mirror of
https://github.com/PowerShellMafia/PowerSploit
synced 2026-06-08 12:13:33 +00:00
Silly me. Just discovered the SetOffset method.
Thanks @JosephBialek!
This commit is contained in:
Matt Graeber
@@ -151,8 +151,6 @@
|
||||
$FlagsConstructor = [FlagsAttribute].GetConstructor(@())
|
||||
$FlagsCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($FlagsConstructor, @())
|
||||
|
||||
$FieldOffsetConstructor = [Runtime.InteropServices.FieldOffsetAttribute].GetConstructor([Int])
|
||||
|
||||
$MarshalAsConstructor = [Runtime.InteropServices.MarshalAsAttribute].GetConstructor([Runtime.InteropServices.UnmanagedType])
|
||||
$SizeConst = [Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst')
|
||||
|
||||
@@ -345,22 +343,22 @@
|
||||
$TypeBuilder = $ModuleBuilder.DefineType('_UNICODE_STRING', $StructAttributes, [ValueType], 2, 16)
|
||||
$TypeBuilder.SetCustomAttribute($StructLayoutCustomAttribute)
|
||||
|
||||
$TypeBuilder.DefineField('Length', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0))))
|
||||
$TypeBuilder.DefineField('MaximumLength', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(2))))
|
||||
$TypeBuilder.DefineField('Length', [UInt16], 'Public').SetOffset(0)
|
||||
$TypeBuilder.DefineField('MaximumLength', [UInt16], 'Public').SetOffset(2)
|
||||
$BufferField = $TypeBuilder.DefineField('Buffer', [String], 'Public, HasFieldMarshal')
|
||||
$BufferField.SetCustomAttribute($MarshalAsCustomAttribute)
|
||||
$BufferField.SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(8))))
|
||||
$BufferField.SetOffset(8)
|
||||
}
|
||||
else
|
||||
{
|
||||
$TypeBuilder = $ModuleBuilder.DefineType('_UNICODE_STRING', $StructAttributes, [ValueType], 2, 8)
|
||||
$TypeBuilder.SetCustomAttribute($StructLayoutCustomAttribute)
|
||||
|
||||
$TypeBuilder.DefineField('Length', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0))))
|
||||
$TypeBuilder.DefineField('MaximumLength', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(2))))
|
||||
$TypeBuilder.DefineField('Length', [UInt16], 'Public').SetOffset(0)
|
||||
$TypeBuilder.DefineField('MaximumLength', [UInt16], 'Public').SetOffset(2)
|
||||
$BufferField = $TypeBuilder.DefineField('Buffer', [String], 'Public, HasFieldMarshal')
|
||||
$BufferField.SetCustomAttribute($MarshalAsCustomAttribute)
|
||||
$BufferField.SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(4))))
|
||||
$BufferField.SetOffset(4)
|
||||
}
|
||||
|
||||
$UnicodeStringClass = $TypeBuilder.CreateType()
|
||||
@@ -439,29 +437,29 @@
|
||||
|
||||
if ([IntPtr]::Size -eq 8)
|
||||
{
|
||||
$TypeBuilder.DefineField('Address', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0))))
|
||||
$TypeBuilder.DefineField('Type', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(8))))
|
||||
$TypeBuilder.DefineField('Reserved1', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(10))))
|
||||
$TypeBuilder.DefineField('ExclusiveOwnerThreadId', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(16))))
|
||||
$TypeBuilder.DefineField('ActiveCount', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(24))))
|
||||
$TypeBuilder.DefineField('ContentionCount', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(28))))
|
||||
$TypeBuilder.DefineField('Reserved2', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(32))))
|
||||
$TypeBuilder.DefineField('Reserved3', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(36))))
|
||||
$TypeBuilder.DefineField('NumberOfSharedWaiters', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(40))))
|
||||
$TypeBuilder.DefineField('NumberOfExclusiveWaiters', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(44))))
|
||||
$TypeBuilder.DefineField('Address', [IntPtr], 'Public').SetOffset(0)
|
||||
$TypeBuilder.DefineField('Type', [UInt16], 'Public').SetOffset(8)
|
||||
$TypeBuilder.DefineField('Reserved1', [UInt16], 'Public').SetOffset(10)
|
||||
$TypeBuilder.DefineField('ExclusiveOwnerThreadId', [UInt32], 'Public').SetOffset(16)
|
||||
$TypeBuilder.DefineField('ActiveCount', [UInt32], 'Public').SetOffset(24)
|
||||
$TypeBuilder.DefineField('ContentionCount', [UInt32], 'Public').SetOffset(28)
|
||||
$TypeBuilder.DefineField('Reserved2', [UInt32], 'Public').SetOffset(32)
|
||||
$TypeBuilder.DefineField('Reserved3', [UInt32], 'Public').SetOffset(36)
