/*  name      ZeroAccess  type      rootkit  cve       —  year      unknown  os        Windows  authors   unknown  source    RamadhanAmizudin/malware  archived  RamadhanAmizudin, krisyotam (2026)  notes     — *//**************************************************************************************  (C) COPYRIGHT AUTHORS, 2015, translated from Microsoft sources/debugger**  TITLE:       NTOS.H**  VERSION:     1.31**  DATE:        18 Jan 2016**  Common header file for the ntos API functions and definitions.** THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A* PARTICULAR PURPOSE.*************************************************************************************/ #pragma comment(lib, "ntdll.lib") #pragma warning(disable: 4214) // nonstandard extension used : bit field types other than int #define IN_REGION(x, Base, Size) (((ULONG_PTR)x >= (ULONG_PTR)Base) && ((ULONG_PTR)x <= (ULONG_PTR)Base + (ULONG_PTR)Size)) #define ALIGN_DOWN(count,size) \            ((ULONG_PTR)(count) & ~((ULONG_PTR)(size) - 1)) #define ALIGN_UP(count,size) \            (ALIGN_DOWN( (ULONG_PTR)(count)+(ULONG_PTR)(size)-1, (ULONG_PTR)(size) )) //Access Rights #define CALLBACK_MODIFY_STATE    0x0001#define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|CALLBACK_MODIFY_STATE ) #define DEBUG_READ_EVENT        (0x0001)#define DEBUG_PROCESS_ASSIGN    (0x0002)#define DEBUG_SET_INFORMATION   (0x0004)#define DEBUG_QUERY_INFORMATION (0x0008)#define DEBUG_ALL_ACCESS     (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|DEBUG_READ_EVENT|DEBUG_PROCESS_ASSIGN|\                              DEBUG_SET_INFORMATION|DEBUG_QUERY_INFORMATION) #define DIRECTORY_QUERY                 (0x0001)#define DIRECTORY_TRAVERSE              (0x0002)#define DIRECTORY_CREATE_OBJECT         (0x0004)#define DIRECTORY_CREATE_SUBDIRECTORY   (0x0008)#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF) #define EVENT_QUERY_STATE       0x0001#define EVENT_MODIFY_STATE      0x0002  #define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)  #define EVENT_PAIR_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE) #define IO_COMPLETION_QUERY_STATE   0x0001#define IO_COMPLETION_MODIFY_STATE  0x0002  #define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)  #define KEYEDEVENT_WAIT 0x0001#define KEYEDEVENT_WAKE 0x0002#define KEYEDEVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | KEYEDEVENT_WAIT | KEYEDEVENT_WAKE) #define MUTANT_QUERY_STATE      0x0001#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|MUTANT_QUERY_STATE) #define PORT_CONNECT (0x0001)#define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1) #define PROFILE_CONTROL (0x0001)#define PROFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL) #define SEMAPHORE_QUERY_STATE       0x0001#define SEMAPHORE_MODIFY_STATE      0x0002 #define SEMAPHORE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) #define SYMBOLIC_LINK_QUERY (0x0001)#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) #define THREAD_ALERT	(0x0004) #define WORKER_FACTORY_RELEASE_WORKER 0x0001#define WORKER_FACTORY_WAIT 0x0002#define WORKER_FACTORY_SET_INFORMATION 0x0004#define WORKER_FACTORY_QUERY_INFORMATION 0x0008#define WORKER_FACTORY_READY_WORKER 0x0010#define WORKER_FACTORY_SHUTDOWN 0x0020 #define OBJECT_TYPE_CREATE (0x0001)#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) #define