#pragma once

// Code below is adapted from @modexpblog. Read linked article for more details.

// https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams

#ifndef SW2_HEADER_H_

#define SW2_HEADER_H_

#include <Windows.h>

#define SW2_SEED 0x874DD416

#define SW2_ROL8(v) (v << 8 | v >> 24)

#define SW2_ROR8(v) (v >> 8 | v << 24)

#define SW2_ROX8(v) ((SW2_SEED % 2) ? SW2_ROL8(v) : SW2_ROR8(v))

#define SW2_MAX_ENTRIES 500

#define SW2_RVA2VA(Type, DllBase, Rva) (Type)((ULONG_PTR) DllBase + Rva)

// Typedefs are prefixed to avoid pollution.

typedef struct _SW2_SYSCALL_ENTRY

{

DWORD Hash;

DWORD Address;

} SW2_SYSCALL_ENTRY, *PSW2_SYSCALL_ENTRY;

typedef struct _SW2_SYSCALL_LIST

{

DWORD Count;

SW2_SYSCALL_ENTRY Entries[SW2_MAX_ENTRIES];

} SW2_SYSCALL_LIST, *PSW2_SYSCALL_LIST;

typedef struct _SW2_PEB_LDR_DATA {

BYTE Reserved1[8];

PVOID Reserved2[3];

LIST_ENTRY InMemoryOrderModuleList;

} SW2_PEB_LDR_DATA, *PSW2_PEB_LDR_DATA;

typedef struct _SW2_LDR_DATA_TABLE_ENTRY {

PVOID Reserved1[2];

LIST_ENTRY InMemoryOrderLinks;

PVOID Reserved2[2];

PVOID DllBase;

} SW2_LDR_DATA_TABLE_ENTRY, *PSW2_LDR_DATA_TABLE_ENTRY;

typedef struct _SW2_PEB {

BYTE Reserved1[2];

BYTE BeingDebugged;

BYTE Reserved2[1];

PVOID Reserved3[2];

PSW2_PEB_LDR_DATA Ldr;

} SW2_PEB, *PSW2_PEB;

DWORD SW2_HashSyscall(PCSTR FunctionName);

BOOL SW2_PopulateSyscallList();

EXTERN_C DWORD SW2_GetSyscallNumber(DWORD FunctionHash);

typedef struct _UNICODE_STRING

{

USHORT Length;

USHORT MaximumLength;

PWSTR Buffer;

} UNICODE_STRING, *PUNICODE_STRING;

typedef struct _SYSTEM_HANDLE

{

ULONG ProcessId;

BYTE ObjectTypeNumber;

BYTE Flags;

USHORT Handle;

PVOID Object;

ACCESS_MASK GrantedAccess;

} SYSTEM_HANDLE, *PSYSTEM_HANDLE;

typedef struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE

{

PVOID pValue;

ULONG ValueLength;

} TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;

typedef struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE

{

ULONG64 Version;

UNICODE_STRING Name;

} TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;

typedef struct _WNF_TYPE_ID

{

GUID TypeId;

} WNF_TYPE_ID, *PWNF_TYPE_ID;

typedef struct _IO_STATUS_BLOCK

{

union

{

NTSTATUS Status;

VOID* Pointer;

};

ULONG_PTR Information;

} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef enum _KCONTINUE_TYPE

{

KCONTINUE_UNWIND,

KCONTINUE_RESUME,

KCONTINUE_LONGJUMP,

KCONTINUE_SET,

KCONTINUE_LAST

} KCONTINUE_TYPE;

typedef enum _PS_CREATE_STATE

{

PsCreateInitialState,

PsCreateFailOnFileOpen,

PsCreateFailOnSectionCreate,

PsCreateFailExeFormat,

PsCreateFailMachineMismatch,

PsCreateFailExeName,

PsCreateSuccess,

PsCreateMaximumStates

} PS_CREATE_STATE, *PPS_CREATE_STATE;

typedef struct _SYSTEM_HANDLE_INFORMATION

{

ULONG HandleCount;

SYSTEM_HANDLE Handles[1];

} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

typedef struct _CLIENT_ID

{

HANDLE UniqueProcess;

