typedef struct _KTHREAD {

  _DISPATCHER_HEADER Header;

  void * SListFaultAddress;

  ULONGLONG QuantumTarget;

  void * InitialStack;

  void * volatile StackLimit;

  void * StackBase;

  ULONGLONG ThreadLock;

  ULONGLONG volatile CycleTime;

  ULONG CurrentRunTime;

  ULONG ExpectedRunTime;

  void * KernelStack;

  _XSAVE_FORMAT * StateSaveArea;

  _KSCHEDULING_GROUP * volatile SchedulingGroup;

  _KWAIT_STATUS_REGISTER WaitRegister;

  UCHAR volatile Running;

  UCHAR Alerted[0x2];

  ULONG AutoBoostActive : 01; // 0x00000001;

  ULONG ReadyTransition : 01; // 0x00000002;

  ULONG WaitNext : 01; // 0x00000004;

  ULONG SystemAffinityActive : 01; // 0x00000008;

  ULONG Alertable : 01; // 0x00000010;

  ULONG UserStackWalkActive : 01; // 0x00000020;

  ULONG ApcInterruptRequest : 01; // 0x00000040;

  ULONG QuantumEndMigrate : 01; // 0x00000080;

  ULONG UmsDirectedSwitchEnable : 01; // 0x00000100;

  ULONG TimerActive : 01; // 0x00000200;

  ULONG SystemThread : 01; // 0x00000400;

  ULONG ProcessDetachActive : 01; // 0x00000800;

  ULONG CalloutActive : 01; // 0x00001000;

  ULONG ScbReadyQueue : 01; // 0x00002000;

  ULONG ApcQueueable : 01; // 0x00004000;

  ULONG ReservedStackInUse : 01; // 0x00008000;

  ULONG UmsPerformingSyscall : 01; // 0x00010000;

  ULONG TimerSuspended : 01; // 0x00020000;

  ULONG SuspendedWaitMode : 01; // 0x00040000;

  ULONG SuspendSchedulerApcWait : 01; // 0x00080000;

  ULONG CetUserShadowStack : 01; // 0x00100000;

  ULONG BypassProcessFreeze : 01; // 0x00200000;

  ULONG Reserved : 10; // 0xffc00000;

  LONG MiscFlags;

  ULONG BamQosLevel : 02; // 0x00000003;

  ULONG AutoAlignment : 01; // 0x00000004;

  ULONG DisableBoost : 01; // 0x00000008;

  ULONG AlertedByThreadId : 01; // 0x00000010;

  ULONG QuantumDonation : 01; // 0x00000020;

  ULONG EnableStackSwap : 01; // 0x00000040;

  ULONG GuiThread : 01; // 0x00000080;

  ULONG DisableQuantum : 01; // 0x00000100;

  ULONG ChargeOnlySchedulingGroup : 01; // 0x00000200;

  ULONG DeferPreemption : 01; // 0x00000400;

  ULONG QueueDeferPreemption : 01; // 0x00000800;

  ULONG ForceDeferSchedule : 01; // 0x00001000;

  ULONG SharedReadyQueueAffinity : 01; // 0x00002000;

  ULONG FreezeCount : 01; // 0x00004000;

  ULONG TerminationApcRequest : 01; // 0x00008000;

  ULONG AutoBoostEntriesExhausted : 01; // 0x00010000;

  ULONG KernelStackResident : 01; // 0x00020000;

  ULONG TerminateRequestReason : 02; // 0x000c0000;

  ULONG ProcessStackCountDecremented : 01; //   0x00100000;

  ULONG RestrictedGuiThread : 01; // 0x00200000;

  ULONG VpBackingThread : 01; // 0x00400000;

  ULONG ThreadFlagsSpare : 01; // 0x00800000;

  ULONG EtwStackTraceApcInserted : 08; // 0xff000000;

  LONG volatile ThreadFlags;

  UCHAR volatile Tag;

  UCHAR SystemHeteroCpuPolicy;

  UCHAR UserHeteroCpuPolicy : 07; // 0x7f;

  UCHAR ExplicitSystemHeteroCpuPolicy : 01; // 0x80;

  UCHAR RunningNonRetpolineCode : 01; // 0x01;

  UCHAR SpecCtrlSpare : 07; // 0xfe;

  UCHAR SpecCtrl;

  ULONG SystemCallNumber;

  ULONG ReadyTime;

  void * FirstArgument;

  _KTRAP_FRAME * TrapFrame;

  _KAPC_STATE ApcState;

  UCHAR ApcStateFill[0x2b];

  CHAR Priority;

  ULONG UserIdealProcessor;

  LONGLONG volatile WaitStatus;

  _KWAIT_BLOCK * WaitBlockList;

  _LIST_ENTRY WaitListEntry;

  _SINGLE_LIST_ENTRY SwapListEntry;

  _DISPATCHER_HEADER * volatile Queue;

  void * Teb;

  ULONGLONG RelativeTimerBias;

  _KTIMER Timer;

  _KWAIT_BLOCK WaitBlock[0x4];

  UCHAR WaitBlockFill4[0x14];

  ULONG ContextSwitches;

  UCHAR WaitBlockFill5[0x44];

  UCHAR volatile State;

  CHAR Spare13;

  UCHAR WaitIrql;

  CHAR WaitMode;

  UCHAR WaitBlockFill6[0x74];

  ULONG WaitTime;

  UCHAR WaitBlockFill7[0xa4];

  SHORT KernelApcDisable;

  SHORT SpecialApcDisable;

  ULONG CombinedApcDisable;

  UCHAR WaitBlockFill8[0x28];

  _KTHREAD_COUNTERS * ThreadCounters;

  UCHAR WaitBlockFill9[0x58];

  _XSTATE_SAVE * XStateSave;

  UCHAR WaitBlockFill10[0x88];

  void * volatile Win32Thread;

  UCHAR WaitBlockFill11[0xb0];

  _UMS_CONTROL_BLOCK * Ucb;

  _KUMS_CONTEXT_HEADER * volatile Uch;

  void * Spare21;

  _LIST_ENTRY QueueListEntry;

  ULONG volatile NextProcessor;

  ULONG NextProcessorNumber : 31; // 0x7fffffff;

  ULONG SharedReadyQueue : 01; // 0x80000000;

  LONG QueuePriority;

  _KPROCESS * Process;

  _GROUP_AFFINITY UserAffinity;

  UCHAR UserAffinityFill[0xa];

  CHAR PreviousMode;

  CHAR BasePriority;

  CHAR PriorityDecrement;

  UCHAR ForegroundBoost : 04; // 0x0f;

  UCHAR UnusualBoost : 04; // 0xf0;

  UCHAR Preempted;

  UCHAR AdjustReason;

  CHAR AdjustIncrement;

  ULONGLONG AffinityVersion;

  _GROUP_AFFINITY Affinity;

