Skip to content

Instantly share code, notes, and snippets.

@wbenny
Last active November 5, 2020 01:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save wbenny/075bbbe260b631e57e9a0e2dcb825088 to your computer and use it in GitHub Desktop.
Save wbenny/075bbbe260b631e57e9a0e2dcb825088 to your computer and use it in GitHub Desktop.
typedef struct _PS_NTDLL_EXPORT_ITEM {
PCSTR RoutineName;
PVOID RoutineAddress;
} PS_NTDLL_EXPORT_ITEM, *PPS_NTDLL_EXPORT_ITEM;
PS_NTDLL_EXPORT_ITEM NtdllExports[] = {
//
// 19 exports on x64
// 14 exports on ARM64
//
};
PVOID PsWowX86SharedInformation[Wow64SharedPageEntriesCount];
PS_NTDLL_EXPORT_ITEM NtdllWowX86Exports[] = {
{ "LdrInitializeThunk",
&PsWowX86SharedInformation[SharedNtdll32LdrInitializeThunk] },
{ "KiUserExceptionDispatcher",
&PsWowX86SharedInformation[SharedNtdll32KiUserExceptionDispatcher] },
{ "KiUserApcDispatcher",
&PsWowX86SharedInformation[SharedNtdll32KiUserApcDispatcher] },
{ "KiUserCallbackDispatcher",
&PsWowX86SharedInformation[SharedNtdll32KiUserCallbackDispatcher] },
{ "RtlUserThreadStart",
&PsWowX86SharedInformation[SharedNtdll32RtlUserThreadStart] },
{ "RtlpQueryProcessDebugInformationRemote",
&PsWowX86SharedInformation[SharedNtdll32pQueryProcessDebugInformationRemote] },
{ "LdrSystemDllInitBlock",
&PsWowX86SharedInformation[SharedNtdll32LdrSystemDllInitBlock] },
{ "RtlpFreezeTimeBias",
&PsWowX86SharedInformation[SharedNtdll32RtlpFreezeTimeBias] },
};
#ifdef _M_ARM64
PVOID PsWowArm32SharedInformation[Wow64SharedPageEntriesCount];
PS_NTDLL_EXPORT_ITEM NtdllWowArm32Exports[] = {
//
// ...
//
};
PVOID PsWowAmd64SharedInformation[Wow64SharedPageEntriesCount];
PS_NTDLL_EXPORT_ITEM NtdllWowAmd64Exports[] = {
//
// ...
//
};
PVOID PsWowChpeX86SharedInformation[Wow64SharedPageEntriesCount];
PS_NTDLL_EXPORT_ITEM NtdllWowChpeX86Exports[] = {
//
// ...
//
};
#endif // _M_ARM64
//
// ...
//
typedef struct _PS_NTDLL_EXPORT_INFORMATION {
PPS_NTDLL_EXPORT_ITEM NtdllExports;
SIZE_T Count;
} PS_NTDLL_EXPORT_INFORMATION, *PPS_NTDLL_EXPORT_INFORMATION;
//
// RTL_NUMBER_OF(NtdllExportInformation)
// == 6
// == (SYSTEM_DLL_TYPE)PsSystemDllTotalTypes
//
PS_NTDLL_EXPORT_INFORMATION NtdllExportInformation[PsSystemDllTotalTypes] = {
{ NtdllExports, RTL_NUMBER_OF(NtdllExports) },
{ NtdllWowX86Exports, RTL_NUMBER_OF(NtdllWowX86Exports) },
#ifdef _M_ARM64
{ NtdllWowArm32Exports, RTL_NUMBER_OF(NtdllWowArm32Exports) },
{ NtdllWowAmd64Exports, RTL_NUMBER_OF(NtdllWowAmd64Exports) },
{ NtdllWowChpeX86Exports, RTL_NUMBER_OF(NtdllWowChpeX86Exports) },
#endif // _M_ARM64
//
// { NULL, 0 } for the rest...
//
};
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment