#include "process_func.h"
namespace process_function
{
	ULONG orin_protect_val;

	auto eprocess_get_protect_offset() -> UINT32
	{
		UNICODE_STRING func_name{ 0 };
		RtlInitUnicodeString(&func_name, L"PsIsProtectedProcess");
		auto pfunc_address = reinterpret_cast<unsigned char*>(MmGetSystemRoutineAddress(&func_name));
		auto offset = *(UINT32*)(pfunc_address + 0x2);
		return offset;
	}


	auto eprocess_protect_process_on(UINT32 Pid) -> NTSTATUS
	{
		PEPROCESS process{ 0 };

		auto status = PsLookupProcessByProcessId(ULongToHandle(Pid), &process);
		if (!NT_SUCCESS(status))
			return status;

		auto offset = eprocess_get_protect_offset();
	
		auto Protection = reinterpret_cast<unsigned long*>((UINT64)process + offset);
		if (*Protection != 0xc0000061)
		{
			orin_protect_val = *Protection;
			*Protection = 0xc0000061;
		}

		ObDereferenceObject(process);
		return status;
	}

	auto eprocess_protect_process_off(UINT32 Pid) -> NTSTATUS
	{
		PEPROCESS process{ 0 };

		auto status = PsLookupProcessByProcessId(ULongToHandle(Pid), &process);
		if (!NT_SUCCESS(status))
			return status;

		auto offset = eprocess_get_protect_offset();
		auto Protection = reinterpret_cast<unsigned long*>((UINT64)process + offset);
		if (*Protection == 0xc0000061) 
			*Protection = orin_protect_val;

		ObDereferenceObject(process);
		return status;
	}





}