31 lines
973 B
C++
31 lines
973 B
C++
#include "kernel_api.h"
|
|
|
|
namespace kernel_api
|
|
{
|
|
struct imported_ imported { 0 };
|
|
|
|
auto kernel_api_init() -> void
|
|
{
|
|
UNICODE_STRING unFuncName{ 0 };
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
|
|
imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
|
|
imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
}
|
|
|
|
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
|
|
{
|
|
return reinterpret_cast<NTSTATUS(*)(ULONG, PVOID, ULONG, PULONG)>(imported.nt_querysystem_information)
|
|
(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
|
|
}
|
|
|
|
UCHAR* psgetprocessimagefilname(PEPROCESS Process)
|
|
{
|
|
return reinterpret_cast<UCHAR * (*)(PEPROCESS)>
|
|
(imported.ps_getprocessimage_filname)(Process);
|
|
}
|
|
}
|