#ifndef LOADER_H#define LOADER_H#pragma pack(push, 1)struct CRC_INFO {uint32_t Address;uint32_t Size;uint32_t Hash;};struct FILE_CRC_INFO {uint32_t FileSize;// CRCInfo crc_info[1]};struct SECTION_INFO {uint32_t Address;uint32_t Size;uint32_t Type;};struct PACKER_INFO {uint32_t Src;uint32_t Dst;};struct IAT_INFO {uint32_t Src;uint32_t Dst;uint32_t Size;};struct DLL_INFO {uint32_t Name;// IMPORT_INFO import_info[1];};struct IMPORT_INFO {uint32_t Name;uint32_t Address;int32_t Key;};struct FIXUP_INFO {uint32_t Address;uint32_t BlockSize;// uint32_t type_offset[1];};struct RELOCATION_INFO {uint32_t Address;uint32_t Source;uint32_t Type;};struct SETUP_IMAGE_DATA {NOINLINE SETUP_IMAGE_DATA() { empty_ = 0; }NOINLINE uint8_t *file_base() { return reinterpret_cast<uint8_t *>(FACE_FILE_BASE) - empty_; }NOINLINE uint8_t *image_base() { return reinterpret_cast<uint8_t *>(FACE_IMAGE_BASE) - empty_; }NOINLINE uint32_t options() { return FACE_LOADER_OPTIONS - empty_; }NOINLINE uint32_t storage() { return FACE_LOADER_DATA - empty_; }NOINLINE uint32_t runtime_entry() { return FACE_RUNTIME_ENTRY - empty_; }#ifdef __unix__NOINLINE uint32_t relro_info() { return FACE_GNU_RELRO_INFO - empty_; }#elif defined(__APPLE__)#elif defined(WIN_DRIVER)#elseNOINLINE uint32_t tls_index_info() { return FACE_TLS_INDEX_INFO - empty_; }#endif// file CRC informationNOINLINE uint32_t file_crc_info() { return FACE_FILE_CRC_INFO - empty_; }NOINLINE uint32_t file_crc_info_size() { return FACE_FILE_CRC_INFO_SIZE - empty_; }// header and loader CRC informationNOINLINE uint32_t loader_crc_info() { return FACE_LOADER_CRC_INFO - empty_; }NOINLINE uint32_t loader_crc_info_size() { return FACE_LOADER_CRC_INFO_SIZE - empty_; }NOINLINE uint32_t loader_crc_info_hash() { return FACE_LOADER_CRC_INFO_HASH - empty_; }// section informationNOINLINE uint32_t section_info() { return FACE_SECTION_INFO - empty_; }NOINLINE uint32_t section_info_size() { return FACE_SECTION_INFO_SIZE - empty_; }// packer informationNOINLINE uint32_t packer_info() { return FACE_PACKER_INFO - empty_; }NOINLINE uint32_t packer_info_size() { return FACE_PACKER_INFO_SIZE - empty_; }// fixups informationNOINLINE uint32_t fixup_info() { return FACE_FIXUP_INFO - empty_; }NOINLINE uint32_t fixup_info_size() { return FACE_FIXUP_INFO_SIZE - empty_; }// relocations informationNOINLINE uint32_t relocation_info() { return FACE_RELOCATION_INFO - empty_; }NOINLINE uint32_t relocation_info_size() { return FACE_RELOCATION_INFO_SIZE - empty_; }// IAT informationNOINLINE uint32_t iat_info() { return FACE_IAT_INFO - empty_; }NOINLINE uint32_t iat_info_size() { return FACE_IAT_INFO_SIZE - empty_; }// import informationNOINLINE uint32_t import_info() { return FACE_IMPORT_INFO - empty_; }NOINLINE uint32_t import_info_size() { return FACE_IMPORT_INFO_SIZE - empty_; }// internal import informationNOINLINE uint32_t internal_import_info() { return FACE_INTERNAL_IMPORT_INFO - empty_; }NOINLINE uint32_t internal_import_info_size() { return FACE_INTERNAL_IMPORT_INFO_SIZE - empty_; }// memory CRC informationNOINLINE uint32_t memory_crc_info() { return FACE_MEMORY_CRC_INFO - empty_; }NOINLINE uint32_t memory_crc_info_size() { return FACE_MEMORY_CRC_INFO_SIZE - empty_; }NOINLINE uint32_t memory_crc_info_hash() { return FACE_MEMORY_CRC_INFO_HASH - empty_; }// delay import informationNOINLINE uint32_t delay_import_info() { return FACE_DELAY_IMPORT_INFO - empty_; }NOINLINE uint32_t delay_import_info_size() { return FACE_DELAY_IMPORT_INFO_SIZE - empty_; }private:uint32_t empty_;};#pragma pack(pop)#ifndef VMP_GNU#define MAXIMUM_FILENAME_LENGTH 256typedef struct _SYSTEM_MODULE_ENTRY{#ifdef _WIN64ULONGLONG