//|_ _ _. _ ._ |_ _. _ | //| | (/_ (_| \/ (/_ | | | | (_| (_ |< #pragma once #include #ifndef STATUS_SUCCESS # define STATUS_SUCCESS 0 #endif template struct _LIST_ENTRY_T { T Flink; T Blink; }; template struct _UNICODE_STRING_T { union { struct { WORD Length; WORD MaximumLength; }; T dummy; }; T Buffer; }; template struct _NT_TIB_T { T ExceptionList; T StackBase; T StackLimit; T SubSystemTib; T FiberData; T ArbitraryUserPointer; T Self; }; template struct _CLIENT_ID_T { T UniqueProcess; T UniqueThread; }; struct OBJECT_HANDLE_FLAG_INFORMATION { BOOLEAN inherit; BOOLEAN protect; }; template struct _TEB_T_ { _NT_TIB_T NtTib; T EnvironmentPointer; _CLIENT_ID_T ClientId; T ActiveRpcHandle; T ThreadLocalStoragePointer; T ProcessEnvironmentBlock; DWORD LastErrorValue; DWORD CountOfOwnedCriticalSections; T CsrClientThread; T Win32ThreadInfo; DWORD User32Reserved[26]; //rest of the structure is not defined for now, as it is not needed }; // ? ? ? ? ? struct _LDR_DATA_TABLE_ENTRY64_T { _LIST_ENTRY_T InLoadOrderLinks; _LIST_ENTRY_T InMemoryOrderLinks; // random missing field here ? ? // _LIST_ENTRY_T InInitializationOrderLinks; DWORD64 DllBase; DWORD64 EntryPoint; union { DWORD SizeOfImage; DWORD64 dummy01; }; _UNICODE_STRING_T DllPath; _UNICODE_STRING_T FullDllName; }; template struct _LDR_DATA_TABLE_ENTRY_T { _LIST_ENTRY_T InLoadOrderLinks; _LIST_ENTRY_T InMemoryOrderLinks; _LIST_ENTRY_T InInitializationOrderLinks; T DllBase; T EntryPoint; union { DWORD SizeOfImage; T dummy01; }; _UNICODE_STRING_T FullDllName; _UNICODE_STRING_T BaseDllName; DWORD Flags; WORD LoadCount; WORD TlsIndex; union { _LIST_ENTRY_T HashLinks; struct { T SectionPointer; T CheckSum; }; }; union { T LoadedImports; DWORD TimeDateStamp; }; T EntryPointActivationContext; T PatchInformation; _LIST_ENTRY_T ForwarderLinks; _LIST_ENTRY_T ServiceTagLinks; _LIST_ENTRY_T StaticLinks; T ContextInformation; T OriginalBase; _LARGE_INTEGER LoadTime; }; template struct _PEB_LDR_DATA_T { DWORD Length; DWORD Initialized; T SsHandle; _LIST_ENTRY_T InLoadOrderModuleList; _LIST_ENTRY_T InMemoryOrderModuleList; _LIST_ENTRY_T InInitializationOrderModuleList; T EntryInProgress; DWORD ShutdownInProgress; T ShutdownThreadId; }; struct PROCESS_BASIC_INFORMATION64 { LONG ExitStatus; U64 PebBaseAddress; U64 AfiinityMask; LONG BasePriority; U64 UniqueProcessId; U64 InheritedFromUniqueProcessId; }; template struct _PEB_T { UCHAR InheritedAddressSpace; UCHAR ReadImageFileExecOptions; UCHAR BeingDebugged; UCHAR BitField; ULONG ImageUsesLargePages: 1; ULONG IsProtectedProcess: 1; ULONG IsLegacyProcess: 1; ULONG IsImageDynamicallyRelocated: 1; ULONG SpareBits: 4; T Mutant; T ImageBaseAddress; T Ldr; T ProcessParameters; T SubSystemData; T ProcessHeap; T FastPebLock; T AtlThunkSListPtr; T IFEOKey; T CrossProcessFlags; T UserSharedInfoPtr; DWORD SystemReserved; DWORD AtlThunkSListPtr32; T ApiSetMap; T TlsExpansionCounter; T TlsBitmap; DWORD TlsBitmapBits[2]; T ReadOnlySharedMemoryBase; T HotpatchInformation; T ReadOnlyStaticServerData; T AnsiCodePageData; T OemCodePageData; T UnicodeCaseTableData; DWORD NumberOfProcessors; union { DWORD NtGlobalFlag; NGF dummy02; }; LARGE_INTEGER CriticalSectionTimeout; T HeapSegmentReserve; T HeapSegmentCommit; T HeapDeCommitTotalFreeThreshold; T HeapDeCommitFreeBlockThreshold; DWORD