1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
|
#pragma once
#include "ntdll.h"
#if defined(__cplusplus) && \
((defined(_MSC_VER) && (_MSC_VER >= 1900)) || defined(__clang__))
#define CONSTEXPR constexpr
#else
#define CONSTEXPR
#endif
#if defined(__RESHARPER__)
#define WPRINTF_ATTR(FormatIndex, FirstToCheck) \
[[rscpp::format(wprintf, FormatIndex, FirstToCheck)]]
#else
#define WPRINTF_ATTR(FormatIndex, FirstToCheck)
#endif
#ifdef __cplusplus
extern "C" {
#endif
// EfiDSEFix.cpp
NTSTATUS
TestSetVariableHook(
);
NTSTATUS
AdjustCiOptions(
_In_ ULONG CiOptionsValue,
_Out_opt_ PULONG OldCiOptionsValue
);
// sysinfo.cpp
NTSTATUS
DumpSystemInformation(
);
// pe.cpp
NTSTATUS
MapFileSectionView(
_In_ PCWCHAR Filename,
_Out_ PVOID *ImageBase,
_Out_ PSIZE_T ViewSize
);
PVOID
GetProcedureAddress(
_In_ ULONG_PTR DllBase,
_In_ PCSTR RoutineName
);
FORCEINLINE
ULONG
RtlNtMajorVersion(
)
{
return *(PULONG)(0x7FFE0000 + 0x026C);
}
FORCEINLINE
ULONG
RtlNtMinorVersion(
)
{
return *(PULONG)(0x7FFE0000 + 0x0270);
}
CONSTEXPR
FORCEINLINE
LONGLONG
RtlMsToTicks(
_In_ ULONG Milliseconds
)
{
return 10000LL * (LONGLONG)Milliseconds;
}
FORCEINLINE
VOID
RtlSleep(
_In_ ULONG Milliseconds
)
{
LARGE_INTEGER Timeout;
Timeout.QuadPart = -1 * RtlMsToTicks(Milliseconds);
NtDelayExecution(FALSE, &Timeout);
}
// Ntdll string functions, not in ntdll.h as they are incompatible with the CRT
typedef const WCHAR *LPCWCHAR, *PCWCHAR;
NTSYSAPI
int
__cdecl
_snwprintf(
_Out_ PWCHAR Buffer,
_In_ size_t BufferCount,
_In_ PCWCHAR Format,
...
);
NTSYSAPI
int
__cdecl
_vsnwprintf(
_Out_ PWCHAR Buffer,
_In_ size_t BufferCount,
_In_ PCWCHAR Format,
_In_ va_list ArgList
);
NTSYSAPI
int
__cdecl
_wtoi(
_In_ PCWCHAR Str
);
// Console functions
WPRINTF_ATTR(1, 2)
inline
VOID
Printf(
_In_ PCWCHAR Format,
...
)
{
WCHAR Buffer[512];
va_list VaList;
va_start(VaList, Format);
ULONG N = _vsnwprintf(Buffer, sizeof(Buffer), Format, VaList);
WriteConsoleW(NtCurrentPeb()->ProcessParameters->StandardOutput, Buffer, N, &N, NULL);
va_end(VaList);
}
inline
VOID
PrintGuid(
_In_ GUID Guid
)
{
Printf(L"{%08lx-%04hx-%04hx-%02hhx%02hhx-%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx}",
Guid.Data1, Guid.Data2, Guid.Data3,
Guid.Data4[0], Guid.Data4[1], Guid.Data4[2], Guid.Data4[3],
Guid.Data4[4], Guid.Data4[5], Guid.Data4[6], Guid.Data4[7]);
}
inline
VOID
WaitForKey(
)
{
const HANDLE StdIn = NtCurrentPeb()->ProcessParameters->StandardInput;
INPUT_RECORD InputRecord = { 0 };
ULONG NumRead;
while (InputRecord.EventType != KEY_EVENT || !InputRecord.Event.KeyEvent.bKeyDown || InputRecord.Event.KeyEvent.dwControlKeyState !=
