mirror of https://github.com/x64dbg/TitanEngine
removed ntdll madness
This commit is contained in:
NtQuery
parent
8984545393
commit
9eb47c282d
|
|
@ -11,23 +11,11 @@ __declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId)
|
|||
ULONG QuerySystemBufferSize = 0x2000;
|
||||
ULONG RequiredSize = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -47,30 +35,20 @@ __declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId)
|
|||
}
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
return(HandleCount);
|
||||
}
|
||||
|
||||
return(NULL);
|
||||
}
|
||||
__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle)
|
||||
{
|
||||
|
||||
bool HandleActive = false;
|
||||
LPVOID QuerySystemBuffer;
|
||||
ULONG QuerySystemBufferSize = 0x2000;
|
||||
ULONG RequiredSize = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL)
|
||||
{
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -94,7 +72,7 @@ __declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE h
|
|||
{
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName)
|
||||
|
|
@ -106,17 +84,6 @@ __declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD
|
|||
ULONG QuerySystemBufferSize = 0x2000;
|
||||
ULONG RequiredSize = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo;
|
||||
LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE);
|
||||
|
|
@ -124,10 +91,9 @@ __declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD
|
|||
LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
|
||||
LPVOID tmpHandleFullName = NULL;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -146,9 +112,9 @@ __declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD
|
|||
if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS))
|
||||
{
|
||||
RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION);
|
||||
cZwQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleFullName, 0x1000);
|
||||
if(pObjectNameInfo->Name.Length != NULL)
|
||||
{
|
||||
|
|
@ -183,7 +149,7 @@ __declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD
|
|||
{
|
||||
return(HandleFullName);
|
||||
}
|
||||
}
|
||||
|
||||
VirtualFree(HandleFullName, NULL, MEM_RELEASE);
|
||||
VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE);
|
||||
return(NULL);
|
||||
|
|
@ -197,17 +163,6 @@ __declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD
|
|||
ULONG QuerySystemBufferSize = 0x2000;
|
||||
ULONG RequiredSize = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo;
|
||||
LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE);
|
||||
|
|
@ -215,10 +170,9 @@ __declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD
|
|||
LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
|
||||
LPVOID tmpHandleFullName = NULL;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -237,9 +191,9 @@ __declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD
|
|||
if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS))
|
||||
{
|
||||
RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION);
|
||||
cZwQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleFullName, 0x1000);
|
||||
if(pObjectNameInfo->Name.Length != NULL)
|
||||
{
|
||||
|
|
@ -275,7 +229,7 @@ __declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD
|
|||
{
|
||||
return(HandleFullName);
|
||||
}
|
||||
}
|
||||
|
||||
VirtualFree(HandleFullName, NULL, MEM_RELEASE);
|
||||
VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE);
|
||||
return(NULL);
|
||||
|
|
@ -289,19 +243,11 @@ __declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId,
|
|||
ULONG TotalHandleCount = NULL;
|
||||
unsigned int HandleCount = NULL;
|
||||
ULONG QuerySystemBufferSize = 0x2000;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL)
