72 lines
3.0 KiB
C++
72 lines
3.0 KiB
C++
#include "kernel_api.h"
|
|
struct imported_ imported { 0 };
|
|
|
|
|
|
namespace kernel_api
|
|
{
|
|
auto kernel_api_init() -> void
|
|
{
|
|
UNICODE_STRING unFuncName{ 0 };
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
|
|
imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
|
|
imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"PsGetProcessId");
|
|
imported.ps_getprocess_id = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
|
|
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
|
|
imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
|
|
imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
|
|
RtlInitUnicodeString(&unFuncName, L"ObOpenObjectByName");
|
|
imported.ob_open_object_by_name = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
|
|
}
|
|
|
|
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
|
|
{
|
|
return reinterpret_cast<NTSTATUS(*)(ULONG, PVOID, ULONG, PULONG)>(imported.nt_querysystem_information)
|
|
(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
|
|
}
|
|
|
|
UCHAR* psgetprocessimagefilname(PEPROCESS Process)
|
|
{
|
|
return reinterpret_cast<UCHAR * (*)(PEPROCESS)>
|
|
(imported.ps_getprocessimage_filname)(Process);
|
|
}
|
|
|
|
HANDLE psgetprocessid(PEPROCESS process)
|
|
{
|
|
return reinterpret_cast<HANDLE(*)(PEPROCESS)>(imported.ps_getprocess_id)(process);
|
|
}
|
|
|
|
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName)
|
|
{
|
|
return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
|
|
(imported.se_locateprocess_imagename)(Process, pImageFileName);
|
|
}
|
|
|
|
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName)
|
|
{
|
|
return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
|
|
(ImageBase, RoutineName);
|
|
}
|
|
NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
|
|
{
|
|
return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
|
|
(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
|
|
}
|
|
NTSTATUS obopenobjectbyname(POBJECT_ATTRIBUTES ObjectAttributes, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, PVOID ParseContext, PHANDLE Handle)
|
|
{
|
|
return reinterpret_cast<NTSTATUS(*)(POBJECT_ATTRIBUTES, POBJECT_TYPE, KPROCESSOR_MODE, PACCESS_STATE, ACCESS_MASK, PVOID, PHANDLE)>
|
|
(imported.ob_open_object_by_name)(ObjectAttributes, ObjectType, AccessMode, AccessState, DesiredAccess, ParseContext, Handle);
|
|
}
|
|
}
|
|
|