HANDLE UniqueThread;

} CLIENT_ID, *PCLIENT_ID;

typedef enum _PLUGPLAY_EVENT_CATEGORY

{

HardwareProfileChangeEvent,

TargetDeviceChangeEvent,

DeviceClassChangeEvent,

CustomDeviceEvent,

DeviceInstallEvent,

DeviceArrivalEvent,

PowerEvent,

VetoEvent,

BlockedDriverEvent,

InvalidIDEvent,

MaxPlugEventCategory

} PLUGPLAY_EVENT_CATEGORY, *PPLUGPLAY_EVENT_CATEGORY;

typedef enum _PNP_VETO_TYPE

{

PNP_VetoTypeUnknown, // unspecified

PNP_VetoLegacyDevice, // instance path

PNP_VetoPendingClose, // instance path

PNP_VetoWindowsApp, // module

PNP_VetoWindowsService, // service

PNP_VetoOutstandingOpen, // instance path

PNP_VetoDevice, // instance path

PNP_VetoDriver, // driver service name

PNP_VetoIllegalDeviceRequest, // instance path

PNP_VetoInsufficientPower, // unspecified

PNP_VetoNonDisableable, // instance path

PNP_VetoLegacyDriver, // service

PNP_VetoInsufficientRights // unspecified

} PNP_VETO_TYPE, *PPNP_VETO_TYPE;

typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1

{

UNICODE_STRING Name;

USHORT ValueType;

USHORT Reserved;

ULONG Flags;

ULONG ValueCount;

union

{

PLONG64 pInt64;

PULONG64 pUint64;

PUNICODE_STRING pString;

PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;

PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;

} Values;

} TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1;

typedef VOID(KNORMAL_ROUTINE) (

IN PVOID NormalContext,

IN PVOID SystemArgument1,

IN PVOID SystemArgument2);

typedef struct _PS_ATTRIBUTE

{

ULONG Attribute;

SIZE_T Size;

union

{

ULONG Value;

PVOID ValuePtr;

} u1;

PSIZE_T ReturnLength;

} PS_ATTRIBUTE, *PPS_ATTRIBUTE;

typedef struct _WNF_STATE_NAME

{

ULONG Data[2];

} WNF_STATE_NAME, *PWNF_STATE_NAME;

#ifndef InitializeObjectAttributes

#define InitializeObjectAttributes( p, n, a, r, s ) { \

(p)->Length = sizeof( OBJECT_ATTRIBUTES ); \

(p)->RootDirectory = r; \

(p)->Attributes = a; \

(p)->ObjectName = n; \

(p)->SecurityDescriptor = s; \

(p)->SecurityQualityOfService = NULL; \

}

#endif

typedef struct _KEY_VALUE_ENTRY

{

PUNICODE_STRING ValueName;

ULONG DataLength;

ULONG DataOffset;

ULONG Type;

} KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;

typedef enum _KEY_SET_INFORMATION_CLASS

{

KeyWriteTimeInformation,

KeyWow64FlagsInformation,

KeyControlFlagsInformation,

KeySetVirtualizationInformation,

KeySetDebugInformation,

KeySetHandleTagsInformation,

MaxKeySetInfoClass // MaxKeySetInfoClass should always be the last enum.

} KEY_SET_INFORMATION_CLASS, *PKEY_SET_INFORMATION_CLASS;

typedef enum _SYSTEM_INFORMATION_CLASS

{

SystemBasicInformation = 0,

SystemPerformanceInformation = 2,

SystemTimeOfDayInformation = 3,

SystemProcessInformation = 5,

SystemProcessorPerformanceInformation = 8,

SystemHandleInformation = 16,

SystemInterruptInformation = 23,

SystemExceptionInformation = 33,

SystemRegistryQuotaInformation = 37,

SystemLookasideInformation = 45,

SystemCodeIntegrityInformation = 103,

SystemPolicyInformation = 134,

} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;

typedef enum _PROCESSINFOCLASS

{

ProcessBasicInformation = 0,

ProcessDebugPort = 7,

ProcessWow64Information = 26,

ProcessImageFileName = 27,

ProcessBreakOnTermination = 29

} PROCESSINFOCLASS, *PPROCESSINFOCLASS;

typedef struct _MEMORY_RANGE_ENTRY

{

PVOID VirtualAddress;