Unknown1;ULONGLONG Unknown2;#elseULONG Unknown1;ULONG Unknown2;#endifPVOID BaseAddress;ULONG Size;ULONG Flags;ULONG EntryIndex;USHORT NameLength; // Length of module name not including the path, this field contains valid value only for NTOSKRNL moduleUSHORT PathLength; // Length of 'directory path' part of modulenameCHAR Name[MAXIMUM_FILENAME_LENGTH];} SYSTEM_MODULE_ENTRY;typedef struct _SYSTEM_MODULE_INFORMATION{ULONG Count;#ifdef _WIN64ULONG Unknown1;#endifSYSTEM_MODULE_ENTRY Module[1];} SYSTEM_MODULE_INFORMATION;typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION{BOOLEAN DebuggerEnabled;BOOLEAN DebuggerNotPresent;} SYSTEM_KERNEL_DEBUGGER_INFORMATION;typedef enum _MEMORY_INFORMATION_CLASS {MemoryBasicInformation} MEMORY_INFORMATION_CLASS, *PMEMORY_INFORMATION_CLASS;#ifdef WIN_DRIVER#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ#define IMAGE_OS2_SIGNATURE 0x454E // NE#define IMAGE_OS2_SIGNATURE_LE 0x454C // LE#define IMAGE_VXD_SIGNATURE 0x454C // LE#define IMAGE_NT_SIGNATURE 0x00004550 // PE00#pragma pack(push, 2)typedef struct _IMAGE_DOS_HEADER { // DOS .EXE headerWORD e_magic; // Magic numberWORD e_cblp; // Bytes on last page of fileWORD e_cp; // Pages in fileWORD e_crlc; // RelocationsWORD e_cparhdr; // Size of header in paragraphsWORD e_minalloc; // Minimum extra paragraphs neededWORD e_maxalloc; // Maximum extra paragraphs neededWORD e_ss; // Initial (relative) SS valueWORD e_sp; // Initial SP valueWORD e_csum; // ChecksumWORD e_ip; // Initial IP valueWORD e_cs; // Initial (relative) CS valueWORD e_lfarlc; // File address of relocation tableWORD e_ovno; // Overlay numberWORD e_res[4]; // Reserved wordsWORD e_oemid; // OEM identifier (for e_oeminfo)WORD e_oeminfo; // OEM information; e_oemid specificWORD e_res2[10]; // Reserved wordsLONG e_lfanew; // File address of new exe header} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;#pragma pack(pop)typedef struct _IMAGE_FILE_HEADER {WORD Machine;WORD NumberOfSections;DWORD TimeDateStamp;DWORD PointerToSymbolTable;DWORD NumberOfSymbols;WORD SizeOfOptionalHeader;WORD Characteristics;} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;typedef struct _IMAGE_DATA_DIRECTORY {DWORD VirtualAddress;DWORD Size;} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16typedef struct _IMAGE_OPTIONAL_HEADER {//// Standard fields.//WORD Magic;BYTE MajorLinkerVersion;BYTE MinorLinkerVersion;DWORD SizeOfCode;DWORD SizeOfInitializedData;DWORD SizeOfUninitializedData;DWORD AddressOfEntryPoint;DWORD BaseOfCode;DWORD BaseOfData;//// NT additional fields.//DWORD ImageBase;DWORD SectionAlignment;DWORD FileAlignment;WORD MajorOperatingSystemVersion;WORD MinorOperatingSystemVersion;WORD MajorImageVersion;WORD MinorImageVersion;WORD MajorSubsystemVersion;WORD MinorSubsystemVersion;DWORD Win32VersionValue;DWORD SizeOfImage;DWORD SizeOfHeaders;DWORD CheckSum;WORD Subsystem;WORD DllCharacteristics;DWORD SizeOfStackReserve;DWORD SizeOfStackCommit;DWORD SizeOfHeapReserve;DWORD SizeOfHeapCommit;DWORD LoaderFlags;DWORD NumberOfRvaAndSizes;IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;typedef struct _IMAGE_ROM_OPTIONAL_HEADER {WORD Magic;BYTE MajorLinkerVersion;BYTE MinorLinkerVersion;DWORD SizeOfCode;DWORD SizeOfInitializedData;DWORD SizeOfUninitializedData;DWORD AddressOfEntryPoint;DWORD BaseOfCode;DWORD BaseOfData;DWORD BaseOfBss;DWORD GprMask;DWORD CprMask[4];DWORD GpValue;} IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;typedef struct _IMAGE_OPTIONAL_HEADER64 {WORD Magic;BYTE MajorLinkerVersion;BYTE MinorLinkerVersion;DWORD SizeOfCode;DWORD SizeOfInitializedData;DWORD SizeOfUninitializedData;DWORD AddressOfEntryPoint;DWORD