mirror of
https://github.com/trickster0/PrimitiveInjection
synced 2026-06-08 17:55:08 +00:00
trickster0
366 lines
15 KiB
C
366 lines
15 KiB
C
#pragma once
|
|
#pragma intrinsic(memcmp)
|
|
#include <windows.h>
|
|
|
|
|
|
WINBASEAPI HMODULE WINAPI KERNEL32$GetModuleHandleA(LPCSTR lpModuleName);
|
|
DECLSPEC_IMPORT WINBASEAPI BOOL WINAPI KERNEL32$CloseHandle (HANDLE);
|
|
WINBASEAPI HANDLE WINAPI KERNEL32$OpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId);
|
|
WINBASEAPI BOOL WINAPI KERNEL32$GetExitCodeThread(HANDLE hThread,LPDWORD lpExitCode);
|
|
WINBASEAPI int __cdecl MSVCRT$memcmp(const void *_Buf1,const void *_Buf2,size_t _Size);
|
|
WINBASEAPI void __cdecl MSVCRT$memset(void *dest, int c, size_t count);
|
|
WINBASEAPI FARPROC WINAPI KERNEL32$GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
|
|
WINBASEAPI LPVOID WINAPI KERNEL32$HeapAlloc(HANDLE hHeap,DWORD dwFlags,SIZE_T dwBytes);
|
|
WINBASEAPI HANDLE WINAPI KERNEL32$GetProcessHeap();
|
|
WINBASEAPI HLOCAL WINAPI KERNEL32$LocalAlloc(UINT uFlags,SIZE_T uBytes);
|
|
WINBASEAPI HLOCAL WINAPI KERNEL32$LocalFree(HLOCAL hMem);
|
|
WINBASEAPI DWORD WINAPI KERNEL32$WaitForSingleObject(HANDLE hHandle, DWORD dwMilliseconds);
|
|
|
|
#define NtCurrentProcess() ((HANDLE) -1)
|
|
#define NtCurrentThread() ((HANDLE) -2)
|
|
#define RVA(type, base_addr, rva) (type)((ULONG_PTR) base_addr + rva)
|
|
|
|
|
|
typedef VOID(KNORMAL_ROUTINE) (
|
|
IN PVOID NormalContext,
|
|
IN PVOID SystemArgument1,
|
|
IN PVOID SystemArgument2);
|
|
|
|
typedef struct _UNICODE_STRING
|
|
{
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} UNICODE_STRING, *PUNICODE_STRING;
|
|
|
|
typedef struct _PS_ATTRIBUTE
|
|
{
|
|
ULONG Attribute;
|
|
SIZE_T Size;
|
|
union
|
|
{
|
|
ULONG Value;
|
|
PVOID ValuePtr;
|
|
} u1;
|
|
PSIZE_T ReturnLength;
|
|
} PS_ATTRIBUTE, *PPS_ATTRIBUTE;
|
|
|
|
#ifndef InitializeObjectAttributes
|
|
#define InitializeObjectAttributes( p, n, a, r, s ) { \
|
|
(p)->Length = sizeof( OBJECT_ATTRIBUTES ); \
|
|
(p)->RootDirectory = r; \
|
|
(p)->Attributes = a; \
|
|
(p)->ObjectName = n; \
|
|
(p)->SecurityDescriptor = s; \
|
|
(p)->SecurityQualityOfService = NULL; \
|
|
}
|
|
#endif
|
|
|
|
typedef struct _OBJECT_ATTRIBUTES
|
|
{
|
|
ULONG Length;
|
|
HANDLE RootDirectory;
|
|
PUNICODE_STRING ObjectName;
|
|
ULONG Attributes;
|
|
PVOID SecurityDescriptor;
|
|
PVOID SecurityQualityOfService;
|
|
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
|
|
|
|
|
|
typedef struct _USER_STACK
|
|
{
|
|
PVOID FixedStackBase;
|
|
PVOID FixedStackLimit;
|
|
PVOID ExpandableStackBase;
|
|
PVOID ExpandableStackLimit;
|
|
PVOID ExpandableStackBottom;
|
|
} USER_STACK, *PUSER_STACK;
|
|
|
|
typedef KNORMAL_ROUTINE* PKNORMAL_ROUTINE;
|
|
|
|
typedef NTSTATUS(NTAPI*pNtCreateThreadEx)(
|
|
OUT PHANDLE ThreadHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
