#pragma once

#include "KswordArkProcessIoctl.h"

// ============================================================
// KswordArkKernelIoctl.h
// 作用：
// - 定义 R3 <-> R0 内核检查协议；
// - 当前覆盖 SSDT/SSSDT 快照、Inline Hook、IAT/EAT Hook 与 DriverObject 查询；
// - 只读地址不能单独作为操作凭据；修改请求必须带名称并由 R0 重新引用对象，
//   再校验 DriverObject/DeviceObject/子对象三重身份。
// ============================================================

#define KSWORD_ARK_IOCTL_FUNCTION_ENUM_SSDT 0x806
#define KSWORD_ARK_IOCTL_FUNCTION_QUERY_DRIVER_OBJECT 0x811
#define KSWORD_ARK_IOCTL_FUNCTION_ENUM_SHADOW_SSDT 0x81EUL
#define KSWORD_ARK_IOCTL_FUNCTION_SCAN_INLINE_HOOKS 0x81FUL
#define KSWORD_ARK_IOCTL_FUNCTION_PATCH_INLINE_HOOK 0x820UL
#define KSWORD_ARK_IOCTL_FUNCTION_ENUM_IAT_EAT_HOOKS 0x821UL
#define KSWORD_ARK_IOCTL_FUNCTION_FORCE_UNLOAD_DRIVER 0x826UL
#define KSWORD_ARK_IOCTL_FUNCTION_QUERY_DRIVER_INTEGRITY 0x849UL
#define KSWORD_ARK_IOCTL_FUNCTION_QUERY_CPU_HARDWARE 0x84AUL
#define KSWORD_ARK_IOCTL_FUNCTION_QUERY_PHYSICAL_MEMORY_LAYOUT 0x84BUL
#define KSWORD_ARK_IOCTL_FUNCTION_QUERY_IOCTL_REGISTRY 0x8A4UL
#define KSWORD_ARK_IOCTL_FUNCTION_ENUM_TIMER_DPC 0x8A5UL
#define KSWORD_ARK_IOCTL_FUNCTION_EXPERIMENTAL_RETURN_TO_FIRMWARE 0x8A6UL
#define KSWORD_ARK_IOCTL_FUNCTION_CONTROL_IO_TIMER 0x8ABUL

#define IOCTL_KSWORD_ARK_ENUM_SSDT \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_ENUM_SSDT, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

#define IOCTL_KSWORD_ARK_QUERY_DRIVER_OBJECT \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_QUERY_DRIVER_OBJECT, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

// 中文说明：查询 KswordARK 自身静态 IOCTL 注册表，只返回只读诊断元数据。
#define IOCTL_KSWORD_ARK_QUERY_IOCTL_REGISTRY \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_QUERY_IOCTL_REGISTRY, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

// 中文说明：按处理器只读遍历 KPRCB TimerTable，并返回 KTIMER/KDPC 快照。
#define IOCTL_KSWORD_ARK_ENUM_TIMER_DPC \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_ENUM_TIMER_DPC, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

// 中文说明：启用/停止由 IoInitializeTimer 注册的设备 IoTimer。
// R0 只调用 WDK 公开 IoStartTimer/IoStopTimer，不解引用私有 IO_TIMER 布局。
#define IOCTL_KSWORD_ARK_CONTROL_IO_TIMER \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_CONTROL_IO_TIMER, \
        METHOD_BUFFERED, \
        FILE_WRITE_ACCESS)

// 实验性整机级动作：HalReturnToFirmware 不是线程/进程终止 API。
// 当前只允许 HalRebootRoutine，并要求 UI 明确完成双重确认。
#define IOCTL_KSWORD_ARK_EXPERIMENTAL_RETURN_TO_FIRMWARE \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_EXPERIMENTAL_RETURN_TO_FIRMWARE, \
        METHOD_BUFFERED, \
        FILE_WRITE_ACCESS)

#define KSWORD_ARK_FIRMWARE_RETURN_ACTION_HAL_REBOOT_ROUTINE 3UL
#define KSWORD_ARK_FIRMWARE_RETURN_FLAG_UI_CONFIRMED         0x00000001UL
#define KSWORD_ARK_FIRMWARE_RETURN_CONFIRMATION_TOKEN        0x48524657UL

typedef struct _KSWORD_ARK_EXPERIMENTAL_RETURN_TO_FIRMWARE_REQUEST
{
    unsigned long action;
    unsigned long flags;
    unsigned long confirmationToken;
    unsigned long reserved;
} KSWORD_ARK_EXPERIMENTAL_RETURN_TO_FIRMWARE_REQUEST;

#define KSWORD_ARK_IOCTL_REGISTRY_PROTOCOL_VERSION 1UL
#define KSWORD_ARK_IOCTL_REGISTRY_NAME_CHARS 96U
#define KSWORD_ARK_IOCTL_REGISTRY_MAX_ENTRIES 512UL
#define KSWORD_ARK_IOCTL_REGISTRY_FLAG_INCLUDE_HANDLER 0x00000001UL
#define KSWORD_ARK_IOCTL_REGISTRY_STATUS_OK 0UL
#define KSWORD_ARK_IOCTL_REGISTRY_STATUS_TRUNCATED 1UL
#define KSWORD_ARK_IOCTL_REGISTRY_STATUS_INVALID_REQUEST 2UL

typedef struct _KSWORD_ARK_QUERY_IOCTL_REGISTRY_REQUEST
{
    unsigned long version;
    unsigned long flags;
    unsigned long maxEntries;
    unsigned long reserved;
} KSWORD_ARK_QUERY_IOCTL_REGISTRY_REQUEST;

typedef struct _KSWORD_ARK_IOCTL_REGISTRY_ENTRY
{
    unsigned long ioControlCode;
    unsigned long functionNumber;
    unsigned long method;
    unsigned long access;
    unsigned long flags;
    unsigned long reserved;
    unsigned long long requiredCapability;
    unsigned long long handlerAddress;
    char name[KSWORD_ARK_IOCTL_REGISTRY_NAME_CHARS];
} KSWORD_ARK_IOCTL_REGISTRY_ENTRY;

typedef struct _KSWORD_ARK_QUERY_IOCTL_REGISTRY_RESPONSE
{
    unsigned long version;
    unsigned long status;
    unsigned long totalCount;
    unsigned long returnedCount;
    unsigned long entrySize;
    unsigned long duplicateCount;
    long lastStatus;
    unsigned long reserved;
    KSWORD_ARK_IOCTL_REGISTRY_ENTRY entries[1];
} KSWORD_ARK_QUERY_IOCTL_REGISTRY_RESPONSE;

#define KSWORD_ARK_IOCTL_REGISTRY_RESPONSE_HEADER_SIZE \
    (sizeof(KSWORD_ARK_QUERY_IOCTL_REGISTRY_RESPONSE) - sizeof(KSWORD_ARK_IOCTL_REGISTRY_ENTRY))

#define IOCTL_KSWORD_ARK_ENUM_SHADOW_SSDT \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_ENUM_SHADOW_SSDT, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

#define IOCTL_KSWORD_ARK_SCAN_INLINE_HOOKS \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_SCAN_INLINE_HOOKS, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

#define IOCTL_KSWORD_ARK_PATCH_INLINE_HOOK \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_PATCH_INLINE_HOOK, \
        METHOD_BUFFERED, \
        FILE_WRITE_ACCESS)

#define IOCTL_KSWORD_ARK_ENUM_IAT_EAT_HOOKS \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_ENUM_IAT_EAT_HOOKS, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

