Skip to content

Commit 7e6fb23

Browse files
mrexodiamrexodia
committedJun 26, 2016
format
1 parent 3fc6704 commit 7e6fb23

6 files changed

+80
-80
lines changed
 

‎DeviceNameResolver.cpp

+30-30
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,26 @@
66
extern "C" __declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSize)
77
{
88
DeviceNameResolver deviceNameResolver;
9-
wchar_t targetPath[MAX_PATH]=L"";
9+
wchar_t targetPath[MAX_PATH] = L"";
1010
if(!deviceNameResolver.resolveDeviceLongNameToShort(szDevicePath, targetPath))
1111
return false;
12-
wcscpy_s(szPath, nSize/sizeof(wchar_t), targetPath);
12+
wcscpy_s(szPath, nSize / sizeof(wchar_t), targetPath);
1313
return true;
1414
}
1515

1616
extern "C" __declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSize)
1717
{
1818
size_t len = strlen(szDevicePath);
19-
DynBuf newDevicePathBuf((len+1)*sizeof(wchar_t));
19+
DynBuf newDevicePathBuf((len + 1)*sizeof(wchar_t));
2020
wchar_t* newDevicePath = (wchar_t*)newDevicePathBuf.GetPtr();
21-
*newDevicePath=L'\0';
22-
if(MultiByteToWideChar(CP_ACP, NULL, szDevicePath, -1, newDevicePath, (int)len+1))
21+
*newDevicePath = L'\0';
22+
if(MultiByteToWideChar(CP_ACP, NULL, szDevicePath, -1, newDevicePath, (int)len + 1))
2323
{
24-
DynBuf newPathBuf(nSize*sizeof(wchar_t));
24+
DynBuf newPathBuf(nSize * sizeof(wchar_t));
2525
wchar_t* newPath = (wchar_t*)newPathBuf.GetPtr();
26-
if(!DevicePathToPathW(newDevicePath, newPath, nSize*sizeof(wchar_t)))
26+
if(!DevicePathToPathW(newDevicePath, newPath, nSize * sizeof(wchar_t)))
2727
return false;
28-
if(!WideCharToMultiByte(CP_ACP, NULL, newPath, -1, szPath, (int)wcslen(newPath)+1, NULL, NULL))
28+
if(!WideCharToMultiByte(CP_ACP, NULL, newPath, -1, szPath, (int)wcslen(newPath) + 1, NULL, NULL))
2929
return false;
3030
}
3131
return true;
@@ -35,18 +35,18 @@ __declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDe
3535
{
3636
NativeWinApi::initialize();
3737
ULONG ReturnLength;
38-
bool bRet=false;
39-
if(NativeWinApi::NtQueryObject(hFile, ObjectNameInformation, 0, 0, &ReturnLength)==STATUS_INFO_LENGTH_MISMATCH)
38+
bool bRet = false;
39+
if(NativeWinApi::NtQueryObject(hFile, ObjectNameInformation, 0, 0, &ReturnLength) == STATUS_INFO_LENGTH_MISMATCH)
4040
{
41-
ReturnLength+=0x2000; //on Windows XP SP3 ReturnLength will not be set just add some buffer space to fix this
42-
POBJECT_NAME_INFORMATION NameInformation=(POBJECT_NAME_INFORMATION)GlobalAlloc(0, ReturnLength);
43-
if(NativeWinApi::NtQueryObject(hFile, ObjectNameInformation, NameInformation, ReturnLength, 0)==STATUS_SUCCESS)
41+
ReturnLength += 0x2000; //on Windows XP SP3 ReturnLength will not be set just add some buffer space to fix this
42+
POBJECT_NAME_INFORMATION NameInformation = (POBJECT_NAME_INFORMATION)GlobalAlloc(0, ReturnLength);
43+
if(NativeWinApi::NtQueryObject(hFile, ObjectNameInformation, NameInformation, ReturnLength, 0) == STATUS_SUCCESS)
4444
{
45-
NameInformation->Name.Buffer[NameInformation->Name.Length/2]=L'\0'; //null-terminate the UNICODE_STRING
46-
if(wcslen(NameInformation->Name.Buffer)<nSize)
45+
NameInformation->Name.Buffer[NameInformation->Name.Length / 2] = L'\0'; //null-terminate the UNICODE_STRING
46+
if(wcslen(NameInformation->Name.Buffer) < nSize)
4747
{
48-
wcscpy_s(szDevicePath, nSize/sizeof(wchar_t), NameInformation->Name.Buffer);
49-
bRet=true;
48+
wcscpy_s(szDevicePath, nSize / sizeof(wchar_t), NameInformation->Name.Buffer);
49+
bRet = true;
5050
}
5151
}
5252
GlobalFree(NameInformation);
@@ -66,52 +66,52 @@ __declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDe
6666

6767
__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSize)
6868
{
69-
DynBuf newDevicePathBuf(nSize*sizeof(wchar_t));
69+
DynBuf newDevicePathBuf(nSize * sizeof(wchar_t));
7070
wchar_t* newDevicePath = (wchar_t*)newDevicePathBuf.GetPtr();
71-
if(!DevicePathFromFileHandleW(hFile, newDevicePath, nSize*sizeof(wchar_t)))
71+
if(!DevicePathFromFileHandleW(hFile, newDevicePath, nSize * sizeof(wchar_t)))
7272
return false;
73-
if(!WideCharToMultiByte(CP_ACP, NULL, newDevicePath, -1, szDevicePath, (int)wcslen(newDevicePath)+1, NULL, NULL))
73+
if(!WideCharToMultiByte(CP_ACP, NULL, newDevicePath, -1, szDevicePath, (int)wcslen(newDevicePath) + 1, NULL, NULL))
7474
return false;
7575
return true;
7676
}
7777

7878
__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSize)
7979
{
80-
typedef DWORD (WINAPI* GETFINALPATHNAMEBYHANDLEW) (
80+
typedef DWORD (WINAPI * GETFINALPATHNAMEBYHANDLEW)(
8181
IN HANDLE hFile,
8282
OUT wchar_t* lpszFilePath,
8383
IN DWORD cchFilePath,
8484
IN DWORD dwFlags
85-
);
86-
static GETFINALPATHNAMEBYHANDLEW GetFPNBHW=(GETFINALPATHNAMEBYHANDLEW)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetFinalPathNameByHandleW");
87-
if(GetFPNBHW && GetFPNBHW(hFile, szPath, (DWORD)(nSize/sizeof(wchar_t)), 0))
85+
);
86+
static GETFINALPATHNAMEBYHANDLEW GetFPNBHW = (GETFINALPATHNAMEBYHANDLEW)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetFinalPathNameByHandleW");
87+
if(GetFPNBHW && GetFPNBHW(hFile, szPath, (DWORD)(nSize / sizeof(wchar_t)), 0))
8888
{
8989
if(_wcsnicmp(szPath, L"\\\\?\\UNC\\", 8) == 0) // Server path
9090
{
9191
wcscpy_s(szPath, nSize / sizeof(wchar_t), L"\\\\");
9292
wcscat_s(szPath, nSize / sizeof(wchar_t), &szPath[8]);
9393
}
94-
else if(_wcsnicmp(szPath, L"\\\\?\\", 4) == 0 && szPath[5]==L':') // Drive path
94+
else if(_wcsnicmp(szPath, L"\\\\?\\", 4) == 0 && szPath[5] == L':') // Drive path
9595
{
96-
wcscpy_s(szPath, nSize/sizeof(wchar_t), &szPath[4]);
96+
wcscpy_s(szPath, nSize / sizeof(wchar_t), &szPath[4]);
9797
}
9898
return true;
9999
}
100100
if(!DevicePathFromFileHandleW(hFile, szPath, nSize))
101101
return false;
102102
std::wstring oldPath(szPath);
103-
if (!DevicePathToPathW(szPath, szPath, nSize))
103+
if(!DevicePathToPathW(szPath, szPath, nSize))
104104
wcscpy_s(szPath, nSize / sizeof(wchar_t), oldPath.c_str());
105105
return true;
106106
}
107107