|
||||
{
|
||||
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -324,7 +270,7 @@ __declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId,
|
|||
}
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
return(HandleCount);
|
||||
}
|
||||
|
||||
return(NULL);
|
||||
}
|
||||
__declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn)
|
||||
|
|
@ -335,17 +281,6 @@ __declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess,
|
|||
ULONG QuerySystemBufferSize = 0x2000;
|
||||
ULONG RequiredSize = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo;
|
||||
LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
|
||||
|
|
@ -354,10 +289,9 @@ __declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess,
|
|||
bool DontFreeStringMemory = false;
|
||||
ULONG_PTR ReturnData = NULL;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -373,7 +307,7 @@ __declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess,
|
|||
if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS))
|
||||
{
|
||||
RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION);
|
||||
cZwQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
if(InformationReturn == UE_OPTION_HANDLER_RETURN_HANDLECOUNT)
|
||||
{
|
||||
ReturnData = (ULONG_PTR)ObjectBasicInfo.HandleCount;
|
||||
|
|
@ -392,8 +326,8 @@ __declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess,
|
|||
if(HandleInfo->GrantedAccess != 0x0012019F)
|
||||
{
|
||||
RtlZeroMemory(HandleFullData, 0x1000);
|
||||
cZwQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleNameData, 0x1000);
|
||||
if(pObjectTypeInfo->TypeName.Length != NULL)
|
||||
{
|
||||
|
|
@ -409,8 +343,8 @@ __declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess,
|
|||
if(HandleInfo->GrantedAccess != 0x0012019F)
|
||||
{
|
||||
RtlZeroMemory(HandleFullData, 0x1000);
|
||||
cZwQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleNameData, 0x1000);
|
||||
if(pObjectTypeInfo->TypeName.Length != NULL)
|
||||
{
|
||||
|
|
@ -435,7 +369,7 @@ __declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess,
|
|||
VirtualFree(HandleFullData, NULL, MEM_RELEASE);
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
return(ReturnData);
|
||||
}
|
||||
|
||||
if(!DontFreeStringMemory)
|
||||
{
|
||||
VirtualFree(HandleNameData, NULL, MEM_RELEASE);
|
||||
|
|
@ -482,17 +416,8 @@ __declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileO
|
|||
ULONG RequiredSize = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
DWORD LastProcessId = NULL;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
|
||||
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo;
|
||||
LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE);
|
||||
|
|
@ -501,10 +426,9 @@ __declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileO
|
|||
int LenFileOrFolderName = lstrlenW(szFileOrFolderName);
|
||||
LPVOID tmpHandleFullName = NULL;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -532,9 +456,9 @@ __declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileO
|
|||
if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS))
|
||||
{
|
||||
RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION);
|
||||
cZwQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleFullName, 0x1000);
|
||||
if(pObjectNameInfo->Name.Length != NULL)
|
||||
{
|
||||
|
|
@ -579,10 +503,6 @@ __declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileO
|
|||
VirtualFree(HandleFullName, NULL, MEM_RELEASE);
|
||||
return(FoundHandles);
|
||||
}
|
||||
VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE);
|
||||
VirtualFree(HandleFullName, NULL, MEM_RELEASE);
|
||||
return(NULL);
|
||||
}
|
||||
