#include "kernel_api.h"
struct imported_ imported { 0 };


namespace kernel_api
{
	auto kernel_api_init() -> void
	{
		UNICODE_STRING unFuncName{ 0 };

		RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
		imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);

		RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
		imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);

		RtlInitUnicodeString(&unFuncName, L"PsGetProcessId");
		imported.ps_getprocess_id = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);

		RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
		imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);

		RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
		imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
	}

	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
	{
		return reinterpret_cast<NTSTATUS(*)(ULONG, PVOID, ULONG, PULONG)>(imported.nt_querysystem_information)
			(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
	}

	UCHAR* psgetprocessimagefilname(PEPROCESS Process)
	{
		return reinterpret_cast<UCHAR * (*)(PEPROCESS)>
			(imported.ps_getprocessimage_filname)(Process);
	}

	HANDLE psgetprocessid(PEPROCESS process)
	{
		return reinterpret_cast<HANDLE(*)(PEPROCESS)>(imported.ps_getprocess_id)(process);
	}

	NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName)
	{
		return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
			(imported.se_locateprocess_imagename)(Process, pImageFileName);
	}

	PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName)
	{
		return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
			(ImageBase, RoutineName);
	}
}