166 lines
4.3 KiB
C++
166 lines
4.3 KiB
C++
#pragma once
|
|
#include "Base.h"
|
|
|
|
namespace kernel_function
|
|
{
|
|
typedef enum _SYSTEM_INFORMATION_CLASS {
|
|
SystemBasicInformation = 0,
|
|
SystemPerformanceInformation = 2,
|
|
SystemTimeOfDayInformation = 3,
|
|
SystemProcessInformation = 5,
|
|
SystemProcessorPerformanceInformation = 8,
|
|
SystemInterruptInformation = 23,
|
|
SystemExceptionInformation = 33,
|
|
SystemRegistryQuotaInformation = 37,
|
|
SystemLookasideInformation = 45,
|
|
SystemCodeIntegrityInformation = 103,
|
|
SystemPolicyInformation = 134,
|
|
} SYSTEM_INFORMATION_CLASS;
|
|
|
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION
|
|
{
|
|
HANDLE Section;
|
|
PVOID MappedBase;
|
|
PVOID ImageBase;
|
|
ULONG ImageSize;
|
|
ULONG Flags;
|
|
USHORT LoadOrderIndex;
|
|
USHORT InitOrderIndex;
|
|
USHORT LoadCount;
|
|
USHORT OffsetToFileName;
|
|
UCHAR FullPathName[256];
|
|
} RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;
|
|
|
|
typedef struct _RTL_PROCESS_MODULES
|
|
{
|
|
ULONG NumberOfModules;
|
|
RTL_PROCESS_MODULE_INFORMATION Modules[1];
|
|
} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
|
|
|
|
typedef struct _PEB32
|
|
{
|
|
UCHAR InheritedAddressSpace;
|
|
UCHAR ReadImageFileExecOptions;
|
|
UCHAR BeingDebugged;
|
|
UCHAR BitField;
|
|
ULONG Mutant;
|
|
ULONG ImageBaseAddress;
|
|
ULONG Ldr;
|
|
ULONG ProcessParameters;
|
|
ULONG SubSystemData;
|
|
ULONG ProcessHeap;
|
|
ULONG FastPebLock;
|
|
ULONG AtlThunkSListPtr;
|
|
ULONG IFEOKey;
|
|
ULONG CrossProcessFlags;
|
|
ULONG UserSharedInfoPtr;
|
|
ULONG SystemReserved;
|
|
ULONG AtlThunkSListPtr32;
|
|
ULONG ApiSetMap;
|
|
} PEB32, * PPEB32; ////32 PEB½á¹¹
|
|
|
|
typedef struct _LDR_DATA_TABLE_ENTRY32
|
|
{
|
|
LIST_ENTRY32 InLoadOrderLinks;
|
|
LIST_ENTRY32 InMemoryOrderLinks;
|
|
LIST_ENTRY32 InInitializationOrderLinks;
|
|
ULONG DllBase;
|
|
ULONG EntryPoint;
|
|
ULONG SizeOfImage;
|
|
UNICODE_STRING32 FullDllName;
|
|
UNICODE_STRING32 BaseDllName;
|
|
ULONG Flags;
|
|
USHORT LoadCount;
|
|
USHORT TlsIndex;
|
|
LIST_ENTRY32 HashLinks;
|
|
ULONG TimeDateStamp;
|
|
} LDR_DATA_TABLE_ENTRY32, * PLDR_DATA_TABLE_ENTRY32;//32 PEB½á¹¹
|
|
typedef struct _PEB_LDR_DATA32
|
|
{
|
|
ULONG Length;
|
|
UCHAR Initialized;
|
|
ULONG SsHandle;
|
|
LIST_ENTRY32 InLoadOrderModuleList;
|
|
LIST_ENTRY32 InMemoryOrderModuleList;
|
|