__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated)
|
||||
{
|
||||
|
||||
|
|
@ -610,17 +530,6 @@ __declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOr
|
|||
ULONG RequiredSize = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
DWORD LastProcessId = NULL;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo;
|
||||
LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE);
|
||||
|
|
@ -629,10 +538,9 @@ __declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOr
|
|||
int LenFileOrFolderName = lstrlenW(szFileOrFolderName);
|
||||
LPVOID tmpHandleFullName = NULL;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -660,9 +568,9 @@ __declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOr
|
|||
if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS))
|
||||
{
|
||||
RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION);
|
||||
cZwQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleFullName, 0x1000);
|
||||
if(pObjectNameInfo->Name.Length != NULL)
|
||||
{
|
||||
|
|
@ -710,10 +618,7 @@ __declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOr
|
|||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE);
|
||||
VirtualFree(HandleFullName, NULL, MEM_RELEASE);
|
||||
return false;
|
||||
|
||||
}
|
||||
__declspec(dllexport) bool TITCALL HandlerIsFileLocked(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated)
|
||||
{
|
||||
|
|
@ -741,17 +646,7 @@ __declspec(dllexport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderN
|
|||
ULONG RequiredSize = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
DWORD LastProcessId = NULL;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo;
|
||||
LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE);
|
||||
|
|
@ -760,10 +655,8 @@ __declspec(dllexport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderN
|
|||
int LenFileOrFolderName = lstrlenW(szFileOrFolderName);
|
||||
LPVOID tmpHandleFullName = NULL;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -791,9 +684,9 @@ __declspec(dllexport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderN
|
|||
if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS))
|
||||
{
|
||||
RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION);
|
||||
cZwQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleFullName, 0x1000);
|
||||
if(pObjectNameInfo->Name.Length != NULL)
|
||||
{
|
||||
|
|
@ -835,10 +728,7 @@ __declspec(dllexport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderN
|
|||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
VirtualFree(HandleFullName, NULL, MEM_RELEASE);
|
||||
return false;
|
||||
}
|
||||
VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE);
|
||||
VirtualFree(HandleFullName, NULL, MEM_RELEASE);
|
||||
return false;
|
||||
|
||||
}
|
||||
// TitanEngine.Handler[Mutex].functions:
|
||||
__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount)
|
||||
|
|
@ -851,26 +741,15 @@ __declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess,
|
|||
ULONG TotalHandleCount = NULL;
|
||||
unsigned int HandleCount = NULL;
|
||||
ULONG QuerySystemBufferSize = 0x2000;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
|
||||
LPVOID HandleNameData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
|
||||
PPUBLIC_OBJECT_TYPE_INFORMATION pObjectTypeInfo = (PPUBLIC_OBJECT_TYPE_INFORMATION)HandleFullData;
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -889,8 +768,8 @@ __declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess,
|
|||
if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS))
|
||||
{
|
||||
RtlZeroMemory(HandleFullData, 0x1000);
|
||||
cZwQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleNameData, 0x1000);
