mirror of
https://github.com/Friends-Security/RedirectThread
synced 2026-06-06 15:44:29 +00:00
YS
62 lines
2.7 KiB
C++
62 lines
2.7 KiB
C++
#include "NativeAPI.h"
|
|
#include <iostream> // For std::cerr/std::cout
|
|
|
|
// Initialize global function pointers
|
|
NtCreateThread_t pNtCreateThread = nullptr;
|
|
NtQueueApcThread_t pNtQueueApcThread = nullptr;
|
|
NtQueueApcThreadEx_t pNtQueueApcThreadEx = nullptr;
|
|
NtQueueApcThreadEx2_t pNtQueueApcThreadEx2 = nullptr;
|
|
QueueUserAPC2_t pQueueUserAPC2 = nullptr;
|
|
NtQueryInformationThread_t pNtQueryInformationThread = nullptr;
|
|
NtQuerySystemInformation_t pNtQuerySystemInformation = nullptr;
|
|
|
|
bool LoadNativeAPIs()
|
|
{
|
|
HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
|
|
HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
|
|
if (!hNtdll || !hKernel32)
|
|
{
|
|
std::cerr << "[!] Failed to get module handle for ntdll.dll or kernel32.dll. Error: " << GetLastError() << std::endl;
|
|
return false;
|
|
}
|
|
|
|
// Load NtCreateThread
|
|
pNtCreateThread = (NtCreateThread_t)GetProcAddress(hNtdll, "NtCreateThread");
|
|
if (!pNtCreateThread)
|
|
{
|
|
std::cerr << "[!] Failed to get address for NtCreateThread function." << std::endl;
|
|
}
|
|
|
|
// Load NtQueueApcThread functions
|
|
pNtQueueApcThread = (NtQueueApcThread_t)GetProcAddress(hNtdll, "NtQueueApcThread");
|
|
pNtQueueApcThreadEx = (NtQueueApcThreadEx_t)GetProcAddress(hNtdll, "NtQueueApcThreadEx");
|
|
pNtQueueApcThreadEx2 = (NtQueueApcThreadEx2_t)GetProcAddress(hNtdll, "NtQueueApcThreadEx2");
|
|
pQueueUserAPC2 = (QueueUserAPC2_t)GetProcAddress(hKernel32, "QueueUserAPC2");
|
|
pNtQueryInformationThread = (NtQueryInformationThread_t)GetProcAddress(hNtdll, "NtQueryInformationThread");
|
|
pNtQuerySystemInformation = (NtQuerySystemInformation_t)GetProcAddress(hNtdll, "NtQuerySystemInformation");
|
|
// pRtlFillMemory = (RtlFillMemory_t)GetProcAddress(hNtdll, "RtlFillMemory");
|
|
|
|
if (!pNtQueueApcThread || !pNtQueueApcThreadEx || !pNtQueueApcThreadEx2 || !pNtQueryInformationThread)
|
|
{
|
|
std::cerr << "[!] Failed to get address for one or more NtQueueApcThread* functions." << std::endl;
|
|
if (!pNtQueueApcThread)
|
|
std::cerr << " - NtQueueApcThread not found.\n";
|
|
if (!pNtQueueApcThreadEx)
|
|
std::cerr << " - NtQueueApcThreadEx not found.\n";
|
|
if (!pNtQueueApcThreadEx2)
|
|
std::cerr << " - NtQueueApcThreadEx2 not found.\n";
|
|
if (!pNtQueryInformationThread)
|
|
std::cerr << " - NtQueryInformationThread not found.\n";
|
|
if (!pNtQuerySystemInformation)
|
|
std::cerr << " - NtQuerySystemInformation not found.\n";
|
|
// if (!pRtlFillMemory) std::cerr << " - RtlFillMemory not found.\n";
|
|
}
|
|
|
|
if (!pQueueUserAPC2)
|
|
{
|
|
std::cout << "[*] Note: kernel32!QueueUserAPC2 not found (requires Win10 build 1809+). Option --method queueuserapc2 unavailable." << std::endl;
|
|
}
|
|
|
|
return true;
|
|
}
|