| 27 | } |
| 28 | |
| 29 | void Disconnect() { |
| 30 | //print("\n[+] stopping thread and closing..."); |
| 31 | |
| 32 | |
| 33 | PVOID Kthread = reinterpret_cast<PVOID>(KeGetCurrentThread()); |
| 34 | PVOID InitialStack = (PVOID)((ULONG64)Kthread + GInitialStack); |
| 35 | PVOID VCreateTime = (PVOID)((ULONG64)Kthread + GVCreateTime); |
| 36 | PVOID StartAddress = (PVOID)((ULONG64)Kthread + GStartAddress); |
| 37 | PVOID Win32StartAddress = (PVOID)((ULONG64)Kthread + GWin32StartAddress); |
| 38 | PVOID KernelStack = (PVOID)((ULONG64)Kthread + GKernelStack); |
| 39 | PVOID ExitStatus = (PVOID)((ULONG64)Kthread + GExitStatus); |
| 40 | PVOID CID = (PVOID)((ULONG64)Kthread + GCID); |
| 41 | |
| 42 | |
| 43 | //print("\n[+] resetting vars...."); |
| 44 | *(PVOID*)(VCreateTime) = _VCreateTime; |
| 45 | *(PVOID*)(StartAddress) = _StartAddress; |
| 46 | *(PVOID*)(Win32StartAddress) = _Win32StartAddress; |
| 47 | *(PVOID*)(KernelStack) = _KernelStack; |
| 48 | *(PVOID*)(ExitStatus) = _ExitStatus; |
| 49 | *(PVOID*)(CID) = _CID; |
| 50 | |
| 51 | //print("\n[+] Bye!"); |
| 52 | PsTerminateSystemThread(STATUS_SUCCESS); |
| 53 | } |
| 54 | |
| 55 | void InitTarget() { |
| 56 | process::target_pid = readlocal<ULONG64>(readlocal<ULONG64>(process::STRUCT_OFFSET_ADDRESS));//double reading because STRUCT_OFFSET_ADDRESS saves a pointer that has pid |