|
||||
if(pObjectTypeInfo->TypeName.Length != NULL)
|
||||
{
|
||||
|
|
@ -914,10 +793,7 @@ __declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess,
|
|||
VirtualFree(HandleNameData, NULL, MEM_RELEASE);
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
return(HandleCount);
|
||||
}
|
||||
VirtualFree(HandleFullData, NULL, MEM_RELEASE);
|
||||
VirtualFree(HandleNameData, NULL, MEM_RELEASE);
|
||||
return(NULL);
|
||||
|
||||
}
|
||||
__declspec(dllexport) long long TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, char* szMutexString)
|
||||
{
|
||||
|
|
@ -994,17 +870,6 @@ __declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t
|
|||
DWORD LastProcessId = NULL;
|
||||
ULONG TotalHandleCount = NULL;
|
||||
ULONG QuerySystemBufferSize = 0x2000;
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(WINAPI *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwQuerySystemInformation)(DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
typedef NTSTATUS(__fastcall *fZwQueryObject)(HANDLE hObject, DWORD fInfoType, LPVOID fBuffer, ULONG fBufferSize, PULONG fRequiredSize);
|
||||
#endif
|
||||
LPVOID ZwQuerySystemInformation = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQuerySystemInformation");
|
||||
LPVOID ZwQueryObject = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwQueryObject");
|
||||
fZwQuerySystemInformation cZwQuerySystemInformation = (fZwQuerySystemInformation)(ZwQuerySystemInformation);
|
||||
fZwQueryObject cZwQueryObject = (fZwQueryObject)(ZwQueryObject);
|
||||
PNTDLL_QUERY_HANDLE_INFO HandleInfo;
|
||||
LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
|
||||
LPVOID HandleNameData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
|
||||
|
|
@ -1013,11 +878,10 @@ __declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t
|
|||
PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo;
|
||||
wchar_t RealMutexName[512] = L"\\BaseNamedObjects\\";
|
||||
|
||||
if(ZwQuerySystemInformation != NULL && ZwQueryObject != NULL)
|
||||
{
|
||||
|
||||
lstrcatW(RealMutexName, szMutexString);
|
||||
QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
while(cZwQuerySystemInformation(NTDLL_SystemHandleInfo, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L)
|
||||
{
|
||||
QuerySystemBufferSize = RequiredSize;
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
|
|
@ -1045,8 +909,8 @@ __declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t
|
|||
if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS))
|
||||
{
|
||||
RtlZeroMemory(HandleFullData, 0x1000);
|
||||
cZwQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleNameData, 0x1000);
|
||||
if(pObjectTypeInfo->TypeName.Length != NULL)
|
||||
{
|
||||
|
|
@ -1054,8 +918,8 @@ __declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t
|
|||
lstrcpyW((wchar_t*)HandleNameData, (wchar_t*)pObjectNameInfo->Name.Buffer);
|
||||
if(lstrcmpiW((LPCWSTR)HandleNameData, L"Mutant") == NULL)
|
||||
{
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
cZwQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize);
|
||||
NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize);
|
||||
RtlZeroMemory(HandleNameData, 0x1000);
|
||||
if(pObjectNameInfo->Name.Length != NULL)
|
||||
{
|
||||
|
|
@ -1082,9 +946,5 @@ __declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t
|
|||
VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE);
|
||||
VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE);
|
||||
return(ReturnData);
|
||||
}
|
||||
VirtualFree(HandleFullData, NULL, MEM_RELEASE);
|
||||
VirtualFree(HandleNameData, NULL, MEM_RELEASE);
|
||||
VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE);
