#pragma once

#include <stdbool.h>

#include <stdint.h>

#include <assert.h>

#include <linux/limits.h>

#include <ctype.h>

typedef long unsigned int size_t;

#if !defined TRUE

#define TRUE true

#if !defined FALSE

#define FALSE false

#define CONST const

#define VOID void

typedef VOID *PVOID, *LPVOID;

typedef bool BOOL, *PBOOL;

typedef bool BOOLEAN;

typedef char CHAR, *PCHAR, *LPCH, *PCH, INT8;

typedef CONST CHAR *LPCCH, *PCCH;

typedef CHAR *NPSTR, *LPSTR, *PSTR;

typedef PSTR *PZPSTR;

typedef CONST PSTR *PCZPSTR;

typedef CONST CHAR *LPCSTR, *PCSTR;

typedef PCSTR *PZPCSTR;

typedef CHAR *PZZSTR;

typedef CONST CHAR *PCZZSTR;

typedef CHAR *PNZCH;

typedef CONST CHAR *PCNZCH;

typedef unsigned char UCHAR, *PUCHAR, UINT8;

typedef uint8_t BYTE, *PBYTE;

typedef short SHORT, *PSHORT, INT16;

typedef unsigned short USHORT, *PUSHORT, UINT16;

typedef unsigned short WORD;

typedef int INT;

typedef unsigned int UINT;

typedef uint32_t DWORD, *PDWORD, *UINT_PTR;

typedef int32_t LONG, *PLONG, INT32;

typedef uint32_t ULONG, *PULONG, *ULONG_PTR, UINT32;

typedef int64_t INT64, LONGLONG;

typedef uint64_t ULONG64, UINT64, ULONGLONG, *PULONGLONG, DWORD64;

typedef int errno_t;

typedef uint32_t NTSTATUS;

typedef size_t SIZE_T, *PSIZE_T;

typedef uint64_t SID, *PSID;

typedef uint64_t SERVICE_STATUS;

typedef uint64_t SERVICE_STATUS_HANDLE;

typedef uint32_t HRESULT;

typedef PVOID SRWLOCK, *PSRWLOCK;

typedef PVOID HANDLE, *PHANDLE, HMODULE, REGHANDLE;

typedef HANDLE HKEY;

#define ANYSIZE_ARRAY 1

#define __stdcall

#define WINAPI

#define _In_

#define _Inout_

#define _Out_

#define _Outptr_

#define _In_opt_

#define _Inout_opt_

#define _Out_opt_

#define _Outptr_opt_

#define _In_reads_(s)

#define _In_reads_opt_(s)

#define MAX_PATH PATH_MAX

typedef HANDLE EVT_HANDLE;

typedef HANDLE* PEVT_HANDLE;

typedef HANDLE EVT_OBJECT_ARRAY_PROPERTY_HANDLE;

typedef unsigned short WCHAR; // wc, 16-bit UNICODE character

typedef WCHAR *PWCHAR, *LPWCH, *PWCH;

typedef CONST WCHAR *LPCWCH, *PCWCH;

typedef WCHAR *NWPSTR, *LPWSTR, *PWSTR;

typedef PWSTR *PZPWSTR;

typedef CONST PWSTR *PCZPWSTR;

typedef WCHAR *LPUWSTR, *PUWSTR;

typedef CONST WCHAR *LPCWSTR, *PCWSTR;

typedef PCWSTR *PZPCWSTR;

typedef CONST WCHAR *LPCUWSTR, *PCUWSTR;

typedef WCHAR *PZZWSTR;

typedef CONST WCHAR *PCZZWSTR;

typedef WCHAR *PUZZWSTR;

typedef CONST WCHAR *PCUZZWSTR;

typedef WCHAR *PNZWCH;

typedef CONST WCHAR *PCNZWCH;

typedef WCHAR *PUNZWCH;

typedef CONST WCHAR *PCUNZWCH;

typedef CONST WCHAR *LPCWCHAR, *PCWCHAR;

typedef CONST WCHAR *LPCUWCHAR, *PCUWCHAR;

typedef WCHAR *LPOLESTR;

typedef unsigned long UCSCHAR;

#define UCSCHAR_INVALID_CHARACTER (0xffffffff)

#define MIN_UCSCHAR (0)

#define MAX_UCSCHAR (0x0010FFFF)

typedef UCSCHAR *PUCSCHAR;

typedef const UCSCHAR *PCUCSCHAR;

typedef UCSCHAR *PUCSSTR;

typedef UCSCHAR *PUUCSSTR;

typedef const UCSCHAR *PCUCSSTR;

typedef const UCSCHAR *PCUUCSSTR;

typedef UCSCHAR *PUUCSCHAR;

typedef const UCSCHAR *PCUUCSCHAR;

typedef char TCHAR, *PTCHAR;

typedef unsigned char TBYTE, *PTBYTE;

typedef LPCH LPTCH, PTCH;

typedef LPCCH LPCTCH, PCTCH;

typedef LPSTR PTSTR, LPTSTR, PUTSTR, LPUTSTR;

typedef LPCSTR PCTSTR, LPCTSTR, PCUTSTR, LPCUTSTR;

typedef PZZSTR PZZTSTR, PUZZTSTR;

typedef PCZZSTR PCZZTSTR, PCUZZTSTR;

typedef PNZCH PNZTCH, PUNZTCH;

typedef PCNZCH PCNZTCH, PCUNZTCH;

