#pragma once #include "notify.h" #define OBJECT_HASH_TABLE_SIZE 37 typedef struct _OBJECT_DIRECTORY_ENTRY { struct _OBJECT_DIRECTORY_ENTRY *NextEntry; PVOID Object; ULONG HashValue; // pas en NT5 } OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY; typedef struct _OBJECT_DIRECTORY { POBJECT_DIRECTORY_ENTRY HashBuckets[OBJECT_HASH_TABLE_SIZE]; EX_PUSH_LOCK Lock; PVOID DeviceMap; ULONG SessionId; PVOID NamespaceEntry; // a partir de là, différent en NT5, mais pas utilisé... ULONG Flags; } OBJECT_DIRECTORY, *POBJECT_DIRECTORY; typedef struct _OBJECT_TYPE_INITIALIZER // NT6, décaler ULONG en NT5x86 (compensé par l'alignement en x64) { SHORT Length; UCHAR ObjectTypeFlags; ULONG ObjectTypeCode; ULONG InvalidAttributes; GENERIC_MAPPING GenericMapping; ACCESS_MASK ValidAccessMask; ULONG RetainAccess; POOL_TYPE PoolType; ULONG DefaultPagedPoolCharge; ULONG DefaultNonPagedPoolCharge; PVOID DumpProcedure; PVOID OpenProcedure; PVOID CloseProcedure; PVOID DeleteProcedure; PVOID ParseProcedure; PVOID SecurityProcedure; PVOID QueryNameProcedure; PVOID OkayToCloseProcedure; } OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER; typedef struct _OBJECT_TYPE { LIST_ENTRY TypeList; UNICODE_STRING Name; PVOID DefaultObject; UCHAR Index; ULONG TotalNumberOfObjects; ULONG TotalNumberOfHandles; ULONG HighWaterNumberOfObjects; ULONG HighWaterNumberOfHandles; OBJECT_TYPE_INITIALIZER TypeInfo; EX_PUSH_LOCK TypeLock; ULONG Key; LIST_ENTRY CallbackList; } OBJECT_TYPE, *POBJECT_TYPE; typedef struct _OBJECT_CALLBACK_ENTRY { LIST_ENTRY CallbackList; OB_OPERATION Operations; ULONG Active; /*OB_HANDLE*/ PVOID Handle; POBJECT_TYPE ObjectType; POB_PRE_OPERATION_CALLBACK PreOperation; POB_POST_OPERATION_CALLBACK PostOperation; } OBJECT_CALLBACK_ENTRY, *POBJECT_CALLBACK_ENTRY; typedef enum _KIWI_NOTIF_OBJECT_ACTION { ListNotif, ClearNotif } KIWI_NOTIF_OBJECT_ACTION; POBJECT_DIRECTORY * ObpTypeDirectoryObject; NTSTATUS getObpTypeDirectoryObject(); NTSTATUS kListNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); NTSTATUS kClearNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); NTSTATUS listNotifyOrClearObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_NOTIF_OBJECT_ACTION action);