  UCHAR AffinityFill[0xa];

  UCHAR ApcStateIndex;

  UCHAR WaitBlockCount;

  ULONG IdealProcessor;

  ULONGLONG NpxState;

  _KAPC_STATE SavedApcState;

  UCHAR SavedApcStateFill[0x2b];

  UCHAR WaitReason;

  CHAR SuspendCount;

  CHAR Saturation;

  USHORT SListFaultCount;

  _KAPC SchedulerApc;

  UCHAR SchedulerApcFill0[0x1];

  UCHAR ResourceIndex;

  UCHAR SchedulerApcFill1[0x3];

  UCHAR QuantumReset;

  UCHAR SchedulerApcFill2[0x4];

  ULONG KernelTime;

  UCHAR SchedulerApcFill3[0x40];

  _KPRCB * volatile WaitPrcb;

  UCHAR SchedulerApcFill4[0x48];

  void * LegoData;

  UCHAR SchedulerApcFill5[0x53];

  UCHAR CallbackNestingLevel;

  ULONG UserTime;

  _KEVENT SuspendEvent;

  _LIST_ENTRY ThreadListEntry;

  _LIST_ENTRY MutantListHead;

  UCHAR AbEntrySummary;

  UCHAR AbWaitEntryCount;

  UCHAR AbAllocationRegionCount;

  CHAR SystemPriority;

  ULONG SecureThreadCookie;

  _KLOCK_ENTRY LockEntries[0x6];

  _SINGLE_LIST_ENTRY PropagateBoostsEntry;

  _SINGLE_LIST_ENTRY IoSelfBoostsEntry;

  UCHAR PriorityFloorCounts[0x10];

  ULONG PriorityFloorSummary;

  LONG volatile AbCompletedIoBoostCount;

  LONG volatile AbCompletedIoQoSBoostCount;

  SHORT volatile KeReferenceCount;

  UCHAR AbOrphanedEntrySummary;

  UCHAR AbOwnedEntryCount;

  ULONG ForegroundLossTime;

  _LIST_ENTRY GlobalForegroundListEntry;

  _SINGLE_LIST_ENTRY ForegroundDpcStackListEntry;

  ULONGLONG InGlobalForegroundList;

  LONGLONG ReadOperationCount;

  LONGLONG WriteOperationCount;

  LONGLONG OtherOperationCount;

  LONGLONG ReadTransferCount;

  LONGLONG WriteTransferCount;

  LONGLONG OtherTransferCount;

  _KSCB * QueuedScb;

  ULONG volatile ThreadTimerDelay;

  LONG volatile ThreadFlags2;

  ULONG PpmPolicy : 02; // 0x00000003;

  ULONG ThreadFlags2Reserved : 30; // 0xfffffffc;

  ULONGLONG TracingPrivate[0x1];

  void * SchedulerAssist;

  void * volatile AbWaitObject;

}KTHREAD, *PKTHREAD;

#ifndef _WIN64

#error Showing this for 64-bit builds only!

#endif

LONG gFlags;

PDRIVER_OBJECT g_DriverObject;

enum{

  flImageNotifySet,

};

extern "C" NTSTATUS NTAPI DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)

{

  g_DriverObject = DriverObject;

  DriverObject->DriverUnload = DriverUnload;

  NTSTATUS status = PsSetLoadImageNotifyRoutine(OnLoadImage);

  if (0 <= status)

  {

    _bittestandset(&gFlags, flImageNotifySet);

  }

  return status;

}

void NTAPI DriverUnload(PDRIVER_OBJECT DriverObject)

{

  FreeLoadImageData();

}

void FreeLoadImageData()

{

  if (_bittestandreset(&gFlags, flImageNotifySet)) PsRemoveLoadImageNotifyRoutine(OnLoadImage);

}

VOID CALLBACK OnLoadImage(

            IN PUNICODE_STRING FullImageName,

            IN HANDLE ProcessId, // Process where image is mapped

            IN PIMAGE_INFO ImageInfo

            )

{

  STATIC_UNICODE_STRING(kernel32, "\\kernel32.dll");

  if (

    !ImageInfo->SystemModeImage &&

    ProcessId == PsGetCurrentProcessId() &&   // section can be "remotely" mapped from another process

    SuffixUnicodeString(FullImageName, &kernel32) &&

    IsByLdrLoadDll(&kernel32)

    )

  {

    BeginInject(&NATIVE_DLL::di);

  }

}

VOID CALLBACK RundownRoutine(PKAPC );

VOID CALLBACK KernelRoutine(PKAPC , PKNORMAL_ROUTINE *, PVOID * , PVOID * ,PVOID * );

VOID CALLBACK NormalRoutine(PVOID , PVOID ,PVOID );

void BeginInject(DLL_INFORMATION* pdi)

{

  PVOID Section;

  if (0 <= pdi->GetSection(&Section))

  {

    if (PKAPC Apc = ExAllocatePool(NonPagedPool, sizeof(KAPC)))

    {

      KeInitializeApc(Apc, KeGetCurrentThread(), OriginalApcEnvironment,

        KernelRoutine, RundownRoutine, NormalRoutine, KernelMode, Apc);

      ObfReferenceObject(g_DriverObject);

      ObfReferenceObject(Section);

      if (!KeInsertQueueApc(Apc, Section, pdi, IO_NO_INCREMENT))

      {

        ObfDereferenceObject(Section);

        RundownRoutine(Apc);

      }

    }

  }

}

extern "C" NTSYSAPI BOOLEAN NTAPI KeTestAlertThread(IN KPROCESSOR_MODE  AlertMode);

VOID CALLBACK _NormalRoutine (

              PKAPC Apc,

              PVOID Section,

              DLL_INFORMATION* pdi

              )

{

  PVOID BaseAddress;

  NTSTATUS status = pdi->MapSection(BaseAddress);

  ObfDereferenceObject(Section);

  if (0 <= status)

  {

    union {

      PVOID pvNormalRoutine;

      PKNORMAL_ROUTINE NormalRoutine;

    };

    PVOID NormalContext = BaseAddress;

    pvNormalRoutine = (PBYTE)BaseAddress + pdi->rva_1;

    if (pdi == &WOW_DLL::di) PsWrapApcWow64Thread(&NormalContext, &pvNormalRoutine);

    KeInitializeApc(Apc, KeGetCurrentThread(), OriginalApcEnvironment,

      KernelRoutine, RundownRoutine, NormalRoutine, UserMode, NormalContext);

    ObfReferenceObject(g_DriverObject);

    if (KeInsertQueueApc(Apc, NtCurrentProcess(), BaseAddress, IO_NO_INCREMENT))

    {

      //Force user-mode APC callback

      KeTestAlertThread(UserMode);

      return;

    }

    ObfDereferenceObject(g_DriverObject);

    MmUnmapViewOfSection(IoGetCurrentProcess(), BaseAddress);

