Stubs.h

/*
*
* Copyright (c) 2015-2017 by blindtiger ( blindtiger@foxmail.com )
*
* The contents of this file are subject to the Mozilla Public License Version
* 2.0 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. Ree the License
* for the specific language governing rights and limitations under the
* License.
*
* The Initial Developer of the Original e is blindtiger.
*
*/

#ifndef _STUBS_H_
#define _STUBS_H_

#ifdef __cplusplus
/* Assume C declarations for C++ */
extern "C" {
#endif	/* __cplusplus */

    typedef enum _KSTUBS_CLASS {
        NumberAcceptConnectPort,
        NumberAccessCheck,
        NumberAccessCheckAndAuditAlarm,
        NumberAccessCheckByType,
        NumberAccessCheckByTypeAndAuditAlarm,
        NumberAccessCheckByTypeResultList,
        NumberAccessCheckByTypeResultListAndAuditAlarm,
        NumberAccessCheckByTypeResultListAndAuditAlarmByHandle,
        NumberAcquireCMFViewOwnership,
        NumberAcquireProcessActivityReference,
        NumberAddAtom,
        NumberAddAtomEx,
        NumberAddBootEntry,
        NumberAddDriverEntry,
        NumberAdjustGroupsToken,
        NumberAdjustPrivilegesToken,
        NumberAdjustTokenClaimsAndDeviceGroups,
        NumberAlertResumeThread,
        NumberAlertThread,
        NumberAlertThreadByThreadId,
        NumberAllocateLocallyUniqueId,
        NumberAllocateReserveObject,
        NumberAllocateUserPhysicalPages,
        NumberAllocateUuids,
        NumberAllocateVirtualMemory,
        NumberAllocateVirtualMemoryEx,
        NumberAlpcAcceptConnectPort,
        NumberAlpcCancelMessage,
        NumberAlpcConnectPort,
        NumberAlpcConnectPortEx,
        NumberAlpcCreatePort,
        NumberAlpcCreatePortSection,
        NumberAlpcCreateResourceReserve,
        NumberAlpcCreateSectionView,
        NumberAlpcCreateSecurityContext,
        NumberAlpcDeletePortSection,
        NumberAlpcDeleteResourceReserve,
        NumberAlpcDeleteSectionView,
        NumberAlpcDeleteSecurityContext,
        NumberAlpcDisconnectPort,
        NumberAlpcImpersonateClientContainerOfPort,
        NumberAlpcImpersonateClientOfPort,
        NumberAlpcOpenSenderProcess,
        NumberAlpcOpenSenderThread,
        NumberAlpcQueryInformation,
        NumberAlpcQueryInformationMessage,
        NumberAlpcRevokeSecurityContext,
        NumberAlpcSendWaitReceivePort,
        NumberAlpcSetInformation,
        NumberApphelpCacheControl,
        NumberAreMappedFilesTheSame,
        NumberAssignProcessToJobObject,
        NumberAssociateWaitCompletionPacket,
        NumberCallEnclave,
        NumberCallbackReturn,
        NumberCancelDeviceWakeupRequest,
        NumberCancelIoFile,
        NumberCancelIoFileEx,
        NumberCancelSynchronousIoFile,
        NumberCancelTimer,
        NumberCancelTimer2,
        NumberCancelWaitCompletionPacket,
        NumberClearAllSavepointsTransaction,
        NumberClearEvent,
        NumberClearSavepointTransaction,
        NumberClose,
        NumberCloseObjectAuditAlarm,
        NumberCommitComplete,
        NumberCommitEnlistment,
        NumberCommitRegistryTransaction,
        NumberCommitTransaction,
        NumberCompactKeys,
        NumberCompareObjects,
        NumberCompareSigningLevels,
        NumberCompareTokens,
        NumberCompleteConnectPort,
        NumberCompressKey,
        NumberConnectPort,
        NumberContinue,
        NumberConvertBetweenAuxiliaryCounterAndPerformanceCounter,
        NumberCreateDebugObject,
        NumberCreateDirectoryObject,
        NumberCreateDirectoryObjectEx,
        NumberCreateEnclave,
        NumberCreateEnlistment,
        NumberCreateEvent,
        NumberCreateEventPair,
        NumberCreateFile,
        NumberCreateIRTimer,
        NumberCreateIoCompletion,
        NumberCreateJobObject,
        NumberCreateJobSet,
        NumberCreateKey,
        NumberCreateKeyTransacted,
        NumberCreateKeyedEvent,
        NumberCreateLowBoxToken,
        NumberCreateMailslotFile,
        NumberCreateMutant,
        NumberCreateNamedPipeFile,
        NumberCreatePagingFile,
        NumberCreatePartition,
        NumberCreatePort,
        NumberCreatePrivateNamespace,
        NumberCreateProcess,
