/*
SysmonForLinux
Copyright (c) Microsoft Corporation
All rights reserved.
MIT License
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the ""Software""), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*/
//====================================================================
//
// linuxTypes.h
//
// Defines and typedefs to map to Windows types.
//
//====================================================================
#pragma once
#include
#include
#include
#include
#include
typedef long unsigned int size_t;
//
// Basics
//
#if !defined TRUE
#define TRUE true
#endif
#if !defined FALSE
#define FALSE false
#endif
#define CONST const
#define VOID void
typedef VOID *PVOID, *LPVOID;
typedef bool BOOL, *PBOOL;
typedef bool BOOLEAN;
typedef char CHAR, *PCHAR, *LPCH, *PCH, INT8;
typedef CONST CHAR *LPCCH, *PCCH;
typedef CHAR *NPSTR, *LPSTR, *PSTR;
typedef PSTR *PZPSTR;
typedef CONST PSTR *PCZPSTR;
typedef CONST CHAR *LPCSTR, *PCSTR;
typedef PCSTR *PZPCSTR;
typedef CHAR *PZZSTR;
typedef CONST CHAR *PCZZSTR;
typedef CHAR *PNZCH;
typedef CONST CHAR *PCNZCH;
typedef unsigned char UCHAR, *PUCHAR, UINT8;
typedef uint8_t BYTE, *PBYTE;
typedef short SHORT, *PSHORT, INT16;
typedef unsigned short USHORT, *PUSHORT, UINT16;
typedef unsigned short WORD;
typedef int INT;
typedef unsigned int UINT;
typedef uint32_t DWORD, *PDWORD, *UINT_PTR;
typedef int32_t LONG, *PLONG, INT32;
typedef uint32_t ULONG, *PULONG, *ULONG_PTR, UINT32;
typedef int64_t INT64, LONGLONG;
typedef uint64_t ULONG64, UINT64, ULONGLONG, *PULONGLONG, DWORD64;
typedef int errno_t;
typedef uint32_t NTSTATUS;
typedef size_t SIZE_T, *PSIZE_T;
typedef uint64_t SID, *PSID;
typedef uint64_t SERVICE_STATUS;
typedef uint64_t SERVICE_STATUS_HANDLE;
typedef uint32_t HRESULT;
typedef PVOID SRWLOCK, *PSRWLOCK;
typedef PVOID HANDLE, *PHANDLE, HMODULE, REGHANDLE;
typedef HANDLE HKEY;
//
// Windows compiler annotaions
//
#define ANYSIZE_ARRAY 1
#define __stdcall
#define WINAPI
#define _In_
#define _Inout_
#define _Out_
#define _Outptr_
#define _In_opt_
#define _Inout_opt_
#define _Out_opt_
#define _Outptr_opt_
#define _In_reads_(s)
#define _In_reads_opt_(s)
#define MAX_PATH PATH_MAX
typedef HANDLE EVT_HANDLE;
typedef HANDLE* PEVT_HANDLE;
typedef HANDLE EVT_OBJECT_ARRAY_PROPERTY_HANDLE;
//
// UNICODE (Wide Character) types
//
typedef unsigned short WCHAR; // wc, 16-bit UNICODE character
typedef WCHAR *PWCHAR, *LPWCH, *PWCH;
typedef CONST WCHAR *LPCWCH, *PCWCH;
typedef WCHAR *NWPSTR, *LPWSTR, *PWSTR;
typedef PWSTR *PZPWSTR;
typedef CONST PWSTR *PCZPWSTR;
typedef WCHAR *LPUWSTR, *PUWSTR;
typedef CONST WCHAR *LPCWSTR, *PCWSTR;
typedef PCWSTR *PZPCWSTR;
