42 lines
1.1 KiB
C++
42 lines
1.1 KiB
C++
#pragma once
|
|
#include "Base.h"
|
|
|
|
struct imported_
|
|
{
|
|
ULONG64 zw_setsystem_information;
|
|
ULONG64 mm_copy_virtualMemory;
|
|
ULONG64 nt_querysystem_information;
|
|
ULONG64 rtl_findexported_routinebyname;
|
|
ULONG64 ex_get_previous_mode;
|
|
ULONG64 io_create_driver;
|
|
ULONG64 zw_trace_control;
|
|
ULONG64 ps_getprocessimage_filname;
|
|
ULONG64 zw_protect_virtualmemory;
|
|
ULONG64 ps_lookup_processby_processid;
|
|
ULONG64 ps_getprocess_exitstatus;
|
|
ULONG64 io_getcurrent_process;
|
|
ULONG64 mm_copy_memory;
|
|
ULONG64 ps_getprocess_section_baseaddress;
|
|
ULONG64 ps_getprocess_id;
|
|
ULONG64 se_locateprocess_imagename;
|
|
};
|
|
|
|
namespace kernel_api
|
|
{
|
|
//extern struct imported_ imported;
|
|
|
|
auto kernel_api_init() -> void;
|
|
|
|
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass,
|
|
PVOID SystemInformation,
|
|
ULONG SystemInformationLength,
|
|
PULONG ReturnLength);
|
|
|
|
UCHAR* psgetprocessimagefilname(PEPROCESS Process);
|
|
|
|
HANDLE psgetprocessid(PEPROCESS process);
|
|
|
|
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
|
|
|
|
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
|
|
} |