126 lines
3.6 KiB
Zig
126 lines
3.6 KiB
Zig
const std = @import("std");
|
|
const windows = std.os.windows;
|
|
|
|
pub const WINAPI: std.builtin.CallingConvention = .winapi;
|
|
|
|
// Page protection constants for NtProtectVirtualMemory.
|
|
// https://ntdoc.m417z.com/ntprotectvirtualmemory
|
|
pub const PAGE_NOACCESS: windows.ULONG = 0x01;
|
|
pub const PAGE_READONLY: windows.ULONG = 0x02;
|
|
pub const PAGE_READWRITE: windows.ULONG = 0x04;
|
|
pub const PAGE_EXECUTE_READ: windows.ULONG = 0x20;
|
|
pub const PAGE_EXECUTE_READWRITE: windows.ULONG = 0x40;
|
|
|
|
pub const CONTEXT_DEBUG_REGISTERS: windows.DWORD = 0x00100010;
|
|
pub const EXCEPTION_SINGLE_STEP: windows.DWORD = 0x80000004;
|
|
pub const EXCEPTION_CONTINUE_EXECUTION: windows.LONG = -1;
|
|
pub const EXCEPTION_CONTINUE_SEARCH: windows.LONG = 0;
|
|
|
|
// https://ntdoc.m417z.com/object_attributes
|
|
pub const OBJ_CASE_INSENSITIVE: windows.ULONG = 0x00000040;
|
|
|
|
// https://ntdoc.m417z.com/unicode_string
|
|
pub const UNICODE_STRING = extern struct {
|
|
Length: u16,
|
|
MaximumLength: u16,
|
|
Buffer: [*]u16,
|
|
};
|
|
|
|
// https://ntdoc.m417z.com/object_attributes
|
|
pub const OBJECT_ATTRIBUTES = extern struct {
|
|
Length: windows.ULONG,
|
|
RootDirectory: ?windows.HANDLE,
|
|
ObjectName: ?*UNICODE_STRING,
|
|
Attributes: windows.ULONG,
|
|
SecurityDescriptor: ?*anyopaque,
|
|
SecurityQualityOfService: ?*anyopaque,
|
|
};
|
|
|
|
// https://ntdoc.m417z.com/client_id
|
|
pub const CLIENT_ID = extern struct {
|
|
UniqueProcess: windows.HANDLE,
|
|
UniqueThread: ?windows.HANDLE,
|
|
};
|
|
|
|
// https://ntdoc.m417z.com/token_type
|
|
pub const TOKEN_TYPE = enum(u32) {
|
|
TokenPrimary = 1,
|
|
TokenImpersonation = 2,
|
|
};
|
|
|
|
pub const PROCESS_QUERY_LIMITED_INFORMATION: windows.DWORD = 0x1000;
|
|
pub const MAXIMUM_ALLOWED: windows.DWORD = 0x02000000;
|
|
|
|
// Access rights for NtOpenProcessToken.
|
|
// https://ntdoc.m417z.com/ntopenprocesstoken
|
|
pub const TOKEN_DUPLICATE: windows.DWORD = 0x0002;
|
|
pub const TOKEN_QUERY: windows.DWORD = 0x0008;
|
|
pub const TOKEN_IMPERSONATE: windows.DWORD = 0x0004;
|
|
|
|
// https://ntdoc.m417z.com/ntopensection
|
|
pub const SECTION_MAP_READ: windows.DWORD = 0x0004;
|
|
|
|
pub const CONTEXT = extern struct {
|
|
P1Home: windows.DWORD64,
|
|
P2Home: windows.DWORD64,
|
|
P3Home: windows.DWORD64,
|
|
P4Home: windows.DWORD64,
|
|
P5Home: windows.DWORD64,
|
|
P6Home: windows.DWORD64,
|
|
ContextFlags: windows.DWORD,
|
|
MxCsr: windows.DWORD,
|
|
SegCs: windows.WORD,
|
|
SegDs: windows.WORD,
|
|
SegEs: windows.WORD,
|
|
SegFs: windows.WORD,
|
|
SegGs: windows.WORD,
|
|
SegSs: windows.WORD,
|
|
EFlags: windows.DWORD,
|
|
Dr0: windows.DWORD64,
|
|
Dr1: windows.DWORD64,
|
|
Dr2: windows.DWORD64,
|
|
Dr3: windows.DWORD64,
|
|
Dr6: windows.DWORD64,
|
|
Dr7: windows.DWORD64,
|
|
Rax: windows.DWORD64,
|
|
Rcx: windows.DWORD64,
|
|
Rdx: windows.DWORD64,
|
|
Rbx: windows.DWORD64,
|
|
Rsp: windows.DWORD64,
|
|
Rbp: windows.DWORD64,
|
|
Rsi: windows.DWORD64,
|
|
Rdi: windows.DWORD64,
|
|
R8: windows.DWORD64,
|
|
R9: windows.DWORD64,
|
|
R10: windows.DWORD64,
|
|
R11: windows.DWORD64,
|
|
R12: windows.DWORD64,
|
|
R13: windows.DWORD64,
|
|
R14: windows.DWORD64,
|
|
R15: windows.DWORD64,
|
|
Rip: windows.DWORD64,
|
|
};
|
|
|
|
pub const EXCEPTION_RECORD = extern struct {
|
|
ExceptionCode: windows.DWORD,
|
|
ExceptionFlags: windows.DWORD,
|
|
ExceptionRecord: *EXCEPTION_RECORD,
|
|
ExceptionAddress: *anyopaque,
|
|
NumberParameters: windows.DWORD,
|
|
ExceptionInformation: [15]windows.ULONG_PTR,
|
|
};
|
|
|
|
pub const EXCEPTION_POINTERS = extern struct {
|
|
ExceptionRecord: *EXCEPTION_RECORD,
|
|
ContextRecord: *CONTEXT,
|
|
};
|
|
|
|
pub inline fn NT_SUCCESS(status: windows.NTSTATUS) bool {
|
|
return @as(i32, @bitCast(@intFromEnum(status))) >= 0;
|
|
}
|
|
|
|
pub fn FALSE_BOOL() windows.BOOLEAN {
|
|
return @enumFromInt(@as(u8, 0));
|
|
}
|
|
|