vendor/ntapi-0.4.0/src/ntdbg.rs

use crate::ntapi_base::{CLIENT_ID, PCLIENT_ID};
use winapi::shared::evntprov::EVENT_FILTER_DESCRIPTOR;
use winapi::shared::guiddef::LPCGUID;
use winapi::shared::ntdef::{
    BOOLEAN, HANDLE, NTSTATUS, PCCH, PCH, PCSTR, PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES,
    PULONG, PVOID, UCHAR, ULONG, ULONGLONG,
};
use winapi::um::minwinbase::LPDEBUG_EVENT;
use winapi::um::winnt::{ACCESS_MASK, EXCEPTION_RECORD, STANDARD_RIGHTS_REQUIRED, SYNCHRONIZE};
use winapi::vc::vadefs::va_list;
EXTERN!{extern "system" {
    fn DbgUserBreakPoint();
    fn DbgBreakPoint();
    fn DbgBreakPointWithStatus(
        Status: ULONG,
    );
}}
pub const DBG_STATUS_CONTROL_C: u32 = 1;
pub const DBG_STATUS_SYSRQ: u32 = 2;
pub const DBG_STATUS_BUGCHECK_FIRST: u32 = 3;
pub const DBG_STATUS_BUGCHECK_SECOND: u32 = 4;
pub const DBG_STATUS_FATAL: u32 = 5;
pub const DBG_STATUS_DEBUG_CONTROL: u32 = 6;
pub const DBG_STATUS_WORKER: u32 = 7;
EXTERN!{extern "C" {
    fn DbgPrint(
        Format: PCSTR,
        ...
    ) -> ULONG;
    fn DbgPrintEx(
        ComponentId: ULONG,
        Level: ULONG,
        Format: PCSTR,
        ...
    ) -> ULONG;
}}
EXTERN!{extern "system" {
    fn vDbgPrintEx(
        ComponentId: ULONG,
        Level: ULONG,
        Format: PCCH,
        arglist: va_list,
    ) -> ULONG;
    fn vDbgPrintExWithPrefix(
        Prefix: PCH,
        ComponentId: ULONG,
        Level: ULONG,
        Format: PCCH,
        arglist: va_list,
    ) -> ULONG;
    fn DbgQueryDebugFilterState(
        ComponentId: ULONG,
        Level: ULONG,
    ) -> NTSTATUS;
    fn DbgSetDebugFilterState(
        ComponentId: ULONG,
        Level: ULONG,
        State: BOOLEAN,
    ) -> NTSTATUS;
    fn DbgPrompt(
        Prompt: PCCH,
        Response: PCH,
        Length: ULONG,
    ) -> ULONG;
}}
STRUCT!{struct DBGKM_EXCEPTION {
    ExceptionRecord: EXCEPTION_RECORD,
    FirstChance: ULONG,
}}
pub type PDBGKM_EXCEPTION = *mut DBGKM_EXCEPTION;
STRUCT!{struct DBGKM_CREATE_THREAD {
    SubSystemKey: ULONG,
    StartAddress: PVOID,
}}
pub type PDBGKM_CREATE_THREAD = *mut DBGKM_CREATE_THREAD;
STRUCT!{struct DBGKM_CREATE_PROCESS {
    SubSystemKey: ULONG,
    FileHandle: HANDLE,
    BaseOfImage: PVOID,
    DebugInfoFileOffset: ULONG,
    DebugInfoSize: ULONG,
    InitialThread: DBGKM_CREATE_THREAD,
}}
pub type PDBGKM_CREATE_PROCESS = *mut DBGKM_CREATE_PROCESS;
STRUCT!{struct DBGKM_EXIT_THREAD {
    ExitStatus: NTSTATUS,
}}
pub type PDBGKM_EXIT_THREAD = *mut DBGKM_EXIT_THREAD;
STRUCT!{struct DBGKM_EXIT_PROCESS {
    ExitStatus: NTSTATUS,
}}
pub type PDBGKM_EXIT_PROCESS = *mut DBGKM_EXIT_PROCESS;
STRUCT!{struct DBGKM_LOAD_DLL {
    FileHandle: HANDLE,
    BaseOfDll: PVOID,
    DebugInfoFileOffset: ULONG,
    DebugInfoSize: ULONG,
    NamePointer: PVOID,
}}
pub type PDBGKM_LOAD_DLL = *mut DBGKM_LOAD_DLL;
STRUCT!{struct DBGKM_UNLOAD_DLL {
    BaseAddress: PVOID,
}}
pub type PDBGKM_UNLOAD_DLL = *mut DBGKM_UNLOAD_DLL;
ENUM!{enum DBG_STATE {
    DbgIdle = 0,
    DbgReplyPending = 1,
    DbgCreateThreadStateChange = 2,
    DbgCreateProcessStateChange = 3,
    DbgExitThreadStateChange = 4,
    DbgExitProcessStateChange = 5,
    DbgExceptionStateChange = 6,
    DbgBreakpointStateChange = 7,
    DbgSingleStepStateChange = 8,
    DbgLoadDllStateChange = 9,
    DbgUnloadDllStateChange = 10,
}}
pub type PDBG_STATE = *mut DBG_STATE;
STRUCT!{struct DBGUI_CREATE_THREAD {
    HandleToThread: HANDLE,
    NewThread: DBGKM_CREATE_THREAD,
}}
pub type PDBGUI_CREATE_THREAD = *mut DBGUI_CREATE_THREAD;
STRUCT!{struct DBGUI_CREATE_PROCESS {
    HandleToProcess: HANDLE,
