662 lines
21 KiB
Rust
662 lines
21 KiB
Rust
use winapi::shared::basetsd::{LONG_PTR, PSIZE_T, SIZE_T, ULONG_PTR};
|
|
use winapi::shared::ntdef::{
|
|
BOOLEAN, HANDLE, LARGE_INTEGER, LIST_ENTRY, LONG, LONGLONG, NTSTATUS, PANSI_STRING, PCSTR,
|
|
PCUNICODE_STRING, PCWSTR, PHANDLE, POBJECT_ATTRIBUTES, PSINGLE_LIST_ENTRY, PSTR, PULONG,
|
|
PUNICODE_STRING, PUSHORT, PVOID, PWSTR, RTL_BALANCED_NODE, SINGLE_LIST_ENTRY, UCHAR, ULONG,
|
|
UNICODE_STRING, USHORT,
|
|
};
|
|
use winapi::um::winnt::{
|
|
ACCESS_MASK, ACTIVATION_CONTEXT, IMAGE_RESOURCE_DIRECTORY_ENTRY, PCIMAGE_DELAYLOAD_DESCRIPTOR,
|
|
PIMAGE_BASE_RELOCATION, PIMAGE_IMPORT_DESCRIPTOR, PIMAGE_RESOURCE_DATA_ENTRY,
|
|
PIMAGE_RESOURCE_DIRECTORY, PIMAGE_RESOURCE_DIRECTORY_STRING, PIMAGE_THUNK_DATA,
|
|
};
|
|
FN!{stdcall PLDR_INIT_ROUTINE(
|
|
DllHandle: PVOID,
|
|
Reason: ULONG,
|
|
Context: PVOID,
|
|
) -> BOOLEAN}
|
|
STRUCT!{struct LDR_SERVICE_TAG_RECORD {
|
|
Next: *mut LDR_SERVICE_TAG_RECORD,
|
|
ServiceTag: ULONG,
|
|
}}
|
|
pub type PLDR_SERVICE_TAG_RECORD = *mut LDR_SERVICE_TAG_RECORD;
|
|
STRUCT!{struct LDRP_CSLIST {
|
|
Tail: PSINGLE_LIST_ENTRY,
|
|
}}
|
|
pub type PLDRP_CSLIST = *mut LDRP_CSLIST;
|
|
ENUM!{enum LDR_DDAG_STATE {
|
|
LdrModulesMerged = -5i32 as u32,
|
|
LdrModulesInitError = -4i32 as u32,
|
|
LdrModulesSnapError = -3i32 as u32,
|
|
LdrModulesUnloaded = -2i32 as u32,
|
|
LdrModulesUnloading = -1i32 as u32,
|
|
LdrModulesPlaceHolder = 0,
|
|
LdrModulesMapping = 1,
|
|
LdrModulesMapped = 2,
|
|
LdrModulesWaitingForDependencies = 3,
|
|
LdrModulesSnapping = 4,
|
|
LdrModulesSnapped = 5,
|
|
LdrModulesCondensed = 6,
|
|
LdrModulesReadyToInit = 7,
|
|
LdrModulesInitializing = 8,
|
|
LdrModulesReadyToRun = 9,
|
|
}}
|
|
UNION!{union LDR_DDAG_NODE_u {
|
|
Dependencies: LDRP_CSLIST,
|
|
RemovalLink: SINGLE_LIST_ENTRY,
|
|
}}
|
|
STRUCT!{struct LDR_DDAG_NODE {
|
|
Modules: LIST_ENTRY,
|
|
ServiceTagList: PLDR_SERVICE_TAG_RECORD,
|
|
LoadCount: ULONG,
|
|
LoadWhileUnloadingCount: ULONG,
|
|
LowestLink: ULONG,
|
|
u: LDR_DDAG_NODE_u,
|
|
IncomingDependencies: LDRP_CSLIST,
|
|
State: LDR_DDAG_STATE,
|
|
CondenseLink: SINGLE_LIST_ENTRY,
|
|
PreorderNumber: ULONG,
|
|
}}
|
|
pub type PLDR_DDAG_NODE = *mut LDR_DDAG_NODE;
|
|
STRUCT!{struct LDR_DEPENDENCY_RECORD {
|
|
DependencyLink: SINGLE_LIST_ENTRY,
|
|
DependencyNode: PLDR_DDAG_NODE,
|
|
IncomingDependencyLink: SINGLE_LIST_ENTRY,
|
|
IncomingDependencyNode: PLDR_DDAG_NODE,
|
|
}}
|
|
pub type PLDR_DEPENDENCY_RECORD = *mut LDR_DEPENDENCY_RECORD;
|
|
ENUM!{enum LDR_DLL_LOAD_REASON {
|
|
LoadReasonStaticDependency = 0,
|
|
LoadReasonStaticForwarderDependency = 1,
|
|
LoadReasonDynamicForwarderDependency = 2,
|
|
LoadReasonDelayloadDependency = 3,
|
|
LoadReasonDynamicLoad = 4,
|
|
