/inc/win_structs.h
https://code.google.com/p/dwarftherapist/ · C Header · 67 lines · 39 code · 6 blank · 22 comment · 0 complexity · 68a7ed3a662482679387fecf14e271d1 MD5 · raw file
- /*
- Dwarf Therapist
- Copyright (c) 2009 Trey Stout (chmod)
-
- Permission is hereby granted, free of charge, to any person obtaining a copy
- of this software and associated documentation files (the "Software"), to deal
- in the Software without restriction, including without limitation the rights
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- copies of the Software, and to permit persons to whom the Software is
- furnished to do so, subject to the following conditions:
-
- The above copyright notice and this permission notice shall be included in
- all copies or substantial portions of the Software.
-
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- THE SOFTWARE.
- */
- #ifndef WIN_STRUCTS_H
- #define WIN_STRUCTS_H
- #include <windows.h>
- #include <ntsecapi.h>
- #include <stdio.h>
-
-
- typedef struct _PEB {
- bool InheritedAddressSpace;
- bool ReadImageFileExecOptions;
- bool BeingDebugged;
- bool Spare;
- HANDLE Mutant;
- PVOID ImageBaseAddress;
- } PEB, *PPEB;
-
- typedef NTSTATUS (NTAPI *_NtQueryInformationProcess)(
- HANDLE ProcessHandle,
- DWORD ProcessInformationClass,
- PVOID ProcessInformation,
- DWORD ProcessInformationLength,
- PDWORD ReturnLength
- );
-
- typedef struct _PROCESS_BASIC_INFORMATION
- {
- DWORD ExitStatus;
- PVOID PebBaseAddress;
- DWORD AffinityMask;
- DWORD BasePriority;
- DWORD UniqueProcessId;
- DWORD ParentProcessId;
- } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
-
- PVOID GetPebAddress(HANDLE ProcessHandle)
- {
- _NtQueryInformationProcess NtQueryInformationProcess =
- (_NtQueryInformationProcess)GetProcAddress(
- GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess");
- PROCESS_BASIC_INFORMATION pbi;
-
- NtQueryInformationProcess(ProcessHandle, 0, &pbi, sizeof(pbi), NULL);
- return pbi.PebBaseAddress;
- }
- #endif // WIN_STRUCTS_H