1
2
3
4
5 """Table for all hook logging statements.
6
7 This table is not automatically generated at the moment, but kept up-to-date
8 by hand.
9
10 """
11 table = [
12 ("__process__", "__init__", ("",)),
13 ("__thread__", "__init__", ("",)),
14 ("NtDeleteFile", "filesystem", ("O", "FileName")),
15 ("CreateDirectoryW", "filesystem", ("u", "DirectoryName")),
16 ("CreateDirectoryExW", "filesystem", ("u", "DirectoryName")),
17 ("RemoveDirectoryA", "filesystem", ("s", "DirectoryName")),
18 ("RemoveDirectoryW", "filesystem", ("u", "DirectoryName")),
19 ("FindFirstFileExA", "filesystem", ("s", "FileName")),
20 ("FindFirstFileExW", "filesystem", ("u", "FileName")),
21 ("DeleteFileA", "filesystem", ("s", "FileName")),
22 ("DeleteFileW", "filesystem", ("u", "FileName")),
23 ("UnhookWindowsHookEx", "hooking", ("p", "HookHandle")),
24 ("LdrGetDllHandle", "system", ("oP", "FileName", "ModuleHandle")),
25 ("ExitWindowsEx", "system", ("ll", "Flags", "Reason")),
26 ("IsDebuggerPresent", "system", ("",)),
27 ("LookupPrivilegeValueW", "system", ("uu", "SystemName", "PrivilegeName")),
28 ("NtClose", "system", ("p", "Handle")),
29 ("URLDownloadToFileW", "network", ("uu", "URL", "FileName")),
30 ("InternetReadFile", "network", ("pB", "InternetHandle", "Buffer")),
31 ("InternetWriteFile", "network", ("pB", "InternetHandle", "Buffer")),
32 ("InternetCloseHandle", "network", ("p", "InternetHandle")),
33 ("DnsQuery_A", "network", ("sil", "Name", "Type", "Options")),
34 ("DnsQuery_UTF8", "network", ("sil", "Name", "Type", "Options")),
35 ("DnsQuery_W", "network", ("uil", "Name", "Type", "Options")),
36 ("getaddrinfo", "network", ("ss", "NodeName", "ServiceName")),
37 ("GetAddrInfoW", "network", ("uu", "NodeName", "ServiceName")),
38 ("NtTerminateProcess", "process", ("pl", "ProcessHandle", "ExitCode")),
39 ("ExitProcess", "process", ("l", "ExitCode")),
40 ("system", "process", ("s", "Command")),
41 ("RegOpenKeyExA", "registry", ("psP", "Registry", "SubKey", "Handle")),
42 ("RegOpenKeyExW", "registry", ("puP", "Registry", "SubKey", "Handle")),
43 ("RegDeleteKeyA", "registry", ("ps", "Handle", "SubKey")),
44 ("RegDeleteKeyW", "registry", ("pu", "Handle", "SubKey")),
45 ("RegEnumKeyW", "registry", ("plu", "Handle", "Index", "Name")),
46 ("RegDeleteValueA", "registry", ("ps", "Handle", "ValueName")),
47 ("RegDeleteValueW", "registry", ("pu", "Handle", "ValueName")),
48 ("RegCloseKey", "registry", ("p", "Handle")),
49 ("NtRenameKey", "registry", ("po", "KeyHandle", "NewName")),
50 ("NtEnumerateKey", "registry", ("pl", "KeyHandle", "Index")),
51 ("NtDeleteKey", "registry", ("p", "KeyHandle")),
52 ("NtDeleteValueKey", "registry", ("po", "KeyHandle", "ValueName")),
53 ("NtLoadKey", "registry", ("OO", "TargetKey", "SourceFile")),
54 ("NtSaveKey", "registry", ("pp", "KeyHandle", "FileHandle")),
55 ("ControlService", "services", ("pl", "ServiceHandle", "ControlCode")),
56 ("DeleteService", "services", ("p", "ServiceHandle")),
57 ("NtDelayExecution", "system", ("ls", "Milliseconds", "Status")),
58 ("NtDelayExecution", "system", ("l", "Milliseconds")),
