[Kernel] nonintrusive guest to host object mapping
This commit is contained in:
committed by
Radosław Gliński
parent
d36b1b3830
commit
ee424ae14a
@@ -312,12 +312,62 @@ struct X_EX_TITLE_TERMINATE_REGISTRATION {
|
||||
};
|
||||
static_assert_size(X_EX_TITLE_TERMINATE_REGISTRATION, 16);
|
||||
|
||||
|
||||
enum X_OBJECT_HEADER_FLAGS : uint16_t {
|
||||
OBJECT_HEADER_FLAG_NAMED_OBJECT =
|
||||
1, // if set, has X_OBJECT_HEADER_NAME_INFO prior to X_OBJECT_HEADER
|
||||
OBJECT_HEADER_FLAG_IS_PERMANENT = 2,
|
||||
OBJECT_HEADER_FLAG_CONTAINED_IN_DIRECTORY =
|
||||
4, // this object resides in an X_OBJECT_DIRECTORY
|
||||
OBJECT_HEADER_IS_TITLE_OBJECT = 0x10, // used in obcreateobject
|
||||
|
||||
};
|
||||
|
||||
// https://www.nirsoft.net/kernel_struct/vista/OBJECT_HEADER.html
|
||||
struct X_OBJECT_HEADER {
|
||||
xe::be<uint32_t> pointer_count;
|
||||
xe::be<uint32_t> handle_count;
|
||||
xe::be<uint32_t> object_type_ptr; // -0x8 POBJECT_TYPE
|
||||
xe::be<uint16_t> flags;
|
||||
uint8_t unknownE;
|
||||
uint8_t unknownF;
|
||||
// Object lives after this header.
|
||||
// (There's actually a body field here which is the object itself)
|
||||
};
|
||||
static_assert_size(X_OBJECT_HEADER, 0x10);
|
||||
|
||||
struct X_OBJECT_DIRECTORY {
|
||||
// each is a pointer to X_OBJECT_HEADER_NAME_INFO
|
||||
// i believe offset 0 = pointer to next in bucket
|
||||
xe::be<uint32_t> name_buckets[13];
|
||||
};
|
||||
static_assert_size(X_OBJECT_DIRECTORY, 0x34);
|
||||
|
||||
// https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/ob/object_header_name_info.htm
|
||||
// quite different, though
|
||||
struct X_OBJECT_HEADER_NAME_INFO {
|
||||
// i think that this is the next link in an X_OBJECT_DIRECTORY's buckets
|
||||
xe::be<uint32_t> next_in_directory;
|
||||
xe::be<uint32_t> object_directory; // pointer to X_OBJECT_DIRECTORY
|
||||
X_ANSI_STRING name;
|
||||
};
|
||||
struct X_OBJECT_ATTRIBUTES {
|
||||
xe::be<uint32_t> root_directory; // 0x0
|
||||
xe::be<uint32_t> name_ptr; // 0x4 PANSI_STRING
|
||||
xe::be<uint32_t> attributes; // 0xC
|
||||
};
|
||||
|
||||
struct X_OBJECT_TYPE {
|
||||
xe::be<uint32_t> allocate_proc; // 0x0
|
||||
xe::be<uint32_t> free_proc; // 0x4
|
||||
xe::be<uint32_t> close_proc; // 0x8
|
||||
xe::be<uint32_t> delete_proc; // 0xC
|
||||
xe::be<uint32_t> unknown_proc; // 0x10
|
||||
xe::be<uint32_t>
|
||||
unknown_size_or_object_; // this seems to be a union, it can be a pointer
|
||||
// or it can be the size of the object
|
||||
xe::be<uint32_t> pool_tag; // 0x18
|
||||
};
|
||||
static_assert_size(X_OBJECT_TYPE, 0x1C);
|
||||
// https://msdn.microsoft.com/en-us/library/windows/desktop/aa363082.aspx
|
||||
typedef struct {
|
||||
// Renamed due to a collision with exception_code from Windows excpt.h.
|
||||
|
||||
Reference in New Issue
Block a user