mirror of
https://github.com/helpsystems/CreateProcess
synced 2026-06-08 14:37:39 +00:00
infosec guy
36 lines
1.4 KiB
C
36 lines
1.4 KiB
C
#pragma once
|
|
|
|
#include <stdio.h>
|
|
#include <windows.h>
|
|
|
|
#include "ntdefs.h"
|
|
#include "syscalls.h"
|
|
#include "dinvoke.h"
|
|
#include "csr.h"
|
|
|
|
#ifdef _WIN64
|
|
#define OSMAJORVERSION_OFFSET 0x118
|
|
#define PEB_OFFSET 0x60
|
|
#define READ_MEMLOC __readgsqword
|
|
#else
|
|
#define OSMAJORVERSION_OFFSET 0xa4
|
|
#define PEB_OFFSET 0x30
|
|
#define READ_MEMLOC __readfsdword
|
|
#endif
|
|
|
|
#define DOS_HEADERS_SIZE 0x1000
|
|
|
|
typedef VOID(NTAPI* RtlInitUnicodeString_t)(PUNICODE_STRING DestinationString, PCWSTR SourceString);
|
|
typedef NTSTATUS(NTAPI* RtlCreateProcessParametersEx_t)(PRTL_USER_PROCESS_PARAMETERS* pProcessParameters, PUNICODE_STRING ImagePathName, PUNICODE_STRING DllPath, PUNICODE_STRING CurrentDirectory, PUNICODE_STRING CommandLine, PVOID Environment, PUNICODE_STRING WindowTitle, PUNICODE_STRING DesktopInfo, PUNICODE_STRING ShellInfo, PUNICODE_STRING RuntimeData, ULONG Flags);
|
|
typedef NTSTATUS(NTAPI* RtlDestroyProcessParameters_t)(PRTL_USER_PROCESS_PARAMETERS procParams);
|
|
typedef PVOID(NTAPI* RtlAllocateHeap_t)(PVOID HeapHandle, ULONG Flags, SIZE_T Size);
|
|
typedef BOOL(NTAPI* RtlFreeHeap_t)(PVOID HeapHandle, ULONG Flags, PVOID BaseAddress);
|
|
|
|
#define RtlInitUnicodeString_SW2_HASH 0x7B6E73FC
|
|
#define RtlCreateProcessParametersEx_SW2_HASH 0x5A6A1A93
|
|
#define RtlDestroyProcessParameters_SW2_HASH 0x2B02174D
|
|
#define RtlAllocateHeap_SW2_HASH 0x12B32415
|
|
#define CsrAllocateCaptureBuffer_SW2_HASH 0xE7A5EF3E
|
|
#define CsrClientCallServer_SW2_HASH 0x3A0512BB
|
|
#define RtlFreeHeap_SW2_HASH 0x29881D2C
|