MalwareSourceCode/Win32/Proof of Concepts/Process-Hollowing/sourcecode/ProcessHollowing/internals.h
vxunderground 900263ea6f updates and moves
n/a
2022-04-11 20:00:13 -05:00

27 lines
661 B
C

struct PROCESS_BASIC_INFORMATION {
PVOID Reserved1;
DWORD PebBaseAddress;
PVOID Reserved2[2];
DWORD UniqueProcessId;
PVOID Reserved3;
};
typedef NTSTATUS (WINAPI* _NtUnmapViewOfSection)(
HANDLE ProcessHandle,
PVOID BaseAddress
);
typedef NTSTATUS (WINAPI* _NtQueryInformationProcess)(
HANDLE ProcessHandle,
DWORD ProcessInformationClass,
PVOID ProcessInformation,
DWORD ProcessInformationLength,
PDWORD ReturnLength
);
typedef NTSTATUS (WINAPI* _NtQuerySystemInformation)(
DWORD SystemInformationClass,
PVOID SystemInformation,
ULONG SystemInformationLength,
PULONG ReturnLength
);