mirror of https://github.com/x64dbg/GleeBug
implemented GetPEBLocation + GetTEBLocation + removed unused ImporterGetRemoteAPIAddress
This commit is contained in:
parent
1747679017
commit
b23675562f
|
|
@ -1,5 +1,6 @@
|
|||
#include <GleeBug/Debugger.h>
|
||||
#include "TitanEngine.h"
|
||||
#include "ntdll.h"
|
||||
|
||||
using namespace GleeBug;
|
||||
|
||||
|
|
@ -66,8 +67,7 @@ public:
|
|||
auto process = processFromHandle(hProcess);
|
||||
if (!process)
|
||||
return false;
|
||||
//TODO process->MemWriteSafe
|
||||
return process->MemWriteUnsafe(ptr(lpBaseAddress), lpBuffer, nSize, (ptr*)lpNumberOfBytesWritten);
|
||||
return process->MemWriteSafe(ptr(lpBaseAddress), lpBuffer, nSize, (ptr*)lpNumberOfBytesWritten);
|
||||
}
|
||||
|
||||
bool Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte)
|
||||
|
|
@ -158,14 +158,44 @@ public:
|
|||
//Misc
|
||||
void* GetPEBLocation(HANDLE hProcess)
|
||||
{
|
||||
//TODO
|
||||
return nullptr;
|
||||
ULONG RequiredLen = 0;
|
||||
void* PebAddress = 0;
|
||||
PROCESS_BASIC_INFORMATION myProcessBasicInformation[5] = { 0 };
|
||||
|
||||
if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, sizeof(PROCESS_BASIC_INFORMATION), &RequiredLen) == 0)
|
||||
{
|
||||
PebAddress = (void*)myProcessBasicInformation->PebBaseAddress;
|
||||
}
|
||||
else
|
||||
{
|
||||
if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, RequiredLen, &RequiredLen) == 0)
|
||||
{
|
||||
PebAddress = (void*)myProcessBasicInformation->PebBaseAddress;
|
||||
}
|
||||
}
|
||||
|
||||
return PebAddress;
|
||||
}
|
||||
|
||||
void* GetTEBLocation(HANDLE hProcess)
|
||||
void* GetTEBLocation(HANDLE hThread)
|
||||
{
|
||||
//TODO
|
||||
return nullptr;
|
||||
ULONG RequiredLen = 0;
|
||||
void* TebAddress = 0;
|
||||
THREAD_BASIC_INFORMATION myThreadBasicInformation[5] = { 0 };
|
||||
|
||||
if(NtQueryInformationThread(hThread, ThreadBasicInformation, myThreadBasicInformation, sizeof(THREAD_BASIC_INFORMATION), &RequiredLen) == 0)
|
||||
{
|
||||
TebAddress = (void*)myThreadBasicInformation->TebBaseAddress;
|
||||
}
|
||||
else
|
||||
{
|
||||
if(NtQueryInformationThread(hThread, ThreadBasicInformation, myThreadBasicInformation, RequiredLen, &RequiredLen) == 0)
|
||||
{
|
||||
TebAddress = (void*)myThreadBasicInformation->TebBaseAddress;
|
||||
}
|
||||
}
|
||||
|
||||
return TebAddress;
|
||||
}
|
||||
|
||||
bool HideDebugger(HANDLE hProcess, DWORD PatchAPILevel)
|
||||
|
|
@ -186,12 +216,6 @@ public:
|
|||
return OpenThread(dwDesiredAccess, bInheritHandle, dwThreadId);
|
||||
}
|
||||
|
||||
ULONG_PTR ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress)
|
||||
{
|
||||
//TODO
|
||||
return 0;
|
||||
}
|
||||
|
||||
//Stepping
|
||||
void StepOver(LPVOID CallBack)
|
||||
{
|
||||
|
|
|
|||
|
|
@ -97,9 +97,9 @@ __declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess)
|
|||
return emu.GetPEBLocation(hProcess);
|
||||
}
|
||||
|
||||
__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hProcess)
|
||||
__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hThread)
|
||||
{
|
||||
return emu.GetTEBLocation(hProcess);
|
||||
return emu.GetTEBLocation(hThread);
|
||||
}
|
||||
|
||||
__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel)
|
||||
|
|
@ -117,11 +117,6 @@ __declspec(dllexport) HANDLE TITCALL TitanOpenThread(DWORD dwDesiredAccess, bool
|
|||
return emu.TitanOpenThread(dwDesiredAccess, bInheritHandle, dwThreadId);
|
||||
}
|
||||
|
||||
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress)
