diff options
| -rw-r--r-- | include/ntapi/ntapi.h | 11 | ||||
| -rw-r--r-- | src/internal/ntapi_hash_table.h | 66 | ||||
| -rw-r--r-- | src/refs/NTHASH | 8 |
3 files changed, 56 insertions, 29 deletions
diff --git a/include/ntapi/ntapi.h b/include/ntapi/ntapi.h index ec4fb31..ae47447 100644 --- a/include/ntapi/ntapi.h +++ b/include/ntapi/ntapi.h @@ -23,6 +23,7 @@ #include "nt_registry.h" #include "nt_security.h" #include "nt_pnp.h" +#include "nt_debug.h" #include "nt_exception.h" #include "nt_locale.h" #include "nt_uuid.h" @@ -317,6 +318,16 @@ typedef struct _ntapi_vtbl { ntapi_zw_plug_play_control * zw_plug_play_control; ntapi_zw_get_plug_play_event * zw_get_plug_play_event; + /* nt_debug.h */ + ntapi_zw_create_debug_object * zw_create_debug_object; + ntapi_zw_debug_active_process * zw_debug_active_process; + ntapi_zw_remove_process_debug * zw_remove_process_debug; + ntapi_zw_wait_for_debug_event * zw_wait_for_debug_event; + ntapi_zw_debug_continue * zw_debug_continue; + ntapi_zw_set_information_debug_object * zw_set_information_debug_object; + ntapi_zw_query_debug_filter_state * zw_query_debug_filter_state; + ntapi_zw_set_debug_filter_state * zw_set_debug_filter_state; + /* nt_exception */ ntapi_zw_raise_exception * zw_raise_exception; ntapi_zw_continue * zw_continue; diff --git a/src/internal/ntapi_hash_table.h b/src/internal/ntapi_hash_table.h index 49448d9..540b482 100644 --- a/src/internal/ntapi_hash_table.h +++ b/src/internal/ntapi_hash_table.h @@ -22,6 +22,7 @@ {0x06b550e3, (146)}, /* ZwWriteRequestData */ \ {0x0708114b, (50)}, /* ZwTestAlert */ \ {0x08087626, (34)}, /* ZwOpenSection */ \ + {0x0815d651, (230)}, /* ZwSetInformationDebugObject */ \ {0x08b1918f, (45)}, /* ZwSuspendThread */ \ {0x097e0efd, (154)}, /* ZwOpenFile */ \ {0x0a7a10d0, (88)}, /* ZwOpenTimer */ \ @@ -31,15 +32,16 @@ {0x0d638bd2, (74)}, /* ZwSetInformationJobObject */ \ {0x0e629eed, (102)}, /* ZwQuerySemaphore */ \ {0x11fcbb7c, (23)}, /* ZwReadVirtualMemory */ \ + {0x121f1e7e, (225)}, /* ZwCreateDebugObject */ \ {0x124a301e, (16)}, /* ZwSetSystemEnvironmentValue */ \ - {0x12ec66eb, (227)}, /* ZwQueryDefaultLocale */ \ + {0x12ec66eb, (235)}, /* ZwQueryDefaultLocale */ \ {0x1742c5c9, (162)}, /* ZwWriteFileGather */ \ {0x177157e3, (42)}, /* ZwTerminateThread */ \ {0x1af41c1a, (22)}, /* ZwProtectVirtualMemory */ \ - {0x1c0197e6, (233)}, /* ZwAllocateUuids */ \ + {0x1c0197e6, (241)}, /* ZwAllocateUuids */ \ {0x1c7a90a1, (5)}, /* ZwQuerySecurityObject */ \ {0x1cf668c5, (194)}, /* ZwQueryKey */ \ - {0x21b850be, (250)}, /* _snprintf */ \ + {0x21b850be, (258)}, /* _snprintf */ \ {0x2259fc62, (2)}, /* ZwDuplicateObject */ \ {0x24e09c64, (18)}, /* ZwSystemDebugControl */ \ {0x255bf138, (142)}, /* ZwReplyWaitReplyPort */ \ @@ -47,13 +49,13 @@ {0x25d91d90, (71)}, /* ZwTerminateJobObject */ \ {0x26e1170e, (193)}, /* ZwSetInformationKey */ \ {0x27dd46c3, (29)}, /* ZwFreeUserPhysicalPages */ \ - {0x2812eb3c, (232)}, /* ZwAllocateLocallyUniqueId */ \ + {0x2812eb3c, (240)}, /* ZwAllocateLocallyUniqueId */ \ {0x28574a3f, (77)}, /* ZwOpenThreadToken */ \ {0x29b5ea3d, (140)}, /* ZwRequestWaitReplyPort */ \ {0x2a6ac6fb, (26)}, /* ZwUnlockVirtualMemory */ \ {0x2aad9aed, (83)}, /* ZwSetInformationToken */ \ {0x2b2356f7, (52)}, /* ZwAlertResumeThread */ \ - {0x2c0f001a, (230)}, /* ZwSetDefaultUILanguage */ \ + {0x2c0f001a, (238)}, /* ZwSetDefaultUILanguage */ \ {0x2f22b634, (96)}, /* ZwResetEvent */ \ {0x30309daa, (170)}, /* ZwCreateNamedPipeFile */ \ {0x3064d37b, (68)}, /* RtlQueryProcessDebugInformation */ \ @@ -66,19 +68,20 @@ {0x391b8d79, (157)}, /* ZwCancelIoFile */ \ {0x3928a4cc, (20)}, /* ZwFreeVirtualMemory */ \ {0x39bea937, (89)}, /* ZwCancelTimer */ \ - {0x3abffc38, (239)}, /* ZwFlushWriteBuffer */ \ + {0x3abffc38, (247)}, /* ZwFlushWriteBuffer */ \ {0x3b1f8d85, (124)}, /* ZwQueryTimerResolution */ \ - {0x3d4aceeb, (248)}, /* memset */ \ + {0x3cd73491, (226)}, /* ZwDebugActiveProcess */ \ + {0x3d4aceeb, (256)}, /* memset */ \ {0x3e1d331d, (44)}, /* ZwSetInformationThread */ \ {0x3f62370b, (204)}, /* ZwPrivilegeCheck */ \ {0x416c4024, (118)}, /* ZwSetLowWaitHighEventPair */ \ {0x43c1745d, (92)}, /* ZwCreateEvent */ \ - {0x43d65de2, (231)}, /* ZwQueryInstallUILanguage */ \ + {0x43d65de2, (239)}, /* ZwQueryInstallUILanguage */ \ {0x45d7086f, (108)}, /* ZwOpenIoCompletion */ \ {0x465977c0, (129)}, /* ZwQueryIntervalProfile */ \ {0x47b3fd39, (8)}, /* ZwOpenDirectoryObject */ \ {0x47dd6896, (171)}, /* ZwCreateMailslotFile */ \ - {0x49d62b40, (246)}, /* LdrLoadDll */ \ + {0x49d62b40, (254)}, /* LdrLoadDll */ \ {0x4a638203, (91)}, /* ZwQueryTimer */ \ {0x4c51093e, (189)}, /* ZwLoadKey2 */ \ {0x4cb0ea34, (206)}, /* ZwPrivilegedServiceAuditAlarm */ \ @@ -93,33 +96,34 @@ {0x50f7777d, (84)}, /* ZwWaitForSingleObject */ \ {0x513877ab, (61)}, /* ZwSetInformationProcess */ \ {0x51d5c98d, (137)}, /* ZwAcceptConnectPort */ \ - {0x51ddffce, (242)}, /* ZwDisplayString */ \ + {0x51ddffce, (250)}, /* ZwDisplayString */ \ {0x51fbe1c4, (165)}, /* ZwDeviceIoControlFile */ \ {0x52334a05, (213)}, /* ZwDeleteObjectAuditAlarm */ \ {0x5288a7cf, (46)}, /* ZwResumeThread */ \ {0x54a89e87, (131)}, /* ZwStopProfile */ \ {0x56ada303, (185)}, /* ZwSaveKey */ \ + {0x573e11b1, (231)}, /* ZwQueryDebugFilterState */ \ {0x57dd87c6, (114)}, /* ZwWaitLowEventPair */ \ - {0x5879157d, (241)}, /* ZwSetDefaultHardErrorPort */ \ + {0x5879157d, (249)}, /* ZwSetDefaultHardErrorPort */ \ {0x58b766a7, (200)}, /* ZwQueryValueKey */ \ {0x59d0cf7f, (9)}, /* ZwQueryDirectoryObject */ \ {0x5a201018, (180)}, /* ZwSetInformationFile */ \ {0x5b24a650, (155)}, /* ZwDeleteFile */ \ {0x5cc5b0cc, (149)}, /* CsrClientCallServer */ \ - {0x5ccb443b, (245)}, /* ZwVdmControl */ \ + {0x5ccb443b, (253)}, /* ZwVdmControl */ \ {0x5d5b0c74, (15)}, /* ZwQuerySystemEnvironmentValue */ \ {0x5dcf9e33, (205)}, /* ZwPrivilegeObjectAuditAlarm */ \ {0x5f3fb511, (164)}, /* ZwUnlockFile */ \ {0x60ebf65f, (120)}, /* ZwQuerySystemTime */ \ - {0x63033516, (244)}, /* ZwSetLdtEntries */ \ + {0x63033516, (252)}, /* ZwSetLdtEntries */ \ {0x63cc9e64, (66)}, /* RtlCreateQueryDebugBuffer */ \ {0x64a2ceb5, (56)}, /* ZwCreateProcess */ \ {0x654da6fd, (143)}, /* ZwReplyWaitReceivePort */ \ - {0x6570064e, (243)}, /* ZwCreatePagingFile */ \ + {0x6570064e, (251)}, /* ZwCreatePagingFile */ \ {0x65b5374b, (14)}, /* ZwSetSystemInformation */ \ {0x6a2d88fc, (126)}, /* ZwYieldExecution */ \ {0x6c1b25c0, (97)}, /* ZwClearEvent */ \ - {0x6db16208, (238)}, /* ZwQueryInformationAtom */ \ + {0x6db16208, (246)}, /* ZwQueryInformationAtom */ \ {0x6e0c0f9d, (65)}, /* RtlNormalizeProcessParams */ \ {0x6f11895e, (217)}, /* ZwIsSystemResumeAutomatic */ \ {0x7160272d, (144)}, /* ZwReplyWaitReceivePortEx */ \ @@ -133,13 +137,14 @@ {0x78327b0d, (173)}, /* ZwSetVolumeInformationFile */ \ {0x78a28538, (80)}, /* ZwAdjustPrivilegesToken */ \ {0x7b9f9b64, (182)}, /* ZwOpenKey */ \ - {0x7c868d67, (252)}, /* _vsnprintf */ \ + {0x7c868d67, (260)}, /* _vsnprintf */ \ {0x7ccd8968, (138)}, /* ZwCompleteConnectPort */ \ {0x7dfb3677, (169)}, /* ZwSetEaFile */ \ {0x7e21039a, (87)}, /* ZwCreateTimer */ \ - {0x7e92a7a6, (251)}, /* vsprintf */ \ + {0x7e92a7a6, (259)}, /* vsprintf */ \ {0x7ec723c2, (122)}, /* ZwQueryPerformanceCounter */ \ {0x7f99ab33, (145)}, /* ZwReadRequestData */ \ + {0x8053fc81, (228)}, /* ZwWaitForDebugEvent */ \ {0x81b18dcd, (21)}, /* ZwQueryVirtualMemory */ \ {0x842e9cbb, (43)}, /* ZwQueryInformationThread */ \ {0x84d52359, (112)}, /* ZwCreateEventPair */ \ @@ -147,7 +152,7 @@ {0x850106f7, (7)}, /* ZwCreateDirectoryObject */ \ {0x8548dfbd, (106)}, /* ZwQueryMutant */ \ {0x85f069ec, (197)}, /* ZwNotifyChangeMultipleKeys */ \ - {0x87763935, (249)}, /* sprintf */ \ + {0x87763935, (257)}, /* sprintf */ \ {0x87fd0a60, (24)}, /* ZwWriteVirtualMemory */ \ {0x8a1989d8, (136)}, /* ZwListenPort */ \ {0x8afaa2ca, (31)}, /* ZwGetWriteWatch */ \ @@ -166,14 +171,16 @@ {0x920b0183, (116)}, /* ZwWaitHighEventPair */ \ {0x9331fae3, (25)}, /* ZwLockVirtualMemory */ \ {0x9384c236, (103)}, /* ZwCreateMutant */ \ + {0x93cf5771, (232)}, /* ZwSetDebugFilterState */ \ {0x93e64266, (130)}, /* ZwStartProfile */ \ {0x949f76b6, (19)}, /* ZwAllocateVirtualMemory */ \ {0x956ba548, (11)}, /* ZwOpenSymbolicLinkObject */ \ - {0x963cafbc, (229)}, /* ZwQueryDefaultUILanguage */ \ + {0x9636e6ce, (227)}, /* ZwRemoveProcessDebug */ \ + {0x963cafbc, (237)}, /* ZwQueryDefaultUILanguage */ \ {0x9731aded, (178)}, /* ZwQueryDirectoryFile */ \ {0x978855cd, (37)}, /* ZwMapViewOfSection */ \ {0x98058c5c, (86)}, /* ZwWaitForMultipleObjects */ \ - {0x997388d8, (237)}, /* ZwDeleteAtom */ \ + {0x997388d8, (245)}, /* ZwDeleteAtom */ \ {0x9bf04a73, (172)}, /* ZwQueryVolumeInformationFile */ \ {0x9c805856, (167)}, /* ZwNotifyChangeDirectoryFile */ \ {0x9d9c64db, (186)}, /* ZwSaveMergedKeys */ \ @@ -183,7 +190,7 @@ {0xa313f9b0, (220)}, /* ZwSetSystemPowerState */ \ {0xa34a43e1, (48)}, /* ZwSetContextThread */ \ {0xa51616fd, (156)}, /* ZwFlushBuffersFile */ \ - {0xa589ce00, (226)}, /* ZwContinue */ \ + {0xa589ce00, (234)}, /* ZwContinue */ \ {0xa5b2c609, (117)}, /* ZwSetHighEventPair */ \ {0xa8720028, (153)}, /* ZwCreateFile */ \ {0xa93301f4, (110)}, /* ZwRemoveIoCompletion */ \ @@ -201,21 +208,22 @@ {0xb3a5ef4c, (64)}, /* RtlDestroyProcessParameters */ \ {0xb3d90f63, (60)}, /* ZwQueryInformationProcess */ \ {0xb3f8b8ba, (184)}, /* ZwFlushKey */ \ - {0xb468e7d0, (225)}, /* ZwRaiseException */ \ + {0xb468e7d0, (233)}, /* ZwRaiseException */ \ {0xb4f463e1, (175)}, /* ZwSetQuotaInformationFile */ \ {0xb5ce95b0, (109)}, /* ZwSetIoCompletion */ \ {0xb677bd15, (219)}, /* ZwGetDevicePowerState */ \ {0xb891d19c, (141)}, /* ZwReplyPort */ \ {0xba08cfed, (221)}, /* ZwInitiatePowerAction */ \ - {0xba5bdfc3, (234)}, /* ZwSetUuidSeed */ \ + {0xba5bdfc3, (242)}, /* ZwSetUuidSeed */ \ + {0xba812651, (229)}, /* ZwDebugContinue */ \ {0xbc310050, (133)}, /* ZwCreateWaitablePort */ \ {0xbde7d8d1, (151)}, /* ZwLoadDriver */ \ {0xbe9990b9, (134)}, /* ZwConnectPort */ \ {0xc0040fd0, (90)}, /* ZwSetTimer */ \ - {0xc00fc05c, (240)}, /* ZwRaiseHardError */ \ + {0xc00fc05c, (248)}, /* ZwRaiseHardError */ \ {0xc4bd0fda, (99)}, /* ZwCreateSemaphore */ \ {0xc524def2, (148)}, /* ZwImpersonateClientOfPort */ \ - {0xc6a277e0, (236)}, /* ZwFindAtom */ \ + {0xc6a277e0, (244)}, /* ZwFindAtom */ \ {0xc6de9ce3, (139)}, /* ZwRequestPort */ \ {0xc707f028, (27)}, /* ZwFlushVirtualMemory */ \ {0xc70d789c, (69)}, /* ZwCreateJobObject */ \ @@ -223,7 +231,7 @@ {0xc7835b75, (195)}, /* ZwEnumerateKey */ \ {0xc7d8afa4, (85)}, /* ZwSignalAndWaitForSingleObject */ \ {0xc94ea8a6, (81)}, /* ZwAdjustGroupsToken */ \ - {0xc9f42a5d, (235)}, /* ZwAddAtom */ \ + {0xc9f42a5d, (243)}, /* ZwAddAtom */ \ {0xca250552, (210)}, /* ZwAccessCheckByTypeResultList */ \ {0xcaf1f803, (152)}, /* ZwUnloadDriver */ \ {0xcb3c8251, (223)}, /* ZwPlugPlayControl */ \ @@ -234,9 +242,9 @@ {0xd48a2bbc, (40)}, /* ZwCreateThread */ \ {0xd517401d, (54)}, /* ZwImpersonateThread */ \ {0xd5a16cee, (51)}, /* ZwAlertThread */ \ - {0xd628c8f6, (228)}, /* ZwSetDefaultLocale */ \ + {0xd628c8f6, (236)}, /* ZwSetDefaultLocale */ \ {0xd7fef93d, (201)}, /* ZwEnumerateValueKey */ \ - {0xda57df71, (247)}, /* LdrUnloadDll */ \ + {0xda57df71, (255)}, /* LdrUnloadDll */ \ {0xdaa7575e, (215)}, /* ZwAccessCheckByTypeResultListAndAuditAlarm */ \ {0xde07d08f, (224)}, /* ZwGetPlugPlayEvent */ \ {0xde5468ed, (202)}, /* ZwQueryMultipleValueKey */ \ @@ -264,6 +272,6 @@ {0xf425639c, (104)}, /* ZwOpenMutant */ \ {0xfde47817, (94)}, /* ZwSetEvent */ \ -#define __NT_IMPORTED_SYMBOLS_ARRAY_SIZE 253 +#define __NT_IMPORTED_SYMBOLS_ARRAY_SIZE 261 #endif diff --git a/src/refs/NTHASH b/src/refs/NTHASH index 77ba37d..37cad44 100644 --- a/src/refs/NTHASH +++ b/src/refs/NTHASH @@ -223,6 +223,14 @@ ZwInitiatePowerAction ZwPowerInformation ZwPlugPlayControl ZwGetPlugPlayEvent +ZwCreateDebugObject +ZwDebugActiveProcess +ZwRemoveProcessDebug +ZwWaitForDebugEvent +ZwDebugContinue +ZwSetInformationDebugObject +ZwQueryDebugFilterState +ZwSetDebugFilterState ZwRaiseException ZwContinue ZwQueryDefaultLocale |