WMIGUID_QUERY                 0x0001#define WMIGUID_SET                   0x0002#define WMIGUID_NOTIFICATION          0x0004#define WMIGUID_READ_DESCRIPTION      0x0008#define WMIGUID_EXECUTE               0x0010#define TRACELOG_CREATE_REALTIME      0x0020#define TRACELOG_CREATE_ONDISK        0x0040#define TRACELOG_GUID_ENABLE          0x0080#define TRACELOG_ACCESS_KERNEL_LOGGER 0x0100#define TRACELOG_CREATE_INPROC        0x0200#define TRACELOG_ACCESS_REALTIME      0x0400#define TRACELOG_REGISTER_GUIDS       0x0800 #define NtCurrentThread() ( (HANDLE)(LONG_PTR) -2 )#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )#define ZwCurrentProcess() NtCurrentProcess()#define ZwCurrentThread()	 NtCurrentThread() //// Define special ByteOffset parameters for read and write operations// #define FILE_WRITE_TO_END_OF_FILE       0xffffffff#define FILE_USE_FILE_POINTER_POSITION  0xfffffffe //// This is the maximum MaximumLength for a UNICODE_STRING.// #define MAXUSHORT   0xffff     #define MAX_USTRING ( sizeof(WCHAR) * (MAXUSHORT/sizeof(WCHAR)) ) typedef struct _UNICODE_STRING {	USHORT Length;	USHORT MaximumLength;	PWSTR  Buffer;} UNICODE_STRING;typedef UNICODE_STRING *PUNICODE_STRING;typedef const UNICODE_STRING *PCUNICODE_STRING; typedef struct _STRING{	USHORT Length;	USHORT MaximumLength;	PCHAR Buffer;} STRING;typedef STRING *PSTRING; typedef STRING ANSI_STRING;typedef PSTRING PANSI_STRING; typedef STRING OEM_STRING;typedef PSTRING POEM_STRING;typedef CONST STRING* PCOEM_STRING;typedef CONST char *PCSZ; typedef struct _CSTRING{	USHORT Length;	USHORT MaximumLength;	CONST char *Buffer;} CSTRING;typedef CSTRING *PCSTRING;#define ANSI_NULL ((CHAR)0) typedef STRING CANSI_STRING;typedef PSTRING PCANSI_STRING; typedef struct _OBJECT_ATTRIBUTES {	ULONG Length;	HANDLE RootDirectory;	PUNICODE_STRING ObjectName;	ULONG Attributes;	PVOID SecurityDescriptor;	PVOID SecurityQualityOfService;} OBJECT_ATTRIBUTES;typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES; typedef struct _IO_STATUS_BLOCK {	union {		NTSTATUS Status;		PVOID Pointer;	} DUMMYUNIONNAME; 	ULONG_PTR Information;} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; /*** Semaphore START*/ #ifndef _SEMAPHORE_INFORMATION_CLASStypedef enum _SEMAPHORE_INFORMATION_CLASS {	SemaphoreBasicInformation} SEMAPHORE_INFORMATION_CLASS;#endif #ifndef _SEMAPHORE_BASIC_INFORMATIONtypedef struct _SEMAPHORE_BASIC_INFORMATION {	LONG CurrentCount;	LONG MaximumCount;} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;#endif /*** Semaphore END*/ /*** Processes START*/ #ifndef KPRIORITYtypedef LONG KPRIORITY;#endif typedef enum _THREAD_STATE {	StateInitialized,	StateReady,	StateRunning,	StateStandby,	StateTerminated,	StateWait,	StateTransition,	StateUnknown} THREAD_STATE; typedef enum _KWAIT_REASON {	Executive,	FreePage,	PageIn,	PoolAllocation,	DelayExecution,	Suspended,	UserRequest,	WrExecutive,	WrFreePage,	WrPageIn,	WrPoolAllocation,	WrDelayExecution,	WrSuspended,	WrUserRequest,	WrEventPair,	WrQueue,	WrLpcReceive,	WrLpcReply,	WrVirtualMemory,	WrPageOut,	WrRendezvous,	WrKeyedEvent,	WrTerminated,	WrProcessInSwap,	WrCpuRateControl,	WrCalloutStack,	WrKernel,	WrResource,	WrPushLock,	WrMutex,	WrQuantumEnd,	WrDispatchInt,	WrPreempted,	WrYieldExecution,	WrFastMutex,	WrGuardedMutex,	WrRundown,	MaximumWaitReason} KWAIT_REASON; typedef