fix disable fail

This commit is contained in:
2026-06-23 13:18:59 +08:00
parent 9c8c165efa
commit 3e7beaa4ec
8 changed files with 391 additions and 16 deletions
+12 -2
View File
@@ -1,9 +1,9 @@
#include "kernel_api.h"
struct imported_ imported { 0 };
namespace kernel_api
{
struct imported_ imported { 0 };
auto kernel_api_init() -> void
{
UNICODE_STRING unFuncName{ 0 };
@@ -19,6 +19,9 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
}
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -43,4 +46,11 @@ namespace kernel_api
return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
(imported.se_locateprocess_imagename)(Process, pImageFileName);
}
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName)
{
return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
(ImageBase, RoutineName);
}
}