/*
  name      ZeroAccess
  type      rootkit
  cve       —
  year      unknown
  os        Windows
  authors   unknown
  source    RamadhanAmizudin/malware
  archived  RamadhanAmizudin, krisyotam (2026)
  notes     —
 */
/*******************************************************************************
*
*  (C) COPYRIGHT AUTHORS, 2016
*
*  TITLE:       GDIP.H
*
*  VERSION:     1.00
*
*  DATE:        18 Jan 2016
*
*  Common header file for GDI+.
*
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
* PARTICULAR PURPOSE.
*
*******************************************************************************/

#pragma once

typedef enum {
	GdiplusOk = 0,
	GdiplusGenericError = 1,
	GdiplusInvalidParameter = 2,
	GdiplusOutOfMemory = 3,
	GdiplusObjectBusy = 4,
	GdiplusInsufficientBuffer = 5,
	GdiplusNotImplemented = 6,
	GdiplusWin32Error = 7,
	GdiplusWrongState = 8,
	GdiplusAborted = 9,
	GdiplusFileNotFound = 10,
	GdiplusValueOverflow = 11,
	GdiplusAccessDenied = 12,
	GdiplusUnknownImageFormat = 13,
	GdiplusFontFamilyNotFound = 14,
	GdiplusFontStyleNotFound = 15,
	GdiplusNotTrueTypeFont = 16,
	GdiplusUnsupportedGdiplusVersion = 17,
	GdiplusNotInitialized = 18,
	GdiplusPropertyNotFound = 19,
	GdiplusPropertyNotSupported = 20,
	GdiplusProfileNotFound = 21
} GDI_STATUS;

typedef struct _GdiplusStartupInput {
	UINT32         GdiplusVersion;
	PVOID          DebugEventCallback;
	BOOL           SuppressBackgroundThread;
	BOOL           SuppressExternalCodecs;
} GdiplusStartupInput, *PGdiplusStartupInput;

typedef struct _GdiplusStartupOutput {
	PVOID          NotificationHook;
	PVOID          NotificationUnhook;
} GdiplusStartupOutput, *PGdiplusStartupOutput;

typedef struct _GdiPlusRect {
	INT X;
	INT Y;
	INT Width;
	INT Height;
} GdiPlusRect, *PGdiPlusRect;

typedef struct _GdiPlusBitmapData {
	UINT Width;
	UINT Height;
	INT Stride;
	UINT PixelFormat;
	VOID* Scan0;
	UINT_PTR Reserved;
} GdiPlusBitmapData, *PGdiPlusBitmapData;

typedef GDI_STATUS(WINAPI *pfnGdiplusStartup)(
	_Out_ ULONG_PTR *token,
	_In_  const GdiplusStartupInput *input,
	_Out_ GdiplusStartupOutput *output
	);

typedef void (WINAPI *pfnGdiplusShutdown)(
	_In_  ULONG_PTR token
	);

typedef GDI_STATUS(WINAPI *pfnGdipCreateBitmapFromStream)(
	IStream* stream,
	void **bitmap
	);

typedef GDI_STATUS(WINAPI *pfnGdipGetImageWidth)(
	void *image,
	UINT *width
	);

typedef GDI_STATUS(WINAPI *pfnGdipGetImageHeight)(
	void *image,
	UINT *height
	);

typedef GDI_STATUS(WINAPI *pfnGdipDisposeImage)(
	void *image
	);

typedef GDI_STATUS(WINAPI *pfnGdipBitmapLockBits)(
	void* bitmap,
	CONST GdiPlusRect* rect,
	UINT flags,
	INT format,
	void* lockedBitmapData
	);

typedef GDI_STATUS(WINAPI *pfnGdipBitmapUnlockBits)(
	void* bitmap,
	void* lockedBitmapData
	);

typedef enum
{
	ImageLockModeRead = 0x0001,
	ImageLockModeWrite = 0x0002,
	ImageLockModeUserInputBuf = 0x0004
} ImageLockMode;

#define    PixelFormatIndexed      0x00010000 // Indexes into a palette
#define    PixelFormatGDI          0x00020000 // Is a GDI-supported format
#define    PixelFormatAlpha        0x00040000 // Has an alpha component
#define    PixelFormatPAlpha       0x00080000 // Pre-multiplied alpha
#define    PixelFormatExtended     0x00100000 // Extended color 16 bits/channel
#define    PixelFormatCanonical    0x00200000 
#define    PixelFormatUndefined       0
#define    PixelFormatDontCare        0
#define    PixelFormat1bppIndexed     (1 | ( 1 << 8) | PixelFormatIndexed | PixelFormatGDI)
#define    PixelFormat4bppIndexed     (2 | ( 4 << 8) | PixelFormatIndexed | PixelFormatGDI)
#define    PixelFormat8bppIndexed     (3 | ( 8 << 8) | PixelFormatIndexed | PixelFormatGDI)
#define    PixelFormat16bppGrayScale  (4 | (16 << 8) | PixelFormatExtended)
#define    PixelFormat16bppRGB555     (5 | (16 << 8) | PixelFormatGDI)
#define    PixelFormat16bppRGB565     (6 | (16 << 8) | PixelFormatGDI)
#define    PixelFormat16bppARGB1555   (7 | (16 << 8) | PixelFormatAlpha | PixelFormatGDI)
#define    PixelFormat24bppRGB        (8 | (24 << 8) | PixelFormatGDI)
#define    PixelFormat32bppRGB        (9 | (32 << 8) | PixelFormatGDI)
#define    PixelFormat32bppARGB       (10 | (32 << 8) | PixelFormatAlpha | PixelFormatGDI | PixelFormatCanonical)
#define    PixelFormat32bppPARGB      (11 | (32 << 8) | PixelFormatAlpha | PixelFormatPAlpha | PixelFormatGDI)
#define    PixelFormat48bppRGB        (12 | (48 << 8) | PixelFormatExtended)
#define    PixelFormat64bppARGB       (13 | (64 << 8) | PixelFormatAlpha  | PixelFormatCanonical | PixelFormatExtended)
#define    PixelFormat64bppPARGB      (14 | (64 << 8) | PixelFormatAlpha  | PixelFormatPAlpha | PixelFormatExtended)
#define    PixelFormat32bppCMYK       (15 | (32 << 8))
#define    PixelFormatMax             16

pfnGdiplusStartup GdiplusStartup;
pfnGdiplusShutdown GdiplusShutdown;
pfnGdipCreateBitmapFromStream GdipCreateBitmapFromStream;
pfnGdipDisposeImage GdipDisposeImage;
pfnGdipGetImageWidth GdipGetImageWidth;
pfnGdipGetImageHeight GdipGetImageHeight;
pfnGdipBitmapLockBits GdipBitmapLockBits;
pfnGdipBitmapUnlockBits GdipBitmapUnlockBits;

BOOL SfInitGdiPlus(
	VOID
	);