SIZE_T NumberOfBytes;

} MEMORY_RANGE_ENTRY, *PMEMORY_RANGE_ENTRY;

typedef struct _T2_SET_PARAMETERS_V0

{

ULONG Version;

ULONG Reserved;

LONGLONG NoWakeTolerance;

} T2_SET_PARAMETERS, *PT2_SET_PARAMETERS;

typedef struct _FILE_PATH

{

ULONG Version;

ULONG Length;

ULONG Type;

CHAR FilePath[1];

} FILE_PATH, *PFILE_PATH;

typedef struct _FILE_USER_QUOTA_INFORMATION

{

ULONG NextEntryOffset;

ULONG SidLength;

LARGE_INTEGER ChangeTime;

LARGE_INTEGER QuotaUsed;

LARGE_INTEGER QuotaThreshold;

LARGE_INTEGER QuotaLimit;

SID Sid[1];

} FILE_USER_QUOTA_INFORMATION, *PFILE_USER_QUOTA_INFORMATION;

typedef struct _FILE_QUOTA_LIST_INFORMATION

{

ULONG NextEntryOffset;

ULONG SidLength;

SID Sid[1];

} FILE_QUOTA_LIST_INFORMATION, *PFILE_QUOTA_LIST_INFORMATION;

typedef struct _FILE_NETWORK_OPEN_INFORMATION

{

LARGE_INTEGER CreationTime;

LARGE_INTEGER LastAccessTime;

LARGE_INTEGER LastWriteTime;

LARGE_INTEGER ChangeTime;

LARGE_INTEGER AllocationSize;

LARGE_INTEGER EndOfFile;

ULONG FileAttributes;

ULONG Unknown;

} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;

typedef enum _FILTER_BOOT_OPTION_OPERATION

{

FilterBootOptionOperationOpenSystemStore,

FilterBootOptionOperationSetElement,

FilterBootOptionOperationDeleteElement,

FilterBootOptionOperationMax

} FILTER_BOOT_OPTION_OPERATION, *PFILTER_BOOT_OPTION_OPERATION;

typedef enum _EVENT_TYPE

{

NotificationEvent = 0,

SynchronizationEvent = 1,

} EVENT_TYPE, *PEVENT_TYPE;

typedef struct _FILE_FULL_EA_INFORMATION

{

ULONG NextEntryOffset;

UCHAR Flags;

UCHAR EaNameLength;

USHORT EaValueLength;

CHAR EaName[1];

} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;

typedef struct _FILE_GET_EA_INFORMATION

{

ULONG NextEntryOffset;

BYTE EaNameLength;

CHAR EaName[1];

} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;

typedef struct _BOOT_OPTIONS

{

ULONG Version;

ULONG Length;

ULONG Timeout;

ULONG CurrentBootEntryId;

ULONG NextBootEntryId;

WCHAR HeadlessRedirection[1];

} BOOT_OPTIONS, *PBOOT_OPTIONS;

typedef ULONG WNF_CHANGE_STAMP, *PWNF_CHANGE_STAMP;

typedef enum _WNF_DATA_SCOPE

{

WnfDataScopeSystem = 0,

WnfDataScopeSession = 1,

WnfDataScopeUser = 2,

WnfDataScopeProcess = 3,

WnfDataScopeMachine = 4

} WNF_DATA_SCOPE, *PWNF_DATA_SCOPE;

typedef enum _WNF_STATE_NAME_LIFETIME

{

WnfWellKnownStateName = 0,

WnfPermanentStateName = 1,

WnfPersistentStateName = 2,

WnfTemporaryStateName = 3

} WNF_STATE_NAME_LIFETIME, *PWNF_STATE_NAME_LIFETIME;

typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS

{

VmPrefetchInformation,

VmPagePriorityInformation,

VmCfgCallTargetInformation

} VIRTUAL_MEMORY_INFORMATION_CLASS, *PVIRTUAL_MEMORY_INFORMATION_CLASS;

typedef enum _IO_SESSION_EVENT

{

IoSessionEventIgnore,

IoSessionEventCreated,

IoSessionEventTerminated,

IoSessionEventConnected,

IoSessionEventDisconnected,

IoSessionEventLogon,

IoSessionEventLogoff,

IoSessionEventMax

} IO_SESSION_EVENT, *PIO_SESSION_EVENT;

typedef enum _PORT_INFORMATION_CLASS

{

PortBasicInformation,

#if DEVL

PortDumpInformation

#endif

} PORT_INFORMATION_CLASS, *PPORT_INFORMATION_CLASS;

typedef enum _PLUGPLAY_CONTROL_CLASS

{

PlugPlayControlEnumerateDevice,

PlugPlayControlRegisterNewDevice,

PlugPlayControlDeregisterDevice,

PlugPlayControlInitializeDevice,

PlugPlayControlStartDevice,

PlugPlayControlUnlockDevice,

PlugPlayControlQueryAndRemoveDevice,

PlugPlayControlUserResponse,

PlugPlayControlGenerateLegacyDevice,

PlugPlayControlGetInterfaceDeviceList,

PlugPlayControlProperty,

PlugPlayControlDeviceClassAssociation,

PlugPlayControlGetRelatedDevice,

PlugPlayControlGetInterfaceDeviceAlias,

PlugPlayControlDeviceStatus,

PlugPlayControlGetDeviceDepth,

PlugPlayControlQueryDeviceRelations,

PlugPlayControlTargetDeviceRelation,

PlugPlayControlQueryConflictList,

PlugPlayControlRetrieveDock,

PlugPlayControlResetDevice,

PlugPlayControlHaltDevice,

PlugPlayControlGetBlockedDriverList,

MaxPlugPlayControl

} PLUGPLAY_CONTROL_CLASS, *PPLUGPLAY_CONTROL_CLASS;

typedef enum _IO_COMPLETION_INFORMATION_CLASS

{

IoCompletionBasicInformation

} IO_COMPLETION_INFORMATION_CLASS, *PIO_COMPLETION_INFORMATION_CLASS;

typedef enum _SECTION_INHERIT

{

ViewShare = 1,

ViewUnmap = 2

} SECTION_INHERIT, *PSECTION_INHERIT;

typedef enum _DEBUGOBJECTINFOCLASS

{

DebugObjectFlags = 1,

MaxDebugObjectInfoClass

} DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS;

typedef enum _SEMAPHORE_INFORMATION_CLASS

{

SemaphoreBasicInformation

} SEMAPHORE_INFORMATION_CLASS, *PSEMAPHORE_INFORMATION_CLASS;

typedef struct _PS_ATTRIBUTE_LIST

{

SIZE_T TotalLength;

PS_ATTRIBUTE Attributes[1];

} PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;

typedef enum _VDMSERVICECLASS

{

VdmStartExecution,

VdmQueueInterrupt,

VdmDelayInterrupt,

VdmInitialize,

VdmFeatures,

VdmSetInt21Handler,

VdmQueryDir,

VdmPrinterDirectIoOpen,

VdmPrinterDirectIoClose,

VdmPrinterInitialize,

VdmSetLdtEntries,

VdmSetProcessLdtInfo,

VdmAdlibEmulation,

VdmPMCliControl,

VdmQueryVdmProcess

} VDMSERVICECLASS, *PVDMSERVICECLASS;

typedef struct _PS_CREATE_INFO

{

SIZE_T Size;

PS_CREATE_STATE State;

union

{

// PsCreateInitialState

struct {

union {

ULONG InitFlags;

struct {

UCHAR WriteOutputOnExit : 1;

UCHAR DetectManifest : 1;

UCHAR IFEOSkipDebugger : 1;

UCHAR IFEODoNotPropagateKeyState : 1;

UCHAR SpareBits1 : 4;

UCHAR SpareBits2 : 8;

USHORT ProhibitedImageCharacteristics : 16;

};

};

ACCESS_MASK AdditionalFileAccess;

} InitState;

// PsCreateFailOnSectionCreate

struct {

HANDLE FileHandle;

} FailSection;