|
||||
return(NULL);
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,7 +5,6 @@
|
|||
// TitanEngine.Hider.functions:
|
||||
__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess)
|
||||
{
|
||||
typedef NTSTATUS(WINAPI *fNtQueryInformationProcess)(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);
|
||||
ULONG RequiredLen = 0;
|
||||
void * PebAddress = 0;
|
||||
PPROCESS_BASIC_INFORMATION myProcessBasicInformation = (PPROCESS_BASIC_INFORMATION)VirtualAlloc(NULL, sizeof(PROCESS_BASIC_INFORMATION) * 4, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
|
||||
|
|
@ -13,22 +12,18 @@ __declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess)
|
|||
if(!myProcessBasicInformation)
|
||||
return 0;
|
||||
|
||||
fNtQueryInformationProcess cNtQueryInformationProcess = (fNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"),"NtQueryInformationProcess");
|
||||
|
||||
if(cNtQueryInformationProcess != NULL)
|
||||
{
|
||||
if(cNtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, sizeof(PROCESS_BASIC_INFORMATION), &RequiredLen) == STATUS_SUCCESS)
|
||||
if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, sizeof(PROCESS_BASIC_INFORMATION), &RequiredLen) == STATUS_SUCCESS)
|
||||
{
|
||||
PebAddress = (void*)myProcessBasicInformation->PebBaseAddress;
|
||||
}
|
||||
else
|
||||
{
|
||||
if(cNtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, RequiredLen, &RequiredLen) == STATUS_SUCCESS)
|
||||
if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, RequiredLen, &RequiredLen) == STATUS_SUCCESS)
|
||||
{
|
||||
PebAddress = (void*)myProcessBasicInformation->PebBaseAddress;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
VirtualFree(myProcessBasicInformation, 0, MEM_RELEASE);
|
||||
return PebAddress;
|
||||
|
|
|
|||
|
|
@ -26,13 +26,7 @@ __declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, wchar_t*
|
|||
LPVOID remStringData;
|
||||
LPVOID remCodeData;
|
||||
ULONG_PTR remInjectSize = (ULONG_PTR)((ULONG_PTR)&injectedRemoteFreeLibrary - (ULONG_PTR)&injectedRemoteLoadLibrary);
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwSetInformationThread)(HANDLE fThreadHandle, DWORD fThreadInfoClass, LPVOID fBuffer, ULONG fBufferSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwSetInformationThread)(HANDLE fThreadHandle, DWORD fThreadInfoClass, LPVOID fBuffer, ULONG fBufferSize);
|
||||
#endif
|
||||
LPVOID ZwSetInformationThread = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwSetInformationThread");
|
||||
fZwSetInformationThread cZwSetInformationThread = (fZwSetInformationThread)(ZwSetInformationThread);
|
||||
|
||||
ULONG_PTR NumberOfBytesWritten;
|
||||
DWORD ThreadId;
|
||||
HANDLE hThread;
|
||||
|
|
@ -56,10 +50,9 @@ __declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, wchar_t*
|
|||
if(WaitForThreadExit)
|
||||
{
|
||||
hThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)remCodeData, remStringData, CREATE_SUSPENDED, &ThreadId);
|
||||
if(ZwSetInformationThread != NULL)
|
||||
{
|
||||
cZwSetInformationThread(hThread, 0x11, NULL, NULL);
|
||||
}
|
||||
|
||||
NtSetInformationThread(hThread, ThreadHideFromDebugger, NULL, NULL);
|
||||
|
||||
ResumeThread(hThread);
|
||||
WaitForSingleObject(hThread, INFINITE);
|
||||
VirtualFreeEx(hProcess, remCodeData, NULL, MEM_RELEASE);
|
||||
|
|
@ -120,13 +113,6 @@ __declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE h
|
|||
LPVOID remCodeData;
|
||||
ULONG_PTR remInjectSize1 = (ULONG_PTR)((ULONG_PTR)&injectedExitProcess - (ULONG_PTR)&injectedRemoteFreeLibrarySimple);
|
||||
ULONG_PTR remInjectSize2 = (ULONG_PTR)((ULONG_PTR)&injectedRemoteFreeLibrarySimple - (ULONG_PTR)&injectedRemoteFreeLibrary);
