#pragma once

//BaseAddressIndex.cpp

typedef struct _MMP_BASE_ADDRESS_INDEX_DATA {

PRTL_RB_TREE LdrpModuleBaseAddressIndex;

PLDR_DATA_TABLE_ENTRY NtdllLdrEntry;

PVOID _RtlRbInsertNodeEx;

PVOID _RtlRbRemoveNode;

}MMP_BASE_ADDRESS_INDEX_DATA, * PMMP_BASE_ADDRESS_INDEX_DATA;

//InvertedFunctionTable.cpp

typedef struct _MMP_INVERTED_FUNCTION_TABLE_DATA {

PVOID LdrpInvertedFunctionTable;

}MMP_INVERTED_FUNCTION_TABLE_DATA, * PMMP_INVERTED_FUNCTION_TABLE_DATA;

//LdrEntry.cpp

typedef struct _MMP_LDR_ENTRY_DATA {

PLIST_ENTRY LdrpHashTable;

}MMP_LDR_ENTRY_DATA, * PMMP_LDR_ENTRY_DATA;

//MmpTls.cpp

typedef struct _MMP_TLS_DATA {

LIST_ENTRY MmpTlsList;

RTL_BITMAP MmpTlsBitmap;

SRWLOCK MmpTlsListLock;

CRITICAL_SECTION MmpTlspLock;

LIST_ENTRY MmpThreadLocalStoragePointer;

DWORD MmpActiveThreadCount;

struct {

PVOID HookReserved1;

PVOID HookReserved2;

decltype(&NtSetInformationProcess) OriginNtSetInformationProcess;

decltype(&LdrShutdownThread) OriginLdrShutdownThread;

decltype(&RtlUserThreadStart) OriginRtlUserThreadStart;

}Hooks;

}MMP_TLS_DATA, * PMMP_TLS_DATA;

//MmpDotNet.cpp

typedef struct _MMP_DOT_NET_DATA {

FILETIME AssemblyTimes;

CRITICAL_SECTION MmpFakeHandleListLock;

LIST_ENTRY MmpFakeHandleListHead;

BOOLEAN PreHooked;

BOOLEAN Initialized;

struct {

decltype(&CreateFileW) OriginCreateFileW;

decltype(&GetFileInformationByHandle) OriginGetFileInformationByHandle;

decltype(&GetFileAttributesExW) OriginGetFileAttributesExW;

decltype(&GetFileSize) OriginGetFileSize;

decltype(&GetFileSizeEx) OriginGetFileSizeEx;

decltype(&CreateFileMappingW) OriginCreateFileMappingW;

decltype(&MapViewOfFileEx) OriginMapViewOfFileEx;

decltype(&MapViewOfFile) OriginMapViewOfFile;

decltype(&UnmapViewOfFile)OriginUnmapViewOfFile;

decltype(&CloseHandle)OriginCloseHandle;

GetFileVersion_T OriginGetFileVersion1;

GetFileVersion_T OriginGetFileVersion2;

}Hooks;

}MMP_DOT_NET_DATA, * PMMP_DOT_NET_DATA;

typedef struct _MMP_FUNCTIONS {

decltype(&LdrLoadDllMemoryExW) _LdrLoadDllMemoryExW;

decltype(&LdrUnloadDllMemory) _LdrUnloadDllMemory;

decltype(&LdrUnloadDllMemoryAndExitThread) _LdrUnloadDllMemoryAndExitThread;

decltype(&MmpHandleTlsData) _MmpHandleTlsData;

decltype(&MmpReleaseTlsEntry) _MmpReleaseTlsEntry;

}MMP_FUNCTIONS, * PMMP_FUNCTIONS;

//ImportTable.cpp

typedef struct _MMP_IAT_DATA {

LIST_ENTRY MmpIatResolverList;

CRITICAL_SECTION MmpIatResolverListLock;

MM_IAT_RESOLVER MmpIatResolverHead;

}MMP_IAT_DATA, * PMMP_IAT_DATA;

typedef enum class _WINDOWS_VERSION :BYTE {

null,

xp,

vista,

win7,

win8,

winBlue,

win10,

win10_1,

win10_2,

win11,

invalid

}WINDOWS_VERSION;

#define MEMORY_MODULE_MAKE_PREVIEW(MinorVersion) (0x8000|(MinorVersion))

#define MEMORY_MODULE_IS_PREVIEW(MinorVersion) (!!(0x8000&(MinorVersion)))

#define MEMORY_MODULE_GET_MINOR_VERSION(MinorVersion) (~0x8000&(MinorVersion))

#define MEMORY_MODULE_MAJOR_VERSION 2

#define MEMORY_MODULE_MINOR_VERSION MEMORY_MODULE_MAKE_PREVIEW(2)

typedef struct _MMP_GLOBAL_DATA {

WORD MajorVersion;

WORD MinorVersion;

DWORD MmpFeatures;

struct {

DWORD MajorVersion;

DWORD MinorVersion;

DWORD BuildNumber;

}NtVersions;

WINDOWS_VERSION WindowsVersion;

WORD LdrDataTableEntrySize;

SYSTEM_INFO SystemInfo;

PMMP_BASE_ADDRESS_INDEX_DATA MmpBaseAddressIndex;

PMMP_INVERTED_FUNCTION_TABLE_DATA MmpInvertedFunctionTable;

PMMP_LDR_ENTRY_DATA MmpLdrEntry;

PMMP_TLS_DATA MmpTls;

PMMP_DOT_NET_DATA MmpDotNet;

PVOID BaseAddress;

PMMP_FUNCTIONS MmpFunctions;

PMMP_IAT_DATA MmpIat;

DWORD ReferenceCount;

}MMP_GLOBAL_DATA, * PMMP_GLOBAL_DATA;

#define MMP_GLOBAL_DATA_SIZE (\

sizeof(MMP_GLOBAL_DATA) + \

sizeof(MMP_BASE_ADDRESS_INDEX_DATA) + \

sizeof(MMP_INVERTED_FUNCTION_TABLE_DATA) + \

sizeof(MMP_LDR_ENTRY_DATA) + \

sizeof(MMP_TLS_DATA) + \

sizeof(MMP_DOT_NET_DATA) + \

sizeof(MMP_FUNCTIONS) + \

sizeof(PMMP_IAT_DATA)\

)

extern PMMP_GLOBAL_DATA MmpGlobalDataPtr;