52 lines
1.4 KiB
C++
52 lines
1.4 KiB
C++
#pragma once
|
|
#include "Base.h"
|
|
|
|
namespace kernel_function
|
|
{
|
|
typedef enum _SYSTEM_INFORMATION_CLASS {
|
|
SystemBasicInformation = 0,
|
|
SystemPerformanceInformation = 2,
|
|
SystemTimeOfDayInformation = 3,
|
|
SystemProcessInformation = 5,
|
|
SystemProcessorPerformanceInformation = 8,
|
|
SystemInterruptInformation = 23,
|
|
SystemExceptionInformation = 33,
|
|
SystemRegistryQuotaInformation = 37,
|
|
SystemLookasideInformation = 45,
|
|
SystemCodeIntegrityInformation = 103,
|
|
SystemPolicyInformation = 134,
|
|
} SYSTEM_INFORMATION_CLASS;
|
|
|
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION
|
|
{
|
|
HANDLE Section;
|
|
PVOID MappedBase;
|
|
PVOID ImageBase;
|
|
ULONG ImageSize;
|
|
ULONG Flags;
|
|
USHORT LoadOrderIndex;
|
|
USHORT InitOrderIndex;
|
|
USHORT LoadCount;
|
|
USHORT OffsetToFileName;
|
|
UCHAR FullPathName[256];
|
|
} RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;
|
|
|
|
typedef struct _RTL_PROCESS_MODULES
|
|
{
|
|
ULONG NumberOfModules;
|
|
RTL_PROCESS_MODULE_INFORMATION Modules[1];
|
|
} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
|
|
|
|
|
|
auto FindProcess(CONST CHAR* ProcessName)->PEPROCESS;
|
|
|
|
auto GetKernelModule(CONST CHAR* Module)->uintptr_t;
|
|
|
|
auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode)->NTSTATUS;
|
|
|
|
auto GetMmverifyCallBackFlags()->uintptr_t;
|
|
|
|
auto Mack_MmVerifyCallBackFlags(BYTE** orgin_byte)->BOOL;
|
|
|
|
auto Orgin_MmVerifyCallBackFlags(BYTE* orgin_byte)->BOOL;
|
|
} |