-
Notifications
You must be signed in to change notification settings - Fork 9
/
Copy pathimport_handler.hpp
67 lines (58 loc) · 1.75 KB
/
import_handler.hpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
#pragma once
#define NT_FUNC(func) inline f_##func func = nullptr
#define NT_LOCAL(func) f_##func func = nullptr
#define INIT_CONSTRUCTOR_NATIVE(func) func = NATIVE::##func
#define WIN32_FUNC(func) inline decltype(func)* p_##func = nullptr
#define WIN32_LOCAL(func) decltype(func)* p_##func = nullptr
#define INIT_WIN32_FUNC(func, h_k32) NATIVE::p_##func = (decltype(func)*)GetProcAddress(h_k32, #func)
#define INIT_CONSTRUCTOR_NATIVE_WIN32(func) p_##func = NATIVE::p_##func
#define _FUNC_(func) L#func, NATIVE::##func
DWORD GetOSVersion();
DWORD GetOSBuildVersion();
bool IsWin7OrGreater();
bool IsWin8OrGreater();
bool IsWin81OrGreater();
bool IsWin10OrGreater();
bool IsWin11OrGreater();
enum class IMPORT_INDEX
{
II_NTDLL,
II_KERNEL32
};
namespace NATIVE
{
NT_FUNC(NtQueryObject);
NT_FUNC(LdrGetProcedureAddress);
NT_FUNC(LdrLoadDll);
NT_FUNC(LdrUnloadDll);
NT_FUNC(RtlFreeHeap);
NT_FUNC(LdrpHeap);
NT_FUNC(RtlAllocateHeap);
NT_FUNC(NtAllocateVirtualMemory);
NT_FUNC(NtProtectVirtualMemory);
NT_FUNC(NtFreeVirtualMemory);
NT_FUNC(memmove);
NT_FUNC(NtOpenFile);
NT_FUNC(NtClose);
NT_FUNC(NtSetInformationFile);
NT_FUNC(NtQueryInformationFile);
NT_FUNC(NtQuerySystemInformation);
NT_FUNC(NtReadFile);
NT_FUNC(LdrLockLoaderLock);
NT_FUNC(LdrUnlockLoaderLock);
NT_FUNC(NtCreateThreadEx);
NT_FUNC(RtlRbRemoveNode);
NT_FUNC(LdrpModuleBaseAddressIndex);
NT_FUNC(LdrpMappingInfoIndex);
NT_FUNC(memset);
NT_FUNC(LdrProtectMrdata);
NT_FUNC(RtlAddVectoredExceptionHandler);
NT_FUNC(LdrpInvertedFunctionTable);
NT_FUNC(RtlInsertInvertedFunctionTable);
NT_FUNC(RtlRemoveVectoredExceptionHandler);
WIN32_FUNC(LoadLibraryA);
WIN32_FUNC(FreeLibrary);
WIN32_FUNC(LoadLibraryExW);
WIN32_FUNC(GetLastError);
}
bool ResolveImports(class SymbolLoader* loader);