#define IOCTL_KSWORD_ARK_FORCE_UNLOAD_DRIVER \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_FORCE_UNLOAD_DRIVER, \
        METHOD_BUFFERED, \
        FILE_WRITE_ACCESS)

#define IOCTL_KSWORD_ARK_QUERY_DRIVER_INTEGRITY \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_QUERY_DRIVER_INTEGRITY, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

#define IOCTL_KSWORD_ARK_QUERY_CPU_HARDWARE \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_QUERY_CPU_HARDWARE, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

#define IOCTL_KSWORD_ARK_QUERY_PHYSICAL_MEMORY_LAYOUT \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_QUERY_PHYSICAL_MEMORY_LAYOUT, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

#define KSWORD_ARK_ENUM_SSDT_PROTOCOL_VERSION 2UL
#define KSWORD_ARK_DRIVER_OBJECT_PROTOCOL_VERSION_V1 1UL
#define KSWORD_ARK_DRIVER_OBJECT_PROTOCOL_VERSION_V2 2UL
#define KSWORD_ARK_DRIVER_OBJECT_PROTOCOL_VERSION KSWORD_ARK_DRIVER_OBJECT_PROTOCOL_VERSION_V2
#define KSWORD_ARK_KERNEL_HOOK_PROTOCOL_VERSION 1UL
#define KSWORD_ARK_FORCE_UNLOAD_DRIVER_PROTOCOL_VERSION 2UL
#define KSWORD_ARK_DRIVER_INTEGRITY_PROTOCOL_VERSION_V1 1UL
#define KSWORD_ARK_DRIVER_INTEGRITY_PROTOCOL_VERSION_V2 2UL
#define KSWORD_ARK_DRIVER_INTEGRITY_PROTOCOL_VERSION_V3 3UL
#define KSWORD_ARK_DRIVER_INTEGRITY_PROTOCOL_VERSION_V4 4UL
#define KSWORD_ARK_DRIVER_INTEGRITY_PROTOCOL_VERSION KSWORD_ARK_DRIVER_INTEGRITY_PROTOCOL_VERSION_V4
#define KSWORD_ARK_CPU_HARDWARE_PROTOCOL_VERSION 1UL
#define KSWORD_ARK_PHYSICAL_MEMORY_LAYOUT_PROTOCOL_VERSION 1UL
#define KSWORD_ARK_TIMER_DPC_PROTOCOL_VERSION 1UL

// Timer/DPC request bounds and response state. 枚举只读取活动 KTIMER 链表，
// maxEntries 为全局行预算，maxEntriesPerBucket 限制单个损坏链表的影响范围。
#define KSWORD_ARK_TIMER_DPC_DEFAULT_MAX_ENTRIES 4096UL
#define KSWORD_ARK_TIMER_DPC_MAX_ENTRIES 16384UL
#define KSWORD_ARK_TIMER_DPC_DEFAULT_BUCKET_BUDGET 4096UL
#define KSWORD_ARK_TIMER_DPC_MAX_BUCKET_BUDGET 16384UL
#define KSWORD_ARK_TIMER_DPC_MAX_BUCKETS 512UL

#define KSWORD_ARK_TIMER_DPC_QUERY_STATUS_OK 0UL
#define KSWORD_ARK_TIMER_DPC_QUERY_STATUS_PARTIAL 1UL
#define KSWORD_ARK_TIMER_DPC_QUERY_STATUS_DYNDATA_MISSING 2UL
#define KSWORD_ARK_TIMER_DPC_QUERY_STATUS_INVALID_LAYOUT 3UL
#define KSWORD_ARK_TIMER_DPC_QUERY_STATUS_NOT_SUPPORTED 4UL

#define KSWORD_ARK_TIMER_DPC_STATUS_PARTIAL 0x00000001UL
#define KSWORD_ARK_TIMER_DPC_STATUS_TRUNCATED 0x00000002UL
#define KSWORD_ARK_TIMER_DPC_STATUS_CORRUPT_CHAIN 0x00000004UL
#define KSWORD_ARK_TIMER_DPC_STATUS_DYNDATA_MISSING 0x00000008UL
#define KSWORD_ARK_TIMER_DPC_STATUS_READ_FAILED 0x00000010UL
#define KSWORD_ARK_TIMER_DPC_STATUS_DUPLICATE_SKIPPED 0x00000020UL

#define KSWORD_ARK_TIMER_DPC_ENTRY_DPC_PRESENT 0x00000001UL
#define KSWORD_ARK_TIMER_DPC_ENTRY_DPC_FIELDS_PRESENT 0x00000002UL
#define KSWORD_ARK_TIMER_DPC_ENTRY_PERIODIC 0x00000004UL
#define KSWORD_ARK_TIMER_DPC_ENTRY_DUPLICATE_CPU 0x00000008UL
#define KSWORD_ARK_TIMER_DPC_ENTRY_READ_PARTIAL 0x00000010UL

