62 lines
1.3 KiB
C++
62 lines
1.3 KiB
C++
#include "process_func.h"
|
|
namespace process_function
|
|
{
|
|
ULONG orin_protect_val;
|
|
|
|
auto eprocess_get_protect_offset() -> UINT32
|
|
{
|
|
UNICODE_STRING func_name{ 0 };
|
|
RtlInitUnicodeString(&func_name, L"PsIsProtectedProcess");
|
|
auto pfunc_address = reinterpret_cast<unsigned char*>(MmGetSystemRoutineAddress(&func_name));
|
|
auto offset = *(UINT32*)(pfunc_address + 0x2);
|
|
return offset;
|
|
}
|
|
|
|
|
|
auto eprocess_protect_process_on(UINT32 Pid) -> NTSTATUS
|
|
{
|
|
PEPROCESS process{ 0 };
|
|
|
|
auto status = PsLookupProcessByProcessId(ULongToHandle(Pid), &process);
|
|
if (!NT_SUCCESS(status))
|
|
return status;
|
|
|
|
auto offset = eprocess_get_protect_offset();
|
|
|
|
auto Protection = reinterpret_cast<unsigned long*>((UINT64)process + offset);
|
|
if (*Protection != 0xc0000061)
|
|
{
|
|
orin_protect_val = *Protection;
|
|
*Protection = 0xc0000061;
|
|
}
|
|
|
|
ObDereferenceObject(process);
|
|
return status;
|
|
}
|
|
|
|
auto eprocess_protect_process_off(UINT32 Pid) -> NTSTATUS
|
|
{
|
|
PEPROCESS process{ 0 };
|
|
|
|
auto status = PsLookupProcessByProcessId(ULongToHandle(Pid), &process);
|
|
if (!NT_SUCCESS(status))
|
|
return status;
|
|
|
|
auto offset = eprocess_get_protect_offset();
|
|
auto Protection = reinterpret_cast<unsigned long*>((UINT64)process + offset);
|
|
if (*Protection == 0xc0000061)
|
|
*Protection = orin_protect_val;
|
|
|
|
ObDereferenceObject(process);
|
|
return status;
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|