|
||||
{
|
||||
return emu.ImporterGetRemoteAPIAddress(hProcess, APIAddress);
|
||||
}
|
||||
|
||||
//Registers
|
||||
__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister)
|
||||
{
|
||||
|
|
|
|||
|
|
@ -0,0 +1,610 @@
|
|||
#pragma once
|
||||
|
||||
#include <windows.h>
|
||||
|
||||
#ifndef _WIN64
|
||||
#pragma comment(lib, "ntdll_x86.lib")
|
||||
#else
|
||||
#pragma comment(lib, "ntdll_x64.lib")
|
||||
#endif
|
||||
|
||||
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
|
||||
|
||||
typedef LONG NTSTATUS;
|
||||
typedef LONG KPRIORITY;
|
||||
|
||||
typedef struct _CLIENT_ID
|
||||
{
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
} CLIENT_ID, *PCLIENT_ID;
|
||||
|
||||
typedef enum _KTHREAD_STATE
|
||||
{
|
||||
Initialized,
|
||||
Ready,
|
||||
Running,
|
||||
Standby,
|
||||
Terminated,
|
||||
Waiting,
|
||||
Transition,
|
||||
DeferredReady,
|
||||
GateWait
|
||||
} KTHREAD_STATE;
|
||||
|
||||
typedef enum _KWAIT_REASON
|
||||
{
|
||||
Executive,
|
||||
FreePage,
|
||||
PageIn,
|
||||
PoolAllocation,
|
||||
DelayExecution,
|
||||
Suspended,
|
||||
UserRequest,
|
||||
WrExecutive,
|
||||
WrFreePage,
|
||||
WrPageIn,
|
||||
WrPoolAllocation,
|
||||
WrDelayExecution,
|
||||
WrSuspended,
|
||||
WrUserRequest,
|
||||
WrEventPair,
|
||||
WrQueue,
|
||||
WrLpcReceive,
|
||||
WrLpcReply,
|
||||
WrVirtualMemory,
|
||||
WrPageOut,
|
||||
WrRendezvous,
|
||||
Spare2,
|
||||
Spare3,
|
||||
Spare4,
|
||||
Spare5,
|
||||
Spare6,
|
||||
WrKernel,
|
||||
WrResource,
|
||||
WrPushLock,
|
||||
WrMutex,
|
||||
WrQuantumEnd,
|
||||
WrDispatchInt,
|
||||
WrPreempted,
|
||||
WrYieldExecution,
|
||||
WrFastMutex,
|
||||
WrGuardedMutex,
|
||||
WrRundown,
|
||||
MaximumWaitReason
|
||||
} KWAIT_REASON;
|
||||
|
||||
typedef struct _UNICODE_STRING
|
||||
{
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PWSTR Buffer;
|
||||
} UNICODE_STRING, *PUNICODE_STRING;
|
||||
|
||||
typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
|
||||
{
|
||||
ULONG SessionId;
|
||||
ULONG SizeOfBuf;
|
||||
PVOID Buffer;
|
||||
} SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;
|
||||
|
||||
typedef struct _SYSTEM_THREAD_INFORMATION
|
||||
{
|
||||
LARGE_INTEGER KernelTime;
|
||||
LARGE_INTEGER UserTime;
|
||||
LARGE_INTEGER CreateTime;
|
||||
ULONG WaitTime;
|
||||
PVOID StartAddress;
|
||||
CLIENT_ID ClientId;
|
||||
KPRIORITY Priority;
|
||||
LONG BasePriority;
|
||||
ULONG ContextSwitches;
|
||||
ULONG ThreadState;
|
||||
ULONG WaitReason;
|
||||
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
|
||||
|
||||
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
|
||||
{
|
||||
USHORT UniqueProcessId;
|
||||
USHORT CreatorBackTraceIndex;
|
||||
UCHAR ObjectTypeIndex;
|
||||
UCHAR HandleAttributes;
|
||||
USHORT HandleValue;
|
||||
PVOID Object;
|
||||
ULONG GrantedAccess;
|
||||
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
|
||||
|
||||
typedef struct _SYSTEM_HANDLE_INFORMATION
|
||||
{
|
||||
ULONG NumberOfHandles;
|
||||
SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
|
||||
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
|
||||
|
||||
typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION
|
||||
{
|
||||
SYSTEM_THREAD_INFORMATION ThreadInfo;
|
||||
PVOID StackBase;
|
||||
PVOID StackLimit;
|
||||
PVOID Win32StartAddress;
|
||||
PVOID TebAddress; /* This is only filled in on Vista and above */
|
||||
ULONG_PTR Reserved2;
|
||||
ULONG_PTR Reserved3;
|
||||
ULONG_PTR Reserved4;
|
||||
} SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION;
|
||||
|
||||
typedef struct _SYSTEM_PROCESS_INFORMATION
|
||||
{
|
||||
ULONG NextEntryOffset;
|
||||
ULONG NumberOfThreads;
|
||||
LARGE_INTEGER SpareLi1;
|
||||
LARGE_INTEGER SpareLi2;
|
||||
LARGE_INTEGER SpareLi3;
|
||||
LARGE_INTEGER CreateTime;
|
||||
LARGE_INTEGER UserTime;
|
||||
LARGE_INTEGER KernelTime;
|
||||
UNICODE_STRING ImageName;
|
||||
KPRIORITY BasePriority;
|
||||
HANDLE UniqueProcessId;
|
||||
HANDLE InheritedFromUniqueProcessId;
|
||||
ULONG HandleCount;
|
||||
ULONG SessionId;
|
||||
ULONG_PTR PageDirectoryBase;
|
||||
SIZE_T PeakVirtualSize;
|
||||
SIZE_T VirtualSize;
|
||||
ULONG PageFaultCount;
|
||||
SIZE_T PeakWorkingSetSize;
|
||||
SIZE_T WorkingSetSize;
|
||||
SIZE_T QuotaPeakPagedPoolUsage;
|
||||
SIZE_T QuotaPagedPoolUsage;
|
||||
SIZE_T QuotaPeakNonPagedPoolUsage;
|
||||
SIZE_T QuotaNonPagedPoolUsage;
|
||||
SIZE_T PagefileUsage;
|
||||
SIZE_T PeakPagefileUsage;
|
||||
SIZE_T PrivatePageCount;
|
||||
LARGE_INTEGER ReadOperationCount;
|
||||
LARGE_INTEGER WriteOperationCount;
|
||||
LARGE_INTEGER OtherOperationCount;
|
||||
LARGE_INTEGER ReadTransferCount;
|
||||
LARGE_INTEGER WriteTransferCount;
|
||||
LARGE_INTEGER OtherTransferCount;
|
||||
SYSTEM_THREAD_INFORMATION Threads[1];
|
||||
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
|
||||
|
||||
|
||||
typedef struct _OBJECT_BASIC_INFORMATION
|
||||
{
|
||||
ULONG Attributes;
|
||||
ACCESS_MASK GrantedAccess;
|
||||
ULONG HandleCount;
|
||||
ULONG PointerCount;
|
||||
ULONG PagedPoolCharge;
|
||||
ULONG NonPagedPoolCharge;
|
||||
ULONG Reserved[ 3 ];
|
||||
ULONG NameInfoSize;
|
||||
ULONG TypeInfoSize;
|
||||
ULONG SecurityDescriptorSize;
|
||||
LARGE_INTEGER CreationTime;
|
||||
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
|
||||
|
||||
typedef struct _OBJECT_NAME_INFORMATION
|
||||
{
|
||||
UNICODE_STRING Name;
|
||||
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
|
||||
|
||||
typedef struct _OBJECT_TYPE_INFORMATION
|
||||
{
|
||||
UNICODE_STRING TypeName;
|
||||
ULONG TotalNumberOfObjects;
|
||||
ULONG TotalNumberOfHandles;
|
||||
ULONG TotalPagedPoolUsage;
|
||||
ULONG TotalNonPagedPoolUsage;
|
||||
ULONG TotalNamePoolUsage;
|
||||
ULONG TotalHandleTableUsage;
|
||||
ULONG HighWaterNumberOfObjects;
|
||||
ULONG HighWaterNumberOfHandles;
|
||||
ULONG HighWaterPagedPoolUsage;
|
||||
ULONG HighWaterNonPagedPoolUsage;
|
||||
ULONG HighWaterNamePoolUsage;
|
||||
ULONG HighWaterHandleTableUsage;
|
||||
ULONG InvalidAttributes;
|
||||
GENERIC_MAPPING GenericMapping;
|
||||
ULONG ValidAccessMask;
|
||||
BOOLEAN SecurityRequired;
|
||||
BOOLEAN MaintainHandleCount;
|
||||
ULONG PoolType;
|
||||
ULONG DefaultPagedPoolCharge;
|
||||
ULONG DefaultNonPagedPoolCharge;
|
||||
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
|
||||
|
||||
typedef struct _OBJECT_TYPES_INFORMATION
|
||||
{
|
||||
ULONG NumberOfTypes;
|
||||
OBJECT_TYPE_INFORMATION TypeInformation[1];
|
||||
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
|
||||
|
||||
//typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION
|
||||
//{
|
||||
// ULONG Attributes;
|
||||
// ACCESS_MASK GrantedAccess;
|
||||
// ULONG HandleCount;
|
||||
// ULONG PointerCount;
|
||||
//
|
||||
// ULONG Reserved[10]; // reserved for internal use
|
||||
//
|
||||
//} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;
|
||||
|
||||
typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION
|
||||
{
|
||||
|
||||