59 ("WSAStartup", "socket", ("p", "VersionRequested")),
60 ("gethostbyname", "socket", ("s", "Name")),
61 ("socket", "socket", ("lll", "af", "type", "protocol")),
62 ("connect", "socket", ("p", "socket")),
63 ("send", "socket", ("pb", "socket", "buffer")),
64 ("sendto", "socket", ("pb", "socket", "buffer")),
65 ("recv", "socket", ("pb", "socket", "buffer")),
66 ("recvfrom", "socket", ("pb", "socket", "buffer")),
67 ("accept", "socket", ("pp", "socket", "ClientSocket")),
68 ("bind", "socket", ("psl", "socket", "ip", "port")),
69 ("bind", "socket", ("p", "socket")),
70 ("setsockopt", "socket", ("pllb", "socket", "level", "optname", "optval")),
71 ("listen", "socket", ("p", "socket")),
72 ("select", "socket", ("p", "socket")),
73 ("ioctlsocket", "socket", ("pl", "socket", "command")),
74 ("closesocket", "socket", ("p", "socket")),
75 ("shutdown", "socket", ("pl", "socket", "how")),
76 ("WSARecv", "socket", ("p", "socket")),
77 ("WSARecvFrom", "socket", ("p", "socket")),
78 ("WSASend", "socket", ("p", "Socket")),
79 ("WSASendTo", "socket", ("p", "Socket")),
80 ("WSASocketA", "socket", ("lll", "af", "type", "protocol")),
81 ("WSASocketW", "socket", ("lll", "af", "type", "protocol")),
82 ("ConnectEx", "socket", ("pB", "socket", "SendBuffer")),
83 ("NtOpenMutant", "synchronization", ("PO", "Handle", "MutexName")),
84 ("NtGetContextThread", "threading", ("p", "ThreadHandle")),
85 ("NtSetContextThread", "threading", ("p", "ThreadHandle")),
86 ("NtResumeThread", "threading", ("pL", "ThreadHandle", "SuspendCount")),
87 ("NtTerminateThread", "threading", ("pl", "ThreadHandle", "ExitStatus")),
88 ("ExitThread", "threading", ("l", "ExitCode")),
89 ("FindWindowA", "windows", ("ss", "ClassName", "WindowName")),
90 ("FindWindowW", "windows", ("uu", "ClassName", "WindowName")),
91 ("FindWindowExA", "windows", ("ls", "ClassName", "WindowName")),
92 ("FindWindowExA", "windows", ("ss", "ClassName", "WindowName")),
93 ("FindWindowExW", "windows", ("lu", "ClassName", "WindowName")),
94 ("FindWindowExW", "windows", ("uu", "ClassName", "WindowName")),
95 ("NtCreateFile", "filesystem", ("PpOll", "FileHandle", "DesiredAccess", "FileName", "CreateDisposition", "ShareAccess")),
96 ("NtOpenFile", "filesystem", ("PpOl", "FileHandle", "DesiredAccess", "FileName", "ShareAccess")),
97 ("NtReadFile", "filesystem", ("pb", "FileHandle", "Buffer")),
98 ("NtWriteFile", "filesystem", ("pb", "FileHandle", "Buffer")),
99 ("NtDeviceIoControlFile", "filesystem", ("pbb", "FileHandle", "InputBuffer", "OutputBuffer")),
100 ("NtQueryDirectoryFile", "filesystem", ("pbo", "FileHandle", "FileInformation", "FileName")),
101 ("NtQueryInformationFile", "filesystem", ("pb", "FileHandle", "FileInformation")),
102 ("NtSetInformationFile", "filesystem", ("pb", "FileHandle", "FileInformation")),
103 ("NtOpenDirectoryObject", "filesystem", ("PlO", "DirectoryHandle", "DesiredAccess", "ObjectAttributes")),
104 ("NtCreateDirectoryObject", "filesystem", ("PlO", "DirectoryHandle", "DesiredAccess", "ObjectAttributes")),