    HandleToThread: HANDLE,
    NewProcess: DBGKM_CREATE_PROCESS,
}}
UNION!{union DBGUI_WAIT_STATE_CHANGE_StateInfo {
    Exception: DBGKM_EXCEPTION,
    CreateThread: DBGUI_CREATE_THREAD,
    CreateProcessInfo: DBGUI_CREATE_PROCESS,
    ExitThread: DBGKM_EXIT_THREAD,
    ExitProcess: DBGKM_EXIT_PROCESS,
    LoadDll: DBGKM_LOAD_DLL,
    UnloadDll: DBGKM_UNLOAD_DLL,
}}
pub type PDBGUI_CREATE_PROCESS = *mut DBGUI_CREATE_PROCESS;
STRUCT!{struct DBGUI_WAIT_STATE_CHANGE {
    NewState: DBG_STATE,
    AppClientId: CLIENT_ID,
    StateInfo: DBGUI_WAIT_STATE_CHANGE_StateInfo,
}}
pub type PDBGUI_WAIT_STATE_CHANGE = *mut DBGUI_WAIT_STATE_CHANGE;
pub const DEBUG_READ_EVENT: ULONG = 0x0001;
pub const DEBUG_PROCESS_ASSIGN: ULONG = 0x0002;
pub const DEBUG_SET_INFORMATION: ULONG = 0x0004;
pub const DEBUG_QUERY_INFORMATION: ULONG = 0x0008;
pub const DEBUG_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | DEBUG_READ_EVENT
    | DEBUG_PROCESS_ASSIGN | DEBUG_SET_INFORMATION | DEBUG_QUERY_INFORMATION;
pub const DEBUG_KILL_ON_CLOSE: u32 = 0x1;
ENUM!{enum DEBUGOBJECTINFOCLASS {
    DebugObjectUnusedInformation = 0,
    DebugObjectKillProcessOnExitInformation = 1,
    MaxDebugObjectInfoClass = 2,
}}
pub type PDEBUGOBJECTINFOCLASS = *mut DEBUGOBJECTINFOCLASS;
EXTERN!{extern "system" {
    fn NtCreateDebugObject(
        DebugObjectHandle: PHANDLE,
        DesiredAccess: ACCESS_MASK,
        ObjectAttributes: POBJECT_ATTRIBUTES,
        Flags: ULONG,
    ) -> NTSTATUS;
    fn NtDebugActiveProcess(
        ProcessHandle: HANDLE,
        DebugObjectHandle: HANDLE,
    ) -> NTSTATUS;
    fn NtDebugContinue(
        DebugObjectHandle: HANDLE,
        ClientId: PCLIENT_ID,
        ContinueStatus: NTSTATUS,
    ) -> NTSTATUS;
    fn NtRemoveProcessDebug(
        ProcessHandle: HANDLE,
        DebugObjectHandle: HANDLE,
    ) -> NTSTATUS;
    fn NtSetInformationDebugObject(
        DebugObjectHandle: HANDLE,
        DebugObjectInformationClass: DEBUGOBJECTINFOCLASS,
        DebugInformation: PVOID,
        DebugInformationLength: ULONG,
        ReturnLength: PULONG,
    ) -> NTSTATUS;
    fn NtWaitForDebugEvent(
        DebugObjectHandle: HANDLE,
        Alertable: BOOLEAN,
        Timeout: PLARGE_INTEGER,
        WaitStateChange: PVOID,
    ) -> NTSTATUS;
    fn DbgUiConnectToDbg() -> NTSTATUS;
    fn DbgUiGetThreadDebugObject() -> HANDLE;
    fn DbgUiSetThreadDebugObject(
        DebugObject: HANDLE,
    );
    fn DbgUiWaitStateChange(
        StateChange: PDBGUI_WAIT_STATE_CHANGE,
        Timeout: PLARGE_INTEGER,
    ) -> NTSTATUS;
    fn DbgUiContinue(
        AppClientId: PCLIENT_ID,
        ContinueStatus: NTSTATUS,
    ) -> NTSTATUS;
    fn DbgUiStopDebugging(
        Process: HANDLE,
    ) -> NTSTATUS;
    fn DbgUiDebugActiveProcess(
        Process: HANDLE,
    ) -> NTSTATUS;
    fn DbgUiRemoteBreakin(
        Context: PVOID,
    );
    fn DbgUiIssueRemoteBreakin(
        Process: HANDLE,
    ) -> NTSTATUS;
    fn DbgUiConvertStateChangeStructure(
        StateChange: PDBGUI_WAIT_STATE_CHANGE,
        DebugEvent: LPDEBUG_EVENT,
    ) -> NTSTATUS;
}}
FN!{stdcall PENABLECALLBACK(
    SourceId: LPCGUID,
    IsEnabled: ULONG,
    Level: UCHAR,
    MatchAnyKeyword: ULONGLONG,
    MatchAllKeyword: ULONGLONG,
    FilterData: *mut EVENT_FILTER_DESCRIPTOR,
    CallbackContext: PVOID,
) -> ()}
pub type REGHANDLE = ULONGLONG;
pub type PREGHANDLE = *mut ULONGLONG;
EXTERN!{extern "system" {
    fn EtwEventRegister(
        ProviderId: LPCGUID,
        EnableCallback: PENABLECALLBACK,
        CallbackContext: PVOID,
        RegHandle: PREGHANDLE,
    ) -> NTSTATUS;
}}