LoadReasonAsImageLoad = 5,
|
|
LoadReasonAsDataLoad = 6,
|
|
LoadReasonEnclavePrimary = 7,
|
|
LoadReasonEnclaveDependency = 8,
|
|
LoadReasonUnknown = -1i32 as u32,
|
|
}}
|
|
pub type PLDR_DLL_LOAD_REASON = *mut LDR_DLL_LOAD_REASON;
|
|
pub const LDRP_PACKAGED_BINARY: ULONG = 0x00000001;
|
|
pub const LDRP_STATIC_LINK: ULONG = 0x00000002;
|
|
pub const LDRP_IMAGE_DLL: ULONG = 0x00000004;
|
|
pub const LDRP_LOAD_IN_PROGRESS: ULONG = 0x00001000;
|
|
pub const LDRP_UNLOAD_IN_PROGRESS: ULONG = 0x00002000;
|
|
pub const LDRP_ENTRY_PROCESSED: ULONG = 0x00004000;
|
|
pub const LDRP_ENTRY_INSERTED: ULONG = 0x00008000;
|
|
pub const LDRP_CURRENT_LOAD: ULONG = 0x00010000;
|
|
pub const LDRP_FAILED_BUILTIN_LOAD: ULONG = 0x00020000;
|
|
pub const LDRP_DONT_CALL_FOR_THREADS: ULONG = 0x00040000;
|
|
pub const LDRP_PROCESS_ATTACH_CALLED: ULONG = 0x00080000;
|
|
pub const LDRP_DEBUG_SYMBOLS_LOADED: ULONG = 0x00100000;
|
|
pub const LDRP_IMAGE_NOT_AT_BASE: ULONG = 0x00200000;
|
|
pub const LDRP_COR_IMAGE: ULONG = 0x00400000;
|
|
pub const LDRP_DONT_RELOCATE: ULONG = 0x00800000;
|
|
pub const LDRP_SYSTEM_MAPPED: ULONG = 0x01000000;
|
|
pub const LDRP_IMAGE_VERIFYING: ULONG = 0x02000000;
|
|
pub const LDRP_DRIVER_DEPENDENT_DLL: ULONG = 0x04000000;
|
|
pub const LDRP_ENTRY_NATIVE: ULONG = 0x08000000;
|
|
pub const LDRP_REDIRECTED: ULONG = 0x10000000;
|
|
pub const LDRP_NON_PAGED_DEBUG_INFO: ULONG = 0x20000000;
|
|
pub const LDRP_MM_LOADED: ULONG = 0x40000000;
|
|
pub const LDRP_COMPAT_DATABASE_PROCESSED: ULONG = 0x80000000;
|
|
STRUCT!{struct LDRP_LOAD_CONTEXT {
|
|
BaseDllName: UNICODE_STRING,
|
|
somestruct: PVOID,
|
|
Flags: ULONG,
|
|
pstatus: *mut NTSTATUS,
|
|
ParentEntry: *mut LDR_DATA_TABLE_ENTRY,
|
|
Entry: *mut LDR_DATA_TABLE_ENTRY,
|
|
WorkQueueListEntry: LIST_ENTRY,
|
|
ReplacedEntry: *mut LDR_DATA_TABLE_ENTRY,
|
|
pvImports: *mut *mut LDR_DATA_TABLE_ENTRY,
|
|
ImportDllCount: ULONG,
|
|
TaskCount: LONG,
|
|
pvIAT: PVOID,
|
|
SizeOfIAT: ULONG,
|
|
CurrentDll: ULONG,
|
|
piid: PIMAGE_IMPORT_DESCRIPTOR,
|
|
OriginalIATProtect: ULONG,
|
|
GuardCFCheckFunctionPointer: PVOID,
|
|
pGuardCFCheckFunctionPointer: *mut PVOID,
|
|
}}
|
|
UNION!{union LDR_DATA_TABLE_ENTRY_u1 {
|
|
InInitializationOrderLinks: LIST_ENTRY,
|
|
InProgressLinks: LIST_ENTRY,
|
|
}}
|
|
UNION!{union LDR_DATA_TABLE_ENTRY_u2 {
|
|
FlagGroup: [UCHAR; 4],
|
|
Flags: ULONG,
|
|
}}
|
|
STRUCT!{struct LDR_DATA_TABLE_ENTRY {
|
|
InLoadOrderLinks: LIST_ENTRY,
|
|
InMemoryOrderLinks: LIST_ENTRY,
|
|
u1: LDR_DATA_TABLE_ENTRY_u1,
|
|
DllBase: PVOID,
|
|
EntryPoint: PLDR_INIT_ROUTINE,
|
|
SizeOfImage: ULONG,
|
|
FullDllName: UNICODE_STRING,
|
|
BaseDllName: UNICODE_STRING,
|
|
u2: LDR_DATA_TABLE_ENTRY_u2,
|
|
ObsoleteLoadCount: USHORT,
|
|
TlsIndex: USHORT,
|
|
