kerneldetective/fsd.h at master · Fyyre/kerneldetective · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
/*
 * Copyright (c) 2008 Arab Team 4 Reverse Engineering. All rights reserved.
 *
 * Module Name:
 *
 *		fsd.c
 *
 * Abstract:
 *
 *		This module defines various routines used to relocate image files.
 *
 * Author:
 *
 *		GamingMasteR
 *
 */


#include "KeDetective.h"

#ifdef __cplusplus
	extern "C" {
#endif


#define RVATOVA(base, offset) ((PVOID)((DWORD)(base) + (DWORD)(offset)))


typedef struct _FSD_OBJECT {
	PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
	PDRIVER_OBJECT DriverObject;
	PVOID MappedImage;
} FSD_OBJECT, *PFSD_OBJECT;


/* generic relocation types */
#define IMAGE_REL_BASED_ABSOLUTE				0
#define IMAGE_REL_BASED_HIGH					1
#define IMAGE_REL_BASED_LOW						2
#define IMAGE_REL_BASED_HIGHLOW					3
#define IMAGE_REL_BASED_HIGHADJ					4
#define IMAGE_REL_BASED_MIPS_JMPADDR			5
#define IMAGE_REL_BASED_SECTION					6
#define IMAGE_REL_BASED_REL						7
#define IMAGE_REL_BASED_MIPS_JMPADDR16			9
#define IMAGE_REL_BASED_IA64_IMM64				9
#define IMAGE_REL_BASED_DIR64					10
#define IMAGE_REL_BASED_HIGH3ADJ				11


NTSTATUS
ResolveImageReferences (
    PVOID ImageBase,
    IN PUNICODE_STRING ImageFileDirectory
    );


PVOID
LoadFile(
	LPWSTR FileName,
	PVOID ImageBase,
	BOOLEAN FixIAT
	);


PVOID
LoadSystemFile(
	LPSTR FileName,
	PVOID ImageBase,
	BOOLEAN FixIAT
	);


ULONG
LdrRelocateImage(
    IN PVOID BaseAddress,
	IN PVOID NewBase,
    IN ULONG Success,
    IN ULONG Conflict,
    IN ULONG Invalid
);


BOOLEAN
GetFileName(
	PFILE_OBJECT FileObject,
	PWCHAR FileName,
	ULONG FileNameLength
	);


PDRIVER_DISPATCH
GetFileSystemMajorFunction(
	PFSD_OBJECT Fsd,
	ULONG MajorFunctionIndex
);


NTSTATUS
DeleteFile(
	PWCHAR FileName,
	LONG ForceDelete
);

NTSTATUS
CopyFile(
	PWCHAR lpSource,
	PWCHAR lpDest
);

NTSTATUS
FsCallDriver(
    PDRIVER_OBJECT DriverObject,
	PDEVICE_OBJECT DeviceObject,
	PIRP Irp
);

NTSTATUS
ReadWriteDisk(
	PDRIVER_OBJECT DriverObject,
	PDEVICE_OBJECT DeviceObject,
    ULONG SectorNumber,
    USHORT SectorCount,
    BOOL IsWrite,
	PVOID Buffer
	);


NTSTATUS
IoOpenFile(
	HANDLE *Handle,
	LPWSTR FileName,
	ACCESS_MASK DesiredAccess,
	ULONG ShareAccess,
	ULONG CreateOptions,
	ULONG CreateDisposition
);

NTSTATUS
IoReadFile(
	HANDLE Handle,
	PVOID Buffer,
	ULONG FileSize,
	PLARGE_INTEGER FileOffset
);

NTSTATUS
IoWriteFile(
	HANDLE Handle,
	PVOID Buffer,
	ULONG FileSize,
	PLARGE_INTEGER FileOffset
);


extern FSD_OBJECT FsdFastFat, FsdNtfs;

#ifdef __cplusplus
	}
#endif