
/**
 * @file object_header_wxp.h
 *
 * Tento soubor je soucasti frameworku na procjazeni internich datovych struktur
 * spravce objektu. Obsahuje definice nekterych struktur pro Windows XP.
 */
 
#ifndef __OBJECT_HEADER_WXP_H_
#define __OBJECT_HEADER_WXP_H_

#include <ntddk.h>
#include "object_type_wxp.h"

// Definice podhlavicky obsahujici informace, kolik pametove kvoty kazde handle daneho
// objektu ubira procesu.
typedef struct _OBJECT_HEADER_QUOTA_INFO_WXP
{
  // Strankovana pamet
  ULONG32 PagedPoolCharge;
  // Nestrankovana pamet
  ULONG32 NonPagedPoolCharge;
  // Popisovac zabezpeceni
  ULONG32 SecurityDescriptorCharge;
  // Adresa tela exklizivniho procesu
  PEPROCESS ExclusiveProcess;
} OBJECT_HEADER_QUOTA_INFO_WXP, *POBJECT_HEADER_QUOTA_INFO_WXP;

// Podhlavicka obsahujici informace o procesu, ktery je tvurcem daneho objektu
typedef struct _OBJECT_HEADER_CREATOR_INFO_WXP
{
  // Propojuje objekt s dalsimi objekty stejneho typu (pouze pokud objekt typu ma priznak MaintainTypeList.
  LIST_ENTRY TypeList;
  // PID tvurce objektu (nemusi byt validni v dobe jeho zkoumani. ten proces uz nemusi existovat)
  HANDLE CreatorUniqueProcess;
  USHORT CreatorBackTraceIndex;
  USHORT Reserved;
} OBJECT_HEADER_CREATOR_INFO_WXP, *POBJECT_HEADER_CREATOR_INFO_WXP;

// Definice podhlavicky se jmenem a adresarem objektu
typedef struct _OBJECT_HEADER_NAME_INFO_WXP
{
  // Adresa tela adresare, ve kterem je objekt obsazen
  PVOID Directory;                                    
  // Jmeno objektu
  UNICODE_STRING Name;
  ULONG32 QueryReferences;
} OBJECT_HEADER_NAME_INFO_WXP, *POBJECT_HEADER_NAME_INFO_WXP;


// Struktura "hlavni" hlavicky objektu
typedef struct _OBJECT_HEADER_WXP {
  // Pocet referenci na objekt
  LONG_PTR PointerCount;
  // Pocet existujicich handle objektu
  LONG_PTR HandleCount;
  // Adresa tela objektu typu
  POBJECT_TYPE_WXP Type;
  // Offset hlavicky OBJECT_HEADER_NAME_INFO
  UCHAR NameInfoOffset;
  // Offset hlavicky OBJECT_HEADER_HANDLE_INFO
  UCHAR HandleInfoOffset;
  // Offset hlavicky OBJECT_HEADER_QUOTA_INFO
  UCHAR QuotaInfoOffset;
  // Priznaky
  UCHAR Flags;
  union {
    // Odkaz na strukturu s parametry pri vytvareni objektu
    PVOID ObjectCreateInfo;
    PVOID QuotaBlockCharged;
  };
  // Popisovac zabezpeceni objektu
  PVOID SecurityDescriptor;
} OBJECT_HEADER_WXP, *POBJECT_HEADER_WXP;

// Makra slouzici pro "vytahnuti" dulezitych clenu ze struktur hlavicek a podhlavicek

#define OHWXPGetPointerCount(a)                        ((POBJECT_HEADER_WXP)a)->PointerCount
#define OHWXPGetHandleCount(a)                         ((POBJECT_HEADER_WXP)a)->HandleCount
#define OHWXPGetType(a)                                ((POBJECT_HEADER_WXP)a)->Type
#define OHWXPGetNameInfoOffset(a)                      ((POBJECT_HEADER_WXP)a)->NameInfoOffset
#define OHWXPGetHandleInfoOffset(a)                    ((POBJECT_HEADER_WXP)a)->HandleInfoOffset
#define OHWXPGetQuotaInfoOffset(a)                     ((POBJECT_HEADER_WXP)a)->QuotaInfoOffset
#define OHWXPGetFlags(a)                               ((POBJECT_HEADER_WXP)a)->Flags
#define OHWXPGetObjectCreateInfo(a)                    ((POBJECT_HEADER_WXP)a)->ObjectCreateInfo
#define OHWXPGetSecurityDescriptor(a)                  (PSECURITY_DESCRIPTOR)(((POBJECT_HEADER_WXP)a)->SecurityDescriptor)

#define OHWXPHandleInfoGetHandleCountDatabase(a)       ((POBJECT_HEADER_HANDLE_INFO_WXP)a)->HandleCountDatabase
#define OHWXPHandleInfoGetHandleCountSingleEntry(a)    ((POBJECT_HEADER_HANDLE_INFO_WXP)a)->SingleEntry
#define OHWXPQuotaInfoGetPagedPoolCharge(a)            ((POBJECT_HEADER_QUOTA_INFO_WXP)a)->PagedPoolCharge
#define OHWXPQuotaInfoGetNonPagedPoolCharge(a)         ((POBJECT_HEADER_QUOTA_INFO_WXP)a)->NonPagedPoolCharge
#define OHWXPQuotaInfoGetSecurityDescriptorCharge(a)   ((POBJECT_HEADER_QUOTA_INFO_WXP)a)->SecurityDescriptorCharge
#define OHWXPQuotaInfoGetExclusiveProcess(a)           ((POBJECT_HEADER_QUOTA_INFO_WXP)a)->ExclusiveProcess
#define OHWXPCreatorInfoGetCreatorUniqueProcess(a)     ((POBJECT_HEADER_CREATOR_INFO_WXP)a)->CreatorUniqueProcess 
#define OHWXPNameInfoGetDirectory(a)                   ((POBJECT_HEADER_NAME_INFO_WXP)a)->Directory
#define OHWXPNameInfoGetReferenceCount(a)              ((POBJECT_HEADER_NAME_INFO_WXP)a)->QueryReferences


#endif
