rbmm rbmm
rbmm
/ gist:2b6a788b5d767520c09878e7028a2d8e
Created
February 18, 2025 17:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| PsSetCreateProcessNotifyRoutineEx=0 | |
| PsSetLoadImageNotifyRoutine=0 | |
| 00001 17:38:07 + 13ac(sc.exe) 00007FFEEDED0000{1a000} u \Device\HarddiskVolume9\Windows\System32\kernel.appcore.dll | |
| (::)C:\WINDOWS\SYSTEM32\kernel.appcore.dll | |
| 00002 17:38:07 + 13ac(sc.exe) 00007FFEEFB20000{a9000} u \Device\HarddiskVolume9\Windows\System32\msvcrt.dll | |
| (::)C:\WINDOWS\System32\msvcrt.dll | |
| 1 13ac exit [1]13ac(sc.exe) ================ | |
| 00003 17:38:07 b58(cmd.exe) 00007FFEEDED0000{1a000} u \Device\HarddiskVolume9\Windows\System32\kernel.appcore.dll | |
| (::)C:\WINDOWS\SYSTEM32\kernel.appcore.dll |
rbmm
/ gist:aeb4d3ed288995fcdee6d72763057c56
Created
February 18, 2025 16:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| EXTERN_C_START | |
| NTSYSAPI | |
| NTSTATUS | |
| NTAPI | |
| RtlPrepareForProcessCloning(); | |
| NTSYSAPI | |
| NTSTATUS | |
| NTAPI |
rbmm
/ gist:3d09b53bc3d85523c1a91a326969d06b
Created
February 10, 2025 14:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <ntnls.h> | |
| NTSTATUS MakeProcessUTF8(PVOID hmod, PVOID BaseAddress, SIZE_T ViewSize) | |
| { | |
| UINT AnsiCodePage = GetACP(); | |
| PIMAGE_NT_HEADERS pinth; | |
| NTSTATUS status = RtlImageNtHeaderEx(0, BaseAddress, ViewSize, &pinth); | |
| if (0 > status) | |
| { |
rbmm
/ gist:b0bcd7eb381b84b7616100d79719595b
Created
February 10, 2025 14:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #define RTL_USER_PROC_UTF8_PROCESS 0x08000000 | |
| NTSTATUS SetPtocessUtf8(HANDLE hProcess) | |
| { | |
| PROCESS_BASIC_INFORMATION pbi; | |
| _RTL_USER_PROCESS_PARAMETERS* ProcessParameters; | |
| ULONG Flags; | |
| NTSTATUS status; | |
| 0 <= (status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), 0)) && |
rbmm
/ gist:ffc9125a8f1d3e2536071fa8cd7486b4
Last active
February 6, 2025 17:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| struct IDriverInstallStatusNotify | |
| { | |
| virtual HRESULT STDMETHODCALLTYPE Notify(ULONG s) | |
| { | |
| __debugbreak(); | |
| DbgPrint("Notify(%x)\n", s); | |
| return S_OK; | |
| } | |
| }; |
rbmm
/ gist:4ce18b4fe82f9c5d8187f00658c9dc13
Created
February 5, 2025 21:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 1>------ Build started: Project: prepare, Configuration: Release x64 ------ | |
| 1>stdafx.cpp | |
| 1>Note: including file: C:\Users\Harry\Documents\GitHub\SC_DEMO\prepare\stdafx.h | |
| 1>Note: including file: C:\Users\Harry\Documents\GitHub\SC_DEMO\pnth\pch.h | |
| 1>Note: including file: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km\crt\stdlib.h | |
| 1>Note: including file: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km\crt\crtdefs.h | |
| 1>Note: including file: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\shared\specstrings.h | |
| 1>Note: including file: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\shared\sal.h | |
| 1>Note: including file: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\shared\concurrencysal.h | |
| 1>Note: including file: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\shared\specstrings_strict.h |
rbmm
/ gist:81698ebfc26bccb2ff76b026d8c19a95
Created
February 1, 2025 17:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| enum class PREFERRED_APP_MODE { | |
| Default, | |
| AllowDark, | |
| ForceDark, | |
| ForceLight, | |
| Max | |
| }; | |
| EXTERN_C_START |
rbmm
/ gist:4af7fd2e8c25f4033dcdc41e87c6ca2c
Created
January 29, 2025 01:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| RtlGuardIsValidStackPointer | |
| FFFFF802CD3BD900 test rdx,rdx | |
| FFFFF802CD3BD903 je FFFFF802CD3BD95F v | |
| FFFFF802CD3BD905 mov rax,qword ptr [rdx+1478h] // <-- LowLimit from GetCurrentThreadStackLimits | |
| FFFFF802CD3BD90C mov qword ptr [rsp+20h],rax | |
| FFFFF802CD3BD911 mov rax,qword ptr [rdx+8] // <-- NT_TIB::StackBase | |
| FFFFF802CD3BD915 mov qword ptr [rsp+10h],rax | |
| FFFFF802CD3BD91A mov rax,qword ptr [rdx+10h] // <-- NT_TIB::StackLimit | |
| FFFFF802CD3BD91E mov qword ptr [rsp+18h],rax | |
| FFFFF802CD3BD923 mov rdx,rax |
rbmm
/ gist:7fa3ed48df9637ab6cef30ddb9f88b7c
Created
January 29, 2025 00:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ULONG _G_LowLimit; | |
| NTSTATUS GetStackLimits(HANDLE hThread, PNT_TIB& tib, PVOID& StackBase, PVOID& StackLimit, PVOID& LowStackLimit) | |
| { | |
| if (!_G_LowLimit) | |
| { | |
| return STATUS_NOT_FOUND; | |
| } | |
| THREAD_BASIC_INFORMATION tbi; |
rbmm
/ gist:f28c0b4c67c3ae4b0ab9a8b6b1f7143a
Last active
January 16, 2025 01:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| struct INVERTED_FUNCTION_TABLE_ENTRY | |
| { | |
| PRUNTIME_FUNCTION Table; | |
| PVOID ImageBase; | |
| ULONG ImageSize; | |
| ULONG TableSize; | |
| }; | |
| struct INVERTED_FUNCTION_TABLE | |
| { |