        NumberCreateProcessEx,
        NumberCreateProfile,
        NumberCreateProfileEx,
        NumberCreateRegistryTransaction,
        NumberCreateResourceManager,
        NumberCreateSection,
        NumberCreateSemaphore,
        NumberCreateSymbolicLinkObject,
        NumberCreateThread,
        NumberCreateThreadEx,
        NumberCreateTimer,
        NumberCreateTimer2,
        NumberCreateToken,
        NumberCreateTokenEx,
        NumberCreateTransaction,
        NumberCreateTransactionManager,
        NumberCreateUserProcess,
        NumberCreateWaitCompletionPacket,
        NumberCreateWaitablePort,
        NumberCreateWnfStateName,
        NumberCreateWorkerFactory,
        NumberDebugActiveProcess,
        NumberDebugContinue,
        NumberDelayExecution,
        NumberDeleteAtom,
        NumberDeleteBootEntry,
        NumberDeleteDriverEntry,
        NumberDeleteFile,
        NumberDeleteKey,
        NumberDeleteObjectAuditAlarm,
        NumberDeletePrivateNamespace,
        NumberDeleteValueKey,
        NumberDeleteWnfStateData,
        NumberDeleteWnfStateName,
        NumberDeviceIoControlFile,
        NumberDisableLastKnownGood,
        NumberDisplayString,
        NumberDrawText,
        NumberDuplicateObject,
        NumberDuplicateToken,
        NumberEnableLastKnownGood,
        NumberEnumerateBootEntries,
        NumberEnumerateDriverEntries,
        NumberEnumerateKey,
        NumberEnumerateSystemEnvironmentValuesEx,
        NumberEnumerateTransactionObject,
        NumberEnumerateValueKey,
        NumberExtendSection,
        NumberFilterBootOption,
        NumberFilterToken,
        NumberFilterTokenEx,
        NumberFindAtom,
        NumberFlushBuffersFile,
        NumberFlushBuffersFileEx,
        NumberFlushInstallUILanguage,
        NumberFlushInstructionCache,
        NumberFlushKey,
        NumberFlushProcessWriteBuffers,
        NumberFlushVirtualMemory,
        NumberFlushWriteBuffer,
        NumberFreeUserPhysicalPages,
        NumberFreeVirtualMemory,
        NumberFreezeRegistry,
        NumberFreezeTransactions,
        NumberFsControlFile,
        NumberGetCachedSigningLevel,
        NumberGetCompleteWnfStateSubscription,
        NumberGetContextThread,
        NumberGetCurrentProcessorNumber,
        NumberGetCurrentProcessorNumberEx,
        NumberGetDevicePowerState,
        NumberGetMUIRegistryInfo,
        NumberGetNextProcess,
        NumberGetNextThread,
        NumberGetNlsSectionPtr,
        NumberGetNotificationResourceManager,
        NumberGetPlugPlayEvent,
        NumberGetWriteWatch,
        NumberImpersonateAnonymousToken,
        NumberImpersonateClientOfPort,
        NumberImpersonateThread,
        NumberInitializeEnclave,
        NumberInitializeNlsFiles,
        NumberInitializeRegistry,
        NumberInitiatePowerAction,
        NumberIsProcessInJob,
        NumberIsSystemResumeAutomatic,
        NumberIsUILanguageComitted,
        NumberListTransactions,
        NumberListenPort,
        NumberLoadDriver,
        NumberLoadEnclaveData,
        NumberLoadHotPatch,
        NumberLoadKey,
        NumberLoadKey2,
        NumberLoadKeyEx,
        NumberLockFile,
        NumberLockProductActivationKeys,
        NumberLockRegistryKey,
        NumberLockVirtualMemory,
        NumberMakePermanentObject,
        NumberMakeTemporaryObject,
        NumberManagePartition,
        NumberMapCMFModule,
        NumberMapUserPhysicalPages,
        NumberMapUserPhysicalPagesScatter,
        NumberMapViewOfSection,
        NumberMapViewOfSectionEx,
        NumberMarshallTransaction,
        NumberModifyBootEntry,
        NumberModifyDriverEntry,
        NumberNotifyChangeDirectoryFile,
        NumberNotifyChangeDirectoryFileEx,
        NumberNotifyChangeKey,
        NumberNotifyChangeMultipleKeys,
        NumberNotifyChangeSession,
        NumberOpenDirectoryObject,
        NumberOpenEnlistment,
        NumberOpenEvent,
        NumberOpenEventPair,
        NumberOpenFile,
        NumberOpenIoCompletion,
        NumberOpenJobObject,
        NumberOpenKey,
        NumberOpenKeyEx,
        NumberOpenKeyTransacted,
        NumberOpenKeyTransactedEx,
        NumberOpenKeyedEvent,
        NumberOpenMutant,
