init

2026-07-28 15:11:47 +08:00
parent 9b00c5f6eb
commit e91e372b19
80 changed files with 246075 additions and 0 deletions
@@ -0,0 +1,145 @@
+#pragma once
+#include <Windows.h>
+#include <iostream>
+#include <winternl.h>
+#include <stdint.h>
+#include <fstream>
+#include <string>
+#pragma comment(lib, "ntdll.lib")
+
+#define DEBUG_PRINTF 0
+
+#if DEBUG_PRINTF
+
+#define Log(content) std::wcout << content
+#else
+#define Log(content)
+#endif // 0
+
+
+
+
+
+namespace nt
+{
+	EXTERN_C NTSTATUS RtlAdjustPrivilege(ULONG Privilege, BOOLEAN Enable, BOOLEAN Client, BOOLEAN* WasEnabled);
+	EXTERN_C NTSTATUS NtLoadDriver(PUNICODE_STRING DriverServiceName);
+	EXTERN_C NTSTATUS NtUnloadDriver(PUNICODE_STRING DriverServiceName);
+
+
+	constexpr auto STATUS_INFO_LENGTH_MISMATCH = 0xC0000004;
+
+	constexpr auto SystemModuleInformation = 11;
+	constexpr auto SystemExtendedHandleInformation = 64;
+
+	bool RegisterAndStart(const std::wstring& driver_path, const std::wstring& serviceName);
+	bool StopAndRemove(const std::wstring& serviceName);
+
+	typedef struct _SYSTEM_HANDLE
+	{
+		PVOID Object;
+		HANDLE UniqueProcessId;
+		HANDLE HandleValue;
+		ULONG GrantedAccess;
+		USHORT CreatorBackTraceIndex;
+		USHORT ObjectTypeIndex;
+		ULONG HandleAttributes;
+		ULONG Reserved;
+	} SYSTEM_HANDLE, * PSYSTEM_HANDLE;
+
+	typedef struct _SYSTEM_HANDLE_INFORMATION_EX
+	{
+		ULONG_PTR HandleCount;
+		ULONG_PTR Reserved;
+		SYSTEM_HANDLE Handles[1];
+	} SYSTEM_HANDLE_INFORMATION_EX, * PSYSTEM_HANDLE_INFORMATION_EX;
+
+
+	typedef struct _RTL_BALANCED_LINKS {
+		struct _RTL_BALANCED_LINKS* Parent;
+		struct _RTL_BALANCED_LINKS* LeftChild;
+		struct _RTL_BALANCED_LINKS* RightChild;
+		CHAR Balance;
+		UCHAR Reserved[3];
+	} RTL_BALANCED_LINKS;
+	typedef RTL_BALANCED_LINKS* PRTL_BALANCED_LINKS;
+
+	typedef struct _RTL_AVL_TABLE {
+		RTL_BALANCED_LINKS BalancedRoot;
+		PVOID OrderedPointer;
+		ULONG WhichOrderedElement;
+		ULONG NumberGenericTableElements;
+		ULONG DepthOfTree;
+		PVOID RestartKey;
+		ULONG DeleteCount;
+		PVOID CompareRoutine;
+		PVOID AllocateRoutine;
+		PVOID FreeRoutine;
+		PVOID TableContext;
+	} RTL_AVL_TABLE;
+	typedef RTL_AVL_TABLE* PRTL_AVL_TABLE;
+
+	typedef struct _PiDDBCacheEntry
+	{
+		LIST_ENTRY		List;
+		UNICODE_STRING	DriverName;
+		ULONG			TimeDateStamp;
+		NTSTATUS		LoadStatus;
+		char			_0x0028[16]; // data from the shim engine, or uninitialized memory for custom drivers
+	} PiDDBCacheEntry, * NPiDDBCacheEntry;
+
+	typedef struct _HashBucketEntry
+	{
+		struct _HashBucketEntry* Next;
+		UNICODE_STRING DriverName;
+		ULONG CertHash[5];
+	} HashBucketEntry, * PHashBucketEntry;
+
+}
+
+typedef struct _CALC_VERIFY
+{
+	int a, b, c, d;
+	ULONG64 calc_val;
+
+}CALC_VERIFY,*PCALC_VERIFY;
+
+typedef struct COMM_INFO
+{
+	uintptr_t case_number;
+	uintptr_t reserved;
+	uintptr_t source;
+	uintptr_t destination;
+	uintptr_t length;
+
+	PCALC_VERIFY Verify;
+
+}COMM_INFO, * PCOMM_INFO;
+
+typedef struct _GET_PHYS_ADDRESS_BUFFER_INFO
+{
+	uint64_t case_number;
+	uint64_t reserved;
+	uint64_t return_physical_address;
+	uint64_t address_to_translate;
+}GET_PHYS_ADDRESS_BUFFER_INFO, * PGET_PHYS_ADDRESS_BUFFER_INFO;
+
+typedef struct _MAP_IO_SPACE_BUFFER_INFO
+{
+	uint64_t case_number;
+	uint64_t reserved;
+	uint64_t return_value;
+	uint64_t return_virtual_address;
+	uint64_t physical_address_to_map;
+	uint32_t size;
+}MAP_IO_SPACE_BUFFER_INFO, * PMAP_IO_SPACE_BUFFER_INFO;
+
+typedef struct _UNMAP_IO_SPACE_BUFFER_INFO
+{
+	uint64_t case_number;
+	uint64_t reserved1;
+	uint64_t reserved2;
+	uint64_t virt_address;
+	uint64_t reserved3;
+	uint32_t number_of_bytes;
+}UNMAP_IO_SPACE_BUFFER_INFO, * PUNMAP_IO_SPACE_BUFFER_INFO;