-
Notifications
You must be signed in to change notification settings - Fork 76
/
common.h
90 lines (74 loc) · 1.71 KB
/
common.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
#pragma once
#pragma comment(lib,"ntdll.lib")
#include <ntstatus.h>
#define WIN32_NO_STATUS // needed to prevent winternl.h from redefining macros defined by ntstatus.h
#include <Windows.h>
#include <winternl.h>
#include <TlHelp32.h>
#include <iostream>
#include <algorithm>
#include <thread>
#include "raii.h"
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
#define SYMBOLIC_LINK_QUERY 0x0001
typedef NTSTATUS(NTAPI* pNtMakeTemporaryObject)
(
_In_ HANDLE Handle
);
typedef NTSTATUS(NTAPI* pNtOpenSymbolicLinkObject)
(
_Out_ PHANDLE LinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
typedef NTSTATUS (NTAPI* pNtCreateSymbolicLinkObject)
(
_Out_ PHANDLE LinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PUNICODE_STRING LinkTarget
);
typedef NTSTATUS (NTAPI* pNtImpersonateThread)
(
_In_ HANDLE ServerThreadHandle,
_In_ HANDLE ClientThreadHandle,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos
);
typedef NTSTATUS (NTAPI* pNtUnloadDriver)
(
_In_ PUNICODE_STRING DriverServiceName
);
typedef NTSTATUS(NTAPI* pNtQuerySymbolicLinkObject)
(
_In_ HANDLE LinkHandle,
_Inout_ PUNICODE_STRING LinkTarget,
_Out_opt_ PULONG ReturnedLength
);
NTSTATUS ChangeSymlink
(
_In_ std::wstring symLinkName,
_In_ std::wstring target
);
void Error
(
_In_ DWORD lastError
);
DWORD FindPID
(
_In_ std::wstring imageName
);
DWORD GetFirstThreadID
(
_In_ DWORD dwOwnerPID
);
bool SetPrivilege(
_In_ HANDLE token,
_In_ std::wstring privilege,
_In_ bool enableDisable
);
NTSTATUS ImpersonateAndUnload();
std::wstring GetSymbolicLinkTarget
(
_In_ std::wstring symLinkName
);
bool GetSystem();