AuroraRuntime/Source/AuProcAddresses.NT.hpp

782 lines
26 KiB
C++
Raw Normal View History

/***
Copyright (C) 2023 J Reece Wilson (a/k/a "Reece"). All rights reserved.
File: AuProcAddresses.NT.hpp
Date: 2023-2-16
Author: Reece
***/
#pragma once
struct _PROCESS_MEMORY_COUNTERS;
struct _tagSTACKFRAME64;
struct _MINIDUMP_EXCEPTION_INFORMATION;
struct _MINIDUMP_USER_STREAM_INFORMATION;
struct _IMAGEHLP_LINE64;
struct _tagADDRESS64;
struct _MINIDUMP_CALLBACK_INFORMATION;
struct _MIB_IPADDRTABLE;
struct _IP_ADAPTER_INFO;
struct _CREATEFILE2_EXTENDED_PARAMETERS;
struct _EXPLICIT_ACCESS_A;
struct _ACL;
enum _SE_OBJECT_TYPE;
enum _MINIDUMP_TYPE;
#if defined(AURORA_COMPILER_MSVC)
struct _IP_ADAPTER_ADDRESSES_LH;
struct _IP_ADAPTER_ADDRESSES_XP;
#if (NTDDI_VERSION >= NTDDI_VISTA)
typedef _IP_ADAPTER_ADDRESSES_LH IP_ADAPTER_ADDRESSES;
typedef _IP_ADAPTER_ADDRESSES_LH *PIP_ADAPTER_ADDRESSES;
#elif (NTDDI_VERSION >= NTDDI_WINXP)
typedef _IP_ADAPTER_ADDRESSES_XP IP_ADAPTER_ADDRESSES;
typedef _IP_ADAPTER_ADDRESSES_XP *PIP_ADAPTER_ADDRESSES;
#else
typedef _IP_ADAPTER_ADDRESSES_XP IP_ADAPTER_ADDRESSES;
typedef _IP_ADAPTER_ADDRESSES_XP *PIP_ADAPTER_ADDRESSES;
#endif
#endif
namespace Aurora
{
void InitNTAddresses();
static const wchar_t *kSyncDllName { L"API-MS-Win-Core-Synch-l1-2-0.dll" };
static const wchar_t *kNtDllName { L"NTDLL.dll" };
static const wchar_t *kKernel32DllName { L"Kernel32.dll" };
static const wchar_t *kKernelBaseDllName { L"KernelBase.dll" };
static const wchar_t *kWS2DllName { L"Ws2_32.dll" };
static const wchar_t *kAdvancedApiDllName { L"Advapi32.dll" };
static const wchar_t *kBCryptDllName { L"bcrypt.dll" };
static const wchar_t *kThemeDllName { L"UxTheme.dll" };
static const wchar_t *kShellDllName { L"Shell32.dll" };
static const wchar_t *kPSAPILegacyDllName { L"psapi.dll" };
static const wchar_t *kDbgHelperDllName { L"dbghelp.dll" };
static const wchar_t *kWinTrustDllName { L"WINTRUST.dll" };
static const wchar_t *kIPHelperDllName { L"IPHLPAPI.dll" };
static const wchar_t *kCOMDllName { L"ole32.dll" };
static const wchar_t *kUser32DllName { L"User32.dll" };
struct WIN32_MEMORY_RANGE_ENTRY2
{
PVOID VirtualAddress;
SIZE_T NumberOfBytes;
};
enum class THREAD_INFORMATION_CLASS
{
ThreadMemoryPriority,
ThreadAbsoluteCpuPriority,
ThreadDynamicCodePolicy,
ThreadPowerThrottling,
ThreadInformationClassMax
};
inline BOOL(__stdcall *pWaitOnAddress)(
volatile VOID * Address,
PVOID CompareAddress,
SIZE_T AddressSize,
DWORD dwMilliseconds
);
inline void(__stdcall *pWakeByAddressSingle)(
PVOID Address
);
inline void(__stdcall *pWakeByAddressAll)(
PVOID Address
