| 70 | } |
| 71 | |
| 72 | void mainthread() |
| 73 | { |
| 74 | //KeSetBasePriorityThread(KeGetCurrentThread(), 31); |
| 75 | |
| 76 | auto OsInfo = GetOSVersion(); |
| 77 | |
| 78 | if (OsInfo.dwBuildNumber > 19000) { //above 1909 |
| 79 | GInitialStack = InitialStack_UP; |
| 80 | GVCreateTime = VCreateTime_UP; |
| 81 | GStartAddress = StartAddress_UP; |
| 82 | GWin32StartAddress = Win32StartAddress_UP; |
| 83 | GImageFileName = ImageFileName_UP; |
| 84 | GActiveThreads = ActiveThreads_UP; |
| 85 | GActiveProcessLinks = ActiveProcessLinks_UP; |
| 86 | GKernelStack = KernelStack_UP; |
| 87 | GExitStatus = ExitStatus_UP; |
| 88 | GCID = CID_UP; |
| 89 | } |
| 90 | else { |
| 91 | GInitialStack = InitialStack_1909; |
| 92 | GVCreateTime = VCreateTime_1909; |
| 93 | GStartAddress = StartAddress_1909; |
| 94 | GWin32StartAddress = Win32StartAddress_1909; |
| 95 | GImageFileName = ImageFileName_1909; |
| 96 | GActiveThreads = ActiveThreads_1909; |
| 97 | GActiveProcessLinks = ActiveProcessLinks_1909; |
| 98 | GKernelStack = KernelStack_1909; |
| 99 | GExitStatus = ExitStatus_1909; |
| 100 | GCID = CID_1909; |
| 101 | } |
| 102 | |
| 103 | HideThread(); |
| 104 | //print("\n[+] waiting for program"); |
| 105 | |
| 106 | sleep(1000); |
| 107 | Check(); |
| 108 | sleep(3000); |
| 109 | if (Connect()) { |
| 110 | while (true) { |
| 111 | int code = CheckCode(); |
| 112 | switch (code) { |
| 113 | case 3: |
| 114 | Disconnect(); |
| 115 | break; |
| 116 | case 4: |
| 117 | Read(); |
| 118 | break; |
| 119 | case 5: |
| 120 | GetBase(); |
| 121 | break; |
| 122 | case 6: |
| 123 | InitTarget(); |
| 124 | break; |
| 125 | default: |
| 126 | break; |
| 127 | } |
| 128 | } |
| 129 | } |
nothing calls this directly
no test coverage detected