stdafx.h

#pragma once

// ============================================
// EtwTi-FluctuationMonitor v3.0
// 标准头文件
// ============================================

#include <winsock2.h>
#include <Windows.h>
#include <winsvc.h>
#define _WS2DEF_
#include <aclapi.h>
#include <processthreadsapi.h>
#include <Psapi.h>
#include <sddl.h>
#include <shellapi.h>
#include <Shlobj.h>
#include <Shlobj_core.h>
#include <strsafe.h>
#include <tchar.h>
#include <tlhelp32.h>
#include <winternl.h>

#include <stdio.h>

#include <cstdio>
#include <filesystem>
#include <iostream>
#include <string>
#include <string_view>
#include <unordered_map>
#include <set>
#include <mutex>
#include <atomic>
#include <thread>
#include <chrono>
#include <iomanip>
#include <sstream>
#include <vector>

#include "krabs.hpp"

// 包含驱动公共头文件
#include "drivers_mon/Public.h"

// ============================================
// NT 状态类型和宏
// ============================================
#ifndef NTSTATUS
typedef LONG NTSTATUS;
#endif

#ifndef NT_SUCCESS
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
#endif

// NTAPI 宏定义（如果未定义）
#ifndef NTAPI
#define NTAPI __stdcall
#endif

// ============================================
// 控制台颜色常量
// ============================================
constexpr auto COLOR_RED = 12;
constexpr auto COLOR_YELLOW = 14;
constexpr auto COLOR_GREEN = 10;
constexpr auto COLOR_CYAN = 11;
constexpr auto COLOR_WHITE = 15;

// ============================================
// 内存保护属性常量
// ============================================
constexpr auto PAGE_EXECUTE_ANY = PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY;
constexpr auto IsExecutable = [](DWORD Protection) { return 0 != (Protection & PAGE_EXECUTE_ANY); };

constexpr auto PAGE_WRITE_ANY = PAGE_READWRITE | PAGE_WRITECOPY | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY;
constexpr auto IsWritable = [](DWORD Protection) { return 0 != (Protection & PAGE_WRITE_ANY); };

// ============================================
// ETW-TI 关键字掩码定义
// ============================================
// 内存分配关键字
constexpr ULONG64 KEYWORD_ALLOCVM_LOCAL = 0x1;
constexpr ULONG64 KEYWORD_ALLOCVM_LOCAL_KERNEL_CALLER = 0x2;
constexpr ULONG64 KEYWORD_ALLOCVM_REMOTE = 0x4;
constexpr ULONG64 KEYWORD_ALLOCVM_REMOTE_KERNEL_CALLER = 0x8;

// 内存保护关键字
constexpr ULONG64 KEYWORD_PROTECTVM_LOCAL = 0x10;
constexpr ULONG64 KEYWORD_PROTECTVM_LOCAL_KERNEL_CALLER = 0x20;
constexpr ULONG64 KEYWORD_PROTECTVM_REMOTE = 0x40;
constexpr ULONG64 KEYWORD_PROTECTVM_REMOTE_KERNEL_CALLER = 0x80;

// 映射视图关键字
constexpr ULONG64 KEYWORD_MAPVIEW_LOCAL = 0x100;
constexpr ULONG64 KEYWORD_MAPVIEW_LOCAL_KERNEL_CALLER = 0x200;
constexpr ULONG64 KEYWORD_MAPVIEW_REMOTE = 0x400;
constexpr ULONG64 KEYWORD_MAPVIEW_REMOTE_KERNEL_CALLER = 0x800;

// APC关键字
constexpr ULONG64 KEYWORD_QUEUEUSERAPC_REMOTE = 0x1000;
constexpr ULONG64 KEYWORD_QUEUEUSERAPC_REMOTE_KERNEL_CALLER = 0x2000;

// 线程上下文关键字
constexpr ULONG64 KEYWORD_SETTHREADCONTEXT_REMOTE = 0x4000;
constexpr ULONG64 KEYWORD_SETTHREADCONTEXT_REMOTE_KERNEL_CALLER = 0x8000;

// 内存读写关键字
constexpr ULONG64 KEYWORD_READVM_LOCAL = 0x10000;
constexpr ULONG64 KEYWORD_READVM_REMOTE = 0x20000;
constexpr ULONG64 KEYWORD_WRITEVM_LOCAL = 0x40000;
constexpr ULONG64 KEYWORD_WRITEVM_REMOTE = 0x80000;

// 线程挂起/恢复关键字
constexpr ULONG64 KEYWORD_SUSPEND_THREAD = 0x100000;
constexpr ULONG64 KEYWORD_RESUME_THREAD = 0x200000;

// 进程挂起/恢复关键字
constexpr ULONG64 KEYWORD_SUSPEND_PROCESS = 0x400000;
constexpr ULONG64 KEYWORD_RESUME_PROCESS = 0x800000;
constexpr ULONG64 KEYWORD_FREEZE_PROCESS = 0x1000000;
constexpr ULONG64 KEYWORD_THAW_PROCESS = 0x2000000;

// 驱动/设备事件关键字
constexpr ULONG64 KEYWORD_DRIVER_EVENTS = 0x40000000;
constexpr ULONG64 KEYWORD_DEVICE_EVENTS = 0x80000000;

// ============================================
// 事件ID定义
// ============================================
constexpr USHORT EVENT_ALLOCVM_REMOTE = 1;
constexpr USHORT EVENT_PROTECTVM_REMOTE = 2;
constexpr USHORT EVENT_MAPVIEW_REMOTE = 3;
constexpr USHORT EVENT_QUEUEUSERAPC_REMOTE = 4;
constexpr USHORT EVENT_SETTHREADCONTEXT_REMOTE = 5;
constexpr USHORT EVENT_ALLOCVM_LOCAL = 6;
constexpr USHORT EVENT_PROTECTVM_LOCAL = 7;
constexpr USHORT EVENT_MAPVIEW_LOCAL = 8;
constexpr USHORT EVENT_READVM_LOCAL = 11;
constexpr USHORT EVENT_WRITEVM_LOCAL = 12;
constexpr USHORT EVENT_READVM_REMOTE = 13;
constexpr USHORT EVENT_WRITEVM_REMOTE = 14;
constexpr USHORT EVENT_SUSPEND_THREAD = 15;
constexpr USHORT EVENT_RESUME_THREAD = 16;
constexpr USHORT EVENT_SUSPEND_PROCESS = 17;
constexpr USHORT EVENT_RESUME_PROCESS = 18;
constexpr USHORT EVENT_FREEZE_PROCESS = 19;
constexpr USHORT EVENT_THAW_PROCESS = 20;
constexpr USHORT EVENT_ALLOCVM_REMOTE_KERNEL = 21;
constexpr USHORT EVENT_PROTECTVM_REMOTE_KERNEL = 22;
constexpr USHORT EVENT_MAPVIEW_REMOTE_KERNEL = 23;
constexpr USHORT EVENT_QUEUEUSERAPC_REMOTE_KERNEL = 24;
constexpr USHORT EVENT_SETTHREADCONTEXT_REMOTE_KERNEL = 25;
constexpr USHORT EVENT_ALLOCVM_LOCAL_KERNEL = 26;
constexpr USHORT EVENT_PROTECTVM_LOCAL_KERNEL = 27;
constexpr USHORT EVENT_MAPVIEW_LOCAL_KERNEL = 28;
constexpr USHORT EVENT_DRIVER_LOAD = 29;
constexpr USHORT EVENT_DRIVER_UNLOAD = 30;
constexpr USHORT EVENT_DEVICE_CREATE = 31;
constexpr USHORT EVENT_DEVICE_CLOSE = 32;

// ============================================
// RTCore64 驱动相关常量
// ============================================
static const DWORD RTCORE64_MEMORY_READ_CODE = 0x80002048;
static const DWORD RTCORE64_MEMORY_WRITE_CODE = 0x8000204c;

// ============================================
// 内核偏移量结构
// ============================================
struct Offsets {
    DWORD64 UniqueProcessIdOffset;
    DWORD64 ActiveProcessLinksOffset;
    DWORD64 TokenOffset;
    DWORD64 SignatureLevelOffset;
};

// ============================================
// 事件类型枚举
// ============================================
enum class EventType {
    ALLOCVM,
    PROTECTVM,
    MAPVIEW,
    QUEUEUSERAPC,
    SETTHREADCONTEXT,
    READVM,
    WRITEVM,
    SUSPEND_THREAD,
    RESUME_THREAD,
    SUSPEND_PROCESS,
    RESUME_PROCESS,
    FREEZE_PROCESS,
    THAW_PROCESS,
    DRIVER_LOAD,
    DRIVER_UNLOAD,
    DEVICE_CREATE,
    DEVICE_CLOSE,
    UNKNOWN
};

// ============================================
// 行为类型枚举
// ============================================
enum class BehaviorType {
    LOCAL,      // 本地行为：进程操作自己的内存
    REMOTE,     // 跨进程行为：进程操作其他进程的内存
    KERNEL      // 内核调用
};

// ============================================
// 函数声明 - helpers.cpp
// ============================================
const char* ProtectionString(DWORD Protection);
std::wstring ProcessName(DWORD processId);
std::string GetCurrentTimestamp();
EventType GetEventType(USHORT eventId);
BehaviorType GetBehaviorType(USHORT eventId);
std::string EventTypeToString(EventType type);
std::string BehaviorTypeToString(BehaviorType type);

// ============================================
// 函数声明 - enableppl.cpp
// ============================================
bool IsDriverAvailable();
HANDLE OpenDriverDevice();
void CloseDriverDevice(HANDLE hDevice);
bool EnablePPL(HANDLE hDevice);
bool DisablePPL(HANDLE hDevice);
Offsets GetVersionOffsets();

// ============================================
// 函数声明 - driver_comm.cpp
// ============================================
bool IsDriversMonServiceExists();
bool LoadDriversMonDriver(const wchar_t* driverPath);
bool UnloadDriversMonDriver();
HANDLE OpenDriversMonDevice();
void CloseDriversMonDevice(HANDLE hDevice);
bool ReadDriverEvent(HANDLE hDevice, PVOID buffer, ULONG bufferSize, PULONG bytesReturned);
bool SetDriverFilter(HANDLE hDevice, ULONG filterFlags);