  }

  _RundownRoutine(Apc);

}

VOID CALLBACK _KernelRoutine(

               PKAPC Apc,

               PKNORMAL_ROUTINE * /*NormalRoutine*/,

               PVOID * /*NormalContext*/,

               PVOID * /*SystemArgument1*/,

               PVOID * /*SystemArgument2*/

               )

{

  if (Apc->ApcMode == KernelMode)

  {

    //Kernel-mode APC

    ObfReferenceObject(g_DriverObject);   //NormalRoutine will be called

    return;

  }

  //User-mode APC -> free Apc object

  _RundownRoutine(Apc);

}

VOID CALLBACK _RundownRoutine(PKAPC Apc)

{

  ExFreePool(Apc);

}

typedef struct _ACTIVATION_CONTEXT_BASIC_INFORMATION {

  HANDLE  hActCtx;

  DWORD   dwFlags;

} ACTIVATION_CONTEXT_BASIC_INFORMATION, *PACTIVATION_CONTEXT_BASIC_INFORMATION;

DWORD QueueUserAPC(PAPCFUNC pfnAPC, HANDLE hThread, ULONG_PTR dwData)

{

  ACTIVATION_CONTEXT_BASIC_INFORMATION ContextInfo = {};

  NTSTATUS status = RtlQueryInformationActivationContext(

            1,    //RTL_QUERY_ACTIVATION_CONTEXT_FLAG_USE_ACTIVE_ACTIVATION_CONTEXT,

            NULL,

            NULL,

            1,    //ActivationContextBasicInformation,

            &ContextInfo,

            sizeof(ContextInfo),

            NULL);

  if(FAILED(status))

  {

    BaseSetLastNTError(status);

    return FALSE;

  }

  status = ZwQueueApcThread(hThread, RtlDispatchAPC, pfnAPC, dwData,

        !(ContextInfo.dwFlags & 1) ? ContextInfo.hActCtx : INVALID_HANDLE_VALUE);

  if(FAILED(status))

  {

    BaseSetLastNTError(status);

    return FALSE;

  }

  return TRUE;

}

typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME

{

  PRTL_ACTIVATION_CONTEXT_STACK_FRAME Previous;

  _ACTIVATION_CONTEXT * ActivationContext;

  ULONG Flags;

} RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME;

typedef struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED

{

  SIZE_T Size;

  ULONG Format;

  RTL_ACTIVATION_CONTEXT_STACK_FRAME Frame;

  PVOID Extra1;

  PVOID Extra2;

  PVOID Extra3;

  PVOID Extra4;

} RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED,

 *PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED;

void RtlDispatchAPC(PAPCFUNC pfnAPC, ULONG_PTR dwData, HANDLE hActCtx)

{

  RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActEx = {};

  ActEx.Size = sizeof(ActEx);

  ActEx.Format = 1;

  if(hActCtx != INVALID_HANDLE_VALUE)

  {

    RtlActivateActivationContextUnsafeFast(&ActEx, hActCtx);

    pfnAPC(dwData);

    RtlDeactivateActivationContextUnsafeFast(&ActEx);

    RtlReleaseActivationContext(hActCtx);

  }

  else

    pfnAPC(dwData);

}

  {

    //Check that we don't have an activation context yet

    QueryCtx();

    //Set our activation context for this process

    ULONG_PTR dwCookie;

    if (ActivateActCtx(hActCtx, &dwCookie))

    {

      //Check that we have an activation context now

      QueryCtx();

      //Queue APC in this process on this thread

      QueueUserAPC(OnApc, GetCurrentThread(), 0);

      //Make APC callback execute now

      ZwTestAlert();    //same as: SleepEx(0, TRUE);

      //Queue APC in a remote process (using native API)

      //It will succeed

      TestAPC_InRemoteProcess(true);

      //Queue APC in a remote process (using Win32 API)

      //It will crash the remote process!

      TestAPC_InRemoteProcess(false);

      DeactivateActCtx(0, dwCookie);

    }

    ReleaseActCtx(hActCtx);

  }

  return 0;

}

void TestAPC_InRemoteProcess(bool bUseNativeApi)

{

  //Invoke a user-mode APC callback in a remote process

  //Get path to cmd.exe

  WCHAR appname[MAX_PATH];

  if (GetEnvironmentVariableW(L"comspec", appname, _countof(appname)))

  {

    PROCESS_INFORMATION pi;

    STARTUPINFO si = { sizeof(si) };

    //Run cmd.exe suspended

    if (CreateProcessW(appname, 0, 0, 0, 0, CREATE_SUSPENDED, 0, 0, &si, &pi))

    {

      //Invoke APC in cmd.exe, using either a native or documented Win32 function

      //We don't care about the callback function itself, for as long as it can

      //handle our input parameters. Thus I will use LPVOID TlsGetValue(DWORD)

      bUseNativeApi

        ? ZwQueueApcThread(pi.hThread, (PKNORMAL_ROUTINE)TlsGetValue, 0, 0, 0)

        : QueueUserAPC((PAPCFUNC)TlsGetValue, pi.hThread, 0);

      //Resume thread to let APC execute

      ResumeThread(pi.hThread);

      CloseHandle(pi.hThread);

      CloseHandle(pi.hProcess);

    }

  }

}

void QueryCtx()

{

  //Query activation context in this process and output it into (debugger) console

  SIZE_T cb = 0;

  ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION acrli;

  union {

    PVOID buf;

    PACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION pacadi;

  };

  buf = 0;

  ACTIVATION_CONTEXT_QUERY_INDEX QueryIndex = { 1, 0 };

__again:

  switch (QueryActCtxW(QUERY_ACTCTX_FLAG_USE_ACTIVE_ACTCTX, 0, &QueryIndex,

    AssemblyDetailedInformationInActivationContext, buf, cb, &cb) ? NOERROR : GetLastError())

  {

  case ERROR_INSUFFICIENT_BUFFER:

    buf = alloca(cb);

    goto __again;

    break;

  case NOERROR:

    if (buf)

    {

      DbgPrint("==========\nPID=%u: %S\n%S\n",

        GetCurrentProcessId(),

        pacadi->lpAssemblyManifestPath,

        pacadi->lpAssemblyEncodedAssemblyIdentity);

    }

    break;

  }

  if (QueryActCtxW(QUERY_ACTCTX_FLAG_USE_ACTIVE_ACTCTX, 0, 0,

    RunlevelInformationInActivationContext, &acrli, sizeof(acrli), &cb))

  {

    DbgPrint("PID=%u: RunLevel = %x\n", GetCurrentProcessId(), acrli.RunLevel);

  }

}

VOID NTAPI OnApc(

  _In_ ULONG_PTR /*Parameter*/

)

{

  //User-mode APC callback

  QueryCtx();

}

NTSTATUS CollectModules(HANDLE hProcess, BOOL b64bit, NTDLL_FN_PTRS* pfnPtrs)

{

  //INFO: It is not the most efficient way of calling this function twice with

  //      repeated creation of the section and then mapping it into a process.