typedef CONST WCHAR *LPCUWSTR, *PCUWSTR;
typedef WCHAR *PZZWSTR;
typedef CONST WCHAR *PCZZWSTR;
typedef WCHAR *PUZZWSTR;
typedef CONST WCHAR *PCUZZWSTR;
typedef WCHAR *PNZWCH;
typedef CONST WCHAR *PCNZWCH;
typedef WCHAR *PUNZWCH;
typedef CONST WCHAR *PCUNZWCH;
typedef CONST WCHAR *LPCWCHAR, *PCWCHAR;
typedef CONST WCHAR *LPCUWCHAR, *PCUWCHAR;
typedef WCHAR *LPOLESTR;
//
// UCS (Universal Character Set) types
//
typedef unsigned long UCSCHAR;
#define UCSCHAR_INVALID_CHARACTER (0xffffffff)
#define MIN_UCSCHAR (0)
#define MAX_UCSCHAR (0x0010FFFF)
typedef UCSCHAR *PUCSCHAR;
typedef const UCSCHAR *PCUCSCHAR;
typedef UCSCHAR *PUCSSTR;
typedef UCSCHAR *PUUCSSTR;
typedef const UCSCHAR *PCUCSSTR;
typedef const UCSCHAR *PCUUCSSTR;
typedef UCSCHAR *PUUCSCHAR;
typedef const UCSCHAR *PCUUCSCHAR;
//
// Neutral ANSI/UNICODE types and macros
// Map tchar to char
//
typedef char TCHAR, *PTCHAR;
typedef unsigned char TBYTE, *PTBYTE;
typedef LPCH LPTCH, PTCH;
typedef LPCCH LPCTCH, PCTCH;
typedef LPSTR PTSTR, LPTSTR, PUTSTR, LPUTSTR;
typedef LPCSTR PCTSTR, LPCTSTR, PCUTSTR, LPCUTSTR;
typedef PZZSTR PZZTSTR, PUZZTSTR;
typedef PCZZSTR PCZZTSTR, PCUZZTSTR;
typedef PNZCH PNZTCH, PUNZTCH;
typedef PCNZCH PCNZTCH, PCUNZTCH;
#define __TEXT(quote) quote
#define TEXT(quote) __TEXT(quote)
#define _T(x) x
//
// Coord for console screen struct
//
typedef struct {
SHORT X;
SHORT Y;
} COORD, *PCOORD;
typedef struct {
COORD dwSize;
} CONSOLE_SCREEN_BUFFER_INFO, *PCONSOLE_SCREEN_BUFFER_INFO;
//
// Error codes
//
#define S_OK 0
#define E_ABORT 0x80004004
#define E_ACCESSDENIED 0x80070005
#define E_FAIL 0x80004005
#define E_HANDLE 0x80070006
#define E_INVALIDARG 0x80070057
#define E_NOINTERFACE 0x80004002
#define E_NOTIMPL 0x80004001
#define E_OUTOFMEMORY 0x8007000E
#define E_POINTER 0x80004003
#define E_UNEXPECTED 0x8000FFFF
#define ERROR_SUCCESS 0L
#define ERROR_FILE_NOT_FOUND 2L
#define ERROR_INVALID_BLOCK 9L
#define ERROR_INVALID_DATA 13L
#define ERROR_OUTOFMEMORY 14L
#define ERROR_INVALID_PARAMETER 87L
#define ERROR_BUFFER_OVERFLOW 111L
#define ERROR_INSUFFICIENT_BUFFER 122L
#define ERROR_NO_MATCH 1169L
#define ERROR_ELEVATION_REQUIRED 740L
#if defined DEBUG || defined _DEBUG
#define D_ASSERT(x) assert(x)
#else
#define D_ASSERT(x)
#endif
#define _ASSERT(x) assert(x)
#define FAILED(hr) (((HRESULT)(hr)) < 0)
#define SUCCEEDED(hr) (((HRESULT)(hr)) >= 0)
//
// Array macros
//
#define _countof(_x) (sizeof(_x)/sizeof(*_x))
#define ARRAYSIZE(_x) (sizeof(_x)/sizeof(*_x))
//
// Map tchar to char
//
#define _tstoi(a) atoi(a)
#define _istalnum(a) isalnum(a)
#define _tcscpy(a,b) strcpy(a,b)
#define _tcsncpy(a,b,c) strncpy(a,b,c)