// PsCreateFailExeFormat

struct {

USHORT DllCharacteristics;

} ExeFormat;

// PsCreateFailExeName

struct {

HANDLE IFEOKey;

} ExeName;

// PsCreateSuccess

struct {

union {

ULONG OutputFlags;

struct {

UCHAR ProtectedProcess : 1;

UCHAR AddressSpaceOverride : 1;

UCHAR DevOverrideEnabled : 1; // from Image File Execution Options

UCHAR ManifestDetected : 1;

UCHAR ProtectedProcessLight : 1;

UCHAR SpareBits1 : 3;

UCHAR SpareBits2 : 8;

USHORT SpareBits3 : 16;

};

};

HANDLE FileHandle;

HANDLE SectionHandle;

ULONGLONG UserProcessParametersNative;

ULONG UserProcessParametersWow64;

ULONG CurrentParameterFlags;

ULONGLONG PebAddressNative;

ULONG PebAddressWow64;

ULONGLONG ManifestAddress;

ULONG ManifestSize;

} SuccessState;

};

} PS_CREATE_INFO, *PPS_CREATE_INFO;

typedef enum _MEMORY_INFORMATION_CLASS

{

MemoryBasicInformation,

MemoryWorkingSetInformation,

MemoryMappedFilenameInformation,

MemoryRegionInformation,

MemoryWorkingSetExInformation,

MemorySharedCommitInformation,

MemoryImageInformation,

MemoryRegionInformationEx,

MemoryPrivilegedBasicInformation,

MemoryEnclaveImageInformation,

MemoryBasicInformationCapped

} MEMORY_INFORMATION_CLASS, *PMEMORY_INFORMATION_CLASS;

typedef enum _MEMORY_RESERVE_TYPE

{

MemoryReserveUserApc,

MemoryReserveIoCompletion,

MemoryReserveTypeMax

} MEMORY_RESERVE_TYPE, *PMEMORY_RESERVE_TYPE;

typedef enum _ALPC_PORT_INFORMATION_CLASS

{

AlpcBasicInformation,

AlpcPortInformation,

AlpcAssociateCompletionPortInformation,

AlpcConnectedSIDInformation,

AlpcServerInformation,

AlpcMessageZoneInformation,

AlpcRegisterCompletionListInformation,

AlpcUnregisterCompletionListInformation,

AlpcAdjustCompletionListConcurrencyCountInformation,

AlpcRegisterCallbackInformation,

AlpcCompletionListRundownInformation

} ALPC_PORT_INFORMATION_CLASS, *PALPC_PORT_INFORMATION_CLASS;

typedef struct _ALPC_CONTEXT_ATTR

{

PVOID PortContext;

PVOID MessageContext;

ULONG SequenceNumber;

ULONG MessageID;

ULONG CallbackID;

} ALPC_CONTEXT_ATTR, *PALPC_CONTEXT_ATTR;

typedef struct _ALPC_DATA_VIEW_ATTR

{

ULONG Flags;

HANDLE SectionHandle;

PVOID ViewBase;

SIZE_T ViewSize;

} ALPC_DATA_VIEW_ATTR, *PALPC_DATA_VIEW_ATTR;

typedef struct _ALPC_SECURITY_ATTR

{

ULONG Flags;

PSECURITY_QUALITY_OF_SERVICE SecurityQos;

HANDLE ContextHandle;

ULONG Reserved1;

ULONG Reserved2;

} ALPC_SECURITY_ATTR, *PALPC_SECURITY_ATTR;

typedef PVOID* PPVOID;

typedef enum _KPROFILE_SOURCE

{

ProfileTime = 0,

ProfileAlignmentFixup = 1,

ProfileTotalIssues = 2,

ProfilePipelineDry = 3,

ProfileLoadInstructions = 4,

ProfilePipelineFrozen = 5,

ProfileBranchInstructions = 6,

ProfileTotalNonissues = 7,

ProfileDcacheMisses = 8,

ProfileIcacheMisses = 9,

ProfileCacheMisses = 10,

ProfileBranchMispredictions = 11,

ProfileStoreInstructions = 12,

ProfileFpInstructions = 13,

ProfileIntegerInstructions = 14,

Profile2Issue = 15,

Profile3Issue = 16,

Profile4Issue = 17,

ProfileSpecialInstructions = 18,

ProfileTotalCycles = 19,

ProfileIcacheIssues = 20,

ProfileDcacheAccesses = 21,

ProfileMemoryBarrierCycles = 22,

ProfileLoadLinkedIssues = 23,

ProfileMaximum = 24,

} KPROFILE_SOURCE, *PKPROFILE_SOURCE;

