|
#ifndef DRV_VIRGINITY_H
#define DRV_VIRGINITY_H
#include "drvFiles.h"
#include "drvCpp.h"
extern "C"
{
#include "drv_NtDefinitions.h"
}
typedef struct _Drv_VirginityContext
{
drv_MappedFile m_mapped;
HANDLE m_hFile;
UCHAR m_SectionName[IMAGE_SIZEOF_SHORT_NAME+1];
ULONG m_sstOffsetInSection;
char * m_mappedSST;
ULONG m_imageBase;
char * m_pSectionStart;
char * m_pMappedSectionStart;
char * m_pLoadedNtAddress;
}Drv_VirginityContext;
NTSTATUS Drv_VirginityInit(Drv_VirginityContext * pContext);
void Drv_VirginityFree(Drv_VirginityContext * pContext);
void Drv_GetRealSSTValue(Drv_VirginityContext * pContext, long index, void ** pValue);
ULONG Drv_GetSizeOfNtosSST();
void ** Drv_GetNtosSSTEntry(int index);
ULONG DisableKernelDefence(KIRQL * OldIrql);
VOID EnableKernelDefence(ULONG OldCr0, KIRQL OldIrql);
void Drv_HookSST(PVOID * ppPlaceToHook, PVOID pNewHook);
class CAutoVirginity
{
Drv_VirginityContext * m_pContext;
CAutoVirginity(const CAutoVirginity&);
CAutoVirginity&operator = (const CAutoVirginity&);
public:
CAutoVirginity()
: m_pContext(0)
{
}
NTSTATUS Init(Drv_VirginityContext * pContext)
{
NT_CHECK(Drv_VirginityInit(pContext));
m_pContext = pContext;
return NT_OK;
}
~CAutoVirginity()
{
if (m_pContext)
Drv_VirginityFree(m_pContext);
}
};
typedef struct _Drv_ResolverContext
{
PSYSTEM_MODULE_INFORMATION m_pModInfo;
}
Drv_ResolverContext;
NTSTATUS Drv_ResolverContextInit(Drv_ResolverContext * pContext);
void Drv_ResolverContextFree(Drv_ResolverContext * pContext);
SYSTEM_MODULE * Drv_ResolverLookupModule(Drv_ResolverContext * pContext, const void * pPointer);
class Drv_Resolver
{
Drv_ResolverContext m_context;
int m_bInited;
Drv_Resolver(const Drv_Resolver & );
Drv_Resolver&operator =(const Drv_Resolver & );
public:
Drv_Resolver();
~Drv_Resolver();
NTSTATUS Init();
SYSTEM_MODULE * LookupModule(const void * pPointer);
};
#endif
|
By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.
If a file you wish to view isn't highlighted, and is a text file (not binary), please
let us know and we'll add colourisation support for it.
ApriorIT is a software research and development company specializing in cybersecurity and data management technology engineering. We work for a broad range of clients from Fortune 500 technology leaders to small innovative startups building unique solutions.
As Apriorit offers integrated research&development services for the software projects in such areas as endpoint security, network security, data security, embedded Systems, and virtualization, we have strong kernel and driver development skills, huge system programming expertise, and are reals fans of research projects.
Our specialty is reverse engineering, we apply it for security testing and security-related projects.
A separate department of Apriorit works on large-scale business SaaS solutions, handling tasks from business analysis, data architecture design, and web development to performance optimization and DevOps.
Official site: https://www.apriorit.com
Clutch profile: https://clutch.co/profile/apriorit
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.