| 23 | } |
| 24 | |
| 25 | void HideThread() { |
| 26 | |
| 27 | //this is not needed lol, i just use this to get a random address ill set the start address to |
| 28 | PVOID ntoskrnlbase = (PVOID)((ULONG64)get_system_module_base(skCrypt("\\SystemRoot\\system32\\ntoskrnl.exe")) + 0x23810a); |
| 29 | //PVOID ntoskrnlbase = (PVOID)((ULONG64)get_system_module_base("\\SystemRoot\\system32\\ntoskrnl.exe")); |
| 30 | //print("\n[+] Base: 0x%llX", ntoskrnlbase); |
| 31 | PVOID Kthread = reinterpret_cast<PVOID>(KeGetCurrentThread()); |
| 32 | //print("\n[+] Kthread: 0x%llX", Kthread); |
| 33 | |
| 34 | PVOID InitialStack = (PVOID)((ULONG64)Kthread + GInitialStack); |
| 35 | PVOID VCreateTime = (PVOID)((ULONG64)Kthread + GVCreateTime); |
| 36 | PVOID StartAddress = (PVOID)((ULONG64)Kthread + GStartAddress); |
| 37 | PVOID Win32StartAddress = (PVOID)((ULONG64)Kthread + GWin32StartAddress); |
| 38 | PVOID KernelStack = (PVOID)((ULONG64)Kthread + GKernelStack); |
| 39 | PVOID CID = (PVOID)((ULONG64)Kthread + GCID); |
| 40 | PVOID ExitStatus = (PVOID)((ULONG64)Kthread + GExitStatus); |
| 41 | |
| 42 | //print("\n[+] CreateTime: 0x%llX", VCreateTime); |
| 43 | SpoofAddress<LARGE_INTEGER>(VCreateTime, &_VCreateTime, (PVOID)2147483247); |
| 44 | |
| 45 | //print("\n[+] StartAddress: 0x%llX", StartAddress); |
| 46 | SpoofAddress<void*>(StartAddress, &_StartAddress, ntoskrnlbase); |
| 47 | |
| 48 | //print("\n[+] Win32StartAddress: 0x%llX", Win32StartAddress); |
| 49 | SpoofAddress<void*>(Win32StartAddress, &_Win32StartAddress, ntoskrnlbase); |
| 50 | |
| 51 | //print("\n[+] KernelStack: 0x%llX", KernelStack); |
| 52 | SpoofAddress<LARGE_INTEGER>(KernelStack, &_KernelStack); |
| 53 | |
| 54 | SpoofAddress<CLIENT_ID>(CID, &_CID); |
| 55 | |
| 56 | |
| 57 | SpoofAddress<LONG>(ExitStatus, &_ExitStatus); |
| 58 | |
| 59 | } |
| 60 | |
| 61 | int errors = 0; |
| 62 | int CheckCode() { |
no test coverage detected