359 lines
12 KiB
C++
359 lines
12 KiB
C++
/***
|
|
Copyright (C) 2023 J Reece Wilson (a/k/a "Reece"). All rights reserved.
|
|
|
|
File: AuProcAddresses.NT.hpp
|
|
Date: 2023-2-16
|
|
Author: Reece
|
|
***/
|
|
#pragma once
|
|
|
|
struct _PROCESS_MEMORY_COUNTERS;
|
|
|
|
namespace Aurora
|
|
{
|
|
void InitNTAddresses();
|
|
|
|
static const wchar_t *kSyncDllName { L"API-MS-Win-Core-Synch-l1-2-0.dll" };
|
|
static const wchar_t *kNtDllName { L"NTDLL.dll" };
|
|
static const wchar_t *kKernel32DllName { L"Kernel32.dll" };
|
|
static const wchar_t *kKernelBaseDllName { L"KernelBase.dll" };
|
|
static const wchar_t *kWS2DllName { L"Ws2_32.dll" };
|
|
static const wchar_t *kAdvancedApiDllName { L"Advapi32.dll" };
|
|
static const wchar_t *kBCryptDllName { L"bcrypt.dll" };
|
|
static const wchar_t *kThemeDllName { L"UxTheme.dll" };
|
|
static const wchar_t *kShellDllName { L"Shell32.dll" };
|
|
static const wchar_t *kPSAPILegacyDllName { L"psapi.dll" };
|
|
|
|
struct WIN32_MEMORY_RANGE_ENTRY2
|
|
{
|
|
PVOID VirtualAddress;
|
|
SIZE_T NumberOfBytes;
|
|
};
|
|
|
|
enum class THREAD_INFORMATION_CLASS
|
|
{
|
|
ThreadMemoryPriority,
|
|
ThreadAbsoluteCpuPriority,
|
|
ThreadDynamicCodePolicy,
|
|
ThreadPowerThrottling,
|
|
ThreadInformationClassMax
|
|
};
|
|
|
|
inline BOOL(__stdcall *pWaitOnAddress)(
|
|
volatile VOID * Address,
|
|
PVOID CompareAddress,
|
|
SIZE_T AddressSize,
|
|
DWORD dwMilliseconds
|
|
);
|
|
|
|
inline void(__stdcall *pWakeByAddressSingle)(
|
|
PVOID Address
|
|
);
|
|
|
|
inline void(__stdcall *pWakeByAddressAll)(
|
|
PVOID Address
|
|
);
|
|
|
|
inline DWORD(__stdcall *pNtDelayExecution)(
|
|
BOOLEAN Alertable,
|
|
PLARGE_INTEGER DelayInterval
|
|
);
|
|
|
|
inline PVOID(__stdcall *pVirtualAlloc2)(
|
|
HANDLE Process,
|
|
PVOID BaseAddress,
|
|
SIZE_T Size,
|
|
ULONG AllocationType,
|
|
ULONG PageProtection,
|
|
MEM_EXTENDED_PARAMETER * ExtendedParameters,
|
|
ULONG ParameterCount
|
|
);
|
|
|
|
inline PVOID(__stdcall *pMapViewOfFile3)(
|
|
HANDLE FileMapping,
|
|
HANDLE Process,
|
|
PVOID BaseAddress,
|
|
ULONG64 Offset,
|
|
SIZE_T ViewSize,
|
|
ULONG AllocationType,
|
|
ULONG PageProtection,
|
|
MEM_EXTENDED_PARAMETER * ExtendedParameters,
|
|
ULONG ParameterCount
|
|
);
|
|
|
|
inline PVOID(__stdcall *pUnmapViewOfFile2)(
|
|
HANDLE Process,
|
|
PVOID BaseAddress,
|
|
ULONG UnmapFlags
|
|
);
|
|
|
|
inline NTSTATUS(__stdcall *pNtWaitForKeyedEvent)(
|
|
HANDLE Handle,
|
|
PVOID Key,
|
|
BOOLEAN Alertable,
|
|
PLARGE_INTEGER NTTimeout
|
|
);
|
|
|
|
inline NTSTATUS(__stdcall *pNtReleaseKeyedEvent)(
|
|
HANDLE Handle,
|
|
PVOID Key,
|
|
BOOLEAN Alertable,
|
|
PLARGE_INTEGER NTTimeout
|
|
);
|
|
|
|
inline NTSTATUS(__stdcall *pNtCreateKeyedEvent)(
|
|
HANDLE Handle,
|
|
ACCESS_MASK Access,
|
|
POBJECT_ATTRIBUTES Attr,
|
|
ULONG Flags
|
|
);
|
|
|
|
inline NTSTATUS(__stdcall *pNtOpenKeyedEvent)(