|
|
IN HANDLE ProcessHandle,
|
|
IN PVOID StartRoutine,
|
|
IN PVOID Argument OPTIONAL,
|
|
IN ULONG CreateFlags,
|
|
IN SIZE_T ZeroBits,
|
|
IN SIZE_T StackSize,
|
|
IN SIZE_T MaximumStackSize,
|
|
IN PVOID AttributeList OPTIONAL);
|
|
|
|
typedef NTSTATUS(NTAPI*pNtQueueApcThread)(
|
|
IN HANDLE ThreadHandle,
|
|
IN PKNORMAL_ROUTINE ApcRoutine,
|
|
IN PVOID ApcArgument1 OPTIONAL,
|
|
IN PVOID ApcArgument2 OPTIONAL,
|
|
IN PVOID ApcArgument3 OPTIONAL);
|
|
|
|
typedef DWORD(NTAPI*pRtlQueryDepthSList)(ULONG_PTR* pValue);
|
|
|
|
typedef NTSTATUS(NTAPI*pNtResumeThread)(
|
|
IN HANDLE ThreadHandle,
|
|
OUT PULONG SuspendCount OPTIONAL);
|
|
|
|
typedef NTSTATUS(NTAPI*pNtTestAlert)();
|
|
|
|
typedef LONG KPRIORITY;
|
|
|
|
typedef void* PRTL_USER_PROCESS_PARAMETERS;
|
|
typedef void* PPS_POST_PROCESS_INIT_ROUTINE;
|
|
|
|
typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
|
|
{
|
|
DWORD dwLength;
|
|
DWORD dwInitialized;
|
|
LPVOID lpSsHandle;
|
|
LIST_ENTRY InLoadOrderModuleList;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
LPVOID lpEntryInProgress;
|
|
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
|
|
|
typedef struct _PEB {
|
|
BYTE InheritedAddressSpace;
|
|
BYTE ReadImageFileExecOptions;
|
|
BYTE BeingDebugged;
|
|
BYTE _SYSTEM_DEPENDENT_01;
|
|
|
|
LPVOID Mutant;
|
|
LPVOID ImageBaseAddress;
|
|
|
|
PPEB_LDR_DATA Ldr;
|
|
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
|
LPVOID SubSystemData;
|
|
LPVOID ProcessHeap;
|
|
LPVOID FastPebLock;
|
|
LPVOID _SYSTEM_DEPENDENT_02;
|
|
LPVOID _SYSTEM_DEPENDENT_03;
|
|
LPVOID _SYSTEM_DEPENDENT_04;
|
|
union {
|
|
LPVOID KernelCallbackTable;
|
|
LPVOID UserSharedInfoPtr;
|
|
};
|
|
DWORD SystemReserved;
|
|
DWORD _SYSTEM_DEPENDENT_05;
|
|
LPVOID _SYSTEM_DEPENDENT_06;
|
|
LPVOID TlsExpansionCounter;
|
|
LPVOID TlsBitmap;
|
|
DWORD TlsBitmapBits[2];
|
|
LPVOID ReadOnlySharedMemoryBase;
|
|
LPVOID _SYSTEM_DEPENDENT_07;
|
|
LPVOID ReadOnlyStaticServerData;
|
|
LPVOID AnsiCodePageData;
|
|
LPVOID OemCodePageData;
|
|
LPVOID UnicodeCaseTableData;
|
|
DWORD NumberOfProcessors;
|
|
union
|
|
{
|
|
DWORD NtGlobalFlag;
|
|
LPVOID dummy02;
|
|
};
|
|
LARGE_INTEGER CriticalSectionTimeout;
|
|
LPVOID HeapSegmentReserve;
|
|
LPVOID HeapSegmentCommit;
|
|
LPVOID HeapDeCommitTotalFreeThreshold;
|
|
LPVOID HeapDeCommitFreeBlockThreshold;
|
|
DWORD NumberOfHeaps;
|
|
DWORD MaximumNumberOfHeaps;
|
|
LPVOID ProcessHeaps;
|
|
LPVOID GdiSharedHandleTable;
|
|
LPVOID ProcessStarterHelper;
|
|
LPVOID GdiDCAttributeList;
|
|
LPVOID LoaderLock;
|
|
DWORD OSMajorVersion;
|
|
DWORD OSMinorVersion;
|
|
WORD OSBuildNumber;
|
|
WORD OSCSDVersion;
|
|
DWORD OSPlatformId;
|
|
DWORD ImageSubsystem;
|
|
DWORD ImageSubsystemMajorVersion;
|
|
LPVOID ImageSubsystemMinorVersion;
|
|
union
|
|
{
|
|
LPVOID ImageProcessAffinityMask;
|
|
LPVOID ActiveProcessAffinityMask;
