57 lines
1.8 KiB
C
57 lines
1.8 KiB
C
// Native userspace PE32+ image-loader declarations.
|
|
|
|
#pragma once
|
|
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
#include <ntlite/status.h>
|
|
#include <ntlite/string_view.h>
|
|
#include <ntlite/handle.h>
|
|
|
|
#define NTL_PE_LOAD_FLAG_NONE 0x00000000u
|
|
|
|
typedef KSTATUS (*NTL_PE_IMPORT_RESOLVER)(void* context,
|
|
SYS_STRING_VIEW moduleName,
|
|
SYS_STRING_VIEW symbolName,
|
|
uintptr_t* addressOut);
|
|
|
|
typedef struct NTL_PE_IMAGE {
|
|
uintptr_t Base;
|
|
size_t Size;
|
|
uintptr_t EntryPoint;
|
|
uint64_t PreferredBase;
|
|
} NTL_PE_IMAGE;
|
|
|
|
typedef KSTATUS (*NTL_PE_PREPARED_CALLBACK)(void* context, const NTL_PE_IMAGE* image);
|
|
|
|
typedef struct NTL_PE_LOAD_REQUEST {
|
|
uint32_t Size;
|
|
SYS_HANDLE ProcessHandle;
|
|
SYS_HANDLE FileHandle;
|
|
uint32_t Flags;
|
|
NTL_PE_IMPORT_RESOLVER ResolveImport;
|
|
void* ResolveContext;
|
|
NTL_PE_PREPARED_CALLBACK Prepared;
|
|
void* PreparedContext;
|
|
NTL_PE_IMAGE* ImageOut;
|
|
} NTL_PE_LOAD_REQUEST;
|
|
|
|
#if defined(NTL_SYSCALL_STATIC)
|
|
#define NTL_SYSCALL_API
|
|
#elif defined(NTL_SYSCALL_BUILD)
|
|
#define NTL_SYSCALL_API __declspec(dllexport)
|
|
#else
|
|
#define NTL_SYSCALL_API
|
|
#endif
|
|
|
|
// Reads, validates, materializes, relocates, binds, and protects one AMD64 PE32+ image.
|
|
// ProcessHandle may be SYS_HANDLE_INVALID to target the current process. Dependency policy
|
|
// remains entirely in ResolveImport. Prepared runs after relocation and before import binding.
|
|
NTL_SYSCALL_API KSTATUS NtlLoadPeImage(const NTL_PE_LOAD_REQUEST* request);
|
|
|
|
// Resolves one named export directly from an already-materialized PE image. Forwarders and
|
|
// ordinal lookups are intentionally unsupported.
|
|
NTL_SYSCALL_API KSTATUS NtlGetPeExport(uintptr_t imageBase, SYS_STRING_VIEW name, uintptr_t* addressOut);
|
|
|
|
#undef NTL_SYSCALL_API
|