
/**
 * @file object_header_w2k.h
 *
 * Tento soubor je soucasti frameworku na procjazeni internich datovych struktur
 * spravce objektu. Obsahuje definice nekterych struktur pro Windows 2000.
 */
 
#ifndef __OBJECT_HEADER_W2K_H_
#define __OBJECT_HEADER_W2K_H_

#include <ntddk.h>
#include "object_type_w2k.h"


// Definice podhlavicky obsahujici informace, kolik pametove kvoty kazde handle daneho
// objektu ubira procesu.
typedef struct _OBJECT_HEADER_QUOTA_INFO_W2K
{
  // Strankovana pamet
  ULONG32 PagedPoolCharge;
  // Nestrankovana pamet
  ULONG32 NonPagedPoolCharge;
  // Popisovac zabezpeceni
  ULONG32 SecurityDescriptorCharge;
  // Adresa tela exkluzivniho procesu
  PEPROCESS ExclusiveProcess;
} OBJECT_HEADER_QUOTA_INFO_W2K, *POBJECT_HEADER_QUOTA_INFO_W2K;

// Podhlavicka obsahujici informace o procesu, ktery je tvurcem daneho objektu
typedef struct _OBJECT_HEADER_CREATOR_INFO_W2K
{
  // Propojuje objekt s dalsimi objekty stejneho typu (pouze pokud objekt typu ma priznak MaintainTypeList.
  LIST_ENTRY TypeList;
  // PID tvurce objektu (nemusi byt validni v dobe jeho zkoumani. ten proces uz nemusi existovat)
  HANDLE CreatorUniqueProcess;
  USHORT CreatorBackTraceIndex;
  USHORT Reserved;
} OBJECT_HEADER_CREATOR_INFO_W2K, *POBJECT_HEADER_CREATOR_INFO_W2K;

// Definice podhlavicky se jmenem a adresarem objektu
typedef struct _OBJECT_HEADER_NAME_INFO_W2K
{
  // Adresa tela adresare, ve kterem je objekt obsazen
  PVOID Directory;                                    
  // Jmeno objektu
  UNICODE_STRING Name;
  ULONG32 QueryReferences;
} OBJECT_HEADER_NAME_INFO_W2K, *POBJECT_HEADER_NAME_INFO_W2K;


// Struktura "hlavni" hlavicky objektu
typedef struct _OBJECT_HEADER_W2K {
  // Pocet referenci na objekt
  LONG_PTR PointerCount;
  // Pocet existujicich handle objektu
  LONG_PTR HandleCount;
  // Adresa tela objektu typu
  POBJECT_TYPE_W2K Type;
  // Offset hlavicky OBJECT_HEADER_NAME_INFO
  UCHAR NameInfoOffset;
  // Offset hlavicky OBJECT_HEADER_HANDLE_INFO
  UCHAR HandleInfoOffset;
  // Offset hlavicky OBJECT_HEADER_QUOTA_INFO
  UCHAR QuotaInfoOffset;
  // Priznaky
  UCHAR Flags;
  union {
    // Odkaz na strukturu s parametry pri vytvareni objektu
    PVOID ObjectCreateInfo;
    PVOID QuotaBlockCharged;
  };
  // Popisovac zabezpeceni objektu
  PVOID SecurityDescriptor;
} OBJECT_HEADER_W2K, *POBJECT_HEADER_W2K;

// Makra slouzici pro "vytahnuti" dulezitych clenu ze struktur hlavicek a podhlavicek

#define OHW2KGetPointerCount(a)              ((POBJECT_HEADER_W2K)a)->PointerCount
#define OHW2KGetHandleCount(a)               ((POBJECT_HEADER_W2K)a)->HandleCount
#define OHW2KGetType(a)                      ((POBJECT_HEADER_W2K)a)->Type
#define OHW2KGetNameInfoOffset(a)            ((POBJECT_HEADER_W2K)a)->NameInfoOffset
#define OHW2KGetHandleInfoOffset(a)          ((POBJECT_HEADER_W2K)a)->HandleInfoOffset
#define OHW2KGetQuotaInfoOffset(a)           ((POBJECT_HEADER_W2K)a)->QuotaInfoOffset
#define OHW2KGetFlags(a)                     ((POBJECT_HEADER_W2K)a)->Flags
#define OHW2KGetObjectCreateInfo(a)          ((POBJECT_HEADER_W2K)a)->ObjectCreateInfo
#define OHW2KGetSecurityDescriptor(a)        (PSECURITY_DESCRIPTOR)(((POBJECT_HEADER_W2K)a)->SecurityDescriptor)

#define OHW2KHandleInfoGetHandleCountDatabase(a)       ((POBJECT_HEADER_HANDLE_INFO_W2K)a)->HandleCountDatabase
#define OHW2KHandleInfoGetHandleCountSingleEntry(a)    ((POBJECT_HEADER_HANDLE_INFO_W2K)a)->SingleEntry
#define OHW2KQuotaInfoGetPagedPoolCharge(a)            ((POBJECT_HEADER_QUOTA_INFO_W2K)a)->PagedPoolCharge
#define OHW2KQuotaInfoGetNonPagedPoolCharge(a)         ((POBJECT_HEADER_QUOTA_INFO_W2K)a)->NonPagedPoolCharge
#define OHW2KQuotaInfoGetSecurityDescriptorCharge(a)   ((POBJECT_HEADER_QUOTA_INFO_W2K)a)->SecurityDescriptorCharge
#define OHW2KQuotaInfoGetExclusiveProcess(a)           ((POBJECT_HEADER_QUOTA_INFO_W2K)a)->ExclusiveProcess
#define OHW2KCreatorInfoGetCreatorUniqueProcess(a)     ((POBJECT_HEADER_CREATOR_INFO_W2K)a)->CreatorUniqueProcess 
#define OHW2KNameInfoGetDirectory(a)                   ((POBJECT_HEADER_NAME_INFO_W2K)a)->Directory
#define OHW2KNameInfoGetReferenceCount(a)              ((POBJECT_HEADER_NAME_INFO_W2K)a)->QueryReferences

#endif