);
inline DWORD(__stdcall *pNtDelayExecution)(
BOOLEAN Alertable,
PLARGE_INTEGER DelayInterval
);
inline PVOID(__stdcall *pVirtualAlloc2)(
HANDLE Process,
PVOID BaseAddress,
SIZE_T Size,
ULONG AllocationType,
ULONG PageProtection,
MEM_EXTENDED_PARAMETER * ExtendedParameters,
ULONG ParameterCount
);
inline PVOID(__stdcall *pMapViewOfFile3)(
HANDLE FileMapping,
HANDLE Process,
PVOID BaseAddress,
ULONG64 Offset,
SIZE_T ViewSize,
ULONG AllocationType,
ULONG PageProtection,
MEM_EXTENDED_PARAMETER * ExtendedParameters,
ULONG ParameterCount
);
inline PVOID(__stdcall *pUnmapViewOfFile2)(
HANDLE Process,
PVOID BaseAddress,
ULONG UnmapFlags
);
inline NTSTATUS(__stdcall *pNtWaitForKeyedEvent)(
HANDLE Handle,
PVOID Key,
BOOLEAN Alertable,
PLARGE_INTEGER NTTimeout
);
inline NTSTATUS(__stdcall *pNtReleaseKeyedEvent)(
HANDLE Handle,
PVOID Key,
BOOLEAN Alertable,
PLARGE_INTEGER NTTimeout
);
inline NTSTATUS(__stdcall *pNtCreateKeyedEvent)(
HANDLE Handle,
ACCESS_MASK Access,
POBJECT_ATTRIBUTES Attr,
ULONG Flags
);
inline NTSTATUS(__stdcall *pNtOpenKeyedEvent)(
HANDLE Handle,
ACCESS_MASK Access,
POBJECT_ATTRIBUTES Attr,
ULONG Flags
);
inline NTSTATUS(__stdcall *pRtlWaitOnAddress)(
const void * addr,
const void * cmp,
SIZE_T size,
2023-09-09 14:29:12 +00:00
const LARGE_INTEGER * timeout
);
inline void(__stdcall *pRtlWakeByAddressAll)(
const void * addr
);
inline void(__stdcall *pRtlWakeAddressSingle)(
const void * addr
);
#if defined(AURORA_PLATFORM_WIN32)
inline NTSTATUS(__stdcall *pRtlGetVersion)(
PRTL_OSVERSIONINFOW lpVersionInformation
);
#endif
2023-09-13 13:17:45 +00:00
inline HANDLE(__stdcall *pCreateFile2W)(
LPCWSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
DWORD dwCreationDisposition,
_CREATEFILE2_EXTENDED_PARAMETERS *pCreateExParams
);
inline HANDLE(__stdcall *pCreateFileW)(
LPCWSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile
);
inline NTSTATUS(__stdcall *pNtNotifyChangeDirectoryFile)(
HANDLE FileHandle,
HANDLE Event,
PIO_APC_ROUTINE ApcRoutine,
PVOID ApcContext,
PIO_STATUS_BLOCK IoStatusBlock,
PVOID Buffer,
ULONG BufferSize,
ULONG CompletionFilter,
BOOLEAN WatchTree
);
inline NTSTATUS(__stdcall *pNtTerminateProcess)(
HANDLE ProcessHandle,
NTSTATUS ExitStatus
);
inline BOOL(__stdcall *pGetSystemCpuSetInformation)(
PSYSTEM_CPU_SET_INFORMATION Information,
ULONG BufferLength,
PULONG ReturnedLength,
HANDLE Process,
ULONG Flags
);
inline BOOL(__stdcall *pGetLogicalProcessorInformation)(
PSYSTEM_LOGICAL_PROCESSOR_INFORMATION Buffer,
PDWORD ReturnedLength
);
inline HRESULT(__stdcall *pSetThreadDescription)(
HANDLE hThread,
PCWSTR lpThreadDescription
