Panoptes 1.0.0
Endpoint Detection and Response
Loading...
Searching...
No Matches
def.h
Go to the documentation of this file.
1#pragma once
2#include <Winddi.h>
3
17
18#pragma region API Definitions
20typedef NTSTATUS(NTAPI* pNtWriteVirtualMemory)(
21 HANDLE ProcessHandle,
22 PVOID BaseAddress,
23 PVOID Buffer,
24 SIZE_T NumberOfBytesToWrite,
25 PSIZE_T NumberOfBytesWritten
26 );
27
29typedef NTSTATUS(NTAPI* pNtModifyBootEntry)(
30 PBOOT_ENTRY BootEntry
31 );
32
35typedef NTSTATUS(NTAPI* pNtMapViewOfSectionEx)(
36 _In_ HANDLE SectionHandle,
37 _In_ HANDLE ProcessHandle,
38 _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize)
39 _Post_readable_byte_size_(*ViewSize)) PVOID* BaseAddress,
40 _Inout_opt_ PLARGE_INTEGER SectionOffset,
41 _Inout_ PSIZE_T ViewSize,
42 _In_ ULONG AllocationType,
43 _In_ ULONG PageProtection,
44 _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
45 _In_ ULONG ExtendedParameterCount
46 );
47#pragma endregion
NTSTATUS(NTAPI * pNtWriteVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten)
The NtWriteVirtualMemory function writes memory to a specified process.
Definition def.h:20
struct _BOOT_ENTRY BOOT_ENTRY
The BOOT_ENTRY structure represents a boot entry in the boot configuration database....
struct _BOOT_ENTRY * PBOOT_ENTRY
NTSTATUS(NTAPI * pNtModifyBootEntry)(PBOOT_ENTRY BootEntry)
The NtModifyBootEntry function modifies a boot entry in the boot configuration database.
Definition def.h:29
NTSTATUS(NTAPI * pNtMapViewOfSectionEx)(_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle, _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ ULONG AllocationType, _In_ ULONG PageProtection, _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, _In_ ULONG ExtendedParameterCount)
The NtMapViewOfSectionEx function maps a view of a section into the address space of a process.
Definition def.h:35
The BOOT_ENTRY structure represents a boot entry in the boot configuration database....
Definition def.h:7
ULONG FriendlyNameOffset
Definition def.h:12
ULONG Length
Definition def.h:9
ULONG OsOptionsLength
Definition def.h:14
ULONG Attributes
Definition def.h:11
ULONG Version
Definition def.h:8
ULONG BootFilePathOffset
Definition def.h:13
CHAR OsOptions[1]
Definition def.h:15
ULONG Id
Definition def.h:10