// Request flags.
#define KSWORD_ARK_ENUM_SSDT_FLAG_INCLUDE_UNRESOLVED 0x00000001UL
#define KSWORD_ARK_KERNEL_SCAN_FLAG_INCLUDE_CLEAN     0x00000001UL
#define KSWORD_ARK_KERNEL_SCAN_FLAG_INCLUDE_INTERNAL  0x00000002UL
#define KSWORD_ARK_KERNEL_SCAN_FLAG_MODULE_FILTER     0x00000004UL
#define KSWORD_ARK_KERNEL_SCAN_FLAG_INCLUDE_EXPORTS   0x00000008UL
#define KSWORD_ARK_KERNEL_SCAN_FLAG_INCLUDE_IMPORTS   0x00000010UL
#define KSWORD_ARK_KERNEL_PATCH_FLAG_FORCE            0x00000001UL
// Driver unload flags。
// - CLEAR_DISPATCH_ON_NO_UNLOAD：目标没有 DriverUnload 时把 MajorFunction 替换为拒绝 IRP stub，并清 FastIo。
// - CLEAR_DISPATCH_AFTER_UNLOAD：DriverUnload 返回后把 MajorFunction 替换为拒绝 IRP stub，并清 FastIo。
// - CLEAR_UNLOAD_POINTER：清空 DriverObject->DriverUnload，避免重复入口被误调用。
// - DELETE_DEVICE_OBJECTS_ON_NO_UNLOAD：目标没有 DriverUnload 时尝试删除 DeviceObject 链。
// - DELETE_DEVICE_OBJECTS_ALWAYS：最高风险实验强拆；即使 DriverUnload 返回也尝试删除 DeviceObject 链。
// - MAKE_TEMPORARY_OBJECT：调用 ObMakeTemporaryObject，配合引用释放触发对象回收。
// - TARGET_MODULE_BASE_PRESENT：请求携带模块基址，R0 先按 DriverObject->DriverStart 反查目标。
// - REMOVE_CALLBACKS_BY_MODULE_BASE：请求携带模块基址时，先批量移除该模块登记的可移除回调。
// - ALLOW_DESTRUCTIVE_CLEANUP：显式允许持久 DriverObject 改写和高危后处理。
// - DIRECT_UNLOAD_CALL：跳过 ZwUnloadDriver，仅调用 DriverObject->DriverUnload。
// - DRIVER_OBJECT_TEARDOWN：执行 DriverObject 强拆模式；R0 固定按“封 dispatch、停线程、调 unload、拆设备”顺序执行。
// - CLEAR_DISPATCH_BEFORE_UNLOAD：在调用 DriverUnload 前把 MajorFunction 替换为拒绝 IRP stub，并清 FastIo。
// - TERMINATE_MODULE_THREADS：终止系统进程中入口位于目标驱动镜像内的线程，并等待它们退出。
// - DETACH_DEVICE_STACKS：删除目标 DeviceObject 前解除其上下层设备栈关联。
// 注意：CLEAR_* / DELETE_* / MAKE_TEMPORARY / REMOVE_CALLBACKS 均可能破坏目标驱动后续正常卸载；
//      R0 会把缺少 ALLOW_DESTRUCTIVE_CLEANUP 的旧 FORCE_CLEANUP 请求降级为“仅调用 DriverUnload”。
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_DISPATCH_ON_NO_UNLOAD      0x00000001UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_DISPATCH_AFTER_UNLOAD      0x00000002UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_UNLOAD_POINTER             0x00000004UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_DELETE_DEVICE_OBJECTS_ON_NO_UNLOAD 0x00000008UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_MAKE_TEMPORARY_OBJECT            0x00000010UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_TARGET_MODULE_BASE_PRESENT        0x00000020UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_REMOVE_CALLBACKS_BY_MODULE_BASE   0x00000040UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_ALLOW_DESTRUCTIVE_CLEANUP         0x00000080UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_DELETE_DEVICE_OBJECTS_ALWAYS      0x00000100UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_DIRECT_UNLOAD_CALL                 0x00000200UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_DRIVER_OBJECT_TEARDOWN             0x00000400UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_DISPATCH_BEFORE_UNLOAD       0x00000800UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_TERMINATE_MODULE_THREADS           0x00001000UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_DETACH_DEVICE_STACKS               0x00002000UL
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_DRIVER_OBJECT_TEARDOWN_STAGES \
    (KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_DISPATCH_BEFORE_UNLOAD | \
     KSWORD_ARK_DRIVER_UNLOAD_FLAG_TERMINATE_MODULE_THREADS | \
     KSWORD_ARK_DRIVER_UNLOAD_FLAG_DELETE_DEVICE_OBJECTS_ALWAYS | \
     KSWORD_ARK_DRIVER_UNLOAD_FLAG_DETACH_DEVICE_STACKS | \
     KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_UNLOAD_POINTER | \
     KSWORD_ARK_DRIVER_UNLOAD_FLAG_MAKE_TEMPORARY_OBJECT | \
     KSWORD_ARK_DRIVER_UNLOAD_FLAG_REMOVE_CALLBACKS_BY_MODULE_BASE)
#define KSWORD_ARK_DRIVER_UNLOAD_FLAG_FORCE_CLEANUP \
    (KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_DISPATCH_ON_NO_UNLOAD | \
     KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_DISPATCH_AFTER_UNLOAD | \
     KSWORD_ARK_DRIVER_UNLOAD_FLAG_CLEAR_UNLOAD_POINTER)

// DriverObject 查询 flags。
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_MAJOR_FUNCTIONS 0x00000001UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_DEVICES         0x00000002UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_NAMES           0x00000004UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_ATTACHED        0x00000008UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_ALL \
    (KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_MAJOR_FUNCTIONS | \
     KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_DEVICES | \
     KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_NAMES | \
     KSWORD_ARK_DRIVER_OBJECT_QUERY_FLAG_INCLUDE_ATTACHED)

// Driver Integrity query flags.
// - DRIVER_OBJECT: collect DriverObject, KLDR alignment, dispatch/FastIo, and device-chain evidence.
// - SERVICE: read Services\<Name> metadata without modifying service state.
// - CPU: collect per-CPU control-register, IDTR/GDTR, and MSR/LSTAR evidence.
// - IDT_ENTRIES: expand per-vector IDT handler module-attribution rows.
// - OPTIONAL_GLOBALS: report MmUnloadedDrivers/PiDDBCacheTable availability when DynData permits.
#define KSWORD_ARK_DRIVER_INTEGRITY_FLAG_DRIVER_OBJECT     0x00000001UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FLAG_SERVICE           0x00000002UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FLAG_CPU               0x00000004UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FLAG_IDT_ENTRIES       0x00000008UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FLAG_OPTIONAL_GLOBALS  0x00000010UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FLAG_GDT_ENTRIES       0x00000020UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FLAG_DEFAULT \
    (KSWORD_ARK_DRIVER_INTEGRITY_FLAG_DRIVER_OBJECT | \
     KSWORD_ARK_DRIVER_INTEGRITY_FLAG_SERVICE | \
     KSWORD_ARK_DRIVER_INTEGRITY_FLAG_CPU | \
     KSWORD_ARK_DRIVER_INTEGRITY_FLAG_IDT_ENTRIES | \
     KSWORD_ARK_DRIVER_INTEGRITY_FLAG_OPTIONAL_GLOBALS)

// Driver Integrity source mask.
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_SYSTEM_MODULE       0x00000001UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_AUXKLIB             0x00000002UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_PS_LOADED_MODULES   0x00000004UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_DRIVER_OBJECT       0x00000008UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_DRIVER_SECTION      0x00000010UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_SERVICE_REGISTRY    0x00000020UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_CPU_REGISTER        0x00000040UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_IDT                 0x00000080UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_GDT                 0x00000100UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_MSR                 0x00000200UL
#define KSWORD_ARK_DRIVER_INTEGRITY_SOURCE_DYNDATA             0x00000400UL

// Driver Integrity risk flags.
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_NONE                  0x00000000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_UNAVAILABLE           0x00000001UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_QUERY_FAILED          0x00000002UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_MODULE_UNRESOLVED     0x00000004UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_OWNER_MISMATCH        0x00000008UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_OUTSIDE_DRIVER_IMAGE  0x00000010UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_SECTION_MISMATCH      0x00000020UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_SERVICE_MISSING       0x00000040UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_EMPTY_UNLOAD          0x00000080UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_DEVICE_LOOP           0x00000100UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_ATTACHED_LOOP         0x00000200UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_CROSS_DRIVER_ATTACH   0x00000400UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_NULL_POINTER          0x00000800UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_IDT_NON_CORE_OWNER    0x00001000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_CPU_WP_DISABLED       0x00002000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_CPU_NXE_DISABLED      0x00004000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_CPU_SMEP_DISABLED     0x00008000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_CPU_SMAP_DISABLED     0x00010000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_DESCRIPTOR_INVALID    0x00020000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_DYNDATA_UNAVAILABLE   0x00040000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_TRUNCATED             0x00080000UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RISK_IDT_BASELINE_CHANGED  0x00100000UL

// Driver Integrity response field flags.
// These bits describe which v2 typed columns were populated by R0. Older R3
// clients can ignore them because they reuse the former reserved response slot.
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_COMMON                0x00000001UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_OWNER_MODULE          0x00000002UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_DRIVER_OBJECT         0x00000004UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_DEVICE_OBJECT         0x00000008UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_DISPATCH_TARGET       0x00000010UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_FAST_IO_TARGET        0x00000020UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_KLDR                  0x00000040UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_OPTIONAL_GLOBAL       0x00000080UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_CPU_CONTEXT           0x00000100UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_DESCRIPTOR            0x00000200UL
#define KSWORD_ARK_DRIVER_INTEGRITY_FIELD_DESCRIPTOR_BASELINE   0x00000400UL

#define KSWORD_ARK_DESCRIPTOR_BASELINE_FLAG_AVAILABLE 0x00000001UL
#define KSWORD_ARK_DESCRIPTOR_BASELINE_FLAG_DIFFERS   0x00000002UL
#define KSWORD_ARK_DESCRIPTOR_BASELINE_FLAG_SAME_TABLE 0x00000004UL

// IDT/GDT 描述符通用标志。它们仅表示 R0 采集到的硬件位，
// 不用于写回或重建描述符。
#define KSWORD_ARK_DESCRIPTOR_FLAG_PRESENT             0x00000001UL
#define KSWORD_ARK_DESCRIPTOR_FLAG_GRANULARITY_PAGE    0x00000002UL
#define KSWORD_ARK_DESCRIPTOR_FLAG_USER_SEGMENT        0x00000004UL
#define KSWORD_ARK_DESCRIPTOR_FLAG_LONG_MODE           0x00000008UL
#define KSWORD_ARK_DESCRIPTOR_FLAG_DEFAULT_BIG         0x00000010UL
#define KSWORD_ARK_DESCRIPTOR_FLAG_AVAILABLE           0x00000020UL
#define KSWORD_ARK_DESCRIPTOR_FLAG_READ_FAILED         0x00000040UL

// Driver Integrity response status flags.
// These bits summarize whether rows are complete, partial, unsupported, or
// truncated without requiring R3 to parse every evidence row first.
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_FLAG_PARTIAL         0x00000001UL
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_FLAG_UNSUPPORTED     0x00000002UL
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_FLAG_TRUNCATED       0x00000004UL
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_FLAG_PDB_REQUIRED    0x00000008UL

// Driver Integrity per-entry target range state.
// R0 only classifies observed pointers against loaded-module ranges; it never
// patches or redirects targets based on these values.
#define KSWORD_ARK_DRIVER_INTEGRITY_RANGE_UNKNOWN               0UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RANGE_IN_DRIVER             1UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RANGE_IN_OTHER_MODULE       2UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RANGE_UNRESOLVED            3UL
#define KSWORD_ARK_DRIVER_INTEGRITY_RANGE_NULL                  4UL

// Driver Integrity evidence classes.
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_MODULE_VIEW          1UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_PS_LOADED_MODULES    2UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_DRIVER_OBJECT        3UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_DRIVER_SECTION       4UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_MAJOR_FUNCTION       5UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_FAST_IO              6UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_DEVICE_CHAIN         7UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_SERVICE              8UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_CPU_CONTROL          9UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_DESCRIPTOR_TABLE     10UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_MSR_ENTRY            11UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_IDT_HANDLER          12UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_OPTIONAL_GLOBAL      13UL
#define KSWORD_ARK_DRIVER_INTEGRITY_CLASS_GDT_DESCRIPTOR       14UL

// Driver Integrity query status.
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_UNAVAILABLE         0UL
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_OK                  1UL
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_PARTIAL             2UL
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_NOT_FOUND           3UL
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_BUFFER_TOO_SMALL    4UL
#define KSWORD_ARK_DRIVER_INTEGRITY_STATUS_QUERY_FAILED        5UL

// Entry flags.
#define KSWORD_ARK_SSDT_ENTRY_FLAG_INDEX_RESOLVED 0x00000001UL
#define KSWORD_ARK_SSDT_ENTRY_FLAG_TABLE_ADDRESS_VALID 0x00000002UL
#define KSWORD_ARK_SSDT_ENTRY_FLAG_SHADOW_TABLE        0x00000004UL
#define KSWORD_ARK_SSDT_ENTRY_FLAG_STUB_EXPORT         0x00000008UL
#define KSWORD_ARK_SSDT_ENTRY_FLAG_TABLE_VALUE_CAPTURED 0x00000010UL

// Kernel hook 行状态。
#define KSWORD_ARK_KERNEL_HOOK_STATUS_UNKNOWN             0UL
#define KSWORD_ARK_KERNEL_HOOK_STATUS_CLEAN               1UL
#define KSWORD_ARK_KERNEL_HOOK_STATUS_SUSPICIOUS          2UL
#define KSWORD_ARK_KERNEL_HOOK_STATUS_INTERNAL_BRANCH     3UL
#define KSWORD_ARK_KERNEL_HOOK_STATUS_READ_FAILED         4UL
#define KSWORD_ARK_KERNEL_HOOK_STATUS_PARSE_FAILED        5UL
#define KSWORD_ARK_KERNEL_HOOK_STATUS_FORCE_REQUIRED      6UL
#define KSWORD_ARK_KERNEL_HOOK_STATUS_PATCHED             7UL
#define KSWORD_ARK_KERNEL_HOOK_STATUS_PATCH_FAILED        8UL

// Kernel Hook module range state. These values are read-only evidence.
#define KSWORD_ARK_KERNEL_HOOK_RANGE_UNKNOWN              0UL
#define KSWORD_ARK_KERNEL_HOOK_RANGE_WITHIN_EXPECTED      1UL
#define KSWORD_ARK_KERNEL_HOOK_RANGE_WITHIN_OTHER_MODULE  2UL
#define KSWORD_ARK_KERNEL_HOOK_RANGE_UNRESOLVED           3UL

// Kernel Hook first-byte hash status. The hash covers currentBytes only.
#define KSWORD_ARK_KERNEL_HOOK_HASH_STATUS_UNAVAILABLE    0UL
#define KSWORD_ARK_KERNEL_HOOK_HASH_STATUS_CURRENT_BYTES  1UL

// Inline Hook 类型。
#define KSWORD_ARK_INLINE_HOOK_TYPE_NONE                  0UL
#define KSWORD_ARK_INLINE_HOOK_TYPE_JMP_REL32             1UL
#define KSWORD_ARK_INLINE_HOOK_TYPE_JMP_REL8              2UL
#define KSWORD_ARK_INLINE_HOOK_TYPE_JMP_RIP_INDIRECT      3UL
#define KSWORD_ARK_INLINE_HOOK_TYPE_MOV_RAX_JMP_RAX       4UL
#define KSWORD_ARK_INLINE_HOOK_TYPE_MOV_R11_JMP_R11       5UL
#define KSWORD_ARK_INLINE_HOOK_TYPE_RET_PATCH             6UL
#define KSWORD_ARK_INLINE_HOOK_TYPE_INT3_PATCH            7UL
#define KSWORD_ARK_INLINE_HOOK_TYPE_UNKNOWN_PATCH         8UL

// Inline 修复模式。
#define KSWORD_ARK_INLINE_PATCH_MODE_NOP_BRANCH           1UL
#define KSWORD_ARK_INLINE_PATCH_MODE_RESTORE_BYTES        2UL

// IAT/EAT Hook 类型。
#define KSWORD_ARK_IAT_EAT_HOOK_CLASS_IAT                 1UL
#define KSWORD_ARK_IAT_EAT_HOOK_CLASS_EAT                 2UL

// DriverObject 查询状态。
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_STATUS_UNAVAILABLE      0UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_STATUS_OK               1UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_STATUS_PARTIAL          2UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_STATUS_NAME_INVALID     3UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_STATUS_NOT_FOUND        4UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_STATUS_REFERENCE_FAILED 5UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_STATUS_BUFFER_TOO_SMALL 6UL
#define KSWORD_ARK_DRIVER_OBJECT_QUERY_STATUS_QUERY_FAILED     7UL

// Driver force-unload 状态。
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_UNKNOWN            0UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_UNLOADED           1UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_UNLOAD_ROUTINE_MISSING 2UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_REFERENCE_FAILED    3UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_THREAD_FAILED       4UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_WAIT_TIMEOUT        5UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_OPERATION_FAILED    6UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_FORCED_CLEANUP      7UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_CLEANUP_FAILED      8UL
#define KSWORD_ARK_DRIVER_UNLOAD_STATUS_UNLOAD_ROUTINE_CALLED 9UL