(InputRecord.Event.KeyEvent.dwControlKeyState & ~(RIGHT_CTRL_PRESSED | LEFT_CTRL_PRESSED)))
{
ReadConsoleInputW(StdIn, &InputRecord, 1, &NumRead);
}
}
#ifdef NT_ANALYSIS_ASSUME
// wdm.h's asserts are incompatible with both clang and MS's own analyzer
#undef NT_ANALYSIS_ASSUME
#undef NT_ASSERT_ACTION
#undef NT_ASSERTMSG_ACTION
#undef NT_ASSERTMSGW_ACTION
#undef NT_ASSERT_ASSUME
#undef NT_ASSERTMSG_ASSUME
#undef NT_ASSERTMSGW_ASSUME
#undef NT_ASSERT
#undef NT_ASSERTMSG
#undef NT_ASSERTMSGW
#endif
#ifdef _PREFAST_
#define NT_ANALYSIS_ASSUME(...) _Analysis_assume_(__VA_ARGS__)
#elif defined(_DEBUG) || defined(DBG)
#define NT_ANALYSIS_ASSUME(...) ((void) 0)
#else
#define NT_ANALYSIS_ASSUME(...) __noop(__VA_ARGS__)
#endif
#if !defined(__clang__)
#if !defined(DbgRaiseAssertionFailure)
#define DbgRaiseAssertionFailure() __int2c()
#endif
#define NT_ASSERT_ACTION(_exp) \
((!(_exp)) ? \
(__annotation((PWCHAR)L"Debug", L"AssertFail", L#_exp), \
DbgRaiseAssertionFailure(), FALSE) : \
TRUE)
#define NT_ASSERTMSG_ACTION(_msg, _exp) \
((!(_exp)) ? \
(__annotation((PWCHAR)L"Debug", L"AssertFail", L##_msg), \
DbgRaiseAssertionFailure(), FALSE) : \
TRUE)
#define NT_ASSERTMSGW_ACTION(_msg, _exp) \
((!(_exp)) ? \
(__annotation((PWCHAR)L"Debug", L"AssertFail", _msg), \
DbgRaiseAssertionFailure(), FALSE) : \
TRUE)
#else
#define NT_ASSERT_ACTION(_exp) \
((!(_exp)) ? (__debugbreak(), FALSE) : TRUE)
#define NT_ASSERTMSG_ACTION(_msg, _exp) \
NT_ASSERT_ACTION(_exp)
#define NT_ASSERTMSGW_ACTION(_msg, _exp) \
NT_ASSERT_ACTION(_exp)
#endif
#if defined(_DEBUG) || defined(DBG)
#define NT_ASSERT_ASSUME(_exp) \
(NT_ANALYSIS_ASSUME(_exp), NT_ASSERT_ACTION(_exp))
#define NT_ASSERTMSG_ASSUME(_msg, _exp) \
(NT_ANALYSIS_ASSUME(_exp), NT_ASSERTMSG_ACTION(_msg, _exp))
#define NT_ASSERTMSGW_ASSUME(_msg, _exp) \
(NT_ANALYSIS_ASSUME(_exp), NT_ASSERTMSGW_ACTION(_msg, _exp))
#define NT_ASSERT NT_ASSERT_ASSUME
#define NT_ASSERTMSG NT_ASSERTMSG_ASSUME
#define NT_ASSERTMSGW NT_ASSERTMSGW_ASSUME
#else
#define NT_ASSERT(_exp) ((void) 0)
#define NT_ASSERTMSG(_msg, _exp) ((void) 0)
#define NT_ASSERTMSGW(_msg, _exp) ((void) 0)
#endif
#ifdef __cplusplus
}
#endif
#ifdef __cplusplus
#pragma warning(push)
#pragma warning(disable:4309)
// Convenience utility
// Usage: static_print<some_constant>()() gives the value as compiler warning C4305 or -Wconstant-conversion
template<ULONG N>
struct static_print
{
CONSTEXPR CHAR operator()() const { return N + 256; }
};
#pragma warning(pop)
#define PRINT_SIZE(T) { static_print<sizeof(T)>()(); }
#define PRINT_OFFSET(T, V) { static_print<UFIELD_OFFSET(T, V)>()(); }
#endif
|