mirror of
https://github.com/itm4n/PPLdump
synced 2026-06-08 14:54:06 +00:00
itm4n
40 lines
2.1 KiB
C
40 lines
2.1 KiB
C
#pragma once
|
|
|
|
#include "utils.h"
|
|
#include "resource.h"
|
|
|
|
#include <versionhelpers.h>
|
|
#include <aclapi.h>
|
|
|
|
#define PPL_BINARY L"services.exe"
|
|
#define DLL_TO_HIJACK_WIN81 L"SspiCli.dll"
|
|
#define DLL_TO_HIJACK_WIN10 L"EventAggregation.dll"
|
|
|
|
#ifndef STATUS_INFO_LENGTH_MISMATCH
|
|
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
|
|
#endif
|
|
|
|
extern BOOL g_bVerbose;
|
|
extern BOOL g_bDebug;
|
|
extern BOOL g_bForce;
|
|
|
|
_Success_(return) BOOL DumpProcess(_In_ DWORD dwProcessId, _In_ LPWSTR pwszFilePath);
|
|
_Success_(return) BOOL DumpProcessByName(_In_ LPWSTR pwszProcessName, _In_ LPWSTR pwszFilePath);
|
|
_Success_(return) BOOL CheckRequirements();
|
|
_Success_(return) BOOL IsCurrentUserSystem(_Out_ PBOOL pbResult);
|
|
_Success_(return) BOOL GetHijackableDllName(_Out_ LPWSTR* ppwszDllName);
|
|
//_Success_(return) BOOL WritePayloadDll(_In_ LPWSTR pwszPath);
|
|
_Success_(return) BOOL GetPayloadDll(_Out_ LPVOID* ppBuffer, _Out_ PDWORD pdwSize);
|
|
_Success_(return) BOOL FindFileForTransaction(_In_ DWORD dwMinSize, _Out_ LPWSTR* ppwszFilePath);
|
|
_Success_(return) BOOL WritePayloadDllTransacted(_Out_ PHANDLE pdhFile);
|
|
_Success_(return) BOOL FindProcessTokenAndDuplicate(_In_ LPCWSTR pwszTargetSid, _Out_ PHANDLE phToken, _In_opt_ LPCWSTR pwszPrivileges[], _In_ DWORD dwPrivilegeCount);
|
|
_Success_(return) BOOL Impersonate(_In_ HANDLE hToken);
|
|
_Success_(return) BOOL ImpersonateUser(_In_ LPCWSTR pwszSid, _Out_ PHANDLE phToken, _In_opt_ LPCWSTR pwszPrivileges[], _In_ DWORD dwPrivilegeCount);
|
|
_Success_(return) BOOL ImpersonateSystem(_Out_ PHANDLE phSystemToken);
|
|
_Success_(return) BOOL ImpersonateLocalService(_Out_ PHANDLE phLocalServiceToken);
|
|
_Success_(return) BOOL CheckKnownDllSymbolicLink(_In_ LPCWSTR pwszDllName, _In_ LPWSTR pwszTarget);
|
|
_Success_(return) BOOL MapDll(_In_ LPWSTR pwszSectionName, _Out_ PHANDLE phSection);
|
|
_Success_(return) BOOL UnmapDll(_In_ HANDLE hSection);
|
|
_Success_(return) BOOL PrepareCommandLine(_In_ DWORD dwProcessId, _In_ LPWSTR pwszFilePath, _In_ LPWSTR pwszRandomGuid, _Out_ LPWSTR* ppwszCommandLine);
|
|
_Success_(return) BOOL CreateProtectedProcessAsUser(_In_ HANDLE hToken, _In_ LPWSTR pwszCommandLine, _Out_ PHANDLE phProcess);
|