-
Notifications
You must be signed in to change notification settings - Fork 10
/
Win8.h
209 lines (179 loc) · 4.76 KB
/
Win8.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
#pragma once
#include "NT Defs.h"
typedef struct _LDR_DDAG_NODE_WIN8
{
LIST_ENTRY Modules;
PLDR_SERVICE_TAG_RECORD ServiceTagList;
ULONG LoadCount;
ULONG ReferenceCount;
ULONG DependencyCount;
union
{
LDRP_CSLIST Dependencies;
SINGLE_LIST_ENTRY * RemovalLink;
};
PLDRP_CSLIST IncomingDependencies;
LDR_DDAG_STATE State;
SINGLE_LIST_ENTRY CondenseLink;
ULONG PreorderNumber;
ULONG LowestLink;
} LDR_DDAG_NODE_WIN8, * PLDR_DDAG_NODE_WIN8;
typedef struct _LDR_DATA_TABLE_ENTRY_WIN8
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
union
{
LIST_ENTRY InInitializationOrderLinks;
LIST_ENTRY InProgressLinks;
};
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
union
{
UCHAR FlagGroup[4];
ULONG Flags;
struct
{
ULONG PackagedBinary : 1;
ULONG MarkedForRemoval : 1;
ULONG ImageDll : 1;
ULONG LoadNotificationsSent : 1;
ULONG TelemetryEntryProcessed : 1;
ULONG ProcessStaticImport : 1;
ULONG InLegacyLists : 1;
ULONG InIndexes : 1;
ULONG ShimDll : 1;
ULONG InExceptionTable : 1;
ULONG ReservedFlags1 : 2;
ULONG LoadInProgress : 1;
ULONG ReservedFlags2 : 1;
ULONG EntryProcessed : 1;
ULONG ReservedFlags3 : 3;
ULONG DontCallForThreads : 1;
ULONG ProcessAttachCalled : 1;
ULONG ProcessAttachFailed : 1;
ULONG CorDeferredValidate : 1;
ULONG CorImage : 1;
ULONG DontRelocate : 1;
ULONG CorILOnly : 1;
ULONG ReservedFlags5 : 3;
ULONG Redirected : 1;
ULONG ReservedFlags6 : 2;
ULONG CompatDatabaseProcessed : 1;
};
};
WORD ObsoleteLoadCount;
WORD TlsIndex;
LIST_ENTRY HashLinks;
ULONG TimedateStamp;
PVOID EntryPointActivationContext;
PVOID PatchInformation;
LDR_DDAG_NODE_WIN8 * DdagNode;
LIST_ENTRY NodeModuleLink;
PVOID SnapContext;
PVOID ParentDllBase;
PVOID SwitchBackContext;
RTL_BALANCED_NODE BaseAddressIndexNode;
RTL_BALANCED_NODE MappingInfoIndexNode;
ULONG_PTR OriginalBase;
LARGE_INTEGER LoadTime;
ULONG BaseNameHashValue;
LDR_DLL_LOAD_REASON LoadReason;
} LDR_DATA_TABLE_ENTRY_WIN8, * PLDR_DATA_TABLE_ENTRY_WIN8;
typedef struct _LDRP_PATH_SEARCH_CONTEXT_WIN8
{
ULONG_PTR Flags; //probably LDRP_LOAD_CONTEXT_FLAGS
wchar_t * OriginalFullDllName; //can be path
BOOLEAN unknown2; //only low byte relevant
ULONG_PTR unknown3[3]; //sometimes imagebase?
} LDRP_PATH_SEARCH_CONTEXT_WIN8, * PLDRP_PATH_SEARCH_CONTEXT_WIN8;
#ifdef _WIN64
typedef __declspec(align(4)) struct _LDR_DDAG_NODE_WIN8_32
{
LIST_ENTRY32 Modules;
DWORD ServiceTagList; // -> LDR_SERVICE_TAG_RECORD_32
ULONG LoadCount;
ULONG ReferenceCount;
ULONG DependencyCount;
union
{
LDRP_CSLIST_32 Dependencies;
DWORD RemovalLink; // -> SINGLE_LIST_ENTRY_32
};
DWORD IncomingDependencies; // -> LDRP_CSLIST_32
LDR_DDAG_STATE State;
SINGLE_LIST_ENTRY_32 CondenseLink;
ULONG PreorderNumber;
ULONG LowestLink;
} LDR_DDAG_NODE_WIN8_32, * PLDR_DDAG_NODE_WIN8_32;
typedef struct _LDR_DATA_TABLE_ENTRY_WIN8_32
{
LIST_ENTRY32 InLoadOrderLinks;
LIST_ENTRY32 InMemoryOrderLinks;
union
{
LIST_ENTRY32 InInitializationOrderLinks;
LIST_ENTRY32 InProgressLinks;
};
DWORD DllBase;
DWORD EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING_32 FullDllName;
UNICODE_STRING_32 BaseDllName;
union
{
UCHAR FlagGroup[4];
ULONG Flags;
struct
{
ULONG PackagedBinary : 1;
ULONG MarkedForRemoval : 1;
ULONG ImageDll : 1;
ULONG LoadNotificationsSent : 1;
ULONG TelemetryEntryProcessed : 1;
ULONG ProcessStaticImport : 1;
ULONG InLegacyLists : 1;
ULONG InIndexes : 1;
ULONG ShimDll : 1;
ULONG InExceptionTable : 1;
ULONG ReservedFlags1 : 2;
ULONG LoadInProgress : 1;
ULONG ReservedFlags2 : 1;
ULONG EntryProcessed : 1;
ULONG ReservedFlags3 : 3;
ULONG DontCallForThreads : 1;
ULONG ProcessAttachCalled : 1;
ULONG ProcessAttachFailed : 1;
ULONG CorDeferredValidate : 1;
ULONG CorImage : 1;
ULONG DontRelocate : 1;
ULONG CorILOnly : 1;
ULONG ReservedFlags5 : 3;
ULONG Redirected : 1;
ULONG ReservedFlags6 : 2;
ULONG CompatDatabaseProcessed : 1;
};
};
WORD ObsoleteLoadCount;
WORD TlsIndex;
LIST_ENTRY32 HashLinks;
ULONG TimedateStamp;
DWORD EntryPointActivationContext;
DWORD PatchInformation;
DWORD DdagNode; // -> LDR_DDAG_NODE_WIN8_32
LIST_ENTRY32 NodeModuleLink;
DWORD SnapContext;
DWORD ParentDllBase;
DWORD SwitchBackContext;
RTL_BALANCED_NODE_32 BaseAddressIndexNode;
RTL_BALANCED_NODE_32 MappingInfoIndexNode;
DWORD OriginalBase;
LARGE_INTEGER LoadTime;
ULONG BaseNameHashValue;
LDR_DLL_LOAD_REASON LoadReason;
} LDR_DATA_TABLE_ENTRY_WIN8_32, * PLDR_DATA_TABLE_ENTRY_WIN8_32;
#endif