105 ("MoveFileWithProgressW", "filesystem", ("uu", "ExistingFileName", "NewFileName")),
106 ("CopyFileA", "filesystem", ("ss", "ExistingFileName", "NewFileName")),
107 ("CopyFileW", "filesystem", ("uu", "ExistingFileName", "NewFileName")),
108 ("CopyFileExW", "filesystem", ("uul", "ExistingFileName", "NewFileName", "CopyFlags")),
109 ("SetWindowsHookExA", "system", ("lppl", "HookIdentifier", "ProcedureAddress", "ModuleAddress", "ThreadId")),
110 ("SetWindowsHookExW", "system", ("lppl", "HookIdentifier", "ProcedureAddress", "ModuleAddress", "ThreadId")),
111 ("LdrLoadDll", "system", ("loP", "Flags", "FileName", "BaseAddress")),
112 ("LdrGetProcedureAddress", "system", ("pSlP", "ModuleHandle", "FunctionName", "Ordinal", "FunctionAddress")),
113 ("DeviceIoControl", "device", ("plbb", "DeviceHandle", "IoControlCode", "InBuffer", "OutBuffer")),
114 ("WriteConsoleA", "system", ("pS", "ConsoleHandle", "Buffer")),
115 ("WriteConsoleW", "system", ("pU", "ConsoleHandle", "Buffer")),
116 ("InternetOpenA", "network", ("spssp", "Agent", "AccessType", "ProxyName", "ProxyBypass", "Flags")),
117 ("InternetOpenW", "network", ("upuup", "Agent", "AccessType", "ProxyName", "ProxyBypass", "Flags")),
118 ("InternetConnectA", "network", ("pslsslp", "InternetHandle", "ServerName", "ServerPort", "Username", "Password", "Service", "Flags")),
119 ("InternetConnectW", "network", ("puluulp", "InternetHandle", "ServerName", "ServerPort", "Username", "Password", "Service", "Flags")),
120 ("InternetOpenUrlA", "network", ("psSp", "ConnectionHandle", "URL", "Headers", "Flags")),
121 ("InternetOpenUrlW", "network", ("puUp", "ConnectionHandle", "URL", "Headers", "Flags")),
122 ("HttpOpenRequestA", "network", ("psl", "InternetHandle", "Path", "Flags")),
123 ("HttpOpenRequestW", "network", ("pul", "InternetHandle", "Path", "Flags")),
124 ("HttpSendRequestA", "network", ("pSb", "RequestHandle", "Headers", "PostData")),
125 ("HttpSendRequestW", "network", ("pUb", "RequestHandle", "Headers", "PostData")),
126 ("NtCreateProcess", "process", ("PpO", "ProcessHandle", "DesiredAccess", "FileName")),
127 ("NtCreateProcessEx", "process", ("PpO", "ProcessHandle", "DesiredAccess", "FileName")),
128 ("NtCreateUserProcess", "process", ("PPppOOoo", "ProcessHandle", "ThreadHandle", "ProcessDesiredAccess", "ThreadDesiredAccess", "ProcessFileName", "ThreadName", "ImagePathName", "CommandLine")),
129 ("NtOpenProcess", "process", ("ppp", "ProcessHandle", "DesiredAccess", "ProcessIdentifier")),
130 ("NtOpenProcess", "process", ("PpP", "ProcessHandle", "DesiredAccess", "ProcessIdentifier")),
131 ("NtCreateSection", "process", ("PpOp", "SectionHandle", "DesiredAccess", "ObjectAttributes", "FileHandle")),
132 ("NtOpenSection", "process", ("PpO", "SectionHandle", "DesiredAccess", "ObjectAttributes")),
133 ("CreateProcessInternalW", "process", ("uupllpp", "ApplicationName", "CommandLine", "CreationFlags", "ProcessId", "ThreadId", "ProcessHandle", "ThreadHandle")),
134 ("ShellExecuteExW", "process", ("2ul", "FilePath", "Parameters", "Show")),