HashLinks: LIST_ENTRY,
|
|
TimeDateStamp: ULONG,
|
|
EntryPointActivationContext: *mut ACTIVATION_CONTEXT,
|
|
Lock: PVOID,
|
|
DdagNode: PLDR_DDAG_NODE,
|
|
NodeModuleLink: LIST_ENTRY,
|
|
LoadContext: *mut LDRP_LOAD_CONTEXT,
|
|
ParentDllBase: PVOID,
|
|
SwitchBackContext: PVOID,
|
|
BaseAddressIndexNode: RTL_BALANCED_NODE,
|
|
MappingInfoIndexNode: RTL_BALANCED_NODE,
|
|
OriginalBase: ULONG_PTR,
|
|
LoadTime: LARGE_INTEGER,
|
|
BaseNameHashValue: ULONG,
|
|
LoadReason: LDR_DLL_LOAD_REASON,
|
|
ImplicitPathOptions: ULONG,
|
|
ReferenceCount: ULONG,
|
|
DependentLoadFlags: ULONG,
|
|
SigningLevel: UCHAR,
|
|
}}
|
|
BITFIELD!{unsafe LDR_DATA_TABLE_ENTRY_u2 Flags: ULONG [
|
|
PackagedBinary set_PackagedBinary[0..1],
|
|
MarkedForRemoval set_MarkedForRemoval[1..2],
|
|
ImageDll set_ImageDll[2..3],
|
|
LoadNotificationsSent set_LoadNotificationsSent[3..4],
|
|
TelemetryEntryProcessed set_TelemetryEntryProcessed[4..5],
|
|
ProcessStaticImport set_ProcessStaticImport[5..6],
|
|
InLegacyLists set_InLegacyLists[6..7],
|
|
InIndexes set_InIndexes[7..8],
|
|
ShimDll set_ShimDll[8..9],
|
|
InExceptionTable set_InExceptionTable[9..10],
|
|
ReservedFlags1 set_ReservedFlags1[10..12],
|
|
LoadInProgress set_LoadInProgress[12..13],
|
|
LoadConfigProcessed set_LoadConfigProcessed[13..14],
|
|
EntryProcessed set_EntryProcessed[14..15],
|
|
ProtectDelayLoad set_ProtectDelayLoad[15..16],
|
|
ReservedFlags3 set_ReservedFlags3[16..18],
|
|
DontCallForThreads set_DontCallForThreads[18..19],
|
|
ProcessAttachCalled set_ProcessAttachCalled[19..20],
|
|
ProcessAttachFailed set_ProcessAttachFailed[20..21],
|
|
CorDeferredValidate set_CorDeferredValidate[21..22],
|
|
CorImage set_CorImage[22..23],
|
|
DontRelocate set_DontRelocate[23..24],
|
|
CorILOnly set_CorILOnly[24..25],
|
|
ReservedFlags5 set_ReservedFlags5[25..28],
|
|
Redirected set_Redirected[28..29],
|
|
ReservedFlags6 set_ReservedFlags6[29..31],
|
|
CompatDatabaseProcessed set_CompatDatabaseProcessed[31..32],
|
|
]}
|
|
pub type PLDR_DATA_TABLE_ENTRY = *mut LDR_DATA_TABLE_ENTRY;
|
|
#[inline]
|
|
pub const fn LDR_IS_DATAFILE(DllHandle: ULONG_PTR) -> bool {
|
|
DllHandle & 1 != 0
|
|
}
|
|
#[inline]
|
|
pub const fn LDR_IS_IMAGEMAPPING(DllHandle: ULONG_PTR) -> bool {
|
|
DllHandle & 2 != 0
|
|
}
|
|
#[inline]
|
|
pub const fn LDR_IS_RESOURCE(DllHandle: ULONG_PTR) -> bool {
|
|
LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle)
|
|
}
|
|
EXTERN!{extern "system" {
|
|
fn LdrLoadDll(
|
|
DllPath: PWSTR,
|
|
DllCharacteristics: PULONG,
|
|
DllName: PUNICODE_STRING,
|
|
DllHandle: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrUnloadDll(
|
|
DllHandle: PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrGetDllHandle(
|
|
DllPath: PWSTR,
|
|
DllCharacteristics: PULONG,
|
|
DllName: PUNICODE_STRING,
|
|
DllHandle: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
}}
|
|
pub const LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT: ULONG = 0x00000001;
|
|
pub const LDR_GET_DLL_HANDLE_EX_PIN: ULONG = 0x00000002;
|
|
EXTERN!{extern "system" {
|
|
fn LdrGetDllHandleEx(
|
|
Flags: ULONG,
|
|
DllPath: PWSTR,
|
|
DllCharacteristics: PULONG,
|
|
DllName: PUNICODE_STRING,
|
|
DllHandle: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrGetDllHandleByMapping(
|
|
BaseAddress: PVOID,
|
|
DllHandle: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrGetDllHandleByName(
|
|
BaseDllName: PUNICODE_STRING,
|
|
FullDllName: PUNICODE_STRING,
|
|
DllHandle: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrGetDllFullName(
|
|
DllHandle: PVOID,
|
|
FullDllName: PUNICODE_STRING,
|
|
) -> NTSTATUS;
|
|
fn LdrGetDllDirectory(
|
|
DllDirectory: PUNICODE_STRING,
|
|
) -> NTSTATUS;
|
|
fn LdrSetDllDirectory(
|
|
DllDirectory: PUNICODE_STRING,
|
|
) -> NTSTATUS;
|
|
}}
|
|
pub const LDR_ADDREF_DLL_PIN: ULONG = 0x00000001;
|
|
EXTERN!{extern "system" {
|
|
fn LdrAddRefDll(
|
|
Flags: ULONG,
|
|
DllHandle: PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrGetProcedureAddress(
|
|
DllHandle: PVOID,
|
|
ProcedureName: PANSI_STRING,
|
|
ProcedureNumber: ULONG,
|
|
ProcedureAddress: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
}}
|
|
pub const LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER: ULONG = 0x00000001;
|
|
EXTERN!{extern "system" {
|
|
fn LdrGetProcedureAddressEx(
|
|
DllHandle: PVOID,
|
|
ProcedureName: PANSI_STRING,
|
|
ProcedureNumber: ULONG,
|
|
ProcedureAddress: *mut PVOID,
|
|
Flags: ULONG,
|
|
) -> NTSTATUS;
|
|
fn LdrGetKnownDllSectionHandle(
|
|
DllName: PCWSTR,
|
|
KnownDlls32: BOOLEAN,
|
|
Section: PHANDLE,
|
|
) -> NTSTATUS;
|
|
fn LdrGetProcedureAddressForCaller(
|
|
DllHandle: PVOID,
|
|
ProcedureName: PANSI_STRING,
|
|
ProcedureNumber: ULONG,
|
|
ProcedureAddress: *mut PVOID,
|
|
Flags: ULONG,
|
|
Callback: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
}}
|
|
pub const LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS: ULONG = 0x00000001;
|
|
pub const LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY: ULONG = 0x00000002;
|
|
pub const LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID: ULONG = 0;
|
|
pub const LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED: ULONG = 1;
|
|
pub const LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED: ULONG = 2;
|
|
EXTERN!{extern "system" {
|
|
fn LdrLockLoaderLock(
|
|
Flags: ULONG,
|
|
Disposition: *mut ULONG,
|
|
Cookie: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
}}
|
|
pub const LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS: ULONG = 0x00000001;
