-
Notifications
You must be signed in to change notification settings - Fork 30
/
Copy pathvmmdll.h
1832 lines (1648 loc) · 77.9 KB
/
vmmdll.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// vmmdll.h : header file to include in projects that use vmm.dll / vmm.so
//
// Windows may access both UTF-8 *U and Wide-Char *W versions of functions
// while Linux may only access UTF-8 versions. Some functionality may also
// be degraded or unavailable on Linux.
//
// (c) Ulf Frisk, 2018-2021
// Author: Ulf Frisk, [email protected]
//
// Header Version: 4.0
//
#include "leechcore.h"
#ifndef __VMMDLL_H__
#define __VMMDLL_H__
#ifdef __cplusplus
extern "C" {
#endif /* __cplusplus */
#ifdef _WIN32
#include <Windows.h>
#undef EXPORTED_FUNCTION
#define EXPORTED_FUNCTION
typedef unsigned __int64 QWORD, *PQWORD;
#endif /* _WIN32 */
#ifdef LINUX
#include <inttypes.h>
#include <stdlib.h>
#undef EXPORTED_FUNCTION
#define EXPORTED_FUNCTION __attribute__((visibility("default")))
typedef void VOID, *PVOID, *HANDLE, **PHANDLE, *HMODULE;
typedef long long unsigned int QWORD, *PQWORD, ULONG64, *PULONG64;
typedef uint64_t SIZE_T, *PSIZE_T, FILETIME, *PFILETIME;
typedef uint32_t DWORD, *PDWORD, *LPDWORD, BOOL, *PBOOL, NTSTATUS;
typedef uint16_t WORD, *PWORD;
typedef uint8_t BYTE, *PBYTE, *LPBYTE, UCHAR;
typedef char CHAR, *PCHAR, *LPSTR, *LPCSTR;
typedef uint16_t WCHAR, *PWCHAR, *LPWSTR, *LPCWSTR;
#define MAX_PATH 260
#define _In_
#define _In_z_
#define _In_opt_
#define _In_reads_(x)
#define _In_reads_opt_(x)
#define _Inout_
#define _Inout_bytecount_(x)
#define _Inout_opt_
#define _Inout_updates_opt_(x)
#define _Out_
#define _Out_opt_
#define _Out_writes_(x)
#define _Out_writes_bytes_opt_(x)
#define _Out_writes_opt_(x)
#define _Out_writes_to_(x,y)
#define _When_(x,y)
#define _Frees_ptr_opt_
#define _Post_ptr_invalid_
#define _Check_return_opt_
#define _Printf_format_string_
#define _Success_(x)
#endif /* LINUX */
//-----------------------------------------------------------------------------
// INITIALIZATION FUNCTIONALITY BELOW:
// Choose one way of initializing the VMM / MemProcFS.
//-----------------------------------------------------------------------------
/*
* Initialize VMM.DLL with command line parameters. For a more detailed info
* about the parameters please see github wiki for MemProcFS and LeechCore.
* NB! LeechCore initialization parameters are _also_ valid to this function.
* Important parameters are:
* -printf = show printf style outputs.
* -v -vv -vvv = extra verbosity levels.
* -device = device as on format for LeechCore - please see leechcore.h or
* Github documentation for additional information. Some values
* are: <file>, fpga, usb3380, hvsavedstate, totalmeltdown, pmem
* -remote = remote LeechCore instance - please see leechcore.h or Github
* documentation for additional information.
* -norefresh = disable background refreshes (even if backing memory is
* volatile memory).
* -memmap = specify a physical memory map given by file or specify 'auto'.
* example: -memmap c:\\temp\\my_custom_memory_map.txt
* example: -memmap auto
* -pagefile[0-9] = page file(s) to use in addition to physical memory.
* Normally pagefile.sys have index 0 and swapfile.sys index 1.
* Page files are in constant flux - do not use if time diff
* between memory dump and page files are more than few minutes.
* Example: 'pagefile0 swapfile.sys'
* -symbolserverdisable = disable symbol server until user change.
* This parameter will take precedence over registry settings.
* -waitinitialize = Wait for initialization to complete before returning.
* Normal use is that some initialization is done asynchronously
* and may not be completed when initialization call is completed.
* This includes virtual memory compression, registry and more.
* Example: '-waitinitialize'
* -userinteract = allow vmm.dll to, on the console, query the user for
* information such as, but not limited to, leechcore device options.
* Default: user interaction = disabled.
* -forensic = start a forensic scan of the physical memory immediately after
* startup if possible. Allowed parameter values range from 0-4.
* Note! forensic mode is not available for live memory.
* 1 = forensic mode with in-memory sqlite database.
* 2 = forensic mode with temp sqlite database deleted upon exit.
* 3 = forensic mode with temp sqlite database remaining upon exit.
* 4 = forensic mode with static named sqlite database (vmm.sqlite3).
* Example -forensic 4
*
* -- argc
* -- argv
* -- ppLcErrorInfo = optional pointer to receive a function allocated memory of
* struct LC_CONFIG_ERRORINFO with extended error information upon
* failure. Any memory received should be free'd by caller by
* calling LcMemFree().
* -- return = success/fail
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_Initialize(_In_ DWORD argc, _In_ LPSTR argv[]);
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_InitializeEx(_In_ DWORD argc, _In_ LPSTR argv[], _Out_opt_ PPLC_CONFIG_ERRORINFO ppLcErrorInfo);
/*
* Close an initialized instance of VMM.DLL and clean up all allocated resources
* including plugins, linked PCILeech.DLL and other memory resources.
* -- return = success/fail.
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_Close();
/*
* Free memory allocated by the VMMDLL.
* -- pvMem
*/
EXPORTED_FUNCTION
VOID VMMDLL_MemFree(_Frees_ptr_opt_ PVOID pvMem);
//-----------------------------------------------------------------------------
// CONFIGURATION SETTINGS BELOW:
// Configure MemProcFS or the underlying memory
// acquisition devices.
//-----------------------------------------------------------------------------
/*
* Options used together with the functions: VMMDLL_ConfigGet & VMMDLL_ConfigSet
* Options are defined with either: VMMDLL_OPT_* in this header file or as
* LC_OPT_* in leechcore.h
* For more detailed information check the sources for individual device types.
