Last active
February 26, 2023 12:59
-
-
Save BlackOfWorld/0d1e9f4d4142ced783bf57d597a8dde9 to your computer and use it in GitHub Desktop.
This is just a useful meme
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#define NtGetCurrentProcess() (HANDLE)-1 | |
#define NtGetCurrentThread() (HANDLE)-2 | |
#ifdef _WIN64 | |
#define NtGetPeb() (PPEB)__readgsqword(0x60) | |
#define NtGetTeb() (PTEB)__readgsqword(0x30) | |
#define NtGetPid() (uint32_t)__readgsqword(0x40) /* GetCurrentProcessId() */ | |
#define NtGetTid() (uint32_t)__readgsqword(0x48) /* GetCurrentThreadId() */ | |
#define NtGetErr() (uint32_t)__readgsqword(0x68) /* GetLastError()*/ | |
#define _NtGetSeh() (void**)__readgsqword(0x00) | |
#define _NtGetStackHigh() (void**)__readgsqword(0x08) | |
#define _NtGetStackLow() (void**)__readgsqword(0x10) | |
#define _NtGetSubsystemTib() (void**)__readgsqword(0x18) | |
#define _NtGetFib() (void**)__readgsqword(0x20) | |
#define _NtGetEnv() (char16_t**)__readgsqword(0x38) | |
#define _NtGetRpc() (void**)__readgsqword(0x50) | |
#define _NtGetTls() (void**)__readgsqword(0x58) | |
#else | |
#define NtGetPeb() (PPEB)__readfsdword(0x30); | |
#define NtGetTeb() (PTEB)__readfsdword(0x18) | |
#define NtGetPid() (uint32_t)__readfsdword(0x20) /* GetCurrentProcessId() */ | |
#define NtGetTid() (uint32_t)__readfsdword(0x24) /* GetCurrentThreadId() */ | |
#define NtGetErr() (uint32_t)__readfsdword(0x34) /* GetLastError()*/ | |
#define _NtGetSeh() (void**)__readfsdword(0x00) | |
#define _NtGetStackHigh() (void**)__readfsdword(0x04) | |
#define _NtGetStackLow() (void**)__readfsdword(0x08) | |
#define _NtGetSubsystemTib() (void**)__readfsdword(0x0C) | |
#define _NtGetFib() (void**)__readfsdword(0x10) | |
#define _NtGetEnv() (char16_t**)__readfsdword(0x1C) | |
#define _NtGetRpc() (void**)__readfsdword(0x28) | |
#define _NtGetTls() (void**)__readfsdword(0x2C) | |
#endif |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment