170 lines
4.8 KiB
C
170 lines
4.8 KiB
C
|
/*++
|
|||
|
|
|
|||
|
|
Copyright (c) 1995 Microsoft Corporation
|
|||
|
|
|
|||
|
|
Module Name:
|
|||
|
|
|
|||
|
|
apimon.h
|
|||
|
|
|
|||
|
|
Abstract:
|
|||
|
|
|
|||
|
|
Common types & structures for the APIMON projects.
|
|||
|
|
|
|||
|
|
Author:
|
|||
|
|
|
|||
|
|
Wesley Witt (wesw) 28-June-1995
|
|||
|
|
|
|||
|
|
Environment:
|
|||
|
|
|
|||
|
|
User Mode
|
|||
|
|
|
|||
|
|
--*/
|
|||
|
|
|
|||
|
|
#ifndef _APIMON_
|
|||
|
|
#define _APIMON_
|
|||
|
|
|
|||
|
|
#ifdef __cplusplus
|
|||
|
|
#define CLINKAGE extern "C"
|
|||
|
|
#else
|
|||
|
|
#define CLINKAGE
|
|||
|
|
#endif
|
|||
|
|
|
|||
|
|
#define TROJANDLL "apidll.dll"
|
|||
|
|
#define MAX_NAME_SZ 32
|
|||
|
|
#define MAX_DLLS 512
|
|||
|
|
#define MEGABYTE (1024*1024)
|
|||
|
|
#define MAX_MEM_ALLOC (MEGABYTE*32)
|
|||
|
|
#define MAX_APIS ((MAX_MEM_ALLOC/2)/sizeof(API_INFO))
|
|||
|
|
#define THUNK_SIZE MEGABYTE
|
|||
|
|
#define Align(p,x) (((x) & ((p)-1)) ? (((x) & ~((p)-1)) + p) : (x))
|
|||
|
|
|
|||
|
|
#define KERNEL32 "kernel32.dll"
|
|||
|
|
#define NTDLL "ntdll.dll"
|
|||
|
|
#define USER32 "user32.dll"
|
|||
|
|
#define WNDPROCDLL "wndprocs"
|
|||
|
|
#define LOADLIBRARYA "LoadLibraryA"
|
|||
|
|
#define LOADLIBRARYW "LoadLibraryW"
|
|||
|
|
#define FREELIBRARY "FreeLibrary"
|
|||
|
|
#define GETPROCADDRESS "GetProcAddress"
|
|||
|
|
#define REGISTERCLASSA "RegisterClassA"
|
|||
|
|
#define REGISTERCLASSW "RegisterClassW"
|
|||
|
|
#define SETWINDOWLONGA "SetWindowLongA"
|
|||
|
|
#define SETWINDOWLONGW "SetWindowLongW"
|
|||
|
|
#define ALLOCATEHEAP "RtlAllocateHeap"
|
|||
|
|
#define CREATEHEAP "RtlCreateHeap"
|
|||
|
|
|
|||
|
|
#if defined(_ALPHA_)
|
|||
|
|
|
|||
|
|
#define UPPER_ADDR(_addr) LOWORD(((LONG_PTR)(_addr) >> 32) + (HIGH_ADDR((_addr)) >> 15))
|
|||
|
|
#define HIGH_ADDR(_addr) LOWORD(HIWORD((_addr)) + (LOWORD((_addr)) >> 15))
|
|||
|
|
#define LOW_ADDR(_addr) LOWORD((_addr))
|
|||
|
|
|
|||
|
|
#endif
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// api table type definitions
|
|||
|
|
//
|
|||
|
|
#define DFLT_TRACE_ARGS 8
|
|||
|
|
#define MAX_TRACE_ARGS 8
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// Handle type, index corresponds to the entries in the alias array
|
|||
|
|
//
|
|||
|
|
|
|||
|
|
enum Handles { T_HACCEL, T_HANDLE, T_HBITMAP, T_HBRUSH, T_HCURSOR, T_HDC,
|
|||
|
|
T_HDCLPPOINT, T_HDESK, T_HDWP, T_HENHMETAFILE, T_HFONT, T_HGDIOBJ,
|
|||
|
|
T_HGLOBAL, T_HGLRC, T_HHOOK, T_HICON, T_HINSTANCE, T_HKL, T_HMENU,
|
|||
|
|
T_HMETAFILE, T_HPALETTE, T_HPEN, T_HRGN, T_HWINSTA, T_HWND};
|
|||
|
|
|
|||
|
|
#define T_DWORD 101
|
|||
|
|
#define T_LPSTR 102
|
|||
|
|
#define T_LPWSTR 103
|
|||
|
|
#define T_UNISTR 104 // UNICODE string (counted)
|
|||
|
|