108108
__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSize)
109109
{
110-
DynBuf newDevicePathBuf(nSize*sizeof(wchar_t));
110+
DynBuf newDevicePathBuf(nSize * sizeof(wchar_t));
111111
wchar_t* newDevicePath = (wchar_t*)newDevicePathBuf.GetPtr();
112-
if (!PathFromFileHandleW(hFile, newDevicePath, nSize*sizeof(wchar_t)))
112+
if(!PathFromFileHandleW(hFile, newDevicePath, nSize * sizeof(wchar_t)))
113113
return false;
114-
if (!WideCharToMultiByte(CP_ACP, NULL, newDevicePath, -1, szPath, (int)wcslen(newDevicePath) + 1, NULL, NULL))
114+
if(!WideCharToMultiByte(CP_ACP, NULL, newDevicePath, -1, szPath, (int)wcslen(newDevicePath) + 1, NULL, NULL))
115115
return false;
116116
return true;
117117
}

‎DeviceNameResolverInternal.cpp

+8-8
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ void DeviceNameResolver::initDeviceNameList()
2222

2323
deviceNameList.reserve(3);
2424

25-
for ( TCHAR shortD = TEXT('a'); shortD <= TEXT('z'); shortD++ )
25+
for(TCHAR shortD = TEXT('a'); shortD <= TEXT('z'); shortD++)
2626
{
2727
shortName[0] = shortD;
28-
if (QueryDosDevice( shortName, longName, MAX_PATH ) > 0)
28+
if(QueryDosDevice(shortName, longName, MAX_PATH) > 0)
2929
{
3030
hardDisk.shortName[0] = _totupper(shortD);
3131
hardDisk.shortName[1] = TEXT(':');
@@ -41,11 +41,11 @@ void DeviceNameResolver::initDeviceNameList()
4141
fixVirtualDevices();
4242
}
4343

44-
bool DeviceNameResolver::resolveDeviceLongNameToShort(const TCHAR * sourcePath, TCHAR * targetPath)
44+
bool DeviceNameResolver::resolveDeviceLongNameToShort(const TCHAR* sourcePath, TCHAR* targetPath)
4545
{
46-
for (unsigned int i = 0; i < deviceNameList.size(); i++)
46+
for(unsigned int i = 0; i < deviceNameList.size(); i++)
4747
{
48-
if (!_tcsnicmp(deviceNameList.at(i).longName, sourcePath, deviceNameList.at(i).longNameLength) && sourcePath[deviceNameList.at(i).longNameLength]==TEXT('\\'))
48+
if(!_tcsnicmp(deviceNameList.at(i).longName, sourcePath, deviceNameList.at(i).longNameLength) && sourcePath[deviceNameList.at(i).longNameLength] == TEXT('\\'))
4949
{
5050
_tcscpy_s(targetPath, MAX_PATH, deviceNameList.at(i).shortName);
5151
_tcscat_s(targetPath, MAX_PATH, sourcePath + deviceNameList.at(i).longNameLength);
@@ -67,10 +67,10 @@ void DeviceNameResolver::fixVirtualDevices()
6767
HardDisk hardDisk;
6868

6969
unicodeOutput.Buffer = (PWSTR)malloc(BufferSize);
70-
if (!unicodeOutput.Buffer)
70+
if(!unicodeOutput.Buffer)
7171
return;
7272

73-
for (unsigned int i = 0; i < deviceNameList.size(); i++)
73+
for(unsigned int i = 0; i < deviceNameList.size(); i++)
7474
{
7575
wcscpy_s(longCopy, deviceNameList.at(i).longName);
7676

@@ -83,7 +83,7 @@ void DeviceNameResolver::fixVirtualDevices()
8383
unicodeOutput.MaximumLength = unicodeOutput.Length;
8484
ZeroMemory(unicodeOutput.Buffer, unicodeOutput.Length);
8585

86-
if (NT_SUCCESS(NativeWinApi::NtQuerySymbolicLinkObject(hFile, &unicodeOutput, &retLen)))
86+
if(NT_SUCCESS(NativeWinApi::NtQuerySymbolicLinkObject(hFile, &unicodeOutput, &retLen)))
8787
{
8888
hardDisk.longNameLength = wcslen(unicodeOutput.Buffer);
8989
wcscpy_s(hardDisk.shortName, deviceNameList.at(i).shortName);

