From 59cd18360764af6e6133ad11ec9cd8295372e587 Mon Sep 17 00:00:00 2001 From: clymb3r Date: Tue, 1 Oct 2013 09:47:05 -0700 Subject: Adding Invoke-Mimikatz and Invoke-Ninjacopy --- Exfiltration/mimikatz-1.0/driver/notify_image.h | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 Exfiltration/mimikatz-1.0/driver/notify_image.h (limited to 'Exfiltration/mimikatz-1.0/driver/notify_image.h') diff --git a/Exfiltration/mimikatz-1.0/driver/notify_image.h b/Exfiltration/mimikatz-1.0/driver/notify_image.h new file mode 100644 index 0000000..f6e0711 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_image.h @@ -0,0 +1,10 @@ +#pragma once +#include "notify.h" + +#define MAX_NT_PspLoadImageNotifyRoutine 8 + +ULONG * PspLoadImageNotifyRoutineCount; +PVOID * PspLoadImageNotifyRoutine; + +NTSTATUS getPspLoadImageNotifyRoutine(); +NTSTATUS kListNotifyImages(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); -- cgit v1.2.3