
#ifndef __LISTDLLPEB_H_
#define __LISTDLLPEB_H_

/**
 * @file: listdll-peb.h
 *
 * Tento soubor obsahuje definice struktur, konstant a dalsich veci pro
 * modul pro praci se strukturami PEB jinych procesu. Modul je zameren
 * hlavne na cteni seznamu modulu cizich procesu prave skrz PEB.
 */

#include <windows.h>

// Typy informaci o procesu
typedef enum _PROCESSINFOCLASS {
  ProcessBasicInformation
} PROCESSINFOCLASS;

// Definice hlavicky funkce NtQueryInformationProcess
typedef NTSTATUS (NTAPI *NTQUERYINFORMATIONPROCESS)(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);

// Struktura PEB_LDR_DATA
typedef struct _PEB_LDR_DATA {
  BYTE Reserved1[8];
  PVOID Reserved2[3];
  // Hlava spojoveho seznamu modulu nactenych v cilovem procesu
  LIST_ENTRY InMemoryOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

// Struktura PEB_LDR_DATA pro procesy bezici pod WOW64
typedef struct _PEB_LDR_DATA_WOW64 {
  BYTE Reserved1[8];
  DWORD Reserved2[3];
  // Hlava spojoveho seznamu modulu nactenych v cilovem procesu
  DWORD InMemoryOrderModuleList [2];
} PEB_LDR_DATA_WOW64, *PPEB_LDR_DATA_WOW64;

// Struktura LDR_DTA_TABLE_ENTRY. Obsahuje informace o jednom modulu
typedef struct _LDR_DATA_TABLE_ENTRY {
  PVOID Reserved1[2];
  // Spojovy seznam nactenych modulu
  LIST_ENTRY InMemoryOrderLinks;
  PVOID Reserved2[2];
  // Virtualni adresa pocatku modulu
  PVOID DllBase;
  // Vstupni bod do souboru modulu
  PVOID EntryPoint;
  // Velikost souboru modulu
  SIZE_T ImageSize;
  // Plne jmeno souboru modulu
  UNICODE_STRING FullDllName;
  BYTE Reserved4[8];
  PVOID Reserved5[3];
  union {
    ULONG CheckSum;
    PVOID Reserved6;
  };

  ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

// Struktura LDR_DATA_TABLE_ENTRY pro WOW64 procesy
typedef struct _LDR_DATA_TABLE_ENTRY_WOW64 {
  DWORD Reserved1[2];
  // Spojovy seznam nactenych modulu
  DWORD InMemoryOrderLinks[2];
  DWORD Reserved2[2];
  // Virtualni adresa pocatku modulu
  DWORD DllBase;
  // Vstupni bod do souboru modulu
  DWORD EntryPoint;
  // Velikost souboru modulu
  DWORD ImageSize;
  // Plne jmeno souboru modulu
  USHORT FullDllNameLength;
  USHORT FullDllNameMaximumLength;
  DWORD FullDllNameBuffer;
  BYTE Reserved4[8];
  DWORD Reserved5[3];
  union {
    ULONG CheckSum;
    DWORD Reserved6;
  };

  ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY_WOW64, *PLDR_DATA_TABLE_ENTRY_WOW64;

// Struktura PEB pro WOW64 procesy
typedef struct _PEB_WOW64 {
  UCHAR InheritedAddressSpace;
  UCHAR ReadImageFileExecOptions;
  UCHAR BeingDebugged;
  UCHAR Spare;
  DWORD Reserved3[2];
  DWORD Ldr;
  DWORD ProcessParameters;
  BYTE Reserved4[104];
  DWORD Reserved5[52];
  DWORD PostProcessInitRoutine;
  BYTE Reserved6[128];
  DWORD Reserved7[1];
  ULONG SessionId;
} PEB_WOW64, *PPEB_WOW64;

// Definice struktury PEB pro 64bit OS
typedef struct _PEB {
  UCHAR InheritedAddressSpace;
  UCHAR ReadImageFileExecOptions;
  UCHAR BeingDebugged;
  UCHAR Spare;
  PVOID Reserved2[2];
  PPEB_LDR_DATA Ldr;
  PVOID ProcessParameters;
  BYTE Reserved3[520];
  PVOID PostProcessInitRoutine;
  BYTE Reserved4[136];
  ULONG SessionId;
} PEB, *PPEB;



// Definice struktury dat bufferu, ktera vrati rutina NtQueryInformationProcess
// na pozadavek ProcessBasicInformation
typedef struct _PROCESS_BASIC_INFORMATION {
  PVOID Reserved1;
  // Virtualni adresa nativniho PEBu
  PVOID PebBaseAddress;
  PVOID Reserved2[2];
  // PID procesu
  ULONG_PTR UniqueProcessId;
  PVOID Reserved3;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;


// Popis vyznamu jednotlivych rutin najdete u jejich implementace v
// souboru listdll-peb.c

BOOL ListDllPEBGetModules(DWORD PID, PMODULE_INFO_ITEM *ModuleList);
BOOL ListDllPEBInit(VOID);
VOID ListDllPEBFinit(VOID);


#endif