  //      Ideally, you'd create it once and then close and re-create it ONLY if its

  //      original size is too small to fit all the modules.

  //

  //      But, I will leave this code as-is for brevity, as such optimization

  //      has nothing to do with the APC concepts that we discuss in this blog post.

  NTSTATUS status;

  HANDLE hThread = NULL;

  BYTE* pThisBaseAddr = NULL;

  SIZE_T ViewSize = 0;

  ULONG uiRealSize = 0;

  PRTL_PROCESS_MODULES pRPMs = NULL;

  PRTL_PROCESS_MODULES32 pRPMs32 = NULL;

  HANDLE hSection = NULL;

  LARGE_INTEGER liSectionSize = {};

  PVOID pBaseAddr = NULL;

  ULONG szBufferSz = 0;

  bool bExportSuppression = false;

  bool bDone = false;

  typedef NTSTATUS(CALLBACK PFN_PTR)(HANDLE hThread,

    PKNORMAL_ROUTINE ApcRoutine,

    PVOID ApcContext,

    PVOID Argument1,

    PVOID Argument2);

  PFN_PTR* pQueueAPC;

  assert(pfnPtrs);

  assert(pfnPtrs->pLdrQueryProcessModuleInformation.pfn);

  assert(pfnPtrs->pRtlExitUserThread.pfn);

  //Assume 8 memory pages as the original section size

  SYSTEM_INFO si = {};

  GetSystemInfo(&si);

  szBufferSz = si.dwPageSize * 8;

  assert(szBufferSz);

  //See if export suppression is enabled in Control Flow Guard (CFG) for the target process

  //INFO: If so, we need to enable our thread's EP function and APC callback for CFG,

  //      since calling them otherwise will crash the target process as a security measure!

  status = IsExportSuppressionEnabled(hProcess, &bExportSuppression);

  if (FAILED(status))

    goto cleanup;

  if (bExportSuppression)

  {

    //Enable our function pointers for CFG in the process

    status = SetValidExport(hProcess, pfnPtrs->pRtlExitUserThread.pfn);

    if (FAILED(status))

      goto cleanup;

    status = SetValidExport(hProcess, pfnPtrs->pLdrQueryProcessModuleInformation.pfn);

    if (FAILED(status))

      goto cleanup;

  }

  while (!bDone)

  {

    bDone = true;

    liSectionSize.QuadPart = szBufferSz;

    //Create section

    assert(!hSection);

    status = NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, &liSectionSize, PAGE_READWRITE, SEC_COMMIT, 0);

    if (FAILED(status))

      goto cleanup;

    assert(!pBaseAddr);

    pBaseAddr = NULL;

    ViewSize = 0;

    //Map section into target process for writing

    status = ZwMapViewOfSection(hSection, hProcess, &pBaseAddr, 0, 0, NULL, &ViewSize, ViewShare, 0, PAGE_READWRITE);

    if (FAILED(status))

      goto cleanup;

    //Create remote thread in the target process (and shunt it to RtlExitUserThread)

    //Ensure that the thread is created suspended!

    assert(!hThread);

    status = RtlCreateUserThread(hProcess, NULL, TRUE, 0, 0, 0, pfnPtrs->pRtlExitUserThread.pfn, NULL, &hThread, NULL);

    if (FAILED(status))

      goto cleanup;

    //(Optional call)

    //INFO: Notifications about creation and termination of this thread will not be passed to an attached debugger.

    //      And, exceptions in such thread will not be passed to a debugger either.

    NtSetInformationThread(hThread, ThreadHideFromDebugger, 0, 0);

    //Pick which APC function to use (depending on the bitness)

    pQueueAPC = b64bit ? ZwQueueApcThread : RtlQueueApcWow64Thread;

    //We'll reserve last ULONG in our buffer for LdrQueryProcessModuleInformation to return its RequiredSize

    status = pQueueAPC(hThread,

      (PKNORMAL_ROUTINE)pfnPtrs->pLdrQueryProcessModuleInformation.pfn,

      pBaseAddr,

      (PVOID)(szBufferSz - sizeof(ULONG)),

      (BYTE*)pBaseAddr + szBufferSz - sizeof(ULONG));

    if (FAILED(status))

      goto cleanup;

    //Let our APC callback and the thread itself run

    if (ResumeThread(hThread) != 1)

    {

      status = GetLastError();

      goto cleanup;

    }

    //Wait for the thread to finish

    if (WaitForSingleObject(hThread, INFINITE) != WAIT_OBJECT_0)

    {

      status = GetLastError();

      goto cleanup;

    }

    //Unmap the section from the target process

    status = ZwUnmapViewOfSection(hProcess, pBaseAddr);

    if (FAILED(status))

      goto cleanup;

    pBaseAddr = NULL;

    assert(!pThisBaseAddr);

    pThisBaseAddr = NULL;

    ViewSize = 0;

    //Map the same section into our own process so that we can read it

    status = ZwMapViewOfSection(hSection, GetCurrentProcess(),

          (PVOID*)&pThisBaseAddr, 0, 0, NULL, &ViewSize, ViewShare, 0, PAGE_READONLY);

    if (FAILED(status))

      goto cleanup;

    assert(ViewSize <= szBufferSz);

    //Check if the size of the section that we assumed earlier was enough to fill in all modules

    uiRealSize = *(ULONG*)(pThisBaseAddr + szBufferSz - sizeof(ULONG));

    if (uiRealSize <= szBufferSz)

    {

      //Unfortunately we cannot check the return value from the LdrQueryProcessModuleInformation() call. Here's why:

      //The LdrQueryProcessModuleInformation() function is called from an APC callback, and by the time

      //our remote thread gets to calling RtlExitUserThread() its context will be restored by a call to ntdll!NtContinue()

      if (b64bit)

      {

        //64-bit modules

        pRPMs = (PRTL_PROCESS_MODULES)pThisBaseAddr;

        ULONG nNumberOfModules = pRPMs->NumberOfModules;

        //Check that we have at least one module loaded, otherwise it's an error

        if (!nNumberOfModules)

        {

          status = STATUS_PROCEDURE_NOT_FOUND;

          goto cleanup;

        }

        //Output results to the console

        wprintf(L"64-bit Modules (%u):\n",        nNumberOfModules);

        RTL_PROCESS_MODULE_INFORMATION* pPMI = pRPMs->Modules;

        do

        {

          printf("%p sz=%08X flg=%08X Ord=%02X %s\n"

            ,

            pPMI->ImageBase,

            pPMI->ImageSize,

            pPMI->Flags,

            pPMI->InitOrderIndex,

            pPMI->FullPathName

          );