// DriverObject field flags。
#define KSWORD_ARK_DRIVER_OBJECT_FIELD_BASIC_PRESENT         0x00000001UL
#define KSWORD_ARK_DRIVER_OBJECT_FIELD_DRIVER_NAME_PRESENT   0x00000002UL
#define KSWORD_ARK_DRIVER_OBJECT_FIELD_SERVICE_KEY_PRESENT   0x00000004UL
#define KSWORD_ARK_DRIVER_OBJECT_FIELD_IMAGE_PATH_PRESENT    0x00000008UL
#define KSWORD_ARK_DRIVER_OBJECT_FIELD_MAJOR_PRESENT         0x00000010UL
#define KSWORD_ARK_DRIVER_OBJECT_FIELD_DEVICE_PRESENT        0x00000020UL
#define KSWORD_ARK_DRIVER_OBJECT_FIELD_DEVICE_TRUNCATED      0x00000040UL
#define KSWORD_ARK_DRIVER_OBJECT_FIELD_ATTACHED_TRUNCATED    0x00000080UL

#define KSWORD_ARK_SSDT_ENTRY_MAX_NAME 96U
#define KSWORD_ARK_SSDT_ENTRY_MAX_MODULE 64U
#define KSWORD_ARK_KERNEL_HOOK_NAME_CHARS 128U
#define KSWORD_ARK_KERNEL_HOOK_MODULE_CHARS 64U
#define KSWORD_ARK_KERNEL_HOOK_BYTES 16U
#define KSWORD_ARK_KERNEL_HOOK_PATCH_MAX_BYTES 32U
#define KSWORD_ARK_KERNEL_HOOK_DEFAULT_MAX_ENTRIES 4096UL
#define KSWORD_ARK_DRIVER_OBJECT_NAME_CHARS 260U
#define KSWORD_ARK_DRIVER_IMAGE_PATH_CHARS 512U
#define KSWORD_ARK_DRIVER_SERVICE_KEY_CHARS 260U
#define KSWORD_ARK_DRIVER_DEVICE_NAME_CHARS 260U
#define KSWORD_ARK_DRIVER_MODULE_NAME_CHARS 64U
#define KSWORD_ARK_DRIVER_INTEGRITY_DETAIL_CHARS 256U
#define KSWORD_ARK_DRIVER_INTEGRITY_OWNER_CHARS 96U
#define KSWORD_ARK_DRIVER_MAJOR_FUNCTION_COUNT 28U
#define KSWORD_ARK_DRIVER_DEVICE_LIMIT_DEFAULT 96UL
#define KSWORD_ARK_DRIVER_ATTACHED_LIMIT_DEFAULT 16UL
#define KSWORD_ARK_DRIVER_INTEGRITY_DEFAULT_MAX_ROWS 4096UL
#define KSWORD_ARK_DRIVER_INTEGRITY_DEFAULT_IDT_VECTORS 256UL
#define KSWORD_ARK_CPU_HARDWARE_VENDOR_CHARS 13U
#define KSWORD_ARK_CPU_HARDWARE_BRAND_CHARS 49U

// CPU hardware feature flags from R0 CPUID snapshots.
// These flags intentionally model stable architectural capabilities only. R3 can
// render them as badges without parsing raw CPUID leaves in UI code.
#define KSWORD_ARK_CPU_FEATURE_SSE3          0x0000000000000001ULL
#define KSWORD_ARK_CPU_FEATURE_PCLMULQDQ     0x0000000000000002ULL
#define KSWORD_ARK_CPU_FEATURE_VMX           0x0000000000000004ULL
#define KSWORD_ARK_CPU_FEATURE_SSSE3         0x0000000000000008ULL
#define KSWORD_ARK_CPU_FEATURE_FMA           0x0000000000000010ULL
#define KSWORD_ARK_CPU_FEATURE_SSE41         0x0000000000000020ULL
#define KSWORD_ARK_CPU_FEATURE_SSE42         0x0000000000000040ULL
#define KSWORD_ARK_CPU_FEATURE_AES           0x0000000000000080ULL
#define KSWORD_ARK_CPU_FEATURE_XSAVE         0x0000000000000100ULL
#define KSWORD_ARK_CPU_FEATURE_OSXSAVE       0x0000000000000200ULL
#define KSWORD_ARK_CPU_FEATURE_AVX           0x0000000000000400ULL
#define KSWORD_ARK_CPU_FEATURE_HYPERVISOR    0x0000000000000800ULL
#define KSWORD_ARK_CPU_FEATURE_MSR           0x0000000000001000ULL
#define KSWORD_ARK_CPU_FEATURE_PAE           0x0000000000002000ULL
#define KSWORD_ARK_CPU_FEATURE_MCE           0x0000000000004000ULL
#define KSWORD_ARK_CPU_FEATURE_CX8           0x0000000000008000ULL
#define KSWORD_ARK_CPU_FEATURE_APIC          0x0000000000010000ULL
#define KSWORD_ARK_CPU_FEATURE_SEP           0x0000000000020000ULL
#define KSWORD_ARK_CPU_FEATURE_MTRR          0x0000000000040000ULL
#define KSWORD_ARK_CPU_FEATURE_PGE           0x0000000000080000ULL
#define KSWORD_ARK_CPU_FEATURE_MCA           0x0000000000100000ULL
#define KSWORD_ARK_CPU_FEATURE_CMOV          0x0000000000200000ULL
#define KSWORD_ARK_CPU_FEATURE_PAT           0x0000000000400000ULL
#define KSWORD_ARK_CPU_FEATURE_PSE36         0x0000000000800000ULL
#define KSWORD_ARK_CPU_FEATURE_CLFSH         0x0000000001000000ULL
#define KSWORD_ARK_CPU_FEATURE_MMX           0x0000000002000000ULL
#define KSWORD_ARK_CPU_FEATURE_FXSR          0x0000000004000000ULL
#define KSWORD_ARK_CPU_FEATURE_SSE           0x0000000008000000ULL
#define KSWORD_ARK_CPU_FEATURE_SSE2          0x0000000010000000ULL
#define KSWORD_ARK_CPU_FEATURE_FSGSBASE      0x0000000020000000ULL
#define KSWORD_ARK_CPU_FEATURE_BMI1          0x0000000040000000ULL
#define KSWORD_ARK_CPU_FEATURE_HLE           0x0000000080000000ULL
#define KSWORD_ARK_CPU_FEATURE_AVX2          0x0000000100000000ULL
#define KSWORD_ARK_CPU_FEATURE_SMEP          0x0000000200000000ULL
#define KSWORD_ARK_CPU_FEATURE_BMI2          0x0000000400000000ULL
#define KSWORD_ARK_CPU_FEATURE_ERMS          0x0000000800000000ULL
#define KSWORD_ARK_CPU_FEATURE_INVPCID       0x0000001000000000ULL
#define KSWORD_ARK_CPU_FEATURE_RTM           0x0000002000000000ULL
#define KSWORD_ARK_CPU_FEATURE_AVX512F       0x0000004000000000ULL
#define KSWORD_ARK_CPU_FEATURE_RDSEED        0x0000008000000000ULL
#define KSWORD_ARK_CPU_FEATURE_ADX           0x0000010000000000ULL
#define KSWORD_ARK_CPU_FEATURE_SMAP          0x0000020000000000ULL
#define KSWORD_ARK_CPU_FEATURE_CLFLUSHOPT    0x0000040000000000ULL
#define KSWORD_ARK_CPU_FEATURE_CLWB          0x0000080000000000ULL
#define KSWORD_ARK_CPU_FEATURE_UMIP          0x0000100000000000ULL
#define KSWORD_ARK_CPU_FEATURE_PKU           0x0000200000000000ULL
#define KSWORD_ARK_CPU_FEATURE_OSPKE         0x0000400000000000ULL
#define KSWORD_ARK_CPU_FEATURE_RDRAND        0x0000800000000000ULL
#define KSWORD_ARK_CPU_FEATURE_RDTSCP        0x0001000000000000ULL
#define KSWORD_ARK_CPU_FEATURE_NX            0x0002000000000000ULL
#define KSWORD_ARK_CPU_FEATURE_LM            0x0004000000000000ULL
#define KSWORD_ARK_CPU_FEATURE_INVARIANT_TSC 0x0008000000000000ULL
#define KSWORD_ARK_CPU_FEATURE_LAHF_LM       0x0010000000000000ULL

