47 lines
1.6 KiB
C++
47 lines
1.6 KiB
C++
#include "kernel_api.h"
|
|
|
|
namespace kernel_api
|
|
{
|
|
struct imported_ imported { 0 };
|
|
|
|
auto kernel_api_init() -> void
|
|
{
|
|
UNICODE_STRING unFuncName{ 0 };
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
|
|
imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
|
|
imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"PsGetProcessId");
|
|
imported.ps_getprocess_id = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
|
|
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
}
|
|
|
|
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
|
|
{
|
|
return reinterpret_cast<NTSTATUS(*)(ULONG, PVOID, ULONG, PULONG)>(imported.nt_querysystem_information)
|
|
(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
|
|
}
|
|
|
|
UCHAR* psgetprocessimagefilname(PEPROCESS Process)
|
|
{
|
|
return reinterpret_cast<UCHAR * (*)(PEPROCESS)>
|
|
(imported.ps_getprocessimage_filname)(Process);
|
|
}
|
|
|
|
HANDLE psgetprocessid(PEPROCESS process)
|
|
{
|
|
return reinterpret_cast<HANDLE(*)(PEPROCESS)>(imported.ps_getprocess_id)(process);
|
|
}
|
|
|
|
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName)
|
|
{
|
|
return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
|
|
(imported.se_locateprocess_imagename)(Process, pImageFileName);
|
|
}
|
|
}
|