/************************************************************************************* * Author: Jeff Tang <jtang@cylance.com> * Copyright (c) 2017 Cylance Inc. All rights reserved. * * * * Redistribution and use in source and binary forms, with or without modification, * * are permitted provided that the following conditions are met: * * * * 1. Redistributions of source code must retain the above copyright notice, this * * list of conditions and the following disclaimer. * * * * 2. Redistributions in binary form must reproduce the above copyright notice, * * this list of conditions and the following disclaimer in the documentation and/or * * other materials provided with the distribution. * * * * 3. Neither the name of the copyright holder nor the names of its contributors * * may be used to endorse or promote products derived from this software without * * specific prior written permission. * * * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR * * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * * * *************************************************************************************/ #pragma once #ifndef _APISETMAP_H_ #define _APISETMAP_H_ #define WIN32_LEAN_AND_MEAN #include <windows.h> #include "../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.h" _PPEB GetProcessEnvironmentBlock(); PLDR_DATA_TABLE_ENTRY GetInMemoryOrderModuleList(); // Win 10 typedef struct _API_SET_VALUE_ENTRY_V6 { ULONG Flags; ULONG NameOffset; ULONG NameLength; ULONG ValueOffset; ULONG ValueLength; } API_SET_VALUE_ENTRY_V6, *PAPI_SET_VALUE_ENTRY_V6; typedef struct _API_SET_NAMESPACE_HASH_ENTRY_V6 { ULONG Hash; ULONG Index; } API_SET_NAMESPACE_HASH_ENTRY_V6, *PAPI_SET_NAMESPACE_HASH_ENTRY_V6; typedef struct _API_SET_NAMESPACE_ENTRY_V6 { ULONG Flags; ULONG NameOffset; ULONG Size; ULONG NameLength; ULONG DataOffset; ULONG Count; } API_SET_NAMESPACE_ENTRY_V6, *PAPI_SET_NAMESPACE_ENTRY_V6; typedef struct _API_SET_NAMESPACE_ARRAY_V6 { ULONG Version; ULONG Size; ULONG Flags; ULONG Count; ULONG DataOffset; ULONG HashOffset; ULONG Multiplier; API_SET_NAMESPACE_ENTRY_V6 Array[ANYSIZE_ARRAY]; } API_SET_NAMESPACE_ARRAY_V6, *PAPI_SET_NAMESPACE_ARRAY_V6; // Windows 8.1 typedef struct _API_SET_VALUE_ENTRY_V4 { ULONG Flags; ULONG NameOffset; ULONG NameLength; ULONG ValueOffset; ULONG ValueLength; } API_SET_VALUE_ENTRY_V4, *PAPI_SET_VALUE_ENTRY_V4; typedef struct _API_SET_VALUE_ARRAY_V4 { ULONG Flags; ULONG Count; API_SET_VALUE_ENTRY_V4 Array[ANYSIZE_ARRAY]; } API_SET_VALUE_ARRAY_V4, *PAPI_SET_VALUE_ARRAY_V4; typedef struct _API_SET_NAMESPACE_ENTRY_V4 { ULONG Flags; ULONG NameOffset; ULONG NameLength; ULONG AliasOffset; ULONG AliasLength; ULONG DataOffset; } API_SET_NAMESPACE_ENTRY_V4, *PAPI_SET_NAMESPACE_ENTRY_V4; typedef struct _API_SET_NAMESPACE_ARRAY_V4 { ULONG Version; ULONG Size; ULONG Flags; ULONG Count; API_SET_NAMESPACE_ENTRY_V4 Array[ANYSIZE_ARRAY]; } API_SET_NAMESPACE_ARRAY_V4, *PAPI_SET_NAMESPACE_ARRAY_V4; // Windows 7/8 typedef struct _API_SET_VALUE_ENTRY_V2 { ULONG NameOffset; ULONG NameLength; ULONG ValueOffset; ULONG ValueLength; } API_SET_VALUE_ENTRY_V2, *PAPI_SET_VALUE_ENTRY_V2; typedef struct _API_SET_VALUE_ARRAY_V2 { ULONG Count; API_SET_VALUE_ENTRY_V2 Array[ANYSIZE_ARRAY]; } API_SET_VALUE_ARRAY_V2, *PAPI_SET_VALUE_ARRAY_V2; typedef struct _API_SET_NAMESPACE_ENTRY_V2 { ULONG NameOffset; ULONG NameLength; ULONG DataOffset; } API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2; typedef struct _API_SET_NAMESPACE_ARRAY_V2 { ULONG Version; ULONG Count; API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY]; } API_SET_NAMESPACE_ARRAY_V2, *PAPI_SET_NAMESPACE_ARRAY_V2; PWCHAR GetRedirectedName(const PWSTR wszImportingModule, const PWSTR wszVirtualModule, SIZE_T* stSize); PWCHAR GetRedirectedName_V6(const PWSTR wszImportingModule, const PWSTR wszVirtualModule, SIZE_T* stSize); PWCHAR GetRedirectedName_V4(const PWSTR wszImportingModule, const PWSTR wszVirtualModule, SIZE_T* stSize); PWCHAR GetRedirectedName_V2(const PWSTR wszImportingModule, const PWSTR wszVirtualModule, SIZE_T* stSize); #endif // _APISETMAP_H_