/*

* KProcessHacker

*

* Copyright (C) 2010-2016 wj32

* Copyright (C) 2020 jxy-s

*

* This file is part of Process Hacker.

*

* Process Hacker is free software; you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* Process Hacker is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with Process Hacker. If not, see <http://www.gnu.org/licenses/>.

*/

#include <kph.h>

#include <dyndata.h>

#ifdef ALLOC_PRAGMA

#pragma alloc_text(PAGE, KphGetSystemRoutineAddress)

#pragma alloc_text(PAGE, KphDynamicImport)

#endif

/**

* Dynamically imports routines.

*/

VOID KphDynamicImport(

VOID

)

{

PAGED_CODE();

KphDynPsGetProcessProtection = (PPS_GET_PROCESS_PROTECTION)(

KphGetSystemRoutineAddress(L"PsGetProcessProtection"));

KphDynRtlImageNtHeaderEx = (PRTL_IMAGE_NT_HEADER_EX)(

KphGetSystemRoutineAddress(L"RtlImageNtHeaderEx"));

}

/**

* Retrieves the address of a function exported by NTOS or HAL.

*

* \param SystemRoutineName The name of the function.

*

* \return The address of the function, or NULL if the function could

* not be found.

*/

PVOID KphGetSystemRoutineAddress(

_In_ PWSTR SystemRoutineName

)

{

UNICODE_STRING systemRoutineName;

PAGED_CODE();

RtlInitUnicodeString(&systemRoutineName, SystemRoutineName);

return MmGetSystemRoutineAddress(&systemRoutineName);

}