|
||||
#if !defined(_WIN64)
|
||||
typedef NTSTATUS(WINAPI *fZwSetInformationThread)(HANDLE fThreadHandle, DWORD fThreadInfoClass, LPVOID fBuffer, ULONG fBufferSize);
|
||||
#else
|
||||
typedef NTSTATUS(__fastcall *fZwSetInformationThread)(HANDLE fThreadHandle, DWORD fThreadInfoClass, LPVOID fBuffer, ULONG fBufferSize);
|
||||
#endif
|
||||
LPVOID ZwSetInformationThread = (LPVOID)GetProcAddress(GetModuleHandleA("ntdll.dll"),"ZwSetInformationThread");
|
||||
fZwSetInformationThread cZwSetInformationThread = (fZwSetInformationThread)(ZwSetInformationThread);
|
||||
ULONG_PTR NumberOfBytesWritten;
|
||||
DWORD ThreadId;
|
||||
HANDLE hThread;
|
||||
|
|
@ -153,10 +139,9 @@ __declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE h
|
|||
if(WaitForThreadExit)
|
||||
{
|
||||
hThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)remCodeData, remStringData, CREATE_SUSPENDED, &ThreadId);
|
||||
if(ZwSetInformationThread != NULL)
|
||||
{
|
||||
cZwSetInformationThread(hThread, 0x11, NULL, NULL);
|
||||
}
|
||||
|
||||
NtSetInformationThread(hThread, ThreadHideFromDebugger, NULL, NULL);
|
||||
|
||||
ResumeThread(hThread);
|
||||
WaitForSingleObject(hThread, INFINITE);
|
||||
VirtualFreeEx(hProcess, remCodeData, NULL, MEM_RELEASE);
|
||||
|
|
@ -200,10 +185,7 @@ __declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE h
|
|||
if(WaitForThreadExit)
|
||||
{
|
||||
hThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)remCodeData, remStringData, CREATE_SUSPENDED, &ThreadId);
|
||||
if(ZwSetInformationThread != NULL)
|
||||
{
|
||||
cZwSetInformationThread(hThread, 0x11, NULL, NULL);
|
||||
}
|
||||
NtSetInformationThread(hThread, ThreadHideFromDebugger, NULL, NULL);
|
||||
ResumeThread(hThread);
|
||||
WaitForSingleObject(hThread, INFINITE);
|
||||
VirtualFreeEx(hProcess, remCodeData, NULL, MEM_RELEASE);
|
||||
|
|
|
|||
|
|
@ -298,6 +298,7 @@
|
|||
<ClInclude Include="Global.TLS.h" />
|
||||
<ClInclude Include="LzmaDec.h" />
|
||||
<ClInclude Include="LzmaTypes.h" />
|
||||
<ClInclude Include="ntdll.h" />
|
||||
<ClInclude Include="resource.h" />
|
||||
<ClInclude Include="scylla_wrapper.h" />
|
||||
<ClInclude Include="stdafx.h" />
|
||||
|
|
|
|||
|
|
@ -0,0 +1,260 @@
|
|||
#pragma once
|
||||
|
||||
#include <windows.h>
|
||||
|
||||
#ifndef _WIN64
|
||||
#pragma comment(lib, "ntdll_x86.lib")
|
||||
#else
|
||||
#pragma comment(lib, "ntdll_x64.lib")
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
typedef LONG NTSTATUS;
|
||||
|
||||
typedef struct _UNICODE_STRING {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PWSTR Buffer;
|
||||
} UNICODE_STRING, *PUNICODE_STRING;
|
||||
|
||||
typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
|
||||
ULONG Attributes;
|
||||
ACCESS_MASK GrantedAccess;
|
||||
ULONG HandleCount;
|
||||
ULONG PointerCount;
|
||||
|
||||
ULONG Reserved[10]; // reserved for internal use
|
||||
|
||||
} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;
|
||||
|
||||
typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION {
|
||||
|
||||
UNICODE_STRING TypeName;
|
||||
|
||||
ULONG Reserved [22]; // reserved for internal use
|
||||
|
||||
} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;
|
||||
|
||||
typedef struct _PROCESS_BASIC_INFORMATION {
|
||||
PVOID Reserved1;
|
||||
PVOID PebBaseAddress;
|
||||
PVOID Reserved2[2];
|
||||
ULONG_PTR UniqueProcessId;
|
||||
PVOID Reserved3;
|
||||
} PROCESS_BASIC_INFORMATION;
|
||||
typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION;
|
||||
|
||||
typedef enum _PROCESSINFOCLASS {
|
||||
ProcessBasicInformation,
|
||||
ProcessQuotaLimits,
|
||||
ProcessIoCounters,
|
||||
ProcessVmCounters,
