Upload files to "src/headers"
This commit is contained in:
parent
52068d5f60
commit
a315e79dae
65
src/headers/enums.h
Normal file
65
src/headers/enums.h
Normal file
@ -0,0 +1,65 @@
|
||||
#pragma once
|
||||
|
||||
#ifndef ENUMS_H
|
||||
#define ENUMS_H
|
||||
|
||||
/*
|
||||
* Define enumerations
|
||||
*/
|
||||
typedef enum _SYSTEM_INFORMATION_CLASS {
|
||||
SystemBasicInformation = 0,
|
||||
SystemPerformanceInformation = 2,
|
||||
SystemTimeOfDayInformation = 3,
|
||||
SystemProcessInformation = 5,
|
||||
SystemProcessorPerformanceInformation = 8,
|
||||
SystemHandleInformation = 16,
|
||||
SystemInterruptInformation = 23,
|
||||
SystemExceptionInformation = 33,
|
||||
SystemRegistryQuotaInformation = 37,
|
||||
SystemLookasideInformation = 45
|
||||
} SYSTEM_INFORMATION_CLASS,
|
||||
*PSYSTEM_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _POOL_TYPE {
|
||||
NonPagedPool,
|
||||
PagedPool,
|
||||
NonPagedPoolMustSucceed,
|
||||
DontUseThisType,
|
||||
NonPagedPoolCacheAligned,
|
||||
PagedPoolCacheAligned,
|
||||
NonPagedPoolCacheAlignedMustS
|
||||
} POOL_TYPE,
|
||||
*PPOOL_TYPE;
|
||||
|
||||
typedef enum _OBJECT_INFORMATION_CLASS {
|
||||
ObjectBasicInformation,
|
||||
ObjectNameInformation,
|
||||
ObjectTypeInformation,
|
||||
ObjectAllInformation,
|
||||
ObjectDataInformation
|
||||
} OBJECT_INFORMATION_CLASS,
|
||||
*POBJECT_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _THREADINFOCLASS {
|
||||
ThreadBasicInformation,
|
||||
ThreadTimes,
|
||||
ThreadPriority,
|
||||
ThreadBasePriority,
|
||||
ThreadAffinityMask,
|
||||
ThreadImpersonationToken,
|
||||
ThreadDescriptorTableEntry,
|
||||
ThreadEnableAlignmentFaultFixup,
|
||||
ThreadEventPair,
|
||||
ThreadQuerySetWin32StartAddress,
|
||||
ThreadZeroTlsCell,
|
||||
ThreadPerformanceCount,
|
||||
ThreadAmILastThread,
|
||||
ThreadIdealProcessor,
|
||||
ThreadPriorityBoost,
|
||||
ThreadSetTlsArrayAddress,
|
||||
ThreadIsIoPending,
|
||||
ThreadHideFromDebugger
|
||||
} THREADINFOCLASS,
|
||||
*PTHREADINFOCLASS;
|
||||
|
||||
#endif
|
||||
22
src/headers/includes.h
Normal file
22
src/headers/includes.h
Normal file
@ -0,0 +1,22 @@
|
||||
#pragma once
|
||||
|
||||
#ifndef INCLUDES_H
|
||||
#define INCLUDES_H
|
||||
|
||||
#include <vector>
|
||||
#include <random>
|
||||
|
||||
#include <windows.h>
|
||||
#include <winevt.h>
|
||||
#include <sddl.h>
|
||||
#include <processsnapshot.h>
|
||||
#include <dbghelp.h>
|
||||
#include <evntprov.h>
|
||||
|
||||
#include "enums.h"
|
||||
#include "structs.h"
|
||||
#include "syscalls.h"
|
||||
|
||||
#pragma comment(lib, "wevtapi.lib")
|
||||
|
||||
#endif
|
||||
183
src/headers/structs.h
Normal file
183
src/headers/structs.h
Normal file
@ -0,0 +1,183 @@
|
||||
#pragma once
|
||||
|
||||
#ifndef STRUCTS_H
|
||||
#define STRUCTS_H
|
||||
|
||||
/*
|
||||
* Define custom structs
|
||||
*/
|
||||