|
|
HANDLE Handle,
|
|
ACCESS_MASK Access,
|
|
POBJECT_ATTRIBUTES Attr,
|
|
ULONG Flags
|
|
);
|
|
|
|
inline NTSTATUS(__stdcall *pRtlWaitOnAddress)(
|
|
const void * addr,
|
|
const void * cmp,
|
|
SIZE_T size,
|
|
const LARGE_INTEGER * timeout);
|
|
|
|
#if defined(AURORA_PLATFORM_WIN32)
|
|
inline NTSTATUS(__stdcall *pRtlGetVersion)(
|
|
PRTL_OSVERSIONINFOW lpVersionInformation
|
|
);
|
|
#endif
|
|
|
|
inline NTSTATUS(__stdcall *pNtNotifyChangeDirectoryFile)(
|
|
HANDLE FileHandle,
|
|
HANDLE Event,
|
|
PIO_APC_ROUTINE ApcRoutine,
|
|
PVOID ApcContext,
|
|
PIO_STATUS_BLOCK IoStatusBlock,
|
|
PVOID Buffer,
|
|
ULONG BufferSize,
|
|
ULONG CompletionFilter,
|
|
BOOLEAN WatchTree
|
|
);
|
|
|
|
inline BOOL(__stdcall *pGetSystemCpuSetInformation)(
|
|
PSYSTEM_CPU_SET_INFORMATION Information,
|
|
ULONG BufferLength,
|
|
PULONG ReturnedLength,
|
|
HANDLE Process,
|
|
ULONG Flags
|
|
);
|
|
|
|
inline BOOL(__stdcall *pGetLogicalProcessorInformation)(
|
|
PSYSTEM_LOGICAL_PROCESSOR_INFORMATION Buffer,
|
|
PDWORD ReturnedLength
|
|
);
|
|
|
|
inline HRESULT(__stdcall *pSetThreadDescription)(
|
|
HANDLE hThread,
|
|
PCWSTR lpThreadDescription
|
|
);
|
|
|
|
inline BOOL(__stdcall *pSetThreadInformation)(
|
|
HANDLE hThread,
|
|
THREAD_INFORMATION_CLASS ThreadInformationClass,
|
|
LPVOID ThreadInformation,
|
|
DWORD ThreadInformationSize
|
|
);
|
|
|
|
inline BOOL(__stdcall *pSetThreadSelectedCpuSets)(
|
|
HANDLE Thread,
|
|
const ULONG * CpuSetIds,
|
|
ULONG CpuSetIdCount
|
|
);
|
|
|
|
#if defined(AURORA_PLATFORM_WIN32)
|
|
inline BOOL(__stdcall *pSetThreadGroupAffinity)(
|
|
HANDLE hThread,
|
|
GROUP_AFFINITY * GroupAffinity,
|
|
PGROUP_AFFINITY PreviousGroupAffinity
|
|
);
|
|
#endif
|
|
|
|
inline INT(__stdcall *pGetAddrInfoExCancel)(
|
|
LPHANDLE lpHandle
|
|
);
|
|
|
|
using LPLOOKUPSERVICE_COMPLETION_ROUTINE = void(__stdcall *)(
|
|
DWORD dwError,
|
|
DWORD dwBytes,
|
|
LPWSAOVERLAPPED lpOverlapped
|
|
);
|
|
|
|
inline INT(__stdcall *pGetAddrInfoExW)(
|
|
PCWSTR pName,
|
|
PCWSTR pServiceName,
|
|
DWORD dwNameSpace,
|
|
LPGUID lpNspId,
|
|
const ADDRINFOEXW * hints,
|
|
PADDRINFOEXW * ppResult,
|
|
struct timeval * timeout,
|
|
LPOVERLAPPED lpOverlapped,
|
|
LPLOOKUPSERVICE_COMPLETION_ROUTINE lpCompletionRoutine,
|
|
LPHANDLE lpHandle
|
|
);
|
|
|
|
inline void(__stdcall *pFreeAddrInfoExW)(
|
|
PADDRINFOEXW pAddrInfoEx
|
|
);
|
|
|
|
inline INT(__stdcall *pgetaddrinfo)(
|
|
PCSTR pNodeName,
|
|
PCSTR pServiceName,
|
|
const ADDRINFOA * pHints,
|
|
PADDRINFOA * ppResult
|
|
);
|
|
|
|
inline void(__stdcall *pfreeaddrinfo)(
|
|
PADDRINFOA pAddrInfo
|
|
);
|
|
|
|
inline BOOL(__stdcall *pPrefetchVirtualMemory)(
|
|
HANDLE hProcess,
|
|
ULONG_PTR NumberOfEntries,
|
|
WIN32_MEMORY_RANGE_ENTRY2 * VirtualAddresses,
|
|
ULONG Flags
|
|
);
|
|
|
|
inline NTSTATUS(__stdcall *pBCryptGenRandom)(
|
|
PVOID hAlgorithm,
|
|