*/
#define VMMDLL_OPT_CORE_PRINTF_ENABLE 0x4000000100000000 // RW
#define VMMDLL_OPT_CORE_VERBOSE 0x4000000200000000 // RW
#define VMMDLL_OPT_CORE_VERBOSE_EXTRA 0x4000000300000000 // RW
#define VMMDLL_OPT_CORE_VERBOSE_EXTRA_TLP 0x4000000400000000 // RW
#define VMMDLL_OPT_CORE_MAX_NATIVE_ADDRESS 0x4000000800000000 // R
#define VMMDLL_OPT_CORE_SYSTEM 0x2000000100000000 // R
#define VMMDLL_OPT_CORE_MEMORYMODEL 0x2000000200000000 // R
#define VMMDLL_OPT_CONFIG_IS_REFRESH_ENABLED 0x2000000300000000 // R - 1/0
#define VMMDLL_OPT_CONFIG_TICK_PERIOD 0x2000000400000000 // RW - base tick period in ms
#define VMMDLL_OPT_CONFIG_READCACHE_TICKS 0x2000000500000000 // RW - memory cache validity period (in ticks)
#define VMMDLL_OPT_CONFIG_TLBCACHE_TICKS 0x2000000600000000 // RW - page table (tlb) cache validity period (in ticks)
#define VMMDLL_OPT_CONFIG_PROCCACHE_TICKS_PARTIAL 0x2000000700000000 // RW - process refresh (partial) period (in ticks)
#define VMMDLL_OPT_CONFIG_PROCCACHE_TICKS_TOTAL 0x2000000800000000 // RW - process refresh (full) period (in ticks)
#define VMMDLL_OPT_CONFIG_VMM_VERSION_MAJOR 0x2000000900000000 // R
#define VMMDLL_OPT_CONFIG_VMM_VERSION_MINOR 0x2000000A00000000 // R
#define VMMDLL_OPT_CONFIG_VMM_VERSION_REVISION 0x2000000B00000000 // R
#define VMMDLL_OPT_CONFIG_STATISTICS_FUNCTIONCALL 0x2000000C00000000 // RW - enable function call statistics (.status/statistics_fncall file)
#define VMMDLL_OPT_CONFIG_IS_PAGING_ENABLED 0x2000000D00000000 // RW - 1/0
#define VMMDLL_OPT_WIN_VERSION_MAJOR 0x2000010100000000 // R
#define VMMDLL_OPT_WIN_VERSION_MINOR 0x2000010200000000 // R
#define VMMDLL_OPT_WIN_VERSION_BUILD 0x2000010300000000 // R
#define VMMDLL_OPT_WIN_SYSTEM_UNIQUE_ID 0x2000010400000000 // R
#define VMMDLL_OPT_FORENSIC_MODE 0x2000020100000000 // RW - enable/retrieve forensic mode type [0-4].
#define VMMDLL_OPT_REFRESH_ALL 0x2001ffff00000000 // W - refresh all caches
#define VMMDLL_OPT_REFRESH_FREQ_MEM 0x2001000200000000 // W - refresh memory cache (excl. TLB) [partial 33%/call]
#define VMMDLL_OPT_REFRESH_FREQ_TLB 0x2001000400000000 // W - refresh page table (TLB) cache [partial 33%/call]
#define VMMDLL_OPT_REFRESH_FREQ_FAST 0x2001040000000000 // W - refresh fast frequency - incl. partial process refresh
#define VMMDLL_OPT_REFRESH_FREQ_MEDIUM 0x2001000100000000 // W - refresh medium frequency - incl. full process refresh
#define VMMDLL_OPT_REFRESH_FREQ_SLOW 0x2001001000000000 // W - refresh slow frequency.
#define VMMDLL_OPT_REFRESH_PROCESS 0x2001000100000000 // W - DEPRECATED: refresh process listings
#define VMMDLL_OPT_REFRESH_READ 0x2001000200000000 // W - DEPRECATED: refresh physical read cache
#define VMMDLL_OPT_REFRESH_TLB 0x2001000400000000 // W - DEPRECATED: refresh page table (TLB) cache
#define VMMDLL_OPT_REFRESH_PAGING 0x2001000800000000 // W - DEPRECATED: refresh virtual memory 'paging' cache
#define VMMDLL_OPT_REFRESH_REGISTRY 0x2001001000000000 // W - DEPRECATED:
#define VMMDLL_OPT_REFRESH_USER 0x2001002000000000 // W - DEPRECATED:
#define VMMDLL_OPT_REFRESH_PHYSMEMMAP 0x2001004000000000 // W - DEPRECATED:
#define VMMDLL_OPT_REFRESH_PFN 0x2001008000000000 // W - DEPRECATED:
#define VMMDLL_OPT_REFRESH_OBJ 0x2001010000000000 // W - DEPRECATED:
#define VMMDLL_OPT_REFRESH_NET 0x2001020000000000 // W - DEPRECATED:
static LPCSTR VMMDLL_MEMORYMODEL_TOSTRING[4] = { "N/A", "X86", "X86PAE", "X64" };
typedef enum tdVMMDLL_MEMORYMODEL_TP {
VMMDLL_MEMORYMODEL_NA = 0,
VMMDLL_MEMORYMODEL_X86 = 1,
VMMDLL_MEMORYMODEL_X86PAE = 2,
VMMDLL_MEMORYMODEL_X64 = 3
} VMMDLL_MEMORYMODEL_TP;
typedef enum tdVMMDLL_SYSTEM_TP {
VMMDLL_SYSTEM_UNKNOWN_X64 = 1,
VMMDLL_SYSTEM_WINDOWS_X64 = 2,
VMMDLL_SYSTEM_UNKNOWN_X86 = 3,
VMMDLL_SYSTEM_WINDOWS_X86 = 4
} VMMDLL_SYSTEM_TP;
/*
* Set a device specific option value. Please see defines VMMDLL_OPT_* for infor-
* mation about valid option values. Please note that option values may overlap
* between different device types with different meanings.
* -- fOption
* -- pqwValue = pointer to ULONG64 to receive option value.
* -- return = success/fail.