LIST_ENTRY32 InInitializationOrderModuleList;
|
|
} PEB_LDR_DATA32, * PPEB_LDR_DATA32;//32 PEB½á¹¹
|
|
|
|
typedef struct _PEB64
|
|
{
|
|
UCHAR InheritedAddressSpace;
|
|
UCHAR ReadImageFileExecOptions;
|
|
UCHAR BeingDebugged;
|
|
UCHAR BitField;
|
|
ULONG64 Mutant;
|
|
ULONG64 ImageBaseAddress;
|
|
ULONG64 Ldr;
|
|
ULONG64 ProcessParameters;
|
|
ULONG64 SubSystemData;
|
|
ULONG64 ProcessHeap;
|
|
ULONG64 FastPebLock;
|
|
ULONG64 AtlThunkSListPtr;
|
|
ULONG64 IFEOKey;
|
|
ULONG64 CrossProcessFlags;
|
|
ULONG64 UserSharedInfoPtr;
|
|
ULONG SystemReserved;
|
|
ULONG AtlThunkSListPtr32;
|
|
ULONG64 ApiSetMap;
|
|
} PEB64, * PPEB64;
|
|
typedef struct _PEB_LDR_DATA64
|
|
{
|
|
ULONG Length;
|
|
BOOLEAN Initialized;
|
|
ULONG64 SsHandle;
|
|
LIST_ENTRY64 InLoadOrderModuleList;
|
|
LIST_ENTRY64 InMemoryOrderModuleList;
|
|
LIST_ENTRY64 InInitializationOrderModuleList;
|
|
ULONG64 EntryInProgress;
|
|
} PEB_LDR_DATA64, * PPEB_LDR_DATA64;
|
|
typedef struct _LDR_DATA_TABLE_ENTRY64
|
|
{
|
|
LIST_ENTRY64 InLoadOrderLinks;
|
|
LIST_ENTRY64 InMemoryOrderLinks;
|
|
LIST_ENTRY64 InInitializationOrderLinks;
|
|
PVOID DllBase;
|
|
ULONG64 EntryPoint;
|
|
ULONG64 SizeOfImage;
|
|
UNICODE_STRING FullDllName;
|
|
UNICODE_STRING BaseDllName;
|
|
ULONG Flags;
|
|
USHORT LoadCount;
|
|
USHORT TlsIndex;
|
|
LIST_ENTRY64 HashLinks;
|
|
ULONG64 SectionPointer;
|
|
ULONG64 CheckSum;
|
|
ULONG64 TimeDateStamp;
|
|
ULONG64 LoadedImports;
|
|
ULONG64 EntryPointActivationContext;
|
|
ULONG64 PatchInformation;
|
|
LIST_ENTRY64 ForwarderLinks;
|
|
LIST_ENTRY64 ServiceTagLinks;
|
|
LIST_ENTRY64 StaticLinks;
|
|
ULONG64 ContextInformation;
|
|
ULONG64 OriginalBase;
|
|
LARGE_INTEGER LoadTime;
|
|
} LDR_DATA_TABLE_ENTRY64, * PLDR_DATA_TABLE_ENTRY64;
|
|
|
|
auto FindProcess(CONST CHAR* ProcessName)->PEPROCESS;
|
|
|
|
auto GetKernelModule(CONST CHAR* Module)->uintptr_t;
|
|
|
|
auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS;
|
|
|
|
auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode)->NTSTATUS;
|
|
|
|
auto GetMmverifyCallBackFlags()->uintptr_t;
|
|
|
|
auto Mack_MmVerifyCallBackFlags(BYTE** orgin_byte)->BOOL;
|
|
|
|
auto Orgin_MmVerifyCallBackFlags(BYTE* orgin_byte)->BOOL;
|
|
|
|
auto ke_stack_attch_process(PEPROCESS PROCESS) ->KAPC_STATE;
|
|
|
|
auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void;
|
|
|
|
auto GetgSessionGlobalSlots()->uintptr_t;
|
|
} |