        NumberOpenObjectAuditAlarm,
        NumberOpenPartition,
        NumberOpenPrivateNamespace,
        NumberOpenProcess,
        NumberOpenProcessToken,
        NumberOpenProcessTokenEx,
        NumberOpenRegistryTransaction,
        NumberOpenResourceManager,
        NumberOpenSection,
        NumberOpenSemaphore,
        NumberOpenSession,
        NumberOpenSymbolicLinkObject,
        NumberOpenThread,
        NumberOpenThreadToken,
        NumberOpenThreadTokenEx,
        NumberOpenTimer,
        NumberOpenTransaction,
        NumberOpenTransactionManager,
        NumberPlugPlayControl,
        NumberPowerInformation,
        NumberPrePrepareComplete,
        NumberPrePrepareEnlistment,
        NumberPrepareComplete,
        NumberPrepareEnlistment,
        NumberPrivilegeCheck,
        NumberPrivilegeObjectAuditAlarm,
        NumberPrivilegedServiceAuditAlarm,
        NumberPropagationComplete,
        NumberPropagationFailed,
        NumberProtectVirtualMemory,
        NumberPullTransaction,
        NumberPulseEvent,
        NumberQueryAttributesFile,
        NumberQueryAuxiliaryCounterFrequency,
        NumberQueryBootEntryOrder,
        NumberQueryBootOptions,
        NumberQueryDebugFilterState,
        NumberQueryDefaultLocale,
        NumberQueryDefaultUILanguage,
        NumberQueryDirectoryFile,
        NumberQueryDirectoryFileEx,
        NumberQueryDirectoryObject,
        NumberQueryDriverEntryOrder,
        NumberQueryEaFile,
        NumberQueryEvent,
        NumberQueryFullAttributesFile,
        NumberQueryInformationAtom,
        NumberQueryInformationByName,
        NumberQueryInformationEnlistment,
        NumberQueryInformationFile,
        NumberQueryInformationJobObject,
        NumberQueryInformationPort,
        NumberQueryInformationProcess,
        NumberQueryInformationResourceManager,
        NumberQueryInformationThread,
        NumberQueryInformationToken,
        NumberQueryInformationTransaction,
        NumberQueryInformationTransactionManager,
        NumberQueryInformationWorkerFactory,
        NumberQueryInstallUILanguage,
        NumberQueryIntervalProfile,
        NumberQueryIoCompletion,
        NumberQueryKey,
        NumberQueryLicenseValue,
        NumberQueryMultipleValueKey,
        NumberQueryMutant,
        NumberQueryObject,
        NumberQueryOpenSubKeys,
        NumberQueryOpenSubKeysEx,
        NumberQueryPerformanceCounter,
        NumberQueryPortInformationProcess,
        NumberQueryQuotaInformationFile,
        NumberQuerySection,
        NumberQuerySecurityAttributesToken,
        NumberQuerySecurityObject,
        NumberQuerySecurityPolicy,
        NumberQuerySemaphore,
        NumberQuerySymbolicLinkObject,
        NumberQuerySystemEnvironmentValue,
        NumberQuerySystemEnvironmentValueEx,
        NumberQuerySystemInformation,
        NumberQuerySystemInformationEx,
        NumberQuerySystemTime,
        NumberQueryTimer,
        NumberQueryTimerResolution,
        NumberQueryValueKey,
        NumberQueryVirtualMemory,
        NumberQueryVolumeInformationFile,
        NumberQueryWnfStateData,
        NumberQueryWnfStateNameInformation,
        NumberQueueApcThread,
        NumberQueueApcThreadEx,
        NumberRaiseException,
        NumberRaiseHardError,
        NumberReadFile,
        NumberReadFileScatter,
        NumberReadOnlyEnlistment,
        NumberReadRequestData,
        NumberReadVirtualMemory,
        NumberRecoverEnlistment,
        NumberRecoverResourceManager,
        NumberRecoverTransactionManager,
        NumberRegisterProtocolAddressInformation,
        NumberRegisterThreadTerminatePort,
        NumberReleaseCMFViewOwnership,
        NumberReleaseKeyedEvent,
        NumberReleaseMutant,
        NumberReleaseSemaphore,
        NumberReleaseWorkerFactoryWorker,
        NumberRemoveIoCompletion,
        NumberRemoveIoCompletionEx,
        NumberRemoveProcessDebug,
        NumberRenameKey,
        NumberRenameTransactionManager,
        NumberReplaceKey,
        NumberReplacePartitionUnit,
        NumberReplyPort,
        NumberReplyWaitReceivePort,
        NumberReplyWaitReceivePortEx,
        NumberReplyWaitReplyPort,
        NumberRequestDeviceWakeup,
