mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-10 19:57:39 +02:00
Merge pull request #1069 from dgmcdona/dgmcdona/windows_svcscan
Windows: SvcScan Binary Info
This commit is contained in:
ikelos
@@ -87,7 +87,7 @@ class ContextInterface(metaclass=ABCMeta):
|
||||
offset: int,
|
||||
native_layer_name: str = None,
|
||||
**arguments,
|
||||
):
|
||||
) -> "interfaces.objects.ObjectInterface":
|
||||
"""Object factory, takes a context, symbol, offset and optional
|
||||
layer_name.
|
||||
|
||||
|
||||
@@ -4,25 +4,42 @@
|
||||
|
||||
import logging
|
||||
import os
|
||||
from typing import List
|
||||
from typing import Dict, List, NamedTuple, Optional, Tuple, Union, cast
|
||||
|
||||
from volatility3.framework import interfaces, renderers, constants, symbols, exceptions
|
||||
from volatility3.framework import (
|
||||
constants,
|
||||
exceptions,
|
||||
interfaces,
|
||||
objects,
|
||||
renderers,
|
||||
symbols,
|
||||
)
|
||||
from volatility3.framework.configuration import requirements
|
||||
from volatility3.framework.layers import scanners
|
||||
from volatility3.framework.renderers import format_hints
|
||||
from volatility3.framework.symbols import intermed
|
||||
from volatility3.framework.symbols.windows import versions
|
||||
from volatility3.framework.symbols.windows.extensions import services
|
||||
from volatility3.plugins.windows import poolscanner, vadyarascan, pslist
|
||||
from volatility3.plugins.windows import poolscanner, pslist, vadyarascan
|
||||
from volatility3.plugins.windows.registry import hivelist
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
|
||||
ServiceBinaryInfo = NamedTuple(
|
||||
"ServiceBinaryInfo",
|
||||
[
|
||||
("dll", Union[str, interfaces.renderers.BaseAbsentValue]),
|
||||
("binary", Union[str, interfaces.renderers.BaseAbsentValue]),
|
||||
],
|
||||
)
|
||||
|
||||
|
||||
class SvcScan(interfaces.plugins.PluginInterface):
|
||||
"""Scans for windows services."""
|
||||
|
||||
_required_framework_version = (2, 0, 0)
|
||||
_version = (1, 0, 0)
|
||||
_version = (2, 0, 0)
|
||||
|
||||
@classmethod
|
||||
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
|
||||
@@ -42,10 +59,16 @@ class SvcScan(interfaces.plugins.PluginInterface):
|
||||
requirements.PluginRequirement(
|
||||
name="vadyarascan", plugin=vadyarascan.VadYaraScan, version=(1, 0, 0)
|
||||
),
|
||||
requirements.PluginRequirement(
|
||||
name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
|
||||
),
|
||||
]
|
||||
|
||||
@staticmethod
|
||||
def get_record_tuple(service_record: interfaces.objects.ObjectInterface):
|
||||
def get_record_tuple(
|
||||
service_record: interfaces.objects.ObjectInterface,
|
||||
binary_info: ServiceBinaryInfo,
|
||||
):
|
||||
return (
|
||||
format_hints.Hex(service_record.vol.offset),
|
||||
service_record.Order,
|
||||
@@ -56,8 +79,32 @@ class SvcScan(interfaces.plugins.PluginInterface):
|
||||
service_record.get_name(),
|
||||
service_record.get_display(),
|
||||
service_record.get_binary(),
|
||||
binary_info.binary,
|
||||
binary_info.dll,
|
||||
)