        }

        while (pPMI++, --nNumberOfModules);

      }

      else

      {

        //32-bit modules

        pRPMs32 = (PRTL_PROCESS_MODULES32)pThisBaseAddr;

        ULONG nNumberOfModules = pRPMs32->NumberOfModules;

        //Check that we have at least one module loaded, otherwise it's an error

        if (!nNumberOfModules)

        {

          status = STATUS_PROCEDURE_NOT_FOUND;

          goto cleanup;

        }

        //Output results to the console

        wprintf(L"32-bit Modules (%u):\n", nNumberOfModules);

        RTL_PROCESS_MODULE_INFORMATION* pPMI32 = pRPMs32->Modules;

        do

        {

          printf("%08X sz=%08X flg=%08X Ord=%02X %s\n"

            ,

            pPMI32->ImageBase,

            pPMI32->ImageSize,

            pPMI32->Flags,

            pPMI32->InitOrderIndex,

            pPMI32->FullPathName

          );

        }

        while (pPMI32++, --nNumberOfModules);

      }

      status = STATUS_SUCCESS;

    }

    else

    {

      //Need more memory - allocate it on a page boundary

      if (uiRealSize % si.dwPageSize)

      {

        szBufferSz = uiRealSize / si.dwPageSize;

        szBufferSz++;

        szBufferSz *= si.dwPageSize;

      }

      else

        szBufferSz = uiRealSize;

      //Retry

      bDone = false;

    }

cleanup:

    //Clean-up

    if (pBaseAddr)

    {

      ZwUnmapViewOfSection(GetCurrentProcess(), pBaseAddr);

      pBaseAddr = NULL;

    }

    if (pThisBaseAddr)

    {

      ZwUnmapViewOfSection(GetCurrentProcess(), pThisBaseAddr);

      pThisBaseAddr = NULL;

    }

    if (hSection)

    {

      ZwClose(hSection);

      hSection = NULL;

    }

    if (hThread)

    {

      ZwClose(hThread);

      hThread = NULL;

    }

  }

  return status;

}

NTSTATUS ResolveNtDllFuncs32bit(NTDLL_FN_PTRS* pfnPtrs)

{

  NTSTATUS status;

  HANDLE hSection;

  SECTION_IMAGE_INFORMATION sii;

  PVOID pBaseAddr = NULL;

  SIZE_T ViewSize = 0;

  //We'll need the special 32-bit image section for ntdll.dll

  static const WCHAR oa_ntdll_str[] = L"\\KnownDlls32\\ntdll.dll";

  static const UNICODE_STRING oa_ntdll_ustr = { sizeof(oa_ntdll_str) - sizeof((oa_ntdll_str)[0]), sizeof(oa_ntdll_str), const_cast<PWSTR>(oa_ntdll_str) };

  static OBJECT_ATTRIBUTES oa_ntdll = { sizeof(oa_ntdll), 0, const_cast<PUNICODE_STRING>(&oa_ntdll_ustr), OBJ_CASE_INSENSITIVE };

  pfnPtrs->pLdrQueryProcessModuleInformation.pfn = NULL;

  pfnPtrs->pRtlExitUserThread.pfn = NULL;

  status = ZwOpenSection(&hSection, SECTION_QUERY | SECTION_MAP_READ, &oa_ntdll);

  if (FAILED(status))

    goto cleanup;

  status = ZwQuerySection(hSection,   SectionImageInformation, &sii, sizeof(sii), 0);

  if (FAILED(status))

    goto cleanup;

  status = ZwMapViewOfSection(hSection, GetCurrentProcess(), &pBaseAddr, 0, 0, 0, &ViewSize, ViewUnmap, 0, PAGE_READONLY);

  if (FAILED(status))

    goto cleanup;

  __try

  {

    //We will have to parse PE structure manually

    //(Remember, the image section here is of a different bitness than our own process!)

    if (PIMAGE_NT_HEADERS32 pinth = (PIMAGE_NT_HEADERS32)RtlImageNtHeader(pBaseAddr))

    {

      //We'll do a really quick-and-dirty parsing here ...

      status = ResolveModuleExports((PBYTE)sii.TransferAddress - pinth->OptionalHeader.AddressOfEntryPoint,

      pBaseAddr, (EXPORT_ENTRY *)pfnPtrs, 2);

    }

    else

      status = STATUS_BAD_FILE_TYPE;

  }

  __except (EXCEPTION_EXECUTE_HANDLER)

  {

    //Catch exceptions in case the section is not a valid PE file

    status = STATUS_BAD_DATA;

  }

cleanup:

  //Clean-up

  if (pBaseAddr)

    ZwUnmapViewOfSection(GetCurrentProcess(), pBaseAddr);

  if(hSection)

    ZwClose(hSection);

  return status;

}

NTSTATUS ResolveModuleExports(PVOID ImageBase, PVOID pBaseAddr, EXPORT_ENTRY* pfnExports, int nCntExports)

{

  //Resolve exported functions by their names provided in 'pfnExports', using the image section mapped in memory

  NTSTATUS status;

  ULONG exportSize, exportRVA;

  ULONG NumberOfFunctions;

  ULONG NumberOfNames;

  ULONG OrdinalBase;

  PULONG AddressOfFunctions;

  PULONG AddressOfNames;

  PWORD AddressOfNameOrdinals;

  PIMAGE_EXPORT_DIRECTORY pied = (PIMAGE_EXPORT_DIRECTORY)

    RtlImageDirectoryEntryToData(pBaseAddr, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &exportSize);

  if (!pied)

  {

    status = STATUS_INVALID_IMAGE_FORMAT;

    goto cleanup;

  }

  exportRVA = RtlPointerToOffset(pBaseAddr, pied);

  NumberOfFunctions = pied->NumberOfFunctions;

  if (!NumberOfFunctions)

  {

    status = STATUS_SOURCE_ELEMENT_EMPTY;

    goto cleanup;

  }

  NumberOfNames = pied->NumberOfNames;

  OrdinalBase = pied->Base;

  AddressOfFunctions = (PULONG)RtlOffsetToPointer(pBaseAddr, pied->AddressOfFunctions);

  AddressOfNames = (PULONG)RtlOffsetToPointer(pBaseAddr, pied->AddressOfNames);

  AddressOfNameOrdinals = (PWORD)RtlOffsetToPointer(pBaseAddr, pied->AddressOfNameOrdinals);

  status = STATUS_SUCCESS;

  for (EXPORT_ENTRY* pEnd = pfnExports + nCntExports; pfnExports < pEnd; pfnExports++)

  {

    ULONG i;

    PCSTR Name = pfnExports->pstrName;

    assert(*Name != '#'); //Can't process ordinals

    //Match each export by name

    i = GetNameOrdinal(pBaseAddr, AddressOfNames, NumberOfNames, Name);

    if (i == UINT_MAX)

    {

      status = STATUS_OBJECT_NAME_NOT_FOUND;

      break;

    }

    if (i < NumberOfNames)

      i = AddressOfNameOrdinals[i];

    if (i >= NumberOfFunctions)

    {

      status = STATUS_FOUND_OUT_OF_SCOPE;

      break;

    }

    DWORD Rva = AddressOfFunctions[i];

    if ((ULONG_PTR)Rva - (ULONG_PTR)exportRVA >=    exportSize)

    {

      (FARPROC&)pfnExports->pfn = (FARPROC)RtlOffsetToPointer(ImageBase, Rva);

    }

    else

    {

      //For brevity, we won't handle forwarded function exports ...

