mirror of https://github.com/x64dbg/GleeBug
implemented GetPEBLocation + GetTEBLocation + removed unused ImporterGetRemoteAPIAddress
This commit is contained in:
parent
1747679017
commit
b23675562f
|
|
@ -1,5 +1,6 @@
|
||||||
#include <GleeBug/Debugger.h>
|
#include <GleeBug/Debugger.h>
|
||||||
#include "TitanEngine.h"
|
#include "TitanEngine.h"
|
||||||
|
#include "ntdll.h"
|
||||||
|
|
||||||
using namespace GleeBug;
|
using namespace GleeBug;
|
||||||
|
|
||||||
|
|
@ -66,8 +67,7 @@ public:
|
||||||
auto process = processFromHandle(hProcess);
|
auto process = processFromHandle(hProcess);
|
||||||
if (!process)
|
if (!process)
|
||||||
return false;
|
return false;
|
||||||
//TODO process->MemWriteSafe
|
return process->MemWriteSafe(ptr(lpBaseAddress), lpBuffer, nSize, (ptr*)lpNumberOfBytesWritten);
|
||||||
return process->MemWriteUnsafe(ptr(lpBaseAddress), lpBuffer, nSize, (ptr*)lpNumberOfBytesWritten);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
bool Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte)
|
bool Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte)
|
||||||
|
|
@ -158,14 +158,44 @@ public:
|
||||||
//Misc
|
//Misc
|
||||||
void* GetPEBLocation(HANDLE hProcess)
|
void* GetPEBLocation(HANDLE hProcess)
|
||||||
{
|
{
|
||||||
//TODO
|
ULONG RequiredLen = 0;
|
||||||
return nullptr;
|
void* PebAddress = 0;
|
||||||
|
PROCESS_BASIC_INFORMATION myProcessBasicInformation[5] = { 0 };
|
||||||
|
|
||||||
|
if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, sizeof(PROCESS_BASIC_INFORMATION), &RequiredLen) == 0)
|
||||||
|
{
|
||||||
|
PebAddress = (void*)myProcessBasicInformation->PebBaseAddress;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, RequiredLen, &RequiredLen) == 0)
|
||||||
|
{
|
||||||
|
PebAddress = (void*)myProcessBasicInformation->PebBaseAddress;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void* GetTEBLocation(HANDLE hProcess)
|
return PebAddress;
|
||||||
|
}
|
||||||
|
|
||||||
|
void* GetTEBLocation(HANDLE hThread)
|
||||||
{
|
{
|
||||||
//TODO
|
ULONG RequiredLen = 0;
|
||||||
return nullptr;
|
void* TebAddress = 0;
|
||||||
|
THREAD_BASIC_INFORMATION myThreadBasicInformation[5] = { 0 };
|
||||||
|
|
||||||
|
if(NtQueryInformationThread(hThread, ThreadBasicInformation, myThreadBasicInformation, sizeof(THREAD_BASIC_INFORMATION), &RequiredLen) == 0)
|
||||||
|
{
|
||||||
|
TebAddress = (void*)myThreadBasicInformation->TebBaseAddress;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
if(NtQueryInformationThread(hThread, ThreadBasicInformation, myThreadBasicInformation, RequiredLen, &RequiredLen) == 0)
|
||||||
|
{
|
||||||
|
TebAddress = (void*)myThreadBasicInformation->TebBaseAddress;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return TebAddress;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool HideDebugger(HANDLE hProcess, DWORD PatchAPILevel)
|
bool HideDebugger(HANDLE hProcess, DWORD PatchAPILevel)
|
||||||
|
|
@ -186,12 +216,6 @@ public:
|
||||||
return OpenThread(dwDesiredAccess, bInheritHandle, dwThreadId);
|
return OpenThread(dwDesiredAccess, bInheritHandle, dwThreadId);
|
||||||
}
|
}
|
||||||
|
|
||||||
ULONG_PTR ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress)
|
|
||||||
{
|
|
||||||
//TODO
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
//Stepping
|
//Stepping
|
||||||
void StepOver(LPVOID CallBack)
|