|
||||
$TypeBuilder.DefineField('NumberOfSharedWaiters', [UInt32], 'Public').SetOffset(40)
|
||||
$TypeBuilder.DefineField('NumberOfExclusiveWaiters', [UInt32], 'Public').SetOffset(44)
|
||||
}
|
||||
else
|
||||
{
|
||||
$TypeBuilder.DefineField('Address', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0))))
|
||||
$TypeBuilder.DefineField('Type', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(4))))
|
||||
$TypeBuilder.DefineField('Reserved1', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(6))))
|
||||
$TypeBuilder.DefineField('ExclusiveOwnerThreadId', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(8))))
|
||||
$TypeBuilder.DefineField('ActiveCount', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(12))))
|
||||
$TypeBuilder.DefineField('ContentionCount', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(16))))
|
||||
$TypeBuilder.DefineField('Reserved2', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(20))))
|
||||
$TypeBuilder.DefineField('Reserved3', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(24))))
|
||||
$TypeBuilder.DefineField('NumberOfSharedWaiters', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(28))))
|
||||
$TypeBuilder.DefineField('NumberOfExclusiveWaiters', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(32))))
|
||||
$TypeBuilder.DefineField('Address', [IntPtr], 'Public').SetOffset(0)
|
||||
$TypeBuilder.DefineField('Type', [UInt16], 'Public').SetOffset(4)
|
||||
$TypeBuilder.DefineField('Reserved1', [UInt16], 'Public').SetOffset(6)
|
||||
$TypeBuilder.DefineField('ExclusiveOwnerThreadId', [UInt32], 'Public').SetOffset(8)
|
||||
$TypeBuilder.DefineField('ActiveCount', [UInt32], 'Public').SetOffset(12)
|
||||
$TypeBuilder.DefineField('ContentionCount', [UInt32], 'Public').SetOffset(16)
|
||||
$TypeBuilder.DefineField('Reserved2', [UInt32], 'Public').SetOffset(20)
|
||||
$TypeBuilder.DefineField('Reserved3', [UInt32], 'Public').SetOffset(24)
|
||||
$TypeBuilder.DefineField('NumberOfSharedWaiters', [UInt32], 'Public').SetOffset(28)
|
||||
$TypeBuilder.DefineField('NumberOfExclusiveWaiters', [UInt32], 'Public').SetOffset(32)
|
||||
}
|
||||
|
||||
$LockInfoClass = $TypeBuilder.CreateType()
|
||||
@@ -474,23 +472,23 @@
|
||||
|
||||
if ([IntPtr]::Size -eq 8)
|
||||
{
|
||||
$TypeBuilder.DefineField('TagValue', [UInt32], 'Public, HasFieldMarshal').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0))))
|
||||
$TypeBuilder.DefineField('PagedPoolAllocs', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(4))))
|
||||
$TypeBuilder.DefineField('PagedPoolFrees', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(8))))
|
||||
$TypeBuilder.DefineField('PagedPoolUsage', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(16))))
|
||||
$TypeBuilder.DefineField('NonPagedPoolAllocs', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(24))))
|
||||
$TypeBuilder.DefineField('NonPagedPoolFrees', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(28))))
|
||||
$TypeBuilder.DefineField('NonPagedPoolUsage', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(32))))
|
||||
$TypeBuilder.DefineField('TagValue', [UInt32], 'Public, HasFieldMarshal').SetOffset(0)
|
||||
$TypeBuilder.DefineField('PagedPoolAllocs', [UInt32], 'Public').SetOffset(4)
|
||||
$TypeBuilder.DefineField('PagedPoolFrees', [UInt32], 'Public').SetOffset(8)
|
||||
$TypeBuilder.DefineField('PagedPoolUsage', [UInt32], 'Public').SetOffset(16)
|
||||
$TypeBuilder.DefineField('NonPagedPoolAllocs', [UInt32], 'Public').SetOffset(24)
|
||||
$TypeBuilder.DefineField('NonPagedPoolFrees', [UInt32], 'Public').SetOffset(28)
|
||||
$TypeBuilder.DefineField('NonPagedPoolUsage', [UInt32], 'Public').SetOffset(32)
|
||||
}
|
||||
else
|
||||
{
|
||||
$TypeBuilder.DefineField('TagValue', [UInt32], 'Public, HasFieldMarshal').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0))))
|
||||
$TypeBuilder.DefineField('PagedPoolAllocs', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(4))))
|
||||
$TypeBuilder.DefineField('PagedPoolFrees', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(8))))
|
||||
$TypeBuilder.DefineField('PagedPoolUsage', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(12))))
|
||||
$TypeBuilder.DefineField('NonPagedPoolAllocs', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(16))))