);
inline BOOL(__stdcall *pSetThreadInformation)(
HANDLE hThread,
THREAD_INFORMATION_CLASS ThreadInformationClass,
LPVOID ThreadInformation,
DWORD ThreadInformationSize
);
inline BOOL(__stdcall *pSetThreadSelectedCpuSets)(
HANDLE Thread,
const ULONG * CpuSetIds,
ULONG CpuSetIdCount
);
#if defined(AURORA_PLATFORM_WIN32)
inline BOOL(__stdcall *pSetThreadGroupAffinity)(
HANDLE hThread,
GROUP_AFFINITY * GroupAffinity,
PGROUP_AFFINITY PreviousGroupAffinity
);
#endif
inline BOOL(__stdcall *pRemoveDllDirectory)(
PVOID Cookie
);
inline PVOID(__stdcall *pAddDllDirectory)(
PCWSTR NewDirectory
);
inline INT(__stdcall *pGetAddrInfoExCancel)(
LPHANDLE lpHandle
);
using LPLOOKUPSERVICE_COMPLETION_ROUTINE = void(__stdcall *)(
DWORD dwError,
DWORD dwBytes,
LPWSAOVERLAPPED lpOverlapped
);
inline INT(__stdcall *pGetAddrInfoExW)(
PCWSTR pName,
PCWSTR pServiceName,
DWORD dwNameSpace,
LPGUID lpNspId,
const ADDRINFOEXW * hints,
PADDRINFOEXW * ppResult,
struct timeval * timeout,
LPOVERLAPPED lpOverlapped,
LPLOOKUPSERVICE_COMPLETION_ROUTINE lpCompletionRoutine,
LPHANDLE lpHandle
);
inline void(__stdcall *pFreeAddrInfoExW)(
PADDRINFOEXW pAddrInfoEx
);
inline INT(__stdcall *pgetaddrinfo)(
PCSTR pNodeName,
PCSTR pServiceName,
const ADDRINFOA * pHints,
PADDRINFOA * ppResult
);
inline void(__stdcall *pfreeaddrinfo)(
PADDRINFOA pAddrInfo
);
inline BOOL(__stdcall *pPrefetchVirtualMemory)(
HANDLE hProcess,
ULONG_PTR NumberOfEntries,
WIN32_MEMORY_RANGE_ENTRY2 * VirtualAddresses,
ULONG Flags
);
inline BOOL(__stdcall *pCryptGenRandom)(
ULONG_PTR hProv,
DWORD dwLen,
BYTE *pbBuffer
);
inline NTSTATUS(__stdcall *pZwSetTimerResolution)(
ULONG RequestedResolution,
BOOLEAN Set,
PULONG ActualResolution
);
inline BOOLEAN(__stdcall *pRtlGenRandom)(
PVOID RandomBuffer,
ULONG RandomBufferLength
);
#if defined(AURORA_PLATFORM_WIN32)
inline NTSTATUS(__stdcall *pNtQueryInformationProcess)(
HANDLE ProcessHandle,
PROCESSINFOCLASS ProcessInformationClass,
PVOID ProcessInformation,
ULONG ProcessInformationLength,
PULONG ReturnLength
);
#endif
inline ULONGLONG(__stdcall *pVerSetConditionMask)(
ULONGLONG ConditionMask,
DWORD TypeMask,
BYTE Condition
);
inline BOOL(__stdcall *pVerifyVersionInfoW)(
LPOSVERSIONINFOEXW dwTypeMask,
DWORD TypeMask,
DWORDLONG dwlConditionMask
);
inline HRESULT(__stdcall *pSetWindowTheme)(
HWND hwnd,
LPCWSTR pszSubAppName,
LPCWSTR pszSubIdList
);
inline HANDLE(__stdcall *pFindFirstStreamW)(
LPCWSTR lpFileName,
STREAM_INFO_LEVELS InfoLevel,
LPVOID lpFindStreamData,
DWORD dwFlags
);
inline BOOL(__stdcall *pFindNextStreamW)(
HANDLE hFindStream,
LPVOID lpFindStreamData
);