|
|
EXTERN!{extern "system" {
|
|
fn LdrUnlockLoaderLock(
|
|
Flags: ULONG,
|
|
Cookie: PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrRelocateImage(
|
|
NewBase: PVOID,
|
|
LoaderName: PSTR,
|
|
Success: NTSTATUS,
|
|
Conflict: NTSTATUS,
|
|
Invalid: NTSTATUS,
|
|
) -> NTSTATUS;
|
|
fn LdrRelocateImageWithBias(
|
|
NewBase: PVOID,
|
|
Bias: LONGLONG,
|
|
LoaderName: PSTR,
|
|
Success: NTSTATUS,
|
|
Conflict: NTSTATUS,
|
|
Invalid: NTSTATUS,
|
|
) -> NTSTATUS;
|
|
fn LdrProcessRelocationBlock(
|
|
VA: ULONG_PTR,
|
|
SizeOfBlock: ULONG,
|
|
NextOffset: PUSHORT,
|
|
Diff: LONG_PTR,
|
|
) -> PIMAGE_BASE_RELOCATION;
|
|
fn LdrVerifyMappedImageMatchesChecksum(
|
|
BaseAddress: PVOID,
|
|
NumberOfBytes: SIZE_T,
|
|
FileLength: ULONG,
|
|
) -> BOOLEAN;
|
|
}}
|
|
FN!{stdcall PLDR_IMPORT_MODULE_CALLBACK(
|
|
Parameter: PVOID,
|
|
ModuleName: PSTR,
|
|
) -> ()}
|
|
EXTERN!{extern "system" {
|
|
fn LdrVerifyImageMatchesChecksum(
|
|
ImageFileHandle: HANDLE,
|
|
ImportCallbackRoutine: PLDR_IMPORT_MODULE_CALLBACK,
|
|
ImportCallbackParameter: PVOID,
|
|
ImageCharacteristics: PUSHORT,
|
|
) -> NTSTATUS;
|
|
}}
|
|
STRUCT!{struct LDR_IMPORT_CALLBACK_INFO {
|
|
ImportCallbackRoutine: PLDR_IMPORT_MODULE_CALLBACK,
|
|
ImportCallbackParameter: PVOID,
|
|
}}
|
|
pub type PLDR_IMPORT_CALLBACK_INFO = *mut LDR_IMPORT_CALLBACK_INFO;
|
|
STRUCT!{struct LDR_SECTION_INFO {
|
|
SectionHandle: HANDLE,
|
|
DesiredAccess: ACCESS_MASK,
|
|
ObjA: POBJECT_ATTRIBUTES,
|
|
SectionPageProtection: ULONG,
|
|
AllocationAttributes: ULONG,
|
|
}}
|
|
pub type PLDR_SECTION_INFO = *mut LDR_SECTION_INFO;
|
|
STRUCT!{struct LDR_VERIFY_IMAGE_INFO {
|
|
Size: ULONG,
|
|
Flags: ULONG,
|
|
CallbackInfo: LDR_IMPORT_CALLBACK_INFO,
|
|
SectionInfo: LDR_SECTION_INFO,
|
|
ImageCharacteristics: USHORT,
|
|
}}
|
|
pub type PLDR_VERIFY_IMAGE_INFO = *mut LDR_VERIFY_IMAGE_INFO;
|
|
EXTERN!{extern "system" {
|
|
fn LdrVerifyImageMatchesChecksumEx(
|
|
ImageFileHandle: HANDLE,
|
|
VerifyInfo: PLDR_VERIFY_IMAGE_INFO,
|
|
) -> NTSTATUS;
|
|
fn LdrQueryModuleServiceTags(
|
|
DllHandle: PVOID,
|
|
ServiceTagBuffer: PULONG,
|
|
BufferSize: PULONG,
|
|
) -> NTSTATUS;
|
|
}}
|
|
pub const LDR_DLL_NOTIFICATION_REASON_LOADED: ULONG = 1;
|
|
pub const LDR_DLL_NOTIFICATION_REASON_UNLOADED: ULONG = 2;
|
|
STRUCT!{struct LDR_DLL_LOADED_NOTIFICATION_DATA {
|
|
Flags: ULONG,
|
|
FullDllName: PUNICODE_STRING,
|
|
BaseDllName: PUNICODE_STRING,
|
|
DllBase: PVOID,
|
|
SizeOfImage: ULONG,
|
|
}}
|
|
pub type PLDR_DLL_LOADED_NOTIFICATION_DATA = *mut LDR_DLL_LOADED_NOTIFICATION_DATA;
|
|
STRUCT!{struct LDR_DLL_UNLOADED_NOTIFICATION_DATA {
|
|
Flags: ULONG,
|
|
FullDllName: PCUNICODE_STRING,
|
|
BaseDllName: PCUNICODE_STRING,
|
|
DllBase: PVOID,
|
|
SizeOfImage: ULONG,
