[Refactor] Code improvements

Source/NTAssassin/Include/NTACrypt.h

@@ -6,4 +6,4 @@
 
 typedef BOOL(CALLBACK* CRYPT_CERTENUMPROC)(_In_ PCCERT_CONTEXT CertContext, LPARAM Param);
 
-NTA_API BOOL NTAPI Crypt_EnumBlobCertificates(_In_reads_(BlobSize) PBYTE BlobData, _In_ ULONG BlobSize, DWORD ExpectedContentTypeFlags, _In_ CRYPT_CERTENUMPROC CertEnumProc, LPARAM Param);
+NTA_API BOOL NTAPI Crypt_EnumBlobCertificates(_In_reads_bytes_(BlobSize) PBYTE BlobData, _In_ ULONG BlobSize, DWORD ExpectedContentTypeFlags, _In_ CRYPT_CERTENUMPROC CertEnumProc, LPARAM Param);

Source/NTAssassin/Include/NTACtl.h

@@ -54,7 +54,10 @@ typedef struct _CTL_COMBOBOXCTL_ITEM
     LPARAM          Param;
 } CTL_COMBOBOXCTL_ITEM, *PCTL_COMBOBOXCTL_ITEM;
 
-typedef BOOL(CALLBACK* CTL_TREEVIEWITEMENUMPROC)(HWND TreeView, HTREEITEM TreeItem, UINT Level, LPARAM Param);
+typedef
+BOOL
+CALLBACK
+CTL_FN_TREEVIEWITEMENUMPROC(HWND TreeView, HTREEITEM TreeItem, UINT Level, LPARAM Param);
 
 /// <summary>
 /// Creates menu
@@ -130,10 +133,17 @@ NTA_API BOOL NTAPI Ctl_InitComboBoxEx(HWND ComboBox, _In_ PCTL_COMBOBOXCTL_ITEM
 /// <param name="TreeItemEnumProc">Callback procedure to receive information of each item</param>
 /// <param name="Param">User defined value passed to the callback</param>
 /// <returns>Returns handle to the last enumerated item if the callback stops the enumeration, or NULL if enumeration finished successfully</returns>
-NTA_API HTREEITEM NTAPI Ctl_EnumTreeViewItems(HWND TreeView, BOOL BFS, _In_ CTL_TREEVIEWITEMENUMPROC TreeItemEnumProc, LPARAM Param);
+NTA_API
+HTREEITEM
+NTAPI
+Ctl_EnumTreeViewItems(
+    _In_ HWND TreeView,
+    BOOL BFS,
+    _In_ CTL_FN_TREEVIEWITEMENUMPROC* TreeItemEnumProc,
+    LPARAM Param);
 
 /// <summary>
-/// Sends CB_SETCURSEL message but will notify parent window by sending "WM_COMMAND" with CBN_SELCHANGE
+/// Sends CB_SETCURSEL message and also notify parent window with WM_COMMAND message and CBN_SELCHANGE
 /// </summary>
 /// <seealso cref="CB_SETCURSEL"/>
-NTA_API LRESULT NTAPI Ctl_ComboBoxSetSelect(HWND ComboBox, INT ItemIndex);
+NTA_API LRESULT NTAPI Ctl_ComboBoxSetSelection(_In_ HWND ComboBox, INT ItemIndex);

Source/NTAssassin/Include/NTAIO.h

@@ -13,27 +13,3 @@
 /// <param name="Length">Size of data in bytes</param>
 /// <returns>TRUE if succeeded, or NULL if failed, error code storaged in last STATUS</returns>
 NTA_API BOOL NTAPI IO_Write(HANDLE FileHandle, ULONGLONG ByteOffset, _In_reads_bytes_(Length) PVOID Buffer, ULONG Length);
-
-/// <summary>
-/// Writes string to specified file or device
-/// </summary>
-/// <seealso cref="IO_Write"/>
-NTA_API BOOL NTAPI IO_WriteStringW(HANDLE FileHandle, _In_z_ PCWSTR String);
-NTA_API BOOL NTAPI IO_WriteStringA(HANDLE FileHandle, _In_z_ PCSTR String);
-#ifdef UNICODE
-#define IO_WriteString IO_WriteStringW
-#else
-#define IO_WriteString IO_WriteStringA
-#endif
-
-/// <summary>
-/// Writes string to specified file or device and starts a new line
-/// </summary>
-/// <seealso cref="IO_Write"/>
-NTA_API BOOL NTAPI IO_WriteLineW(HANDLE FileHandle, _In_z_ PCWSTR String);
-NTA_API BOOL NTAPI IO_WriteLineA(HANDLE FileHandle, _In_z_ PCSTR String);
-#ifdef UNICODE
-#define IO_WriteLine IO_WriteLineW
-#else
-#define IO_WriteLine IO_WriteLineA
-#endif

Source/NTAssassin/Include/NTAMem.h

@@ -21,7 +21,11 @@
 /// </summary>
 /// <seealso cref="VirtualAlloc"/>
 /// <return>Error code storaged in last STATUS</return>
-NTA_API _Check_return_ _Ret_maybenull_ _Post_writable_byte_size_(Size) PVOID NTAPI Mem_PageAlloc(_In_ SIZE_T Size, _In_ ULONG Protect);
+NTA_API
+_Must_inspect_result_
+__drv_allocatesMem(Mem)
+_Post_writable_byte_size_(Size)
+PVOID NTAPI Mem_PageAlloc(_In_ SIZE_T Size, _In_ ULONG Protect);
 
 /// <summary>
 /// Changes the protection of memory pages

Source/NTAssassin/Include/NTANT.h

@@ -25,12 +25,6 @@ NTA_API DWORD NTAPI NT_GetLsaPid();
 /// <remarks>ObjectName.Buffer should be freed by <c>Mem_HeapFree</c> when no longer needs</remarks>
 NTA_API BOOL NTAPI NT_InitPathObject(POBJECT_ATTRIBUTES Object, _In_z_ PCWSTR Path, HANDLE RootDirectory, PUNICODE_STRING ObjectName);
 
-/// <summary>
-/// Opens existing registry key
-/// </summary>
-/// <seealso cref="NtOpenKey"/>
-NTA_API HANDLE NTAPI NT_RegOpenKey(_In_ PUNICODE_STRING KeyPath, _In_ ACCESS_MASK DesiredAccess);
-
 /// <summary>
 /// Gets a DWORD value from registry key
 /// </summary>

Source/NTAssassin/Include/NTAPE.h

@@ -2,6 +2,8 @@
 
 #include "NTAssassin_Base.h"
 
+#include <WinTrust.h>
+
 typedef struct _PE_STRUCT
 {
     PBYTE                           Image;

Source/NTAssassin/Include/NTAssassin.h

@@ -20,7 +20,6 @@ EXTERN_C_START
 #include "NTAPE.h"
 #include "NTAProc.h"
 #include "NTARProc.h"
-#include "NTACon.h"
 #include "NTAUI.h"
 #include "NTACtl.h"
 #include "NTAGDI.h"

Source/NTAssassin/NTACrypt.c

@@ -2,25 +2,28 @@
 
 #pragma comment (lib, "Crypt32.lib")
 
-BOOL NTAPI Crypt_EnumBlobCertificates(_In_reads_(BlobSize) PBYTE BlobData, _In_ ULONG BlobSize, DWORD ExpectedContentTypeFlags, _In_ CRYPT_CERTENUMPROC CertEnumProc, LPARAM Param)
+BOOL NTAPI Crypt_EnumBlobCertificates(_In_reads_bytes_(BlobSize) PBYTE BlobData, _In_ ULONG BlobSize, DWORD ExpectedContentTypeFlags, _In_ CRYPT_CERTENUMPROC CertEnumProc, LPARAM Param)
 {
-    CRYPT_UINT_BLOB blob = { BlobSize, BlobData };
-    HCERTSTORE hCertStore;
-    if (CryptQueryObject(CERT_QUERY_OBJECT_BLOB, &blob, ExpectedContentTypeFlags, CERT_QUERY_FORMAT_FLAG_BINARY, 0, NULL, NULL, NULL, &hCertStore, NULL, NULL))
-    {
-        PCCERT_CONTEXT pContext = NULL;
-        while ((pContext = CertEnumCertificatesInStore(hCertStore, pContext)) != NULL)
-        {
-            if (!CertEnumProc(pContext, Param))
-            {
-                CertFreeCertificateContext(pContext);
-                break;
-            }
-        };
-        CertCloseStore(hCertStore, 0);
-        return TRUE;
-    } else
+    CRYPT_DATA_BLOB Blob = { BlobSize, BlobData };
+    HCERTSTORE CertStore;
+    PCCERT_CONTEXT CertContext;
+
+    CertStore = CertOpenStore(CERT_STORE_PROV_PKCS7, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, (HCRYPTPROV_LEGACY)NULL, 0, &Blob);
+    if (!CertStore)
     {
         return FALSE;
     }
+
+    CertContext = NULL;
+    while ((CertContext = CertEnumCertificatesInStore(CertStore, CertContext)) != NULL)
+    {
+        if (!CertEnumProc(CertContext, Param))
+        {
+            CertFreeCertificateContext(CertContext);
+            break;
+        }
+    };
+
+    CertCloseStore(CertStore, 0);
+    return TRUE;
 }