|
|
};
|
|
#ifdef _WIN64
|
|
LPVOID GdiHandleBuffer[64];
|
|
#else
|
|
LLPVOID GdiHandleBuffer[32];
|
|
#endif
|
|
LPVOID PostProcessInitRoutine;
|
|
LPVOID TlsExpansionBitmap;
|
|
DWORD TlsExpansionBitmapBits[32];
|
|
LPVOID SessionId;
|
|
ULARGE_INTEGER AppCompatFlags;
|
|
ULARGE_INTEGER AppCompatFlagsUser;
|
|
LPVOID pShimData;
|
|
LPVOID AppCompatInfo;
|
|
PUNICODE_STRING CSDVersion;
|
|
LPVOID ActivationContextData;
|
|
LPVOID ProcessAssemblyStorageMap;
|
|
LPVOID SystemDefaultActivationContextData;
|
|
LPVOID SystemAssemblyStorageMap;
|
|
LPVOID MinimumStackCommit;
|
|
} PEB, * PPEB;
|
|
|
|
typedef struct _PROCESS_BASIC_INFORMATION
|
|
{
|
|
NTSTATUS ExitStatus;
|
|
PPEB PebBaseAddress;
|
|
KAFFINITY AffinityMask;
|
|
KPRIORITY BasePriority;
|
|
HANDLE UniqueProcessId;
|
|
HANDLE InheritedFromUniqueProcessId;
|
|
} PROCESS_BASIC_INFORMATION, * PPROCESS_BASIC_INFORMATION;
|
|
|
|
typedef enum _PROCESSINFOCLASS
|
|
{
|
|
ProcessBasicInformation, // q: PROCESS_BASIC_INFORMATION, PROCESS_EXTENDED_BASIC_INFORMATION
|
|
ProcessQuotaLimits, // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX
|
|
ProcessIoCounters, // q: IO_COUNTERS
|
|
ProcessVmCounters, // q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2
|
|
ProcessTimes, // q: KERNEL_USER_TIMES
|
|
ProcessBasePriority, // s: KPRIORITY
|
|
ProcessRaisePriority, // s: ULONG
|
|
ProcessDebugPort, // q: HANDLE
|
|
ProcessExceptionPort, // s: PROCESS_EXCEPTION_PORT
|
|
ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN
|
|
ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10
|
|
ProcessLdtSize, // s: PROCESS_LDT_SIZE
|
|
ProcessDefaultHardErrorMode, // qs: ULONG
|
|
ProcessIoPortHandlers, // (kernel-mode only) // PROCESS_IO_PORT_HANDLER_INFORMATION
|
|
ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS
|
|
ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void
|
|
ProcessUserModeIOPL, // qs: ULONG (requires SeTcbPrivilege)
|
|
ProcessEnableAlignmentFaultFixup, // s: BOOLEAN
|
|
ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS
|
|
ProcessWx86Information, // qs: ULONG (requires SeTcbPrivilege) (VdmAllowed)
|
|
ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
|
|
ProcessAffinityMask, // qs: KAFFINITY, qs: GROUP_AFFINITY
|
|
ProcessPriorityBoost, // qs: ULONG
|
|
ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX
|
|
ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION
|
|
ProcessForegroundInformation, // s: PROCESS_FOREGROUND_BACKGROUND
|
|
ProcessWow64Information, // q: ULONG_PTR
|
|
ProcessImageFileName, // q: UNICODE_STRING
|
|
ProcessLUIDDeviceMapsEnabled, // q: ULONG
|
|
ProcessBreakOnTermination, // qs: ULONG
|
|
ProcessDebugObjectHandle, // q: HANDLE // 30
|
|
ProcessDebugFlags, // qs: ULONG
|
|
ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables
|
|
ProcessIoPriority, // qs: IO_PRIORITY_HINT
