mirror of
https://github.com/hasherezade/pe-sieve
synced 2026-06-08 14:34:52 +00:00
hasherezade
29 lines
761 B
C++
29 lines
761 B
C++
#pragma once
|
|
|
|
#include <windows.h>
|
|
|
|
#define USE_PROCESS_SNAPSHOT
|
|
#define USE_RTL_PROCESS_REFLECTION
|
|
|
|
namespace pesieve {
|
|
namespace util {
|
|
|
|
// required by RtlCreateProcessReflection:
|
|
const DWORD reflection_access1 = PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_DUP_HANDLE;
|
|
|
|
// required by PssCaptureSnapshot:
|
|
const DWORD reflection_access2 = PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_DUP_HANDLE | PROCESS_CREATE_PROCESS;
|
|
|
|
#ifdef USE_PROCESS_SNAPSHOT
|
|
const DWORD reflection_access = reflection_access2;
|
|
#else
|
|
const DWORD reflection_access = reflection_access1;
|
|
#endif
|
|
|
|
bool can_make_process_reflection();
|
|
HANDLE make_process_reflection(HANDLE orig_hndl);
|
|
bool release_process_reflection(HANDLE* reflection_hndl);
|
|
|
|
};
|
|
};
|