mirror of
https://github.com/jdu2600/Get-InjectedThreadEx
synced 2026-06-08 14:59:49 +00:00
John U
90 lines
3.4 KiB
C++
90 lines
3.4 KiB
C++
#pragma once
|
|
|
|
#pragma comment(lib, "ntdll.lib")
|
|
#pragma comment(lib, "DbgHelp.lib")
|
|
#pragma comment(lib, "Zydis.lib")
|
|
|
|
#define WIN32_LEAN_AND_MEAN
|
|
#define NOMINMAX
|
|
#include <Windows.h>
|
|
#include <dbghelp.h>
|
|
//#include <ehdata.h>
|
|
#include <processsnapshot.h>
|
|
#include <psapi.h>
|
|
#include <tlhelp32.h>
|
|
|
|
#include <array>
|
|
#include <cstdio>
|
|
#include <filesystem>
|
|
#include <iostream>
|
|
#include <map>
|
|
#include <unordered_map>
|
|
#include <unordered_set>
|
|
#include <vector>
|
|
|
|
// x86/x86-64 disassembler
|
|
// https://github.com/zyantific/zydis - MIT
|
|
#define ZYDIS_STATIC_BUILD
|
|
#include <Zydis/Zydis.h>
|
|
|
|
// https://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation
|
|
constexpr auto MAX_LONG_PATH = 0x7FFF;
|
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// Logging
|
|
#define Log(_fmt_, ...) printf(_fmt_ "\n", ##__VA_ARGS__)
|
|
#define LogError(_fmt_, ...) fprintf(stderr, "[!] " _fmt_ "\n", ##__VA_ARGS__)
|
|
#if _DEBUG
|
|
#define LogDebug(_fmt_, ...) printf("[#] " _fmt_ "\n", ##__VA_ARGS__)
|
|
#else
|
|
#define LogDebug(...)
|
|
#endif
|
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// Native API
|
|
#define SE_DEBUG_PRIVILEGE (20L)
|
|
typedef LONG NTSTATUS;
|
|
#define NT_SUCCESS(Status) ((Status) >= 0)
|
|
extern "C" {
|
|
NTSTATUS RtlAdjustPrivilege(ULONG Privilege, BOOLEAN Enable, BOOLEAN CurrentThread, PBOOLEAN Enabled);
|
|
}
|
|
|
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// CfgBitMap.cpp
|
|
BOOL GetCfgBitsForAddress(PVOID address, PULONG pCfgBits);
|
|
BOOL IsValidXfgHash(UINT64 xfgHash);
|
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// Memory.cpp
|
|
std::string ToHex(std::string bytes);
|
|
BOOL IsExecutable(const MEMORY_BASIC_INFORMATION& mbi);
|
|
BOOL InSystemImageRange(PVOID Address);
|
|
BOOL ReadProcessMemorySafely(HANDLE hProcess, PVOID address, PDWORD64 buffer);
|
|
BOOL ReadProcessMemorySafely(HANDLE hProcess, PVOID address, std::string& buffer);
|
|
BOOL ReadProcessMemorySafely(HANDLE hProcess, PVOID address, std::string& buffer, const MEMORY_BASIC_INFORMATION& mbi);
|
|
BOOL GetMappedFileNameAsDosPath(HANDLE hProcess, PVOID address, std::wstring& buffer);
|
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// Process.cpp
|
|
BOOL IsElevated();
|
|
BOOL IsDotNet(HANDLE hProcess);
|
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// StackClimb.cpp
|
|
constexpr auto MIN_FRAMES = 5;
|
|
BOOL StackClimb64(const HANDLE hProcess, const PVOID stackBuffer[], const size_t stackBufferCount, std::vector<std::string>& callStackFrames, bool* pbDetection, int offset = 0);
|
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// Symbol.cpp
|
|
BOOL GetNearestSymbol(HANDLE hProcess, PVOID address, std::string& symbol, bool bIncludeDisplacement = false);
|
|
BOOL GetNearestSymbolWithPdb(HANDLE hProcess, PVOID address, std::string& symbol, bool bIncludeDisplacement = false);
|
|
PVOID GetSymbolAddress(const char symbol[]);
|
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// Unwind.cpp
|
|
HRESULT CalculateFrameSize(PVOID returnAddress, PDWORD pFrameSize, const std::wstring& filepath, PVOID remoteBase);
|
|
BOOL IsValidCallSite(HANDLE hProcess, bool bIsWow64, const MEMORY_BASIC_INFORMATION& mbi, PVOID callsite, bool* bCallFound);
|
|
|
|
int main(int, char* []);
|