|
||||
ProcessTimes,
|
||||
ProcessBasePriority,
|
||||
ProcessRaisePriority,
|
||||
ProcessDebugPort,
|
||||
ProcessExceptionPort,
|
||||
ProcessAccessToken,
|
||||
ProcessLdtInformation,
|
||||
ProcessLdtSize,
|
||||
ProcessDefaultHardErrorMode,
|
||||
ProcessIoPortHandlers, // Note: this is kernel mode only
|
||||
ProcessPooledUsageAndLimits,
|
||||
ProcessWorkingSetWatch,
|
||||
ProcessUserModeIOPL,
|
||||
ProcessEnableAlignmentFaultFixup,
|
||||
ProcessPriorityClass,
|
||||
ProcessWx86Information,
|
||||
ProcessHandleCount,
|
||||
ProcessAffinityMask,
|
||||
ProcessPriorityBoost,
|
||||
ProcessDeviceMap,
|
||||
ProcessSessionInformation,
|
||||
ProcessForegroundInformation,
|
||||
ProcessWow64Information,
|
||||
ProcessImageFileName,
|
||||
ProcessLUIDDeviceMapsEnabled,
|
||||
ProcessBreakOnTermination,
|
||||
ProcessDebugObjectHandle,
|
||||
ProcessDebugFlags,
|
||||
ProcessHandleTracing,
|
||||
ProcessIoPriority,
|
||||
ProcessExecuteFlags,
|
||||
ProcessResourceManagement,
|
||||
ProcessCookie,
|
||||
ProcessImageInformation,
|
||||
MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum
|
||||
} PROCESSINFOCLASS;
|
||||
|
||||
typedef enum _SYSTEM_INFORMATION_CLASS {
|
||||
SystemBasicInformation,
|
||||
SystemProcessorInformation, // obsolete...delete
|
||||
SystemPerformanceInformation,
|
||||
SystemTimeOfDayInformation,
|
||||
SystemPathInformation,
|
||||
SystemProcessInformation,
|
||||
SystemCallCountInformation,
|
||||
SystemDeviceInformation,
|
||||
SystemProcessorPerformanceInformation,
|
||||
SystemFlagsInformation,
|
||||
SystemCallTimeInformation,
|
||||
SystemModuleInformation,
|
||||
SystemLocksInformation,
|
||||
SystemStackTraceInformation,
|
||||
SystemPagedPoolInformation,
|
||||
SystemNonPagedPoolInformation,
|
||||
SystemHandleInformation,
|
||||
SystemObjectInformation,
|
||||
SystemPageFileInformation,
|
||||
SystemVdmInstemulInformation,
|
||||
SystemVdmBopInformation,
|
||||
SystemFileCacheInformation,
|
||||
SystemPoolTagInformation,
|
||||
SystemInterruptInformation,
|
||||
SystemDpcBehaviorInformation,
|
||||
SystemFullMemoryInformation,
|
||||
SystemLoadGdiDriverInformation,
|
||||
SystemUnloadGdiDriverInformation,
|
||||
SystemTimeAdjustmentInformation,
|
||||
SystemSummaryMemoryInformation,
|
||||
SystemMirrorMemoryInformation,
|
||||
SystemPerformanceTraceInformation,
|
||||
SystemObsolete0,
|
||||
SystemExceptionInformation,
|
||||
SystemCrashDumpStateInformation,
|
||||
SystemKernelDebuggerInformation,
|
||||
SystemContextSwitchInformation,
|
||||
SystemRegistryQuotaInformation,
|
||||
SystemExtendServiceTableInformation,
|
||||
SystemPrioritySeperation,
|
||||
SystemVerifierAddDriverInformation,
|
||||
SystemVerifierRemoveDriverInformation,
|
||||
SystemProcessorIdleInformation,
|
||||
SystemLegacyDriverInformation,
|
||||
SystemCurrentTimeZoneInformation,
|
||||
SystemLookasideInformation,
|
||||
SystemTimeSlipNotification,
|
||||
SystemSessionCreate,
|
||||
SystemSessionDetach,
|
||||
SystemSessionInformation,
|
||||
SystemRangeStartInformation,
|
||||
SystemVerifierInformation,
|
||||
SystemVerifierThunkExtend,
|
||||
SystemSessionProcessInformation,
|
||||
SystemLoadGdiDriverInSystemSpace,
|
||||
SystemNumaProcessorMap,
|
||||
SystemPrefetcherInformation,
|
||||
SystemExtendedProcessInformation,
|
||||
SystemRecommendedSharedDataAlignment,
|
||||
SystemComPlusPackage,
|
||||
SystemNumaAvailableMemory,
|
||||
SystemProcessorPowerInformation,
|
||||
SystemEmulationBasicInformation,
|
||||
SystemEmulationProcessorInformation,
|
||||
SystemExtendedHandleInformation,
|
||||
SystemLostDelayedWriteInformation,
|
||||
SystemBigPoolInformation,
|
||||
