fix disable fail

2026-06-23 13:18:59 +08:00
parent 9c8c165efa
commit 3e7beaa4ec
8 changed files with 391 additions and 16 deletions
@@ -5,10 +5,9 @@
 #pragma warning(disable : 4838)
 namespace kernel_function
 {
-	PEPROCESS process{ 0 };
-
 	auto FindProcess(const CHAR* ProcessName) -> PEPROCESS
 	{
+		PEPROCESS process{ 0 };
 		for (ULONG i = 4; i < 0x401000; i += 4)
 		{
 			auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process);
@@ -68,6 +67,65 @@ namespace kernel_function
 		return base;
 	}

+	auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS
+	{
+		NTSTATUS status = STATUS_SUCCESS;
+		PEPROCESS process = NULL;
+		UNICODE_STRING UniCodeName{ 0 };
+		uintptr_t ModuleBase = 0;
+
+		status = PsLookupProcessByProcessId(Pid, &process);
+		if (!NT_SUCCESS(status))
+		{
+			DbgPrintEx(77, 0, "[drv_memory] PsLookupProcessByProcessId failed with status %x\n", status);
+			return status;
+		}
+		BOOLEAN Is64 = (utils::PsGetProcessWow64Process(process) != NULL) ? TRUE : FALSE;
+
+		KAPC_STATE ApcState;
+		KeStackAttachProcess(process, &ApcState);
+		if (Is64)
+		{
+			PPEB32 Peb32 = (PPEB32)utils::PsGetProcessWow64Process(process);
+			PLIST_ENTRY32 LdrEntry32 = (PLIST_ENTRY32)((PPEB_LDR_DATA32)Peb32->Ldr)->InLoadOrderModuleList.Flink;
+			while (LdrEntry32 != &((PPEB_LDR_DATA32)Peb32->Ldr)->InLoadOrderModuleList)
+			{
+				PLDR_DATA_TABLE_ENTRY32 LdrDataTableEntry32 = (PLDR_DATA_TABLE_ENTRY32)LdrEntry32;
+				if (LdrDataTableEntry32->BaseDllName.Buffer == NULL) continue;
+
+				RtlInitUnicodeString(&UniCodeName, (PWCHAR)LdrDataTableEntry32->BaseDllName.Buffer);
+				if (RtlEqualUnicodeString(&ModuleName, &UniCodeName, TRUE))
+				{
+					ModuleBase = (uintptr_t)LdrDataTableEntry32->DllBase;
+					break;
+				}
+				LdrEntry32 = (PLIST_ENTRY32)LdrEntry32->Flink;
+			}
+		}
+		else
+		{
+			PPEB64 Peb64 = (PPEB64)utils::PsGetProcessPeb(process);
+			PLIST_ENTRY64 LdrEntry64 = (PLIST_ENTRY64)((PPEB_LDR_DATA64)Peb64->Ldr)->InLoadOrderModuleList.Flink;
+			while (LdrEntry64 != &((PPEB_LDR_DATA64)Peb64->Ldr)->InLoadOrderModuleList)
+			{
+				PLDR_DATA_TABLE_ENTRY64 LdrDataTableEntry64 = (PLDR_DATA_TABLE_ENTRY64)LdrEntry64;
+				if (LdrDataTableEntry64->BaseDllName.Buffer == NULL) continue;
+
+				RtlInitUnicodeString(&UniCodeName, LdrDataTableEntry64->BaseDllName.Buffer);
+				if (RtlEqualUnicodeString(&UniCodeName, &ModuleName, TRUE))
+				{
+					ModuleBase = (uintptr_t)LdrDataTableEntry64->DllBase;
+					break;
+				}
+				LdrEntry64 = (PLIST_ENTRY64)LdrEntry64->Flink;
+			}
+		}
+		KeUnstackDetachProcess(&ApcState);
+		ObDereferenceObject(process);
+		RtlCopyMemory(Buffer, &ModuleBase, sizeof(uintptr_t));
+		return status;
+	}
+
 	auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode) -> NTSTATUS
 	{
 		PMDL pMDL = IoAllocateMdl(Address, (ULONG)Size, FALSE, FALSE, NULL);
@@ -169,5 +227,33 @@ namespace kernel_function
 		return TRUE;
 	}

+	auto ke_stack_attch_process(PEPROCESS PROCESS) -> KAPC_STATE
+	{
+		KAPC_STATE apc_state{ 0 };
+		KeStackAttachProcess(PROCESS, &apc_state);
+		return apc_state;
+	}

+	auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void
+	{
+		KeUnstackDetachProcess(&apc_state);
+	}
+
+	auto GetgSessionGlobalSlots() -> uintptr_t {
+
+		static uintptr_t gSessionGlobalSlots;
+		if (gSessionGlobalSlots == NULL) {
+			auto win32k = GetKernelModule("win32k.sys");
+			if (!win32k)
+				return NULL;
+
+			auto W32GetSessionStateForSession = utils::FindSectionsCode(win32k, "\x48\x8b\x05\x00\x00\x00\x00\xff\xc9\x48\x8b\x04\xc8", "xxx????xxxxxx", ".text");
+			if (!W32GetSessionStateForSession)
+				return NULL;
+
+			gSessionGlobalSlots = (*(ULONG*)(W32GetSessionStateForSession + 3)) + (W32GetSessionStateForSession + 7);
+		}
+
+		return gSessionGlobalSlots;
+	}
 }