#pragma once
#include "Base.h"

namespace kernel_function
{
	typedef enum _SYSTEM_INFORMATION_CLASS {
		SystemBasicInformation = 0,
		SystemPerformanceInformation = 2,
		SystemTimeOfDayInformation = 3,
		SystemProcessInformation = 5,
		SystemProcessorPerformanceInformation = 8,
		SystemInterruptInformation = 23,
		SystemExceptionInformation = 33,
		SystemRegistryQuotaInformation = 37,
		SystemLookasideInformation = 45,
		SystemCodeIntegrityInformation = 103,
		SystemPolicyInformation = 134,
	} SYSTEM_INFORMATION_CLASS;

	typedef struct _RTL_PROCESS_MODULE_INFORMATION
	{
		HANDLE Section;
		PVOID MappedBase;
		PVOID ImageBase;
		ULONG ImageSize;
		ULONG Flags;
		USHORT LoadOrderIndex;
		USHORT InitOrderIndex;
		USHORT LoadCount;
		USHORT OffsetToFileName;
		UCHAR FullPathName[256];
	} RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;

	typedef struct _RTL_PROCESS_MODULES
	{
		ULONG NumberOfModules;
		RTL_PROCESS_MODULE_INFORMATION Modules[1];
	} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;

	typedef struct _PEB32
	{
		UCHAR InheritedAddressSpace;
		UCHAR ReadImageFileExecOptions;
		UCHAR BeingDebugged;
		UCHAR BitField;
		ULONG Mutant;
		ULONG ImageBaseAddress;
		ULONG Ldr;
		ULONG ProcessParameters;
		ULONG SubSystemData;
		ULONG ProcessHeap;
		ULONG FastPebLock;
		ULONG AtlThunkSListPtr;
		ULONG IFEOKey;
		ULONG CrossProcessFlags;
		ULONG UserSharedInfoPtr;
		ULONG SystemReserved;
		ULONG AtlThunkSListPtr32;
		ULONG ApiSetMap;
	} PEB32, * PPEB32;  ////32 PEB结构

	typedef struct _LDR_DATA_TABLE_ENTRY32
	{
		LIST_ENTRY32 InLoadOrderLinks;
		LIST_ENTRY32 InMemoryOrderLinks;
		LIST_ENTRY32 InInitializationOrderLinks;
		ULONG DllBase;
		ULONG EntryPoint;
		ULONG SizeOfImage;
		UNICODE_STRING32 FullDllName;
		UNICODE_STRING32 BaseDllName;
		ULONG Flags;
		USHORT LoadCount;
		USHORT TlsIndex;
		LIST_ENTRY32 HashLinks;
		ULONG TimeDateStamp;
	} LDR_DATA_TABLE_ENTRY32, * PLDR_DATA_TABLE_ENTRY32;//32 PEB结构
	typedef struct _PEB_LDR_DATA32
	{
		ULONG Length;
		UCHAR Initialized;
		ULONG SsHandle;
		LIST_ENTRY32 InLoadOrderModuleList;
		LIST_ENTRY32 InMemoryOrderModuleList;
		LIST_ENTRY32 InInitializationOrderModuleList;
	} PEB_LDR_DATA32, * PPEB_LDR_DATA32;//32 PEB结构

	typedef struct _PEB64
	{
		UCHAR InheritedAddressSpace;
		UCHAR ReadImageFileExecOptions;
		UCHAR BeingDebugged;
		UCHAR BitField;
		ULONG64 Mutant;
		ULONG64 ImageBaseAddress;
		ULONG64 Ldr;
		ULONG64 ProcessParameters;
		ULONG64 SubSystemData;
		ULONG64 ProcessHeap;
		ULONG64 FastPebLock;
		ULONG64 AtlThunkSListPtr;
		ULONG64 IFEOKey;
		ULONG64 CrossProcessFlags;
		ULONG64 UserSharedInfoPtr;
		ULONG SystemReserved;
		ULONG AtlThunkSListPtr32;
		ULONG64 ApiSetMap;
	} PEB64, * PPEB64;
	typedef struct _PEB_LDR_DATA64
	{
		ULONG Length;
		BOOLEAN Initialized;
		ULONG64 SsHandle;
		LIST_ENTRY64 InLoadOrderModuleList;
		LIST_ENTRY64 InMemoryOrderModuleList;
		LIST_ENTRY64 InInitializationOrderModuleList;
		ULONG64 EntryInProgress;
	} PEB_LDR_DATA64, * PPEB_LDR_DATA64;
	typedef struct _LDR_DATA_TABLE_ENTRY64
	{
		LIST_ENTRY64 InLoadOrderLinks;
		LIST_ENTRY64 InMemoryOrderLinks;
		LIST_ENTRY64 InInitializationOrderLinks;
		PVOID DllBase;
		ULONG64 EntryPoint;
		ULONG64 SizeOfImage;
		UNICODE_STRING FullDllName;
		UNICODE_STRING BaseDllName;
		ULONG Flags;
		USHORT LoadCount;
		USHORT TlsIndex;
		LIST_ENTRY64 HashLinks;
		ULONG64 SectionPointer;
		ULONG64 CheckSum;
		ULONG64 TimeDateStamp;
		ULONG64 LoadedImports;
		ULONG64 EntryPointActivationContext;
		ULONG64 PatchInformation;
		LIST_ENTRY64 ForwarderLinks;
		LIST_ENTRY64 ServiceTagLinks;
		LIST_ENTRY64 StaticLinks;
		ULONG64 ContextInformation;
		ULONG64 OriginalBase;
		LARGE_INTEGER LoadTime;
	} LDR_DATA_TABLE_ENTRY64, * PLDR_DATA_TABLE_ENTRY64;

	auto FindProcess(CONST CHAR* ProcessName)->PEPROCESS;

	auto GetKernelModule(CONST CHAR* Module)->uintptr_t;

	auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS;

	auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode)->NTSTATUS;

	auto GetMmverifyCallBackFlags()->uintptr_t;

	auto Mack_MmVerifyCallBackFlags(BYTE** orgin_byte)->BOOL;

	auto Orgin_MmVerifyCallBackFlags(BYTE* orgin_byte)->BOOL;

	auto ke_stack_attch_process(PEPROCESS PROCESS) ->KAPC_STATE;

	auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void;

	auto GetgSessionGlobalSlots()->uintptr_t;
}