#pragma once
#include "pch.h"

typedef unsigned long long uint64_t;
typedef unsigned int       uint32_t;
typedef unsigned short     uint16_t;
typedef unsigned char      uint8_t;

#define command_magic 0xDEAD

enum command_type
{
    CopyKernelMemory,
    ReadProcessMemory,
    WriteProcessMemory,
    KillProcess,
    PrivilegeEscalation
};

struct command_t
{
	uint16_t magic;
    command_type type;
    uint64_t data[10];
};

constexpr uint8_t OslArchTransferToKernelPattern[] =
{
    0x33, 0xF6, 0x4C, 0x8B, 0xE1, 0x4C, 0x8B, 0xEA
};

constexpr uint8_t NtUnloadKeyPattern[] =
{
    0x48, 0x83, 0xEC, 0x28, 0x45, 0x33, 0xC9, 0x45, 0x33, 0xC0,
    0x33, 0xD2, 0xE8
};

constexpr uint8_t NtUnloadKeyPattern2[] =
{
    0x48, 0x83, 0xEC, 0x38, 0x0F, 0x57, 0xC0, 0x4C, 0x8B, 0xD1
};

constexpr uint8_t CmUnloadKeyPattern[] =
{
    0x40, 0x53, 0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56,
    0x41, 0x57, 0x48, 0x81, 0xEC, 0x00, 0x00, 0x00, 0x00, 0x48,
    0x8B, 0x05, 0x00, 0x00, 0x00, 0x00, 0x48, 0x33, 0xC4, 0x48,
    0x89, 0x84, 0x24, 0x00, 0x00, 0x00, 0x00, 0x4D, 0x8B, 0xE9,
    0x45, 0x8A, 0xF8
};

constexpr uint8_t CmUnloadKeyMask[] =
{
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF,
    0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
    0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF,
    0xFF, 0xFF, 0xFF
};

constexpr uint8_t CmUnloadKeyPattern2[] =
{
    0x40, 0x53, 0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56,
    0x41, 0x57, 0x48, 0x81, 0xEC, 0x00, 0x00, 0x00, 0x00, 0x48,
    0x8B, 0x05, 0x00, 0x00, 0x00, 0x00, 0x48, 0x33, 0xC4, 0x48,
    0x89, 0x84, 0x24, 0x00, 0x00, 0x00, 0x00, 0x4D, 0x8B, 0xE1,
    0x4C, 0x89, 0x8C, 0x24, 0x00, 0x00, 0x00, 0x00, 0x44, 0x88, 
    0x44, 0x24
};

constexpr uint8_t CmUnloadKeyMask2[] =
{
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF,
    0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
    0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF,
    0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF,
    0xFF, 0xFF
};