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_ConfigGet(_In_ ULONG64 fOption, _Out_ PULONG64 pqwValue);
/*
* Set a device specific option value. Please see defines VMMDLL_OPT_* for infor-
* mation about valid option values. Please note that option values may overlap
* between different device types with different meanings.
* -- fOption
* -- qwValue
* -- return = success/fail.
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_ConfigSet(_In_ ULONG64 fOption, _In_ ULONG64 qwValue);
//-----------------------------------------------------------------------------
// FORWARD DECLARATIONS:
//-----------------------------------------------------------------------------
typedef struct tdVMMDLL_MAP_PFN *PVMMDLL_MAP_PFN;
//-----------------------------------------------------------------------------
// LINUX SPECIFIC DEFINES:
//-----------------------------------------------------------------------------
#ifdef LINUX
#define IMAGE_SIZEOF_SHORT_NAME 8
typedef struct _IMAGE_DATA_DIRECTORY {
DWORD VirtualAddress;
DWORD Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
typedef struct _IMAGE_SECTION_HEADER {
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
union {
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc;
DWORD VirtualAddress;
DWORD SizeOfRawData;
DWORD PointerToRawData;
DWORD PointerToRelocations;
DWORD PointerToLinenumbers;
WORD NumberOfRelocations;
WORD NumberOfLinenumbers;
DWORD Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
typedef struct _SERVICE_STATUS {
DWORD dwServiceType;
DWORD dwCurrentState;
DWORD dwControlsAccepted;
DWORD dwWin32ExitCode;
DWORD dwServiceSpecificExitCode;
DWORD dwCheckPoint;
DWORD dwWaitHint;
} SERVICE_STATUS, *LPSERVICE_STATUS;
#endif /* LINUX */
//-----------------------------------------------------------------------------
// VFS - VIRTUAL FILE SYSTEM FUNCTIONALITY BELOW:
// NB! VFS FUNCTIONALITY REQUIRES PLUGINS TO BE INITIALIZED
// WITH CALL TO VMMDLL_InitializePlugins().
// This is the core of MemProcFS. All implementation and analysis towards
// the virtual file system (vfs) is possible by using functionality below.
//-----------------------------------------------------------------------------
#define VMMDLL_STATUS_SUCCESS ((NTSTATUS)0x00000000L)
#define VMMDLL_STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L)
#define VMMDLL_STATUS_END_OF_FILE ((NTSTATUS)0xC0000011L)
#define VMMDLL_STATUS_FILE_INVALID ((NTSTATUS)0xC0000098L)
#define VMMDLL_STATUS_FILE_SYSTEM_LIMITATION ((NTSTATUS)0xC0000427L)
#define VMMDLL_VFS_FILELIST_EXINFO_VERSION 1
#define VMMDLL_VFS_FILELIST_VERSION 2
typedef struct tdVMMDLL_VFS_FILELIST_EXINFO {
DWORD dwVersion;
BOOL fCompressed; // set flag FILE_ATTRIBUTE_COMPRESSED - (no meaning but shows gui artifact in explorer.exe)
union {
FILETIME ftCreationTime; // 0 = default time
QWORD qwCreationTime;
};
union {
FILETIME ftLastAccessTime; // 0 = default time
QWORD qwLastAccessTime;
};
union {
FILETIME ftLastWriteTime; // 0 = default time
QWORD qwLastWriteTime;
};
} VMMDLL_VFS_FILELIST_EXINFO, *PVMMDLL_VFS_FILELIST_EXINFO;
typedef struct tdVMMDLL_VFS_FILELIST2 {
DWORD dwVersion;
VOID(*pfnAddFile) (_Inout_ HANDLE h, _In_ LPSTR uszName, _In_ ULONG64 cb, _In_opt_ PVMMDLL_VFS_FILELIST_EXINFO pExInfo);
VOID(*pfnAddDirectory)(_Inout_ HANDLE h, _In_ LPSTR uszName, _In_opt_ PVMMDLL_VFS_FILELIST_EXINFO pExInfo);
HANDLE h;
} VMMDLL_VFS_FILELIST2, *PVMMDLL_VFS_FILELIST2;
/*
* Helper functions for callbacks into the VMM_VFS_FILELIST structure.
*/
EXPORTED_FUNCTION
VOID VMMDLL_VfsList_AddFile(_In_ HANDLE pFileList, _In_ LPSTR uszName, _In_ ULONG64 cb, _In_opt_ PVMMDLL_VFS_FILELIST_EXINFO pExInfo);
VOID VMMDLL_VfsList_AddFileW(_In_ HANDLE pFileList, _In_ LPWSTR wszName, _In_ ULONG64 cb, _In_opt_ PVMMDLL_VFS_FILELIST_EXINFO pExInfo);
EXPORTED_FUNCTION
VOID VMMDLL_VfsList_AddDirectory(_In_ HANDLE pFileList, _In_ LPSTR uszName, _In_opt_ PVMMDLL_VFS_FILELIST_EXINFO pExInfo);
VOID VMMDLL_VfsList_AddDirectoryW(_In_ HANDLE pFileList, _In_ LPWSTR wszName, _In_opt_ PVMMDLL_VFS_FILELIST_EXINFO pExInfo);
EXPORTED_FUNCTION BOOL VMMDLL_VfsList_IsHandleValid(_In_ HANDLE pFileList);
/*
* List a directory of files in MemProcFS. Directories and files will be listed
* by callbacks into functions supplied in the pFileList parameter.
* If information of an individual file is needed it's neccessary to list all
* files in its directory.
* -- [uw]szPath
* -- pFileList
* -- return
*/
EXPORTED_FUNCTION
_Success_(return) BOOL VMMDLL_VfsListU(_In_ LPSTR uszPath, _Inout_ PVMMDLL_VFS_FILELIST2 pFileList);
_Success_(return) BOOL VMMDLL_VfsListW(_In_ LPWSTR wszPath, _Inout_ PVMMDLL_VFS_FILELIST2 pFileList);
/*
* Read select parts of a file in MemProcFS.
* -- [uw]szFileName
* -- pb
* -- cb
* -- pcbRead
* -- cbOffset
* -- return
*
*/
EXPORTED_FUNCTION
NTSTATUS VMMDLL_VfsReadU(_In_ LPSTR uszFileName, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
NTSTATUS VMMDLL_VfsReadW(_In_ LPWSTR wszFileName, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
/*
* Write select parts to a file in MemProcFS.