|
|
}}
|
|
pub type PLDR_DLL_UNLOADED_NOTIFICATION_DATA = *mut LDR_DLL_UNLOADED_NOTIFICATION_DATA;
|
|
UNION!{union LDR_DLL_NOTIFICATION_DATA {
|
|
Loaded: LDR_DLL_LOADED_NOTIFICATION_DATA,
|
|
Unloaded: LDR_DLL_UNLOADED_NOTIFICATION_DATA,
|
|
}}
|
|
pub type PLDR_DLL_NOTIFICATION_DATA = *mut LDR_DLL_NOTIFICATION_DATA;
|
|
FN!{stdcall PLDR_DLL_NOTIFICATION_FUNCTION(
|
|
NotificationReason: ULONG,
|
|
NotificationData: PLDR_DLL_NOTIFICATION_DATA,
|
|
Context: PVOID,
|
|
) -> ()}
|
|
EXTERN!{extern "system" {
|
|
fn LdrRegisterDllNotification(
|
|
Flags: ULONG,
|
|
NotificationFunction: PLDR_DLL_NOTIFICATION_FUNCTION,
|
|
Context: PVOID,
|
|
Cookie: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrUnregisterDllNotification(
|
|
Cookie: PVOID,
|
|
) -> NTSTATUS;
|
|
}}
|
|
STRUCT!{struct PS_MITIGATION_OPTIONS_MAP {
|
|
Map: [ULONG_PTR; 2],
|
|
}}
|
|
pub type PPS_MITIGATION_OPTIONS_MAP = *mut PS_MITIGATION_OPTIONS_MAP;
|
|
STRUCT!{struct PS_MITIGATION_AUDIT_OPTIONS_MAP {
|
|
Map: [ULONG_PTR; 2],
|
|
}}
|
|
pub type PPS_MITIGATION_AUDIT_OPTIONS_MAP = *mut PS_MITIGATION_AUDIT_OPTIONS_MAP;
|
|
STRUCT!{struct PS_SYSTEM_DLL_INIT_BLOCK {
|
|
Size: ULONG,
|
|
SystemDllWowRelocation: ULONG_PTR,
|
|
SystemDllNativeRelocation: ULONG_PTR,
|
|
Wow64SharedInformation: [ULONG_PTR; 16],
|
|
RngData: ULONG,
|
|
Flags: ULONG,
|
|
MitigationOptionsMap: PS_MITIGATION_OPTIONS_MAP,
|
|
CfgBitMap: ULONG_PTR,
|
|
CfgBitMapSize: ULONG_PTR,
|
|
Wow64CfgBitMap: ULONG_PTR,
|
|
Wow64CfgBitMapSize: ULONG_PTR,
|
|
MitigationAuditOptionsMap: PS_MITIGATION_AUDIT_OPTIONS_MAP,
|
|
}}
|
|
BITFIELD!{PS_SYSTEM_DLL_INIT_BLOCK Flags: ULONG [
|
|
CfgOverride set_CfgOverride[0..1],
|
|
Reserved set_Reserved[1..32],
|
|
]}
|
|
pub type PPS_SYSTEM_DLL_INIT_BLOCK = *mut PS_SYSTEM_DLL_INIT_BLOCK;
|
|
EXTERN!{extern "system" {
|
|
fn LdrSystemDllInitBlock() -> PPS_SYSTEM_DLL_INIT_BLOCK;
|
|
fn LdrAddLoadAsDataTable(
|
|
Module: PVOID,
|
|
FilePath: PWSTR,
|
|
Size: SIZE_T,
|
|
Handle: HANDLE,
|
|
) -> NTSTATUS;
|
|
fn LdrRemoveLoadAsDataTable(
|
|
InitModule: PVOID,
|
|
BaseModule: *mut PVOID,
|
|
Size: PSIZE_T,
|
|
Flags: ULONG,
|
|
) -> NTSTATUS;
|
|
fn LdrGetFileNameFromLoadAsDataTable(
|
|
Module: PVOID,
|
|
pFileNamePrt: *mut PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrDisableThreadCalloutsForDll(
|
|
DllImageBase: PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrAccessResource(
|
|
DllHandle: PVOID,
|
|
ResourceDataEntry: PIMAGE_RESOURCE_DATA_ENTRY,
|
|
ResourceBuffer: *mut PVOID,
|
|
ResourceLength: *mut ULONG,
|
|
) -> NTSTATUS;
|
|
}}
|
|
STRUCT!{struct LDR_RESOURCE_INFO {
|
|
Type: ULONG_PTR,
|
|
Name: ULONG_PTR,
|
|
Language: ULONG_PTR,
|
|
}}
|
|
pub type PLDR_RESOURCE_INFO = *mut LDR_RESOURCE_INFO;
|
|