typedef struct _SYSCALL_ENTRY {
|
||||
PVOID Address;
|
||||
unsigned long Hash;
|
||||
SIZE_T Size;
|
||||
} SYSCALL_ENTRY,
|
||||
* PSYSCALL_ENTRY;
|
||||
|
||||
/*
|
||||
* Define PEB/Syscall structs
|
||||
*/
|
||||
typedef struct _UNICODE_STRING {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PWSTR Buffer;
|
||||
} UNICODE_STRING,
|
||||
* PUNICODE_STRING;
|
||||
|
||||
typedef struct _PEB_LDR_DATA {
|
||||
ULONG Length;
|
||||
BOOLEAN Initialized;
|
||||
PVOID SsHandle;
|
||||
LIST_ENTRY InLoadOrderModuleList;
|
||||
LIST_ENTRY InMemoryOrderModuleList;
|
||||
LIST_ENTRY InInitializationOrderModuleList;
|
||||
PVOID EntryInProgress;
|
||||
BOOLEAN ShutdownInProgress;
|
||||
PVOID ShutdownThreadId;
|
||||
} PEB_LDR_DATA,
|
||||
* PPEB_LDR_DATA;
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
LIST_ENTRY InLoadOrderLinks;
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
LIST_ENTRY InInitializationOrderLinks;
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
ULONG SizeOfImage;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
ULONG Flags;
|
||||
USHORT LoadCount;
|
||||
USHORT TlsIndex;
|
||||
LIST_ENTRY HashLinks;
|
||||
ULONG TimeDateStamp;
|
||||
} LDR_DATA_TABLE_ENTRY,
|
||||
* PLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
typedef struct _PEB {
|
||||
BOOLEAN InheritedAddressSpace;
|
||||
BOOLEAN ReadImageFileExecOptions;
|
||||
BOOLEAN BeingDebugged;
|
||||
BOOLEAN BitField;
|
||||
HANDLE Mutant;
|
||||
PVOID ImageBaseAddress;
|
||||
PPEB_LDR_DATA Ldr;
|
||||
// ... other members are not relevant
|
||||
} PEB,
|
||||
* PPEB;
|
||||
|
||||
typedef struct _OBJECT_ATTRIBUTES {
|
||||
ULONG Length;
|
||||
HANDLE RootDirectory;
|
||||
PUNICODE_STRING ObjectName;
|
||||
ULONG Attributes;
|
||||
PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR
|
||||
PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE
|
||||
} OBJECT_ATTRIBUTES,
|
||||
* POBJECT_ATTRIBUTES;
|
||||
|
||||
typedef struct _CLIENT_ID {
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
} CLIENT_ID,
|
||||
* PCLIENT_ID;
|
||||
|
||||
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
|
||||
USHORT UniqueProcessId;
|
||||
USHORT CreatorBackTraceIndex;
|
||||
UCHAR ObjectTypeIndex;
|
||||
UCHAR HandleAttributes;
|
||||
USHORT HandleValue;
|
||||
PVOID Object;
|
||||
ULONG GrantedAccess;
|
||||
} SYSTEM_HANDLE_TABLE_ENTRY_INFO,
|
||||
* PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
|
||||
|
||||
typedef struct _SYSTEM_HANDLE_INFORMATION {
|
||||
ULONG NumberOfHandles;
|
||||
SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
|
||||
} SYSTEM_HANDLE_INFORMATION,
|
||||
* PSYSTEM_HANDLE_INFORMATION;
|
||||
|
||||
typedef LONG KPRIORITY;
|
||||
|
||||
typedef struct _SYSTEM_THREAD_INFORMATION {
|
||||
LARGE_INTEGER KernelTime;
|
||||
LARGE_INTEGER UserTime;
|
||||
LARGE_INTEGER CreateTime;
|
||||
ULONG WaitTime;
|
||||