* -- [uw]szFileName
* -- pb
* -- cb
* -- pcbWrite
* -- cbOffset
* -- return
*/
EXPORTED_FUNCTION
NTSTATUS VMMDLL_VfsWriteU(_In_ LPSTR uszFileName, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset);
NTSTATUS VMMDLL_VfsWriteW(_In_ LPWSTR wszFileName, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset);
/*
* Utility functions for MemProcFS read/write towards different underlying data
* representations.
*/
EXPORTED_FUNCTION NTSTATUS VMMDLL_UtilVfsReadFile_FromPBYTE(_In_ PBYTE pbFile, _In_ ULONG64 cbFile, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
EXPORTED_FUNCTION NTSTATUS VMMDLL_UtilVfsReadFile_FromQWORD(_In_ ULONG64 qwValue, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset, _In_ BOOL fPrefix);
EXPORTED_FUNCTION NTSTATUS VMMDLL_UtilVfsReadFile_FromDWORD(_In_ DWORD dwValue, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset, _In_ BOOL fPrefix);
EXPORTED_FUNCTION NTSTATUS VMMDLL_UtilVfsReadFile_FromBOOL(_In_ BOOL fValue, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
EXPORTED_FUNCTION NTSTATUS VMMDLL_UtilVfsWriteFile_BOOL(_Inout_ PBOOL pfTarget, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset);
EXPORTED_FUNCTION NTSTATUS VMMDLL_UtilVfsWriteFile_DWORD(_Inout_ PDWORD pdwTarget, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset, _In_ DWORD dwMinAllow);
//-----------------------------------------------------------------------------
// PLUGIN MANAGER FUNCTIONALITY BELOW:
// Function and structures to initialize and use MemProcFS plugin functionality.
// The plugin manager is started by a call to function:
// VMM_VfsInitializePlugins. Each built-in plugin and external plugin of which
// the DLL name matches m_*.dll will receive a call to its InitializeVmmPlugin
// function. The plugin/module may decide to call pfnPluginManager_Register to
// register plugins in the form of different names one or more times.
// Example of registration function in a plugin DLL below:
// 'VOID InitializeVmmPlugin(_In_ PVMM_PLUGIN_REGINFO pRegInfo)'
//-----------------------------------------------------------------------------
/*
* Initialize all potential plugins, both built-in and external, that maps into
* MemProcFS. Please note that plugins are not loaded by default - they have to
* be explicitly loaded by calling this function. They will be unloaded on a
* general close of the vmm dll.
* -- return
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_InitializePlugins();
#define VMMDLL_PLUGIN_CONTEXT_MAGIC 0xc0ffee663df9301c
#define VMMDLL_PLUGIN_CONTEXT_VERSION 4
#define VMMDLL_PLUGIN_REGINFO_MAGIC 0xc0ffee663df9301d
#define VMMDLL_PLUGIN_REGINFO_VERSION 13
#define VMMDLL_PLUGIN_FORENSIC_JSONDATA_VERSION 0xc0ee0001
#define VMMDLL_PLUGIN_NOTIFY_VERBOSITYCHANGE 0x01
#define VMMDLL_PLUGIN_NOTIFY_REFRESH_FAST 0x05 // refresh fast event - at partial process refresh.
#define VMMDLL_PLUGIN_NOTIFY_REFRESH_MEDIUM 0x02 // refresh medium event - at full process refresh.
#define VMMDLL_PLUGIN_NOTIFY_REFRESH_SLOW 0x04 // refresh slow event - at registry refresh.
#define VMMDLL_PLUGIN_NOTIFY_FORENSIC_INIT 0x01000100
#define VMMDLL_PLUGIN_NOTIFY_FORENSIC_INIT_COMPLETE 0x01000200
typedef HANDLE *PVMMDLL_PLUGIN_INTERNAL_CONTEXT;
typedef struct tdVMMDLL_PLUGIN_CONTEXT {
ULONG64 magic;
WORD wVersion;
WORD wSize;
DWORD dwPID;
PVOID pProcess;
LPSTR uszModule;
LPSTR uszPath;
PVOID pvReserved1;
PVMMDLL_PLUGIN_INTERNAL_CONTEXT ctxM; // optional internal module context.
} VMMDLL_PLUGIN_CONTEXT, *PVMMDLL_PLUGIN_CONTEXT;
typedef struct tdVMMDLL_PLUGIN_FORENSIC_JSONDATA {
DWORD dwVersion; // must equal VMMDLL_PLUGIN_FORENSIC_JSONDATA_VERSION
BOOL fVerbose;
LPSTR szjType; // log type/name (json encoded)
DWORD i;
DWORD dwPID;
QWORD vaObj;
BOOL fva[2]; // log va even if zero
QWORD va[2];
BOOL fNum[2]; // log num even if zero
QWORD qwNum[2];
BOOL fHex[2]; // log hex even if zero
QWORD qwHex[2];
// str: will be prioritized in order: szu > wsz.
LPCSTR usz[2]; // str: utf-8 encoded
LPCWSTR wsz[2]; // str: wide
BYTE _Reserved[0x4000+256];
} VMMDLL_PLUGIN_FORENSIC_JSONDATA, *PVMMDLL_PLUGIN_FORENSIC_JSONDATA;
typedef struct tdVMMDLL_PLUGIN_FORENSIC_INGEST_PHYSMEM {
DWORD cMEMs;
BOOL fValid;
QWORD paBase;
PPMEM_SCATTER ppMEMs;
PVMMDLL_MAP_PFN pPfnMap;
} VMMDLL_PLUGIN_FORENSIC_INGEST_PHYSMEM, *PVMMDLL_PLUGIN_FORENSIC_INGEST_PHYSMEM;
typedef struct tdVMMDLL_PLUGIN_REGINFO {
ULONG64 magic;
WORD wVersion;
WORD wSize;
VMMDLL_MEMORYMODEL_TP tpMemoryModel;
VMMDLL_SYSTEM_TP tpSystem;
HMODULE hDLL;
BOOL(*pfnPluginManager_Register)(struct tdVMMDLL_PLUGIN_REGINFO *pPluginRegInfo);
DWORD _Reserved[32];
// python plugin information - not for general use
struct {
BOOL fPythonStandalone;
DWORD _Reserved;
HMODULE hReservedDllPython3;
HMODULE hReservedDllPython3X;
} python;
// general plugin registration info to be filled out by the plugin below:
struct {
PVMMDLL_PLUGIN_INTERNAL_CONTEXT ctxM; // optional internal module context [must be cleaned by pfnClose() call].
