
/**
 * @file object_header_w7.h
 *
 * Tento soubor je soucasti frameworku na procjazeni internich datovych struktur
 * spravce objektu. Obsahuje definice nekterych struktur pro Windows 7.
 */
 
#ifndef __OBJECT_HEADER_W7_H_
#define __OBJECT_HEADER_W7_H_

#include <ntddk.h>
#include "object_type_w7.h"

// definice priznaku v poli InfoMask struktury OBJECT_HEADER (hlavicky objektu)
#define INFOMASK_HEADER_CREATOR_INFO   0x1     // Pritomnost OBJECT_HEADER_CREATOR_INFO
#define INFOMASK_HEADER_NAME_INFO      0x2     // Pritomnost OBJECT_HEADER_NAME_INFO
#define INFOMASK_HEADER_HANDLE_INFO    0x4     // Pritomnost OBJECT_HEADER_HANDLE_INFO
#define INFOMASK_HEADER_QUOTA_INFO     0x8     // Pritomnost OBJECT_HEADER_QUOTA_INFO
#define INFOMASK_HEADER_PROCESS_INFO   0x10    // Pritomnost OBJECT_HEADER_PROCESS_IFNO

// Definice podhlavicky obsahujici informace, kolik pametove kvoty kazde handle daneho
// objektu ubira procesu.
typedef struct _OBJECT_HEADER_QUOTA_INFO_W7
{
  // Strankovana pamet
  ULONG32 PagedPoolCharge;
  // Nestrankovana pamet
  ULONG32 NonPagedPoolCharge;
  // Popisovac zabezpeceni
  ULONG32 SecurityDescriptorCharge;
  PVOID SecurityDescriptorCharged;
} OBJECT_HEADER_QUOTA_INFO_W7, *POBJECT_HEADER_QUOTA_INFO_W7;

// Podhlavicka obsahujici informace o procesu exkluzivne vyuzivajicim objekt
typedef struct _OBJECT_HEADER_PROCESS_INFO_W7
{
  // Adresa tela exkluzivniho procesu
  PEPROCESS ExclusiveProcess;
  ULONG Reserved;
} OBJECT_HEADER_PROCESS_INFO_W7, *POBJECT_HEADER_PROCESS_INFO_W7;

// Podhlavicka obsahujici informace o procesu, ktery je tvurcem daneho objektu
typedef struct _OBJECT_HEADER_CREATOR_INFO_W7
{
  // Propojuje objekt s dalsimi objekty stejneho typu (pouze pokud objekt typu ma priznak MaintainTypeList.
  LIST_ENTRY TypeList;
  // PID tvurce objektu (nemusi byt validni v dobe jeho zkoumani. ten proces uz nemusi existovat)
  HANDLE CreatorUniqueProcess;
  USHORT CreatorBackTraceIndex;
  USHORT Reserved;
} OBJECT_HEADER_CREATOR_INFO_W7, *POBJECT_HEADER_CREATOR_INFO_W7;

// Definice podhlavicky se jmenem a adresarem objektu
typedef struct _OBJECT_HEADER_NAME_INFO_W7
{
  // Adresa tela adresare, ve kterem je objekt obsazen
  PVOID Directory;                                    
  // Jmeno objektu
  UNICODE_STRING Name;
  LONG32 ReferenceCount;
} OBJECT_HEADER_NAME_INFO_W7, *POBJECT_HEADER_NAME_INFO_W7;



// Struktura "hlavni" hlavicky objektu
typedef struct _OBJECT_HEADER_W7 {
  // Pocet referenci na objekt
  LONG_PTR PointerCount;
  // Pocet handle existujicich k danemu objektu
  LONG_PTR HandleCount;
  // Zamek pro synchronizaci nad strukturami hlavicky
  PVOID Lock;
  // Index typu (pouziva se v tabulce ObpTypeTableIndex)
  UCHAR TypeIndex;
  UCHAR TraceFlags;
  // Informace o dostupnosti jednotlivych podhlavicek
  UCHAR InfoMask;
  // Priznaky
  UCHAR Flags;
  // Na x64 je zde 4B padding, ale asi nebude treba dodavat
  union {
    // Odkaz na strukturu s parametry pri vytvareni objektu
   PVOID ObjectCreateInfo;
    PVOID QuotaBlockCharged;
  };
  // Popisovac zabezpeceni objektu
  PVOID SecurityDescriptor;
} OBJECT_HEADER_W7, *POBJECT_HEADER_W7;

