mirror of
https://github.com/Orange-Cyberdefense/p3-loader
synced 2026-07-08 17:02:48 +00:00
Zero2504
115 lines
2.3 KiB
C++
115 lines
2.3 KiB
C++
/*
|
|
* File: WinApiResolver.h
|
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
|
*/
|
|
|
|
#ifndef WINAPIRESOLVER_H
|
|
#define WINAPIRESOLVER_H
|
|
|
|
#include <Windows.h>
|
|
#include "imports.h"
|
|
|
|
|
|
typedef NTSTATUS(WINAPI* NtQueryInformationProcess_t)(
|
|
HANDLE,
|
|
PROCESSINFOCLASS,
|
|
PVOID,
|
|
ULONG,
|
|
PULONG);
|
|
|
|
typedef NTSTATUS(NTAPI* NtProtectVirtualMemory_t)(
|
|
HANDLE,
|
|
PVOID,
|
|
PSIZE_T,
|
|
ULONG,
|
|
PULONG);
|
|
|
|
typedef NTSTATUS(NTAPI* NtReadVirtualMemoryEx_t)(
|
|
HANDLE ProcessHandle,
|
|
PVOID BaseAddress,
|
|
PVOID Buffer,
|
|
SIZE_T NumberOfBytesToRead,
|
|
PSIZE_T NumberOfBytesRead,
|
|
ULONG Flags
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI* NtSetContextThread_t)(
|
|
HANDLE ThreadHandle,
|
|
PCONTEXT ThreadContext
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI* NtGetContextThread_t)(
|
|
HANDLE ThreadHandle,
|
|
PCONTEXT ThreadContext
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI* NtTerminateProcess_t)(
|
|
_In_opt_ HANDLE ProcessHandle,
|
|
_In_ NTSTATUS ExitStatus
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI* NtSuspendThread_t)(
|
|
_In_ HANDLE ThreadHandle,
|
|
_Out_opt_ PULONG PreviousSuspendCount
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI* LdrControlFlowGuardEnforced_t)(
|
|
VOID
|
|
);
|
|
|
|
typedef HMODULE(*LoadLibraryA_t)(
|
|
LPCSTR lpLibFileName
|
|
);
|
|
|
|
typedef LPVOID(*VirtualAlloc_t)(
|
|
LPVOID lpAddress,
|
|
SIZE_T dwSize,
|
|
DWORD flAllocationType,
|
|
DWORD flProtect
|
|
);
|
|
|
|
typedef BOOL(*VirtualProtect_t)(
|
|
LPVOID lpAddress,
|
|
SIZE_T dwSize,
|
|
DWORD flNewProtect,
|
|
PDWORD lpflOldProtect
|
|
);
|
|
|
|
typedef int (*MessageBoxA_t)(
|
|
HWND hWnd,
|
|
LPCSTR lpText,
|
|
LPCSTR lpCaption,
|
|
UINT uType
|
|
);
|
|
|
|
class WinApiResolver {
|
|
|
|
public:
|
|
static WinApiResolver& GetInstance();
|
|
|
|
// NTDLL.DLL
|
|
NtQueryInformationProcess_t NtQueryInformationProcess;
|
|
NtProtectVirtualMemory_t NtProtectVirtualMemory;
|
|
NtReadVirtualMemoryEx_t NtReadVirtualMemoryEx;
|
|
NtSetContextThread_t NtSetContextThread;
|
|
NtGetContextThread_t NtGetContextThread;
|
|
NtTerminateProcess_t NtTerminateProcess;
|
|
NtSuspendThread_t NtSuspendThread;
|
|
LdrControlFlowGuardEnforced_t LdrControlFlowGuardEnforced;
|
|
|
|
// KERNEL32.DLL
|
|
LoadLibraryA_t LoadLibraryA;
|
|
VirtualAlloc_t VirtualAlloc;
|
|
VirtualProtect_t VirtualProtect;
|
|
|
|
// USER32.DLL
|
|
MessageBoxA_t MessageBoxA;
|
|
private:
|
|
static WinApiResolver* m_instance;
|
|
|
|
WinApiResolver();
|
|
|
|
void ResolveAPIs();
|
|
};
|
|
|
|
#endif // WINAPIRESOLVER_H
|