219 lines
5.9 KiB
C++
219 lines
5.9 KiB
C++
#include <windows.h>
|
|
|
|
#ifndef _UNDOCUMENTED_H
|
|
#define _UNDOCUMENTED_H
|
|
//Thanks to: https://github.com/zer0fl4g/Nanomite
|
|
|
|
typedef LONG NTSTATUS;
|
|
|
|
typedef struct _UNICODE_STRING
|
|
{
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} UNICODE_STRING;
|
|
|
|
typedef struct _CLIENT_ID
|
|
{
|
|
HANDLE UniqueProcess;
|
|
HANDLE UniqueThread;
|
|
} CLIENT_ID;
|
|
|
|
typedef struct _RTL_USER_PROCESS_PARAMETERS
|
|
{
|
|
BYTE Reserved1[16];
|
|
PVOID Reserved2[10];
|
|
UNICODE_STRING ImagePathName;
|
|
UNICODE_STRING CommandLine;
|
|
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
|
|
|
|
#pragma pack(push)
|
|
#pragma pack(1)
|
|
template <class T>
|
|
struct LIST_ENTRY_T
|
|
{
|
|
T Flink;
|
|
T Blink;
|
|
};
|
|
|
|
template <class T>
|
|
struct UNICODE_STRING_T
|
|
{
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
WORD Length;
|
|
WORD MaximumLength;
|
|
};
|
|
T dummy;
|
|
};
|
|
T _Buffer;
|
|
};
|
|
template <class T, class NGF, int A>
|
|
struct _PEB_T
|
|
{
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
BYTE InheritedAddressSpace;
|
|
BYTE ReadImageFileExecOptions;
|
|
BYTE BeingDebugged;
|
|
BYTE BitField;
|
|
};
|
|
T dummy01;
|
|
};
|
|
T Mutant;
|
|
T ImageBaseAddress;
|
|
T Ldr;
|
|
T ProcessParameters;
|
|
T SubSystemData;
|
|
T ProcessHeap;
|
|
T FastPebLock;
|
|
T AtlThunkSListPtr;
|
|
T IFEOKey;
|
|
T CrossProcessFlags;
|
|
T UserSharedInfoPtr;
|
|
DWORD SystemReserved;
|
|
DWORD AtlThunkSListPtr32;
|
|
T ApiSetMap;
|
|
T TlsExpansionCounter;
|
|
T TlsBitmap;
|
|
DWORD TlsBitmapBits[2];
|
|
T ReadOnlySharedMemoryBase;
|
|
T HotpatchInformation;
|
|
T ReadOnlyStaticServerData;
|
|
T AnsiCodePageData;
|
|
T OemCodePageData;
|
|
T UnicodeCaseTableData;
|
|
DWORD NumberOfProcessors;
|
|
union
|
|
{
|
|
DWORD NtGlobalFlag;
|
|
NGF dummy02;
|
|
};
|
|
LARGE_INTEGER CriticalSectionTimeout;
|
|
T HeapSegmentReserve;
|
|
T HeapSegmentCommit;
|
|
T HeapDeCommitTotalFreeThreshold;
|
|
T HeapDeCommitFreeBlockThreshold;
|
|
DWORD NumberOfHeaps;
|
|
DWORD MaximumNumberOfHeaps;
|
|
T ProcessHeaps;
|
|
T GdiSharedHandleTable;
|
|
T ProcessStarterHelper;
|
|
T GdiDCAttributeList;
|
|
T LoaderLock;
|
|
DWORD OSMajorVersion;
|
|
DWORD OSMinorVersion;
|
|
WORD OSBuildNumber;
|
|
WORD OSCSDVersion;
|
|
DWORD OSPlatformId;
|
|
DWORD ImageSubsystem;
|
|
DWORD ImageSubsystemMajorVersion;
|
|
T ImageSubsystemMinorVersion;
|
|
T ActiveProcessAffinityMask;
|
|
T GdiHandleBuffer[A];