typedef enum _ALPC_MESSAGE_INFORMATION_CLASS

{

AlpcMessageSidInformation,

AlpcMessageTokenModifiedIdInformation

} ALPC_MESSAGE_INFORMATION_CLASS, *PALPC_MESSAGE_INFORMATION_CLASS;

typedef enum _WORKERFACTORYINFOCLASS

{

WorkerFactoryTimeout,

WorkerFactoryRetryTimeout,

WorkerFactoryIdleTimeout,

WorkerFactoryBindingCount,

WorkerFactoryThreadMinimum,

WorkerFactoryThreadMaximum,

WorkerFactoryPaused,

WorkerFactoryBasicInformation,

WorkerFactoryAdjustThreadGoal,

WorkerFactoryCallbackType,

WorkerFactoryStackInformation,

MaxWorkerFactoryInfoClass

} WORKERFACTORYINFOCLASS, *PWORKERFACTORYINFOCLASS;

typedef enum _MEMORY_PARTITION_INFORMATION_CLASS

{

SystemMemoryPartitionInformation,

SystemMemoryPartitionMoveMemory,

SystemMemoryPartitionAddPagefile,

SystemMemoryPartitionCombineMemory,

SystemMemoryPartitionInitialAddMemory,

SystemMemoryPartitionGetMemoryEvents,

SystemMemoryPartitionMax

} MEMORY_PARTITION_INFORMATION_CLASS, *PMEMORY_PARTITION_INFORMATION_CLASS;

typedef enum _MUTANT_INFORMATION_CLASS

{

MutantBasicInformation,

MutantOwnerInformation

} MUTANT_INFORMATION_CLASS, *PMUTANT_INFORMATION_CLASS;

typedef enum _ATOM_INFORMATION_CLASS

{

AtomBasicInformation,

AtomTableInformation

} ATOM_INFORMATION_CLASS, *PATOM_INFORMATION_CLASS;

typedef enum _SHUTDOWN_ACTION {

ShutdownNoReboot,

ShutdownReboot,

ShutdownPowerOff

} SHUTDOWN_ACTION;

typedef VOID(CALLBACK* PTIMER_APC_ROUTINE)(

IN PVOID TimerContext,

IN ULONG TimerLowValue,

IN LONG TimerHighValue);

typedef enum _KEY_VALUE_INFORMATION_CLASS {

KeyValueBasicInformation = 0,

KeyValueFullInformation,

KeyValuePartialInformation,

KeyValueFullInformationAlign64,

KeyValuePartialInformationAlign64,

MaxKeyValueInfoClass

} KEY_VALUE_INFORMATION_CLASS;

typedef LANGID* PLANGID;

typedef struct _PLUGPLAY_EVENT_BLOCK

{

GUID EventGuid;

PLUGPLAY_EVENT_CATEGORY EventCategory;

PULONG Result;

ULONG Flags;

ULONG TotalSize;

PVOID DeviceObject;

union

{

struct

{

GUID ClassGuid;

WCHAR SymbolicLinkName[1];

} DeviceClass;

struct

{

WCHAR DeviceIds[1];

} TargetDevice;

struct

{

WCHAR DeviceId[1];

} InstallDevice;

struct

{

PVOID NotificationStructure;

WCHAR DeviceIds[1];

} CustomNotification;

struct

{

PVOID Notification;

} ProfileNotification;

struct

{

ULONG NotificationCode;

ULONG NotificationData;

} PowerNotification;

struct

{

PNP_VETO_TYPE VetoType;

WCHAR DeviceIdVetoNameBuffer[1]; // DeviceId<null>VetoName<null><null>

} VetoNotification;

struct

{

GUID BlockedDriverGuid;