BaseOfCode;ULONGLONG ImageBase;DWORD SectionAlignment;DWORD FileAlignment;WORD MajorOperatingSystemVersion;WORD MinorOperatingSystemVersion;WORD MajorImageVersion;WORD MinorImageVersion;WORD MajorSubsystemVersion;WORD MinorSubsystemVersion;DWORD Win32VersionValue;DWORD SizeOfImage;DWORD SizeOfHeaders;DWORD CheckSum;WORD Subsystem;WORD DllCharacteristics;ULONGLONG SizeOfStackReserve;ULONGLONG SizeOfStackCommit;ULONGLONG SizeOfHeapReserve;ULONGLONG SizeOfHeapCommit;DWORD LoaderFlags;DWORD NumberOfRvaAndSizes;IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;typedef struct _IMAGE_NT_HEADERS64 {DWORD Signature;IMAGE_FILE_HEADER FileHeader;IMAGE_OPTIONAL_HEADER64 OptionalHeader;} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;typedef struct _IMAGE_NT_HEADERS {DWORD Signature;IMAGE_FILE_HEADER FileHeader;IMAGE_OPTIONAL_HEADER32 OptionalHeader;} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;typedef struct _IMAGE_ROM_HEADERS {IMAGE_FILE_HEADER FileHeader;IMAGE_ROM_OPTIONAL_HEADER OptionalHeader;} IMAGE_ROM_HEADERS, *PIMAGE_ROM_HEADERS;#ifdef _WIN64typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS;typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS;#elsetypedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS;typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS;#endiftypedef struct _IMAGE_SECTION_HEADER {BYTE Name[8];union {DWORD PhysicalAddress;DWORD VirtualSize;} Misc;DWORD VirtualAddress;DWORD SizeOfRawData;DWORD PointerToRawData;DWORD PointerToRelocations;DWORD PointerToLinenumbers;WORD NumberOfRelocations;WORD NumberOfLinenumbers;DWORD Characteristics;} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory#define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory#define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table#define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory// IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP#define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers#define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor#define IMAGE_REL_BASED_ABSOLUTE 0#define IMAGE_REL_BASED_HIGH 1#define IMAGE_REL_BASED_LOW 2#define IMAGE_REL_BASED_HIGHLOW 3#define IMAGE_REL_BASED_HIGHADJ 4#define IMAGE_REL_BASED_MIPS_JMPADDR 5#define IMAGE_REL_BASED_MIPS_JMPADDR16 9#define IMAGE_REL_BASED_IA64_IMM64 9#define IMAGE_REL_BASED_DIR64 10#define IMAGE_ORDINAL_FLAG64 0x8000000000000000#define IMAGE_ORDINAL_FLAG32 0x80000000#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)typedef struct _IMAGE_EXPORT_DIRECTORY {DWORD Characteristics;DWORD TimeDateStamp;WORD MajorVersion;WORD MinorVersion;DWORD Name;DWORD Base;DWORD NumberOfFunctions;DWORD NumberOfNames;DWORD AddressOfFunctions; // RVA from base of imageDWORD AddressOfNames; // RVA from base of imageDWORD AddressOfNameOrdinals; // RVA from base of image} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;#define MAX_PATH 260#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 // Section contains extended relocations.#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 // Section can be discarded.#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 // Section is not cachable.#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 // Section is not pageable.#define IMAGE_SCN_MEM_SHARED 0x10000000 // Section is shareable.#define IMAGE_SCN_MEM_EXECUTE 0x20000000 // Section is executable.#define IMAGE_SCN_MEM_READ 0x40000000 // Section is readable.