fix disable fail
This commit is contained in:
@@ -1,9 +1,9 @@
|
||||
#include "kernel_api.h"
|
||||
struct imported_ imported { 0 };
|
||||
|
||||
|
||||
namespace kernel_api
|
||||
{
|
||||
struct imported_ imported { 0 };
|
||||
|
||||
auto kernel_api_init() -> void
|
||||
{
|
||||
UNICODE_STRING unFuncName{ 0 };
|
||||
@@ -19,6 +19,9 @@ namespace kernel_api
|
||||
|
||||
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
|
||||
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
||||
|
||||
RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
|
||||
imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
||||
}
|
||||
|
||||
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
|
||||
@@ -43,4 +46,11 @@ namespace kernel_api
|
||||
return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
|
||||
(imported.se_locateprocess_imagename)(Process, pImageFileName);
|
||||
}
|
||||
|
||||
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName)
|
||||
{
|
||||
return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
|
||||
(ImageBase, RoutineName);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user