‎DeviceNameResolverInternal.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ class DeviceNameResolver
2020
public:
2121
DeviceNameResolver();
2222
~DeviceNameResolver();
23-
bool resolveDeviceLongNameToShort(const TCHAR * sourcePath, TCHAR * targetPath);
23+
bool resolveDeviceLongNameToShort(const TCHAR* sourcePath, TCHAR* targetPath);
2424
private:
2525
std::vector<HardDisk> deviceNameList;
2626

‎DynBuf.h

+6-6
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,15 @@ A basic dynamic buffer, exception free.
99
class DynBuf
1010
{
1111
public:
12-
DynBuf(size_t sz=0)
12+
DynBuf(size_t sz = 0)
1313
{
1414
Allocate(sz);
1515
}
1616
typedef std::vector<char> DynBufVec;
1717

1818
void* Allocate(size_t sz)
1919
{
20-
void* r=NULL;
20+
void* r = NULL;
2121
try
2222
{
2323
if(Size() < sz)
@@ -43,11 +43,11 @@ class DynBuf
4343
{
4444
mem.clear();
4545
}
46-
DynBufVec& GetVector()
46+
DynBufVec & GetVector()
4747
{
4848
return mem;
4949
}
50-
const DynBufVec& GetVector() const
50+
const DynBufVec & GetVector() const
5151
{
5252
return mem;
5353
}
@@ -58,11 +58,11 @@ class DynBuf
5858

5959

6060
protected:
61-
char& operator[](std::size_t idx)
61+
char & operator[](std::size_t idx)
6262
{
6363
return mem[idx];
6464
};
65-
const char& operator[](std::size_t idx) const
65+
const char & operator[](std::size_t idx) const
6666
{
6767
return mem[idx];
6868
};

‎NativeWinApi.cpp

+3-3
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,14 @@ def_NtClose NativeWinApi::NtClose = 0;
2424

2525
void NativeWinApi::initialize()
2626
{
27-
if (RtlNtStatusToDosError)
27+
if(RtlNtStatusToDosError)
2828
{
2929
return;
3030
}
3131

3232
HMODULE hModuleNtdll = GetModuleHandle(L"ntdll.dll");
3333

34-
if (!hModuleNtdll)
34+
if(!hModuleNtdll)
3535
{
3636
return;
3737
}
@@ -69,7 +69,7 @@ PPEB NativeWinApi::getProcessEnvironmentBlockAddress(HANDLE processHandle)
6969
ULONG lReturnLength = 0;
7070
PROCESS_BASIC_INFORMATION processBasicInformation;
7171

72-
if ((NtQueryInformationProcess(processHandle,ProcessBasicInformation,&processBasicInformation,sizeof(PROCESS_BASIC_INFORMATION),&lReturnLength) >= 0) && (lReturnLength == sizeof(PROCESS_BASIC_INFORMATION)))
72+
if((NtQueryInformationProcess(processHandle, ProcessBasicInformation, &processBasicInformation, sizeof(PROCESS_BASIC_INFORMATION), &lReturnLength) >= 0) && (lReturnLength == sizeof(PROCESS_BASIC_INFORMATION)))
7373
{
7474
//printf("NtQueryInformationProcess success %d\n",sizeof(PROCESS_BASIC_INFORMATION));
7575

‎NativeWinApi.h

+32-32
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ typedef struct _FILE_NAME_INFORMATION // Information Classes 9 and 21
7878

7979
typedef enum _FILE_INFORMATION_CLASS
8080
{
81-
FileNameInformation=9,
81+
FileNameInformation = 9,
8282
} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
8383

8484
typedef struct _UNICODE_STRING
@@ -96,12 +96,12 @@ typedef struct _CLIENT_ID
9696

9797
#define InitializeObjectAttributes(p,n,a,r,s) \
9898
{ \
99-
(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
100-
(p)->ObjectName = n; \
101-
(p)->Attributes = a; \
102-
(p)->RootDirectory = r; \
103-
(p)->SecurityDescriptor = s; \
104-
(p)->SecurityQualityOfService = NULL; \
99+
(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
100+
(p)->ObjectName = n; \
101+
(p)->Attributes = a; \
102+
(p)->RootDirectory = r; \
103+
(p)->SecurityDescriptor = s; \
104+
(p)->SecurityQualityOfService = NULL; \
105105
}
106106

