/* * File: WinApiResolver.h * Authors: Max Hirschberger & Ogulcan Ugur */ #ifndef WINAPIRESOLVER_H #define WINAPIRESOLVER_H #include #include "imports.h" typedef NTSTATUS(WINAPI* NtQueryInformationProcess_t)( HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG); typedef NTSTATUS(NTAPI* NtProtectVirtualMemory_t)( HANDLE, PVOID, PSIZE_T, ULONG, PULONG); typedef NTSTATUS(NTAPI* NtReadVirtualMemoryEx_t)( HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead, ULONG Flags ); typedef NTSTATUS(NTAPI* NtSetContextThread_t)( HANDLE ThreadHandle, PCONTEXT ThreadContext ); typedef NTSTATUS(NTAPI* NtGetContextThread_t)( HANDLE ThreadHandle, PCONTEXT ThreadContext ); typedef NTSTATUS(NTAPI* NtTerminateProcess_t)( _In_opt_ HANDLE ProcessHandle, _In_ NTSTATUS ExitStatus ); typedef NTSTATUS(NTAPI* NtSuspendThread_t)( _In_ HANDLE ThreadHandle, _Out_opt_ PULONG PreviousSuspendCount ); typedef NTSTATUS(NTAPI* LdrControlFlowGuardEnforced_t)( VOID ); typedef HMODULE(*LoadLibraryA_t)( LPCSTR lpLibFileName ); typedef LPVOID(*VirtualAlloc_t)( LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect ); typedef BOOL(*VirtualProtect_t)( LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect ); typedef int (*MessageBoxA_t)( HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType ); class WinApiResolver { public: static WinApiResolver& GetInstance(); // NTDLL.DLL NtQueryInformationProcess_t NtQueryInformationProcess; NtProtectVirtualMemory_t NtProtectVirtualMemory; NtReadVirtualMemoryEx_t NtReadVirtualMemoryEx; NtSetContextThread_t NtSetContextThread; NtGetContextThread_t NtGetContextThread; NtTerminateProcess_t NtTerminateProcess; NtSuspendThread_t NtSuspendThread; LdrControlFlowGuardEnforced_t LdrControlFlowGuardEnforced; // KERNEL32.DLL LoadLibraryA_t LoadLibraryA; VirtualAlloc_t VirtualAlloc; VirtualProtect_t VirtualProtect; // USER32.DLL MessageBoxA_t MessageBoxA; private: static WinApiResolver* m_instance; WinApiResolver(); void ResolveAPIs(); }; #endif // WINAPIRESOLVER_H