void StepOver(LPVOID CallBack)
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -97,9 +97,9 @@ __declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess)
|
||||||
return emu.GetPEBLocation(hProcess);
|
return emu.GetPEBLocation(hProcess);
|
||||||
}
|
}
|
||||||
|
|
||||||
__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hProcess)
|
__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hThread)
|
||||||
{
|
{
|
||||||
return emu.GetTEBLocation(hProcess);
|
return emu.GetTEBLocation(hThread);
|
||||||
}
|
}
|
||||||
|
|
||||||
__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel)
|
__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel)
|
||||||
|
|
@ -117,11 +117,6 @@ __declspec(dllexport) HANDLE TITCALL TitanOpenThread(DWORD dwDesiredAccess, bool
|
||||||
return emu.TitanOpenThread(dwDesiredAccess, bInheritHandle, dwThreadId);
|
return emu.TitanOpenThread(dwDesiredAccess, bInheritHandle, dwThreadId);
|
||||||
}
|
}
|
||||||
|
|
||||||
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress)
|
|
||||||
{
|
|
||||||
return emu.ImporterGetRemoteAPIAddress(hProcess, APIAddress);
|
|
||||||
}
|
|
||||||
|
|
||||||
//Registers
|
//Registers
|
||||||
__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister)
|
__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister)
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,610 @@
|
||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include <windows.h>
|
||||||
|
|
||||||
|
#ifndef _WIN64
|
||||||
|
#pragma comment(lib, "ntdll_x86.lib")
|
||||||
|
#else
|
||||||
|
#pragma comment(lib, "ntdll_x64.lib")
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
|
||||||
|
|
||||||
|
typedef LONG NTSTATUS;
|
||||||
|
typedef LONG KPRIORITY;
|
||||||
|
|
||||||
|
typedef struct _CLIENT_ID
|
||||||
|
{
|
||||||
|
HANDLE UniqueProcess;
|
||||||
|
HANDLE UniqueThread;
|
||||||
|
} CLIENT_ID, *PCLIENT_ID;
|
||||||
|
|
||||||
|
typedef enum _KTHREAD_STATE
|
||||||
|
{
|
||||||
|
Initialized,
|
||||||
|
Ready,
|
||||||
|
Running,
|
||||||
|
Standby,
|
||||||
|
Terminated,
|
||||||
|
Waiting,
|
||||||
|
Transition,
|
||||||
|
DeferredReady,
|
||||||
|
GateWait
|
||||||
|
} KTHREAD_STATE;
|
||||||
|
|
||||||
|
typedef enum _KWAIT_REASON
|
||||||
|
{
|
||||||
|
Executive,
|
||||||
|
FreePage,
|
||||||
|
PageIn,
|
||||||
|
PoolAllocation,
|
||||||
|
DelayExecution,
|
||||||
|
Suspended,
|
||||||
|
UserRequest,
|
||||||
|
WrExecutive,
|
||||||
|
WrFreePage,
|
||||||
|
WrPageIn,
|
||||||
|
WrPoolAllocation,
|
||||||
|
WrDelayExecution,
|
||||||
|
WrSuspended,
|
||||||
|
WrUserRequest,
|
||||||
|
WrEventPair,
|
||||||
|
WrQueue,
|
||||||
|
WrLpcReceive,
|
||||||
|
WrLpcReply,
|
||||||
|
WrVirtualMemory,
|
||||||
|
WrPageOut,
|
||||||
|
WrRendezvous,
|
||||||
|
Spare2,
|
||||||
|
Spare3,
|
||||||
|
Spare4,
|
||||||
|
Spare5,
|
||||||
|
Spare6,
|
||||||
|
WrKernel,
|
||||||
|
WrResource,
|
||||||
|
WrPushLock,
|
||||||
|
WrMutex,
|
||||||
|
WrQuantumEnd,
|
||||||
|
WrDispatchInt,
|
||||||
|
WrPreempted,
|
||||||
|
WrYieldExecution,
|
||||||
|
WrFastMutex,
|
||||||
|
WrGuardedMutex,
|
||||||
|
WrRundown,
|
||||||
|
MaximumWaitReason
|
||||||
|
} KWAIT_REASON;
|
||||||
|
|
||||||
|
typedef struct _UNICODE_STRING
|
||||||
|
{
|
||||||
|
USHORT Length;
|
||||||
|
USHORT MaximumLength;
|
||||||
|
PWSTR Buffer;
|
||||||
|
} UNICODE_STRING, *PUNICODE_STRING;
|
||||||
|