135 ("NtAllocateVirtualMemory", "process", ("pPPp", "ProcessHandle", "BaseAddress", "RegionSize", "Protection")),
136 ("NtReadVirtualMemory", "process", ("2pB", "ProcessHandle", "BaseAddress", "Buffer")),
137 ("ReadProcessMemory", "process", ("ppB", "ProcessHandle", "BaseAddress", "Buffer")),
138 ("NtWriteVirtualMemory", "process", ("2pB", "ProcessHandle", "BaseAddress", "Buffer")),
139 ("WriteProcessMemory", "process", ("ppB", "ProcessHandle", "BaseAddress", "Buffer")),
140 ("NtProtectVirtualMemory", "process", ("pPPpP", "ProcessHandle", "BaseAddress", "NumberOfBytesProtected", "NewAccessProtection", "OldAccessProtection")),
141 ("VirtualProtectEx", "process", ("pppp", "ProcessHandle", "Address", "Size", "Protection")),
142 ("NtFreeVirtualMemory", "process", ("pPPp", "ProcessHandle", "BaseAddress", "RegionSize", "FreeType")),
143 ("VirtualFreeEx", "process", ("pppl", "ProcessHandle", "Address", "Size", "FreeType")),
144 ("RegCreateKeyExA", "registry", ("psslP", "Registry", "SubKey", "Class", "Access", "Handle")),
145 ("RegCreateKeyExW", "registry", ("puulP", "Registry", "SubKey", "Class", "Access", "Handle")),
146 ("RegEnumKeyExA", "registry", ("plss", "Handle", "Index", "Name", "Class")),
147 ("RegEnumKeyExW", "registry", ("pluu", "Handle", "Index", "Name", "Class")),
148 ("RegEnumValueA", "registry", ("plsr", "Handle", "Index", "ValueName", "Data")),
149 ("RegEnumValueA", "registry", ("plsLL", "Handle", "Index", "ValueName", "Type", "DataLength")),
150 ("RegEnumValueW", "registry", ("pluR", "Handle", "Index", "ValueName", "Data")),
151 ("RegEnumValueW", "registry", ("pluLL", "Handle", "Index", "ValueName", "Type", "DataLength")),
152 ("RegSetValueExA", "registry", ("pslr", "Handle", "ValueName", "Type", "Buffer")),
153 ("RegSetValueExA", "registry", ("psl", "Handle", "ValueName", "Type")),
154 ("RegSetValueExW", "registry", ("pulR", "Handle", "ValueName", "Type", "Buffer")),
155 ("RegSetValueExW", "registry", ("pul", "Handle", "ValueName", "Type")),
156 ("RegQueryValueExA", "registry", ("psr", "Handle", "ValueName", "Data")),
157 ("RegQueryValueExA", "registry", ("psLL", "Handle", "ValueName", "Type", "DataLength")),
158 ("RegQueryValueExW", "registry", ("puR", "Handle", "ValueName", "Data")),
159 ("RegQueryValueExW", "registry", ("puLL", "Handle", "ValueName", "Type", "DataLength")),
160 ("RegQueryInfoKeyA", "registry", ("pS6L", "KeyHandle", "Class", "SubKeyCount", "MaxSubKeyLength", "MaxClassLength", "ValueCount", "MaxValueNameLength", "MaxValueLength")),
161 ("RegQueryInfoKeyW", "registry", ("pU6L", "KeyHandle", "Class", "SubKeyCount", "MaxSubKeyLength", "MaxClassLength", "ValueCount", "MaxValueNameLength", "MaxValueLength")),
162 ("NtCreateKey", "registry", ("PlOo", "KeyHandle", "DesiredAccess", "ObjectAttributes", "Class")),
163 ("NtOpenKey", "registry", ("PlO", "KeyHandle", "DesiredAccess", "ObjectAttributes")),
164 ("NtOpenKeyEx", "registry", ("PlO", "KeyHandle", "DesiredAccess", "ObjectAttributes")),
165 ("NtReplaceKey", "registry", ("pOO", "KeyHandle", "NewHiveFileName", "BackupHiveFileName")),
