aboutsummaryrefslogtreecommitdiff
path: root/Exfiltration/mimikatz-1.0/driver/notify_object.h
diff options
context:
space:
mode:
Diffstat (limited to 'Exfiltration/mimikatz-1.0/driver/notify_object.h')
-rw-r--r--Exfiltration/mimikatz-1.0/driver/notify_object.h79
1 files changed, 0 insertions, 79 deletions
diff --git a/Exfiltration/mimikatz-1.0/driver/notify_object.h b/Exfiltration/mimikatz-1.0/driver/notify_object.h
deleted file mode 100644
index 96d5517..0000000
--- a/Exfiltration/mimikatz-1.0/driver/notify_object.h
+++ /dev/null
@@ -1,79 +0,0 @@
-#pragma once
-#include "notify.h"
-
-#define OBJECT_HASH_TABLE_SIZE 37
-
-typedef struct _OBJECT_DIRECTORY_ENTRY {
- struct _OBJECT_DIRECTORY_ENTRY *NextEntry;
- PVOID Object;
- ULONG HashValue; // pas en NT5
-} OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY;
-
-typedef struct _OBJECT_DIRECTORY {
- POBJECT_DIRECTORY_ENTRY HashBuckets[OBJECT_HASH_TABLE_SIZE];
- EX_PUSH_LOCK Lock;
- PVOID DeviceMap;
- ULONG SessionId;
- PVOID NamespaceEntry; // a partir de là, différent en NT5, mais pas utilisé...
- ULONG Flags;
-} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;
-
-typedef struct _OBJECT_TYPE_INITIALIZER // NT6, décaler ULONG en NT5x86 (compensé par l'alignement en x64)
-{
- SHORT Length;
- UCHAR ObjectTypeFlags;
- ULONG ObjectTypeCode;
- ULONG InvalidAttributes;
- GENERIC_MAPPING GenericMapping;
- ACCESS_MASK ValidAccessMask;
- ULONG RetainAccess;
- POOL_TYPE PoolType;
- ULONG DefaultPagedPoolCharge;
- ULONG DefaultNonPagedPoolCharge;
- PVOID DumpProcedure;
- PVOID OpenProcedure;
- PVOID CloseProcedure;
- PVOID DeleteProcedure;
- PVOID ParseProcedure;
- PVOID SecurityProcedure;
- PVOID QueryNameProcedure;
- PVOID OkayToCloseProcedure;
-} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;
-
-typedef struct _OBJECT_TYPE {
- LIST_ENTRY TypeList;
- UNICODE_STRING Name;
- PVOID DefaultObject;
- UCHAR Index;
- ULONG TotalNumberOfObjects;
- ULONG TotalNumberOfHandles;
- ULONG HighWaterNumberOfObjects;
- ULONG HighWaterNumberOfHandles;
- OBJECT_TYPE_INITIALIZER TypeInfo;
- EX_PUSH_LOCK TypeLock;
- ULONG Key;
- LIST_ENTRY CallbackList;
-} OBJECT_TYPE, *POBJECT_TYPE;
-
-typedef struct _OBJECT_CALLBACK_ENTRY {
- LIST_ENTRY CallbackList;
- OB_OPERATION Operations;
- ULONG Active;
- /*OB_HANDLE*/ PVOID Handle;
- POBJECT_TYPE ObjectType;
- POB_PRE_OPERATION_CALLBACK PreOperation;
- POB_POST_OPERATION_CALLBACK PostOperation;
-} OBJECT_CALLBACK_ENTRY, *POBJECT_CALLBACK_ENTRY;
-
-typedef enum _KIWI_NOTIF_OBJECT_ACTION
-{
- ListNotif,
- ClearNotif
-} KIWI_NOTIF_OBJECT_ACTION;
-
-POBJECT_DIRECTORY * ObpTypeDirectoryObject;
-
-NTSTATUS getObpTypeDirectoryObject();
-NTSTATUS kListNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining);
-NTSTATUS kClearNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining);
-NTSTATUS listNotifyOrClearObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_NOTIF_OBJECT_ACTION action);