Source/NTAssassin/NTACtl.c

@@ -185,17 +185,29 @@ BOOL NTAPI Ctl_InitComboBoxEx(HWND ComboBox, _In_ PCTL_COMBOBOXCTL_ITEM Items, _
             }
         } else
         {
-    // CB_ERR or CB_ERRSPACE...
+            // CB_ERR or CB_ERRSPACE...
             break;
         }
     }
     return !(u < ItemCount);
 }
 
-HTREEITEM NTAPI Ctl_EnumTreeViewItems(HWND TreeView, BOOL BFS, _In_ CTL_TREEVIEWITEMENUMPROC TreeItemEnumProc, LPARAM Param)
+HTREEITEM
+NTAPI
+Ctl_EnumTreeViewItems(
+    _In_ HWND TreeView,
+    BOOL BFS,
+    _In_ CTL_FN_TREEVIEWITEMENUMPROC* TreeItemEnumProc,
+    LPARAM Param)
 {
     UINT        uDepth = 0;
     HTREEITEM   hItem, hItemTemp;
+
+    if (BFS)
+    {
+        return NULL;
+    }
+
     hItem = (HTREEITEM)SendMessage(TreeView, TVM_GETNEXTITEM, TVGN_ROOT, 0);
     do
     {
@@ -228,11 +240,17 @@ HTREEITEM NTAPI Ctl_EnumTreeViewItems(HWND TreeView, BOOL BFS, _In_ CTL_TREEVIEW
     return NULL;
 }
 
-LRESULT NTAPI Ctl_ComboBoxSetSelect(HWND ComboBox, INT ItemIndex)
+LRESULT NTAPI Ctl_ComboBoxSetSelection(_In_ HWND ComboBox, INT ItemIndex)
 {
-    LRESULT lResult = SendMessage(ComboBox, CB_SETCURSEL, ItemIndex, 0);
-    INT_PTR iID;
-    if (UI_GetWindowLong(ComboBox, FALSE, GWLP_ID, &iID))
-        SendMessage(GetParent(ComboBox), WM_COMMAND, MAKEWPARAM(iID, CBN_SELCHANGE), (LPARAM)ComboBox);
-    return lResult;
+    LRESULT Result;
+    INT_PTR ID;
+    HWND ParentWindow;
+
+    Result = SendMessageW(ComboBox, CB_SETCURSEL, ItemIndex, 0);
+    if ((ParentWindow = GetParent(ComboBox)) != NULL && UI_GetWindowLong(ComboBox, FALSE, GWLP_ID, &ID))
+    {
+        SendMessageW(ParentWindow, WM_COMMAND, MAKEWPARAM(ID, CBN_SELCHANGE), (LPARAM)ComboBox);
+    }
+
+    return Result;
 }

Source/NTAssassin/NTADPI.c

@@ -46,8 +46,7 @@ static PFNGetDpiForMonitor pfnGetDpiForMonitor = NULL;
 
 BOOL NTAPI DPI_FromWindow(HWND Window, _Out_ PUINT DPIX, _Out_ PUINT DPIY)
 {
-    PCKUSER_SHARED_DATA pKUSD = SharedUserData;
-    if (pKUSD->NtMajorVersion > 6 || (pKUSD->NtMajorVersion == 6 && pKUSD->NtMinorVersion >= 3))
+    if (SharedUserData->NtMajorVersion > 6 || (SharedUserData->NtMajorVersion == 6 && SharedUserData->NtMinorVersion >= 3))
     {
         if (!pfnGetDpiForMonitor)
         {