PUCHAR pbBuffer,
|
|
ULONG cbBuffer,
|
|
ULONG dwFlags
|
|
);
|
|
|
|
inline BOOL(__stdcall *pCryptGenRandom)(
|
|
ULONG_PTR hProv,
|
|
DWORD dwLen,
|
|
BYTE *pbBuffer
|
|
);
|
|
|
|
inline BOOL(__stdcall *pCryptAcquireContextW)(
|
|
ULONG_PTR * hProv,
|
|
LPCWSTR szContainer,
|
|
LPCWSTR szProvider,
|
|
DWORD dwProvType,
|
|
DWORD dwFlags
|
|
);
|
|
|
|
inline BOOL(__stdcall *pCryptReleaseContext)(
|
|
ULONG_PTR hProvz,
|
|
DWORD dwFlags
|
|
);
|
|
|
|
inline NTSTATUS(__stdcall *pZwSetTimerResolution)(
|
|
ULONG RequestedResolution,
|
|
BOOLEAN Set,
|
|
PULONG ActualResolution
|
|
);
|
|
|
|
inline BOOLEAN(__stdcall *pRtlGenRandom)(
|
|
PVOID RandomBuffer,
|
|
ULONG RandomBufferLength
|
|
);
|
|
|
|
#if defined(AURORA_PLATFORM_WIN32)
|
|
inline NTSTATUS(__stdcall *pNtQueryInformationProcess)(
|
|
HANDLE ProcessHandle,
|
|
PROCESSINFOCLASS ProcessInformationClass,
|
|
PVOID ProcessInformation,
|
|
ULONG ProcessInformationLength,
|
|
PULONG ReturnLength
|
|
);
|
|
#endif
|
|
|
|
inline HRESULT(__stdcall *pSetWindowTheme)(
|
|
HWND hwnd,
|
|
LPCWSTR pszSubAppName,
|
|
LPCWSTR pszSubIdList
|
|
);
|
|
|
|
inline HANDLE(__stdcall *pFindFirstStreamW)(
|
|
LPCWSTR lpFileName,
|
|
STREAM_INFO_LEVELS InfoLevel,
|
|
LPVOID lpFindStreamData,
|
|
DWORD dwFlags
|
|
);
|
|
|
|
inline BOOL(__stdcall *pFindNextStreamW)(
|
|
HANDLE hFindStream,
|
|
LPVOID lpFindStreamData
|
|
);
|
|
|
|
inline BOOL(__stdcall *pFindClose)(
|
|
HANDLE hFindFile
|
|
);
|
|
|
|
inline BOOL(__stdcall *pCancelIoEx)(
|
|
HANDLE hFile,
|
|
LPOVERLAPPED lpOverlapped
|
|
);
|
|
|
|
inline BOOL(__stdcall *pCancelSynchronousIo)(
|
|
HANDLE hThread
|
|
);
|
|
|
|
inline BOOL(__stdcall *pGetProcessMemoryInfo)(
|
|
HANDLE Process,
|
|
::_PROCESS_MEMORY_COUNTERS *ppsmemCounters,
|
|
DWORD cb
|
|
);
|
|
|
|
inline BOOL(__stdcall *pSetFileInformationByHandle)(
|
|
HANDLE hFile,
|
|
FILE_INFO_BY_HANDLE_CLASS FileInformationClass,
|
|
LPVOID lpFileInformation,
|
|
DWORD dwBufferSize
|
|
);
|
|
|
|
inline int(__stdcall *pGetLocaleInfoEx)(
|
|
LPCWSTR lpLocaleName,
|
|
LCTYPE LCType,
|
|
LPWSTR lpLCData,
|
|
int cchData
|
|
);
|
|
|
|
inline int(__stdcall *pLCIDToLocaleName)(
|
|
LCID Locale,
|
|
LPWSTR lpName,
|
|
int cchName,
|
|
DWORD dwFlags
|
|
);
|
|
|
|
inline int(__stdcall *pGetLocaleInfoW)(
|
|
LCID Locale,
|
|
LCTYPE LCType,
|
|
LPWSTR lpLCData,
|
|
int cchData
|
|
);
|
|
|
|
inline DWORD(__stdcall *pGetThreadId)(
|
|
HANDLE hThread
|
|
);
|
|
|
|
inline HRESULT(__stdcall *pSHGetKnownFolderPath)(
|
|
const GUID & rfid,
|
|
DWORD dwFlags,
|
|
HANDLE hToken,
|
|
PWSTR * ppszPath
|
|
);
|
|
|
|
inline bool gUseNativeWaitMutex {};
|
|
inline bool gUseNativeWaitCondvar {};
|
|
inline bool gUseNativeWaitSemapahore {};
|
|
|
|
inline bool gUseFastFail {};
|
|
|
|
void Win32DropInit();
|
|
void Win32DropSchedulerResolution();
|
|
|
|
void Win32Terminate();
|
|
} |