#define T_OBJNAME 105 // Name from OBJECT_ATTRIBUTES struct
|
|||
|
|
#define T_LPSTRC 106 // Counted string (count is following arg)
|
|||
|
|
#define T_LPWSTRC 107 // Counted UNICODE string (count is following arg)
|
|||
|
|
#define T_DWORDPTR 108 // Indirect DWORD
|
|||
|
|
#define T_DLONGPTR 109 // Indirect DWORDLONG
|
|||
|
|
|
|||
|
|
// User macro for creating T_DWPTR type with offset encoded in high word
|
|||
|
|
#define T_PDWORD(off) (((off)<<16) + T_DWORDPTR)
|
|||
|
|
#define T_PDLONG(off) (((off)<<16) + T_DLONGPTR)
|
|||
|
|
#define T_PSTR(off) (((off)<<16) + T_LPSTR)
|
|||
|
|
#define T_PWSTR(off) (((off)<<16) + T_LPWSTR)
|
|||
|
|
|
|||
|
|
//
|
|||
|
|
// api trace modes
|
|||
|
|
#define API_TRACE 1 // Trace this api
|
|||
|
|
#define API_FULLTRACE 2 // Trace this api and its callees
|
|||
|
|
|
|||
|
|
typedef struct _API_TABLE {
|
|||
|
|
LPSTR Name;
|
|||
|
|
ULONG RetType;
|
|||
|
|
ULONG ArgCount;
|
|||
|
|
ULONG ArgType[MAX_TRACE_ARGS];
|
|||
|
|
} API_TABLE, *PAPI_TABLE;
|
|||
|
|
|
|||
|
|
typedef struct _API_MASTER_TABLE {
|
|||
|
|
LPSTR Name;
|
|||
|
|
BOOL Processed;
|
|||
|
|
PAPI_TABLE ApiTable;
|
|||
|
|
} API_MASTER_TABLE, *PAPI_MASTER_TABLE;
|
|||
|
|
|
|||
|
|
typedef struct _API_INFO {
|
|||
|
|
ULONG Name;
|
|||
|
|
ULONG_PTR Address;
|
|||
|
|
ULONG_PTR ThunkAddress;
|
|||
|
|
ULONG Count;
|
|||
|
|
DWORDLONG Time;
|
|||
|
|
DWORDLONG CalleeTime;
|
|||
|
|
ULONG NestCount;
|
|||
|
|
ULONG TraceEnabled;
|
|||
|
|
PAPI_TABLE ApiTable;
|
|||
|
|
ULONG_PTR HardFault;
|
|||
|
|
ULONG_PTR SoftFault;
|
|||
|
|
ULONG_PTR CodeFault;
|
|||
|
|
ULONG_PTR DataFault;
|
|||
|
|
ULONG Size;
|
|||
|
|
ULONG ApiTableIndex;
|
|||
|
|
ULONG_PTR DllOffset;
|
|||
|
|
} API_INFO, *PAPI_INFO;
|
|||
|
|
|
|||
|
|
typedef struct _DLL_INFO {
|
|||
|
|
CHAR Name[MAX_NAME_SZ];
|
|||
|
|
ULONG_PTR BaseAddress;
|
|||
|
|
ULONG Size;
|
|||
|
|
ULONG ApiCount;
|
|||
|
|
ULONG ApiOffset;
|
|||
|
|
ULONG Unloaded;
|
|||
|
|
ULONG Enabled;
|
|||
|
|
ULONG OrigEnable;
|
|||
|
|
ULONG Snapped;
|
|||
|
|
ULONG InList;
|
|||
|
|
ULONG StaticProfile;
|
|||
|
|
ULONG Hits;
|
|||
|
|
ULONG LoadCount;
|
|||
|
|
} DLL_INFO, *PDLL_INFO;
|
|||
|
|
|
|||
|
|
typedef struct _TRACE_ENTRY {
|
|||
|
|
ULONG SizeOfStruct;
|
|||
|
|
ULONG_PTR Address;
|
|||
|
|
ULONG_PTR ReturnValue;
|
|||
|
|
ULONG LastError;
|
|||
|
|
ULONG_PTR Caller;
|
|||
|
|
ULONG ApiTableIndex;
|
|||
|
|
DWORDLONG EnterTime;
|
|||
|
|
DWORDLONG Duration;
|
|||
|
|
ULONG ThreadNum;
|
|||
|
|
ULONG Level;
|
|||
|
|
ULONG_PTR Args[MAX_TRACE_ARGS];
|
|||
|
|
} TRACE_ENTRY, *PTRACE_ENTRY;
|
|||
|
|
|
|||
|
|
typedef struct _TRACE_BUFFER {
|
|||
|
|
ULONG Size;
|
|||
|
|
ULONG Offset;
|
|||
|
|
ULONG Count;
|
|||
|
|
TRACE_ENTRY Entry[1];
|
|||
|
|
} TRACE_BUFFER, *PTRACE_BUFFER;
|
|||
|
|
|
|||
|
|
#endif
|
|||
|
|
|