79031da543
Spell checking / Report (Push) (push) Blocked by required conditions
Spell checking / Report (PR) (push) Blocked by required conditions
Spell checking / Check Spelling (push) Has been cancelled
Spell checking / Update PR (push) Has been cancelled
Publish Dev Docs Website / build (push) Failing after 1s
Publish Dev Docs Website / deploy (push) Has been skipped
62 lines
1.9 KiB
C++
62 lines
1.9 KiB
C++
#include "pch.h"
|
|
|
|
#include "NtdllBase.h"
|
|
|
|
Ntdll::Ntdll()
|
|
{
|
|
m_module = GetModuleHandleW(L"ntdll.dll");
|
|
if (m_module == 0)
|
|
{
|
|
throw std::runtime_error{ "GetModuleHandleW returned null" };
|
|
}
|
|
|
|
m_NtQuerySystemInformation = reinterpret_cast<NtQuerySystemInformation_t>(GetProcAddress(m_module, "NtQuerySystemInformation"));
|
|
if (m_NtQuerySystemInformation == 0)
|
|
{
|
|
throw std::runtime_error{ "GetProcAddress returned null for NtQuerySystemInformation" };
|
|
}
|
|
|
|
m_NtDuplicateObject = reinterpret_cast<NtDuplicateObject_t>(GetProcAddress(m_module, "NtDuplicateObject"));
|
|
if (m_NtDuplicateObject == 0)
|
|
{
|
|
throw std::runtime_error{ "GetProcAddress returned null for NtDuplicateObject" };
|
|
}
|
|
|
|
m_NtQueryObject = reinterpret_cast<NtQueryObject_t>(GetProcAddress(m_module, "NtQueryObject"));
|
|
if (m_NtQueryObject == 0)
|
|
{
|
|
throw std::runtime_error{ "GetProcAddress returned null for NtQueryObject" };
|
|
}
|
|
}
|
|
|
|
NTSTATUS Ntdll::NtQuerySystemInformation(
|
|
ULONG SystemInformationClass,
|
|
PVOID SystemInformation,
|
|
ULONG SystemInformationLength,
|
|
PULONG ReturnLength)
|
|
{
|
|
return m_NtQuerySystemInformation(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
|
|
}
|
|
|
|
NTSTATUS Ntdll::NtDuplicateObject(
|
|
HANDLE SourceProcessHandle,
|
|
HANDLE SourceHandle,
|
|
HANDLE TargetProcessHandle,
|
|
PHANDLE TargetHandle,
|
|
ACCESS_MASK DesiredAccess,
|
|
ULONG Attributes,
|
|
ULONG Options)
|
|
{
|
|
return m_NtDuplicateObject(SourceProcessHandle, SourceHandle, TargetProcessHandle, TargetHandle, DesiredAccess, Attributes, Options);
|
|
}
|
|
|
|
NTSTATUS Ntdll::NtQueryObject(
|
|
HANDLE ObjectHandle,
|
|
ULONG ObjectInformationClass,
|
|
PVOID ObjectInformation,
|
|
ULONG ObjectInformationLength,
|
|
PULONG ReturnLength)
|
|
{
|
|
return m_NtQueryObject(ObjectHandle, ObjectInformationClass, ObjectInformation, ObjectInformationLength, ReturnLength);
|
|
}
|