CHAR uszPathName[128];
BOOL fRootModule;
BOOL fProcessModule;
BOOL fRootModuleHidden;
BOOL fProcessModuleHidden;
CHAR sTimelineNameShort[6];
CHAR _Reserved[2];
CHAR uszTimelineFile[32];
CHAR _Reserved2[32];
} reg_info;
// function plugin registration info to be filled out by the plugin below:
struct {
BOOL(*pfnList)(_In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _Inout_ PHANDLE pFileList);
NTSTATUS(*pfnRead)(_In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
NTSTATUS(*pfnWrite)(_In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset);
VOID(*pfnNotify)(_In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In_ DWORD fEvent, _In_opt_ PVOID pvEvent, _In_opt_ DWORD cbEvent);
VOID(*pfnClose)(_In_ PVMMDLL_PLUGIN_CONTEXT ctxP);
BOOL(*pfnVisibleModule)(_In_ PVMMDLL_PLUGIN_CONTEXT ctxP);
PVOID pvReserved[10];
} reg_fn;
// Optional forensic plugin functionality for forensic (more comprehensive)
// analysis of various data. Functions are optional. Functions are called
// in single-threaded mode regards to the plugin itself - but 'ingest'
// functions are called in-parallel multi-threaded between plugins.
// Functions are called in the order of:
// pfnInitialize(), pfnIngest*(), pfnTimeline(), pfnLogJSON(), pfnFinalize()
struct {
PVOID(*pfnInitialize)(_In_ PVMMDLL_PLUGIN_CONTEXT ctxP);
VOID(*pfnFinalize)(_In_opt_ PVOID ctxfc);
VOID(*pfnTimeline)(
_In_opt_ PVOID ctxfc,
_In_ HANDLE hTimeline,
_In_ VOID(*pfnAddEntry)(_In_ HANDLE hTimeline, _In_ QWORD ft, _In_ DWORD dwAction, _In_ DWORD dwPID, _In_ DWORD dwData32, _In_ QWORD qwData64, _In_ LPSTR uszText),
_In_ VOID(*pfnEntryAddBySql)(_In_ HANDLE hTimeline, _In_ DWORD cEntrySql, _In_ LPSTR *pszEntrySql));
VOID(*pfnIngestPhysmem)(_In_opt_ PVOID ctxfc, _In_ PVMMDLL_PLUGIN_FORENSIC_INGEST_PHYSMEM pIngestPhysmem);
VOID(*pfnIngestFinalize)(_In_opt_ PVOID ctxfc);
PVOID pvReserved[10];
VOID(*pfnLogJSON)(_In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In_ VOID(*pfnLogJSON)(_In_ PVMMDLL_PLUGIN_FORENSIC_JSONDATA pData));
} reg_fnfc;
// Additional system information - read/only by the plugins.
struct {
BOOL f32;
DWORD dwVersionMajor;
DWORD dwVersionMinor;
DWORD dwVersionBuild;
DWORD _Reserved[32];
} sysinfo;
} VMMDLL_PLUGIN_REGINFO, *PVMMDLL_PLUGIN_REGINFO;
//-----------------------------------------------------------------------------
// VMM CORE FUNCTIONALITY BELOW:
// Vmm core functaionlity such as read (and write) to both virtual and physical
// memory. NB! writing will only work if the target is supported - i.e. not a
// memory dump file...
// To read physical memory specify dwPID as (DWORD)-1
//-----------------------------------------------------------------------------
#define VMMDLL_PID_PROCESS_WITH_KERNELMEMORY 0x80000000 // Combine with dwPID to enable process kernel memory (NB! use with extreme care).
// FLAG used to supress the default read cache in calls to VMM_MemReadEx()
// which will lead to the read being fetched from the target system always.
// Cached page tables (used for translating virtual2physical) are still used.
#define VMMDLL_FLAG_NOCACHE 0x0001 // do not use the data cache (force reading from memory acquisition device)
#define VMMDLL_FLAG_ZEROPAD_ON_FAIL 0x0002 // zero pad failed physical memory reads and report success if read within range of physical memory.
#define VMMDLL_FLAG_FORCECACHE_READ 0x0008 // force use of cache - fail non-cached pages - only valid for reads, invalid with VMM_FLAG_NOCACHE/VMM_FLAG_ZEROPAD_ON_FAIL.
#define VMMDLL_FLAG_NOPAGING 0x0010 // do not try to retrieve memory from paged out memory from pagefile/compressed (even if possible)
#define VMMDLL_FLAG_NOPAGING_IO 0x0020 // do not try to retrieve memory from paged out memory if read would incur additional I/O (even if possible).
#define VMMDLL_FLAG_NOCACHEPUT 0x0100 // do not write back to the data cache upon successful read from memory acquisition device.
#define VMMDLL_FLAG_CACHE_RECENT_ONLY 0x0200 // only fetch from the most recent active cache region when reading.
#define VMMDLL_FLAG_NO_PREDICTIVE_READ 0x0400 // do not perform additional predictive page reads (default on smaller requests).
/*
* Read memory in various non-contigious locations specified by the pointers to
* the items in the ppMEMs array. Result for each unit of work will be given
* individually. No upper limit of number of items to read, but no performance
* boost will be given if above hardware limit. Max size of each unit of work is
* one 4k page (4096 bytes). Reads must not cross 4k page boundaries. Reads must
* start at even DWORDs (4-bytes).
* -- dwPID - PID of target process, (DWORD)-1 to read physical memory.
* -- ppMEMs = array of scatter read headers.
* -- cpMEMs = count of ppMEMs.
* -- flags = optional flags as given by VMMDLL_FLAG_*
* -- return = the number of successfully read items.
*/
EXPORTED_FUNCTION
DWORD VMMDLL_MemReadScatter(_In_ DWORD dwPID, _Inout_ PPMEM_SCATTER ppMEMs, _In_ DWORD cpMEMs, _In_ DWORD flags);
/*
* Read a single 4096-byte page of memory.