} BlockedDriverNotification;

struct

{

WCHAR ParentId[1];

} InvalidIDNotification;

} u;

} PLUGPLAY_EVENT_BLOCK, *PPLUGPLAY_EVENT_BLOCK;

typedef VOID(NTAPI* PIO_APC_ROUTINE) (

IN PVOID ApcContext,

IN PIO_STATUS_BLOCK IoStatusBlock,

IN ULONG Reserved);

typedef KNORMAL_ROUTINE* PKNORMAL_ROUTINE;

typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS

{

DirectoryNotifyInformation = 1,

DirectoryNotifyExtendedInformation = 2,

} DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS;

typedef enum _EVENT_INFORMATION_CLASS

{

EventBasicInformation

} EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;

typedef struct _ALPC_MESSAGE_ATTRIBUTES

{

unsigned long AllocatedAttributes;

unsigned long ValidAttributes;

} ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES;

typedef struct _ALPC_PORT_ATTRIBUTES

{

ULONG Flags;

SECURITY_QUALITY_OF_SERVICE SecurityQos;

SIZE_T MaxMessageLength;

SIZE_T MemoryBandwidth;

SIZE_T MaxPoolUsage;

SIZE_T MaxSectionSize;

SIZE_T MaxViewSize;

SIZE_T MaxTotalSectionSize;

ULONG DupObjectTypes;

#ifdef _WIN64

ULONG Reserved;

#endif

} ALPC_PORT_ATTRIBUTES, *PALPC_PORT_ATTRIBUTES;

typedef enum _IO_SESSION_STATE

{

IoSessionStateCreated = 1,

IoSessionStateInitialized = 2,

IoSessionStateConnected = 3,

IoSessionStateDisconnected = 4,

IoSessionStateDisconnectedLoggedOn = 5,

IoSessionStateLoggedOn = 6,

IoSessionStateLoggedOff = 7,

IoSessionStateTerminated = 8,

IoSessionStateMax = 9,

} IO_SESSION_STATE, *PIO_SESSION_STATE;

typedef const WNF_STATE_NAME *PCWNF_STATE_NAME;

typedef const WNF_TYPE_ID *PCWNF_TYPE_ID;

typedef struct _WNF_DELIVERY_DESCRIPTOR

{

unsigned __int64 SubscriptionId;

WNF_STATE_NAME StateName;

unsigned long ChangeStamp;

unsigned long StateDataSize;

unsigned long EventMask;

WNF_TYPE_ID TypeId;

unsigned long StateDataOffset;

} WNF_DELIVERY_DESCRIPTOR, *PWNF_DELIVERY_DESCRIPTOR;

typedef enum _DEBUG_CONTROL_CODE

{

SysDbgQueryModuleInformation = 0,

SysDbgQueryTraceInformation = 1,

SysDbgSetTracePoint = 2,

SysDbgSetSpecialCall = 3,

SysDbgClearSpecialCalls = 4,

SysDbgQuerySpecialCalls = 5,

SysDbgBreakPoint = 6,

SysDbgQueryVersion = 7,

SysDbgReadVirtual = 8,

SysDbgWriteVirtual = 9,

SysDbgReadPhysical = 10,

SysDbgWritePhysical = 11,

SysDbgReadControlSpace = 12,

SysDbgWriteControlSpace = 13,

SysDbgReadIoSpace = 14,

SysDbgWriteIoSpace = 15,

SysDbgReadMsr = 16,

SysDbgWriteMsr = 17,

SysDbgReadBusData = 18,

SysDbgWriteBusData = 19,

SysDbgCheckLowMemory = 20,

SysDbgEnableKernelDebugger = 21,

SysDbgDisableKernelDebugger = 22,

SysDbgGetAutoKdEnable = 23,

SysDbgSetAutoKdEnable = 24,

SysDbgGetPrintBufferSize = 25,

SysDbgSetPrintBufferSize = 26,

SysDbgGetKdUmExceptionEnable = 27,

SysDbgSetKdUmExceptionEnable = 28,

SysDbgGetTriageDump = 29,

SysDbgGetKdBlockEnable = 30,

SysDbgSetKdBlockEnable = 31

} DEBUG_CONTROL_CODE, *PDEBUG_CONTROL_CODE;

typedef struct _PORT_MESSAGE

{

union

{

union

{

struct

{

short DataLength;

short TotalLength;