|
||||
$TypeBuilder.DefineField('NonPagedPoolFrees', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(20))))
|
||||
$TypeBuilder.DefineField('NonPagedPoolUsage', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(24))))
|
||||
$TypeBuilder.DefineField('TagValue', [UInt32], 'Public, HasFieldMarshal').SetOffset(0)
|
||||
$TypeBuilder.DefineField('PagedPoolAllocs', [UInt32], 'Public').SetOffset(4)
|
||||
$TypeBuilder.DefineField('PagedPoolFrees', [UInt32], 'Public').SetOffset(8)
|
||||
$TypeBuilder.DefineField('PagedPoolUsage', [UInt32], 'Public').SetOffset(12)
|
||||
$TypeBuilder.DefineField('NonPagedPoolAllocs', [UInt32], 'Public').SetOffset(16)
|
||||
$TypeBuilder.DefineField('NonPagedPoolFrees', [UInt32], 'Public').SetOffset(20)
|
||||
$TypeBuilder.DefineField('NonPagedPoolUsage', [UInt32], 'Public').SetOffset(24)
|
||||
}
|
||||
|
||||
$PoolTagInfoClass = $TypeBuilder.CreateType()
|
||||
@@ -501,17 +499,17 @@
|
||||
$TypeBuilder = $ModuleBuilder.DefineType('_SYSTEM_OBJECTTYPE_INFORMATION', $StructAttributes, [ValueType], 1, $Size_SYSTEM_OBJECTTYPE_INFORMATION)
|
||||
$TypeBuilder.SetCustomAttribute($StructLayoutCustomAttribute)
|
||||
|
||||
$TypeBuilder.DefineField('NextEntryOffset', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x00))))
|
||||
$TypeBuilder.DefineField('NumberOfObjects', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x04))))
|
||||
$TypeBuilder.DefineField('NumberOfHandles', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x08))))
|
||||
$TypeBuilder.DefineField('TypeIndex', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x0C))))
|
||||
$TypeBuilder.DefineField('InvalidAttributes', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x10))))
|
||||
$TypeBuilder.DefineField('GenericMapping', $GenericMappingClass, 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x14))))
|
||||
$TypeBuilder.DefineField('ValidAccessMask', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x24))))
|
||||
$TypeBuilder.DefineField('PoolType', $PoolType, 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x28))))
|
||||
$TypeBuilder.DefineField('SecurityRequired', [Byte], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x2C))))
|
||||
$TypeBuilder.DefineField('WaitableObject', [Byte], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x2D))))
|
||||
$TypeBuilder.DefineField('TypeName', $UnicodeStringClass, 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x30))))
|
||||
$TypeBuilder.DefineField('NextEntryOffset', [UInt32], 'Public').SetOffset(0x00)
|
||||
$TypeBuilder.DefineField('NumberOfObjects', [UInt32], 'Public').SetOffset(0x04)
|
||||
$TypeBuilder.DefineField('NumberOfHandles', [UInt32], 'Public').SetOffset(0x08)
|
||||
$TypeBuilder.DefineField('TypeIndex', [UInt32], 'Public').SetOffset(0x0C)
|
||||
$TypeBuilder.DefineField('InvalidAttributes', [UInt32], 'Public').SetOffset(0x10)
|
||||
$TypeBuilder.DefineField('GenericMapping', $GenericMappingClass, 'Public').SetOffset(0x14)
|
||||
$TypeBuilder.DefineField('ValidAccessMask', [UInt32], 'Public').SetOffset(0x24)
|
||||
$TypeBuilder.DefineField('PoolType', $PoolType, 'Public').SetOffset(0x28)
|
||||
$TypeBuilder.DefineField('SecurityRequired', [Byte], 'Public').SetOffset(0x2C)
|
||||
$TypeBuilder.DefineField('WaitableObject', [Byte], 'Public').SetOffset(0x2D)
|
||||
$TypeBuilder.DefineField('TypeName', $UnicodeStringClass, 'Public').SetOffset(0x30)
|
||||
|
||||
$ObjectTypeClass = $TypeBuilder.CreateType()
|
||||
}
|
||||
@@ -523,33 +521,33 @@
|
||||
|
||||
if ([IntPtr]::Size -eq 8)
|
||||
{
|
||||
$TypeBuilder.DefineField('NextEntryOffset', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x00))))
|
||||
$TypeBuilder.DefineField('Object', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x08))))
|
||||
$TypeBuilder.DefineField('CreatorUniqueProcess', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x10))))
|
||||
$TypeBuilder.DefineField('CreatorBackTraceIndex', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x018))))
|
||||
$TypeBuilder.DefineField('Flags', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x1A))))
|
||||
$TypeBuilder.DefineField('PointerCount', [Int32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x1C))))
|
||||
$TypeBuilder.DefineField('HandleCount', [Int32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x20))))