PVOID StartAddress;
|
||||
CLIENT_ID ClientId;
|
||||
KPRIORITY Priority;
|
||||
LONG BasePriority;
|
||||
ULONG ContextSwitches;
|
||||
ULONG ThreadState;
|
||||
ULONG WaitReason;
|
||||
} SYSTEM_THREAD_INFORMATION,
|
||||
* PSYSTEM_THREAD_INFORMATION;
|
||||
|
||||
typedef struct _SYSTEM_PROCESS_INFORMATION {
|
||||
ULONG NextEntryOffset;
|
||||
ULONG NumberOfThreads;
|
||||
LARGE_INTEGER WorkingSetPrivateSize;
|
||||
ULONG HardFaultCount;
|
||||
ULONG NumberOfThreadsHighWatermark;
|
||||
ULONGLONG CycleTime;
|
||||
LARGE_INTEGER CreateTime;
|
||||
LARGE_INTEGER UserTime;
|
||||
LARGE_INTEGER KernelTime;
|
||||
UNICODE_STRING ImageName;
|
||||
KPRIORITY BasePriority;
|
||||
HANDLE UniqueProcessId;
|
||||
HANDLE InheritedFromUniqueProcessId;
|
||||
ULONG HandleCount;
|
||||
ULONG SessionId;
|
||||
ULONG_PTR UniqueProcessKey;
|
||||
SIZE_T PeakVirtualSize;
|
||||
SIZE_T VirtualSize;
|
||||
ULONG PageFaultCount;
|
||||
SIZE_T PeakWorkingSetSize;
|
||||
SIZE_T WorkingSetSize;
|
||||
SIZE_T QuotaPeakPagedPoolUsage;
|
||||
SIZE_T QuotaPagedPoolUsage;
|
||||
SIZE_T QuotaPeakNonPagedPoolUsage;
|
||||
SIZE_T QuotaNonPagedPoolUsage;
|
||||
SIZE_T PagefileUsage;
|
||||
SIZE_T PeakPagefileUsage;
|
||||
SIZE_T PrivatePageCount;
|
||||
LARGE_INTEGER ReadOperationCount;
|
||||
LARGE_INTEGER WriteOperationCount;
|
||||
LARGE_INTEGER OtherOperationCount;
|
||||
LARGE_INTEGER ReadTransferCount;
|
||||
LARGE_INTEGER WriteTransferCount;
|
||||
LARGE_INTEGER OtherTransferCount;
|
||||
SYSTEM_THREAD_INFORMATION Threads[1];
|
||||
} SYSTEM_PROCESS_INFORMATION,
|
||||
* PSYSTEM_PROCESS_INFORMATION;
|
||||
|
||||
typedef struct _OBJECT_TYPE_INFORMATION {
|
||||
UNICODE_STRING Name;
|
||||
ULONG TotalNumberOfObjects;
|
||||
ULONG TotalNumberOfHandles;
|
||||
ULONG TotalPagedPoolUsage;
|
||||
ULONG TotalNonPagedPoolUsage;
|
||||
ULONG TotalNamePoolUsage;
|
||||
ULONG TotalHandleTableUsage;
|
||||
ULONG HighWaterNumberOfObjects;
|
||||
ULONG HighWaterNumberOfHandles;
|
||||
ULONG HighWaterPagedPoolUsage;
|
||||
ULONG HighWaterNonPagedPoolUsage;
|
||||
ULONG HighWaterNamePoolUsage;
|
||||
ULONG HighWaterHandleTableUsage;
|
||||
ULONG InvalidAttributes;
|
||||
GENERIC_MAPPING GenericMapping;
|
||||
ULONG ValidAccess;
|
||||
BOOLEAN SecurityRequired;
|
||||
BOOLEAN MaintainHandleCount;
|
||||
USHORT MaintainTypeList;
|
||||
POOL_TYPE PoolType;
|
||||
ULONG PagedPoolUsage;
|
||||
ULONG NonPagedPoolUsage;
|
||||
} OBJECT_TYPE_INFORMATION,
|
||||
* POBJECT_TYPE_INFORMATION;
|
||||
|
||||
#endif
|
||||
124
src/headers/syscalls.h
Normal file
124
src/headers/syscalls.h
Normal file
@ -0,0 +1,124 @@
|
||||
#pragma once
|
||||
|
||||
#ifndef SYSCALLS_H
|
||||
#define SYSCALLS_H
|
||||
|
||||
/*
|
||||
* Define syscalls
|
||||
*/
|
||||
|
||||
extern "C" void SetJumpAddress(uintptr_t jumpAddress);
|
||||
|
||||
EXTERN_C NTSTATUS NtReadVirtualMemory(
|
||||