struct _CLIENT_ID {	HANDLE UniqueProcess;	HANDLE UniqueThread;} CLIENT_ID, *PCLIENT_ID; typedef struct _VM_COUNTERS {	SIZE_T PeakVirtualSize;	SIZE_T VirtualSize;	ULONG PageFaultCount;	SIZE_T PeakWorkingSetSize;	SIZE_T WorkingSetSize;	SIZE_T QuotaPeakPagedPoolUsage;	SIZE_T QuotaPagedPoolUsage;	SIZE_T QuotaPeakNonPagedPoolUsage;	SIZE_T QuotaNonPagedPoolUsage;	SIZE_T PagefileUsage;	SIZE_T PeakPagefileUsage;	SIZE_T PrivatePageCount;} VM_COUNTERS; typedef struct _SYSTEM_THREAD_INFORMATION {	LARGE_INTEGER   KernelTime;	LARGE_INTEGER   UserTime;	LARGE_INTEGER   CreateTime;	ULONG           WaitTime;	PVOID           StartAddress;	CLIENT_ID       ClientId;	KPRIORITY       Priority;	KPRIORITY       BasePriority;	ULONG           ContextSwitchCount;	THREAD_STATE    State;	KWAIT_REASON    WaitReason;} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION; typedef struct _SYSTEM_PROCESSES_INFORMATION {	ULONG NextEntryDelta;	ULONG ThreadCount;	LARGE_INTEGER SpareLi1;	LARGE_INTEGER SpareLi2;	LARGE_INTEGER SpareLi3;	LARGE_INTEGER CreateTime;	LARGE_INTEGER UserTime;	LARGE_INTEGER KernelTime;	UNICODE_STRING ImageName;	KPRIORITY BasePriority;	HANDLE UniqueProcessId;	HANDLE InheritedFromUniqueProcessId;	ULONG HandleCount;	ULONG SessionId;	ULONG_PTR PageDirectoryBase;	VM_COUNTERS VmCounters;	IO_COUNTERS IoCounters;	SYSTEM_THREAD_INFORMATION Threads[1];} SYSTEM_PROCESSES_INFORMATION, *PSYSTEM_PROCESSES_INFORMATION; typedef enum _PROCESSINFOCLASS {	ProcessBasicInformation = 0,	ProcessQuotaLimits = 1,	ProcessIoCounters = 2,	ProcessVmCounters = 3,	ProcessTimes = 4,	ProcessBasePriority = 5,	ProcessRaisePriority = 6,	ProcessDebugPort = 7,	ProcessExceptionPort = 8,	ProcessAccessToken = 9,	ProcessLdtInformation = 10,	ProcessLdtSize = 11,	ProcessDefaultHardErrorMode = 12,	ProcessIoPortHandlers = 13,	ProcessPooledUsageAndLimits = 14,	ProcessWorkingSetWatch = 15,	ProcessUserModeIOPL = 16,	ProcessEnableAlignmentFaultFixup = 17,	ProcessPriorityClass = 18,	ProcessWx86Information = 19,	ProcessHandleCount = 20,	ProcessAffinityMask = 21,	ProcessPriorityBoost = 22,	ProcessDeviceMap = 23,	ProcessSessionInformation = 24,	ProcessForegroundInformation = 25,	ProcessWow64Information = 26,	ProcessImageFileName = 27,	ProcessLUIDDeviceMapsEnabled = 28,	ProcessBreakOnTermination = 29,	ProcessDebugObjectHandle = 30,	ProcessDebugFlags = 31,	ProcessHandleTracing = 32,	ProcessIoPriority = 33,	ProcessExecuteFlags = 34,	ProcessTlsInformation = 35,	ProcessCookie = 36,	ProcessImageInformation = 37,	ProcessCycleTime = 38,	ProcessPagePriority = 39,	ProcessInstrumentationCallback = 40,	ProcessThreadStackAllocation = 41,	ProcessWorkingSetWatchEx = 42,	ProcessImageFileNameWin32 = 43,	ProcessImageFileMapping = 44,	ProcessAffinityUpdateMode = 45,	ProcessMemoryAllocationMode = 46,	ProcessGroupInformation = 47,	ProcessTokenVirtualizationEnabled = 48,	ProcessOwnerInformation = 49,	ProcessWindowInformation = 50,	ProcessHandleInformation = 51,	ProcessMitigationPolicy = 52,	ProcessDynamicFunctionTableInformation = 53,	ProcessHandleCheckingMode = 54,	ProcessKeepAliveCount = 55,	ProcessRevokeFileHandles = 56,	ProcessWorkingSetControl = 57,	ProcessHandleTable = 58,	ProcessCheckStackExtentsMode = 59,	ProcessCommandLineInformation = 60,	ProcessProtectionInformation = 61,	MaxProcessInfoClass = 62} PROCESSINFOCLASS; typedef struct _PROCESS_BASIC_INFORMATION {	NTSTATUS ExitStatus;	PVOID PebBaseAddress;	ULONG_PTR AffinityMask;	KPRIORITY BasePriority;	ULONG_PTR UniqueProcessId;	ULONG_PTR InheritedFromUniqueProcessId;} PROCESS_BASIC_INFORMATION;typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION; typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION {	SIZE_T Size;	PROCESS_BASIC_INFORMATION BasicInfo;	union	{		ULONG Flags;		struct		{			ULONG IsProtectedProcess : 1;			ULONG IsWow64Process : 1;			ULONG IsProcessDeleting : 1;			ULONG IsCrossSessionCreate : 1;			ULONG IsFrozen : 1;			ULONG IsBackground : 1;			ULONG IsStronglyNamed : 1;			ULONG SpareBits : 25;		} DUMMYSTRUCTNAME;	} DUMMYUNIONNAME;} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION; /*** Processes END*/ #ifndef _SYSTEM_INFORMATION_CLASStypedef enum _SYSTEM_INFORMATION_CLASS{	SystemBasicInformation = 0,	SystemProcessorInformation = 1,	SystemPerformanceInformation = 2,	SystemTimeOfDayInformation = 3,	SystemPathInformation = 4,	SystemProcessInformation = 5,	SystemCallCountInformation = 6,	SystemDeviceInformation = 7,	SystemProcessorPerformanceInformation = 8,	SystemFlagsInformation = 9,	SystemCallTimeInformation = 10,	SystemModuleInformation = 11,	SystemLocksInformation = 12,	SystemStackTraceInformation = 13,	SystemPagedPoolInformation = 14,	SystemNonPagedPoolInformation = 15,	SystemHandleInformation = 16,	SystemObjectInformation = 17,	SystemPageFileInformation = 18,	SystemVdmInstemulInformation = 19,	SystemVdmBopInformation = 20,	SystemFileCacheInformation = 21,	SystemPoolTagInformation = 22,	SystemInterruptInformation = 23,	SystemDpcBehaviorInformation = 24,	SystemFullMemoryInformation = 25,	SystemLoadGdiDriverInformation = 26,	SystemUnloadGdiDriverInformation = 27,	SystemTimeAdjustmentInformation = 28,	SystemSummaryMemoryInformation = 29,	SystemMirrorMemoryInformation = 30,	SystemPerformanceTraceInformation = 31,	SystemObsolete0 = 32,	SystemExceptionInformation = 33,	SystemCrashDumpStateInformation = 34,	SystemKernelDebuggerInformation = 35,	SystemContextSwitchInformation = 36,	SystemRegistryQuotaInformation = 37,	SystemExtendServiceTableInformation = 38,	SystemPrioritySeperation = 39,	SystemVerifierAddDriverInformation = 40,	SystemVerifierRemoveDriverInformation = 41,	SystemProcessorIdleInformation = 42,	SystemLegacyDriverInformation = 43,	SystemCurrentTimeZoneInformation = 44,	SystemLookasideInformation = 45,	SystemTimeSlipNotification = 46,	SystemSessionCreate = 47,	SystemSessionDetach = 48,	SystemSessionInformation = 49,	SystemRangeStartInformation = 50,	SystemVerifierInformation = 51,	SystemVerifierThunkExtend = 52,	SystemSessionProcessInformation = 53,	SystemLoadGdiDriverInSystemSpace = 54,	SystemNumaProcessorMap = 55,	SystemPrefetcherInformation = 56,	SystemExtendedProcessInformation = 57,	SystemRecommendedSharedDataAlignment = 58,	SystemComPlusPackage = 59,	SystemNumaAvailableMemory = 60,	SystemProcessorPowerInformation = 61,	SystemEmulationBasicInformation = 62,	SystemEmulationProcessorInformation = 63,	SystemExtendedHandleInformation = 64,	SystemLostDelayedWriteInformation = 65,	SystemBigPoolInformation = 66,	SystemSessionPoolTagInformation = 67,	SystemSessionMappedViewInformation = 68,	SystemHotpatchInformation = 69,	SystemObjectSecurityMode = 70,	SystemWatchdogTimerHandler = 71,

Lines 1–500 of 4880. Load more