
/**
 * @file: object_header.h
 *
 * Tento soubor je soucasti frameworku pro praci s internimi datovymi strukturami
 * spravce objektu jadra Windows. Tento soubor obsahuje definice struktur a hlavicky
 * funkci pracujicich s hlavickami a podhlavickami objektu.
 */
#ifndef __OBJECT_HEADER_H_
#define __OBJECT_HEADER_H_

#include <ntddk.h>

// Priznaky v poli Flags hlavicky objektu (struktury OBJECT_HEADER)
#define OB_FLAG_NEW_OBJECT              0x01   // Objekt je ve fazi vytvareni
#define OB_FLAG_KERNEL_OBJECT           0x02   // Objekt je pristupny pouze z jadra
#define OB_FLAG_CREATOR_INFO            0x04   // Objekt ma hlavicku OBJECT_HEADER_CREATOR_INFO
#define OB_FLAG_EXCLUSIVE_OBJECT        0x08   // Jedna se o exkluzivni objekt (muze byt vyuzivan nejvyse jednim procesem)
#define OB_FLAG_PERMANENT_OBJECT        0x10   // Trvaly objekt
#define OB_FLAG_DEFAULT_SECURITY_QUOTA  0x20 
#define OB_FLAG_SINGLE_HANDLE_ENTRY     0x40   // Databaze vyuziti objektu procesy obsahuje pouze jednu polozku
#define OB_FLAG_DELETED_INLINE          0x80   // Objekt je prave odstranovan v ramci pracovniho vlakna

// Struktura jedne polozky v databazi vyuziti objektu jednotlivymi procesy
typedef struct _OBJECT_HANDLE_COUNT_ENTRY 
{
  // Adresa tela objektu procesu
  PEPROCESS Process;
  struct {
    // Pocet handle, ktera tento proces na dany objekt vlastni
    ULONG32 HandleCount : 24;
    ULONG32 LockCount : 8;
  } Entry;
} OBJECT_HANDLE_COUNT_ENTRY, *POBJECT_HANDLE_COUNT_ENTRY;

// Struktura databaze vyuziti objektu jednotlivymi procesy
typedef struct _OBJECT_HANDLE_COUNT_DATABASE
{         
  // Pocet polozek                                                                                     
  ULONG32 CountEntries;
  // Jednotlivy polozky
  OBJECT_HANDLE_COUNT_ENTRY HandleCountEntries[1];
} OBJECT_HANDLE_COUNT_DATABASE, *POBJECT_HANDLE_COUNT_DATABASE;

// Hlavicka OBJECT_HEADER_HANDLE_INFO, ktera obsahuje informace o tom, jak jednotlive
// procesy prave vyuzivaji dany objekt.
typedef struct _OBJECT_HEADER_HANDLE_INFO
{
  union
  {
    // Pokud je objekt vyuzivan vice nez jednim procesem, jedna se o adresu databaze.
    POBJECT_HANDLE_COUNT_DATABASE HandleCountDataBase;
	// Pokud je objekt vyuzivan nejvyse jednim procesem, jedna se primo o polozku pro
	// ten dany proces.
    OBJECT_HANDLE_COUNT_ENTRY SingleEntry;
  };
} OBJECT_HEADER_HANDLE_INFO, *POBJECT_HEADER_HANDLE_INFO;

// Mozne hodnoty typu hlavicky pro rutinu OHGetInfoHeader
#define OH_HEADER_NAME_INFO            1       // OBJECT_HEADER_NAME_INFI
#define OH_HEADER_HANDLE_INFO          2       // OBJECT_HEADER_HANDLE_INFO
#define OH_HEADER_QUOTA_INFO           3       // OBJECT_HEADER_QUOTA_INFO
#define OH_HEADER_CREATOR_INFO         4       // OBJECT_HEADER_CREATOR_INFO
#define OH_HEADER_PROCESS_INFO         5       // OBJECT_HEADER_PROCESS_INFO

// Vlozime definice struktur hlavicek a podhlavicek pro ruzne verze Windows
#include "object_header_w2k.h"
#include "object_header_wxp.h"
#include "object_header_w2k3.h"
#include "object_header_vista.h"
#include "object_header_w7.h"

// Popis semantiky jednotlivych funkci naleznete v souboru object_header.c u jejich
// implementace.

ULONG_PTR OHGetPointerCount(PVOID ObjectHeader);
ULONG_PTR OHGetHandleCount(PVOID ObjectHeader);
POBJECT_TYPE OHGetObjectType(PVOID ObjectHeader);
ULONG OHGetFlags(PVOID ObjectHeader);
ULONG OHGetInfoMask(PVOID ObjectHeader);
PVOID OHGetObjectCreateInfo(PVOID ObjectHeader);
PSECURITY_DESCRIPTOR OHGetSecurityDescriptor(PVOID ObjectHeader);

ULONG OHGetNameInfoOffset(PVOID ObjectHeader);
ULONG OHGetHandleInfoOffset(PVOID ObjectHeader);
ULONG OHGetQuotaInfoOffset(PVOID ObjectHeader);
ULONG OHGetProcessInfoOffset(PVOID ObjectHeader);
ULONG OHGetCreatorInfoOffset(PVOID ObjectHeader);

PVOID OHGetInfoHeader(PVOID ObjectHeader, ULONG HeaderType);
ULONG OHGetInfoHeaderSize(PVOID ObjectHeader, ULONG HeaderType);
PVOID OHGetObjectHeader(PVOID Object);;

PVOID OHNameInfoGetDirectory(PVOID InfoHeader);
PUNICODE_STRING OHNameInfoGetName(PVOID InfoHeader);
ULONG32 OHQuotaInfoGetPagedPoolCharge(PVOID InfoHeader);
ULONG32 OHQuotaInfoGetNonPagedPoolCharge(PVOID InfoHeader);
ULONG32 OHQuotaInfoGetSecurityDescriptorCharge(PVOID InfoHeader);
HANDLE OHCreatorInfoGetCreatorUniqueProcessId(PVOID InfoHeader);
PEPROCESS OHGetEcxlusiveProcess(PVOID Header);

NTSTATUS OHInit(VOID);
VOID OHFinit(VOID);

#endif
