MCPcopy Index your code
hub / github.com/bytecode77/r77-rootkit / R77_NtQueryObject

Function R77_NtQueryObject

r77api/r77win.c:926–930  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

924}
925
926NTSTATUS NTAPI R77_NtQueryObject(HANDLE handle, OBJECT_INFORMATION_CLASS objectInformationClass, LPVOID objectInformation, ULONG objectInformationLength, PULONG returnLength)
927{
928 // NtQueryObject must be called by using GetProcAddress on Windows 7.
929 return ((NT_NTQUERYOBJECT)GetFunction("ntdll.dll", "NtQueryObject"))(handle, objectInformationClass, objectInformation, objectInformationLength, returnLength);
930}
931NTSTATUS NTAPI R77_NtCreateThreadEx(LPHANDLE thread, ACCESS_MASK desiredAccess, LPVOID objectAttributes, HANDLE processHandle, LPVOID startAddress, LPVOID parameter, ULONG flags, SIZE_T stackZeroBits, SIZE_T sizeOfStackCommit, SIZE_T sizeOfStackReserve, LPVOID bytesBuffer)
932{
933 // Use NtCreateThreadEx instead of CreateRemoteThread.

Callers 2

GetRegistryKeyNameFunction · 0.85

Calls 1

GetFunctionFunction · 0.85

Tested by

no test coverage detected