admin/lsecqt-OffensiveCpp
1
0
Fork 0
mirror of https://github.com/lsecqt/OffensiveCpp synced 2026-06-08 15:34:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create Lsasssyscall.h

Browse Source
This commit is contained in:
Joas A Santos
2025-01-13 19:11:20 -03:00
committed by GitHub
parent 4707d52004
commit 7000750136
1 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Evasion Techniques/LsassDump/LsassDumpSyscall/Lsasssyscall.h
+31
View File
@@ -0,0 +1,31 @@
#pragma once
#include <Windows.h>
#include <winternl.h> // For original definitions of structures and types like CLIENT_ID
// Remove any custom definitions of CLIENT_ID or related types
// Prototypes for the functions with the correct signatures, assuming these signatures match those required by your syscalls
EXTERN_C NTSTATUS ZwOpenProcess10(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, CLIENT_ID* ClientId);
EXTERN_C NTSTATUS ZwClose10(HANDLE Handle);
EXTERN_C NTSTATUS ZwWriteVirtualMemory10(HANDLE ProcessHandle, PVOID BaseAddress, LPCVOID Buffer, SIZE_T BufferSize, PSIZE_T NumberOfBytesWritten);
EXTERN_C NTSTATUS ZwProtectVirtualMemory10(HANDLE ProcessHandle, PVOID* BaseAddress, SIZE_T* NumberOfBytesToProtect, ULONG NewAccessProtection, PULONG OldAccessProtection);
EXTERN_C NTSTATUS ZwQuerySystemInformation10(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
EXTERN_C NTSTATUS NtCreateFile10(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
// Global function pointers for dynamic resolution, if needed
// If using these, they should be resolved at runtime based on the system version
typedef NTSTATUS(NTAPI* PFN_ZwOpenProcess)(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, CLIENT_ID* ClientId);
typedef NTSTATUS(NTAPI* PFN_ZwClose)(HANDLE Handle);
typedef NTSTATUS(NTAPI* PFN_ZwWriteVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, LPCVOID Buffer, SIZE_T BufferSize, PSIZE_T NumberOfBytesWritten);
typedef NTSTATUS(NTAPI* PFN_ZwProtectVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, SIZE_T* NumberOfBytesToProtect, ULONG NewAccessProtection, PULONG OldAccessProtection);
typedef NTSTATUS(NTAPI* PFN_ZwQuerySystemInformation)(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
typedef NTSTATUS(NTAPI* PFN_NtCreateFile)(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
// Actual function pointer variables
PFN_ZwOpenProcess g_ZwOpenProcess = nullptr;
PFN_ZwClose g_ZwClose = nullptr;
PFN_ZwWriteVirtualMemory g_ZwWriteVirtualMemory = nullptr;
PFN_ZwProtectVirtualMemory g_ZwProtectVirtualMemory = nullptr;
PFN_ZwQuerySystemInformation g_ZwQuerySystemInformation = nullptr;
PFN_NtCreateFile g_NtCreateFile = nullptr;