Created
February 10, 2025 14:05
-
-
Save rbmm/b0bcd7eb381b84b7616100d79719595b to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#define RTL_USER_PROC_UTF8_PROCESS 0x08000000 | |
NTSTATUS SetPtocessUtf8(HANDLE hProcess) | |
{ | |
PROCESS_BASIC_INFORMATION pbi; | |
_RTL_USER_PROCESS_PARAMETERS* ProcessParameters; | |
ULONG Flags; | |
NTSTATUS status; | |
0 <= (status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), 0)) && | |
0 <= (status = ZwReadVirtualMemory(hProcess, &reinterpret_cast<_PEB*>(pbi.PebBaseAddress)->ProcessParameters, &ProcessParameters, sizeof(ProcessParameters), 0)) && | |
0 <= (status = ZwReadVirtualMemory(hProcess, &ProcessParameters->Flags, &Flags, sizeof(Flags), 0)) && | |
0 <= (status = ZwWriteVirtualMemory(hProcess, &ProcessParameters->Flags, &(Flags |= RTL_USER_PROC_UTF8_PROCESS), sizeof(Flags), 0)); | |
return status; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment