Path: blob/master/external/source/HostingCLR_inject/HostingCLR/EtwTamper.h
19516 views
#pragma once12#include <Windows.h>34#define STATUS_SUCCESS 05#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )67typedef struct _UNICODE_STRING {8USHORT Length;9USHORT MaximumLength;10PWSTR Buffer;11} UNICODE_STRING, *PUNICODE_STRING;1213typedef const UNICODE_STRING* PCUNICODE_STRING;1415typedef struct _PEB_LDR_DATA {16ULONG Length;17BOOLEAN Initialized;18HANDLE SsHandle;19LIST_ENTRY InLoadOrderModuleList;20LIST_ENTRY InMemoryOrderModuleList;21LIST_ENTRY InInitializationOrderModuleList;22PVOID EntryInProgress;23BOOLEAN ShutdownInProgress;24HANDLE ShutdownThreadId;25} PEB_LDR_DATA, *PPEB_LDR_DATA;2627typedef struct _RTL_USER_PROCESS_PARAMETERS {28BYTE Reserved1[16];29PVOID Reserved2[10];30UNICODE_STRING ImagePathName;31UNICODE_STRING CommandLine;32} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;3334typedef struct _API_SET_NAMESPACE {35ULONG Version;36ULONG Size;37ULONG Flags;38ULONG Count;39ULONG EntryOffset;40ULONG HashOffset;41ULONG HashFactor;42} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;4344// Partial PEB45typedef struct _PEB {46BOOLEAN InheritedAddressSpace;47BOOLEAN ReadImageFileExecOptions;48BOOLEAN BeingDebugged;49union50{51BOOLEAN BitField;52struct53{54BOOLEAN ImageUsesLargePages : 1;55BOOLEAN IsProtectedProcess : 1;56BOOLEAN IsLegacyProcess : 1;57BOOLEAN IsImageDynamicallyRelocated : 1;58BOOLEAN SkipPatchingUser32Forwarders : 1;59BOOLEAN SpareBits : 3;60} _bitField;61};62HANDLE Mutant;6364PVOID ImageBaseAddress;65PPEB_LDR_DATA Ldr;66PRTL_USER_PROCESS_PARAMETERS ProcessParameters;67PVOID SubSystemData;68PVOID ProcessHeap;69PRTL_CRITICAL_SECTION FastPebLock;70PVOID IFEOKey;71PSLIST_HEADER AtlThunkSListPtr;72union73{74ULONG CrossProcessFlags;75struct76{77ULONG ProcessInJob : 1;78ULONG ProcessInitializing : 1;79ULONG ProcessUsingVEH : 1;80ULONG ProcessUsingVCH : 1;81ULONG ProcessUsingFTH : 1;82ULONG ProcessPreviouslyThrottled : 1;83ULONG ProcessCurrentlyThrottled : 1;84ULONG ProcessImagesHotPatched : 1;85ULONG ReservedBits0 : 24;86} _crossProcessFlags;87};88union89{90PVOID KernelCallbackTable;91PVOID UserSharedInfoPtr;92};93ULONG SystemReserved;94ULONG AtlThunkSListPtr32;95PAPI_SET_NAMESPACE ApiSetMap;96ULONG TlsExpansionCounter;97PVOID TlsBitmap;98ULONG TlsBitmapBits[2];99PVOID ReadOnlySharedMemoryBase;100PVOID SharedData;101PVOID *ReadOnlyStaticServerData;102PVOID AnsiCodePageData;103PVOID OemCodePageData;104PVOID UnicodeCaseTableData;105ULONG NumberOfProcessors;106ULONG NtGlobalFlag;107ULARGE_INTEGER CriticalSectionTimeout;108SIZE_T HeapSegmentReserve;109SIZE_T HeapSegmentCommit;110SIZE_T HeapDeCommitTotalFreeThreshold;111SIZE_T HeapDeCommitFreeBlockThreshold;112ULONG NumberOfHeaps;113ULONG MaximumNumberOfHeaps;114PVOID *ProcessHeaps;115PVOID GdiSharedHandleTable;116PVOID ProcessStarterHelper;117ULONG GdiDCAttributeList;118PRTL_CRITICAL_SECTION LoaderLock;119ULONG OSMajorVersion;120ULONG OSMinorVersion;121USHORT OSBuildNumber;122} PEB, *PPEB;123124typedef struct _LDR_DATA_TABLE_ENTRY {125LIST_ENTRY InLoadOrderLinks;126LIST_ENTRY InMemoryOrderLinks;127union128{129LIST_ENTRY InInitializationOrderLinks;130LIST_ENTRY InProgressLinks;131};132PVOID DllBase;133PVOID EntryPoint;134ULONG SizeOfImage;135UNICODE_STRING FullDllName;136UNICODE_STRING BaseDllName;137ULONG Flags;138WORD LoadCount;139WORD TlsIndex;140union141{142LIST_ENTRY HashLinks;143struct144{145PVOID SectionPointer;146ULONG CheckSum;147} _hashLinks;148};149union150{151ULONG TimeDateStamp;152PVOID LoadedImports;153};154} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;155156typedef struct _TEB {157PVOID Reserved1[12];158PPEB ProcessEnvironmentBlock;159PVOID Reserved2[399];160BYTE Reserved3[1952];161PVOID TlsSlots[64];162BYTE Reserved4[8];163PVOID Reserved5[26];164PVOID