|
|
ProcessExecuteFlags, // qs: ULONG
|
|
ProcessTlsInformation, // PROCESS_TLS_INFORMATION // ProcessResourceManagement
|
|
ProcessCookie, // q: ULONG
|
|
ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION
|
|
ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
|
|
ProcessPagePriority, // q: PAGE_PRIORITY_INFORMATION
|
|
ProcessInstrumentationCallback, // s: PVOID or PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40
|
|
ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX
|
|
ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]
|
|
ProcessImageFileNameWin32, // q: UNICODE_STRING
|
|
ProcessImageFileMapping, // q: HANDLE (input)
|
|
ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE
|
|
ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE
|
|
ProcessGroupInformation, // q: USHORT[]
|
|
ProcessTokenVirtualizationEnabled, // s: ULONG
|
|
ProcessConsoleHostProcess, // q: ULONG_PTR // ProcessOwnerInformation
|
|
ProcessWindowInformation, // q: PROCESS_WINDOW_INFORMATION // 50
|
|
ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8
|
|
ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION
|
|
ProcessDynamicFunctionTableInformation,
|
|
ProcessHandleCheckingMode, // qs: ULONG; s: 0 disables, otherwise enables
|
|
ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
|
|
ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
|
|
ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL
|
|
ProcessHandleTable, // q: ULONG[] // since WINBLUE
|
|
ProcessCheckStackExtentsMode, // qs: ULONG // KPROCESS->CheckStackExtents (CFG)
|
|
ProcessCommandLineInformation, // q: UNICODE_STRING // 60
|
|
ProcessProtectionInformation, // q: PS_PROTECTION
|
|
ProcessMemoryExhaustion, // PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD
|
|
ProcessFaultInformation, // PROCESS_FAULT_INFORMATION
|
|
ProcessTelemetryIdInformation, // q: PROCESS_TELEMETRY_ID_INFORMATION
|
|
ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION
|
|
ProcessDefaultCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5]
|
|
ProcessAllowedCpuSetsInformation, // SYSTEM_CPU_SET_INFORMATION[5]
|
|
ProcessSubsystemProcess,
|
|
ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO
|
|
ProcessInPrivate, // s: void // ETW // since THRESHOLD2 // 70
|
|
ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables
|
|
ProcessIumChallengeResponse,
|
|
ProcessChildProcessInformation, // q: PROCESS_CHILD_PROCESS_INFORMATION
|
|
ProcessHighGraphicsPriorityInformation, // qs: BOOLEAN (requires SeTcbPrivilege)
|
|
ProcessSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
|
|
ProcessEnergyValues, // q: PROCESS_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES
|
|
ProcessPowerThrottlingState, // qs: POWER_THROTTLING_PROCESS_STATE
|
|
ProcessReserved3Information, // ProcessActivityThrottlePolicy // PROCESS_ACTIVITY_THROTTLE_POLICY
