You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
101 lines
2.0 KiB
101 lines
2.0 KiB
4 years ago
|
#pragma once
|
||
|
|
#include <ntifs.h>
|
||
|
|
#include <windef.h>
|
||
|
|
|
||
|
|
enum com_type
|
||
|
|
{
|
||
|
|
READ,
|
||
|
|
WRITE,
|
||
|
|
READ_KERNEL_MEMORY,
|
||
|
|
WRITE_KERNEL_MEMORY,
|
||
|
|
GET_PROCESS_BASE,
|
||
|
|
GET_MODULE_BASE
|
||
|
|
};
|
||
|
|
|
||
|
|
typedef struct _com_struct
|
||
|
|
{
|
||
|
|
com_type type;
|
||
|
|
unsigned pid;
|
||
|
|
unsigned size;
|
||
|
|
void* data_from;
|
||
|
|
void* data_to;
|
||
|
|
} com_struct, * pcom_struct;
|
||
|
|
|
||
|
|
extern "C" PVOID PsGetProcessSectionBaseAddress(
|
||
|
|
__in PEPROCESS Process
|
||
|
|
);
|
||
|
|
|
||
|
|
extern "C" PPEB PsGetProcessPeb(PEPROCESS process);
|
||
|
|
|
||
|
|
extern "C" NTSTATUS MmCopyVirtualMemory(
|
||
|
|
_In_ PEPROCESS FromProcess,
|
||
|
|
_In_ CONST VOID* FromAddress,
|
||
|
|
_In_ PEPROCESS ToProcess,
|
||
|
|
_Out_opt_ PVOID ToAddress,
|
||
|
|
_In_ SIZE_T BufferSize,
|
||
|
|
_In_ KPROCESSOR_MODE PreviousMode,
|
||
|
|
_Out_ PSIZE_T NumberOfBytesCopied
|
||
|
|
);
|
||
|
|
|
||
|
|
typedef struct _PEB_LDR_DATA
|
||
|
|
{
|
||
|
|
BYTE Reserved1[8];
|
||
|
|
PVOID Reserved2[3];
|
||
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
||
|
|
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
||
|
|
|
||
|
|
typedef struct _LDR_DATA_TABLE_ENTRY
|
||
|
|
{
|
||
|
|
PVOID Reserved1[2];
|
||
|
|
LIST_ENTRY InMemoryOrderLinks;
|
||
|
|
PVOID Reserved2[2];
|
||
|
|
PVOID DllBase;
|
||
|
|
PVOID Reserved3[2];
|
||
|
|
UNICODE_STRING FullDllName;
|
||
|
|
BYTE Reserved4[8];
|
||
|
|
PVOID Reserved5[3];
|
||
|
|
#pragma warning(push)
|
||
|
|
#pragma warning(disable: 4201) // we'll always use the Microsoft compiler
|
||
|
|
union
|
||
|
|
{
|
||
|
|
ULONG CheckSum;
|
||
|
|
PVOID Reserved6;
|
||
|
|
} DUMMYUNIONNAME;
|
||
|
|
#pragma warning(pop)
|
||
|
|
ULONG TimeDateStamp;
|
||
|
|
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
||
|
|
|
||
|
|
typedef struct _RTL_USER_PROCESS_PARAMETERS {
|
||
|
|
BYTE Reserved1[16];
|
||
|
|
PVOID Reserved2[10];
|
||
|
|
UNICODE_STRING ImagePathName;
|
||
|
|
UNICODE_STRING CommandLine;
|
||
|
|
} RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS;
|
||
|
|
|
||
|
|
typedef
|
||
|
|
VOID
|
||
|
|
(NTAPI* PPS_POST_PROCESS_INIT_ROUTINE) (
|
||
|
|
VOID
|
||
|
|
);
|
||
|
|
|
||
|
|
typedef struct _PEB {
|
||
|
|
BYTE Reserved1[2];
|
||
|
|
BYTE BeingDebugged;
|
||
|
|
BYTE Reserved2[1];
|
||
|
|
PVOID Reserved3[2];
|
||
|
|
PPEB_LDR_DATA Ldr;
|
||
|
|
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
||
|
|
PVOID Reserved4[3];
|
||
|
|
PVOID AtlThunkSListPtr;
|
||
|
|
PVOID Reserved5;
|
||
|
|
ULONG Reserved6;
|
||
|
|
PVOID Reserved7;
|
||
|
|
ULONG Reserved8;
|
||
|
|
ULONG AtlThunkSListPtr32;
|
||
|
|
PVOID Reserved9[45];
|
||
|
|
BYTE Reserved10[96];
|
||
|
|
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
|
||
|
|
BYTE Reserved11[128];
|
||
|
|
PVOID Reserved12[1];
|
||
|
|
ULONG SessionId;
|
||
|
|
} PEB, * PPEB;
|