-
Notifications
You must be signed in to change notification settings - Fork 13
/
CallbackHandler.h
83 lines (72 loc) · 1.82 KB
/
CallbackHandler.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
#pragma once
#define DEFAULT_MAGGICCODE 0x59002360218c1e2dul //length 16 max
#define CallbackHandler(name) \
case REQUEST_TYPE::name: { \
REQUEST_##name args; \
RtlCopyMemory(&args, data.Arguments, sizeof(args)); \
*data.Status = Callback##name(&args); \
break; \
}
typedef enum _REQUEST_TYPE : UINT{
WRITE,
READ,
PROTECT,
ALLOC,
FREE,
MODULE,
MAINBASE,
THREADCALL,
} REQUEST_TYPE;
typedef struct _REQUEST_DATA {
ULONG64* MaggicCode;
UINT Type;
PVOID Arguments;
NTSTATUS* Status;
} REQUEST_DATA, * PREQUEST_DATA;
typedef struct _REQUEST_WRITE {
DWORD ProcessId;
PVOID Dest;
PVOID Src;
DWORD Size;
BOOL bPhysicalMem;
} REQUEST_WRITE, * PREQUEST_WRITE;
typedef struct _REQUEST_READ {
DWORD ProcessId;
PVOID Dest;
PVOID Src;
DWORD Size;
BOOL bPhysicalMem;
} REQUEST_READ, * PREQUEST_READ;
typedef struct _REQUEST_PROTECT {
DWORD ProcessId;
PVOID Address;
DWORD Size;
PDWORD InOutProtect;
} REQUEST_PROTECT, * PREQUEST_PROTECT;
typedef struct _REQUEST_ALLOC {
DWORD ProcessId;
PVOID OutAddress;
DWORD Size;
DWORD Protect;
} REQUEST_ALLOC, * PREQUEST_ALLOC;
typedef struct _REQUEST_FREE {
DWORD ProcessId;
PVOID Address;
} REQUEST_FREE, * PREQUEST_FREE;
typedef struct _REQUEST_MODULE {
DWORD ProcessId;
WCHAR Module[0xFF];
PBYTE* OutAddress;
DWORD* OutSize;
} REQUEST_MODULE, * PREQUEST_MODULE;
typedef struct _REQUEST_MAINBASE {
DWORD ProcessId;
PBYTE* OutAddress;
} REQUEST_MAINBASE, * PREQUEST_MAINBASE;
NTSTATUS CallbackWRITE(PREQUEST_WRITE args);
NTSTATUS CallbackREAD(PREQUEST_READ args);
NTSTATUS CallbackPROTECT(PREQUEST_PROTECT args);
NTSTATUS CallbackALLOC(PREQUEST_ALLOC args);
NTSTATUS CallbackFREE(PREQUEST_FREE args);
NTSTATUS CallbackMODULE(PREQUEST_MODULE args);
NTSTATUS CallbackMAINBASE(PREQUEST_MAINBASE args);