|
|
T PostProcessInitRoutine;
|
|
T TlsExpansionBitmap;
|
|
DWORD TlsExpansionBitmapBits[32];
|
|
T SessionId;
|
|
ULARGE_INTEGER AppCompatFlags;
|
|
ULARGE_INTEGER AppCompatFlagsUser;
|
|
T pShimData;
|
|
T AppCompatInfo;
|
|
UNICODE_STRING_T<T> CSDVersion;
|
|
T ActivationContextData;
|
|
T ProcessAssemblyStorageMap;
|
|
T SystemDefaultActivationContextData;
|
|
T SystemAssemblyStorageMap;
|
|
T MinimumStackCommit;
|
|
T FlsCallback;
|
|
LIST_ENTRY_T<T> FlsListHead;
|
|
T FlsBitmap;
|
|
DWORD FlsBitmapBits[4];
|
|
T FlsHighIndex;
|
|
T WerRegistrationData;
|
|
T WerShipAssertPtr;
|
|
T pContextData;
|
|
T pImageHeaderHash;
|
|
T TracingFlags;
|
|
};
|
|
|
|
typedef _PEB_T<DWORD, DWORD64, 34> PEB32;
|
|
typedef _PEB_T<DWORD64, DWORD, 30> PEB64;
|
|
|
|
#pragma pack(pop)
|
|
|
|
#ifdef _WIN64 //x64
|
|
typedef PEB64 PEB;
|
|
#else //x86
|
|
typedef PEB32 PEB;
|
|
#endif //_WIN64
|
|
|
|
typedef PEB* PPEB;
|
|
|
|
typedef struct _TEB
|
|
{
|
|
NT_TIB Tib;
|
|
PVOID EnvironmentPointer;
|
|
CLIENT_ID Cid;
|
|
PVOID ActiveRpcInfo;
|
|
PVOID ThreadLocalStoragePointer;
|
|
PPEB Peb;
|
|
ULONG LastErrorValue;
|
|
ULONG CountOfOwnedCriticalSections;
|
|
PVOID CsrClientThread;
|
|
PVOID Win32ThreadInfo;
|
|
ULONG Win32ClientInfo[0x1F];
|
|
PVOID WOW32Reserved;
|
|
ULONG CurrentLocale;
|
|
ULONG FpSoftwareStatusRegister;
|
|
PVOID SystemReserved1[0x36];
|
|
PVOID Spare1;
|
|
ULONG ExceptionCode;
|
|
ULONG SpareBytes1[0x28];
|
|
PVOID SystemReserved2[0xA];
|
|
ULONG GdiRgn;
|
|
ULONG GdiPen;
|
|
ULONG GdiBrush;
|
|
CLIENT_ID RealClientId;
|
|
PVOID GdiCachedProcessHandle;
|
|
ULONG GdiClientPID;
|
|
ULONG GdiClientTID;
|
|
PVOID GdiThreadLocaleInfo;
|
|
PVOID UserReserved[5];
|
|
PVOID GlDispatchTable[0x118];
|
|
ULONG GlReserved1[0x1A];
|
|
PVOID GlReserved2;
|
|
PVOID GlSectionInfo;
|
|
PVOID GlSection;
|
|
PVOID GlTable;
|
|
PVOID GlCurrentRC;
|
|
PVOID GlContext;
|
|
NTSTATUS LastStatusValue;
|
|
UNICODE_STRING StaticUnicodeString;
|
|
WCHAR StaticUnicodeBuffer[0x105];
|
|
PVOID DeallocationStack;
|
|
PVOID TlsSlots[0x40];
|
|
LIST_ENTRY TlsLinks;
|
|
PVOID Vdm;
|
|
PVOID ReservedForNtRpc;
|
|
PVOID DbgSsReserved[0x2];
|
|
ULONG HardErrorDisabled;
|
|
PVOID Instrumentation[0x10];
|
|
PVOID WinSockData;
|
|
ULONG GdiBatchCount;
|
|
ULONG Spare2;
|
|
ULONG Spare3;
|
|
ULONG Spare4;
|
|
PVOID ReservedForOle;
|
|
ULONG WaitingOnLoaderLock;
|
|
PVOID StackCommit;
|
|
PVOID StackCommitMax;
|
|
PVOID StackReserved;
|
|
} TEB, *PTEB;
|
|
|
|
|
|
#endif /* _UNDOCUMENTED_H */ |