#define _tcsncpy_s(a,b,c,_TRUNCATE) snprintf(a,b,"%s",c)
#define _tcsdup(x) strdup(x)
#define _tcslen(x) strlen(x)
#define _tcsicmp(a,b) strcasecmp(a,b)
#define _tcscmp(a,b) strcmp(a,b)
#define _tcsnicmp(a,b,c) strncasecmp(a,b,c)
#define _tcsncmp(a,b,c) strncmp(a,b,c)
#define _tcschr(a,b) strchr(a,b)
#define _tcsrchr(a,b) strrchr(a,b)
#define _tcstoul(a,b,c) strtoul(a,b,c)
#define _tcsstr(a,b) strstr(a,b)
#define _tcsncat_s(a,b,c,_TRUNCATE) strncat(a,b,c)
#define _tcstok_s(a,b,c) strtok_r(a,b,c)
#define _fputts(a,b) fputs(a,b)
#define _fputtc(a,b) fputc(a,b)
#define _fgetts(a,b,c) fgets(a,b,c)
#define _ftprintf(...) fprintf(__VA_ARGS__)
#define _ftprintf_s(...) fprintf(__VA_ARGS__)
#define _tprintf(...) printf(__VA_ARGS__)
#define _tprintf_s(...) printf(__VA_ARGS__)
#define _stprintf(...) sprintf(__VA_ARGS__)
#define _stprintf_s(...) snprintf(__VA_ARGS__)
#define _sntprintf(...) snprintf(__VA_ARGS__)
#define _sntprintf_s(a,b,c,...) snprintf(a,b,__VA_ARGS__)
#define _tfopen(a,b) fopen(a,b)
#define _tstat(a,b) stat(a,b)
#define ZeroMemory(Destination,Length) memset((Destination),0,(Length))
#define Sleep(a) usleep(a * 1000)
#define __fallthrough __attribute__((fallthrough))
#define FIELD_OFFSET(a,b) offsetof(a,b)
#define CONTAINING_RECORD(address, type, field) ((type *)( \
(PCHAR)(address) - \
(PCHAR)(ULONG_PTR)(&((type *)0)->field)))
#define NT_SUCCESS(x) (((uint32_t)x) < 0x40000000 ? TRUE : FALSE)
typedef enum _EVT_LOGIN_CLASS {
EvtRpcLogin
} EVT_LOGIN_CLASS;
typedef enum _EVT_PUBLISHER_METADATA_PROPERTY_ID {
EvtPublisherMetadataPublisherGuid,
EvtPublisherMetadataResourceFilePath,
EvtPublisherMetadataParameterFilePath,
EvtPublisherMetadataMessageFilePath,
EvtPublisherMetadataHelpLink,
EvtPublisherMetadataPublisherMessageID,
EvtPublisherMetadataChannelReferences,
EvtPublisherMetadataChannelReferencePath,
EvtPublisherMetadataChannelReferenceIndex,
EvtPublisherMetadataChannelReferenceID,
EvtPublisherMetadataChannelReferenceFlags,
EvtPublisherMetadataChannelReferenceMessageID,
EvtPublisherMetadataLevels,
EvtPublisherMetadataLevelName,
EvtPublisherMetadataLevelValue,
EvtPublisherMetadataLevelMessageID,
EvtPublisherMetadataTasks,
EvtPublisherMetadataTaskName,
EvtPublisherMetadataTaskEventGuid,
EvtPublisherMetadataTaskValue,
EvtPublisherMetadataTaskMessageID,
EvtPublisherMetadataOpcodes,
EvtPublisherMetadataOpcodeName,
EvtPublisherMetadataOpcodeValue,
EvtPublisherMetadataOpcodeMessageID,
EvtPublisherMetadataKeywords,
EvtPublisherMetadataKeywordName,
EvtPublisherMetadataKeywordValue,
EvtPublisherMetadataKeywordMessageID,
EvtPublisherMetadataPropertyIdEND
} EVT_PUBLISHER_METADATA_PROPERTY_ID;
