Little-Ki

/* SSDT proxy class */

/*
#pragma pack(1)
struct SYSTEM_SERVICE_TABLE {
	// This pointer points to an array of int
	// In 32 bits mode, this array saves <function's address>.
	// In 64 bits mode, this array saves <(function's address - table's address) << 4>.
	// So we calculate the function's address by this way:
	// In 32 bits mode : function's address = [table's address + 4 * index]

Little-Ki

/* Enum module which in current process */

struct Module_t {
	ULONG64		base;
	ULONG64		size;
	std::string	name;
}

void EnumModule( std::vector<Module_t> & list )
{

Little-Ki

// Enum thread which in process

struct Thread_t {
	ULONG64 tid;
	ULONG64 base;
}

NTSTATUS EnumProcessThread( HANDLE pid, std::vector<Thread_t> & list )
{
	PSYSTEM_PROCESS_INFORMATION	pProcess;