|
||||
$TypeBuilder.DefineField('PagedPoolCharge', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x24))))
|
||||
$TypeBuilder.DefineField('NonPagedPoolCharge', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x28))))
|
||||
$TypeBuilder.DefineField('ExclusiveProcessId', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x30))))
|
||||
$TypeBuilder.DefineField('SecurityDescriptor', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x38))))
|
||||
$TypeBuilder.DefineField('NameInfo', $UnicodeStringClass, 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x40))))
|
||||
$TypeBuilder.DefineField('NextEntryOffset', [UInt32], 'Public').SetOffset(0x00)
|
||||
$TypeBuilder.DefineField('Object', [IntPtr], 'Public').SetOffset(0x08)
|
||||
$TypeBuilder.DefineField('CreatorUniqueProcess', [IntPtr], 'Public').SetOffset(0x10)
|
||||
$TypeBuilder.DefineField('CreatorBackTraceIndex', [UInt16], 'Public').SetOffset(0x018)
|
||||
$TypeBuilder.DefineField('Flags', [UInt16], 'Public').SetOffset(0x1A)
|
||||
$TypeBuilder.DefineField('PointerCount', [Int32], 'Public').SetOffset(0x1C)
|
||||
$TypeBuilder.DefineField('HandleCount', [Int32], 'Public').SetOffset(0x20)
|
||||
$TypeBuilder.DefineField('PagedPoolCharge', [UInt32], 'Public').SetOffset(0x24)
|
||||
$TypeBuilder.DefineField('NonPagedPoolCharge', [UInt32], 'Public').SetOffset(0x28)
|
||||
$TypeBuilder.DefineField('ExclusiveProcessId', [IntPtr], 'Public').SetOffset(0x30)
|
||||
$TypeBuilder.DefineField('SecurityDescriptor', [IntPtr], 'Public').SetOffset(0x38)
|
||||
$TypeBuilder.DefineField('NameInfo', $UnicodeStringClass, 'Public').SetOffset(0x40)
|
||||
}
|
||||
else
|
||||
{
|
||||
$TypeBuilder.DefineField('NextEntryOffset', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x00))))
|
||||
$TypeBuilder.DefineField('Object', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x04))))
|
||||
$TypeBuilder.DefineField('CreatorUniqueProcess', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x08))))
|
||||
$TypeBuilder.DefineField('CreatorBackTraceIndex', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x0C))))
|
||||
$TypeBuilder.DefineField('Flags', [UInt16], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x0E))))
|
||||
$TypeBuilder.DefineField('PointerCount', [Int32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x10))))
|
||||
$TypeBuilder.DefineField('HandleCount', [Int32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x14))))
|
||||
$TypeBuilder.DefineField('PagedPoolCharge', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x18))))
|
||||
$TypeBuilder.DefineField('NonPagedPoolCharge', [UInt32], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x1C))))
|
||||
$TypeBuilder.DefineField('ExclusiveProcessId', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x20))))
|
||||
$TypeBuilder.DefineField('SecurityDescriptor', [IntPtr], 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x24))))
|
||||
$TypeBuilder.DefineField('NameInfo', $UnicodeStringClass, 'Public').SetCustomAttribute((New-Object Reflection.Emit.CustomAttributeBuilder($FieldOffsetConstructor, @(0x28))))
|
||||
$TypeBuilder.DefineField('NextEntryOffset', [UInt32], 'Public').SetOffset(0x00)
|
||||
$TypeBuilder.DefineField('Object', [IntPtr], 'Public').SetOffset(0x04)
|
||||
$TypeBuilder.DefineField('CreatorUniqueProcess', [IntPtr], 'Public').SetOffset(0x08)
|
||||
$TypeBuilder.DefineField('CreatorBackTraceIndex', [UInt16], 'Public').SetOffset(0x0C)
|
||||
$TypeBuilder.DefineField('Flags', [UInt16], 'Public').SetOffset(0x0E)
|
||||
$TypeBuilder.DefineField('PointerCount', [Int32], 'Public').SetOffset(0x10)
|
||||
$TypeBuilder.DefineField('HandleCount', [Int32], 'Public').SetOffset(0x14)
|
||||
$TypeBuilder.DefineField('PagedPoolCharge', [UInt32], 'Public').SetOffset(0x18)
|
||||
$TypeBuilder.DefineField('NonPagedPoolCharge', [UInt32], 'Public').SetOffset(0x1C)
|
||||
$TypeBuilder.DefineField('ExclusiveProcessId', [IntPtr], 'Public').SetOffset(0x20)
|
||||
$TypeBuilder.DefineField('SecurityDescriptor', [IntPtr], 'Public').SetOffset(0x24)
|
||||
$TypeBuilder.DefineField('NameInfo', $UnicodeStringClass, 'Public').SetOffset(0x28)
|
||||
}
|
||||
|
||||
$ObjectClass = $TypeBuilder.CreateType()
|
||||
|
||||
Reference in New Issue
Block a user