|
||||||
|
typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG SessionId;
|
||||||
|
ULONG SizeOfBuf;
|
||||||
|
PVOID Buffer;
|
||||||
|
} SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _SYSTEM_THREAD_INFORMATION
|
||||||
|
{
|
||||||
|
LARGE_INTEGER KernelTime;
|
||||||
|
LARGE_INTEGER UserTime;
|
||||||
|
LARGE_INTEGER CreateTime;
|
||||||
|
ULONG WaitTime;
|
||||||
|
PVOID StartAddress;
|
||||||
|
CLIENT_ID ClientId;
|
||||||
|
KPRIORITY Priority;
|
||||||
|
LONG BasePriority;
|
||||||
|
ULONG ContextSwitches;
|
||||||
|
ULONG ThreadState;
|
||||||
|
ULONG WaitReason;
|
||||||
|
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
|
||||||
|
{
|
||||||
|
USHORT UniqueProcessId;
|
||||||
|
USHORT CreatorBackTraceIndex;
|
||||||
|
UCHAR ObjectTypeIndex;
|
||||||
|
UCHAR HandleAttributes;
|
||||||
|
USHORT HandleValue;
|
||||||
|
PVOID Object;
|
||||||
|
ULONG GrantedAccess;
|
||||||
|
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
|
||||||
|
|
||||||
|
typedef struct _SYSTEM_HANDLE_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG NumberOfHandles;
|
||||||
|
SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
|
||||||
|
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION
|
||||||
|
{
|
||||||
|
SYSTEM_THREAD_INFORMATION ThreadInfo;
|
||||||
|
PVOID StackBase;
|
||||||
|
PVOID StackLimit;
|
||||||
|
PVOID Win32StartAddress;
|
||||||
|
PVOID TebAddress; /* This is only filled in on Vista and above */
|
||||||
|
ULONG_PTR Reserved2;
|
||||||
|
ULONG_PTR Reserved3;
|
||||||
|
ULONG_PTR Reserved4;
|
||||||
|
} SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _SYSTEM_PROCESS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG NextEntryOffset;
|
||||||
|
ULONG NumberOfThreads;
|
||||||
|
LARGE_INTEGER SpareLi1;
|
||||||
|
LARGE_INTEGER SpareLi2;
|
||||||
|
LARGE_INTEGER SpareLi3;
|
||||||
|
LARGE_INTEGER CreateTime;
|
||||||
|
LARGE_INTEGER UserTime;
|
||||||
|
LARGE_INTEGER KernelTime;
|
||||||
|
UNICODE_STRING ImageName;
|
||||||
|
KPRIORITY BasePriority;
|
||||||
|
HANDLE UniqueProcessId;
|
||||||
|
HANDLE InheritedFromUniqueProcessId;
|
||||||
|
ULONG HandleCount;
|
||||||
|
ULONG SessionId;
|
||||||
|
ULONG_PTR PageDirectoryBase;
|
||||||
|
SIZE_T PeakVirtualSize;
|
||||||
|
SIZE_T VirtualSize;
|
||||||
|
ULONG PageFaultCount;
|
||||||
|
SIZE_T PeakWorkingSetSize;
|
||||||
|
SIZE_T WorkingSetSize;
|
||||||
|
SIZE_T QuotaPeakPagedPoolUsage;
|
||||||
|
SIZE_T QuotaPagedPoolUsage;
|
||||||
|
SIZE_T QuotaPeakNonPagedPoolUsage;
|
||||||
|
SIZE_T QuotaNonPagedPoolUsage;
|
||||||
|
SIZE_T PagefileUsage;
|
||||||
|
SIZE_T PeakPagefileUsage;
|
||||||
|
SIZE_T PrivatePageCount;
|
||||||
|
LARGE_INTEGER ReadOperationCount;
|
||||||
|
LARGE_INTEGER WriteOperationCount;
|
||||||
|
LARGE_INTEGER OtherOperationCount;
|
||||||
|
LARGE_INTEGER ReadTransferCount;
|
||||||
|
LARGE_INTEGER WriteTransferCount;
|
||||||
|
LARGE_INTEGER OtherTransferCount;
|
||||||
|
SYSTEM_THREAD_INFORMATION Threads[1];
|
||||||
|
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
|
||||||
|
|
||||||
|
|
||||||
|
typedef struct _OBJECT_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Attributes;
|
||||||
|
ACCESS_MASK GrantedAccess;
|
||||||
|
ULONG HandleCount;
|
||||||
|
ULONG PointerCount;
|
||||||
|
ULONG PagedPoolCharge;
|
||||||
|
ULONG NonPagedPoolCharge;
|
||||||
|
ULONG Reserved[ 3 ];
|
||||||