* -- dwPID - PID of target process, (DWORD)-1 to read physical memory.
* -- qwA
* -- pbPage
* -- return = success/fail (depending if all requested bytes are read or not).
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_MemReadPage(_In_ DWORD dwPID, _In_ ULONG64 qwA, _Inout_bytecount_(4096) PBYTE pbPage);
/*
* Read a contigious arbitrary amount of memory.
* -- dwPID - PID of target process, (DWORD)-1 to read physical memory.
* -- qwA
* -- pb
* -- cb
* -- return = success/fail (depending if all requested bytes are read or not).
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_MemRead(_In_ DWORD dwPID, _In_ ULONG64 qwA, _Out_writes_(cb) PBYTE pb, _In_ DWORD cb);
/*
* Read a contigious amount of memory and report the number of bytes read in pcbRead.
* -- dwPID - PID of target process, (DWORD)-1 to read physical memory.
* -- qwA
* -- pb
* -- cb
* -- pcbRead
* -- flags = flags as in VMMDLL_FLAG_*
* -- return = success/fail. NB! reads may report as success even if 0 bytes are
* read - it's recommended to verify pcbReadOpt parameter.
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_MemReadEx(_In_ DWORD dwPID, _In_ ULONG64 qwA, _Out_writes_(cb) PBYTE pb, _In_ DWORD cb, _Out_opt_ PDWORD pcbReadOpt, _In_ ULONG64 flags);
/*
* Prefetch a number of addresses (specified in the pA array) into the memory
* cache. This function is to be used to batch larger known reads into local
* cache before making multiple smaller reads - which will then happen from
* the cache. Function exists for performance reasons.
* -- dwPID = PID of target process, (DWORD)-1 for physical memory.
* -- pPrefetchAddresses = array of addresses to read into cache.
* -- cPrefetchAddresses
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_MemPrefetchPages(_In_ DWORD dwPID, _In_reads_(cPrefetchAddresses) PULONG64 pPrefetchAddresses, _In_ DWORD cPrefetchAddresses);
/*
* Write a contigious arbitrary amount of memory. Please note some virtual memory
* such as pages of executables (such as DLLs) may be shared between different
* virtual memory over different processes. As an example a write to kernel32.dll
* in one process is likely to affect kernel32 in the whole system - in all
* processes. Heaps and Stacks and other memory are usually safe to write to.
* Please take care when writing to memory!
* -- dwPID = PID of target process, (DWORD)-1 to read physical memory.
* -- qwA
* -- pb
* -- cb
* -- return = TRUE on success, FALSE on partial or zero write.
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_MemWrite(_In_ DWORD dwPID, _In_ ULONG64 qwA, _In_reads_(cb) PBYTE pb, _In_ DWORD cb);
/*
* Translate a virtual address to a physical address by walking the page tables
* of the specified process.
* -- dwPID
* -- qwVA
* -- pqwPA
* -- return = success/fail.
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_MemVirt2Phys(_In_ DWORD dwPID, _In_ ULONG64 qwVA, _Out_ PULONG64 pqwPA);
//-----------------------------------------------------------------------------
// VMM PROCESS MAP FUNCTIONALITY BELOW:
// Functionality for retrieving process related collections of items such as
// page table map (PTE), virtual address descriptor map (VAD), loaded modules,
// heaps and threads.
//-----------------------------------------------------------------------------
#define VMMDLL_MAP_PTE_VERSION 2
#define VMMDLL_MAP_VAD_VERSION 6
#define VMMDLL_MAP_VADEX_VERSION 3
#define VMMDLL_MAP_MODULE_VERSION 5
#define VMMDLL_MAP_UNLOADEDMODULE_VERSION 2
#define VMMDLL_MAP_EAT_VERSION 2
#define VMMDLL_MAP_IAT_VERSION 2
#define VMMDLL_MAP_HEAP_VERSION 2
#define VMMDLL_MAP_THREAD_VERSION 3
#define VMMDLL_MAP_HANDLE_VERSION 2
#define VMMDLL_MAP_NET_VERSION 3
#define VMMDLL_MAP_PHYSMEM_VERSION 2
#define VMMDLL_MAP_USER_VERSION 2
#define VMMDLL_MAP_SERVICE_VERSION 3
// flags to check for existence in the fPage field of VMMDLL_MAP_PTEENTRY
#define VMMDLL_MEMMAP_FLAG_PAGE_W 0x0000000000000002
#define VMMDLL_MEMMAP_FLAG_PAGE_NS 0x0000000000000004
#define VMMDLL_MEMMAP_FLAG_PAGE_NX 0x8000000000000000
#define VMMDLL_MEMMAP_FLAG_PAGE_MASK 0x8000000000000006
typedef enum tdVMMDLL_PTE_TP {
VMMDLL_PTE_TP_NA = 0,
VMMDLL_PTE_TP_HARDWARE = 1,
VMMDLL_PTE_TP_TRANSITION = 2,
VMMDLL_PTE_TP_PROTOTYPE = 3,
VMMDLL_PTE_TP_DEMANDZERO = 4,
VMMDLL_PTE_TP_COMPRESSED = 5,
VMMDLL_PTE_TP_PAGEFILE = 6,
} VMMDLL_PTE_TP, *PVMMDLL_PTE_TP;
typedef struct tdVMMDLL_MAP_PTEENTRY {
QWORD vaBase;
QWORD cPages;
QWORD fPage;
BOOL fWoW64;
DWORD _FutureUse1;
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
DWORD _Reserved1;
DWORD cSoftware; // # software (non active) PTEs in region
} VMMDLL_MAP_PTEENTRY, *PVMMDLL_MAP_PTEENTRY;
typedef struct tdVMMDLL_MAP_VADENTRY {
QWORD vaStart;
QWORD vaEnd;
QWORD vaVad;
// DWORD 0
DWORD VadType : 3; // Pos 0
DWORD Protection : 5; // Pos 3
DWORD fImage : 1; // Pos 8
DWORD fFile : 1; // Pos 9
DWORD fPageFile : 1; // Pos 10
DWORD fPrivateMemory : 1; // Pos 11
DWORD fTeb : 1; // Pos 12
DWORD fStack : 1; // Pos 13
DWORD fSpare : 2; // Pos 14
DWORD HeapNum : 7; // Pos 16
DWORD fHeap : 1; // Pos 23
DWORD cwszDescription : 8; // Pos 24
// DWORD 1
DWORD CommitCharge : 31; // Pos 0
DWORD MemCommit : 1; // Pos 31
DWORD u2;
DWORD cbPrototypePte;
QWORD vaPrototypePte;
QWORD vaSubsection;
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
DWORD _FutureUse1;
DWORD _Reserved1;
QWORD vaFileObject; // only valid if fFile/fImage _and_ after wszText is initialized
DWORD cVadExPages; // number of "valid" VadEx pages in this VAD.