166 ("NtEnumerateValueKey", "registry", ("pll", "KeyHandle", "Index", "KeyValueInformationClass")),
167 ("NtSetValueKey", "registry", ("polR", "KeyHandle", "ValueName", "Type", "Buffer")),
168 ("NtSetValueKey", "registry", ("pol", "KeyHandle", "ValueName", "Type")),
169 ("NtQueryValueKey", "registry", ("polR", "KeyHandle", "ValueName", "Type", "Information")),
170 ("NtQueryValueKey", "registry", ("po", "KeyHandle", "ValueName")),
171 ("NtQueryMultipleValueKey", "registry", ("poS", "KeyHandle", "ValueName", "ValueBuffer")),
172 ("NtLoadKey2", "registry", ("OOl", "TargetKey", "SourceFile", "Flags")),
173 ("NtLoadKeyEx", "registry", ("pOOl", "TrustClassKey", "TargetKey", "SourceFile", "Flags")),
174 ("NtQueryKey", "registry", ("pSl", "KeyHandle", "KeyInformation", "KeyInformationClass")),
175 ("NtSaveKeyEx", "registry", ("ppl", "KeyHandle", "FileHandle", "Format")),
176 ("OpenSCManagerA", "services", ("ssl", "MachineName", "DatabaseName", "DesiredAccess")),
177 ("OpenSCManagerW", "services", ("uul", "MachineName", "DatabaseName", "DesiredAccess")),
178 ("CreateServiceA", "services", ("pss4l3s", "ServiceControlHandle", "ServiceName", "DisplayName", "DesiredAccess", "ServiceType", "StartType", "ErrorControl", "BinaryPathName", "ServiceStartName", "Password")),
179 ("CreateServiceW", "services", ("puu4l3u", "ServiceControlHandle", "ServiceName", "DisplayName", "DesiredAccess", "ServiceType", "StartType", "ErrorControl", "BinaryPathName", "ServiceStartName", "Password")),
180 ("OpenServiceA", "services", ("psl", "ServiceControlManager", "ServiceName", "DesiredAccess")),
181 ("OpenServiceW", "services", ("pul", "ServiceControlManager", "ServiceName", "DesiredAccess")),
182 ("StartServiceA", "services", ("pa", "ServiceHandle", "Arguments")),
183 ("StartServiceW", "services", ("pA", "ServiceHandle", "Arguments")),
184 ("TransmitFile", "socket", ("ppll", "socket", "FileHandle", "NumberOfBytesToWrite", "NumberOfBytesPerSend")),
185 ("NtCreateMutant", "synchronization", ("POl", "Handle", "MutexName", "InitialOwner")),
186 ("NtCreateNamedPipeFile", "synchronization", ("PpOl", "NamedPipeHandle", "DesiredAccess", "PipeName", "ShareAccess")),
187 ("NtCreateThread", "threading", ("PpO", "ThreadHandle", "ProcessHandle", "ObjectAttributes")),
188 ("NtOpenThread", "threading", ("PlO", "ThreadHandle", "DesiredAccess", "ObjectAttributes")),
189 ("NtSuspendThread", "threading", ("pL", "ThreadHandle", "SuspendCount")),
190 ("CreateThread", "threading", ("pplL", "StartRoutine", "Parameter", "CreationFlags", "ThreadId")),
191 ("CreateRemoteThread", "threading", ("3plL", "ProcessHandle", "StartRoutine", "Parameter", "CreationFlags", "ThreadId")),
192 ("RtlCreateUserThread", "threading", ("plppPl", "ProcessHandle", "CreateSuspended", "StartAddress", "StartParameter", "ThreadHandle", "ThreadIdentifier")),
193 ("ZwMapViewOfSection", "process", ("ppPp", "SectionHandle", "ProcessHandle", "BaseAddress", "SectionOffset")),
194 ("GetSystemMetrics", "misc", ("l", "SystemMetricIndex")),
195 ("GetCursorPos", "misc", ("ll", "x", "y")),
196 ]
197