// Physical memory layout response flags.
#define KSWORD_ARK_PHYSICAL_MEMORY_LAYOUT_FIELD_RANGES_PRESENT 0x00000001UL

typedef struct _KSWORD_ARK_ENUM_SSDT_REQUEST
{
    unsigned long flags;
    unsigned long reserved;
} KSWORD_ARK_ENUM_SSDT_REQUEST;

typedef struct _KSWORD_ARK_SSDT_ENTRY
{
    unsigned long serviceIndex;
    unsigned long flags;
    unsigned long long zwRoutineAddress;
    unsigned long long serviceRoutineAddress;
    char serviceName[KSWORD_ARK_SSDT_ENTRY_MAX_NAME];
    char moduleName[KSWORD_ARK_SSDT_ENTRY_MAX_MODULE];
    unsigned long long tableEntryAddress;
    unsigned long long currentTableValue;
    unsigned long tableEntrySize;
    unsigned long reserved;
} KSWORD_ARK_SSDT_ENTRY;

typedef struct _KSWORD_ARK_ENUM_SSDT_RESPONSE
{
    unsigned long version;
    unsigned long totalCount;
    unsigned long returnedCount;
    unsigned long entrySize;
    unsigned long long serviceTableBase;
    unsigned long serviceCountFromTable;
    unsigned long reserved;
    KSWORD_ARK_SSDT_ENTRY entries[1];
} KSWORD_ARK_ENUM_SSDT_RESPONSE;

typedef struct _KSWORD_ARK_SCAN_KERNEL_HOOKS_REQUEST
{
    unsigned long flags;
    unsigned long maxEntries;
    unsigned long reserved0;
    unsigned long reserved1;
    wchar_t moduleName[KSWORD_ARK_KERNEL_HOOK_MODULE_CHARS];
} KSWORD_ARK_SCAN_KERNEL_HOOKS_REQUEST;

/*
 * Inline Hook 行兼容说明：
 * expectedBytes 是旧协议字段名，当前 R0 填入运行时观察基线，
 * 不代表磁盘干净/原始字节。R3 如需干净基线，应按 moduleBase
 * 与 functionAddress 计算 RVA 后从磁盘模块文件读取并自行比较。
 */
typedef struct _KSWORD_ARK_INLINE_HOOK_ENTRY
{
    unsigned long status;
    unsigned long hookType;
    unsigned long flags;
    unsigned long originalByteCount;
    unsigned long currentByteCount;
    unsigned long moduleRangeState;
    unsigned long long functionAddress;
    unsigned long long targetAddress;
    unsigned long long moduleBase;
    unsigned long long targetModuleBase;
    char functionName[KSWORD_ARK_KERNEL_HOOK_NAME_CHARS];
    wchar_t moduleName[KSWORD_ARK_KERNEL_HOOK_MODULE_CHARS];
    wchar_t targetModuleName[KSWORD_ARK_KERNEL_HOOK_MODULE_CHARS];
    unsigned char currentBytes[KSWORD_ARK_KERNEL_HOOK_BYTES];
    unsigned char expectedBytes[KSWORD_ARK_KERNEL_HOOK_BYTES];
    unsigned long firstBytesHashStatus;
    unsigned long firstBytesHash;
    unsigned long long currentTargetAddress;
    unsigned long long expectedOwnerBase;
} KSWORD_ARK_INLINE_HOOK_ENTRY;

typedef struct _KSWORD_ARK_SCAN_INLINE_HOOKS_RESPONSE
{
    unsigned long version;
    unsigned long status;
    unsigned long totalCount;
    unsigned long returnedCount;
    unsigned long entrySize;
    unsigned long moduleCount;
    long lastStatus;
    unsigned long reserved;
    KSWORD_ARK_INLINE_HOOK_ENTRY entries[1];
} KSWORD_ARK_SCAN_INLINE_HOOKS_RESPONSE;

typedef struct _KSWORD_ARK_PATCH_INLINE_HOOK_REQUEST
{
    unsigned long flags;
    unsigned long mode;
    unsigned long patchBytes;
    unsigned long reserved;
    unsigned long long functionAddress;
    unsigned char expectedCurrentBytes[KSWORD_ARK_KERNEL_HOOK_PATCH_MAX_BYTES];
    unsigned char restoreBytes[KSWORD_ARK_KERNEL_HOOK_PATCH_MAX_BYTES];
} KSWORD_ARK_PATCH_INLINE_HOOK_REQUEST;

typedef struct _KSWORD_ARK_PATCH_INLINE_HOOK_RESPONSE
{
    unsigned long version;
    unsigned long status;
    unsigned long bytesPatched;
    unsigned long fieldFlags;
    long lastStatus;
    unsigned long reserved;
    unsigned long long functionAddress;
    unsigned char beforeBytes[KSWORD_ARK_KERNEL_HOOK_PATCH_MAX_BYTES];
    unsigned char afterBytes[KSWORD_ARK_KERNEL_HOOK_PATCH_MAX_BYTES];
} KSWORD_ARK_PATCH_INLINE_HOOK_RESPONSE;

typedef struct _KSWORD_ARK_IAT_EAT_HOOK_ENTRY
{
    unsigned long hookClass;
    unsigned long status;
    unsigned long flags;
    unsigned long ordinal;
    unsigned long long moduleBase;
    unsigned long long thunkAddress;
    unsigned long long currentTarget;
    unsigned long long expectedTarget;
    unsigned long long targetModuleBase;
    char functionName[KSWORD_ARK_KERNEL_HOOK_NAME_CHARS];
    wchar_t moduleName[KSWORD_ARK_KERNEL_HOOK_MODULE_CHARS];
    wchar_t importModuleName[KSWORD_ARK_KERNEL_HOOK_MODULE_CHARS];
    wchar_t targetModuleName[KSWORD_ARK_KERNEL_HOOK_MODULE_CHARS];
} KSWORD_ARK_IAT_EAT_HOOK_ENTRY;

typedef struct _KSWORD_ARK_ENUM_IAT_EAT_HOOKS_RESPONSE
{
    unsigned long version;
    unsigned long status;
    unsigned long totalCount;
    unsigned long returnedCount;
    unsigned long entrySize;
    unsigned long moduleCount;
    long lastStatus;
    unsigned long reserved;
    KSWORD_ARK_IAT_EAT_HOOK_ENTRY entries[1];
} KSWORD_ARK_ENUM_IAT_EAT_HOOKS_RESPONSE;

typedef struct _KSWORD_ARK_QUERY_DRIVER_OBJECT_REQUEST
{
    unsigned long flags;
    unsigned long maxDevices;
    unsigned long maxAttachedDevices;
    unsigned long reserved;
    wchar_t driverName[KSWORD_ARK_DRIVER_OBJECT_NAME_CHARS];
} KSWORD_ARK_QUERY_DRIVER_OBJECT_REQUEST;