} s1;

unsigned long Length;

};

} u1;

union

{

union

{

struct

{

short Type;

short DataInfoOffset;

} s2;

unsigned long ZeroInit;

};

} u2;

union

{

CLIENT_ID ClientId;

double DoNotUseThisField;

};

unsigned long MessageId;

union

{

unsigned __int64 ClientViewSize;

struct

{

unsigned long CallbackId;

long __PADDING__[1];

};

};

} PORT_MESSAGE, *PPORT_MESSAGE;

typedef struct FILE_BASIC_INFORMATION

{

LARGE_INTEGER CreationTime;

LARGE_INTEGER LastAccessTime;

LARGE_INTEGER LastWriteTime;

LARGE_INTEGER ChangeTime;

ULONG FileAttributes;

} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;

typedef struct _PORT_SECTION_READ

{

ULONG Length;

ULONG ViewSize;

ULONG ViewBase;

} PORT_SECTION_READ, *PPORT_SECTION_READ;

typedef struct _PORT_SECTION_WRITE

{

ULONG Length;

HANDLE SectionHandle;

ULONG SectionOffset;

ULONG ViewSize;

PVOID ViewBase;

PVOID TargetViewBase;

} PORT_SECTION_WRITE, *PPORT_SECTION_WRITE;

typedef enum _TIMER_TYPE

{

NotificationTimer,

SynchronizationTimer

} TIMER_TYPE, *PTIMER_TYPE;

typedef struct _BOOT_ENTRY

{

ULONG Version;

ULONG Length;

ULONG Id;

ULONG Attributes;

ULONG FriendlyNameOffset;

ULONG BootFilePathOffset;

ULONG OsOptionsLength;

UCHAR OsOptions[ANYSIZE_ARRAY];

} BOOT_ENTRY, *PBOOT_ENTRY;

typedef struct _EFI_DRIVER_ENTRY

{

ULONG Version;

ULONG Length;

ULONG Id;

ULONG Attributes;

ULONG FriendlyNameOffset;

ULONG DriverFilePathOffset;

} EFI_DRIVER_ENTRY, *PEFI_DRIVER_ENTRY;

typedef USHORT RTL_ATOM, *PRTL_ATOM;

typedef enum _TIMER_SET_INFORMATION_CLASS

{

TimerSetCoalescableTimer,

MaxTimerInfoClass

} TIMER_SET_INFORMATION_CLASS, *PTIMER_SET_INFORMATION_CLASS;

typedef enum _FSINFOCLASS

{

FileFsVolumeInformation = 1,

FileFsLabelInformation = 2,

FileFsSizeInformation = 3,

FileFsDeviceInformation = 4,

FileFsAttributeInformation = 5,

FileFsControlInformation = 6,

FileFsFullSizeInformation = 7,

FileFsObjectIdInformation = 8,

FileFsDriverPathInformation = 9,

FileFsVolumeFlagsInformation = 10,

FileFsSectorSizeInformation = 11,

FileFsDataCopyInformation = 12,

FileFsMetadataSizeInformation = 13,

FileFsFullSizeInformationEx = 14,

FileFsMaximumInformation = 15,

} FSINFOCLASS, *PFSINFOCLASS;

typedef enum _WAIT_TYPE

{

WaitAll = 0,

WaitAny = 1

} WAIT_TYPE, *PWAIT_TYPE;

typedef struct _USER_STACK

{

PVOID FixedStackBase;

PVOID FixedStackLimit;

PVOID ExpandableStackBase;

PVOID ExpandableStackLimit;

PVOID ExpandableStackBottom;

} USER_STACK, *PUSER_STACK;

typedef enum _SECTION_INFORMATION_CLASS

{

SectionBasicInformation,

SectionImageInformation,

} SECTION_INFORMATION_CLASS, *PSECTION_INFORMATION_CLASS;

typedef enum _APPHELPCACHESERVICECLASS

{

ApphelpCacheServiceLookup = 0,