#define IMAGE_SCN_MEM_WRITE 0x80000000 // Section is writeable.typedef enum _SYSTEM_INFORMATION_CLASS {SystemModuleInformation = 0xb,SystemKernelDebuggerInformation = 0x23,SystemFirmwareTableInformation = 0x4c} SYSTEM_INFORMATION_CLASS;extern "C" {NTKERNELAPI NTSTATUS NTAPI NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength,PULONG ReturnLength);}#else#define FILE_OPEN 0x00000001#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020#define FILE_NON_DIRECTORY_FILE 0x00000040typedef enum _SECTION_INHERIT {ViewShare=1,ViewUnmap=2} SECTION_INHERIT, *PSECTION_INHERIT;#define SystemModuleInformation (SYSTEM_INFORMATION_CLASS)11#define SystemKernelDebuggerInformation (SYSTEM_INFORMATION_CLASS)35#define ThreadHideFromDebugger (THREADINFOCLASS)17#define ProcessDebugPort (PROCESSINFOCLASS)0x7#define ProcessDebugObjectHandle (PROCESSINFOCLASS)0x1e#define ProcessDefaultHardErrorMode (PROCESSINFOCLASS)0x0c#define ProcessInstrumentationCallback (PROCESSINFOCLASS)40#define MemoryMappedFilenameInformation (MEMORY_INFORMATION_CLASS)2#define STATUS_PORT_NOT_SET ((NTSTATUS)0xC0000353L)#define STATUS_SERVICE_NOTIFICATION ((NTSTATUS)0x40000018L)#define HARDERROR_OVERRIDE_ERRORMODE 0x10000000#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )#define NtCurrentThread() ( (HANDLE)(LONG_PTR) -2 )typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION{ULONG Version;ULONG Reserved;PVOID Callback;} PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, *PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION;typedef enum HardErrorResponse {ResponseReturnToCaller,ResponseNotHandled,ResponseAbort, ResponseCancel,ResponseIgnore,ResponseNo,ResponseOk,ResponseRetry,ResponseYes} HardErrorResponse;typedef enum HardErrorResponseButton {ResponseButtonOK,ResponseButtonOKCancel,ResponseButtonAbortRetryIgnore,ResponseButtonYesNoCancel,ResponseButtonYesNo,ResponseButtonRetryCancel,ResponseButtonCancelTryAgainContinue} HardErrorResponseButton;typedef enum HardErrorResponseIcon {IconAsterisk = 0x40,IconError = 0x10,IconExclamation = 0x30,IconHand = 0x10,IconInformation = 0x40,IconNone = 0,IconQuestion = 0x20,IconStop = 0x10,IconWarning = 0x30,IconUserIcon = 0x80} HardErrorResponseIcon;#define SEC_IMAGE_NO_EXECUTE (SEC_IMAGE | SEC_NOCACHE)enum {WINDOWS_XP = 2600,WINDOWS_2003 = 3790,WINDOWS_VISTA = 6000,WINDOWS_VISTA_SP1 = 6001,WINDOWS_VISTA_SP2 = 6002,WINDOWS_7 = 7600,WINDOWS_7_SP1 = 7601,WINDOWS_8 = 9200,WINDOWS_8_1 = 9600,WINDOWS_10_TH1 = 10240,WINDOWS_10_TH2 = 10586,WINDOWS_10_RS1 = 14393,WINDOWS_10_RS2 = 15063,WINDOWS_10_RS3 = 16299,WINDOWS_10_RS4 = 17134,WINDOWS_10_RS5 = 17763,WINDOWS_10_19H1 = 18362,WINDOWS_10_19H2 = 18363,WINDOWS_10_20H1 = 19041,WINDOWS_10_20H2 = 19042,WINDOWS_10_21H1 = 19043,WINDOWS_10_21H2 = 19044,WINDOWS_10_22H2 = 19045,WINDOWS_11_21H2 = 22000,WINDOWS_11_22H2 = 22621,};#define IS_KNOWN_WINDOWS_BUILD(b) ( \(b) == WINDOWS_XP || \(b) == WINDOWS_2003 || \(b) == WINDOWS_VISTA || \(b) == WINDOWS_VISTA_SP1 || \(b) == WINDOWS_VISTA_SP2 || \(b) == WINDOWS_7 || \(b) == WINDOWS_7_SP1 || \(b) == WINDOWS_8 || \(b) == WINDOWS_8_1 || \(b) == WINDOWS_10_TH1 || \(b) == WINDOWS_10_TH2 || \(b) == WINDOWS_10_RS1 || \(b) == WINDOWS_10_RS2 || \(b) == WINDOWS_10_RS3 || \(b) == WINDOWS_10_RS4 || \(b) == WINDOWS_10_RS5 || \(b) == WINDOWS_10_19H1 || \(b) == WINDOWS_10_19H2 || \(b) == WINDOWS_10_20H1 || \(b) == WINDOWS_10_20H2 || \(b) == WINDOWS_10_21H1 || \(b) == WINDOWS_10_21H2 || \(b) == WINDOWS_10_22H2 \)#endif // WIN_DRIVER#endif // VMP_GNUtypedef struct _PEB32 {BYTE Reserved1[2];BYTE BeingDebugged;BYTE Reserved2[0xa1];ULONG OSMajorVersion;ULONG OSMinorVersion;USHORT OSBuildNumber;} PEB32;typedef struct _PEB64 {BYTE Reserved1[2];BYTE BeingDebugged;BYTE Reserved2[0x115];ULONG OSMajorVersion;ULONG OSMinorVersion;USHORT OSBuildNumber;} PEB64;#endif
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。