winummoduleblock.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#ifndef _WINUMMODULEBLOCK_H_
#define _WINUMMODULEBLOCK_H_

#include "winpe.h"

#define WINMODBLOCK_INVALID_VALUE               0xFFFFFFFF


typedef enum _WIN_MOD_BLOCK_FLAG
{
    winModBlockFlagUnloadAfterExec = 0x00000001u,   
    winModBlockFlagDoNotUnload = 0x00000002u,       
    winModBlockFlagKillOnError = 0x00000004u        
} WIN_MOD_BLOCK_FLAG;


typedef INTSTATUS
(*PFUNC_IntWinModBlockCallback)(
    _In_ WIN_PROCESS_MODULE *Module,
    _In_ void *BlockObject,
    _In_ QWORD DllHandle,
    _In_ QWORD Reason,
    _In_ QWORD Reserved,
    _In_ QWORD RetAddress,
    _Inout_ INTRO_ACTION *Action
    );

typedef INTSTATUS
(*PFUNC_IntWinModBlockHeadersCallback)(
    _Inout_ WIN_PROCESS_MODULE *Module,
    _In_ BYTE *Headers
    );

typedef INTSTATUS
(*PFUNC_IntWinModBlockCleanup)(
    _Inout_ WIN_PROCESS_MODULE *Module,
    _In_ const void *BlockObject
    );


INTSTATUS
IntWinModBlockBlockModuleLoad(
    _In_ WIN_PROCESS_MODULE *Module,
    _In_ WIN_MOD_BLOCK_FLAG Flags,
    _In_ PFUNC_IntWinModBlockCallback Callback,
    _In_opt_ PFUNC_IntWinModBlockHeadersCallback HeadersCallback,
    _In_opt_ PFUNC_IntWinModBlockCleanup CleanupCallback,
    _Inout_ void **BlockObject
    );


INTSTATUS
IntWinModBlockRegisterCallbackForReason(
    _In_ void *BlockObject,
    _In_ DWORD Reason,
    _In_ PFUNC_IntWinModBlockCallback Callback
    );


INTSTATUS
IntWinModBlockRemoveBlockObject(
    _Inout_ void *BlockObject
    );

#endif