        NumberRequestPort,
        NumberRequestWaitReplyPort,
        NumberRequestWakeupLatency,
        NumberResetEvent,
        NumberResetWriteWatch,
        NumberRestoreKey,
        NumberResumeProcess,
        NumberResumeThread,
        NumberRevertContainerImpersonation,
        NumberRollbackComplete,
        NumberRollbackEnlistment,
        NumberRollbackRegistryTransaction,
        NumberRollbackSavepointTransaction,
        NumberRollbackTransaction,
        NumberRollforwardTransactionManager,
        NumberSaveKey,
        NumberSaveKeyEx,
        NumberSaveMergedKeys,
        NumberSavepointComplete,
        NumberSavepointTransaction,
        NumberSecureConnectPort,
        NumberSerializeBoot,
        NumberSetBootEntryOrder,
        NumberSetBootOptions,
        NumberSetCachedSigningLevel,
        NumberSetCachedSigningLevel2,
        NumberSetContextThread,
        NumberSetDebugFilterState,
        NumberSetDefaultHardErrorPort,
        NumberSetDefaultLocale,
        NumberSetDefaultUILanguage,
        NumberSetDriverEntryOrder,
        NumberSetEaFile,
        NumberSetEvent,
        NumberSetEventBoostPriority,
        NumberSetHighEventPair,
        NumberSetHighWaitLowEventPair,
        NumberSetIRTimer,
        NumberSetInformationDebugObject,
        NumberSetInformationEnlistment,
        NumberSetInformationFile,
        NumberSetInformationJobObject,
        NumberSetInformationKey,
        NumberSetInformationObject,
        NumberSetInformationProcess,
        NumberSetInformationResourceManager,
        NumberSetInformationSymbolicLink,
        NumberSetInformationThread,
        NumberSetInformationToken,
        NumberSetInformationTransaction,
        NumberSetInformationTransactionManager,
        NumberSetInformationVirtualMemory,
        NumberSetInformationWorkerFactory,
        NumberSetIntervalProfile,
        NumberSetIoCompletion,
        NumberSetIoCompletionEx,
        NumberSetLdtEntries,
        NumberSetLowEventPair,
        NumberSetLowWaitHighEventPair,
        NumberSetQuotaInformationFile,
        NumberSetSecurityObject,
        NumberSetSystemEnvironmentValue,
        NumberSetSystemEnvironmentValueEx,
        NumberSetSystemInformation,
        NumberSetSystemPowerState,
        NumberSetSystemTime,
        NumberSetThreadExecutionState,
        NumberSetTimer,
        NumberSetTimer2,
        NumberSetTimerEx,
        NumberSetTimerResolution,
        NumberSetUuidSeed,
        NumberSetValueKey,
        NumberSetVolumeInformationFile,
        NumberSetWnfProcessNotificationEvent,
        NumberShutdownSystem,
        NumberShutdownWorkerFactory,
        NumberSignalAndWaitForSingleObject,
        NumberSinglePhaseReject,
        NumberStartProfile,
        NumberStartTm,
        NumberStopProfile,
        NumberSubscribeWnfStateChange,
        NumberSuspendProcess,
        NumberSuspendThread,
        NumberSystemDebugControl,
        NumberTerminateEnclave,
        NumberTerminateJobObject,
        NumberTerminateProcess,
        NumberTerminateThread,
        NumberTestAlert,
        NumberThawRegistry,
        NumberThawTransactions,
        NumberTraceControl,
        NumberTraceEvent,
        NumberTranslateFilePath,
        NumberUmsThreadYield,
        NumberUnloadDriver,
        NumberUnloadKey,
        NumberUnloadKey2,
        NumberUnloadKeyEx,
        NumberUnlockFile,
        NumberUnlockVirtualMemory,
        NumberUnmapViewOfSection,
        NumberUnmapViewOfSectionEx,
        NumberUnsubscribeWnfStateChange,
        NumberUpdateWnfStateData,
        NumberVdmControl,
        NumberWaitForAlertByThreadId,
        NumberWaitForDebugEvent,
        NumberWaitForKeyedEvent,
        NumberWaitForMultipleObjects,
        NumberWaitForMultipleObjects32,
        NumberWaitForSingleObject,
        NumberWaitForWnfNotifications,
        NumberWaitForWorkViaWorkerFactory,
        NumberWaitHighEventPair,
        NumberWaitLowEventPair,
        NumberWorkerFactoryWorkerReady,
        NumberWriteFile,
        NumberWriteFileGather,
        NumberWriteRequestData,
        NumberWriteVirtualMemory,
        NumberYieldExecution,
        MaxNumberStubs
    }KSTUBS_CLASS;

