; ******************************************************

;       Name: Kernel Storage
;       Author: Peter Kleissner
;       Version: 0.1
;       Date: 16.02.2008 20:40:07
;       last Update: 17.02.2008 13:42:45

;       Forensic Lockdown Software
;       (C) 2008 Vienna Computer Products

;       This include file contains information about
;       the Kernel Memory Storage.

;       The whole Kernel is relocated to segment 0000h.

; ******************************************************

;%define Forensic_Lockdown_Software
;%define Hibernation_File_Attack
%define Stoned_Bootkit


; define the Module's start addresses
;   Bootloader                  512 Bytes
;   System Loader               2048 Bytes
;   Textmode TUI                1024 Bytes
;   Disk System                 8192 Bytes
;   API RM                      2048 Bytes
;   Rescue Module               512 Bytes
;   Boot Application            8 KB preserved
;   Crypto Module               1536 Bytes
;   Boot Module                 1024 Bytes
;   -- some free space --
;   Original Bootloader Image   512 Bytes
;   Configuration Area          512 Bytes
; Module Base: 8000h
%define Bootloader                              7C00h
%define System_Loader                           8000h
%define Textmode_TUI                            8800h
%define Disk_System                             8C00h
%define API_RM                                  0AC00h
%define Rescue_Module                           0B400h
%define Boot_Application                        0B600h
%define Crypto_Module                           0D600h
%define Boot_Module                             0DC00h
%define Pwn_Windows                             0E000h
%define Original_Bootloader_Image               0F800h
%define Configuration_Area                      0FA00h


; define Runtime Variables

; Stack Pointer
%define Stack_Pointer                           7C00h

; Disk Address Packet
%define disk_address_packet                     7E00h
%define dap                                     disk_address_packet

%define dap_Size                                dap+00h
%define dap_Reserved                            dap+01h
%define dap_Count                               dap+02h
%define dap_Buffer                              dap+04h                           ; Segment:Offset value
%define dap_LBA_low                             dap+08h
%define dap_LBA_high                            dap+0Ch

; various Boot variables
%define Boot_stuff                              7E10h
%define Boot_Drive                              Boot_stuff+0
%define Boot_Drive_Sector                       Boot_stuff+4
%define Boot_Stack_Pointer                      Boot_stuff+8


; data for the Disk System
%define Storage_Device_Driver_Stack             5000h
%define Sector_Buffer                           6000h
%define Name_Buffer                             7E60h


; NTFS Sector Buffer
%define Ext_Sector_Buffer                       20000h

; NTFS Data Runs Buffer
%define Data_Runs_Buffer                        30000h

; MBR Backup Restore Area [Forensic Lockdown Software only]
%define MBR_Backup_Buffer                       40000h


; read buffer for hibernation file, 64 KB [Hibernation File Attack only]
%define Xpress_Image_Buffer                     50000h
%define Extended_Buffer                         70000h

; decryption buffer for Xpress Images [Hibernation File Attack only]
%define Hibernation_File_Attack_Data            60000h


; Textmode Buffer
%define Textmode_Buffer                         0B8000h

; VESA graphics
%define VESA_BIOS_A0000h                        0B0000h
%define VESA_BIOS_B0000h                        0B0000h
%define VESA_BIOS_B8000h                        0B8000h
%define VESA_BIOS_image                         0C0000h

