35 lines
831 B
C++
35 lines
831 B
C++
#pragma once
|
|
#include "Base.h"
|
|
|
|
struct imported_
|
|
{
|
|
ULONG64 zw_setsystem_information;
|
|
ULONG64 mm_copy_virtualMemory;
|
|
ULONG64 nt_querysystem_information;
|
|
ULONG64 rtl_findexported_routinebyname;
|
|
ULONG64 ex_get_previous_mode;
|
|
ULONG64 io_create_driver;
|
|
ULONG64 zw_trace_control;
|
|
ULONG64 ps_getprocessimage_filname;
|
|
ULONG64 zw_protect_virtualmemory;
|
|
ULONG64 ps_lookup_processby_processid;
|
|
ULONG64 ps_getprocess_exitstatus;
|
|
ULONG64 io_getcurrent_process;
|
|
ULONG64 mm_copy_memory;
|
|
ULONG64 ps_getprocess_section_baseaddress;
|
|
};
|
|
|
|
namespace kernel_api
|
|
{
|
|
extern struct imported_ imported;
|
|
|
|
auto kernel_api_init() -> void;
|
|
|
|
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass,
|
|
PVOID SystemInformation,
|
|
ULONG SystemInformationLength,
|
|
PULONG ReturnLength);
|
|
|
|
UCHAR* psgetprocessimagefilname(PEPROCESS Process);
|
|
|
|
} |