ReservedForOle;165PVOID Reserved6[4];166PVOID TlsExpansionSlots;167} TEB, *PTEB;168169typedef ULONG(NTAPI *_EtwEventWrite)(170__in REGHANDLE RegHandle,171__in PCEVENT_DESCRIPTOR EventDescriptor,172__in ULONG UserDataCount,173__in_ecount_opt(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData174);175176typedef ULONG(NTAPI *_EtwEventWriteFull)(177__in REGHANDLE RegHandle,178__in PCEVENT_DESCRIPTOR EventDescriptor,179__in USHORT EventProperty,180__in_opt LPCGUID ActivityId,181__in_opt LPCGUID RelatedActivityId,182__in ULONG UserDataCount,183__in_ecount_opt(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData184);185186typedef NTSTATUS(NTAPI* pNtProtectVirtualMemory)(187HANDLE ProcessHandle,188PVOID* BaseAddress,189PSIZE_T RegionSize,190ULONG NewProtect,191PULONG OldProtect192);193194typedef NTSTATUS (NTAPI* pNtWriteVirtualMemory)(195HANDLE ProcessHandle,196PVOID BaseAddress,197PVOID Buffer,198ULONG NumberOfBytesToWrite,199PULONG NumberOfBytesWritten200);201202typedef NTSTATUS(NTAPI* pNtReadVirtualMemory)(203HANDLE ProcessHandle,204PVOID BaseAddress,205PVOID Buffer,206ULONG NumberOfBytesToRead,207PULONG NumberOfBytesRead208);209210// Windows 7 SP1 / Server 2008 R2 specific Syscalls211EXTERN_C NTSTATUS ZwProtectVirtualMemory7SP1(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);212EXTERN_C NTSTATUS ZwReadVirtualMemory7SP1(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);213EXTERN_C NTSTATUS ZwWriteVirtualMemory7SP1(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten);214215// Windows 8 / Server 2012 specific Syscalls216EXTERN_C NTSTATUS ZwProtectVirtualMemory80(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);217EXTERN_C NTSTATUS ZwReadVirtualMemory80(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);218EXTERN_C NTSTATUS ZwWriteVirtualMemory80(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten);219220221// Windows 8.1 / Server 2012 R2 specific Syscalls222EXTERN_C NTSTATUS ZwProtectVirtualMemory81(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);223EXTERN_C NTSTATUS ZwReadVirtualMemory81(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);224EXTERN_C NTSTATUS ZwWriteVirtualMemory81(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten);225226227// Windows 10 / Server 2016 specific Syscalls228#ifdef _X64229EXTERN_C NTSTATUS ZwProtectVirtualMemory10(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);230EXTERN_C NTSTATUS ZwReadVirtualMemory10(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);231#else232EXTERN_C NTSTATUS ZwProtectVirtualMemory10_1(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);233EXTERN_C NTSTATUS ZwReadVirtualMemory10_1(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);234EXTERN_C NTSTATUS ZwProtectVirtualMemory10_2(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);235EXTERN_C NTSTATUS ZwReadVirtualMemory10_2(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);236EXTERN_C NTSTATUS ZwProtectVirtualMemory10_3(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);237EXTERN_C NTSTATUS ZwReadVirtualMemory10_3(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);238EXTERN_C NTSTATUS ZwProtectVirtualMemory10_4(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);239EXTERN_C NTSTATUS ZwReadVirtualMemory10_4(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);240#endif241EXTERN_C NTSTATUS ZwWriteVirtualMemory10(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten);242243pNtProtectVirtualMemory ZwProtectVirtualMemory;244pNtWriteVirtualMemory ZwWriteVirtualMemory;245pNtReadVirtualMemory ZwReadVirtualMemory;246247ULONG NTAPI MyEtwEventWrite(248__in REGHANDLE RegHandle,249__in PCEVENT_DESCRIPTOR EventDescriptor,250__in ULONG UserDataCount,251__in_ecount_opt(UserDataCount) PEVENT_DATA_DESCRIPTOR UserData);252253BOOL PatchEtw(HANDLE pipe);254255256