pub const RESOURCE_TYPE_LEVEL: ULONG = 0;
|
|
pub const RESOURCE_NAME_LEVEL: ULONG = 1;
|
|
pub const RESOURCE_LANGUAGE_LEVEL: ULONG = 2;
|
|
pub const RESOURCE_DATA_LEVEL: ULONG = 3;
|
|
EXTERN!{extern "system" {
|
|
fn LdrFindResource_U(
|
|
DllHandle: PVOID,
|
|
ResourceInfo: PLDR_RESOURCE_INFO,
|
|
Level: ULONG,
|
|
ResourceDataEntry: *mut PIMAGE_RESOURCE_DATA_ENTRY,
|
|
) -> NTSTATUS;
|
|
fn LdrFindResourceDirectory_U(
|
|
DllHandle: PVOID,
|
|
ResourceInfo: PLDR_RESOURCE_INFO,
|
|
Level: ULONG,
|
|
ResourceDirectory: *mut PIMAGE_RESOURCE_DIRECTORY,
|
|
) -> NTSTATUS;
|
|
}}
|
|
STRUCT!{struct LDR_ENUM_RESOURCE_ENTRY_Path_s {
|
|
Id: USHORT,
|
|
NameIsPresent: USHORT,
|
|
}}
|
|
UNION!{union LDR_ENUM_RESOURCE_ENTRY_Path {
|
|
NameOrId: ULONG_PTR,
|
|
Name: PIMAGE_RESOURCE_DIRECTORY_STRING,
|
|
s: LDR_ENUM_RESOURCE_ENTRY_Path_s,
|
|
}}
|
|
STRUCT!{struct LDR_ENUM_RESOURCE_ENTRY {
|
|
Path: [LDR_ENUM_RESOURCE_ENTRY_Path; 3],
|
|
Data: PVOID,
|
|
Size: ULONG,
|
|
Reserved: ULONG,
|
|
}}
|
|
pub type PLDR_ENUM_RESOURCE_ENTRY = *mut LDR_ENUM_RESOURCE_ENTRY;
|
|
#[inline]
|
|
pub unsafe fn NAME_FROM_RESOURCE_ENTRY(
|
|
RootDirectory: PIMAGE_RESOURCE_DIRECTORY,
|
|
Entry: &IMAGE_RESOURCE_DIRECTORY_ENTRY,
|
|
) -> usize {
|
|
if Entry.u.s().NameIsString() != 0 {
|
|
return RootDirectory as usize + Entry.u.s().NameOffset() as usize;
|
|
}
|
|
*Entry.u.Id() as usize
|
|
}
|
|
EXTERN!{extern "system" {
|
|
fn LdrEnumResources(
|
|
DllHandle: PVOID,
|
|
ResourceInfo: PLDR_RESOURCE_INFO,
|
|
Level: ULONG,
|
|
ResourceCount: *mut ULONG,
|
|
Resources: PLDR_ENUM_RESOURCE_ENTRY,
|
|
) -> NTSTATUS;
|
|
fn LdrFindEntryForAddress(
|
|
DllHandle: PVOID,
|
|
Entry: *mut PLDR_DATA_TABLE_ENTRY,
|
|
) -> NTSTATUS;
|
|
}}
|
|
STRUCT!{struct RTL_PROCESS_MODULE_INFORMATION {
|
|
Section: HANDLE,
|
|
MappedBase: PVOID,
|
|
ImageBase: PVOID,
|
|
ImageSize: ULONG,
|
|
Flags: ULONG,
|
|
LoadOrderIndex: USHORT,
|
|
InitOrderIndex: USHORT,
|
|
LoadCount: USHORT,
|
|
OffsetToFileName: USHORT,
|
|
FullPathName: [UCHAR; 256],
|
|
}}
|
|
pub type PRTL_PROCESS_MODULE_INFORMATION = *mut RTL_PROCESS_MODULE_INFORMATION;
|
|
STRUCT!{struct RTL_PROCESS_MODULES {
|
|
NumberOfModules: ULONG,
|
|
Modules: [RTL_PROCESS_MODULE_INFORMATION; 1],
|
|
}}
|
|
pub type PRTL_PROCESS_MODULES = *mut RTL_PROCESS_MODULES;
|
|
STRUCT!{struct RTL_PROCESS_MODULE_INFORMATION_EX {
|
|
NextOffset: USHORT,
|
|
BaseInfo: RTL_PROCESS_MODULE_INFORMATION,
|
|
ImageChecksum: ULONG,
|
|
TimeDateStamp: ULONG,
|
|
DefaultBase: PVOID,
|
|
}}
|
|
pub type PRTL_PROCESS_MODULE_INFORMATION_EX = *mut RTL_PROCESS_MODULE_INFORMATION_EX;
|
|
EXTERN!{extern "system" {
|
|
fn LdrQueryProcessModuleInformation(
|
|
ModuleInformation: PRTL_PROCESS_MODULES,
|
|
Size: ULONG,
|
|
ReturnedSize: PULONG,