typedef struct _LIST_ENTRY {
struct _LIST_ENTRY *Flink;
struct _LIST_ENTRY *Blink;
} LIST_ENTRY, *PLIST_ENTRY, PRLIST_ENTRY;
typedef union _LARGE_INTEGER {
struct {
DWORD LowPart;
LONG HighPart;
};
LONGLONG QuadPart;
} LARGE_INTEGER, *PLARGE_INTEGER;
typedef struct {
DWORD LowPart;
LONG HighPart;
} LUID, *PLUID;
typedef struct _SYSTEMTIME {
WORD wYear;
WORD wMonth;
WORD wDayOfWeek;
WORD wDay;
WORD wHour;
WORD wMinute;
WORD wSecond;
WORD wMilliseconds;
} SYSTEMTIME, *PSYSTEMTIME, *LPSYSTEMTIME;
typedef struct {
ULONG Data1;
USHORT Data2;
USHORT Data3;
UCHAR Data4[8];
} GUID, *PGUID, IID, *PIID, *REFGUID;
typedef CONST GUID *LPCGUID;
typedef struct _FILETIME {
DWORD dwLowDateTime;
DWORD dwHighDateTime;
} FILETIME, *PFILETIME, *LPFILETIME;
typedef struct _EVT_VARIANT {
union {
BOOL BooleanVal;
INT8 SByteVal;
INT16 Int16Val;
INT32 Int32Val;
INT64 Int64Val;
UINT8 ByteVal;
UINT16 UInt16Val;
UINT32 UInt32Val;
UINT64 UInt64Val;
float SingleVal;
double DoubleVal;
ULONGLONG FileTimeVal;
SYSTEMTIME *SysTimeVal;
GUID *GuidVal;
LPCWSTR StringVal;
LPCSTR AnsiStringVal;
PBYTE BinaryVal;
PSID SidVal;
size_t SizeTVal;
BOOL *BooleanArr;
INT8 *SByteArr;
INT16 *Int16Arr;
INT32 *Int32Arr;
INT64 *Int64Arr;
UINT8 *ByteArr;
UINT16 *UInt16Arr;
UINT32 *UInt32Arr;
UINT64 *UInt64Arr;
float *SingleArr;
double *DoubleArr;
FILETIME *FileTimeArr;
SYSTEMTIME *SysTimeArr;
GUID *GuidArr;
LPWSTR *StringArr;
LPSTR *AnsiStringArr;
PSID *SidArr;
size_t *SizeTArr;
EVT_HANDLE EvtHandleVal;
LPCWSTR XmlVal;
LPCWSTR *XmlValArr;
};
DWORD Count;
DWORD Type;
} EVT_VARIANT, *PEVT_VARIANT;
typedef struct {
USHORT Id;
UCHAR Version;
UCHAR Channel;
UCHAR Level;
UCHAR Opcode;
USHORT Task;
ULONGLONG Keyword;
} EVENT_DESCRIPTOR, *PEVENT_DESCRIPTOR;
typedef CONST EVENT_DESCRIPTOR *PCEVENT_DESCRIPTOR;
typedef struct _EVENT_DATA_DESCRIPTOR {
ULONGLONG Ptr;
ULONG Size;
union {
ULONG Reserved;
struct {
UCHAR Type;
UCHAR Reserved1;
USHORT Reserved2;
};
};
} EVENT_DATA_DESCRIPTOR, *PEVENT_DATA_DESCRIPTOR;
typedef struct _EVENT_FILTER_DESCRIPTOR {
ULONGLONG Ptr;
ULONG Size;
ULONG Type;
} EVENT_FILTER_DESCRIPTOR, *PEVENT_FILTER_DESCRIPTOR;
typedef void (*PENABLECALLBACK)(
LPCGUID SourceId,
ULONG IsEnabled,
UCHAR Level,
ULONGLONG MatchAnyKeyword,
ULONGLONG MatchAllKeyword,
PEVENT_FILTER_DESCRIPTOR FilterData,
PVOID CallbackContext
);
typedef struct _RTL_BUFFER
{
PUCHAR Buffer;
PUCHAR StaticBuffer;
SIZE_T Size;
SIZE_T StaticSize;
SIZE_T ReservedForAllocatedSize;
PVOID ReservedForIMalloc;
} RTL_BUFFER, *PRTL_BUFFER;
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _RTL_UNICODE_STRING_BUFFER
{
UNICODE_STRING String;
RTL_BUFFER ByteBuffer;
