global.h

很好的rootkit介绍书籍

#define BOOLBYTE BYTE					/* BOOLBYTE = boolean used in DS */
#define UBYTE BYTE						/* UBYTE = unsigned 8 bit integer */
#define SBYTE signed char				/* SBYTE = signed 8 bit integer */
#define SWORD signed short				/* SWORD = signed 16 bit integer */

typedef DWORD MEMHANDLE;				/* MEMHANDLE = Handle returned by OSMemoryAllocate */
#define NULLMEMHANDLE (MEMHANDLE) 0

typedef WORD STATUS;					/* STATUS = Status code (ERR_xxx) */
										/* High byte is subsystem; */
										/* Low byte is status code */
typedef DWORD FONTID;					/* Font identifier - see FONTID.H */

typedef struct {
	WORD	width;
	WORD	height;
} RECTSIZE;


/*	List structure */

typedef struct {
	USHORT ListEntries;			/* list entries following */
								/* now come the list entries */
} LIST;

/*	Range structure */

typedef struct {
	USHORT ListEntries;			/* list entries following */
	USHORT RangeEntries;		/* range entries following */
								/* now come the list entries */
								/* now come the range entries */
} RANGE;


/*	Basic time/date structure --
	The following 2 structures are ONLY intended to be interpreted using
	the "Time" package (see misc.h) conversion routines.  These structures
	are "bit-encoded", and cannot be parsed/interpreted easily. */

typedef struct tagTIMEDATE {
	DWORD Innards[2];
} TIMEDATE;

typedef struct {						/* a timedate range entry */
	TIMEDATE Lower;
	TIMEDATE Upper;
} TIMEDATE_PAIR;

#ifndef OS2_2x	/* OS2 2.x already defines this itself */
#if defined(LONGIS64BIT)
typedef long QWORD;
#else
typedef struct {DWORD Dwords[2];} QWORD;
#endif
#endif

/*	Basic floating-point number structure --
	This structure is EXACTLY the same format as a 64-bit IEEE floating
	point number, usually defined in most C compilers as "double". */


typedef double NUMBER;					/* NSF floating type (IEEE 64-bit) */
typedef NUMBER ALIGNED_NUMBER;
#if defined(DOS) || defined(OS2) || defined(MAC)		/* This doesn't work for NT, which has its own FLOAT */
#define FLOAT NUMBER					/* for pre-V3 backward compatibility ONLY */
#define FLOAT_PAIR NUMBER_PAIR			/* for pre-V3 backward compatibility ONLY */
#endif	/* DOS or OS2 */


typedef struct {						/* a float range entry */
	NUMBER Lower;
	NUMBER Upper;
} NUMBER_PAIR;

typedef NUMBER_PAIR ALIGNED_NUMBER_PAIR;

/*	This is the structure that defines a license number.  Do not attempt
	to interpret this structure too exactly, since it may change in future
	releases.  For now, simply treat the entire strucure as a unique ID. */

typedef struct {
	BYTE ID[5];						/* license number */
	BYTE Product;					/* product code, mfgr-specific */
	BYTE Check[2];					/* validity check field, mfgr-specific */
} LICENSEID;

typedef WORD BLOCK;					/* pool block handle */

/*	Define symbols for boolean true/false */

#ifndef TRUE
	#define FALSE 0
	#define TRUE !FALSE
#endif


/*	Define the NULL symbol (ignoring previous ones so that it is always a simple "0"). */

#ifdef NULL
#undef NULL
#endif
#define NULL 0

/*	Define the Notes calling convention macros. */

#if !defined(OS2)

#define	LNPUBLIC 		FAR PASCAL			/*	Routines called from outside
												a subsystem (includes routines
												in the published API). */
#define LNCALLBACK		FAR PASCAL			/*	Routines specified as callbacks
												within Notes or an API program */
#if defined(OS390) && defined(__XPLINK__)
#define LNCALLBACKPTR   LNCALLBACK FAR * __callback	/*	Macro for defining a pointer to
												a callback routine. __callback added
												for XPLINK DLL to nonXPLINK DLL calls */
#else
#define LNCALLBACKPTR	LNCALLBACK FAR *	/*	Macro for defining a pointer to
												a callback routine */
#endif /* OS390 */
#define	LNVARARGS		FAR cdecl			/*	Routines with a variable number
												of arguments */
#else

/*	OS/2 requires separate macros because the ordering of function
	modifiers for function pointer is different.  This prevents us
	from inserting _System in a uniform place (e.g. a replacemet
	for PASCAL).  See the comments above for their use.*/

#define	LNPUBLIC 		_System
#define LNCALLBACK		_System
#define LNCALLBACKPTR	* _System
#define	LNVARARGS		_System
#endif

/*  Define some obsolete macros that used to be used for OS/2 32-bit
	programs that used the 16-bit Notes API.  These macros are now
	obsolete, but are here to help in backward compatibility for
	these older programs. */

#define NOTESMAIN				LNPUBLIC
#define NOTESAPI				LNPUBLIC
#define NOTESAPICDECL			LNVARARGS
#define NOTESCALLBACK			LNCALLBACK
#define NOTESCALLBACKPTR		LNCALLBACKPTR
#define NOTESPTR				FAR *
#define NOTESBOOL				BOOL

#ifdef NULLHANDLE
#undef NULLHANDLE				/* Override any existing defn (e.g. OS2 2.0) */
#endif
#define NULLHANDLE 0

/*	Define some miscellaneous constants */

#ifndef MAXDWORD
#define MAXDWORD ((DWORD) 0xffffffff)
#endif
#ifndef MAXWORD
#define MAXWORD ((WORD) 0xffff)
#endif
#ifndef MAXBYTE
#define MAXBYTE ((BYTE) 0xff)
#endif

#ifndef MAXINT
#define MAXINT ((int) (((unsigned int) -1) >> 1))
#endif

#ifndef MININT
#define MININT ((int) (~(unsigned int) MAXINT))
#endif

#ifndef BITS_PER_BYTE
#define	BITS_PER_BYTE 8
#endif


/*	Define a platform-independent method of obtaining the address of
	the "..." variable arguments in a "cdecl" "..." routine.

	void far cdecl SampleRoutine(char *String, WORD LastNamedArgument, ...)
		{
		DWORD temp1;
		WORD temp2;
		VARARG_PTR ap;

		VARARG_START(ap,LastNamedArgument); * Start out just past last named argument
		temp1 = VARARG_GET(ap,DWORD);		* Get next DWORD into temp1 and advance
		temp2 = VARARG_PEEK(ap,WORD);		* Peek at next WORD, but no advance
		temp2 = VARARG_GET(ap,WORD);		* Get next WORD into temp2 and advance
		...
		}
*/
#define VARARG_ROUND_UP(n,unit) ((((n) + (unit) - 1) / (unit)) * (unit))

#if defined(OSF) || (defined(NT) && defined(_ALPHA_)) || defined(LINUX) || defined(SOLARIS)
#include <stdarg.h>
#define VARARG_PTR	va_list
#elif defined(OS400)
#include <stdarg.h>
typedef struct
	{
	char* vaold;
	char* vanew;
	} VARARG_PTR;
#else
typedef char * VARARG_PTR;
#endif

/*
 The C++ 3.0.1 compiler on X86 has a bug. The  __builtin_va_arg_incr
 doesn't work with short data type.
 It works fine with 'cc'.  So use the definition under 'LITTLE_ENDIAN_ORDER'
*/
#if defined(SOLARIS) && !defined(SOLX86)
#define VARARG_START(_AP,_LASTNAMEDARG) \
					((_AP) = (char *) &__builtin_va_alist)
#elif defined(SUN) && defined(GCC)
#define VARARG_START(_AP,_LASTNAMEDARG) \
					(__builtin_saveregs(), \
					(_AP) = (char *) &(_LASTNAMEDARG) + sizeof(_LASTNAMEDARG))
#elif defined(HPUX)
#ifdef __GNUC__

#define VARARG_START(_AP,_LASTNAMEDARG) \
					(_AP = __builtin_saveregs())
#else
#ifdef __cplusplus
#define VARARG_START(_AP,_LASTNAMEDARG) \
					 (_AP) = (char *) &(_LASTNAMEDARG);

#else
#define VARARG_START(_AP,_LASTNAMEDARG) \
					(__builtin_va_start(_AP,&_LASTNAMEDARG), \
					(_AP) = (char *) &(_LASTNAMEDARG))
#endif
#endif
#elif defined(OSF)  || defined(LINUX) || (defined(NT) && defined(_ALPHA_))
#define VARARG_START(_AP,_LASTNAMEDARG) \
					(va_start(_AP,_LASTNAMEDARG))
#elif defined(OS400)
#define VARARG_START(_AP, _LASTNAMEDARG) \
					( (_AP).vanew = ((char *) &(_LASTNAMEDARG)) + sizeof(_LASTNAMEDARG) )

#elif defined(LITTLE_ENDIAN_ORDER) || defined(XLC_C)
#define VARARG_START(_AP,_LASTNAMEDARG) \
					((_AP) = (char *) &(_LASTNAMEDARG) + VARARG_ROUND_UP(sizeof(_LASTNAMEDARG),sizeof(int)))
#else /* BIG_ENDIAN_ORDER */
#define VARARG_START(_AP,_LASTNAMEDARG) \
					((_AP) = (char *) &(_LASTNAMEDARG) + sizeof(_LASTNAMEDARG))
#endif


#if defined(SOLARIS) && !defined(SOLX86)
#define VARARG_GET(_AP,_TYPE) \
					((_TYPE *)__builtin_va_arg_incr((_TYPE *)_AP))[0]
#elif defined(HPUX)
#define TYPE_MASK(_TYPE) (sizeof(_TYPE) > 4 ? 0xFFFFFFF8 : 0xFFFFFFFC)
#define VARARG_GET(_AP,_TYPE) \
					((_AP) = (VARARG_PTR)((long)((_AP) - sizeof(int)) \
										& TYPE_MASK(_TYPE)) , \
					 *(_TYPE *)((_AP) + ((8 - sizeof(_TYPE)) % 4)))
#elif defined(GCC3)
/* GCC3 doesn't allow variable arguments shorter than 4 bytes.  If any argument is less than
   4 bytes and is passed through the parameter list (...), it will be converted to 4 bytes */
#define VARARG_GET(_AP,_TYPE) \
					((sizeof(_TYPE) < sizeof(DWORD)) ? ((_TYPE) va_arg(_AP,DWORD)) : (va_arg(_AP,_TYPE)))

#elif defined(OSF) || defined(LINUX) || (defined(NT) && defined(_ALPHA_))
#define VARARG_GET(_AP,_TYPE) \
					(va_arg(_AP,_TYPE))
#elif defined(OS400)
#define __VARARG_GET(_AP, _TYPE) \
					( (_AP).vaold = __bndup((_AP).vanew, _TYPE),\
					  (_AP).vanew = (_AP).vaold + sizeof(_TYPE),  \
					  *(_TYPE *)((_AP).vaold ) )
/* The C++ compiler will complain about the conversion of DWORD to a struct datatype. */
/* e.g. typedef struct { WORD foo; WORD bar} FOOBAR    VARARG_GET(ap, FOOBAR);  So eliminate */
/* this unnecessary cast. */
#ifdef __cplusplus
	#define __VARARG_GET1(_AP, _TYPE) \
					( (_AP).vaold = __bndup((_AP).vanew, DWORD),\
					  (_AP).vanew = (_AP).vaold + sizeof(DWORD),  \
					  *(_TYPE *)((_AP).vaold + (sizeof(DWORD)- sizeof(_TYPE))) )
#else
	#define __VARARG_GET1(_AP, _TYPE) __VARARG_GET(_AP, DWORD)
#endif

#define VARARG_GET(_AP,_TYPE) \
					(sizeof(_TYPE) < sizeof(DWORD) ? (_TYPE) __VARARG_GET1(_AP,_TYPE) : __VARARG_GET(_AP,_TYPE))
#elif defined(LITTLE_ENDIAN_ORDER)
#define VARARG_GET(_AP,_TYPE) \
					((_AP) += VARARG_ROUND_UP(sizeof(_TYPE),sizeof(int)), \
					 *(_TYPE *)((_AP) - VARARG_ROUND_UP(sizeof(_TYPE),sizeof(int))))
#else /* BIG_ENDIAN_ORDER */
#define VARARG_GET(_AP,_TYPE) \
					((_AP) += VARARG_ROUND_UP(sizeof(_TYPE),sizeof(int)), \
					 *(_TYPE *)((_AP) - sizeof(_TYPE)))
#endif

#if defined(HPUX)
#define VARARG_PEEK(_AP,_TYPE) (*(_TYPE *)((VARARG_PTR)((long)((_AP) \
							- sizeof(_TYPE)) & TYPE_MASK(_TYPE)) \
							+ ((8 - sizeof(_TYPE)) % 4)))
#elif defined(NT) && defined(_ALPHA_)
/*	Just like va_arg from stdargs.h, but without the increment of _AP.offset	*/
#define VARARG_PEEK(_AP,_TYPE)	\
	(*(_TYPE *)((_AP).a0 + (_AP).offset + (((int)sizeof(_TYPE) + 7) & -8)- \
	                    ((__builtin_isfloat(_TYPE) && (_AP).offset <= (6 * 8)) ? \
	                        (6 * 8) + 8 : ((int)sizeof(_TYPE) + 7) & -8)))
#elif defined(OSF)