HANDLE ProcessHandle,
|
||||
PVOID BaseAddress,
|
||||
PVOID Buffer,
|
||||
ULONG NumberOfBytesToRead,
|
||||
PULONG NumberOfBytesReaded,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtWriteVirtualMemory(
|
||||
HANDLE ProcessHandle,
|
||||
PVOID BaseAddress,
|
||||
PVOID Buffer,
|
||||
ULONG NumberOfBytesToWrite,
|
||||
PULONG NumberOfBytesWritten,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtProtectVirtualMemory(
|
||||
HANDLE ProcessHandle,
|
||||
PVOID* BaseAddress,
|
||||
PSIZE_T NumberOfBytesToProtect,
|
||||
ULONG NewAccessProtection,
|
||||
PULONG OldAccessProtection,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtOpenProcess(
|
||||
PHANDLE ProcessHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
PCLIENT_ID ClientId,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtDuplicateObject(
|
||||
HANDLE SourceProcessHandle,
|
||||
HANDLE SourceHandle,
|
||||
HANDLE TargetProcessHandle,
|
||||
PHANDLE TargetHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
ULONG HandleAttributes,
|
||||
ULONG Options,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtQueryObject(
|
||||
HANDLE ObjectHandle,
|
||||
OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
PVOID ObjectInformation,
|
||||
ULONG Length,
|
||||
PULONG ResultLength,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtOpenProcessToken(
|
||||
HANDLE ProcessHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
PHANDLE TokenHandle,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtQueryInformationToken(
|
||||
HANDLE TokenHandle,
|
||||
TOKEN_INFORMATION_CLASS TokenInformationClass,
|
||||
PVOID TokenInformation,
|
||||
ULONG TokenInformationLength,
|
||||
PULONG ReturnLength,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtAdjustPrivilegesToken(
|
||||
HANDLE TokenHandle,
|
||||
BOOLEAN DisableAllPrivileges,
|
||||
PTOKEN_PRIVILEGES TokenPrivileges,
|
||||
ULONG PreviousPrivilegesLength,
|
||||
PTOKEN_PRIVILEGES PreviousPrivileges,
|
||||
PULONG RequiredLength,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtDuplicateToken(
|
||||
HANDLE ExistingToken,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
BOOLEAN EffectiveOnly,
|
||||
TOKEN_TYPE TokenType,
|
||||
PHANDLE NewToken,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtQuerySystemInformation(
|
||||
SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
PVOID SystemInformation,
|
||||
ULONG SystemInformationLength,
|
||||
PULONG ReturnLength,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtClose(
|
||||
HANDLE Handle,
|
||||
int SSN
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS NtSetInformationThread(
|
||||
HANDLE ThreadHandle,
|
||||
THREADINFOCLASS ThreadInformationClass,
|
||||
PVOID ThreadInformation,
|
||||
ULONG ThreadInformationLength,
|
||||
int SSN
|
||||
);
|
||||
|
||||
#endif
|
||||
Loading…
x
Reference in New Issue
Block a user