SystemSessionPoolTagInformation,
|
||||
SystemSessionMappedViewInformation,
|
||||
SystemHotpatchInformation,
|
||||
SystemObjectSecurityMode,
|
||||
SystemWatchdogTimerHandler,
|
||||
SystemWatchdogTimerInformation,
|
||||
SystemLogicalProcessorInformation,
|
||||
SystemWow64SharedInformation,
|
||||
SystemRegisterFirmwareTableInformationHandler,
|
||||
SystemFirmwareTableInformation,
|
||||
SystemModuleInformationEx,
|
||||
SystemVerifierTriageInformation,
|
||||
SystemSuperfetchInformation,
|
||||
SystemMemoryListInformation,
|
||||
SystemFileCacheInformationEx,
|
||||
MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum
|
||||
} SYSTEM_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _OBJECT_INFORMATION_CLASS {
|
||||
ObjectBasicInformation,
|
||||
ObjectNameInformation,
|
||||
ObjectTypeInformation,
|
||||
ObjectTypesInformation,
|
||||
ObjectHandleFlagInformation,
|
||||
ObjectSessionInformation,
|
||||
MaxObjectInfoClass // MaxObjectInfoClass should always be the last enum
|
||||
} OBJECT_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _THREADINFOCLASS {
|
||||
ThreadBasicInformation,
|
||||
ThreadTimes,
|
||||
ThreadPriority,
|
||||
ThreadBasePriority,
|
||||
ThreadAffinityMask,
|
||||
ThreadImpersonationToken,
|
||||
ThreadDescriptorTableEntry,
|
||||
ThreadEnableAlignmentFaultFixup,
|
||||
ThreadEventPair_Reusable,
|
||||
ThreadQuerySetWin32StartAddress,
|
||||
ThreadZeroTlsCell,
|
||||
ThreadPerformanceCount,
|
||||
ThreadAmILastThread,
|
||||
ThreadIdealProcessor,
|
||||
ThreadPriorityBoost,
|
||||
ThreadSetTlsArrayAddress,
|
||||
ThreadIsIoPending,
|
||||
ThreadHideFromDebugger,
|
||||
ThreadBreakOnTermination,
|
||||
ThreadSwitchLegacyState,
|
||||
ThreadIsTerminated,
|
||||
MaxThreadInfoClass
|
||||
} THREADINFOCLASS;
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQueryInformationProcess (
|
||||
__in HANDLE ProcessHandle,
|
||||
__in PROCESSINFOCLASS ProcessInformationClass,
|
||||
__out_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
||||
__in ULONG ProcessInformationLength,
|
||||
__out_opt PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQueryObject (
|
||||
__in HANDLE Handle,
|
||||
__in OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
__out_bcount_opt(ObjectInformationLength) PVOID ObjectInformation,
|
||||
__in ULONG ObjectInformationLength,
|
||||
__out_opt PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQuerySystemInformation (
|
||||
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
__out_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
||||
__in ULONG SystemInformationLength,
|
||||
__out_opt PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSetInformationThread (
|
||||
__in HANDLE ThreadHandle,
|
||||
__in THREADINFOCLASS ThreadInformationClass,
|
||||
__in_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
||||
__in ULONG ThreadInformationLength
|
||||
);
|
||||
|
||||
#ifdef __cplusplus
|
||||
};
|
||||
#endif
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -12,9 +12,8 @@
|
|||
#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers
|
||||
// Windows Header Files:
|
||||
#include <windows.h>
|
||||
#include <Winternl.h>
|
||||
|
||||
|
||||
//#include <winternl.h>
|
||||
#include "ntdll.h"
|
||||
#include "aplib.h"
|
||||
#include "LzmaDec.h"
|
||||
|
||||
|
|
@ -719,10 +718,6 @@ typedef struct
|
|||
|
||||
// UnpackEngine.Handler:
|
||||
|
||||
#define NTDLL_SystemHandleInfo 0x10
|
||||
#define ObjectBasicInformation 0
|
||||
#define ObjectNameInformation 1
|
||||
#define ObjectTypeInformation 2
|
||||
|
||||
/*typedef enum _POOL_TYPE {
|
||||
NonPagedPool,
|
||||
|
|
|
|||
Loading…
Reference in New Issue