markhc

cmake_minimum_required (VERSION 3.12)

# not strictly needed, but it helps when you forget to pass the CMAKE_TOOLCHAIN_FILE as argument to cmake
if(DEFINED ENV{VCPKG_ROOT} AND NOT DEFINED CMAKE_TOOLCHAIN_FILE)
  set(CMAKE_TOOLCHAIN_FILE
      "$ENV{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake"
      CACHE STRING "")
endif()

project(cmake_example CXX)

markhc

#include "SafeHandles/SafeHandle.hpp"

#include "windows.hpp"

class SafeFileHandle     //
  : public SafeHandle<INVALID_HANDLE_VALUE> //
{
public:
  SafeFileHandle(void* handle)
    : SafeHandle(handle, &SafeFileHandle::deleter) 

markhc

#include "Lexer.hpp"

namespace sage
{
namespace detail
{
// ----------------------------------------------------------------------------
inline char getCharAndAdvance(const char*& ptr)
{
  return *ptr++;

markhc

NTSTATUS KapFindKernelPattern(
    _In_ PUCHAR Pattern,
    _In_ PUCHAR Mask,
    _In_ ULONG  PatternLength,
    _Out_ PVOID* Result
)
{
    PIMAGE_NT_HEADERS       NtHeaders;
    PIMAGE_SECTION_HEADER   FirstSection;
    

markhc

#pragma once

#include <cstdint>
#include <array>
#include <string>

template<typename T, uint32_t D>
class vec
{
public:

markhc

*.yazzn {
    box-sizing: border-box;
}

@media screen and (min-width: 999px) {
    code.hljs.javascript {
        border-radius: 5px;
        max-width: 640px;
        max-width: calc(100vw - 347px);
        max-height: 700px;

markhc

HANDLE get_handle_to_process(LPWSTR process)
{
    HANDLE hProcess = NULL;

    enumerate_handles([&](PSYSTEM_HANDLE_TABLE_ENTRY_INFO handle) {

        if(GetCurrentProcessId() != handle->UniqueProcessId) return STATUS_UNSUCCESSFUL;

        BOOL        found = FALSE;
        PVOID       buffer = NULL;

markhc

NTSTATUS enumerate_handles(ENUM_HANDLE_CALLBACK callback)
{
    NTSTATUS                    status = STATUS_UNSUCCESSFUL;
    PVOID                       buffer = NULL;
    ULONG                       bufferSize = 0;

    do {
        status = NtQuerySystemInformation((SYSTEM_INFORMATION_CLASS)16/*SystemHandleInformation*/, buffer, bufferSize, &bufferSize);
        if(!NT_SUCCESS(status)) {
            if(status == STATUS_INFO_LENGTH_MISMATCH) {

markhc

#include <Windows.h>
#include <Psapi.h>
#include <ntstatus.h>
#include <cstdint>
#include <functional>
#include <Shlwapi.h>
#include <winternl.h>

#pragma comment(lib, "ntdll.lib")
#pragma comment(lib, "Shlwapi.lib")

markhc

NTSTATUS RDrvAddToInvertedFunctionTable(
    VOID
)
{
    NTSTATUS status = STATUS_SUCCESS;
    PRTL_INVERTED_FUNCTION_TABLE pInvertedFunctionTable;
    CONST UCHAR szPattern[]  = "\x89\x74\xCD\x20";
    CONST UCHAR szMask[]     = "xxxx";

    status = RDrvGetKernelInfo(NULL, NULL); //Find kernel base & size