moon-struct 0.1.1

Windows Kernel Struct offset
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

pub const EXIT_VT: u64 = 1;

// ept hook
pub const INVEPT_SINGLE_CONTEXT: u64 = 100;
pub const INVEPT_ALL_CONTEXT: u64 = 101;
pub const PAGE_HOOK_FUNCTION: u64 = 110;
pub const PAGE_UNHOOK_FUNCTION: u64 = 111;
pub const DRIVER_HIDE_FUNCTION: u64 = 112;
pub const ADD_EPT_MEMORY_FUNCTION: u64 = 113;
pub const SET_SOFTWARE_BREAKPOINT_TARGET_FUNCTION: u64 = 114;
pub const CLEAR_SOFTWARE_BREAKPOINT_TARGET_FUNCTION: u64 = 115;
pub const EPT_RAW_PATCH_FUNCTION: u64 = 116;
pub const EPT_RAW_UNPATCH_FUNCTION: u64 = 117;
pub const SET_VIRTUAL_HARDWARE_BREAKPOINT_TARGET_FUNCTION: u64 = 118;
pub const CLEAR_VIRTUAL_HARDWARE_BREAKPOINT_TARGET_FUNCTION: u64 = 119;

pub const ADD_EPT_MEMORY_TYPE_SPLIT_2MB: u64 = 0;
pub const ADD_EPT_MEMORY_TYPE_HOOK_DETAIL: u64 = 1;
pub const ADD_EPT_MEMORY_TYPE_TRAMPOLINE: u64 = 2;

pub const VMCALL_SUCCESS: u64 = 0;
pub const VMCALL_ERROR_UNKNOWN: u64 = 1;
pub const VMCALL_ERROR_PAGE_ALREADY_HOOKED: u64 = 2;
pub const VMCALL_ERROR_ALLOCATION_FAILED: u64 = 3;
pub const VMCALL_ERROR_INVALID_PARAMETER: u64 = 4;
pub const VMCALL_ERROR_NOT_FOUND: u64 = 5;
pub const VMCALL_ERROR_INVALID_COMMAND: u64 = 6;