inline BOOL(__stdcall *pFindClose)(
HANDLE hFindFile
);
inline BOOL(__stdcall *pCancelIoEx)(
HANDLE hFile,
LPOVERLAPPED lpOverlapped
);
inline BOOL(__stdcall *pCancelSynchronousIo)(
HANDLE hThread
);
#if 0
inline BOOL(__stdcall *pQueryPerformanceCounter)(
LARGE_INTEGER * lpPerformanceCount
);
inline BOOL(__stdcall *pQueryPerformanceFrequency)(
LARGE_INTEGER * lpPerformanceCount
);
#else // no one will notice
inline BOOL(__stdcall *pQueryPerformanceCounter)(
long long * lpPerformanceCount
);
inline BOOL(__stdcall *pQueryPerformanceFrequency)(
long long * lpPerformanceCount
);
#endif
inline BOOL(__stdcall *pGetProcessMemoryInfo)(
HANDLE Process,
::_PROCESS_MEMORY_COUNTERS *ppsmemCounters,
DWORD cb
);
inline BOOL(__stdcall *pSetFileInformationByHandle)(
HANDLE hFile,
FILE_INFO_BY_HANDLE_CLASS FileInformationClass,
LPVOID lpFileInformation,
DWORD dwBufferSize
);
inline int(__stdcall *pGetLocaleInfoEx)(
LPCWSTR lpLocaleName,
LCTYPE LCType,
LPWSTR lpLCData,
int cchData
);
inline int(__stdcall *pLCIDToLocaleName)(
LCID Locale,
LPWSTR lpName,
int cchName,
DWORD dwFlags
);
inline int(__stdcall *pGetLocaleInfoW)(
LCID Locale,
LCTYPE LCType,
LPWSTR lpLCData,
int cchData
);
inline DWORD(__stdcall *pGetThreadId)(
HANDLE hThread
);
inline NTSTATUS(__stdcall *pBCryptGenRandom)(
PVOID hAlgorithm,
PUCHAR pbBuffer,
ULONG cbBuffer,
ULONG dwFlags
);
// dbghelp
inline DWORD(__stdcall *pUnDecorateSymbolName)(
PCSTR name,
PSTR outputString,
DWORD maxStringLength,
DWORD flags
);
inline BOOL(__stdcall *pMiniDumpWriteDump)(
HANDLE hProcess,
DWORD ProcessId,
HANDLE hFile,
enum _MINIDUMP_TYPE DumpType,
_MINIDUMP_EXCEPTION_INFORMATION * ExceptionParam,
_MINIDUMP_USER_STREAM_INFORMATION * UserStreamParam,
_MINIDUMP_CALLBACK_INFORMATION * CallbackParam
);
inline BOOL(__stdcall *pSymInitialize)(
HANDLE hProcess,
PCSTR UserSearchPath,
BOOL fInvadeProcess
);
inline DWORD64(__stdcall *pSymGetModuleBase64)(
HANDLE hProcess,
DWORD64 qwAddr
);
inline BOOL(__stdcall *pSymGetLineFromAddr64)(
HANDLE hProcess,
DWORD64 qwAddr,
PDWORD pdwDisplacement,
_IMAGEHLP_LINE64 * Line64
);
inline PVOID(__stdcall *pSymFunctionTableAccess64)(
HANDLE hProcess,
DWORD64 AddrBase
);
typedef BOOL(__stdcall *PREAD_PROCESS_MEMORY_ROUTINE64)(
HANDLE hProcess,
DWORD64 qwBaseAddress,
PVOID lpBuffer,
DWORD nSize,
LPDWORD lpNumberOfBytesRead
);
typedef PVOID (__stdcall *PFUNCTION_TABLE_ACCESS_ROUTINE64)(
HANDLE hProcess,
DWORD64 AddrBase
);
typedef DWORD64(__stdcall *PGET_MODULE_BASE_ROUTINE64)(
HANDLE hProcess,
DWORD64 Address
);
typedef DWORD64 (__stdcall *PTRANSLATE_ADDRESS_ROUTINE64)(
HANDLE hProcess,
HANDLE hThread,
