
/**
 * @file object_header_vista.h
 *
 * Tento soubor je soucasti frameworku na procjazeni internich datovych struktur
 * spravce objektu. Obsahuje definice nekterych struktur pro Windows Vista.
 */
#ifndef __OBJECT_HEADER_VISTA_H_
#define __OBJECT_HEADER_VISTA_H_

#include <ntddk.h>
#include "object_type_vista.h"


// Definice podhlavicky obsahujici informace, kolik pametove kvoty kazde handle daneho
// objektu ubira procesu.
typedef struct _OBJECT_HEADER_QUOTA_INFO_VISTA
{
  // Strankovana pamet
  ULONG32 PagedPoolCharge;
  // Nestrankovana pamet
  ULONG32 NonPagedPoolCharge;
  // Popisovac zabezpeceni
  ULONG32 SecurityDescriptorCharge;
  // Adresa tela exkluzivniho procesu
  PEPROCESS ExclusiveProcess;
} OBJECT_HEADER_QUOTA_INFO_VISTA, *POBJECT_HEADER_QUOTA_INFO_VISTA;

// Podhlavicka obsahujici informace o procesu, ktery je tvurcem daneho objektu
typedef struct _OBJECT_HEADER_CREATOR_INFO_VISTA
{
  // Propojuje objekt s dalsimi objekty stejneho typu (pouze pokud objekt typu ma priznak MaintainTypeList.
  LIST_ENTRY TypeList;
  // PID tvurce objektu (nemusi byt validni v dobe jeho zkoumani. ten proces uz nemusi existovat)
  HANDLE CreatorUniqueProcess;
  USHORT CreatorBackTraceIndex;
  USHORT Reserved;
} OBJECT_HEADER_CREATOR_INFO_VISTA, *POBJECT_HEADER_CREATOR_INFO_VISTA;

// Definice podhlavicky se jmenem a adresarem objektu
typedef struct _OBJECT_HEADER_NAME_INFO_VISTA
{
  // Adresa tela adresare, ve kterem je objekt obsazen
  PVOID Directory;                                    
  // Jmeno objektu
  UNICODE_STRING Name;
  ULONG32 QueryReferences;
} OBJECT_HEADER_NAME_INFO_VISTA, *POBJECT_HEADER_NAME_INFO_VISTA;


// Struktura "hlavni" hlavicky objektu
typedef struct _OBJECT_HEADER_VISTA {
  // Pocet referenci na objekt
  LONG_PTR PointerCount;
  // Pocet existujicich handle objektu
  LONG_PTR HandleCount;
  // Adresa tela objektu typu
  POBJECT_TYPE_VISTA Type;
  // Offset hlavicky OBJECT_HEADER_NAME_INFO
  UCHAR NameInfoOffset;
  // Offset hlavicky OBJECT_HEADER_HANDLE_INFO
  UCHAR HandleInfoOffset;
  // Offset hlavicky OBJECT_HEADER_QUOTA_INFO
  UCHAR QuotaInfoOffset;
  // Priznaky
  UCHAR Flags;
  // Na x64 je tady padding 4B, ale asi nebude treba dodavat
  union {
    // Odkaz na strukturu s parametry pri vytvareni objektu
    PVOID ObjectCreateInfo;
    PVOID QuotaBlockCharged;
  };
  // Popisovac zabezpeceni objektu
  PVOID SecurityDescriptor;
} OBJECT_HEADER_VISTA, *POBJECT_HEADER_VISTA;


// Makra slouzici pro "vytahnuti" dulezitych clenu ze struktur hlavicek a podhlavicek

#define OHVistaGetPointerCount(a)              ((POBJECT_HEADER_VISTA)a)->PointerCount
#define OHVistaGetHandleCount(a)               ((POBJECT_HEADER_VISTA)a)->HandleCount
#define OHVistaGetType(a)                      ((POBJECT_HEADER_VISTA)a)->Type
#define OHVistaGetNameInfoOffset(a)            ((POBJECT_HEADER_VISTA)a)->NameInfoOffset
#define OHVistaGetHandleInfoOffset(a)          ((POBJECT_HEADER_VISTA)a)->HandleInfoOffset
#define OHVistaGetQuotaInfoOffset(a)           ((POBJECT_HEADER_VISTA)a)->QuotaInfoOffset
#define OHVistaGetFlags(a)                     ((POBJECT_HEADER_VISTA)a)->Flags
#define OHVistaGetObjectCreateInfo(a)          ((POBJECT_HEADER_VISTA)a)->ObjectCreateInfo
#define OHVistaGetSecurityDescriptor(a)        (PSECURITY_DESCRIPTOR)(((POBJECT_HEADER_VISTA)a)->SecurityDescriptor)

#define OHVistaHandleInfoGetHandleCountDatabase(a)       ((POBJECT_HEADER_HANDLE_INFO_VISTA)a)->HandleCountDatabase
#define OHVistaHandleInfoGetHandleCountSingleEntry(a)    ((POBJECT_HEADER_HANDLE_INFO_VISTA)a)->SingleEntry
#define OHVistaQuotaInfoGetPagedPoolCharge(a)            ((POBJECT_HEADER_QUOTA_INFO_VISTA)a)->PagedPoolCharge
#define OHVistaQuotaInfoGetNonPagedPoolCharge(a)         ((POBJECT_HEADER_QUOTA_INFO_VISTA)a)->NonPagedPoolCharge
#define OHVistaQuotaInfoGetSecurityDescriptorCharge(a)   ((POBJECT_HEADER_QUOTA_INFO_VISTA)a)->SecurityDescriptorCharge
#define OHVistaQuotaInfoGetExclusiveProcess(a)           ((POBJECT_HEADER_QUOTA_INFO_VISTA)a)->ExclusiveProcess
#define OHVistaCreatorInfoGetCreatorUniqueProcess(a)     ((POBJECT_HEADER_CREATOR_INFO_VISTA)a)->CreatorUniqueProcess 
#define OHVistaNameInfoGetDirectory(a)                   ((POBJECT_HEADER_NAME_INFO_VISTA)a)->Directory
#define OHVistaNameInfoGetReferenceCount(a)              ((POBJECT_HEADER_NAME_INFO_VISTA)a)->QueryReferences

#endif
