MultiTool/IAT_NTDLL.cpp at master · ShadowKnightMK4/MultiTool · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
#include "common.h"
#include "IAT_DLLS.H"
#include "IAT_NTDLL.H"
#include "IAT_BOOSTRAP_LOADER.H"
#include <winternl.h>


NtQueryInformationProcessPtr IAT_NtQueryInformationProcess = 0;
NtTerminateProcessPtr IAT_NtTerminateProcess = 0;
DWORD IAT_DynamicLink_NTDLL(DWORD IAT_settings)
{
	DWORD ret = 0;
	if (iatNTDLL == 0)
	{
		if (IAT_LoadLibraryA != 0)
		{
			iatNTDLL = IAT_LoadLibraryA("ntdll.dll");
		}
		else
		{
			iatNTDLL = IAT_LoadLibraryW(L"ntdll.dll");
		}
	}
	if (iatNTDLL == 0)
	{
		return 0;
	}
	else
	{
		if ((IAT_settings & IAT_NTDLL_LINKING_NTQUERYINFOPROCESS) == (IAT_NTDLL_LINKING_NTQUERYINFOPROCESS))
		{
			IAT_NtQueryInformationProcess = (NtQueryInformationProcessPtr) IAT_GetProcAddress(iatNTDLL, "NtQueryInformationProcess");
			if (IAT_NtQueryInformationProcess != 0)
			{
				ret |= IAT_NTDLL_LINKING_NTQUERYINFOPROCESS;
			}
		}

		if ((IAT_settings & IAT_NTDLL_LINKING_NTTERMINATEPROCESS) == (IAT_NTDLL_LINKING_NTTERMINATEPROCESS))
		{
			IAT_NtTerminateProcess = (NtTerminateProcessPtr)IAT_GetProcAddress(iatNTDLL, "NtTerminateProcess");
			if (IAT_NtTerminateProcess != 0)
			{
				ret |= IAT_NTDLL_LINKING_NTTERMINATEPROCESS;
			}
		}


		return ret;
	}
}

DWORD IAT_DynamicLink_NTDLL_Cleanup()
{
	if (iatNTDLL != 0)
	{
		iatNTDLL = 0;
		IAT_NtQueryInformationProcess = 0;
	}
	return 0;
}