/*	Just like va_arg from stdargs.h, but without the increment of _AP.offset	*/
#define VARARG_PEEK(_AP,_TYPE)	\
	(*(_TYPE *)((_AP)._a0 + (_AP)._offset + (((int)sizeof(_TYPE) + 7) & -8)- \
	                    ((__builtin_isfloat(_TYPE) && (_AP)._offset <= (6 * 8)) ? \
	                        (6 * 8) + 8 : ((int)sizeof(_TYPE) + 7) & -8)))

#elif defined(OS400)
/* Just like VARARG_GET, but without the increment of _AP.vanew */
#define VARARG_PEEK(_AP,_TYPE)  \
	(sizeof(_TYPE) < sizeof(DWORD) ? (_TYPE)(*(DWORD *)__bndup((_AP).vanew,DWORD)) : (*(_TYPE *)(__bndup((_AP).vanew,_TYPE))))
#elif defined(LITTLE_ENDIAN_ORDER)
#define VARARG_PEEK(_AP,_TYPE) (*(_TYPE *)(_AP))
#else /* BIG_ENDIAN_ORDER */
#if defined(MAC)
#define VARARG_PEEK(_AP,_TYPE) (*(_TYPE *)((_AP) + VARARG_ROUND_UP(sizeof(_TYPE),sizeof(int)) - sizeof(_TYPE)))
#else
#ifndef ZLINUX
#define VARARG_PEEK(_AP,_TYPE) (*(_TYPE *)((CHAR*)(_AP) + VARARG_ROUND_UP(sizeof(_TYPE),sizeof(int)) - sizeof(_TYPE)))
#endif
#endif
#endif

/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
   Platforms that strictly comply to the C standard do not allow passing of
   variable argument lists by reference using '&' and '*' operators because
   the standard states that you may get undetermined results.  However, you
   are allowed to pass a variable argument list without these operators.  On
   zLinux, whenever you pass a variable argument list the contents will always
   be modified upon returning from the function passing it in as a parameter
   (assuming some function below accesses the list).  For these types of
   platforms, define the following macros to just pass the list without using
   the '&' operator.  All platforms can still use a variable argument list
   as a pointer by simply using the VARARG_PTR_P type.
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
#if defined(ZLINUX)
typedef VARARG_PTR VARARG_PTR_P;
#define VARARG_ADDR(_AAP) _AAP
#define VARARG_DEREF(_AAP) _AAP
#define VARARG_COPY __va_copy
#else
typedef VARARG_PTR * VARARG_PTR_P;
#define VARARG_ADDR(_AAP) &_AAP
#define VARARG_DEREF(_AAP) *_AAP
#define VARARG_COPY(dest, src) (dest)=(src)
#endif


#ifdef __cplusplus
extern "C" {
#endif

/*	Define entry point used by all "SDK" utility programs */

STATUS LNPUBLIC NotesMain (int argc, char far *argv[]);

/*	Define routines indirectly (or directly) used by "SDK" utility programs */

STATUS LNPUBLIC NotesInitIni (char far *pConfigFileName);
STATUS LNPUBLIC NotesInit (void);
STATUS LNPUBLIC NotesInitExtended (int argc, char far * far *argv);
void   LNPUBLIC NotesTerm (void);
void LNPUBLIC NotesInitModule (HMODULE far *rethModule, HMODULE far *rethInstance, HMODULE far *rethPrevInstance);
#ifdef NLM
typedef	void EXPORTED_LIBRARY_PROC(void);
STATUS LNPUBLIC NotesLibraryMain (int argc, char far * far *argv, EXPORTED_LIBRARY_PROC initproc);
#endif /* NLM */
STATUS LNPUBLIC NotesInitThread (void);
void LNPUBLIC NotesTermThread (void);

#ifdef __cplusplus
}
#endif

/*	OBSOLETE symbol (used to be used to force bootstrap to be pulled in.
	Now replaced by explicitly linking with notes0.obj and notesai0.obj). */

#define NotesSDKMainModule

/*	Define error code packages */

#include "globerr.h"
#if defined(NT)
#define ADMIN_PLATFORM			/* Defined for Admin Client platforms */
#endif
#if defined (NT) && defined(_X86_)
#define OLE_HTMLOBJ_PLATFORM
#endif


/* end of global definitions */

#endif	/* GLOBAL_DEFS */

#if defined(OS400) && (__OS400_TGTVRM__ >= 510)
#pragma datamodel(pop)
#endif