|
||||
|
||||
# These checks must be completed from newest -> oldest OS version.
|
||||
_win_version_file_map: List[Tuple[versions.OsDistinguisher, bool, str]] = [
|
||||
(versions.is_win10_25398_or_later, True, "services-win10-25398-x64"),
|
||||
(versions.is_win10_19041_or_later, True, "services-win10-19041-x64"),
|
||||
(versions.is_win10_19041_or_later, False, "services-win10-19041-x86"),
|
||||
(versions.is_win10_18362_or_later, True, "services-win10-18362-x64"),
|
||||
(versions.is_win10_18362_or_later, False, "services-win10-18362-x86"),
|
||||
(versions.is_win10_17763_or_later, False, "services-win10-17763-x86"),
|
||||
(versions.is_win10_16299_or_later, True, "services-win10-16299-x64"),
|
||||
(versions.is_win10_16299_or_later, False, "services-win10-16299-x86"),
|
||||
(versions.is_win10_15063, True, "services-win10-15063-x64"),
|
||||
(versions.is_win10_15063, False, "services-win10-15063-x86"),
|
||||
(versions.is_win10_up_to_15063, True, "services-win8-x64"),
|
||||
(versions.is_win10_up_to_15063, False, "services-win8-x86"),
|
||||
(versions.is_windows_8_or_later, True, "services-win8-x64"),
|
||||
(versions.is_windows_8_or_later, True, "services-win8-x86"),
|
||||
(versions.is_vista_or_later, True, "services-vista-x64"),
|
||||
(versions.is_vista_or_later, False, "services-vista-x86"),
|
||||
(versions.is_windows_xp, False, "services-xp-x86"),
|
||||
(versions.is_xp_or_2003, True, "services-xp-2003-x64"),
|
||||
]
|
||||
|
||||
@staticmethod
|
||||
def create_service_table(
|
||||
context: interfaces.context.ContextInterface,
|
||||
@@ -78,67 +125,14 @@ class SvcScan(interfaces.plugins.PluginInterface):
|
||||
native_types = context.symbol_space[symbol_table].natives
|
||||
is_64bit = symbols.symbol_table_is_64bit(context, symbol_table)
|
||||
|
||||
if (
|
||||
versions.is_windows_xp(context=context, symbol_table=symbol_table)
|
||||
and not is_64bit
|
||||
):
|
||||
symbol_filename = "services-xp-x86"
|
||||
elif (
|
||||
versions.is_xp_or_2003(context=context, symbol_table=symbol_table)
|
||||
and is_64bit
|
||||
):
|
||||
symbol_filename = "services-xp-2003-x64"
|
||||
elif (
|
||||
versions.is_win10_16299_or_later(context=context, symbol_table=symbol_table)
|
||||
and is_64bit
|
||||
):
|
||||
symbol_filename = "services-win10-16299-x64"
|
||||
elif (
|
||||
versions.is_win10_16299_or_later(context=context, symbol_table=symbol_table)
|
||||
and not is_64bit
|
||||
):
|
||||
symbol_filename = "services-win10-16299-x86"
|
||||
elif (
|
||||
versions.is_win10_up_to_15063(context=context, symbol_table=symbol_table)
|
||||
and is_64bit
|
||||
):
|
||||
symbol_filename = "services-win8-x64"
|
||||
elif (
|
||||
versions.is_win10_up_to_15063(context=context, symbol_table=symbol_table)
|
||||
and not is_64bit
|
||||
):
|
||||
symbol_filename = "services-win8-x86"
|
||||
elif (
|
||||
versions.is_win10_15063(context=context, symbol_table=symbol_table)
|
||||
and is_64bit
|
||||
):
|
||||
symbol_filename = "services-win10-15063-x64"
|
||||
elif (
|
||||
versions.is_win10_15063(context=context, symbol_table=symbol_table)
|
||||
and not is_64bit
|
||||
):
|
||||
symbol_filename = "services-win10-15063-x86"
|
||||
elif (
|
||||
versions.is_windows_8_or_later(context=context, symbol_table=symbol_table)
|
||||
and is_64bit
|
||||
):
|
||||
symbol_filename = "services-win8-x64"
|
||||
elif (
|
||||
versions.is_windows_8_or_later(context=context, symbol_table=symbol_table)
|
||||
and not is_64bit
|
||||
):
|
||||
symbol_filename = "services-win8-x86"
|
||||
elif (
|
||||
versions.is_vista_or_later(context=context, symbol_table=symbol_table)
|
||||
and is_64bit
|
||||
):
|
||||
symbol_filename = "services-vista-x64"
|
||||
elif (
|
||||
versions.is_vista_or_later(context=context, symbol_table=symbol_table)
|
||||
and not is_64bit
|
||||
):
|
||||
symbol_filename = "services-vista-x86"
|
||||
else:
|
||||
try:
|
||||
symbol_filename = next(
|
||||
filename
|
||||
for version_check, for_64bit, filename in SvcScan._win_version_file_map
|
||||
if is_64bit == for_64bit
|
||||
and version_check(context=context, symbol_table=symbol_table)
|
||||
)
|
||||
except StopIteration:
|
||||
raise NotImplementedError("This version of Windows is not supported!")
