| 5 | namespace Core { |
| 6 | |
| 7 | NTSTATUS GetProcessBaseAddress(int pid, uint64_t* Address) |
| 8 | { |
| 9 | PEPROCESS pProcess = NULL; |
| 10 | if (pid < 1) |
| 11 | return STATUS_UNSUCCESSFUL; |
| 12 | |
| 13 | if (!NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)pid, &pProcess))) |
| 14 | return STATUS_UNSUCCESSFUL; |
| 15 | |
| 16 | |
| 17 | *Address = (uint64_t)PsGetProcessSectionBaseAddress(pProcess); |
| 18 | |
| 19 | ObDereferenceObject(pProcess); |
| 20 | return STATUS_SUCCESS; |
| 21 | } |
| 22 | |
| 23 | DWORD GetUserDirectoryTableBaseOffset() |
| 24 | { |
no outgoing calls
no test coverage detected