NumberOfHeaps; DWORD MaximumNumberOfHeaps; T ProcessHeaps; T GdiSharedHandleTable; T ProcessStarterHelper; T GdiDCAttributeList; T LoaderLock; DWORD OSMajorVersion; DWORD OSMinorVersion; WORD OSBuildNumber; WORD OSCSDVersion; DWORD OSPlatformId; DWORD ImageSubsystem; DWORD ImageSubsystemMajorVersion; T ImageSubsystemMinorVersion; T ActiveProcessAffinityMask; T GdiHandleBuffer[A]; T PostProcessInitRoutine; T TlsExpansionBitmap; DWORD TlsExpansionBitmapBits[32]; T SessionId; ULARGE_INTEGER AppCompatFlags; ULARGE_INTEGER AppCompatFlagsUser; T pShimData; T AppCompatInfo; _UNICODE_STRING_T CSDVersion; T ActivationContextData; T ProcessAssemblyStorageMap; T SystemDefaultActivationContextData; T SystemAssemblyStorageMap; T MinimumStackCommit; T FlsCallback; _LIST_ENTRY_T FlsListHead; T FlsBitmap; DWORD FlsBitmapBits[4]; T FlsHighIndex; T WerRegistrationData; T WerShipAssertPtr; T pContextData; T pImageHeaderHash; T TracingFlags; }; typedef _LDR_DATA_TABLE_ENTRY_T LDR_DATA_TABLE_ENTRY32; typedef _LDR_DATA_TABLE_ENTRY_T LDR_DATA_TABLE_ENTRY64; typedef _TEB_T_ TEB32; typedef _TEB_T_ TEB64; typedef _PEB_LDR_DATA_T PEB_LDR_DATA32; typedef _PEB_LDR_DATA_T PEB_LDR_DATA64; typedef _PEB_T PEB32; typedef _PEB_T PEB64; struct _XSAVE_FORMAT64 { WORD ControlWord; WORD StatusWord; BYTE TagWord; BYTE Reserved1; WORD ErrorOpcode; DWORD ErrorOffset; WORD ErrorSelector; WORD Reserved2; DWORD DataOffset; WORD DataSelector; WORD Reserved3; DWORD MxCsr; DWORD MxCsr_Mask; _M128A FloatRegisters[8]; _M128A XmmRegisters[16]; BYTE Reserved4[96]; }; struct _CONTEXT64 { DWORD64 P1Home; DWORD64 P2Home; DWORD64 P3Home; DWORD64 P4Home; DWORD64 P5Home; DWORD64 P6Home; DWORD ContextFlags; DWORD MxCsr; WORD SegCs; WORD SegDs; WORD SegEs; WORD SegFs; WORD SegGs; WORD SegSs; DWORD EFlags; DWORD64 Dr0; DWORD64 Dr1; DWORD64 Dr2; DWORD64 Dr3; DWORD64 Dr6; DWORD64 Dr7; DWORD64 Rax; DWORD64 Rcx; DWORD64 Rdx; DWORD64 Rbx; DWORD64 Rsp; DWORD64 Rbp; DWORD64 Rsi; DWORD64 Rdi; DWORD64 R8; DWORD64 R9; DWORD64 R10; DWORD64 R11; DWORD64 R12; DWORD64 R13; DWORD64 R14; DWORD64 R15; DWORD64 Rip; _XSAVE_FORMAT64 FltSave; _M128A Header[2]; _M128A Legacy[8]; _M128A Xmm0; _M128A Xmm1; _M128A Xmm2; _M128A Xmm3; _M128A Xmm4; _M128A Xmm5; _M128A Xmm6; _M128A Xmm7; _M128A Xmm8; _M128A Xmm9; _M128A Xmm10; _M128A Xmm11; _M128A Xmm12; _M128A Xmm13; _M128A Xmm14; _M128A Xmm15; _M128A VectorRegister[26]; DWORD64 VectorControl; DWORD64 DebugControl; DWORD64 LastBranchToRip; DWORD64 LastBranchFromRip; DWORD64 LastExceptionToRip; DWORD64 LastExceptionFromRip; }; struct _SYSTEM_PROCESS_INFORMATION64 { ULONG NextEntryOffset; ULONG NumberOfThreads; BYTE Reserved1[48]; _UNICODE_STRING_T ImageName; KPRIORITY BasePriority; U64 UniqueProcessId; U64 Reserved2; ULONG HandleCount; ULONG SessionId; U64 Reserved3; U64 PeakVirtualSize; U64 VirtualSize; ULONG Reserved4; U64 PeakWorkingSetSize; U64 WorkingSetSize; U64 Reserved5; U64 QuotaPagedPoolUsage; U64 Reserved6; U64 QuotaNonPagedPoolUsage; U64 PagefileUsage; U64 PeakPagefileUsage; U64 PrivatePageCount; LARGE_INTEGER Reserved7[6]; }; template< class T > struct _OBJECT_ATTRIBUTES_T { ULONG Length; T RootDirectory; T ObjectName; ULONG Attributes; T SecurityDescriptor; T SecurityQualityOfService; }; using _OBJECT_ATTRIBUTES64 = _OBJECT_ATTRIBUTES_T; using NTSTATUS64 = DWORD64;