#define __TEXT(quote) quote

#define TEXT(quote) __TEXT(quote)

#define _T(x) x

typedef struct {

SHORT X;

SHORT Y;

} COORD, *PCOORD;

typedef struct {

COORD dwSize;

} CONSOLE_SCREEN_BUFFER_INFO, *PCONSOLE_SCREEN_BUFFER_INFO;

#define S_OK 0

#define E_ABORT 0x80004004

#define E_ACCESSDENIED 0x80070005

#define E_FAIL 0x80004005

#define E_HANDLE 0x80070006

#define E_INVALIDARG 0x80070057

#define E_NOINTERFACE 0x80004002

#define E_NOTIMPL 0x80004001

#define E_OUTOFMEMORY 0x8007000E

#define E_POINTER 0x80004003

#define E_UNEXPECTED 0x8000FFFF

#define ERROR_SUCCESS 0L

#define ERROR_FILE_NOT_FOUND 2L

#define ERROR_INVALID_BLOCK 9L

#define ERROR_INVALID_DATA 13L

#define ERROR_OUTOFMEMORY 14L

#define ERROR_INVALID_PARAMETER 87L

#define ERROR_BUFFER_OVERFLOW 111L

#define ERROR_INSUFFICIENT_BUFFER 122L

#define ERROR_NO_MATCH 1169L

#define ERROR_ELEVATION_REQUIRED 740L

#if defined DEBUG || defined _DEBUG

#define D_ASSERT(x) assert(x)

#define D_ASSERT(x)

#define _ASSERT(x) assert(x)

#define FAILED(hr) (((HRESULT)(hr)) < 0)

#define SUCCEEDED(hr) (((HRESULT)(hr)) >= 0)

#define _countof(_x) (sizeof(_x)/sizeof(*_x))

#define ARRAYSIZE(_x) (sizeof(_x)/sizeof(*_x))

#define _tstoi(a) atoi(a)

#define _istalnum(a) isalnum(a)

#define _tcscpy(a,b) strcpy(a,b)

#define _tcsncpy(a,b,c) strncpy(a,b,c)

#define _tcsncpy_s(a,b,c,_TRUNCATE) snprintf(a,b,"%s",c)

#define _tcsdup(x) strdup(x)

#define _tcslen(x) strlen(x)

#define _tcsicmp(a,b) strcasecmp(a,b)

#define _tcscmp(a,b) strcmp(a,b)

#define _tcsnicmp(a,b,c) strncasecmp(a,b,c)

#define _tcsncmp(a,b,c) strncmp(a,b,c)

#define _tcschr(a,b) strchr(a,b)

#define _tcsrchr(a,b) strrchr(a,b)

#define _tcstoul(a,b,c) strtoul(a,b,c)

#define _tcsstr(a,b) strstr(a,b)

#define _tcsncat_s(a,b,c,_TRUNCATE) strncat(a,b,c)

#define _tcstok_s(a,b,c) strtok_r(a,b,c)

#define _fputts(a,b) fputs(a,b)

#define _fputtc(a,b) fputc(a,b)

#define _fgetts(a,b,c) fgets(a,b,c)

#define _ftprintf(...) fprintf(__VA_ARGS__)

#define _ftprintf_s(...) fprintf(__VA_ARGS__)

#define _tprintf(...) printf(__VA_ARGS__)

#define _tprintf_s(...) printf(__VA_ARGS__)

#define _stprintf(...) sprintf(__VA_ARGS__)

#define _stprintf_s(...) snprintf(__VA_ARGS__)

#define _sntprintf(...) snprintf(__VA_ARGS__)

#define _sntprintf_s(a,b,c,...) snprintf(a,b,__VA_ARGS__)

#define _tfopen(a,b) fopen(a,b)

#define _tstat(a,b) stat(a,b)

#define ZeroMemory(Destination,Length) memset((Destination),0,(Length))

#define Sleep(a) usleep(a * 1000)

#define __fallthrough __attribute__((fallthrough))

#define FIELD_OFFSET(a,b) offsetof(a,b)

#define CONTAINING_RECORD(address, type, field) ((type *)( \

(PCHAR)(address) - \

(PCHAR)(ULONG_PTR)(&((type *)0)->field)))

#define NT_SUCCESS(x) (((uint32_t)x) < 0x40000000 ? TRUE : FALSE)

typedef enum _EVT_LOGIN_CLASS {

EvtRpcLogin

} EVT_LOGIN_CLASS;

typedef enum _EVT_PUBLISHER_METADATA_PROPERTY_ID {

} EVT_PUBLISHER_METADATA_PROPERTY_ID;

typedef struct _LIST_ENTRY {

struct _LIST_ENTRY *Flink;

struct _LIST_ENTRY *Blink;