DWORD cVadExPagesBase; // number of "valid" VadEx pages in "previous" VADs
QWORD _Reserved2;
} VMMDLL_MAP_VADENTRY, *PVMMDLL_MAP_VADENTRY;
typedef struct tdVMMDLL_MAP_VADEXENTRY {
VMMDLL_PTE_TP tp;
DWORD iPML;
QWORD va;
QWORD pa;
QWORD pte;
struct {
DWORD _Reserved1;
VMMDLL_PTE_TP tp;
QWORD pa;
QWORD pte;
} proto;
QWORD vaVadBase;
} VMMDLL_MAP_VADEXENTRY, *PVMMDLL_MAP_VADEXENTRY;
typedef enum tdVMMDLL_MODULE_TP {
VMMDLL_MODULE_TP_NORMAL = 0,
VMMDLL_MODULE_TP_DATA = 1,
VMMDLL_MODULE_TP_NOTLINKED = 2,
VMMDLL_MODULE_TP_INJECTED = 3,
} VMMDLL_MODULE_TP;
typedef struct tdVMMDLL_MAP_MODULEENTRY {
QWORD vaBase;
QWORD vaEntry;
DWORD cbImageSize;
BOOL fWoW64;
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
DWORD _Reserved3;
DWORD _Reserved4;
union { LPSTR uszFullName; LPWSTR wszFullName; }; // U/W dependant
VMMDLL_MODULE_TP tp;
DWORD cbFileSizeRaw;
DWORD cSection;
DWORD cEAT;
DWORD cIAT;
DWORD _Reserved2;
QWORD _Reserved1[2];
} VMMDLL_MAP_MODULEENTRY, *PVMMDLL_MAP_MODULEENTRY;
typedef struct tdVMMDLL_MAP_UNLOADEDMODULEENTRY {
QWORD vaBase;
DWORD cbImageSize;
BOOL fWoW64;
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
DWORD _FutureUse1;
DWORD dwCheckSum; // user-mode only
DWORD dwTimeDateStamp; // user-mode only
DWORD _Reserved1;
QWORD ftUnload; // kernel-mode only
} VMMDLL_MAP_UNLOADEDMODULEENTRY, *PVMMDLL_MAP_UNLOADEDMODULEENTRY;
typedef struct tdVMMDLL_MAP_EATENTRY {
QWORD vaFunction;
DWORD dwOrdinal;
DWORD oFunctionsArray; // PIMAGE_EXPORT_DIRECTORY->AddressOfFunctions[oFunctionsArray]
DWORD oNamesArray; // PIMAGE_EXPORT_DIRECTORY->AddressOfNames[oNamesArray]
DWORD _FutureUse1;
union { LPSTR uszFunction; LPWSTR wszFunction; }; // U/W dependant
} VMMDLL_MAP_EATENTRY, *PVMMDLL_MAP_EATENTRY;
typedef struct tdVMMDLL_MAP_IATENTRY {
QWORD vaFunction;
union { LPSTR uszFunction; LPWSTR wszFunction; }; // U/W dependant
DWORD _FutureUse1;
DWORD _FutureUse2;
union { LPSTR uszModule; LPWSTR wszModule; }; // U/W dependant
struct {
BOOL f32;
WORD wHint;
WORD _Reserved1;
DWORD rvaFirstThunk;
DWORD rvaOriginalFirstThunk;
DWORD rvaNameModule;
DWORD rvaNameFunction;
} Thunk;
} VMMDLL_MAP_IATENTRY, *PVMMDLL_MAP_IATENTRY;
typedef struct tdVMMDLL_MAP_HEAPENTRY {
QWORD vaHeapSegment;
DWORD cPages;
DWORD cPagesUnCommitted : 24;
DWORD HeapId : 7;
DWORD fPrimary : 1;
} VMMDLL_MAP_HEAPENTRY, *PVMMDLL_MAP_HEAPENTRY;
typedef struct tdVMMDLL_MAP_THREADENTRY {
DWORD dwTID;
DWORD dwPID;
DWORD dwExitStatus;
UCHAR bState;
UCHAR bRunning;
UCHAR bPriority;
UCHAR bBasePriority;
QWORD vaETHREAD;
QWORD vaTeb;
QWORD ftCreateTime;
QWORD ftExitTime;
QWORD vaStartAddress;
QWORD vaStackBaseUser; // value from _NT_TIB / _TEB
QWORD vaStackLimitUser; // value from _NT_TIB / _TEB
QWORD vaStackBaseKernel;
QWORD vaStackLimitKernel;
QWORD vaTrapFrame;
QWORD vaRIP; // RIP register (if user mode)
QWORD vaRSP; // RSP register (if user mode)
QWORD qwAffinity;
DWORD dwUserTime;
DWORD dwKernelTime;
UCHAR bSuspendCount;
UCHAR _FutureUse1[3];
DWORD _FutureUse2[15];
} VMMDLL_MAP_THREADENTRY, *PVMMDLL_MAP_THREADENTRY;
typedef struct tdVMMDLL_MAP_HANDLEENTRY {
QWORD vaObject;
DWORD dwHandle;
DWORD dwGrantedAccess : 24;
DWORD iType : 8;
QWORD qwHandleCount;
QWORD qwPointerCount;
QWORD vaObjectCreateInfo;
QWORD vaSecurityDescriptor;
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
DWORD _FutureUse2;
DWORD dwPID;
DWORD dwPoolTag;
DWORD _FutureUse[5];
union { LPSTR uszType; LPWSTR wszType; }; // U/W dependant
} VMMDLL_MAP_HANDLEENTRY, *PVMMDLL_MAP_HANDLEENTRY;
typedef struct tdVMMDLL_MAP_NETENTRY {
DWORD dwPID;
DWORD dwState;
WORD _FutureUse3[3];
WORD AF; // address family (IPv4/IPv6)
struct {
BOOL fValid;
WORD _Reserved;
WORD port;
BYTE pbAddr[16]; // ipv4 = 1st 4 bytes, ipv6 = all bytes