_tagADDRESS64 * lpaddr
);
inline BOOL(__stdcall *pStackWalk64)(
DWORD MachineType,
HANDLE hProcess,
HANDLE hThread,
_tagSTACKFRAME64 * StackFrame,
PVOID ContextRecord,
PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine,
PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine,
PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine,
PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress
);
// WINTRUST
inline BOOL(__stdcall *pWinVerifyTrust)(
HWND hwnd,
GUID * pgActionID,
LPVOID pWVTData
);
// IP Helper
inline ULONG(__stdcall *pGetAdaptersAddresses)(
ULONG Family,
ULONG Flags,
PVOID Reserved,
IP_ADAPTER_ADDRESSES * AdapterAddresses,
PULONG SizePointer
);
inline ULONG(__stdcall *pGetAdaptersInfo)(
_IP_ADAPTER_INFO * AdapterInfo,
PULONG SizePointer
);
// COM
inline HRESULT(__stdcall *pCoInitializeEx)(
LPVOID pvReserved,
DWORD dwCoInit
);
inline void(__stdcall *pCoTaskMemFree)(
LPVOID pv
);
inline void(__stdcall *pCoUninitialize)();
// Shell
inline HRESULT(__stdcall *pSHGetKnownFolderPath)(
const GUID &rfid,
DWORD dwFlags,
HANDLE hToken,
PWSTR *ppszPath
);
inline HINSTANCE(__stdcall *pShellExecuteW)(
HWND hwnd,
LPCWSTR lpOperation,
LPCWSTR lpFile,
LPCWSTR lpParameters,
LPCWSTR lpDirectory,
INT nShowCmd
);
inline HRESULT(__stdcall *pSHGetFolderPathA)(
HWND hwnd,
int csidl,
HANDLE hToken,
DWORD dwFlags,
LPSTR pszPath
);
inline LPWSTR *(__stdcall *pCommandLineToArgvW)(
LPCWSTR lpCmdLine,
int * pNumArgs
);
// Advanced API
inline LSTATUS(__stdcall *pRegSetValueExW)(
HKEY hKey,
LPCWSTR lpValueName,
DWORD Reserved,
DWORD dwType,
CONST BYTE * lpData,
DWORD cbData
);
inline LSTATUS(__stdcall *pRegQueryValueExW)(
HKEY hKey,
LPCWSTR lpValueName,
LPDWORD lpReserved,
LPDWORD lpType,
LPBYTE lpData,
LPDWORD lpcbData
);
inline LSTATUS(__stdcall *pRegCloseKey)(
HKEY hKey
);
inline LSTATUS(__stdcall *pRegOpenKeyExW)(
HKEY hKey,
LPCWSTR lpSubKey,
DWORD ulOptions,
REGSAM samDesired,
PHKEY phkResult
);
inline HANDLE(__stdcall *pRegisterEventSourceW)(
LPCWSTR lpUNCServerName,
LPCWSTR lpSourceName
);
inline BOOL(__stdcall *pDeregisterEventSource)(
HANDLE hEventLog
);
inline BOOL(__stdcall *pReportEventW)(
HANDLE hEventLog,
WORD wType,
WORD wCategory,
DWORD dwEventID,
PSID lpUserSid,
WORD wNumStrings,
DWORD dwDataSize,
LPCWSTR * lpStrings,
LPVOID lpRawData
);
inline BOOL(__stdcall *pCryptAcquireContextW)(
ULONG_PTR * hProv,
LPCWSTR szContainer,
LPCWSTR szProvider,
DWORD dwProvType,
DWORD dwFlags
);
inline BOOL(__stdcall *pCryptReleaseContext)(
ULONG_PTR hProvz,
DWORD dwFlags
);
inline DWORD(__stdcall *pSetEntriesInAclA)(
ULONG cCountOfExplicitEntries,
