| 12345678910111213141516171819202122232425262728293031323334353637 |
- #include <windows.h>
- //ListModules
- DECLSPEC_IMPORT HANDLE WINAPI KERNEL32$OpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId);
- WINBASEAPI int __cdecl MSVCRT$strcmp(const char *str1, const char *str2);
- WINBASEAPI int __cdecl MSVCRT$printf(const char * _Format,...);
- DECLSPEC_IMPORT BOOL WINAPI KERNEL32$CloseHandle (HANDLE hObject);
- DECLSPEC_IMPORT SIZE_T WINAPI KERNEL32$VirtualQueryEx(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength);
- DECLSPEC_IMPORT DWORD WINAPI KERNEL32$K32GetModuleBaseNameA(HANDLE hProcess, HMODULE hModule, LPSTR lpBaseName, DWORD nSize);
- DECLSPEC_IMPORT DWORD WINAPI KERNEL32$K32GetModuleFileNameExA(HANDLE hProcess, HMODULE hModule, LPSTR lpFilename, DWORD nSize);
- //FindProcess
- typedef NTSTATUS (NTAPI * NtGetNextProcess_t)(HANDLE ProcessHandle, ACCESS_MASK DesiredAccess, ULONG HandleAttributes, ULONG Flags, PHANDLE NewProcessHandle);
- DECLSPEC_IMPORT DWORD WINAPI KERNEL32$GetProcessId(HANDLE Process);
- DECLSPEC_IMPORT HANDLE WINAPI KERNEL32$GetCurrentProcessId();
- DECLSPEC_IMPORT DWORD WINAPI KERNEL32$K32GetProcessImageFileNameA(HANDLE hProcess, LPSTR lpImageFileName, DWORD nSize);
- DECLSPEC_IMPORT LPCSTR WINAPI SHLWAPI$PathFindFileNameA(LPCSTR pszPath);
- //BeaconPrintToStreamW + BeaconOutputStreamW
- #define MAX_STRING 8192
- INT g_iGarbage = 1;
- LPSTREAM g_lpStream = (LPSTREAM)1;
- LPWSTR g_lpwPrintBuffer = (LPWSTR)1;
- DECLSPEC_IMPORT HRESULT WINAPI OLE32$CreateStreamOnHGlobal(HGLOBAL hGlobal, BOOL fDeleteOnRelease, LPSTREAM *ppstm);
- WINBASEAPI void *__cdecl MSVCRT$calloc(size_t number, size_t size);
- WINBASEAPI int __cdecl MSVCRT$_vsnwprintf_s(wchar_t *buffer, size_t sizeOfBuffer, size_t count, const wchar_t *format, va_list argptr);
- WINBASEAPI size_t __cdecl MSVCRT$wcslen(const wchar_t *_Str);
- WINBASEAPI void __cdecl MSVCRT$memset(void *dest, int c, size_t count);
- WINBASEAPI HANDLE WINAPI KERNEL32$GetProcessHeap();
- WINBASEAPI LPVOID WINAPI KERNEL32$HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes);
- WINBASEAPI void __cdecl MSVCRT$free(void *memblock);
- WINBASEAPI BOOL WINAPI KERNEL32$HeapFree(HANDLE, DWORD, PVOID);
- DECLSPEC_IMPORT int WINAPI KERNEL32$MultiByteToWideChar(UINT CodePage, DWORD dwFlags, _In_NLS_string_(cbMultiByte)LPCCH lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar);
|