typedef struct _KSWORD_ARK_DRIVER_MAJOR_FUNCTION_ENTRY
{
    unsigned long majorFunction;
    unsigned long flags;
    unsigned long long dispatchAddress;
    unsigned long long moduleBase;
    wchar_t moduleName[KSWORD_ARK_DRIVER_MODULE_NAME_CHARS];
} KSWORD_ARK_DRIVER_MAJOR_FUNCTION_ENTRY;

typedef struct _KSWORD_ARK_DRIVER_DEVICE_ENTRY
{
    unsigned long relationDepth;
    unsigned long deviceType;
    unsigned long flags;
    unsigned long characteristics;
    unsigned long stackSize;
    unsigned long alignmentRequirement;
    long nameStatus;
    unsigned long reserved;
    unsigned long long rootDeviceObjectAddress;
    unsigned long long deviceObjectAddress;
    unsigned long long nextDeviceObjectAddress;
    unsigned long long attachedDeviceObjectAddress;
    unsigned long long driverObjectAddress;
    wchar_t deviceName[KSWORD_ARK_DRIVER_DEVICE_NAME_CHARS];
    // 中文说明：DEVICE_OBJECT.Timer 是 WDK 公开字段；这里只返回只读 PIO_TIMER 地址，
    // 供 R3 构造旧版 SKT64 同等的 IoTimer 清单，不把该地址作为后续修改凭据。
    unsigned long long ioTimerAddress;
} KSWORD_ARK_DRIVER_DEVICE_ENTRY;

// v1 在 ioTimerAddress 加入前结束于 deviceName。R3 使用该常量兼容旧驱动，
// v2 驱动通过 deviceEntrySize 明确告知完整行宽。
#define KSWORD_ARK_DRIVER_DEVICE_ENTRY_V1_SIZE \
    (sizeof(KSWORD_ARK_DRIVER_DEVICE_ENTRY) - sizeof(unsigned long long))

typedef struct _KSWORD_ARK_QUERY_DRIVER_OBJECT_RESPONSE
{
    unsigned long version;
    unsigned long queryStatus;
    unsigned long fieldFlags;
    unsigned long majorFunctionCount;
    unsigned long totalDeviceCount;
    unsigned long returnedDeviceCount;
    unsigned long deviceEntrySize;
    unsigned long reserved;
    long lastStatus;
    unsigned long driverFlags;
    unsigned long driverSize;
    unsigned long reserved1;
    unsigned long long driverObjectAddress;
    unsigned long long driverStart;
    unsigned long long driverSection;
    unsigned long long driverUnload;
    wchar_t driverName[KSWORD_ARK_DRIVER_OBJECT_NAME_CHARS];
    wchar_t serviceKeyName[KSWORD_ARK_DRIVER_SERVICE_KEY_CHARS];
    wchar_t imagePath[KSWORD_ARK_DRIVER_IMAGE_PATH_CHARS];
    KSWORD_ARK_DRIVER_MAJOR_FUNCTION_ENTRY majorFunctions[KSWORD_ARK_DRIVER_MAJOR_FUNCTION_COUNT];
    KSWORD_ARK_DRIVER_DEVICE_ENTRY devices[1];
} KSWORD_ARK_QUERY_DRIVER_OBJECT_RESPONSE;

#define KSWORD_ARK_IO_TIMER_CONTROL_PROTOCOL_VERSION 1UL

#define KSWORD_ARK_IO_TIMER_CONTROL_ACTION_START 1UL
#define KSWORD_ARK_IO_TIMER_CONTROL_ACTION_STOP  2UL

#define KSWORD_ARK_IO_TIMER_CONTROL_FLAG_UI_CONFIRMED 0x00000001UL
#define KSWORD_ARK_IO_TIMER_CONTROL_CONFIRMATION_TOKEN 0x49544D52UL

#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_OK                      0UL
#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_INVALID_REQUEST         1UL
#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_DRIVER_NOT_FOUND        2UL
#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_DRIVER_IDENTITY_CHANGED 3UL
#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_DEVICE_NOT_FOUND        4UL
#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_DEVICE_IDENTITY_CHANGED 5UL
#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_TIMER_NOT_PRESENT       6UL
#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_TIMER_IDENTITY_CHANGED  7UL
#define KSWORD_ARK_IO_TIMER_CONTROL_STATUS_ENUMERATION_FAILED      8UL

typedef struct _KSWORD_ARK_CONTROL_IO_TIMER_REQUEST
{
    unsigned long version;
    unsigned long action;
    unsigned long flags;
    unsigned long confirmationToken;
    unsigned long long expectedDriverObjectAddress;
    unsigned long long expectedDeviceObjectAddress;
    unsigned long long expectedTimerAddress;
    wchar_t driverName[KSWORD_ARK_DRIVER_OBJECT_NAME_CHARS];
} KSWORD_ARK_CONTROL_IO_TIMER_REQUEST;

typedef struct _KSWORD_ARK_CONTROL_IO_TIMER_RESPONSE
{
    unsigned long version;
    unsigned long size;
    unsigned long status;
    unsigned long action;
    long lastStatus;
    unsigned long reserved;
    unsigned long long observedDriverObjectAddress;
    unsigned long long observedDeviceObjectAddress;
    unsigned long long observedTimerAddress;
} KSWORD_ARK_CONTROL_IO_TIMER_RESPONSE;

typedef struct _KSWORD_ARK_QUERY_DRIVER_INTEGRITY_REQUEST
{
    unsigned long version;
    unsigned long flags;
    unsigned long maxRows;
    unsigned long maxIdtVectorsPerCpu;
    unsigned long maxDevices;
    unsigned long maxAttachedDevices;
    unsigned long requestSize;
    unsigned long requestFieldMask;
    unsigned long long targetModuleBase;
    wchar_t driverName[KSWORD_ARK_DRIVER_OBJECT_NAME_CHARS];
} KSWORD_ARK_QUERY_DRIVER_INTEGRITY_REQUEST;