107107
typedef struct _OBJECT_ATTRIBUTES
@@ -241,7 +241,7 @@ typedef struct _PEB
241241
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
242242
BYTE Reserved4[104];
243243
PVOID Reserved5[52];
244-
PVOID PostProcessInitRoutine;
244+
PVOID PostProcessInitRoutine;
245245
BYTE Reserved6[128];
246246
PVOID Reserved7[1];
247247
ULONG SessionId;
@@ -259,13 +259,13 @@ typedef struct _PROCESS_BASIC_INFORMATION
259259

260260
typedef struct _MEMORY_WORKING_SET_LIST
261261
{
262-
ULONG NumberOfPages;
263-
ULONG WorkingSetList[1];
262+
ULONG NumberOfPages;
263+
ULONG WorkingSetList[1];
264264
} MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;
265265

266266
typedef struct _MEMORY_SECTION_NAME
267267
{
268-
UNICODE_STRING SectionFileName;
268+
UNICODE_STRING SectionFileName;
269269
} MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
270270

271271
typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
@@ -439,27 +439,27 @@ typedef PEB32 PEB_CURRENT;
439439
#pragma pack(pop)
440440

441441

442-
typedef NTSTATUS (WINAPI *def_NtTerminateProcess)(HANDLE ProcessHandle, NTSTATUS ExitStatus);
443-
typedef NTSTATUS (WINAPI *def_NtQueryObject)(HANDLE Handle,OBJECT_INFORMATION_CLASS ObjectInformationClass,PVOID ObjectInformation,ULONG ObjectInformationLength,PULONG ReturnLength);
444-
typedef NTSTATUS (WINAPI *def_NtDuplicateObject)(HANDLE SourceProcessHandle, HANDLE SourceHandle, HANDLE TargetProcessHandle, PHANDLE TargetHandle, ACCESS_MASK DesiredAccess, BOOLEAN InheritHandle, ULONG Options );
445-
typedef NTSTATUS (WINAPI *def_NtQueryInformationFile)(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);
446-
typedef NTSTATUS (WINAPI *def_NtQueryInformationThread)(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength,PULONG ReturnLength);
447-
typedef NTSTATUS (WINAPI *def_NtQueryInformationProcess)(HANDLE ProcessHandle,PROCESSINFOCLASS ProcessInformationClass,PVOID ProcessInformation,ULONG ProcessInformationLength,PULONG ReturnLength);
448-
typedef NTSTATUS (WINAPI *def_NtQuerySystemInformation)(SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength, PULONG ReturnLength);
449-
typedef NTSTATUS (WINAPI *def_NtQueryVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, MEMORY_INFORMATION_CLASS MemoryInformationClass, PVOID Buffer, SIZE_T MemoryInformationLength, PSIZE_T ReturnLength);
450-
typedef NTSTATUS (WINAPI *def_NtOpenProcess)(PHANDLE ProcessHandle, ACCESS_MASK AccessMask, PVOID ObjectAttributes, PCLIENT_ID ClientId );
451-
typedef NTSTATUS (WINAPI *def_NtOpenThread)(PHANDLE ThreadHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,PCLIENT_ID ClientId);
452-
typedef NTSTATUS (WINAPI *def_NtResumeThread)(HANDLE ThreadHandle, PULONG SuspendCount);
453-
typedef NTSTATUS (WINAPI *def_NtSetInformationThread)(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
454-
typedef NTSTATUS (WINAPI *def_NtCreateThreadEx)(PHANDLE hThread,ACCESS_MASK DesiredAccess,LPVOID ObjectAttributes,HANDLE ProcessHandle,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter,int CreateFlags,ULONG StackZeroBits,LPVOID SizeOfStackCommit,LPVOID SizeOfStackReserve,LPVOID lpBytesBuffer);
455-
typedef NTSTATUS (WINAPI *def_NtSuspendProcess)(HANDLE ProcessHandle);
456-