|
||||
|
||||
return intermed.IntermediateSymbolTable.create(
|
||||
@@ -150,6 +144,94 @@ class SvcScan(interfaces.plugins.PluginInterface):
|
||||
native_types=native_types,
|
||||
)
|
||||
|
||||
def _get_service_key(self, kernel) -> Optional[objects.StructType]:
|
||||
for hive in hivelist.HiveList.list_hives(
|
||||
context=self.context,
|
||||
base_config_path=interfaces.configuration.path_join(
|
||||
self.config_path, "hivelist"
|
||||
),
|
||||
layer_name=kernel.layer_name,
|
||||
symbol_table=kernel.symbol_table_name,
|
||||
filter_string="machine\\system",
|
||||
):
|
||||
# Get ControlSet\Services.
|
||||
try:
|
||||
return cast(
|
||||
objects.StructType, hive.get_key(r"CurrentControlSet\Services")
|
||||
)
|
||||
except (KeyError, exceptions.InvalidAddressException):
|
||||
try:
|
||||
return cast(
|
||||
objects.StructType, hive.get_key(r"ControlSet001\Services")
|
||||
)
|
||||
except (KeyError, exceptions.InvalidAddressException):
|
||||
vollog.log(
|
||||
constants.LOGLEVEL_VVVV,
|
||||
"Could not retrieve any control set from SYSTEM hive",
|
||||
)
|
||||
|
||||
return None
|
||||
|
||||
@staticmethod
|
||||
def _get_service_dll(
|
||||
service_key,
|
||||
) -> Union[str, interfaces.renderers.BaseAbsentValue]:
|
||||
try:
|
||||
param_key = next(
|
||||
key
|
||||
for key in service_key.get_subkeys()
|
||||
if key.get_name() == "Parameters"
|
||||
)
|
||||
return (
|
||||
next(
|
||||
val
|
||||
for val in param_key.get_values()
|
||||
if val.get_name() == "ServiceDll"
|
||||
)
|
||||
.decode_data()
|
||||
.decode("utf-16")
|
||||
.rstrip("\x00")
|
||||
)
|
||||
|
||||
except UnicodeDecodeError:
|
||||
return renderers.UnparsableValue()
|
||||
except StopIteration:
|
||||
return renderers.UnreadableValue()
|
||||
|
||||
@staticmethod
|
||||
def _get_service_binary(
|
||||
service_key,
|
||||
) -> Union[str, interfaces.renderers.BaseAbsentValue]:
|
||||
try:
|
||||
return (
|
||||
next(
|
||||
val
|
||||
for val in service_key.get_values()
|
||||
if val.get_name() == "ImagePath"
|
||||
)
|
||||
.decode_data()
|
||||
.decode("utf-16")
|
||||
.rstrip("\x00")
|
||||
)
|
||||
|
||||
except UnicodeDecodeError:
|
||||
return renderers.UnparsableValue()
|
||||
except StopIteration:
|
||||
return renderers.UnreadableValue()
|
||||
|
||||
@staticmethod
|
||||
def _get_service_binary_map(
|
||||
services_key: interfaces.objects.ObjectInterface,
|
||||
) -> Dict[str, ServiceBinaryInfo]:
|
||||
services = services_key.get_subkeys()
|
||||
return {
|
||||
service_key.get_name(): ServiceBinaryInfo(
|
||||
SvcScan._get_service_dll(service_key),
|
||||
SvcScan._get_service_binary(service_key),
|
||||
)
|
||||
for service_key in services
|
||||
}
|
||||
|
||||
def _generator(self):
|
||||
kernel = self.context.modules[self.config["kernel"]]
|
||||
|
||||
@@ -157,6 +239,15 @@ class SvcScan(interfaces.plugins.PluginInterface):
|
||||
self.context, kernel.symbol_table_name, self.config_path
|
||||
)