UNICODE_STRING TypeName;
|
||||
|
||||
ULONG Reserved [22]; // reserved for internal use
|
||||
|
||||
} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;
|
||||
|
||||
typedef struct _PROCESS_BASIC_INFORMATION
|
||||
{
|
||||
PVOID Reserved1;
|
||||
PVOID PebBaseAddress;
|
||||
PVOID Reserved2[2];
|
||||
ULONG_PTR UniqueProcessId;
|
||||
PVOID Reserved3;
|
||||
} PROCESS_BASIC_INFORMATION;
|
||||
typedef PROCESS_BASIC_INFORMATION* PPROCESS_BASIC_INFORMATION;
|
||||
|
||||
typedef struct _THREAD_BASIC_INFORMATION
|
||||
{
|
||||
NTSTATUS ExitStatus;
|
||||
PVOID TebBaseAddress;
|
||||
CLIENT_ID ClientId;
|
||||
ULONG_PTR AffinityMask;
|
||||
KPRIORITY Priority;
|
||||
LONG BasePriority;
|
||||
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
|
||||
|
||||
typedef
|
||||
VOID
|
||||
(*PPS_APC_ROUTINE)(
|
||||
__in_opt PVOID ApcArgument1,
|
||||
__in_opt PVOID ApcArgument2,
|
||||
__in_opt PVOID ApcArgument3
|
||||
);
|
||||
|
||||
typedef enum _PROCESSINFOCLASS
|
||||
{
|
||||
ProcessBasicInformation,
|
||||
ProcessQuotaLimits,
|
||||
ProcessIoCounters,
|
||||
ProcessVmCounters,
|
||||
ProcessTimes,
|
||||
ProcessBasePriority,
|
||||
ProcessRaisePriority,
|
||||
ProcessDebugPort,
|
||||
ProcessExceptionPort,
|
||||
ProcessAccessToken,
|
||||
ProcessLdtInformation,
|
||||
ProcessLdtSize,
|
||||
ProcessDefaultHardErrorMode,
|
||||
ProcessIoPortHandlers, // Note: this is kernel mode only
|
||||
ProcessPooledUsageAndLimits,
|
||||
ProcessWorkingSetWatch,
|
||||
ProcessUserModeIOPL,
|
||||
ProcessEnableAlignmentFaultFixup,
|
||||
ProcessPriorityClass,
|
||||
ProcessWx86Information,
|
||||
ProcessHandleCount,
|
||||
ProcessAffinityMask,
|
||||
ProcessPriorityBoost,
|
||||
ProcessDeviceMap,
|
||||
ProcessSessionInformation,
|
||||
ProcessForegroundInformation,
|
||||
ProcessWow64Information,
|
||||
ProcessImageFileName,
|
||||
ProcessLUIDDeviceMapsEnabled,
|
||||
ProcessBreakOnTermination,
|
||||
ProcessDebugObjectHandle,
|
||||
ProcessDebugFlags,
|
||||
ProcessHandleTracing,
|
||||
ProcessIoPriority,
|
||||
ProcessExecuteFlags,
|
||||
ProcessResourceManagement,
|
||||
ProcessCookie,
|
||||
ProcessImageInformation,
|
||||
MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum
|
||||
} PROCESSINFOCLASS;
|
||||
|
||||
typedef enum _SYSTEM_INFORMATION_CLASS
|
||||
{
|
||||
SystemBasicInformation,
|
||||
SystemProcessorInformation, // obsolete...delete
|
||||
SystemPerformanceInformation,
|
||||
SystemTimeOfDayInformation,
|
||||
SystemPathInformation,
|
||||
SystemProcessInformation,
|
||||
SystemCallCountInformation,
|
||||
SystemDeviceInformation,
|
||||
SystemProcessorPerformanceInformation,
|
||||
SystemFlagsInformation,
|
||||
SystemCallTimeInformation,
|
||||
SystemModuleInformation,
|
||||
SystemLocksInformation,
|
||||
SystemStackTraceInformation,
|
||||
SystemPagedPoolInformation,
|
||||
SystemNonPagedPoolInformation,
|
||||
SystemHandleInformation,
|
||||
SystemObjectInformation,
|
||||
SystemPageFileInformation,
|
||||
SystemVdmInstemulInformation,
|
||||
SystemVdmBopInformation,
|
||||
SystemFileCacheInformation,
|
||||
SystemPoolTagInformation,
|
||||
SystemInterruptInformation,
|
||||
SystemDpcBehaviorInformation,
|
||||
SystemFullMemoryInformation,
|
||||
SystemLoadGdiDriverInformation,
|
||||
SystemUnloadGdiDriverInformation,
|
||||
SystemTimeAdjustmentInformation,
|
||||
SystemSummaryMemoryInformation,
|
||||
SystemMirrorMemoryInformation,
|
||||
SystemPerformanceTraceInformation,
|
||||
SystemObsolete0,
|
||||
SystemExceptionInformation,
|
||||
SystemCrashDumpStateInformation,
|
||||
SystemKernelDebuggerInformation,
|
||||
SystemContextSwitchInformation,
|
||||
SystemRegistryQuotaInformation,
|
||||
SystemExtendServiceTableInformation,
|
||||
SystemPrioritySeperation,
|
||||
SystemVerifierAddDriverInformation,
|
||||
SystemVerifierRemoveDriverInformation,
|
||||
SystemProcessorIdleInformation,
|
||||
SystemLegacyDriverInformation,
|
||||
SystemCurrentTimeZoneInformation,
|
||||
SystemLookasideInformation,
|
||||
SystemTimeSlipNotification,
|
||||
SystemSessionCreate,
|
||||
SystemSessionDetach,
|
||||
SystemSessionInformation,
|
||||
SystemRangeStartInformation,
|
||||
SystemVerifierInformation,
|
||||
SystemVerifierThunkExtend,
|
||||
SystemSessionProcessInformation,
|
||||
SystemLoadGdiDriverInSystemSpace,
|
||||
SystemNumaProcessorMap,
|
||||
SystemPrefetcherInformation,
|
||||
SystemExtendedProcessInformation,
|
||||
SystemRecommendedSharedDataAlignment,
|
||||
SystemComPlusPackage,
|
||||
SystemNumaAvailableMemory,
|
||||
SystemProcessorPowerInformation,
|
||||
SystemEmulationBasicInformation,
|
||||
SystemEmulationProcessorInformation,
|
||||
SystemExtendedHandleInformation,
|
||||
SystemLostDelayedWriteInformation,
|
||||
SystemBigPoolInformation,
|
||||
SystemSessionPoolTagInformation,
|
||||
SystemSessionMappedViewInformation,
|
||||
SystemHotpatchInformation,
|
||||
SystemObjectSecurityMode,
|
||||
SystemWatchdogTimerHandler,
|
||||
SystemWatchdogTimerInformation,
|
||||
SystemLogicalProcessorInformation,
|
||||
SystemWow64SharedInformation,
|
||||
SystemRegisterFirmwareTableInformationHandler,
|
||||
SystemFirmwareTableInformation,
|
||||
SystemModuleInformationEx,
|
||||
SystemVerifierTriageInformation,
|
||||
SystemSuperfetchInformation,
|
||||
SystemMemoryListInformation,
|
||||
SystemFileCacheInformationEx,
|
||||
MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum
|
||||
} SYSTEM_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _OBJECT_INFORMATION_CLASS
|
||||
{
|
||||
ObjectBasicInformation,
|
||||
ObjectNameInformation,
|
||||
ObjectTypeInformation,
|
||||
ObjectTypesInformation,
|
||||
ObjectHandleFlagInformation,
|
||||
ObjectSessionInformation,
|
||||
MaxObjectInfoClass // MaxObjectInfoClass should always be the last enum
|
||||
} OBJECT_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _THREADINFOCLASS
|
||||
{
|
||||
ThreadBasicInformation,
|
||||
ThreadTimes,
|
||||
ThreadPriority,
|
||||
ThreadBasePriority,
|
||||
ThreadAffinityMask,
|
||||
ThreadImpersonationToken,
|
||||
ThreadDescriptorTableEntry,
|
||||
ThreadEnableAlignmentFaultFixup,
|
||||
ThreadEventPair_Reusable,
|
||||
ThreadQuerySetWin32StartAddress,
|
||||
ThreadZeroTlsCell,
|
||||
ThreadPerformanceCount,
|
||||
ThreadAmILastThread,
|
||||
ThreadIdealProcessor,
|
||||
ThreadPriorityBoost,
|
||||
ThreadSetTlsArrayAddress,
|
||||
ThreadIsIoPending,
|
||||
ThreadHideFromDebugger,
|
||||
ThreadBreakOnTermination,
|
||||
ThreadSwitchLegacyState,
|
||||
ThreadIsTerminated,
|
||||
MaxThreadInfoClass
|
||||
} THREADINFOCLASS;
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSetInformationProcess(
|
||||
__in HANDLE ProcessHandle,
|
||||
__in PROCESSINFOCLASS ProcessInformationClass,
|
||||
__in_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
||||
__in ULONG ProcessInformationLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQueryInformationProcess(
|
||||
__in HANDLE ProcessHandle,
|
||||
__in PROCESSINFOCLASS ProcessInformationClass,
|
||||
__out_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
||||
__in ULONG ProcessInformationLength,
|
||||
__out_opt PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQueryObject(
|
||||
__in HANDLE Handle,
|
||||
__in OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
__out_bcount_opt(ObjectInformationLength) PVOID ObjectInformation,
|
||||
__in ULONG ObjectInformationLength,
|
||||
__out_opt PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSetSystemInformation(
|
||||
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
__in_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
||||
__in ULONG SystemInformationLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQuerySystemInformation(
|
||||
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
__out_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
||||
__in ULONG SystemInformationLength,
|
||||
__out_opt PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSetInformationThread(
|
||||
__in HANDLE ThreadHandle,
|
||||
__in THREADINFOCLASS ThreadInformationClass,
|
||||
__in_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
||||
__in ULONG ThreadInformationLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQueryInformationThread(
|
||||
__in HANDLE ThreadHandle,
|
||||
__in THREADINFOCLASS ThreadInformationClass,
|
||||
__out_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
||||
__in ULONG ThreadInformationLength,
|
||||
__out_opt PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtUnmapViewOfSection(
|
||||
__in HANDLE ProcessHandle,
|
||||
__in PVOID BaseAddress
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSuspendThread(
|
||||
__in HANDLE ThreadHandle,
|
||||
__out_opt PULONG PreviousSuspendCount
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtResumeThread(
|
||||
__in HANDLE ThreadHandle,
|
||||
__out_opt PULONG PreviousSuspendCount
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSuspendProcess(
|
||||
__in HANDLE ProcessHandle
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtResumeProcess(
|
||||
__in HANDLE ProcessHandle
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQueueApcThread(
|
||||
__in HANDLE ThreadHandle,
|
||||
__in PPS_APC_ROUTINE ApcRoutine,
|
||||
__in_opt PVOID ApcArgument1,
|
||||
__in_opt PVOID ApcArgument2,
|
||||
__in_opt PVOID ApcArgument3
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
RtlGetCompressionWorkSpaceSize(
|
||||
IN USHORT CompressionFormatAndEngine,
|
||||
OUT PULONG CompressBufferWorkSpaceSize,
|
||||
OUT PULONG CompressFragmentWorkSpaceSize
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
RtlCompressBuffer(
|
||||
IN USHORT CompressionFormatAndEngine,
|
||||
IN PUCHAR UncompressedBuffer,
|
||||
IN ULONG UncompressedBufferSize,
|
||||
OUT PUCHAR CompressedBuffer,
|
||||
IN ULONG CompressedBufferSize,
|
||||
IN ULONG UncompressedChunkSize,
|
||||
OUT PULONG FinalCompressedSize,
|
||||
IN PVOID WorkSpace
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
RtlDecompressBuffer(
|
||||
IN USHORT CompressionFormat,
|
||||
OUT PUCHAR UncompressedBuffer,
|
||||
IN ULONG UncompressedBufferSize,
|
||||
IN PUCHAR CompressedBuffer,
|
||||
IN ULONG CompressedBufferSize,
|
||||
OUT PULONG FinalUncompressedSize
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
ULONG
|
||||
NTAPI
|
||||
RtlNtStatusToDosError(
|
||||
NTSTATUS Status
|
||||
);
|
||||
|
||||
#ifdef __cplusplus
|
||||
};
|
||||
#endif
|
||||
Binary file not shown.
Binary file not shown.
Loading…
Reference in New Issue