Domito/include/Domito.h

218 lines
5.4 KiB
C
Raw Normal View History

#pragma once
2023-07-01 06:04:58 +02:00
#include <ci.h>
2023-07-01 05:59:27 +02:00
/********************************************************************************
* Memory management, misc. *
********************************************************************************/
2023-07-01 06:04:58 +02:00
//
2023-07-01 06:54:54 +02:00
// Custom allocator for function that allocate pool memory.
2023-07-01 06:04:58 +02:00
//
2023-07-01 04:23:11 +02:00
typedef
_IRQL_requires_same_
2023-07-01 04:36:59 +02:00
_Function_class_(EVT_DOMITO_ALLOCATE_ROUTINE)
2023-07-01 04:23:11 +02:00
__drv_allocatesMem(Mem)
PVOID
NTAPI
2023-07-01 04:36:59 +02:00
EVT_DOMITO_ALLOCATE_ROUTINE(
2023-07-01 05:24:04 +02:00
_In_ SIZE_T ByteSize
);
2023-07-01 04:36:59 +02:00
typedef EVT_DOMITO_ALLOCATE_ROUTINE* PFN_DOMITO_ALLOCATE_ROUTINE;
2023-07-01 05:59:27 +02:00
/********************************************************************************
* Cryptography *
********************************************************************************/
2023-07-01 06:04:58 +02:00
//
// This structure encapsulates a signature used in verifying executable files.
//
2023-07-01 05:59:27 +02:00
#if !defined(WIN_CERTIFICATE)
2023-07-01 07:03:25 +02:00
typedef struct _WIN_CERTIFICATE
{
2023-07-01 06:04:58 +02:00
DWORD dwLength;
2023-07-01 07:03:25 +02:00
WORD wRevision;
WORD wCertificateType;
BYTE bCertificate[ANYSIZE_ARRAY];
} WIN_CERTIFICATE, *LPWIN_CERTIFICATE;
2023-07-01 05:59:27 +02:00
#endif
//
// UM definitions of WinCrypt.h
//
#if !defined(WIN_CERT_TYPE_X509)
#define WIN_CERT_TYPE_X509 (0x0001) // The bCertificate member contains an X.509 certificate.
#endif
#if !defined(WIN_CERT_TYPE_PKCS_SIGNED_DATA)
#define WIN_CERT_TYPE_PKCS_SIGNED_DATA (0x0002) // The bCertificate member contains a PKCS SignedData structure.
#endif
#if !defined(WIN_CERT_TYPE_PKCS1_SIGN)
#define WIN_CERT_TYPE_PKCS1_SIGN (0x0009) // The bCertificate member contains PKCS1_MODULE_SIGN fields.
#endif
#if !defined(CALG_SHA1)
#define CALG_SHA1 0x8004u
#endif
#if !defined(CALG_SHA256)
#define CALG_SHA256 0x800cu
#endif
#if !defined(CALG_SHA384)
#define CALG_SHA384 0x800du
#endif
#if !defined(CALG_SHA512)
#define CALG_SHA512 0x800eu
#endif
2023-07-01 06:04:58 +02:00
//
2023-07-01 06:54:54 +02:00
// Converts a WinCrypt CALG_ID to a BCRYPT_ALGORITHM identifier.
2023-07-01 06:04:58 +02:00
//
PCWSTR
FORCEINLINE
DOMITO_CALG_TO_BCRYPT_ALGORITHM(
_In_ UINT32 Calg
)
{
switch (Calg)
{
case CALG_SHA1:
return BCRYPT_SHA1_ALGORITHM;
case CALG_SHA256:
return BCRYPT_SHA256_ALGORITHM;
case CALG_SHA384:
return BCRYPT_SHA384_ALGORITHM;
case CALG_SHA512:
return BCRYPT_SHA512_ALGORITHM;
default:
return L"Unknown";
}
}
2023-07-01 06:40:57 +02:00
2023-07-01 05:59:27 +02:00
/********************************************************************************
* Library functions *
********************************************************************************/
2023-07-01 06:04:58 +02:00
//
2023-07-01 06:54:54 +02:00
// Finds the base address of a driver module.
