56 lines
1.5 KiB
C++
56 lines
1.5 KiB
C++
#pragma once
|
|
#include "Base.h"
|
|
|
|
struct imported_
|
|
{
|
|
ULONG64 zw_setsystem_information;
|
|
ULONG64 mm_copy_virtualMemory;
|
|
ULONG64 nt_querysystem_information;
|
|
ULONG64 rtl_findexported_routinebyname;
|
|
ULONG64 ex_get_previous_mode;
|
|
ULONG64 io_create_driver;
|
|
ULONG64 zw_trace_control;
|
|
ULONG64 ps_getprocessimage_filname;
|
|
ULONG64 zw_protect_virtualmemory;
|
|
ULONG64 ps_lookup_processby_processid;
|
|
ULONG64 ps_getprocess_exitstatus;
|
|
ULONG64 io_getcurrent_process;
|
|
ULONG64 mm_copy_memory;
|
|
ULONG64 ps_getprocess_section_baseaddress;
|
|
ULONG64 ps_getprocess_id;
|
|
ULONG64 se_locateprocess_imagename;
|
|
ULONG64 nt_open_thread;
|
|
ULONG64 ob_open_object_by_name;
|
|
};
|
|
|
|
namespace kernel_api
|
|
{
|
|
//extern struct imported_ imported;
|
|
|
|
auto kernel_api_init() -> void;
|
|
|
|
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass,
|
|
PVOID SystemInformation,
|
|
ULONG SystemInformationLength,
|
|
PULONG ReturnLength);
|
|
|
|
UCHAR* psgetprocessimagefilname(PEPROCESS Process);
|
|
|
|
HANDLE psgetprocessid(PEPROCESS process);
|
|
|
|
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
|
|
|
|
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
|
|
|
|
NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
|
|
|
|
NTSTATUS obopenobjectbyname(
|
|
POBJECT_ATTRIBUTES ObjectAttributes,
|
|
POBJECT_TYPE ObjectType,
|
|
KPROCESSOR_MODE AccessMode,
|
|
PACCESS_STATE AccessState,
|
|
ACCESS_MASK DesiredAccess,
|
|
PVOID ParseContext,
|
|
PHANDLE Handle
|
|
);
|
|
} |