      //(This has nothing to do with the subject of this blog post.)

      status = STATUS_ILLEGAL_FUNCTION;

      break;

    }

  }

cleanup:

  //Clean-up process

  return status;

}

ULONG GetNameOrdinal(PVOID pBaseAddr, PDWORD AddressOfNames, DWORD NumberOfNames, PCSTR Name)

{

  //Resolve ordinal index by a function name

  //RETURN:

  //    Such index, or

  //    UINT_MAX if error

  if (NumberOfNames)

  {

    DWORD a = 0;

    do

    {

      int u = (a + NumberOfNames) >> 1;

      PCSTR pNm = RtlOffsetToPointer(pBaseAddr, AddressOfNames[u]);

      int i = strcmp(pNm, Name);

      if (!i)

      {

        return u;

      }

      0 > i ? a = u + 1 : NumberOfNames = u;

    } while (a < NumberOfNames);

  }

  //Name was not found

  return UINT_MAX;

}

NTSTATUS IsExportSuppressionEnabled(HANDLE hProcess, bool* enabled)

{

  //Checks if CFG with export suppression is enabled for 'hProcess' and returns it in 'enabled'

  //The 'hProcess' handle must be opened with the PROCESS_QUERY_INFORMATION permission flag

  struct PROCESS_MITIGATION {

    PROCESS_MITIGATION_POLICY Policy;

    ULONG Flags;

  };

  bool bEnabled = false;

  PROCESS_MITIGATION m = { ProcessControlFlowGuardPolicy };

  NTSTATUS status = NtQueryInformationProcess(hProcess, ProcessMitigationPolicy, &m, sizeof(m), 0);

  if (SUCCEEDED(status))

  {

    PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY* pCFG = (PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY*)&m.Flags;

    bEnabled = pCFG->EnableControlFlowGuard &&

      pCFG->EnableExportSuppression;

  }

  if(enabled)

    *enabled = bEnabled;

  return status;

}

#pragma comment(lib, "mincore.lib")

NTSTATUS SetValidExport(HANDLE hProcess, LPCVOID pv)

{

  //Disables CFG export-suppression on 'pv' function in 'hProcess'

  MEMORY_BASIC_INFORMATION mbi;

  NTSTATUS status = NtQueryVirtualMemory(hProcess, (void*)pv, MemoryBasicInformation, &mbi, sizeof(mbi), 0);

  if (SUCCEEDED(status))

  {

    if (mbi.State != MEM_COMMIT || mbi.Type != MEM_IMAGE)

    {

      return STATUS_INVALID_ADDRESS;

    }

    CFG_CALL_TARGET_INFO OffsetInformation = {

      (ULONG_PTR)pv - (ULONG_PTR)mbi.BaseAddress,

      CFG_CALL_TARGET_CONVERT_EXPORT_SUPPRESSED_TO_VALID | CFG_CALL_TARGET_VALID

    };

    return SetProcessValidCallTargets(hProcess, mbi.BaseAddress, mbi.RegionSize, 1, &OffsetInformation) &&

      (OffsetInformation.Flags & CFG_CALL_TARGET_PROCESSED) ? STATUS_SUCCESS : STATUS_STRICT_CFG_VIOLATION;

  }

  return status;

}

#include <iostream>

#include Windows.h>

#include <assert.h>

#pragma comment(lib, "ntdll.lib")   //For native API calls

struct EXPORT_ENTRY {

  FARPROC pfn;

  PCSTR pstrName;

};

struct NTDLL_FN_PTRS {

  EXPORT_ENTRY pLdrQueryProcessModuleInformation;

  EXPORT_ENTRY pRtlExitUserThread;

};

typedef

VOID

KNORMAL_ROUTINE(

  __in_opt PVOID NormalContext,

  __in_opt PVOID SystemArgument1,

  __in_opt PVOID SystemArgument2

);

typedef KNORMAL_ROUTINE* PKNORMAL_ROUTINE;

typedef struct _UNICODE_STRING {

  USHORT Length;

  USHORT MaximumLength;

  _Field_size_bytes_part_opt_(MaximumLength, Length) PWCH   Buffer;

} UNICODE_STRING;

typedef UNICODE_STRING* PUNICODE_STRING;

typedef const UNICODE_STRING* PCUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES {

  ULONG Length;

  HANDLE RootDirectory;

  PUNICODE_STRING ObjectName;

  ULONG Attributes;

  PVOID SecurityDescriptor;        // Points to type SECURITY_DESCRIPTOR

  PVOID SecurityQualityOfService;  // Points to type SECURITY_QUALITY_OF_SERVICE

} OBJECT_ATTRIBUTES;

typedef OBJECT_ATTRIBUTES* POBJECT_ATTRIBUTES;

typedef CONST OBJECT_ATTRIBUTES* PCOBJECT_ATTRIBUTES;

typedef enum _SECTION_INHERIT {

  ViewShare = 1,

  ViewUnmap = 2

} SECTION_INHERIT;

typedef struct _CLIENT_ID {

  HANDLE UniqueProcess;

  HANDLE UniqueThread;

} CLIENT_ID;

typedef CLIENT_ID* PCLIENT_ID;

typedef struct RTL_PROCESS_MODULE_INFORMATION {

  HANDLE Section;                 // Not filled in

  PVOID MappedBase;

  PVOID ImageBase;

  ULONG ImageSize;

  ULONG Flags;

  USHORT LoadOrderIndex;

  USHORT InitOrderIndex;

  USHORT LoadCount;

  USHORT OffsetToFileName;

  CHAR  FullPathName[256];

} *PRTL_PROCESS_MODULE_INFORMATION;

typedef struct RTL_PROCESS_MODULES {

  ULONG NumberOfModules;

  RTL_PROCESS_MODULE_INFORMATION Modules[1];

} *PRTL_PROCESS_MODULES;

typedef int HANDLE32;

typedef int PVOID32;

#pragma pack(push)

#pragma pack(4)

typedef struct RTL_PROCESS_MODULE_INFORMATION32 {

  HANDLE32 Section;                 // Not filled in

  PVOID32 MappedBase;

  PVOID32 ImageBase;

  ULONG ImageSize;

