-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implement dump for ApiSetSchema v2/v4/v6.
- Loading branch information
Showing
15 changed files
with
3,042 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
.vs/ | ||
obj/ | ||
bin/ | ||
_ReSharper.Caches/ | ||
*.user |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
# ApiSetSchema v2/v4/v6 dumper | ||
|
||
|ApiSetSchema version|OS| | ||
|:-:|:-| | ||
|[v2](data/v2.txt)|Windows 8, Windows Server 2012| | ||
|[v4](data/v4.txt)|Windows 8.1, Windows Server 2012 R2| | ||
|[v6](data/v6.txt)|Windows 10, Windows Server 2016| |
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Large diffs are not rendered by default.
Oops, something went wrong.
Binary file not shown.
Large diffs are not rendered by default.
Oops, something went wrong.
Binary file not shown.
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,156 @@ | ||
/* | ||
MIT License | ||
Copyright (c) 2019 Mikhail Pilin | ||
Permission is hereby granted, free of charge, to any person obtaining a copy | ||
of this software and associated documentation files (the "Software"), to deal | ||
in the Software without restriction, including without limitation the rights | ||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | ||
copies of the Software, and to permit persons to whom the Software is | ||
furnished to do so, subject to the following conditions: | ||
The above copyright notice and this permission notice shall be included in all | ||
copies or substantial portions of the Software. | ||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | ||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | ||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | ||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | ||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | ||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | ||
SOFTWARE. | ||
*/ | ||
|
||
#pragma once | ||
|
||
#include <minwindef.h> | ||
|
||
// References: | ||
// https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-i.html | ||
// https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-ii.html | ||
// https://www.geoffchappell.com/studies/windows/win32/apisetschema/index.htm | ||
|
||
#define API_SET_FLAG_SEALED 0x01 | ||
#define API_SET_FLAG_EXT 0x02 | ||
|
||
/////////////////////////////////////////////////////////////////////////////// | ||
// ApiSet v2 | ||
|
||
struct API_SET_VALUE_ENTRY_REDIRECTION_V2 | ||
{ | ||
ULONG NameOffset; | ||
USHORT NameLength; | ||
ULONG ValueOffset; | ||
USHORT ValueLength; | ||
}; | ||
|
||
struct API_SET_VALUE_ENTRY_V2 | ||
{ | ||
ULONG NumberOfRedirections; | ||
API_SET_VALUE_ENTRY_REDIRECTION_V2 Redirections[ANYSIZE_ARRAY]; | ||
}; | ||
|
||
struct API_SET_NAMESPACE_ENTRY_V2 | ||
{ | ||
ULONG NameOffset; | ||
ULONG NameLength; | ||
ULONG DataOffset; // API_SET_VALUE_ENTRY_V2 offset | ||
}; | ||
|
||
struct API_SET_NAMESPACE_V2 | ||
{ | ||
ULONG Version; | ||
ULONG Count; | ||
API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY]; | ||
}; | ||
|
||
/////////////////////////////////////////////////////////////////////////////// | ||
// ApiSet v4 | ||
|
||
struct API_SET_VALUE_ENTRY_REDIRECTION_V4 | ||
{ | ||
ULONG Flags; | ||
ULONG NameOffset; | ||
ULONG NameLength; | ||
ULONG ValueOffset; | ||
ULONG ValueLength; | ||
}; | ||
|
||
struct API_SET_VALUE_ENTRY_V4 | ||
{ | ||
ULONG Flags; | ||
ULONG NumberOfRedirections; | ||
API_SET_VALUE_ENTRY_REDIRECTION_V4 Redirections[ANYSIZE_ARRAY]; | ||
}; | ||
|
||
struct API_SET_NAMESPACE_ENTRY_V4 | ||
{ | ||
ULONG Flags; | ||
ULONG NameOffset; | ||
ULONG NameLength; | ||
ULONG AliasOffset; | ||
ULONG AliasLength; | ||
ULONG DataOffset; // API_SET_VALUE_ENTRY_V4 offset | ||
}; | ||
|
||
struct API_SET_NAMESPACE_V4 | ||
{ | ||
ULONG Version; | ||
ULONG Size; | ||
ULONG Flags; | ||
ULONG Count; | ||
API_SET_NAMESPACE_ENTRY_V4 Array[ANYSIZE_ARRAY]; | ||
}; | ||
|
||
/////////////////////////////////////////////////////////////////////////////// | ||
// ApiSet v6 | ||
|
||
struct API_SET_HASH_ENTRY_V6 | ||
{ | ||
ULONG Hash; | ||
ULONG Index; | ||
}; | ||
|
||
struct API_SET_VALUE_ENTRY_V6 | ||
{ | ||
ULONG Flags; | ||
ULONG NameOffset; | ||
ULONG NameLength; | ||
ULONG ValueOffset; | ||
ULONG ValueLength; | ||
}; | ||
|
||
struct API_SET_NAMESPACE_ENTRY_V6 | ||
{ | ||
ULONG Flags; | ||
ULONG NameOffset; | ||
ULONG NameLength; | ||
ULONG HashedLength; | ||
ULONG ValueOffset; // API_SET_VALUE_ENTRY_V6 offset | ||
ULONG ValueCount; | ||
}; | ||
|
||
struct API_SET_NAMESPACE_V6 | ||
{ | ||
ULONG Version; // Should be 6 | ||
ULONG Size; | ||
ULONG Flags; | ||
ULONG Count; | ||
ULONG EntryOffset; // API_SET_NAMESPACE_ENTRY_V6 offset | ||
ULONG HashOffset; // API_SET_HASH_ENTRY_V6 offset | ||
ULONG HashFactor; | ||
}; | ||
|
||
/////////////////////////////////////////////////////////////////////////////// | ||
|
||
struct API_SET_NAMESPACE | ||
{ | ||
union | ||
{ | ||
ULONG Version; | ||
API_SET_NAMESPACE_V2 V2; | ||
API_SET_NAMESPACE_V4 V4; | ||
API_SET_NAMESPACE_V6 V6; | ||
}; | ||
}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,31 @@ | ||
|
||
Microsoft Visual Studio Solution File, Format Version 12.00 | ||
# Visual Studio 15 | ||
VisualStudioVersion = 15.0.27428.2043 | ||
MinimumVisualStudioVersion = 10.0.40219.1 | ||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "test", "test\test.vcxproj", "{CDD07939-D363-46F0-938C-89F6B88DA0B1}" | ||
EndProject | ||
Global | ||
GlobalSection(SolutionConfigurationPlatforms) = preSolution | ||
Debug|x64 = Debug|x64 | ||
Debug|x86 = Debug|x86 | ||
Release|x64 = Release|x64 | ||
Release|x86 = Release|x86 | ||
EndGlobalSection | ||
GlobalSection(ProjectConfigurationPlatforms) = postSolution | ||
{CDD07939-D363-46F0-938C-89F6B88DA0B1}.Debug|x64.ActiveCfg = Debug|x64 | ||
{CDD07939-D363-46F0-938C-89F6B88DA0B1}.Debug|x64.Build.0 = Debug|x64 | ||
{CDD07939-D363-46F0-938C-89F6B88DA0B1}.Debug|x86.ActiveCfg = Debug|Win32 | ||
{CDD07939-D363-46F0-938C-89F6B88DA0B1}.Debug|x86.Build.0 = Debug|Win32 | ||
{CDD07939-D363-46F0-938C-89F6B88DA0B1}.Release|x64.ActiveCfg = Release|x64 | ||
{CDD07939-D363-46F0-938C-89F6B88DA0B1}.Release|x64.Build.0 = Release|x64 | ||
{CDD07939-D363-46F0-938C-89F6B88DA0B1}.Release|x86.ActiveCfg = Release|Win32 | ||
{CDD07939-D363-46F0-938C-89F6B88DA0B1}.Release|x86.Build.0 = Release|Win32 | ||
EndGlobalSection | ||
GlobalSection(SolutionProperties) = preSolution | ||
HideSolutionNode = FALSE | ||
EndGlobalSection | ||
GlobalSection(ExtensibilityGlobals) = postSolution | ||
SolutionGuid = {E2140CCD-70E6-4E26-9863-BCED378778A0} | ||
EndGlobalSection | ||
EndGlobal |
Oops, something went wrong.