#ifndef _WIN64

    typedef struct _KSTUBS_ENTRY {
#pragma pack(push, 1)
        CHAR Reserved1[1];

        union {
            CHAR Reserved2[4];
            ULONG KiServiceTableIndex;
        }u1;

        CHAR Reserved3[8];

        union {
            CHAR Reserved4[4];
            ULONG KiSystemService;
        }u2;

        CHAR Ret[3];
        CHAR Alignment[12];
#pragma pack(pop)
    } KSTUBS_ENTRY, *PKSTUBS_ENTRY;

    C_ASSERT(FIELD_OFFSET(KSTUBS_ENTRY, u1.KiServiceTableIndex) == 1);
    C_ASSERT(FIELD_OFFSET(KSTUBS_ENTRY, u2.KiSystemService) == 0xd);
    C_ASSERT(sizeof(KSTUBS_ENTRY) == 0x20);
#else
    typedef struct _KSTUBS_ENTRY {
#pragma pack(push, 1)
        CHAR Reserved1[34];

        union {
            CHAR Reserved2[8];
            ULONGLONG KiServiceLinkage;
        }u1;

        CHAR Reserved3[2];

        union {
            CHAR Reserved4[4];
            ULONG KiServiceTableIndex;
        }u2;

        CHAR Reserved5[2];

        union {
            CHAR Reserved6[8];
            ULONGLONG KiServiceInternal;
        }u3;

        CHAR Reserved7[3];
        CHAR Alignment[3];
#pragma pack(pop)
    } KSTUBS_ENTRY, *PKSTUBS_ENTRY;

    C_ASSERT(FIELD_OFFSET(KSTUBS_ENTRY, u1.KiServiceLinkage) == 0x22);
    C_ASSERT(FIELD_OFFSET(KSTUBS_ENTRY, u2.KiServiceTableIndex) == 0x2c);
    C_ASSERT(FIELD_OFFSET(KSTUBS_ENTRY, u3.KiServiceInternal) == 0x32);
    C_ASSERT(sizeof(KSTUBS_ENTRY) == 0x40);
#endif // !_WIN64

#ifdef __cplusplus
}
#endif	/* __cplusplus */

#endif // !_STUBS_H_