_EXPLICIT_ACCESS_A * pListOfExplicitEntries,
_ACL * OldAcl,
_ACL ** NewAcl
);
inline BOOL(__stdcall *pAllocateAndInitializeSid)(
PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
BYTE nSubAuthorityCount,
DWORD nSubAuthority0,
DWORD nSubAuthority1,
DWORD nSubAuthority2,
DWORD nSubAuthority3,
DWORD nSubAuthority4,
DWORD nSubAuthority5,
DWORD nSubAuthority6,
DWORD nSubAuthority7,
VOID ** pSid
);
inline DWORD(__stdcall *pSetNamedSecurityInfoW)(
LPWSTR pObjectName,
_SE_OBJECT_TYPE ObjectType,
SECURITY_INFORMATION SecurityInfo,
VOID * psidOwner,
VOID * psidGroup,
_ACL * pDacl,
_ACL * pSacl
);
inline PVOID(__stdcall *pFreeSid)(
VOID * pSid
);
// USER32 - the shit microsoft will probably try to phase out and remove over time
// [then give up and write a win32 emulator in a memelang, probably]
inline BOOL(__stdcall *pOpenClipboard)(
HWND hWndNewOwner
);
inline HANDLE(__stdcall *pGetClipboardData)(
UINT uFormat
);
inline BOOL(__stdcall *pCloseClipboard)();
inline UINT(__stdcall *pMapVirtualKeyA)(
UINT uCode,
UINT uMapType
);
inline DWORD(__stdcall *pGetWindowThreadProcessId)(
HWND hWnd,
LPDWORD lpdwProcessId
);
inline LRESULT(__stdcall *pSendMessageA)(
HWND hWnd,
UINT Msg,
WPARAM wParam,
LPARAM lParam
);
inline BOOL(__stdcall *pEnumThreadWindows)(
DWORD dwThreadId,
WNDENUMPROC lpfn,
LPARAM lParam
);
inline BOOL(__stdcall *pTranslateMessage)(
MSG * lpMsg
);
inline LRESULT(__stdcall *pDispatchMessageW)(
MSG * lpMsg
);
inline DWORD(__stdcall *pMsgWaitForMultipleObjects)(
DWORD nCount,
CONST HANDLE * pHandles,
BOOL fWaitAll,
DWORD dwMilliseconds,
DWORD dwWakeMask
);
inline DWORD(__stdcall *pMsgWaitForMultipleObjectsEx)(
DWORD nCount,
CONST HANDLE * pHandles,
DWORD dwMilliseconds,
DWORD dwWakeMask,
DWORD dwFlags
);
inline BOOL(__stdcall *pPeekMessageW)(
LPMSG lpMsg,
HWND hWnd,
UINT wMsgFilterMin,
UINT wMsgFilterMax,
UINT wRemoveMsg
);
inline BOOL(__stdcall *pSetPropW)(
HWND hWnd,
LPCWSTR lpString,
HANDLE hData
);
inline bool gUseNativeWaitMutex {};
inline bool gUseNativeWaitCondvar {};
inline bool gUseNativeWaitSemapahore {};
inline bool gUseFastFail {};
void Win32DropInit();
void Win32DropSchedulerResolution();
void Win32Terminate();
AUKN_SYM /* I'm going to be kind */
HANDLE Win32Open(LPCWSTR lpFileName,
2023-09-13 14:09:53 +00:00
DWORD dwDesiredAccess = GENERIC_READ | GENERIC_WRITE,
DWORD dwShareMode = FILE_SHARE_READ,
bool bInherit = false,
DWORD dwCreationDisposition = 0,
DWORD dwFlags = 0,
DWORD dwAttributes = 0
);
inline HMODULE(__stdcall *pLoadLibraryW)(
LPCWSTR lpLibFileName
);
inline FARPROC(__stdcall*pGetProcAddress)(
HMODULE hModule,
LPCSTR lpProcName
);
}