
#ifndef __QUERYOBJECT_H_
#define __QUERYOBJECT_H_

/** 
 * @file: queryobject.h
 *
 * Tento soubor obsahuje definice a konstanty pro modul implementujici
 * funkce pro zjistovani ruznych informaci o objektech exekutivy.
 */

#include <windows.h>
#include "..\shared\common.h"

/*
// Informace o jednom handle
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
  // PID procesu, kteremu patri
  USHORT UniqueProcessId;
  USHORT CreatorBackTraceIndex;
  // Index typu objektu
  UCHAR ObjectTypeIndex;
  // Priznaky handle (Protected from Close, Inheritable)
  UCHAR HandleAttributes;
  USHORT HandleValue;
  PVOID Object;
  ULONG GrantedAccess;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;

typedef struct _SYSTEM_HANDLE_INFORMATION {
  ULONG NumberOfHandles;
  SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles [1];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
*/

// Informace o jednom handle
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
  // Adresa objektu v pameti jadra
  PVOID Object;
  // PID procesu, ktery dane handle vlastni
  ULONG_PTR UniqueProcessId;
  // Hodnota handle
  ULONG_PTR HandleValue;
  // Opravneni handle
  ULONG GrantedAccess;
  USHORT CreatorBackTraceIndex;
  // Index typu objektu
  USHORT ObjectTypeIndex;
  // Atributy handle (Protected from close, Inheritable)
  ULONG  HandleAttributes;
  ULONG  Reserved;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;

// Definice struktury obsahujici informace o vsech handle v systemu
typedef struct _SYSTEM_HANDLE_INFORMATION_EX {
  ULONG_PTR NumberOfHandles;
  ULONG_PTR Reserved;
  SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles [1];
} SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;

// Mozne druhy informaci, ktere lze ziskat pres rutinu NtQueryObject
typedef enum _OBJECT_INFORMATION_CLASS {
  // Zakladni informace
  ObjectBasicInformation,
  // Jmeno objektu
  ObjectNameInformation,
  // Informace o typu objektu
  ObjectTypeInformation,
  // Informace o vlastnostech a pocet objektu vsech typu
  ObjectTypesInformation,
  // Atributy handle (P, I)
  ObjectHandleFlagInformation,
  ObjectSessionInformation,
} OBJECT_INFORMATION_CLASS;

// Zakladni informace o objektu
typedef struct _OBJECT_BASIC_INFORMATION {
  ULONG Attributes;
  ACCESS_MASK GrantedAccess;
  ULONG HandleCount;
  ULONG PointerCount;
  ULONG PagedPoolCharge;
  ULONG NonPagedPoolCharge;
  ULONG Reserved [3];
  ULONG NameInfoSize;
  ULONG TypeInfoSize;
  ULONG SecurityDescriptorSize;
  // Cas vytvoreni, platny pouze u symbolickych odkazu
  LARGE_INTEGER CreationTime;
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

// Jmeno objektu
typedef struct _OBJECT_NAME_INFORMATION {               // ntddk wdm nthal
  UNICODE_STRING Name;                                // ntddk wdm nthal
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;   // ntddk wdm nthal

// Informace o objektu reprezentujicim typ ciloveho objektu
typedef struct _OBJECT_TYPE_INFORMATION {
  UNICODE_STRING TypeName;
  ULONG TotalNumberOfObjects;
  ULONG TotalNumberOfHandles;
  ULONG TotalPagedPoolUsage;
  ULONG TotalNonPagedPoolUsage;
  ULONG TotalNamePoolUsage;
  ULONG TotalHandleTableUsage;
  ULONG HighWaterNumberOfObjects;
  ULONG HighWaterNumberOfHandles;
  ULONG HighWaterPagedPoolUsage;
  ULONG HighWaterNonPagedPoolUsage;
  ULONG HighWaterNamePoolUsage;
  ULONG HighWaterHandleTableUsage;
  ULONG InvalidAttributes;
  GENERIC_MAPPING GenericMapping;
  ULONG ValidAccessMask;
  BOOLEAN SecurityRequired;
  BOOLEAN MaintainHandleCount;
  ULONG PoolType;
  ULONG DefaultPagedPoolCharge;
  ULONG DefaultNonPagedPoolCharge;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

// Definice struktury pro uchovani informaci o vsech typech objektu
// v systemu
typedef struct _OBJECT_TYPES_INFORMATION {
  LONG NumberOfTypes;
//  OBJECT_TYPE_INFORMATION TypeInformation [1];
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;

// Definice bufferu pro ObjectHandleFlagsInformationClass
typedef struct _OBJECT_HANDLE_FLAG_INFORMATION {
  BOOLEAN Inherit;
  BOOLEAN ProtectFromClose;
} OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;

// Definice rutiny NtQueryObject
typedef NTSTATUS (NTAPI NTQUERYOBJECT) (
  HANDLE Handle,
  OBJECT_INFORMATION_CLASS ObjectInformationClass,
  PVOID ObjectInformation,
  ULONG ObjectInformationLength,
  PULONG ReturnLength);

// Definice rutiny NtQuerySystemInformation
typedef NTSTATUS (NTAPI NTQUERYSYSTEMINFORMATION) (
  SYSTEM_INFORMATION_CLASS SystemInformationClass,
  PVOID SystemInformation,
  ULONG SystemInformationLength,
  PULONG ReturnLength);



// Popis vyznamu jednotlivych funkci naleznete u jejich implementace v
// souboru queryobject.c.

BOOL EnumHandles(PSYSTEM_HANDLE_INFORMATION_EX *HandleInfo);
HANDLE OpenTargetProcess(DWORD ProcessId);
HANDLE DuplicateObject(HANDLE hSourceProcess, HANDLE hSourceObject);
VOID CloseTargetProcess(HANDLE hTargetProcess);
BOOL QueryObjectInfo(HANDLE hObject, POBJECT_BASIC_INFORMATION *BasicInfo, POBJECT_TYPE_INFORMATION *TypeInfo, POBJECT_NAME_INFORMATION *NameInfo);
BOOL QueryObjectTypesInfo(POBJECT_TYPES_INFORMATION *TypesInfo);

BOOL QueryObjectInit(VOID);
VOID QueryObjectFinit(VOID);

#endif
