| 23 | def_NtClose NativeWinApi::NtClose = 0; |
| 24 | |
| 25 | void NativeWinApi::initialize() |
| 26 | { |
| 27 | if (RtlNtStatusToDosError) |
| 28 | { |
| 29 | return; |
| 30 | } |
| 31 | |
| 32 | HMODULE hModuleNtdll = GetModuleHandle(L"ntdll.dll"); |
| 33 | |
| 34 | if (!hModuleNtdll) |
| 35 | { |
| 36 | return; |
| 37 | } |
| 38 | |
| 39 | NtCreateThreadEx = (def_NtCreateThreadEx)GetProcAddress(hModuleNtdll, "NtCreateThreadEx"); |
| 40 | NtDuplicateObject = (def_NtDuplicateObject)GetProcAddress(hModuleNtdll, "NtDuplicateObject"); |
| 41 | NtOpenProcess = (def_NtOpenProcess)GetProcAddress(hModuleNtdll, "NtOpenProcess"); |
| 42 | NtOpenThread = (def_NtOpenThread)GetProcAddress(hModuleNtdll, "NtOpenThread"); |
| 43 | NtQueryObject = (def_NtQueryObject)GetProcAddress(hModuleNtdll, "NtQueryObject"); |
| 44 | NtQueryInformationFile = (def_NtQueryInformationFile)GetProcAddress(hModuleNtdll, "NtQueryInformationFile"); |
| 45 | NtQueryInformationProcess = (def_NtQueryInformationProcess)GetProcAddress(hModuleNtdll, "NtQueryInformationProcess"); |
| 46 | NtQueryInformationThread = (def_NtQueryInformationThread)GetProcAddress(hModuleNtdll, "NtQueryInformationThread"); |
| 47 | NtQuerySystemInformation = (def_NtQuerySystemInformation)GetProcAddress(hModuleNtdll, "NtQuerySystemInformation"); |
| 48 | NtQueryVirtualMemory = (def_NtQueryVirtualMemory)GetProcAddress(hModuleNtdll, "NtQueryVirtualMemory"); |
| 49 | NtResumeProcess = (def_NtResumeProcess)GetProcAddress(hModuleNtdll, "NtResumeProcess"); |
| 50 | NtResumeThread = (def_NtResumeThread)GetProcAddress(hModuleNtdll, "NtResumeThread"); |
| 51 | NtSetInformationThread = (def_NtSetInformationThread)GetProcAddress(hModuleNtdll, "NtSetInformationThread"); |
| 52 | NtSuspendProcess = (def_NtSuspendProcess)GetProcAddress(hModuleNtdll, "NtSuspendProcess"); |
| 53 | NtTerminateProcess = (def_NtTerminateProcess)GetProcAddress(hModuleNtdll, "NtTerminateProcess"); |
| 54 | NtOpenSymbolicLinkObject = (def_NtOpenSymbolicLinkObject)GetProcAddress(hModuleNtdll, "NtOpenSymbolicLinkObject"); |
| 55 | NtQuerySymbolicLinkObject = (def_NtQuerySymbolicLinkObject)GetProcAddress(hModuleNtdll, "NtQuerySymbolicLinkObject"); |
| 56 | |
| 57 | RtlNtStatusToDosError = (def_RtlNtStatusToDosError)GetProcAddress(hModuleNtdll, "RtlNtStatusToDosError"); |
| 58 | NtClose = (def_NtClose)GetProcAddress(hModuleNtdll, "NtClose"); |
| 59 | } |
| 60 | |
| 61 | |
| 62 | PPEB NativeWinApi::getCurrentProcessEnvironmentBlock() |
nothing calls this directly
no outgoing calls
no test coverage detected