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
} Src;
struct {
BOOL fValid;
WORD _Reserved;
WORD port;
BYTE pbAddr[16]; // ipv4 = 1st 4 bytes, ipv6 = all bytes
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
} Dst;
QWORD vaObj;
QWORD ftTime;
DWORD dwPoolTag;
DWORD _FutureUse4;
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
DWORD _FutureUse2[4];
} VMMDLL_MAP_NETENTRY, *PVMMDLL_MAP_NETENTRY;
typedef struct tdVMMDLL_MAP_PHYSMEMENTRY {
QWORD pa;
QWORD cb;
} VMMDLL_MAP_PHYSMEMENTRY, *PVMMDLL_MAP_PHYSMEMENTRY;
typedef struct tdVMMDLL_MAP_USERENTRY {
DWORD _FutureUse1[2];
union { LPSTR uszText; LPWSTR wszText; }; // U/W dependant
ULONG64 vaRegHive;
union { LPSTR uszSID; LPWSTR wszSID; }; // U/W dependant
DWORD _FutureUse2[2];
} VMMDLL_MAP_USERENTRY, *PVMMDLL_MAP_USERENTRY;
typedef struct tdVMMDLL_MAP_SERVICEENTRY {
QWORD vaObj;
DWORD dwOrdinal;
DWORD dwStartType;
SERVICE_STATUS ServiceStatus;
union { LPSTR uszServiceName; LPWSTR wszServiceName; };// U/W dependant
union { LPSTR uszDisplayName; LPWSTR wszDisplayName; };// U/W dependant
union { LPSTR uszPath; LPWSTR wszPath; }; // U/W dependant
union { LPSTR uszUserTp; LPWSTR wszUserTp; }; // U/W dependant
union { LPSTR uszUserAcct; LPWSTR wszUserAcct; }; // U/W dependant
union { LPSTR uszImagePath; LPWSTR wszImagePath; }; // U/W dependant
DWORD dwPID;
DWORD _FutureUse1;
QWORD _FutureUse2;
} VMMDLL_MAP_SERVICEENTRY, *PVMMDLL_MAP_SERVICEENTRY;
typedef struct tdVMMDLL_MAP_PTE {
DWORD dwVersion;
DWORD _Reserved1[5];
PBYTE pbMultiText; // NULL or multi-wstr pointed into by VMMDLL_MAP_VADENTRY.wszText
DWORD cbMultiText;
DWORD cMap; // # map entries.
VMMDLL_MAP_PTEENTRY pMap[]; // map entries.
} VMMDLL_MAP_PTE, *PVMMDLL_MAP_PTE;
typedef struct tdVMMDLL_MAP_VAD {
DWORD dwVersion;
DWORD _Reserved1[4];
DWORD cPage; // # pages in vad map.
PBYTE pbMultiText; // NULL or multi-wstr pointed into by VMMDLL_MAP_VADENTRY.wszText
DWORD cbMultiText;
DWORD cMap; // # map entries.
VMMDLL_MAP_VADENTRY pMap[]; // map entries.
} VMMDLL_MAP_VAD, *PVMMDLL_MAP_VAD;
typedef struct tdVMMDLL_MAP_VADEX {
DWORD dwVersion;
DWORD _Reserved1[4];
DWORD cMap; // # map entries.
VMMDLL_MAP_VADEXENTRY pMap[]; // map entries.
} VMMDLL_MAP_VADEX, *PVMMDLL_MAP_VADEX;
typedef struct tdVMMDLL_MAP_MODULE {
DWORD dwVersion;
DWORD _Reserved1[5];
PBYTE pbMultiText; // multi-wstr pointed into by VMMDLL_MAP_MODULEENTRY.wszText
DWORD cbMultiText;
DWORD cMap; // # map entries.
VMMDLL_MAP_MODULEENTRY pMap[]; // map entries.
} VMMDLL_MAP_MODULE, *PVMMDLL_MAP_MODULE;
typedef struct tdVMMDLL_MAP_UNLOADEDMODULE {
DWORD dwVersion;
DWORD _Reserved1[5];
PBYTE pbMultiText; // multi-wstr pointed into by VMMDLL_MAP_MODULEENTRY.wszText
DWORD cbMultiText;
DWORD cMap; // # map entries.
VMMDLL_MAP_UNLOADEDMODULEENTRY pMap[]; // map entries.
} VMMDLL_MAP_UNLOADEDMODULE, *PVMMDLL_MAP_UNLOADEDMODULE;
typedef struct tdVMMDLL_MAP_EAT {
DWORD dwVersion;
DWORD dwOrdinalBase;
DWORD cNumberOfNames;
DWORD cNumberOfFunctions;
DWORD _Reserved1[4];
QWORD vaModuleBase;
QWORD vaAddressOfFunctions;
QWORD vaAddressOfNames;
PBYTE pbMultiText; // multi-str pointed into by VMM_MAP_EATENTRY.wszFunction
DWORD cbMultiText;
DWORD cMap; // # map entries.
VMMDLL_MAP_EATENTRY pMap[]; // map entries.
} VMMDLL_MAP_EAT, *PVMMDLL_MAP_EAT;
typedef struct tdVMMDLL_MAP_IAT {
DWORD dwVersion;
DWORD _Reserved1[5];
QWORD vaModuleBase;
PBYTE pbMultiText; // multi-str pointed into by VMM_MAP_EATENTRY.[wszFunction|wszModule]
DWORD cbMultiText;
DWORD cMap; // # map entries.
VMMDLL_MAP_IATENTRY pMap[]; // map entries.
} VMMDLL_MAP_IAT, *PVMMDLL_MAP_IAT;
typedef struct tdVMMDLL_MAP_HEAP {
DWORD dwVersion;
DWORD _Reserved1[8];
DWORD cMap; // # map entries.