  ULONG Flags;

  USHORT LoadOrderIndex;

  USHORT InitOrderIndex;

  USHORT LoadCount;

  USHORT OffsetToFileName;

  CHAR  FullPathName[256];

} *PRTL_PROCESS_MODULE_INFORMATION32;

typedef struct RTL_PROCESS_MODULES32 {

  ULONG NumberOfModules;

  RTL_PROCESS_MODULE_INFORMATION32 Modules[1];

} *PRTL_PROCESS_MODULES32;

#pragma pack(pop)

typedef enum _PROCESSINFOCLASS {

  ProcessBasicInformation = 0,

  ProcessQuotaLimits = 1,

  ProcessIoCounters = 2,

  ProcessVmCounters = 3,

  ProcessTimes = 4,

  ProcessBasePriority = 5,

  ProcessRaisePriority = 6,

  ProcessDebugPort = 7,

  ProcessExceptionPort = 8,

  ProcessAccessToken = 9,

  ProcessLdtInformation = 10,

  ProcessLdtSize = 11,

  ProcessDefaultHardErrorMode = 12,

  ProcessIoPortHandlers = 13,   // Note: this is kernel mode only

  ProcessPooledUsageAndLimits = 14,

  ProcessWorkingSetWatch = 15,

  ProcessUserModeIOPL = 16,

  ProcessEnableAlignmentFaultFixup = 17,

  ProcessPriorityClass = 18,

  ProcessWx86Information = 19,

  ProcessHandleCount = 20,

  ProcessAffinityMask = 21,

  ProcessPriorityBoost = 22,

  ProcessDeviceMap = 23,

  ProcessSessionInformation = 24,

  ProcessForegroundInformation = 25,

  ProcessWow64Information = 26,

  ProcessImageFileName = 27,

  ProcessLUIDDeviceMapsEnabled = 28,

  ProcessBreakOnTermination = 29,

  ProcessDebugObjectHandle = 30,

  ProcessDebugFlags = 31,

  ProcessHandleTracing = 32,

  ProcessIoPriority = 33,

  ProcessExecuteFlags = 34,

  ProcessTlsInformation = 35,

  ProcessCookie = 36,

  ProcessImageInformation = 37,

  ProcessCycleTime = 38,

  ProcessPagePriority = 39,

  ProcessInstrumentationCallback = 40,

  ProcessThreadStackAllocation = 41,

  ProcessWorkingSetWatchEx = 42,

  ProcessImageFileNameWin32 = 43,

  ProcessImageFileMapping = 44,

  ProcessAffinityUpdateMode = 45,

  ProcessMemoryAllocationMode = 46,

  ProcessGroupInformation = 47,

  ProcessTokenVirtualizationEnabled = 48,

  ProcessOwnerInformation = 49,

  ProcessWindowInformation = 50,

  ProcessHandleInformation = 51,

  ProcessMitigationPolicy = 52,

  ProcessDynamicFunctionTableInformation = 53,

  ProcessHandleCheckingMode = 54,

  ProcessKeepAliveCount = 55,

  ProcessRevokeFileHandles = 56,

  ProcessWorkingSetControl = 57,

  ProcessHandleTable = 58,

  ProcessCheckStackExtentsMode = 59,

  ProcessCommandLineInformation = 60,

  ProcessProtectionInformation = 61,

  ProcessMemoryExhaustion = 62,

  ProcessFaultInformation = 63,

  ProcessTelemetryIdInformation = 64,

  ProcessCommitReleaseInformation = 65,

  ProcessReserved1Information = 66,

  ProcessReserved2Information = 67,

  ProcessSubsystemProcess = 68,

  ProcessInPrivate = 70,

  ProcessRaiseUMExceptionOnInvalidHandleClose = 71,

  ProcessSubsystemInformation = 75,

  ProcessWin32kSyscallFilterInformation = 79,

  ProcessEnergyTrackingState = 82,

  MaxProcessInfoClass                             // MaxProcessInfoClass should always be the last enum

} PROCESSINFOCLASS;

#define OBJ_CASE_INSENSITIVE                0x00000040L

#define STATUS_SUCCESS                   ((NTSTATUS)0x00000000L)

#define STATUS_BAD_DATA                  ((NTSTATUS)0xC000090BL)

#define STATUS_BAD_FILE_TYPE             ((NTSTATUS)0xC0000903L)

#define STATUS_INVALID_IMAGE_FORMAT      ((NTSTATUS)0xC000007BL)

#define STATUS_SOURCE_ELEMENT_EMPTY      ((NTSTATUS)0xC0000283L)

#define STATUS_FOUND_OUT_OF_SCOPE        ((NTSTATUS)0xC000022EL)

#define STATUS_ILLEGAL_FUNCTION          ((NTSTATUS)0xC00000AFL)

#define STATUS_OBJECT_NAME_NOT_FOUND     ((NTSTATUS)0xC0000034L)

#define STATUS_PROCEDURE_NOT_FOUND       ((NTSTATUS)0xC000007AL)

#define STATUS_INVALID_ADDRESS           ((NTSTATUS)0xC0000141L)

#define STATUS_STRICT_CFG_VIOLATION      ((NTSTATUS)0xC0000606L)

#define RtlPointerToOffset(B,P)  ((ULONG)( ((PCHAR)(P)) - ((PCHAR)(B)) ))

#define RtlOffsetToPointer(B,O)  ((PCHAR)( ((PCHAR)(B)) + ((ULONG_PTR)(O)) ))

struct SECTION_IMAGE_INFORMATION

{

  PVOID TransferAddress;

  ULONG ZeroBits;

  SIZE_T MaximumStackSize;

  SIZE_T CommittedStackSize;

  ULONG SubSystemType;

  union

  {

    struct

    {

      USHORT SubSystemMinorVersion;

      USHORT SubSystemMajorVersion;

    };

    ULONG SubSystemVersion;

  };

  ULONG GpValue;

  USHORT ImageCharacteristics;

  USHORT DllCharacteristics;

  USHORT Machine;

  BOOLEAN ImageContainsCode;

  union

  {

    UCHAR ImageFlags;

    struct

    {

      UCHAR ComPlusNativeReady : 1;

      UCHAR ComPlusILOnly : 1;

      UCHAR ImageDynamicallyRelocated : 1;

      UCHAR ImageMappedFlat : 1;

      UCHAR BaseBelow4gb : 1;

      UCHAR Reserved : 3;

    };

  };

  ULONG LoaderFlags;

  ULONG ImageFileSize;

  ULONG CheckSum;