|
ULONG NameInfoSize;
|
||||||
|
ULONG TypeInfoSize;
|
||||||
|
ULONG SecurityDescriptorSize;
|
||||||
|
LARGE_INTEGER CreationTime;
|
||||||
|
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _OBJECT_NAME_INFORMATION
|
||||||
|
{
|
||||||
|
UNICODE_STRING Name;
|
||||||
|
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _OBJECT_TYPE_INFORMATION
|
||||||
|
{
|
||||||
|
UNICODE_STRING TypeName;
|
||||||
|
ULONG TotalNumberOfObjects;
|
||||||
|
ULONG TotalNumberOfHandles;
|
||||||
|
ULONG TotalPagedPoolUsage;
|
||||||
|
ULONG TotalNonPagedPoolUsage;
|
||||||
|
ULONG TotalNamePoolUsage;
|
||||||
|
ULONG TotalHandleTableUsage;
|
||||||
|
ULONG HighWaterNumberOfObjects;
|
||||||
|
ULONG HighWaterNumberOfHandles;
|
||||||
|
ULONG HighWaterPagedPoolUsage;
|
||||||
|
ULONG HighWaterNonPagedPoolUsage;
|
||||||
|
ULONG HighWaterNamePoolUsage;
|
||||||
|
ULONG HighWaterHandleTableUsage;
|
||||||
|
ULONG InvalidAttributes;
|
||||||
|
GENERIC_MAPPING GenericMapping;
|
||||||
|
ULONG ValidAccessMask;
|
||||||
|
BOOLEAN SecurityRequired;
|
||||||
|
BOOLEAN MaintainHandleCount;
|
||||||
|
ULONG PoolType;
|
||||||
|
ULONG DefaultPagedPoolCharge;
|
||||||
|
ULONG DefaultNonPagedPoolCharge;
|
||||||
|
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _OBJECT_TYPES_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG NumberOfTypes;
|
||||||
|
OBJECT_TYPE_INFORMATION TypeInformation[1];
|
||||||
|
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
|
||||||
|
|
||||||
|
//typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION
|
||||||
|
//{
|
||||||
|
// ULONG Attributes;
|
||||||
|
// ACCESS_MASK GrantedAccess;
|
||||||
|
// ULONG HandleCount;
|
||||||
|
// ULONG PointerCount;
|
||||||
|
//
|
||||||
|
// ULONG Reserved[10]; // reserved for internal use
|
||||||
|
//
|
||||||
|
//} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION
|
||||||
|
{
|
||||||
|
|
||||||
|
UNICODE_STRING TypeName;
|
||||||
|
|
||||||
|
ULONG Reserved [22]; // reserved for internal use
|
||||||
|
|
||||||
|
} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _PROCESS_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID Reserved1;
|
||||||
|
PVOID PebBaseAddress;
|
||||||
|
PVOID Reserved2[2];
|
||||||
|
ULONG_PTR UniqueProcessId;
|
||||||
|
PVOID Reserved3;
|
||||||
|
} PROCESS_BASIC_INFORMATION;
|
||||||
|
typedef PROCESS_BASIC_INFORMATION* PPROCESS_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _THREAD_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
NTSTATUS ExitStatus;
|
||||||
|
PVOID TebBaseAddress;
|
||||||
|
CLIENT_ID ClientId;
|
||||||
|
ULONG_PTR AffinityMask;
|
||||||
|
KPRIORITY Priority;
|
||||||
|
LONG BasePriority;
|
||||||
|
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
typedef
|
||||||
|
VOID
|
||||||
|
(*PPS_APC_ROUTINE)(
|
||||||
|
__in_opt PVOID ApcArgument1,
|
||||||
|
__in_opt PVOID ApcArgument2,
|
||||||
|
__in_opt PVOID ApcArgument3
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef enum _PROCESSINFOCLASS
|
||||||
|
{
|
||||||
|
ProcessBasicInformation,
|
||||||
|
ProcessQuotaLimits,
|
||||||
|
ProcessIoCounters,
|
||||||
|
ProcessVmCounters,
|
||||||
|
ProcessTimes,
|
||||||
|
ProcessBasePriority,
|
||||||
|
ProcessRaisePriority,
|
||||||
|
ProcessDebugPort,
|
||||||
|
ProcessExceptionPort,
|
||||||
|
ProcessAccessToken,
|
||||||
|
ProcessLdtInformation,
|
||||||
|
ProcessLdtSize,
|
||||||
|
ProcessDefaultHardErrorMode,
|
||||||
|
ProcessIoPortHandlers, // Note: this is kernel mode only
|
||||||
|
ProcessPooledUsageAndLimits,
|
||||||
|
ProcessWorkingSetWatch,
|
||||||
|
ProcessUserModeIOPL,
|
||||||
|
ProcessEnableAlignmentFaultFixup,
|
||||||
|
ProcessPriorityClass,
|
||||||
|
ProcessWx86Information,
|
||||||
|
ProcessHandleCount,
|
||||||
|
ProcessAffinityMask,
|
||||||
|
ProcessPriorityBoost,
|
||||||
|
ProcessDeviceMap,
|
||||||
|
ProcessSessionInformation,
|
||||||
|
ProcessForegroundInformation,
|
||||||
|
ProcessWow64Information,
|
||||||
|
ProcessImageFileName,
|
||||||
|
ProcessLUIDDeviceMapsEnabled,
|
||||||
|
ProcessBreakOnTermination,
|
||||||
|
ProcessDebugObjectHandle,
|
||||||
|
ProcessDebugFlags,
|
||||||
|
ProcessHandleTracing,
|
||||||
|
ProcessIoPriority,
|
||||||
|
ProcessExecuteFlags,
|
||||||
|
ProcessResourceManagement,
|
||||||
|
ProcessCookie,
|
||||||
|
ProcessImageInformation,
|
||||||
|
MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum
|
||||||
|
} PROCESSINFOCLASS;
|
||||||
|
|
||||||
|
typedef enum _SYSTEM_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
SystemBasicInformation,
|
||||||
|
SystemProcessorInformation, // obsolete...delete
|
||||||
|
SystemPerformanceInformation,
|
||||||
|
SystemTimeOfDayInformation,
|
||||||
|
SystemPathInformation,
|
||||||
|
SystemProcessInformation,
|
||||||
|
SystemCallCountInformation,
|
||||||
|
SystemDeviceInformation,
|
||||||
|
SystemProcessorPerformanceInformation,
|
||||||
|
SystemFlagsInformation,
|
||||||
|
SystemCallTimeInformation,
|
||||||
|
SystemModuleInformation,
|
||||||
|
SystemLocksInformation,
|
||||||
|
SystemStackTraceInformation,
|
||||||
|
SystemPagedPoolInformation,
|
||||||
|
SystemNonPagedPoolInformation,
|
||||||
|
SystemHandleInformation,
|
||||||
|
SystemObjectInformation,
|
||||||
|
SystemPageFileInformation,
|
||||||
|
SystemVdmInstemulInformation,
|
||||||
|
SystemVdmBopInformation,
|
||||||
|
SystemFileCacheInformation,
|
||||||
|
SystemPoolTagInformation,
|
||||||
|
SystemInterruptInformation,
|
||||||
|
SystemDpcBehaviorInformation,
|
||||||
|
SystemFullMemoryInformation,
|
||||||
|
SystemLoadGdiDriverInformation,
|
||||||
|
SystemUnloadGdiDriverInformation,
|
||||||
|
SystemTimeAdjustmentInformation,
|
||||||
|
SystemSummaryMemoryInformation,
|
||||||
|
SystemMirrorMemoryInformation,
|
||||||
|
SystemPerformanceTraceInformation,
|
||||||
|
SystemObsolete0,
|
||||||
|
SystemExceptionInformation,
|
||||||
|
SystemCrashDumpStateInformation,
|
||||||
|
SystemKernelDebuggerInformation,
|
||||||
|
SystemContextSwitchInformation,
|
||||||
|
SystemRegistryQuotaInformation,
|
||||||
|
SystemExtendServiceTableInformation,
|
||||||
|
SystemPrioritySeperation,
|
||||||
|
SystemVerifierAddDriverInformation,
|
||||||
|
SystemVerifierRemoveDriverInformation,
|
||||||
|
SystemProcessorIdleInformation,
|
||||||
|
SystemLegacyDriverInformation,
|
||||||
|
SystemCurrentTimeZoneInformation,
|
||||||
|
SystemLookasideInformation,
|
||||||
|
SystemTimeSlipNotification,
|
||||||
|
SystemSessionCreate,
|
||||||
|
SystemSessionDetach,
|
||||||
|
SystemSessionInformation,
|
||||||
|
SystemRangeStartInformation,
|
||||||
|
SystemVerifierInformation,
|
||||||
|
SystemVerifierThunkExtend,
|
||||||
|
SystemSessionProcessInformation,
|
||||||
|
SystemLoadGdiDriverInSystemSpace,
|
||||||
|
SystemNumaProcessorMap,
|
||||||
|
SystemPrefetcherInformation,
|
||||||
|
SystemExtendedProcessInformation,
|
||||||
|
SystemRecommendedSharedDataAlignment,
|
||||||
|
SystemComPlusPackage,
|
||||||
|
SystemNumaAvailableMemory,
|
||||||
|
SystemProcessorPowerInformation,
|
||||||
|
SystemEmulationBasicInformation,
|
||||||
|
SystemEmulationProcessorInformation,
|
||||||
|
SystemExtendedHandleInformation,
|
||||||
|
SystemLostDelayedWriteInformation,
|
||||||
|
SystemBigPoolInformation,
|
||||||
|
SystemSessionPoolTagInformation,
|
||||||
|
SystemSessionMappedViewInformation,
|
||||||
|
SystemHotpatchInformation,
|
||||||
|
SystemObjectSecurityMode,
|
||||||
|
SystemWatchdogTimerHandler,
|
||||||
|
SystemWatchdogTimerInformation,
|
||||||
|
SystemLogicalProcessorInformation,
|
||||||
|
SystemWow64SharedInformation,
|
||||||
|
SystemRegisterFirmwareTableInformationHandler,
|
||||||
|
SystemFirmwareTableInformation,
|
||||||
|
SystemModuleInformationEx,
|
||||||
|
SystemVerifierTriageInformation,
|
||||||
|
SystemSuperfetchInformation,
|
||||||
|
SystemMemoryListInformation,
|
||||||
|
SystemFileCacheInformationEx,
|
||||||
|
MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum
|
||||||
|
} SYSTEM_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
typedef enum _OBJECT_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
ObjectBasicInformation,
|
||||||
|
ObjectNameInformation,
|
||||||
|
ObjectTypeInformation,
|
||||||
|
ObjectTypesInformation,
|
||||||
|
ObjectHandleFlagInformation,
|
||||||
|
ObjectSessionInformation,
|
||||||
|
MaxObjectInfoClass // MaxObjectInfoClass should always be the last enum
|
||||||
|
} OBJECT_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
typedef enum _THREADINFOCLASS
|
||||||
|
{
|
||||||
|
ThreadBasicInformation,
|
||||||
|
ThreadTimes,
|
||||||
|
ThreadPriority,
|
||||||
|
ThreadBasePriority,
|
||||||
|
ThreadAffinityMask,
|
||||||
|
ThreadImpersonationToken,
|
||||||
|
ThreadDescriptorTableEntry,
|
||||||
|
ThreadEnableAlignmentFaultFixup,
|
||||||
|
ThreadEventPair_Reusable,
|
||||||
|
ThreadQuerySetWin32StartAddress,
|
||||||
|
ThreadZeroTlsCell,
|
||||||
|
ThreadPerformanceCount,
|
||||||
|
ThreadAmILastThread,
|
||||||
|
ThreadIdealProcessor,
|
||||||
|
ThreadPriorityBoost,
|
||||||
|
ThreadSetTlsArrayAddress,
|
||||||
|
ThreadIsIoPending,
|
||||||
|
ThreadHideFromDebugger,
|
||||||
|
ThreadBreakOnTermination,
|
||||||
|
ThreadSwitchLegacyState,
|
||||||
|
ThreadIsTerminated,
|
||||||
|
MaxThreadInfoClass
|
||||||
|
} THREADINFOCLASS;
|
||||||
|
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
extern "C" {
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationProcess(
|
||||||
|
__in HANDLE ProcessHandle,
|
||||||
|
__in PROCESSINFOCLASS ProcessInformationClass,
|
||||||
|
__in_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
||||||
|
__in ULONG ProcessInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryInformationProcess(
|
||||||
|
__in HANDLE ProcessHandle,
|
||||||
|
__in PROCESSINFOCLASS ProcessInformationClass,
|
||||||
|
__out_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
||||||
|
__in ULONG ProcessInformationLength,
|
||||||
|
__out_opt PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryObject(
|
||||||
|
__in HANDLE Handle,
|
||||||
|
__in OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||||
|
__out_bcount_opt(ObjectInformationLength) PVOID ObjectInformation,
|
||||||
|
__in ULONG ObjectInformationLength,
|
||||||
|
__out_opt PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetSystemInformation(
|
||||||
|
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||||
|
__in_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
||||||
|
__in ULONG SystemInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQuerySystemInformation(
|
||||||
|
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||||
|
__out_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
||||||
|
__in ULONG SystemInformationLength,
|
||||||
|
__out_opt PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationThread(
|
||||||
|
__in HANDLE ThreadHandle,
|
||||||
|
__in THREADINFOCLASS ThreadInformationClass,
|
||||||
|
__in_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
||||||
|
__in ULONG ThreadInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryInformationThread(
|
||||||
|
__in HANDLE ThreadHandle,
|
||||||
|
__in THREADINFOCLASS ThreadInformationClass,
|
||||||
|
__out_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
||||||
|
__in ULONG ThreadInformationLength,
|
||||||
|
__out_opt PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtUnmapViewOfSection(
|
||||||
|
__in HANDLE ProcessHandle,
|
||||||
|
__in PVOID BaseAddress
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSuspendThread(
|
||||||
|
__in HANDLE ThreadHandle,
|
||||||
|
__out_opt PULONG PreviousSuspendCount
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtResumeThread(
|
||||||
|
__in HANDLE ThreadHandle,
|
||||||
|
__out_opt PULONG PreviousSuspendCount
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSuspendProcess(
|
||||||
|
__in HANDLE ProcessHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtResumeProcess(
|
||||||
|
__in HANDLE ProcessHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueueApcThread(
|
||||||
|
__in HANDLE ThreadHandle,
|
||||||
|
__in PPS_APC_ROUTINE ApcRoutine,
|
||||||
|
__in_opt PVOID ApcArgument1,
|
||||||
|
__in_opt PVOID ApcArgument2,
|
||||||
|
__in_opt PVOID ApcArgument3
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
RtlGetCompressionWorkSpaceSize(
|
||||||
|
IN USHORT CompressionFormatAndEngine,
|
||||||
|
OUT PULONG CompressBufferWorkSpaceSize,
|
||||||
|
OUT PULONG CompressFragmentWorkSpaceSize
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
RtlCompressBuffer(
|
||||||
|
IN USHORT CompressionFormatAndEngine,
|
||||||
|
IN PUCHAR UncompressedBuffer,
|
||||||
|
IN ULONG UncompressedBufferSize,
|
||||||
|
OUT PUCHAR CompressedBuffer,
|
||||||
|
IN ULONG CompressedBufferSize,
|
||||||
|
IN ULONG UncompressedChunkSize,
|
||||||
|
OUT PULONG FinalCompressedSize,
|
||||||
|
IN PVOID WorkSpace
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
RtlDecompressBuffer(
|
||||||
|
IN USHORT CompressionFormat,
|
||||||
|
OUT PUCHAR UncompressedBuffer,
|
||||||
|
IN ULONG UncompressedBufferSize,
|
||||||
|
IN PUCHAR CompressedBuffer,
|
||||||
|
IN ULONG CompressedBufferSize,
|
||||||
|
OUT PULONG FinalUncompressedSize
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
ULONG
|
||||||
|
NTAPI
|
||||||
|
RtlNtStatusToDosError(
|
||||||
|
NTSTATUS Status
|
||||||
|
);
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
};
|
||||||
|
#endif
|
||||||
Binary file not shown.
Binary file not shown.
Loading…
Reference in New Issue