} LIST_ENTRY, *PLIST_ENTRY, PRLIST_ENTRY;

typedef union _LARGE_INTEGER {

struct {

DWORD LowPart;

LONG HighPart;

};

LONGLONG QuadPart;

} LARGE_INTEGER, *PLARGE_INTEGER;

typedef struct {

DWORD LowPart;

LONG HighPart;

} LUID, *PLUID;

typedef struct _SYSTEMTIME {

} SYSTEMTIME, *PSYSTEMTIME, *LPSYSTEMTIME;

typedef struct {

ULONG Data1;

USHORT Data2;

USHORT Data3;

UCHAR Data4[8];

} GUID, *PGUID, IID, *PIID, *REFGUID;

typedef CONST GUID *LPCGUID;

typedef struct _FILETIME {

DWORD dwLowDateTime;

DWORD dwHighDateTime;

} FILETIME, *PFILETIME, *LPFILETIME;

typedef struct _EVT_VARIANT {

} EVT_VARIANT, *PEVT_VARIANT;

typedef struct {

USHORT Id;

UCHAR Version;

UCHAR Channel;

UCHAR Level;

UCHAR Opcode;

USHORT Task;

ULONGLONG Keyword;

} EVENT_DESCRIPTOR, *PEVENT_DESCRIPTOR;

typedef CONST EVENT_DESCRIPTOR *PCEVENT_DESCRIPTOR;

typedef struct _EVENT_DATA_DESCRIPTOR {

} EVENT_DATA_DESCRIPTOR, *PEVENT_DATA_DESCRIPTOR;

typedef struct _EVENT_FILTER_DESCRIPTOR {

} EVENT_FILTER_DESCRIPTOR, *PEVENT_FILTER_DESCRIPTOR;

typedef void (*PENABLECALLBACK)(

LPCGUID SourceId,

ULONG IsEnabled,

UCHAR Level,

ULONGLONG MatchAnyKeyword,

ULONGLONG MatchAllKeyword,

PEVENT_FILTER_DESCRIPTOR FilterData,

PVOID CallbackContext

);

typedef struct _RTL_BUFFER

} RTL_BUFFER, *PRTL_BUFFER;

typedef struct _UNICODE_STRING {

} UNICODE_STRING, *PUNICODE_STRING;

typedef struct _RTL_UNICODE_STRING_BUFFER

} RTL_UNICODE_STRING_BUFFER, *PRTL_UNICODE_STRING_BUFFER;

typedef struct _OSVERSIONINFOA {

} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA,

OSVERSIONINFO, *POSVERSIONINFO, *LPOSVERSIONINFO;

#define MAX_MODULE_NAME32 255

typedef struct tagMODULEENTRY32 {

} MODULEENTRY32;

typedef struct _LSA_UNICODE_STRING {

} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;

typedef struct _LSA_LAST_INTER_LOGON_INFO {

} LSA_LAST_INTER_LOGON_INFO, *PLSA_LAST_INTER_LOGON_INFO;

typedef struct _SECURITY_LOGON_SESSION_DATA {

} SECURITY_LOGON_SESSION_DATA, *PSECURITY_LOGON_SESSION_DATA;

#define LinuxFileOpen 0xFF01

#define LinuxNetworkEvent 0xFF02

#define __NR_NETWORK 400

#define __NR_PROCTERM 401

#define __NR_RAWACCESS 402

#define __NR_CREATE 403

typedef enum {

LINUX_FO_Sid,

LINUX_FO_ImagePath,

LINUX_FO_PathName,

LINUX_FO_Dir,

LINUX_FILE_OPEN_ExtMax

} LINUX_FILE_OPEN_Extensions;

typedef struct {

ULONGLONG tv_sec;

ULONG tv_nsec;

} my_statx_timestamp;

typedef struct {

ULONG m_ProcessId;

LARGE_INTEGER m_EventTime;

ULONG m_Flags;

ULONG m_Mode;

my_statx_timestamp m_atime;

my_statx_timestamp m_mtime;

my_statx_timestamp m_ctime;

ULONG m_Extensions[LINUX_FILE_OPEN_ExtMax];

} SYSMON_LINUX_FILE_OPEN, *PSYSMON_LINUX_FILE_OPEN;

typedef struct {

ULONG m_ProcessId;

LARGE_INTEGER m_EventTime;

CONST VOID* m_SockId;

bool m_AddrIsIPv4;

BYTE m_SrcAddr[16];

BYTE m_DstAddr[16];

WORD m_SrcPort;

WORD m_DstPort;

bool m_IsTCP;

ULONG m_OldState;

ULONG m_NewState;

} SYSMON_LINUX_NETWORK_EVENT, *PSYSMON_LINUX_NETWORK_EVENT;