};

enum SECTION_INFORMATION_CLASS

{

  SectionBasicInformation,

  SectionImageInformation

};

typedef enum _THREADINFOCLASS {

  ThreadBasicInformation = 0,

  ThreadTimes = 1,

  ThreadPriority = 2,

  ThreadBasePriority = 3,

  ThreadAffinityMask = 4,

  ThreadImpersonationToken = 5,

  ThreadDescriptorTableEntry = 6,

  ThreadEnableAlignmentFaultFixup = 7,

  ThreadEventPair_Reusable = 8,

  ThreadQuerySetWin32StartAddress = 9,

  ThreadZeroTlsCell = 10,

  ThreadPerformanceCount = 11,

  ThreadAmILastThread = 12,

  ThreadIdealProcessor = 13,

  ThreadPriorityBoost = 14,

  ThreadSetTlsArrayAddress = 15,   // Obsolete

  ThreadIsIoPending = 16,

  ThreadHideFromDebugger = 17,

  ThreadBreakOnTermination = 18,

  ThreadSwitchLegacyState = 19,

  ThreadIsTerminated = 20,

  ThreadLastSystemCall = 21,

  ThreadIoPriority = 22,

  ThreadCycleTime = 23,

  ThreadPagePriority = 24,

  ThreadActualBasePriority = 25,

  ThreadTebInformation = 26,

  ThreadCSwitchMon = 27,   // Obsolete

  ThreadCSwitchPmu = 28,

  ThreadWow64Context = 29,

  ThreadGroupInformation = 30,

  ThreadUmsInformation = 31,   // UMS

  ThreadCounterProfiling = 32,

  ThreadIdealProcessorEx = 33,

  ThreadCpuAccountingInformation = 34,

  ThreadSuspendCount = 35,

  ThreadActualGroupAffinity = 41,

  ThreadDynamicCodePolicyInfo = 42,

  ThreadSubsystemInformation = 45,

  MaxThreadInfoClass = 51,

} THREADINFOCLASS;

typedef enum _MEMORY_INFORMATION_CLASS {

  MemoryBasicInformation

} MEMORY_INFORMATION_CLASS;

//Imported native functions from ntdll

extern "C" {

  __declspec(dllimport) NTSTATUS CALLBACK ZwQueueApcThread

  (

    HANDLE hThread,

    PKNORMAL_ROUTINE ApcRoutine,

    PVOID ApcContext,

    PVOID Argument1,

    PVOID Argument2

  );

  __declspec(dllimport) NTSTATUS CALLBACK NtCreateSection

  (

    _Out_ PHANDLE SectionHandle,

    _In_ ACCESS_MASK DesiredAccess,

    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,

    _In_opt_ PLARGE_INTEGER MaximumSize,

    _In_ ULONG SectionPageProtection,

    _In_ ULONG AllocationAttributes,

    _In_opt_ HANDLE FileHandle

  );

  __declspec(dllimport) NTSTATUS CALLBACK ZwClose

  (

    _In_ HANDLE Handle

  );

  __declspec(dllimport) NTSTATUS CALLBACK ZwMapViewOfSection

  (

    _In_ HANDLE SectionHandle,

    _In_ HANDLE ProcessHandle,

    _Outptr_result_bytebuffer_(*ViewSize) PVOID* BaseAddress,

    _In_ ULONG_PTR ZeroBits,

    _In_ SIZE_T CommitSize,

    _Inout_opt_ PLARGE_INTEGER SectionOffset,

    _Inout_ PSIZE_T ViewSize,

    _In_ SECTION_INHERIT InheritDisposition,

    _In_ ULONG AllocationType,

    _In_ ULONG Win32Protect

  );

  __declspec(dllimport) NTSTATUS CALLBACK ZwUnmapViewOfSection

  (

    _In_ HANDLE ProcessHandle,

    _In_opt_ PVOID BaseAddress

  );

  __declspec(dllimport) NTSTATUS CALLBACK RtlCreateUserThread

  (

    IN HANDLE hProcess,

    PVOID   SecurityDescriptor,

    BOOLEAN CreateSuspended,

    ULONG ZeroBits,

    SIZE_T StackReserve,

    SIZE_T StackCommit,

    PVOID EntryPoint,

    const void* Argument,

    PHANDLE phThread,

    PCLIENT_ID pCid

  );

  __declspec(dllimport) NTSTATUS CALLBACK RtlExitUserThread

  (

    DWORD dwExitCode

  );

  __declspec(dllimport) NTSTATUS CALLBACK RtlQueueApcWow64Thread

  (

    HANDLE hThread,

    PKNORMAL_ROUTINE ApcRoutine,

    PVOID ApcContext,

    PVOID Argument1,

    PVOID Argument2

  );

  __declspec(dllimport) NTSTATUS CALLBACK LdrQueryProcessModuleInformation

  (

    PRTL_PROCESS_MODULES psmi,

    ULONG BufferSize,

    PULONG RealSize

  );

  __declspec(dllimport) NTSTATUS CALLBACK NtQueryInformationProcess

  (

    IN HANDLE ProcessHandle,

    IN  PROCESSINFOCLASS ProcessInformationClass,

    OUT PVOID ProcessInformation,

    IN ULONG ProcessInformationLength,

    OUT PULONG ReturnLength OPTIONAL

  );

  __declspec(dllimport) NTSTATUS CALLBACK ZwOpenSection

  (

    _Out_ PHANDLE SectionHandle,

    _In_ ACCESS_MASK DesiredAccess,

    _In_ POBJECT_ATTRIBUTES ObjectAttributes

  );

  __declspec(dllimport) NTSTATUS CALLBACK ZwQuerySection

  (

    IN HANDLE SectionHandle,

    IN ULONG SectionInformationClass,

    OUT PVOID SectionInformation,

    IN ULONG SectionInformationLength,

    OUT PSIZE_T ResultLength OPTIONAL

  );

  __declspec(dllimport) PIMAGE_NT_HEADERS CALLBACK RtlImageNtHeader

  (

    PVOID Base

  );

  __declspec(dllimport) PVOID CALLBACK RtlImageDirectoryEntryToData

  (

    PVOID Base,

    BOOLEAN MappedAsImage,

    USHORT DirectoryEntry,

    PULONG Size

  );

  __declspec(dllimport) NTSTATUS CALLBACK NtSetInformationThread(

    _In_ HANDLE ThreadHandle,

    _In_ THREADINFOCLASS ThreadInformationClass,

    _When_((ThreadInformationClass != ThreadManageWritesToExecutableMemory),

      _In_reads_bytes_(ThreadInformationLength))

    _When_((ThreadInformationClass == ThreadManageWritesToExecutableMemory),

      _Inout_updates_(ThreadInformationLength))

    PVOID ThreadInformation,

    _In_ ULONG ThreadInformationLength

  );

  __declspec(dllimport) NTSTATUS CALLBACK NtQueryVirtualMemory(

    _In_ HANDLE ProcessHandle,

    _In_opt_ PVOID BaseAddress,

    _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,

    _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,

    _In_ SIZE_T MemoryInformationLength,

    _Out_opt_ PSIZE_T ReturnLength

  );

}