|
|
ProcessWin32kSyscallFilterInformation, // q: WIN32K_SYSCALL_FILTER
|
|
ProcessDisableSystemAllowedCpuSets, // 80
|
|
ProcessWakeInformation, // PROCESS_WAKE_INFORMATION
|
|
ProcessEnergyTrackingState, // PROCESS_ENERGY_TRACKING_STATE
|
|
ProcessManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3
|
|
ProcessCaptureTrustletLiveDump,
|
|
ProcessTelemetryCoverage,
|
|
ProcessEnclaveInformation,
|
|
ProcessEnableReadWriteVmLogging, // PROCESS_READWRITEVM_LOGGING_INFORMATION
|
|
ProcessUptimeInformation, // q: PROCESS_UPTIME_INFORMATION
|
|
ProcessImageSection, // q: HANDLE
|
|
ProcessDebugAuthInformation, // since REDSTONE4 // 90
|
|
ProcessSystemResourceManagement, // PROCESS_SYSTEM_RESOURCE_MANAGEMENT
|
|
ProcessSequenceNumber, // q: ULONGLONG
|
|
ProcessLoaderDetour, // since REDSTONE5
|
|
ProcessSecurityDomainInformation, // PROCESS_SECURITY_DOMAIN_INFORMATION
|
|
ProcessCombineSecurityDomainsInformation, // PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION
|
|
ProcessEnableLogging, // PROCESS_LOGGING_INFORMATION
|
|
ProcessLeapSecondInformation, // PROCESS_LEAP_SECOND_INFORMATION
|
|
ProcessFiberShadowStackAllocation, // PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION // since 19H1
|
|
ProcessFreeFiberShadowStackAllocation, // PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION
|
|
ProcessAltSystemCallInformation, // qs: BOOLEAN (kernel-mode only) // INT2E // since 20H1 // 100
|
|
ProcessDynamicEHContinuationTargets, // PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION
|
|
ProcessDynamicEnforcedCetCompatibleRanges, // PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_INFORMATION // since 20H2
|
|
ProcessCreateStateChange, // since WIN11
|
|
ProcessApplyStateChange,
|
|
ProcessEnableOptionalXStateFeatures,
|
|
ProcessAltPrefetchParam, // since 22H1
|
|
ProcessAssignCpuPartitions,
|
|
ProcessPriorityClassEx,
|
|
ProcessMembershipInformation,
|
|
ProcessEffectiveIoPriority,
|
|
ProcessEffectivePagePriority,
|
|
MaxProcessInfoClass
|
|
} PROCESSINFOCLASS;
|
|
|
|
typedef NTSTATUS(NTAPI*pNtQueryInformationProcess) (
|
|
HANDLE ProcessHandle,
|
|
PROCESSINFOCLASS ProcessInformationClass,
|
|
PVOID ProcessInformation,
|
|
ULONG ProcessInformationLength,
|
|
PULONG ReturnLength
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI*pNtWaitForSingleObject)(
|
|
HANDLE Handle,
|
|
BOOLEAN Alertable,
|
|
PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI*pNtContinue)(
|
|
PCONTEXT ThreadContext,
|
|
BOOLEAN RaiseAlert);
|
|
|
|
typedef NTSTATUS(NTAPI*pNtGetContextThread)(
|
|
HANDLE ThreadHandle,
|
|
PCONTEXT pContext);
|
|
|
|
typedef NTSTATUS(WINAPI*pSetProcessValidCallTargets)(
|
|
HANDLE hProcess,
|
|
LPVOID VirtualAddress,
|
|
SIZE_T RegionSize,
|
|
ULONG NumberOfOffsets,
|
|
PCFG_CALL_TARGET_INFO CfgCallInfo
|
|
);
|