feat get zwopenprocess

2026-06-30 16:58:18 +08:00
parent eb8978731f
commit cbbb11430a
2 changed files with 11 additions and 0 deletions
@@ -19,6 +19,7 @@ struct imported_
 	ULONG64 ps_getprocess_section_baseaddress;
 	ULONG64 ps_getprocess_id;
 	ULONG64 se_locateprocess_imagename;
+	ULONG64 nt_open_thread;
 };

 namespace kernel_api
@@ -39,4 +40,6 @@ namespace kernel_api
 	NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);

 	PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
+
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
 }