typedef NTSTATUS (WINAPI *def_NtResumeProcess)(HANDLE ProcessHandle);
457-
458-
typedef NTSTATUS (WINAPI *def_NtOpenSymbolicLinkObject)(PHANDLE LinkHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes);
459-
typedef NTSTATUS (WINAPI *def_NtQuerySymbolicLinkObject)(HANDLE LinkHandle,PUNICODE_STRING LinkTarget,PULONG ReturnedLength);
460-
461-
typedef ULONG (WINAPI *def_RtlNtStatusToDosError)(NTSTATUS Status);
462-
typedef NTSTATUS (WINAPI *def_NtClose)(HANDLE Handle);
442+
typedef NTSTATUS(WINAPI* def_NtTerminateProcess)(HANDLE ProcessHandle, NTSTATUS ExitStatus);
443+
typedef NTSTATUS(WINAPI* def_NtQueryObject)(HANDLE Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass, PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength);
444+
typedef NTSTATUS(WINAPI* def_NtDuplicateObject)(HANDLE SourceProcessHandle, HANDLE SourceHandle, HANDLE TargetProcessHandle, PHANDLE TargetHandle, ACCESS_MASK DesiredAccess, BOOLEAN InheritHandle, ULONG Options);
445+
typedef NTSTATUS(WINAPI* def_NtQueryInformationFile)(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);
446+
typedef NTSTATUS(WINAPI* def_NtQueryInformationThread)(HANDLE ThreadHandle, THREADINFOCLASS ThreadInformationClass, PVOID ThreadInformation, ULONG ThreadInformationLength, PULONG ReturnLength);
447+
typedef NTSTATUS(WINAPI* def_NtQueryInformationProcess)(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);
448+
typedef NTSTATUS(WINAPI* def_NtQuerySystemInformation)(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
449+
typedef NTSTATUS(WINAPI* def_NtQueryVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, MEMORY_INFORMATION_CLASS MemoryInformationClass, PVOID Buffer, SIZE_T MemoryInformationLength, PSIZE_T ReturnLength);
450+
typedef NTSTATUS(WINAPI* def_NtOpenProcess)(PHANDLE ProcessHandle, ACCESS_MASK AccessMask, PVOID ObjectAttributes, PCLIENT_ID ClientId);
451+
typedef NTSTATUS(WINAPI* def_NtOpenThread)(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
452+
typedef NTSTATUS(WINAPI* def_NtResumeThread)(HANDLE ThreadHandle, PULONG SuspendCount);
453+
typedef NTSTATUS(WINAPI* def_NtSetInformationThread)(HANDLE ThreadHandle, THREADINFOCLASS ThreadInformationClass, PVOID ThreadInformation, ULONG ThreadInformationLength);
454+
typedef NTSTATUS(WINAPI* def_NtCreateThreadEx)(PHANDLE hThread, ACCESS_MASK DesiredAccess, LPVOID ObjectAttributes, HANDLE ProcessHandle, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, int CreateFlags, ULONG StackZeroBits, LPVOID SizeOfStackCommit, LPVOID SizeOfStackReserve, LPVOID lpBytesBuffer);
455+
typedef NTSTATUS(WINAPI* def_NtSuspendProcess)(HANDLE ProcessHandle);
456+
typedef NTSTATUS(WINAPI* def_NtResumeProcess)(HANDLE ProcessHandle);
457+
458+
typedef NTSTATUS(WINAPI* def_NtOpenSymbolicLinkObject)(PHANDLE LinkHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes);
459+
typedef NTSTATUS(WINAPI* def_NtQuerySymbolicLinkObject)(HANDLE LinkHandle, PUNICODE_STRING LinkTarget, PULONG ReturnedLength);
460+
461+
typedef ULONG(WINAPI* def_RtlNtStatusToDosError)(NTSTATUS Status);
462+
typedef NTSTATUS(WINAPI* def_NtClose)(HANDLE Handle);
463463

464464
//Flags from waliedassar
465465
#define NtCreateThreadExFlagCreateSuspended 0x1

0 commit comments

Comments
 (0)
Please sign in to comment.