|
||||
|
||||
# Building the dictionary ahead of time is much better for performance
|
||||
# vs looking up each service's DLL individually.
|
||||
services_key = self._get_service_key(kernel)
|
||||
service_binary_dll_map = (
|
||||
self._get_service_binary_map(services_key)
|
||||
if services_key is not None
|
||||
else {}
|
||||
)
|
||||
|
||||
relative_tag_offset = self.context.symbol_space.get_type(
|
||||
service_table_name + constants.BANG + "_SERVICE_RECORD"
|
||||
).relative_child_offset("Tag")
|
||||
@@ -209,7 +300,16 @@ class SvcScan(interfaces.plugins.PluginInterface):
|
||||
if not service_record.is_valid():
|
||||
continue
|
||||
|
||||
yield (0, self.get_record_tuple(service_record))
|
||||
service_info = service_binary_dll_map.get(
|
||||
service_record.get_name(),
|
||||
ServiceBinaryInfo(
|
||||
renderers.UnreadableValue(), renderers.UnreadableValue()
|
||||
),
|
||||
)
|
||||
yield (
|
||||
0,
|
||||
self.get_record_tuple(service_record, service_info),
|
||||
)
|
||||
else:
|
||||
service_header = self.context.object(
|
||||
service_table_name + constants.BANG + "_SERVICE_HEADER",
|
||||
@@ -227,7 +327,16 @@ class SvcScan(interfaces.plugins.PluginInterface):
|
||||
if service_record in seen:
|
||||
break
|
||||
seen.append(service_record)
|
||||
yield (0, self.get_record_tuple(service_record))
|
||||
service_info = service_binary_dll_map.get(
|
||||
service_record.get_name(),
|
||||
ServiceBinaryInfo(
|
||||
renderers.UnreadableValue(), renderers.UnreadableValue()
|
||||
),
|
||||
)
|
||||
yield (
|
||||
0,
|
||||
self.get_record_tuple(service_record, service_info),
|
||||
)
|
||||
|
||||
def run(self):
|
||||
return renderers.TreeGrid(
|
||||
@@ -241,6 +350,8 @@ class SvcScan(interfaces.plugins.PluginInterface):
|
||||
("Name", str),
|
||||
("Display", str),
|
||||
("Binary", str),
|
||||
("Binary (Registry)", str),
|
||||
("Dll", str),
|
||||
],
|
||||
self._generator(),
|
||||
)
|
||||
|
||||
@@ -0,0 +1,248 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 8
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 20
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 48
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 160
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 44
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 160
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 52
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 156
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,255 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 8,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 40
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 40
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 64
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 240
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 76
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 240
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 72
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 32
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 248
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,248 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 8
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 20
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 48
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 164
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 44
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 164
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 52
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 156
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,255 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 8,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 40
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 40
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 64
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 296
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 76
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 296
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 72
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 32
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 296
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "David McDonald",
|
||||
"datetime": "2023-11-16T15:05:35-06:00"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,248 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 4
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 8
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 20
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 12
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 48
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 192
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 12
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 44
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 192
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 52
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 20
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 192
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "vtypes_to_json.py",
|
||||
"datetime": "2019-04-17T13:45:16.417006"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,255 @@
|
||||
{
|
||||
"symbols": {},
|
||||
"enums": {
|
||||
"StateEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_START_PENDING": 2,
|
||||
"SERVICE_STOP_PENDING": 3,
|
||||
"SERVICE_STOPPED": 1,
|
||||
"SERVICE_CONTINUE_PENDING": 5,
|
||||
"SERVICE_PAUSE_PENDING": 6,
|
||||
"SERVICE_PAUSED": 7,
|
||||
"SERVICE_RUNNING": 4
|
||||
},
|
||||
"size": 4
|
||||
},
|
||||
"StartEnum": {
|
||||
"base": "long",
|
||||
"constants": {
|
||||
"SERVICE_DEMAND_START": 3,
|
||||
"SERVICE_AUTO_START": 2,
|
||||
"SERVICE_BOOT_START": 0,
|
||||
"SERVICE_DISABLED": 4,
|
||||
"SERVICE_SYSTEM_START": 1
|
||||
},
|
||||
"size": 4
|
||||
}
|
||||
},
|
||||
"base_types": {
|
||||
"unsigned long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned char": {
|
||||
"kind": "char",
|
||||
"size": 1,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"pointer": {
|
||||
"kind": "int",
|
||||
"size": 8,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned int": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"unsigned short": {
|
||||
"kind": "int",
|
||||
"size": 2,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
},
|
||||
"long": {
|
||||
"kind": "int",
|
||||
"size": 4,
|
||||
"signed": false,
|
||||
"endian": "little"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"_SERVICE_LIST_ENTRY": {
|
||||
"fields": {
|
||||
"Flink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Blink": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
}
|
||||
},
|
||||
"offset": 0
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_PROCESS": {
|
||||
"fields": {
|
||||
"BinaryPath": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 24
|
||||
},
|
||||
"ProcessId": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 40
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 40
|
||||
},
|
||||
"_SERVICE_HEADER": {
|
||||
"fields": {
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"ServiceRecord": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 16
|
||||
},
|
||||
"_SERVICE_RECORD": {
|
||||
"fields": {
|
||||
"ServiceList": {
|
||||
"type": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_LIST_ENTRY"
|
||||
},
|
||||
"offset": 0
|
||||
},
|
||||
"Tag": {
|
||||
"type": {
|
||||
"count": 4,
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned char"
|
||||
},
|
||||
"kind": "array"
|
||||
},
|
||||
"offset": 32
|
||||
},
|
||||
"DisplayName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 64
|
||||
},
|
||||
"ServiceProcess": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_PROCESS"
|
||||
}
|
||||
},
|
||||
"offset": 336
|
||||
},
|
||||
"PrevEntry": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "struct",
|
||||
"name": "_SERVICE_RECORD"
|
||||
}
|
||||
},
|
||||
"offset": 16
|
||||
},
|
||||
"Start": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StartEnum"
|
||||
},
|
||||
"offset": 36
|
||||
},
|
||||
"State": {
|
||||
"type": {
|
||||
"kind": "enum",
|
||||
"name": "StateEnum"
|
||||
},
|
||||
"offset": 84
|
||||
},
|
||||
"ServiceName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 56
|
||||
},
|
||||
"DriverName": {
|
||||
"type": {
|
||||
"kind": "pointer",
|
||||
"subtype": {
|
||||
"kind": "base",
|
||||
"name": "unsigned short"
|
||||
}
|
||||
},
|
||||
"offset": 296
|
||||
},
|
||||
"Type": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned long"
|
||||
},
|
||||
"offset": 80
|
||||
},
|
||||
"Order": {
|
||||
"type": {
|
||||
"kind": "base",
|
||||
"name": "unsigned int"
|
||||
},
|
||||
"offset": 32
|
||||
}
|
||||
},
|
||||
"kind": "struct",
|
||||
"size": 336
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"producer": {
|
||||
"version": "0.0.1",
|
||||
"name": "David McDonald",
|
||||
"datetime": "2023-11-16T15:05:35-06:00"
|
||||
},
|
||||
"format": "4.1.0"
|
||||
}
|
||||
}
|
||||
@@ -151,11 +151,45 @@ is_win10_16299_or_later = OsDistinguisher(
|
||||
],
|
||||
)
|
||||
|
||||
is_win10_17763_or_later = OsDistinguisher(
|
||||
version_check=lambda x: x >= (10, 0, 17763),
|
||||
fallback_checks=[
|
||||
("_EPROCESS", "TrustletIdentity", False),
|
||||
("ParentSecurityDomain", None, True),
|
||||
],
|
||||
)
|
||||
|
||||
is_win10_18362_or_later = OsDistinguisher(
|
||||
version_check=lambda x: x >= (10, 0, 18362),
|
||||
fallback_checks=[
|
||||
("ObHeaderCookie", None, True),
|
||||
("_CM_CACHED_VALUE_INDEX", None, False),
|
||||
("_WNF_PROCESS_CONTEXT", None, True),
|
||||
],
|
||||
)
|
||||
|
||||
is_win10_18363_or_later = OsDistinguisher(
|
||||
version_check=lambda x: x >= (10, 0, 18363),
|
||||
fallback_checks=[("_KQOS_GROUPING_SETS", None, True)],
|
||||
)
|
||||
|
||||
is_win10_19041_or_later = OsDistinguisher(
|
||||
version_check=lambda x: x >= (10, 0, 19041),
|
||||
fallback_checks=[
|
||||
("_EPROCESS", "TimerResolutionIgnore", True),
|
||||
("_EPROCESS", "VmProcessorHostTransition", True),
|
||||
("_KQOS_GROUPING_SETS", None, True),
|
||||
],
|
||||
)
|
||||
|
||||
is_win10_25398_or_later = OsDistinguisher(
|
||||
version_check=lambda x: x >= (10, 0, 25398),
|
||||
fallback_checks=[
|
||||
("_EPROCESS", "MmSlabIdentity", True),
|
||||
("_EPROCESS", "EnableProcessImpersonationLogging", True),
|
||||
],
|
||||
)
|
||||
|
||||
is_windows_10 = OsDistinguisher(
|
||||
version_check=lambda x: x >= (10, 0),
|
||||
fallback_checks=[("ObHeaderCookie", None, True)],
|
||||
|
||||
Reference in New Issue
Block a user