/*
 * Driver Integrity evidence compatibility:
 * - The fields through detail[] are the v1 prefix and must remain stable.
 * - Protocol v2 appends typed DriverObject columns. Protocol v3 appends
 *   descriptor columns. Older R3 clients keep using the stable prefix while
 *   newer clients use entrySize/fieldMask/statusFlags.
 * - Missing PDB/DynData data is reported as partial/unsupported; R0 never
 *   guesses offsets from build numbers.
 */
typedef struct _KSWORD_ARK_DRIVER_INTEGRITY_EVIDENCE
{
    unsigned long evidenceClass;
    unsigned long riskFlags;
    unsigned long sourceMask;
    unsigned long confidence;
    unsigned long processorGroup;
    unsigned long processorNumber;
    unsigned long vector;
    unsigned long ownerModuleSize;
    unsigned long long objectAddress;
    unsigned long long targetAddress;
    unsigned long long ownerModuleBase;
    wchar_t ownerModule[KSWORD_ARK_DRIVER_INTEGRITY_OWNER_CHARS];
    wchar_t detail[KSWORD_ARK_DRIVER_INTEGRITY_DETAIL_CHARS];
    unsigned long entryStatus;
    unsigned long statusFlags;
    unsigned long fieldMask;
    unsigned long riskScore;
    unsigned long rangeState;
    unsigned long ordinal;
    unsigned long deviceType;
    unsigned long deviceFlags;
    unsigned long long driverObjectAddress;
    unsigned long long driverStart;
    unsigned long long driverSize;
    unsigned long long driverSection;
    unsigned long long driverUnload;
    unsigned long long deviceObjectAddress;
    unsigned long long nextDeviceObjectAddress;
    unsigned long long attachedDeviceObjectAddress;
    unsigned long long deviceDriverObjectAddress;
    unsigned long long kldrEntryAddress;
    unsigned long long kldrListHeadAddress;
    unsigned long long kldrDllBase;
    unsigned long kldrSizeOfImage;
    unsigned long reserved2;
    // v3 尾部：IDT/GDT 描述符结构化字段，v1/v2 客户端可按 entrySize 忽略。
    unsigned long descriptorSelector;
    unsigned long descriptorType;
    unsigned long descriptorDpl;
    unsigned long descriptorFlags;
    unsigned long descriptorSize;
    unsigned long descriptorTableLimit;
    unsigned long long descriptorTableBase;
    unsigned long long descriptorBase;
    unsigned long long descriptorLimit;
    unsigned long long descriptorRawLow;
    unsigned long long descriptorRawHigh;
    // v4 尾部：驱动加载早期捕获的 IDT 只读基线；不适用于 GDT 行。
    unsigned long baselineDescriptorFlags;
    unsigned long baselineGeneration;
    unsigned long long baselineDescriptorBase;
    unsigned long long baselineDescriptorRawLow;
    unsigned long long baselineDescriptorRawHigh;
} KSWORD_ARK_DRIVER_INTEGRITY_EVIDENCE;

typedef struct _KSWORD_ARK_QUERY_DRIVER_INTEGRITY_RESPONSE
{
    unsigned long version;
    unsigned long queryStatus;
    unsigned long flags;
    unsigned long sourceMask;
    unsigned long totalCount;
    unsigned long returnedCount;
    unsigned long entrySize;
    unsigned long cpuCount;
    unsigned long moduleCount;
    unsigned long fieldFlags;
    long lastStatus;
    unsigned long statusFlags;
    KSWORD_ARK_DRIVER_INTEGRITY_EVIDENCE entries[1];
} KSWORD_ARK_QUERY_DRIVER_INTEGRITY_RESPONSE;

typedef struct _KSWORD_ARK_QUERY_CPU_HARDWARE_RESPONSE
{
    unsigned long version;
    unsigned long fieldFlags;
    unsigned long logicalProcessorCount;
    unsigned long activeProcessorCount;
    unsigned long packageCount;
    unsigned long family;
    unsigned long model;
    unsigned long stepping;
    unsigned long processorType;
    unsigned long brandIndex;
    unsigned long clflushLineSize;
    unsigned long initialApicId;
    unsigned long maxBasicLeaf;
    unsigned long maxExtendedLeaf;
    long lastStatus;
    unsigned long reserved;
    unsigned long long featureMask;
    unsigned long long leaf1Ecx;
    unsigned long long leaf1Edx;
    unsigned long long leaf7Ebx;
    unsigned long long leaf7Ecx;
    unsigned long long leaf7Edx;
    unsigned long long leaf80000001Ecx;
    unsigned long long leaf80000001Edx;
    char vendor[KSWORD_ARK_CPU_HARDWARE_VENDOR_CHARS];
    char brand[KSWORD_ARK_CPU_HARDWARE_BRAND_CHARS];
} KSWORD_ARK_QUERY_CPU_HARDWARE_RESPONSE;

typedef struct _KSWORD_ARK_QUERY_PHYSICAL_MEMORY_LAYOUT_RESPONSE
{
    unsigned long version;
    unsigned long fieldFlags;
    unsigned long rangeCount;
    unsigned long zeroLengthRangeCount;
    unsigned long truncated;
    unsigned long reserved0;
    long lastStatus;
    unsigned long reserved1;
    unsigned long long totalPhysicalBytes;
    unsigned long long highestPhysicalAddress;
    unsigned long long largestRangeBytes;
    unsigned long long smallestRangeBytes;
    unsigned long long firstBaseAddress;
    unsigned long long lastEndAddress;
    unsigned long long estimatedAddressSpaceGapBytes;
} KSWORD_ARK_QUERY_PHYSICAL_MEMORY_LAYOUT_RESPONSE;

typedef struct _KSWORD_ARK_ENUM_TIMER_DPC_REQUEST
{
    unsigned long version;
    unsigned long flags;
    unsigned long maxEntries;
    unsigned long maxEntriesPerBucket;
} KSWORD_ARK_ENUM_TIMER_DPC_REQUEST;

typedef struct _KSWORD_ARK_TIMER_DPC_ENTRY
{
    unsigned short processorGroup;
    unsigned short processorNumber;
    unsigned long bucketIndex;
    unsigned long flags;
    unsigned long timerType;
    long period;
    long long dueTime;
    unsigned long long timerAddress;
    unsigned long long dpcAddress;
    unsigned long long deferredRoutine;
    unsigned long long deferredContext;
} KSWORD_ARK_TIMER_DPC_ENTRY;

typedef struct _KSWORD_ARK_ENUM_TIMER_DPC_RESPONSE
{
    unsigned long version;
    unsigned long queryStatus;
    unsigned long statusFlags;
    unsigned long totalCount;
    unsigned long returnedCount;
    unsigned long entrySize;
    unsigned long processorCount;
    unsigned long bucketCount;
    unsigned long bucketsVisited;
    unsigned long corruptBucketCount;
    unsigned long readFailureCount;
    unsigned long duplicateCount;
    long lastStatus;
    unsigned long reserved;
    KSWORD_ARK_TIMER_DPC_ENTRY entries[1];
} KSWORD_ARK_ENUM_TIMER_DPC_RESPONSE;

#define KSWORD_ARK_ENUM_TIMER_DPC_RESPONSE_HEADER_SIZE \
    (sizeof(KSWORD_ARK_ENUM_TIMER_DPC_RESPONSE) - sizeof(KSWORD_ARK_TIMER_DPC_ENTRY))

typedef struct _KSWORD_ARK_FORCE_UNLOAD_DRIVER_REQUEST
{
    unsigned long version;
    unsigned long flags;
    unsigned long timeoutMilliseconds;
    unsigned long reserved;
    wchar_t driverName[KSWORD_ARK_DRIVER_OBJECT_NAME_CHARS];
    unsigned long long targetModuleBase;
} KSWORD_ARK_FORCE_UNLOAD_DRIVER_REQUEST;

typedef struct _KSWORD_ARK_FORCE_UNLOAD_DRIVER_RESPONSE
{
    unsigned long version;
    unsigned long status;
    unsigned long flags;
    unsigned long reserved; // requestedFlags：R3 原始请求 flags；R0 日志用于区分“未请求”和“preflight 降级”。
    long lastStatus;
    long waitStatus;
    unsigned long cleanupFlagsApplied;
    unsigned long deletedDeviceCount;
    unsigned long long driverObjectAddress;
    unsigned long long driverUnloadAddress;
    unsigned long callbackCandidates;
    unsigned long callbacksRemoved;
    unsigned long callbackFailures;
    long callbackLastStatus;
    unsigned long threadCandidates;
    unsigned long threadsTerminated;
    unsigned long threadFailures;
    long threadLastStatus;
    unsigned long detachedDeviceCount;
    unsigned long reserved2;
    wchar_t driverName[KSWORD_ARK_DRIVER_OBJECT_NAME_CHARS];
} KSWORD_ARK_FORCE_UNLOAD_DRIVER_RESPONSE;
