[Kernel] nonintrusive guest to host object mapping

This commit is contained in:
disjtqz
2023-10-13 15:04:01 -04:00
committed by Radosław Gliński
parent d36b1b3830
commit ee424ae14a
7 changed files with 106 additions and 63 deletions

View File

@@ -312,12 +312,62 @@ struct X_EX_TITLE_TERMINATE_REGISTRATION {
};
static_assert_size(X_EX_TITLE_TERMINATE_REGISTRATION, 16);
enum X_OBJECT_HEADER_FLAGS : uint16_t {
OBJECT_HEADER_FLAG_NAMED_OBJECT =
1, // if set, has X_OBJECT_HEADER_NAME_INFO prior to X_OBJECT_HEADER
OBJECT_HEADER_FLAG_IS_PERMANENT = 2,
OBJECT_HEADER_FLAG_CONTAINED_IN_DIRECTORY =
4, // this object resides in an X_OBJECT_DIRECTORY
OBJECT_HEADER_IS_TITLE_OBJECT = 0x10, // used in obcreateobject
};
// https://www.nirsoft.net/kernel_struct/vista/OBJECT_HEADER.html
struct X_OBJECT_HEADER {
xe::be<uint32_t> pointer_count;
xe::be<uint32_t> handle_count;
xe::be<uint32_t> object_type_ptr; // -0x8 POBJECT_TYPE
xe::be<uint16_t> flags;
uint8_t unknownE;
uint8_t unknownF;
// Object lives after this header.
// (There's actually a body field here which is the object itself)
};
static_assert_size(X_OBJECT_HEADER, 0x10);
struct X_OBJECT_DIRECTORY {
// each is a pointer to X_OBJECT_HEADER_NAME_INFO
// i believe offset 0 = pointer to next in bucket
xe::be<uint32_t> name_buckets[13];
};
static_assert_size(X_OBJECT_DIRECTORY, 0x34);
// https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/ob/object_header_name_info.htm
// quite different, though
struct X_OBJECT_HEADER_NAME_INFO {
// i think that this is the next link in an X_OBJECT_DIRECTORY's buckets
xe::be<uint32_t> next_in_directory;
xe::be<uint32_t> object_directory; // pointer to X_OBJECT_DIRECTORY
X_ANSI_STRING name;
};
struct X_OBJECT_ATTRIBUTES {
xe::be<uint32_t> root_directory; // 0x0
xe::be<uint32_t> name_ptr; // 0x4 PANSI_STRING
xe::be<uint32_t> attributes; // 0xC
};
struct X_OBJECT_TYPE {
xe::be<uint32_t> allocate_proc; // 0x0
xe::be<uint32_t> free_proc; // 0x4
xe::be<uint32_t> close_proc; // 0x8
xe::be<uint32_t> delete_proc; // 0xC
xe::be<uint32_t> unknown_proc; // 0x10
xe::be<uint32_t>
unknown_size_or_object_; // this seems to be a union, it can be a pointer
// or it can be the size of the object
xe::be<uint32_t> pool_tag; // 0x18
};
static_assert_size(X_OBJECT_TYPE, 0x1C);
// https://msdn.microsoft.com/en-us/library/windows/desktop/aa363082.aspx
typedef struct {
// Renamed due to a collision with exception_code from Windows excpt.h.