UCHAR MinimumStaticBufferForTerminalNul[sizeof(WCHAR)];
} RTL_UNICODE_STRING_BUFFER, *PRTL_UNICODE_STRING_BUFFER;
typedef struct _OSVERSIONINFOA {
DWORD dwOSVersionInfoSize;
DWORD dwMajorVersion;
DWORD dwMinorVersion;
DWORD dwBuildNumber;
DWORD dwPlatformId;
CHAR szCSDVersion[128];
} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA,
OSVERSIONINFO, *POSVERSIONINFO, *LPOSVERSIONINFO;
#define MAX_MODULE_NAME32 255
typedef struct tagMODULEENTRY32 {
DWORD dwSize;
DWORD th32ModuleID;
DWORD th32ProcessID;
DWORD GlblcntUsage;
DWORD ProccntUsage;
BYTE *modBaseAddr;
DWORD modBaseSize;
HMODULE hModule;
char szModule[MAX_MODULE_NAME32 + 1];
char szExePath[MAX_PATH];
} MODULEENTRY32;
typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
typedef struct _LSA_LAST_INTER_LOGON_INFO {
LARGE_INTEGER LastSuccessfulLogon;
LARGE_INTEGER LastFailedLogon;
ULONG FailedAttemptCountSinceLastSuccessfulLogon;
} LSA_LAST_INTER_LOGON_INFO, *PLSA_LAST_INTER_LOGON_INFO;
typedef struct _SECURITY_LOGON_SESSION_DATA {
ULONG Size;
LUID LogonId;
LSA_UNICODE_STRING UserName;
LSA_UNICODE_STRING LogonDomain;
LSA_UNICODE_STRING AuthenticationPackage;
ULONG LogonType;
ULONG Session;
PSID Sid;
LARGE_INTEGER LogonTime;
LSA_UNICODE_STRING LogonServer;
LSA_UNICODE_STRING DnsDomainName;
LSA_UNICODE_STRING Upn;
ULONG UserFlags;
LSA_LAST_INTER_LOGON_INFO LastLogonInfo;
LSA_UNICODE_STRING LogonScript;
LSA_UNICODE_STRING ProfilePath;
LSA_UNICODE_STRING HomeDirectory;
LSA_UNICODE_STRING HomeDirectoryDrive;
LARGE_INTEGER LogoffTime;
LARGE_INTEGER KickOffTime;
LARGE_INTEGER PasswordLastSet;
LARGE_INTEGER PasswordCanChange;
LARGE_INTEGER PasswordMustChange;
} SECURITY_LOGON_SESSION_DATA, *PSECURITY_LOGON_SESSION_DATA;
#define LinuxFileOpen 0xFF01
#define LinuxNetworkEvent 0xFF02
#define __NR_NETWORK 400
#define __NR_PROCTERM 401
#define __NR_RAWACCESS 402
#define __NR_CREATE 403
typedef enum {
LINUX_FO_Sid,
LINUX_FO_ImagePath,
LINUX_FO_PathName,
LINUX_FO_Dir,
LINUX_FILE_OPEN_ExtMax
} LINUX_FILE_OPEN_Extensions;
typedef struct {
ULONGLONG tv_sec;
ULONG tv_nsec;
} my_statx_timestamp;
typedef struct {
ULONG m_ProcessId;
LARGE_INTEGER m_EventTime;
ULONG m_Flags;
ULONG m_Mode;
my_statx_timestamp m_atime;
my_statx_timestamp m_mtime;
my_statx_timestamp m_ctime;
ULONG m_Extensions[LINUX_FILE_OPEN_ExtMax];
} SYSMON_LINUX_FILE_OPEN, *PSYSMON_LINUX_FILE_OPEN;
typedef struct {
ULONG m_ProcessId;
LARGE_INTEGER m_EventTime;
CONST VOID* m_SockId;
bool m_AddrIsIPv4;
BYTE m_SrcAddr[16];
BYTE m_DstAddr[16];
WORD m_SrcPort;
WORD m_DstPort;
bool m_IsTCP;
ULONG m_OldState;
ULONG m_NewState;
} SYSMON_LINUX_NETWORK_EVENT, *PSYSMON_LINUX_NETWORK_EVENT;