2023-07-01 06:04:58 +02:00
//
_Success_(return == STATUS_SUCCESS)
_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
EXTERN_C
NTSTATUS
2023-07-01 05:33:35 +02:00
DomitoFindModuleBaseAddress(
2023-07-01 05:24:04 +02:00
_In_ PFN_DOMITO_ALLOCATE_ROUTINE Allocator,
2023-07-01 07:03:25 +02:00
_In_ STRING ModuleName,
_Inout_opt_ PVOID* ModuleBase
);
2023-07-01 04:36:59 +02:00
//
2023-07-01 06:54:54 +02:00
// Finds the address of an exported function by name.
2023-07-01 04:36:59 +02:00
//
_Success_(return == STATUS_SUCCESS)
_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
EXTERN_C
NTSTATUS
DomitoFindExportedFunctionAddress(
2023-07-01 05:24:04 +02:00
_In_ PVOID ModuleBase,
_In_ STRING FunctionName,
2023-07-01 07:03:25 +02:00
_Inout_opt_ PVOID* FunctionAddress
2023-07-01 05:24:04 +02:00
);
//
2023-07-01 06:54:54 +02:00
// Scans a provided buffer for a memory pattern.
2023-07-01 05:24:04 +02:00
//
_Success_(return == STATUS_SUCCESS)
_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
EXTERN_C
2023-07-01 05:24:04 +02:00
NTSTATUS
DomitoMemorySearchPattern(
_In_ PCUCHAR pcPattern,
_In_ UCHAR uWildcard,
_In_ SIZE_T puLen,
_In_ PVOID pcBase,
_In_ SIZE_T puSize,
2023-07-01 07:03:25 +02:00
_Outptr_result_maybenull_ PVOID* ppMatch
);
//
// Extracts the CALG_ID from a signed PE that was used to
// calculate the message digest when it was signed
//
2023-07-01 06:14:42 +02:00
_IRQL_requires_max_(DISPATCH_LEVEL)
EXTERN_C
UINT32
DomitoGetPortableExecutableDigestKind(
_In_ PUCHAR pPeBytes,
_In_ PIMAGE_DATA_DIRECTORY pImgDataDirectory
);
2023-07-01 06:23:11 +02:00
//
2023-07-01 06:54:54 +02:00
// Reads from the beginning of a file until the end or the buffer size is reached.
2023-07-01 06:23:11 +02:00
//
_Success_(return == STATUS_SUCCESS)
_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
EXTERN_C
NTSTATUS
DomitoReadFile(
_In_ HANDLE FileHandle,
_Out_ PVOID Buffer,
_In_ ULONG BufferSize
);
2023-07-01 06:54:54 +02:00
//
// Extracts Authenticode signing information and calculates the file digest of a PE file.
//
_Success_(return == STATUS_SUCCESS)
_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
EXTERN_C
NTSTATUS
DomitoCalculatePortableExecutableDigest(
_In_ PFN_DOMITO_ALLOCATE_ROUTINE Allocator,
_In_ PUCHAR pPeBytes,
_In_ ULONG PeSize,
_Out_ PUINT32 pDigestCalgOut,
_Out_ PULONG pDigestSizeOut,
_Out_ PVOID* pDigestOut,
_Out_ LPWIN_CERTIFICATE* pCertOut,
_Out_ PULONG pSizeOfSecurityDirectory
);
2023-07-01 06:48:16 +02:00
2023-07-01 06:54:54 +02:00
//
// Gets the name of the main image of the process identified by PID.
//
2023-07-01 06:48:16 +02:00
_Success_(return == STATUS_SUCCESS)
_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
EXTERN_C
NTSTATUS
DomitoGetProcessImageName(
_In_ PFN_DOMITO_ALLOCATE_ROUTINE Allocator,
_In_ ULONG ProcessId,
_Inout_ PUNICODE_STRING* ProcessImageName
);
2023-07-01 07:03:25 +02:00
_Success_(return == STATUS_SUCCESS)
_Must_inspect_result_
_IRQL_requires_max_(PASSIVE_LEVEL)
EXTERN_C
NTSTATUS
DomitoValidateFileLegacyMode(
_In_ PFN_DOMITO_ALLOCATE_ROUTINE Allocator,
_In_ HANDLE FileHandle,
_In_ PVOID Hash,
_In_ UINT32 HashSize,
_In_ ALG_ID HashAlgId,
_In_ const IMAGE_DATA_DIRECTORY* SecurityDirectory,
_Inout_ MINCRYPT_POLICY_INFO* PolicyInfo,
_Out_ LARGE_INTEGER* SigningTime,
_Inout_ MINCRYPT_POLICY_INFO* TimeStampPolicyInfo
);