-
Notifications
You must be signed in to change notification settings - Fork 10
/
Win7.h
151 lines (124 loc) · 3.46 KB
/
Win7.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
#pragma once
#include "NT Defs.h"
//some flags might not be Win7 but w/e, stolen from here:
//https://doxygen.reactos.org/d1/d97/ldrtypes_8h_source.html#l00034
//0x00000001
#define LDRP_STATIC_LINK 0x00000002
#define LDRP_IMAGE_DLL 0x00000004
#define LDRP_SHIMENG_ENTRY_PROCESSED 0x00000008
#define LDRP_TELEMETRY_ENTRY_PROCESSED 0x00000010
#define LDRP_IMAGE_INTEGRITY_FORCED 0x00000020
//0x00000040 - 0x00000800
#define LDRP_LOAD_IN_PROGRESS 0x00001000
#define LDRP_UNLOAD_IN_PROGRESS 0x00002000
#define LDRP_ENTRY_PROCESSED 0x00004000
#define LDRP_ENTRY_INSERTED 0x00008000
#define LDRP_CURRENT_LOAD 0x00010000
#define LDRP_FAILED_BUILTIN_LOAD 0x00020000
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000
#define LDRP_COR_IMAGE 0x00400000
#define LDR_COR_OWNS_UNMAP 0x00800000
#define LDRP_SYSTEM_MAPPED 0x01000000
#define LDRP_IMAGE_VERIFYING 0x02000000
#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000
#define LDRP_ENTRY_NATIVE 0x08000000
#define LDRP_REDIRECTED 0x10000000
#define LDRP_NON_PAGED_DEBUG_INFO 0x20000000
#define LDRP_MM_LOADED 0x40000000
#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000
typedef struct _LDR_DDAG_NODE_WIN7 //dummy for macros
{
} LDR_DDAG_NODE_WIN7, * PLDR_DDAG_NODE_WIN7;
typedef struct _LDR_DATA_TABLE_ENTRY_WIN7
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
WORD LoadCount;
WORD TlsIndex;
union
{
LIST_ENTRY HashLinks;
struct
{
PVOID SectionPointer;
ULONG CheckSum;
};
};
union
{
ULONG TimeDateStamp;
PVOID LoadedImports;
};
PVOID EntryPointActivationContext;
PVOID PatchInformation;
LIST_ENTRY ForwarderLinks;
LIST_ENTRY ServiceTagLinks;
LIST_ENTRY StaticLinks;
PVOID ContextInformation;
ULONG_PTR OriginalBase;
LARGE_INTEGER LoadTime;
} LDR_DATA_TABLE_ENTRY_WIN7, * PLDR_DATA_TABLE_ENTRY_WIN7;
typedef struct _RTL_INVERTED_FUNCTION_TABLE_WIN7
{
ULONG Count;
ULONG MaxCount;
ULONG Epoch;
RTL_INVERTED_FUNCTION_TABLE_ENTRY Entries[ANYSIZE_ARRAY];
} RTL_INVERTED_FUNCTION_TABLE_WIN7, * PRTL_INVERTED_FUNCTION_TABLE_WIN7;
#ifdef _WIN64
typedef struct _LDR_DDAG_NODE_WIN7_32 //dummy for macros
{
} LDR_DDAG_NODE_WIN7_32, * PLDR_DDAG_NODE_WIN7_32;
typedef struct _LDR_DATA_TABLE_ENTRY_WIN7_32
{
LIST_ENTRY32 InLoadOrderLinks;
LIST_ENTRY32 InMemoryOrderLinks;
LIST_ENTRY32 InInitializationOrderLinks;
DWORD DllBase;
DWORD EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING_32 FullDllName;
UNICODE_STRING_32 BaseDllName;
ULONG Flags;
WORD LoadCount;
WORD TlsIndex;
union
{
LIST_ENTRY32 HashLinks;
struct
{
DWORD SectionPointer;
ULONG CheckSum;
};
};
union
{
ULONG TimeDateStamp;
DWORD LoadedImports;
};
DWORD EntryPointActivationContext;
DWORD PatchInformation;
LIST_ENTRY32 ForwarderLinks;
LIST_ENTRY32 ServiceTagLinks;
LIST_ENTRY32 StaticLinks;
DWORD ContextInformation;
DWORD OriginalBase;
LARGE_INTEGER LoadTime;
} LDR_DATA_TABLE_ENTRY_WIN7_32, * PLDR_DATA_TABLE_ENTRY_WIN7_32;
typedef struct _RTL_VECTORED_EXCEPTION_ENTRY_WIN7_32 //prototype
{
LIST_ENTRY32 List;
DWORD Flag;
DWORD VectoredHandler; //PVECTORED_EXCEPTION_HANDLER
} RTL_VECTORED_EXCEPTION_ENTRY_WIN7_32, * PRTL_VECTORED_EXCEPTION_ENTRY_WIN7_32;
#endif