aboutsummaryrefslogtreecommitdiff
path: root/Exfiltration/mimikatz-1.0/driver/notify_object.h
diff options
context:
space:
mode:
authorclymb3r <bialek.joseph@gmail.com>2014-04-16 21:02:50 -0700
committerclymb3r <bialek.joseph@gmail.com>2014-04-16 21:02:50 -0700
commitb783b459c12112509a733253df9f5935e104200c (patch)
treee58bce1f7d2f2584d1426262cc609f153d774e51 /Exfiltration/mimikatz-1.0/driver/notify_object.h
parent47b90647c11cb4956c735cfa47628dc7dcb03bb6 (diff)
parent946328cf9e6d6c60eca2bb9d71a38e210c1c3b6c (diff)
downloadPowerSploit-b783b459c12112509a733253df9f5935e104200c.tar.gz
PowerSploit-b783b459c12112509a733253df9f5935e104200c.zip
Merge branch 'master' of https://github.com/mattifestation/PowerSploit
Conflicts: Recon/Get-ComputerDetails.ps1 Recon/Recon.psd1
Diffstat (limited to 'Exfiltration/mimikatz-1.0/driver/notify_object.h')
-rw-r--r--Exfiltration/mimikatz-1.0/driver/notify_object.h79
1 files changed, 0 insertions, 79 deletions
diff --git a/Exfiltration/mimikatz-1.0/driver/notify_object.h b/Exfiltration/mimikatz-1.0/driver/notify_object.h
deleted file mode 100644
index 96d5517..0000000
--- a/Exfiltration/mimikatz-1.0/driver/notify_object.h
+++ /dev/null
@@ -1,79 +0,0 @@
-#pragma once
-#include "notify.h"
-
-#define OBJECT_HASH_TABLE_SIZE 37
-
-typedef struct _OBJECT_DIRECTORY_ENTRY {
- struct _OBJECT_DIRECTORY_ENTRY *NextEntry;
- PVOID Object;
- ULONG HashValue; // pas en NT5
-} OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY;
-
-typedef struct _OBJECT_DIRECTORY {
- POBJECT_DIRECTORY_ENTRY HashBuckets[OBJECT_HASH_TABLE_SIZE];
- EX_PUSH_LOCK Lock;
- PVOID DeviceMap;
- ULONG SessionId;
- PVOID NamespaceEntry; // a partir de là, différent en NT5, mais pas utilisé...
- ULONG Flags;
-} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;
-
-typedef struct _OBJECT_TYPE_INITIALIZER // NT6, décaler ULONG en NT5x86 (compensé par l'alignement en x64)
-{
- SHORT Length;
- UCHAR ObjectTypeFlags;
- ULONG ObjectTypeCode;
- ULONG InvalidAttributes;
- GENERIC_MAPPING GenericMapping;
- ACCESS_MASK ValidAccessMask;
- ULONG RetainAccess;
- POOL_TYPE PoolType;
- ULONG DefaultPagedPoolCharge;
- ULONG DefaultNonPagedPoolCharge;
- PVOID DumpProcedure;
- PVOID OpenProcedure;
- PVOID CloseProcedure;
- PVOID DeleteProcedure;
- PVOID ParseProcedure;
- PVOID SecurityProcedure;
- PVOID QueryNameProcedure;
- PVOID OkayToCloseProcedure;
-} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;
-
-typedef struct _OBJECT_TYPE {
- LIST_ENTRY TypeList;
- UNICODE_STRING Name;
- PVOID DefaultObject;
- UCHAR Index;
- ULONG TotalNumberOfObjects;
- ULONG TotalNumberOfHandles;
- ULONG HighWaterNumberOfObjects;
- ULONG HighWaterNumberOfHandles;
- OBJECT_TYPE_INITIALIZER TypeInfo;
- EX_PUSH_LOCK TypeLock;
- ULONG Key;
- LIST_ENTRY CallbackList;
-} OBJECT_TYPE, *POBJECT_TYPE;
-
-typedef struct _OBJECT_CALLBACK_ENTRY {
- LIST_ENTRY CallbackList;
- OB_OPERATION Operations;
- ULONG Active;
- /*OB_HANDLE*/ PVOID Handle;
- POBJECT_TYPE ObjectType;
- POB_PRE_OPERATION_CALLBACK PreOperation;
- POB_POST_OPERATION_CALLBACK PostOperation;
-} OBJECT_CALLBACK_ENTRY, *POBJECT_CALLBACK_ENTRY;
-
-typedef enum _KIWI_NOTIF_OBJECT_ACTION
-{
- ListNotif,
- ClearNotif
-} KIWI_NOTIF_OBJECT_ACTION;
-
-POBJECT_DIRECTORY * ObpTypeDirectoryObject;
-
-NTSTATUS getObpTypeDirectoryObject();
-NTSTATUS kListNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining);
-NTSTATUS kClearNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining);
-NTSTATUS listNotifyOrClearObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_NOTIF_OBJECT_ACTION action);