// Makra slouzici pro "vytahnuti" dulezitych clenu ze struktur hlavicek a podhlavicek

#define OHW7GetPointerCount(a)                        ((POBJECT_HEADER_W7)a)->PointerCount
#define OHW7GetHandleCount(a)                         ((POBJECT_HEADER_W7)a)->HandleCount
#define OHW7GetLock(a)                                &((POBJECT_HEADER_W7)a)->Lock
#define OHW7GetType(a)                                (POBJECT_TYPE_W7)(_ObpTypeIndexTable[((POBJECT_HEADER_W7)a)->TypeIndex])
#define OHW7GetInfoMask(a)                            ((POBJECT_HEADER_W7)a)->InfoMask
#define OHW7GetNameInfoOffset(a)                      _ObpInfoMaskToOffset[((POBJECT_HEADER_W7)a)->InfoMask & (INFOMASK_HEADER_NAME_INFO | (INFOMASK_HEADER_NAME_INFO - 1))]
#define OHW7GetHandleInfoOffset(a)                    _ObpInfoMaskToOffset[((POBJECT_HEADER_W7)a)->InfoMask & (INFOMASK_HEADER_HANDLE_INFO | (INFOMASK_HEADER_HANDLE_INFO - 1))]
#define OHW7GetQuotaInfoOffset(a)                     _ObpInfoMaskToOffset[((POBJECT_HEADER_W7)a)->InfoMask & (INFOMASK_HEADER_QUOTA_INFO | (INFOMASK_HEADER_QUOTA_INFO - 1))]
#define OHW7GetProcessInfoOffset(a)                   _ObpInfoMaskToOffset[((POBJECT_HEADER_W7)a)->InfoMask & (INFOMASK_HEADER_PROCESS_INFO | (INFOMASK_HEADER_PROCESS_INFO - 1))]
#define OHW7GetFlags(a)                               ((POBJECT_HEADER_W7)a)->Flags
#define OHW7GetObjectCreateInfo(a)                    ((POBJECT_HEADER_W7)a)->ObjectCreateInfo
#define OHW7GetSecurityDescriptor(a)                  (PSECURITY_DESCRIPTOR)(((POBJECT_HEADER_W7)a)->SecurityDescriptor)

#define OHW7HandleInfoGetHandleCountDatabase(a)       ((POBJECT_HEADER_HANDLE_INFO_W7)a)->HandleCountDatabase
#define OHW7HandleInfoGetHandleCountSingleEntry(a)    ((POBJECT_HEADER_HANDLE_INFO_W7)a)->SingleEntry
#define OHW7QuotaInfoGetPagedPoolCharge(a)            ((POBJECT_HEADER_QUOTA_INFO_W7)a)->PagedPoolCharge
#define OHW7QuotaInfoGetNonPagedPoolCharge(a)         ((POBJECT_HEADER_QUOTA_INFO_W7)a)->NonPagedPoolCharge
#define OHW7QuotaInfoGetSecurityDescriptorCharge(a)   ((POBJECT_HEADER_QUOTA_INFO_W7)a)->SecurityDescriptorCharge
#define OHW7QuotaInfoGetSecurityDescriptorCharged(a)  ((POBJECT_HEADER_QUOTA_INFO_W7)a)->SecurityCharged
#define OHW7CreatorInfoGetCreatorUniqueProcess(a)     ((POBJECT_HEADER_CREATOR_INFO_W7)a)->CreatorUniqueProcess 
#define OHW7NameInfoGetDirectory(a)                   ((POBJECT_HEADER_NAME_INFO_W7)a)->Directory
#define OHW7NameInfoGetReferenceCount(a)              ((POBJECT_HEADER_NAME_INFO_W7)a)->ReferenceCount
#define OHW7ProcessInfoGetExclusiveProcess(a)         ((POBJECT_HEADER_PROCESS_INFO_W7)a)->ExclusiveProcess

#endif
