NTSTATUS mimikatz_initOrClean(BOOL Init) { unsigned short indexModule; PKUHL_M_C_FUNC_INIT function; long offsetToFunc; NTSTATUS fStatus; if(Init) { RtlGetNtVersionNumbers(&MIMIKATZ_NT_MAJOR_VERSION, &MIMIKATZ_NT_MINOR_VERSION, &MIMIKATZ_NT_BUILD_NUMBER); MIMIKATZ_NT_BUILD_NUMBER &= 0x00003fff; offsetToFunc = FIELD_OFFSET(KUHL_M, pInit); } else offsetToFunc = FIELD_OFFSET(KUHL_M, pClean); for(indexModule = 0; indexModule < sizeof(mimikatz_modules) / sizeof(KUHL_M *); indexModule++) { if(function = *(PKUHL_M_C_FUNC_INIT *) ((ULONG_PTR) (mimikatz_modules[indexModule]) + offsetToFunc)) { fStatus = function(); if(!NT_SUCCESS(fStatus)) kprintf(L">>> %s of \'%s\' module failed : %08x\n", (Init ? L"INIT" : L"CLEAN"), mimikatz_modules[indexModule]->shortName, fStatus); } } if(!Init) kull_m_output_file(NULL); return STATUS_SUCCESS; }
BOOL init() { BOOL status = FALSE; RtlGetNtVersionNumbers(&MIMIKATZ_NT_MAJOR_VERSION, &MIMIKATZ_NT_MINOR_VERSION, &MIMIKATZ_NT_BUILD_NUMBER); MIMIKATZ_NT_BUILD_NUMBER &= 0x00003fff; if(g_isAsn1Init = kull_m_kerberos_asn1_helper_init()) if(g_isSockInit = kull_m_sock_startup()) if(g_isKerberos = kull_m_kerberos_helper_init()) status = TRUE; return status; }