MCPcopy Create free account
hub / github.com/SickleSec/GhostWolf / WalkRemoteApp

Function WalkRemoteApp

Ghostwolf/Application.cpp:563–591  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

561 }
562}
563void WalkRemoteApp(HANDLE hProcess, uintptr_t patternAddress, AppLication targetApplication, AppMode mode) {
564 CanonicalTodesk todesk;
565 CanonicalTodeskList todesklist;
566 CanonicalTodeskListWithPass todesklistwithpass;
567 switch (mode) {
568 case Pass:
569 if (!ReadProcessMemory(hProcess, reinterpret_cast<LPCVOID>(patternAddress), &todesklistwithpass, sizeof(CanonicalTodeskListWithPass), nullptr)) {
570 PRINT("Failed to read the todeskData\n");
571 return;
572 }
573 PrintValuesTodeskListWithPass(todesklistwithpass, hProcess, patternAddress);
574 break;
575 case List:
576 if (!ReadProcessMemory(hProcess, reinterpret_cast<LPCVOID>(patternAddress), &todesklist, sizeof(CanonicalTodeskList), nullptr)) {
577 PRINT("Failed to read the todeskData\n");
578 return;
579 }
580 PrintValuesTodeskList(todesklist, hProcess, patternAddress);
581 break;
582 case Normal:
583 default:
584 if (!ReadProcessMemory(hProcess, reinterpret_cast<LPCVOID>(patternAddress), &todesk, sizeof(CanonicalTodesk), nullptr)) {
585 PRINT("Failed to read the todeskData\n");
586 return;
587 }
588 PrintValuesTodesk(todesk, hProcess, patternAddress);
589 break;
590 }
591}

Callers 1

mainFunction · 0.85

Calls 3

PrintValuesTodeskListFunction · 0.85
PrintValuesTodeskFunction · 0.85

Tested by

no test coverage detected