Skip to content

Instantly share code, notes, and snippets.

@BlackOfWorld
Last active February 26, 2023 12:59
Show Gist options
  • Save BlackOfWorld/0d1e9f4d4142ced783bf57d597a8dde9 to your computer and use it in GitHub Desktop.
Save BlackOfWorld/0d1e9f4d4142ced783bf57d597a8dde9 to your computer and use it in GitHub Desktop.
This is just a useful meme
#define NtGetCurrentProcess() (HANDLE)-1
#define NtGetCurrentThread() (HANDLE)-2
#ifdef _WIN64
#define NtGetPeb() (PPEB)__readgsqword(0x60)
#define NtGetTeb() (PTEB)__readgsqword(0x30)
#define NtGetPid() (uint32_t)__readgsqword(0x40) /* GetCurrentProcessId() */
#define NtGetTid() (uint32_t)__readgsqword(0x48) /* GetCurrentThreadId() */
#define NtGetErr() (uint32_t)__readgsqword(0x68) /* GetLastError()*/
#define _NtGetSeh() (void**)__readgsqword(0x00)
#define _NtGetStackHigh() (void**)__readgsqword(0x08)
#define _NtGetStackLow() (void**)__readgsqword(0x10)
#define _NtGetSubsystemTib() (void**)__readgsqword(0x18)
#define _NtGetFib() (void**)__readgsqword(0x20)
#define _NtGetEnv() (char16_t**)__readgsqword(0x38)
#define _NtGetRpc() (void**)__readgsqword(0x50)
#define _NtGetTls() (void**)__readgsqword(0x58)
#else
#define NtGetPeb() (PPEB)__readfsdword(0x30);
#define NtGetTeb() (PTEB)__readfsdword(0x18)
#define NtGetPid() (uint32_t)__readfsdword(0x20) /* GetCurrentProcessId() */
#define NtGetTid() (uint32_t)__readfsdword(0x24) /* GetCurrentThreadId() */
#define NtGetErr() (uint32_t)__readfsdword(0x34) /* GetLastError()*/
#define _NtGetSeh() (void**)__readfsdword(0x00)
#define _NtGetStackHigh() (void**)__readfsdword(0x04)
#define _NtGetStackLow() (void**)__readfsdword(0x08)
#define _NtGetSubsystemTib() (void**)__readfsdword(0x0C)
#define _NtGetFib() (void**)__readfsdword(0x10)
#define _NtGetEnv() (char16_t**)__readfsdword(0x1C)
#define _NtGetRpc() (void**)__readfsdword(0x28)
#define _NtGetTls() (void**)__readfsdword(0x2C)
#endif
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment