15 #define BASENAME "WinD" BITS
17 #define RTL_STRING(s) ((UNICODE_STRING){sizeof(s)-sizeof((s)[0]),sizeof(s),(s)})
19 #define RVA2PTR(base,rva) ((void*)(((PCHAR) base) + rva))
20 #define ID_SeLoadDriverPrivilege 10
21 #define LUID_SeLoadDriverPrivilege (LUID){ID_SeLoadDriverPrivilege,0}
23 #define FILE_VBS "wind-restorepoint.vbs"
25 "set obj=GetObject(\"winmgmts:\\\\.\\root\\default:Systemrestore\")\nobj.Enable(\"\")\n" \
26 "obj.CreateRestorePoint \"%s\", 0, 100\nWScript.Quit 123"
28 #define POLICY_KEY "System\\CurrentControlSet\\Control\\ProductOptions"
29 #define PRODUCT_POLICY "ProductPolicy"
30 #define CUSTOM_POLICY "CustomPolicy"
32 #define NT_MACHINE L"\\Registry\\Machine\\"
34 #define POLICY_PATH NT_MACHINE POLICY_KEY
35 #define SVC_BASE NT_MACHINE "System\\CurrentControlSet\\Services\\"
36 #define LOAD_ATTEMPTS 8
40 #define DBG(x...) DbgPrint("WIND: " x);
42 //#define DBG(x...) { printf("! %s:%d@%s(): ",__FILE__,__LINE__,__func__); printf(x); printf("\n"); }
45 sprintf(_buf + sprintf(_buf, "WIND: %s:%d@%s(): ",__FILE__,__LINE__,__func__), x); \
47 OutputDebugStringA(_buf); \
54 #define RTL_QUERY_REGISTRY_TYPECHECK 0x00000100
55 #define RTL_QUERY_REGISTRY_TYPECHECK_SHIFT 24
57 #define WIN7 (cfg.protbit >= 0)
58 #define SystemModuleInformation 0xb
59 #define SystemBootEnvironmentInformation 0x5a
60 #define SystemCodeIntegrityInformation 0x67
61 #define SystemSecureBootPolicyInformation 0x8f
64 #define WSKIP(p) while (*p == L' ' || *p == L'\t') p++;
65 #define EQUALS(a,b) (RtlCompareMemory(a,b,sizeof(b)-1)==(sizeof(b)-1))