You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
94 lines
2.4 KiB
94 lines
2.4 KiB
5 years ago
|
#pragma once
|
||
|
|
#include <Windows.h>
|
||
|
|
#include <winternl.h>
|
||
|
|
#pragma comment(lib, "ntdll.lib")
|
||
|
|
|
||
|
|
#define MM_COPY_MEMORY_PHYSICAL 0x1
|
||
|
|
#define MM_COPY_MEMORY_VIRTUAL 0x2
|
||
|
|
#define PHYSMEME_DEBUGGING 1
|
||
|
|
|
||
|
|
constexpr auto PAGE_SIZE = 0x1000;
|
||
|
|
constexpr auto STATUS_INFO_LENGTH_MISMATCH = 0xC0000004;
|
||
|
|
|
||
|
|
constexpr auto SystemModuleInformation = 11;
|
||
|
|
constexpr auto SystemHandleInformation = 16;
|
||
|
|
constexpr auto SystemExtendedHandleInformation = 64;
|
||
|
|
|
||
|
|
typedef struct _SYSTEM_HANDLE
|
||
|
|
{
|
||
|
|
PVOID Object;
|
||
|
|
HANDLE UniqueProcessId;
|
||
|
|
HANDLE HandleValue;
|
||
|
|
ULONG GrantedAccess;
|
||
|
|
USHORT CreatorBackTraceIndex;
|
||
|
|
USHORT ObjectTypeIndex;
|
||
|
|
ULONG HandleAttributes;
|
||
|
|
ULONG Reserved;
|
||
|
|
} SYSTEM_HANDLE, * PSYSTEM_HANDLE;
|
||
|
|
|
||
|
|
typedef struct _SYSTEM_HANDLE_INFORMATION_EX
|
||
|
|
{
|
||
|
|
ULONG_PTR HandleCount;
|
||
|
|
ULONG_PTR Reserved;
|
||
|
|
SYSTEM_HANDLE Handles[1];
|
||
|
|
} SYSTEM_HANDLE_INFORMATION_EX, * PSYSTEM_HANDLE_INFORMATION_EX;
|
||
|
|
|
||
|
|
typedef enum _POOL_TYPE {
|
||
|
|
NonPagedPool,
|
||
|
|
NonPagedPoolExecute,
|
||
|
|
PagedPool,
|
||
|
|
NonPagedPoolMustSucceed,
|
||
|
|
DontUseThisType,
|
||
|
|
NonPagedPoolCacheAligned,
|
||
|
|
PagedPoolCacheAligned,
|
||
|
|
NonPagedPoolCacheAlignedMustS,
|
||
|
|
MaxPoolType,
|
||
|
|
NonPagedPoolBase,
|
||
|
|
NonPagedPoolBaseMustSucceed,
|
||
|
|
NonPagedPoolBaseCacheAligned,
|
||
|
|
NonPagedPoolBaseCacheAlignedMustS,
|
||
|
|
NonPagedPoolSession,
|
||
|
|
PagedPoolSession,
|
||
|
|
NonPagedPoolMustSucceedSession,
|
||
|
|
DontUseThisTypeSession,
|
||
|
|
NonPagedPoolCacheAlignedSession,
|
||
|
|
PagedPoolCacheAlignedSession,
|
||
|
|
NonPagedPoolCacheAlignedMustSSession,
|
||
|
|
NonPagedPoolNx,
|
||
|
|
NonPagedPoolNxCacheAligned,
|
||
|
|
NonPagedPoolSessionNx
|
||
|
|
} POOL_TYPE;
|
||
|
|
|
||
|
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION
|
||
|
|
{
|
||
|
|
HANDLE Section;
|
||
|
|
PVOID MappedBase;
|
||
|
|
PVOID ImageBase;
|
||
|
|
ULONG ImageSize;
|
||
|
|
ULONG Flags;
|
||
|
|
USHORT LoadOrderIndex;
|
||
|
|
USHORT InitOrderIndex;
|
||
|
|
USHORT LoadCount;
|
||
|
|
USHORT OffsetToFileName;
|
||
|
|
UCHAR FullPathName[256];
|
||
|
|
} RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;
|
||
|
|
|
||
|
|
typedef struct _RTL_PROCESS_MODULES
|
||
|
|
{
|
||
|
|
ULONG NumberOfModules;
|
||
|
|
RTL_PROCESS_MODULE_INFORMATION Modules[1];
|
||
|
|
} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
|
||
|
|
|
||
|
|
typedef LARGE_INTEGER PHYSICAL_ADDRESS, * PPHYSICAL_ADDRESS;
|
||
|
|
|
||
|
|
typedef struct _MM_COPY_ADDRESS {
|
||
|
|
union {
|
||
|
|
PVOID VirtualAddress;
|
||
|
|
PHYSICAL_ADDRESS PhysicalAddress;
|
||
|
|
};
|
||
|
|
} MM_COPY_ADDRESS, * PMMCOPY_ADDRESS;
|
||
|
|
|
||
|
|
using ExAllocatePool = PVOID(__stdcall*) (POOL_TYPE, SIZE_T);
|
||
|
|
using ExAllocatePoolWithTag = PVOID(__stdcall*)(POOL_TYPE, SIZE_T, ULONG);
|
||
|
|
using MmCopyMemory = NTSTATUS (__stdcall*)(PVOID, MM_COPY_ADDRESS,SIZE_T,ULONG,PSIZE_T);
|
||
|
|
using DRIVER_INITIALIZE = NTSTATUS(__stdcall*)(std::uintptr_t, std::size_t);
|