init

2026-05-27 13:24:57 +08:00
commit 4bf9a42170
21 changed files with 901 additions and 0 deletions
@@ -0,0 +1,30 @@
+#include "kernel_api.h"
+
+namespace kernel_api
+{
+	struct imported_ imported { 0 };
+
+	auto kernel_api_init() -> void
+	{
+		UNICODE_STRING unFuncName{ 0 };
+
+		RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
+		imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+
+		RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
+		imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+	}
+
+	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
+	{
+		return  reinterpret_cast<NTSTATUS(*)(ULONG, PVOID, ULONG, PULONG)>(imported.nt_querysystem_information)
+			(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
+	}
+
+	UCHAR* psgetprocessimagefilname(PEPROCESS Process)
+	{
+		return reinterpret_cast<UCHAR * (*)(PEPROCESS)>
+			(imported.ps_getprocessimage_filname)(Process);
+	}
+}