|
|
) -> NTSTATUS;
|
|
}}
|
|
FN!{stdcall PLDR_ENUM_CALLBACK(
|
|
ModuleInformation: PLDR_DATA_TABLE_ENTRY,
|
|
Parameter: PVOID,
|
|
Stop: *mut BOOLEAN,
|
|
) -> ()}
|
|
EXTERN!{extern "system" {
|
|
fn LdrEnumerateLoadedModules(
|
|
ReservedFlag: BOOLEAN,
|
|
EnumProc: PLDR_ENUM_CALLBACK,
|
|
Context: PVOID,
|
|
) -> NTSTATUS;
|
|
fn LdrOpenImageFileOptionsKey(
|
|
SubKey: PUNICODE_STRING,
|
|
Wow64: BOOLEAN,
|
|
NewKeyHandle: PHANDLE,
|
|
) -> NTSTATUS;
|
|
fn LdrQueryImageFileKeyOption(
|
|
KeyHandle: HANDLE,
|
|
ValueName: PCWSTR,
|
|
Type: ULONG,
|
|
Buffer: PVOID,
|
|
BufferSize: ULONG,
|
|
ReturnedLength: PULONG,
|
|
) -> NTSTATUS;
|
|
fn LdrQueryImageFileExecutionOptions(
|
|
SubKey: PUNICODE_STRING,
|
|
ValueName: PCWSTR,
|
|
ValueSize: ULONG,
|
|
Buffer: PVOID,
|
|
BufferSize: ULONG,
|
|
ReturnedLength: PULONG,
|
|
) -> NTSTATUS;
|
|
fn LdrQueryImageFileExecutionOptionsEx(
|
|
SubKey: PUNICODE_STRING,
|
|
ValueName: PCWSTR,
|
|
Type: ULONG,
|
|
Buffer: PVOID,
|
|
BufferSize: ULONG,
|
|
ReturnedLength: PULONG,
|
|
Wow64: BOOLEAN,
|
|
) -> NTSTATUS;
|
|
}}
|
|
UNION!{union DELAYLOAD_PROC_DESCRIPTOR_Description {
|
|
Name: PCSTR,
|
|
Ordinal: ULONG,
|
|
}}
|
|
STRUCT!{struct DELAYLOAD_PROC_DESCRIPTOR {
|
|
ImportDescribedByName: ULONG,
|
|
Description: DELAYLOAD_PROC_DESCRIPTOR_Description,
|
|
}}
|
|
pub type PDELAYLOAD_PROC_DESCRIPTOR = *mut DELAYLOAD_PROC_DESCRIPTOR;
|
|
STRUCT!{struct DELAYLOAD_INFO {
|
|
Size: ULONG,
|
|
DelayloadDescriptor: PCIMAGE_DELAYLOAD_DESCRIPTOR,
|
|
ThunkAddress: PIMAGE_THUNK_DATA,
|
|
TargetDllName: PCSTR,
|
|
TargetApiDescriptor: DELAYLOAD_PROC_DESCRIPTOR,
|
|
TargetModuleBase: PVOID,
|
|
Unused: PVOID,
|
|
LastError: ULONG,
|
|
}}
|
|
pub type PDELAYLOAD_INFO = *mut DELAYLOAD_INFO;
|
|
FN!{stdcall PDELAYLOAD_FAILURE_DLL_CALLBACK(
|
|
NotificationReason: ULONG,
|
|
DelayloadInfo: PDELAYLOAD_INFO,
|
|
) -> PVOID}
|
|
FN!{stdcall PDELAYLOAD_FAILURE_SYSTEM_ROUTINE(
|
|
DllName: PCSTR,
|
|
ProcName: PCSTR,
|
|
) -> PVOID}
|
|
EXTERN!{extern "system" {
|
|
fn LdrResolveDelayLoadedAPI(
|
|
ParentModuleBase: PVOID,
|
|
DelayloadDescriptor: PCIMAGE_DELAYLOAD_DESCRIPTOR,
|
|
FailureDllHook: PDELAYLOAD_FAILURE_DLL_CALLBACK,
|
|
FailureSystemHook: PDELAYLOAD_FAILURE_SYSTEM_ROUTINE,
|
|
ThunkAddress: PIMAGE_THUNK_DATA,
|
|
Flags: ULONG,
|
|
) -> PVOID;
|
|
fn LdrResolveDelayLoadsFromDll(
|
|
ParentBase: PVOID,
|
|
TargetDllName: PCSTR,
|
|
Flags: ULONG,
|
|
) -> NTSTATUS;
|
|
fn LdrSetDefaultDllDirectories(
|
|
DirectoryFlags: ULONG,
|
|
) -> NTSTATUS;
|
|
fn LdrShutdownProcess() -> NTSTATUS;
|
|
fn LdrShutdownThread() -> NTSTATUS;
|
|
fn LdrSetImplicitPathOptions(
|
|
ImplicitPathOptions: ULONG,
|
|
) -> NTSTATUS;
|
|
fn LdrControlFlowGuardEnforced() -> BOOLEAN;
|
|
}}
|