📄 ntdll.h

📁 以插入explorer.exe进程的方式自启动。默认端口2121 支持多种命令
💻 H
📖 第 1 页 / 共 5 页
字号:
上一页 1 2 3 45
NtSetSystemInformation(
	IN SYSTEMINFOCLASS	SystemInformationClass,
	IN PVOID			pSystemInformation,
	IN ULONG			uSystemInformationLength
	);

// Time functions
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySystemTime(
	OUT PLARGE_INTEGER	SystemTime
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetSystemTime(
	IN PLARGE_INTEGER	NewTime,
	OUT PLARGE_INTEGER	OldTime OPTIONAL
);

NTSYSAPI
VOID
NTAPI
RtlTimeToTimeFields(
	IN PLARGE_INTEGER	pliTime,
	OUT PTIME_FIELDS	pTimeFields
);

NTSYSAPI
BOOLEAN
NTAPI
RtlTimeFieldsToTime(
	IN	PTIME_FIELDS	pTimeFields,
	OUT PLARGE_INTEGER	pliTime
);

NTSYSAPI
VOID
NTAPI
RtlSecondsSince1970ToTime(
    IN ULONG			SecondsSince1970,
    OUT PLARGE_INTEGER	Time
);

NTSYSAPI
VOID
NTAPI
RtlTimeToSecondsSince1970(
	IN PLARGE_INTEGER	Time,
	OUT PULONG			SecondsSince1970
);

// Event functions
NTSYSAPI
NTSTATUS
NTAPI
NtOpenEvent(
	PHANDLE				phEvent,
	ACCESS_MASK			AccessMask,
	POBJECT_ATTRIBUTES	pObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
NtClearEvent(
	IN HANDLE	hEvent
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetEvent(
	IN HANDLE	hEvent,
	OUT PLONG	plSignaled OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtCreateSemaphore(
    OUT PHANDLE SemaphoreHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN LONG InitialCount,
    IN LONG MaximumCount
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenSemaphore(
    OUT PHANDLE SemaphoreHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
NtReleaseSemaphore(
    IN HANDLE SemaphoreHandle,
    IN LONG ReleaseCount,
    OUT PLONG PreviousCount OPTIONAL
);

typedef enum _SEMAPHORE_INFORMATION_CLASS
{
	SemaphoreBasicInformation
} SEMAPHORE_INFORMATION_CLASS;

NTSYSAPI
NTSTATUS
NTAPI
NtQuerySemaphore(
    IN HANDLE SemaphoreHandle,
    IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
    OUT PVOID SemaphoreInformation,
    IN ULONG SemaphoreInformationLength,
    OUT PULONG ResultLength OPTIONAL
);

typedef struct _SEMAPHORE_BASIC_INFORMATION
{
	LONG CurrentCount;
	LONG MaximumCount;
} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;

// Directory and Symbolic Link functions
NTSYSAPI
NTSTATUS
NTAPI
NtCreateDirectoryObject(
	OUT PHANDLE				phDirectory,
	IN ACCESS_MASK			AccessMask,
	IN POBJECT_ATTRIBUTES	pObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenDirectoryObject(
	OUT PHANDLE				DirectoryHandle,
	IN ACCESS_MASK			DesiredAccess,
	IN POBJECT_ATTRIBUTES	ObjectAttributes
);

typedef struct _DIRECTORY_CONTENTS
{
    struct
	{
        UNICODE_STRING Name;
        UNICODE_STRING Type;
    } Entry[ANYSIZE_ARRAY];
} DIRECTORY_CONTENTS, *PDIRECTORY_CONTENTS;

NTSYSAPI
NTSTATUS
NTAPI 
NtQueryDirectoryObject(
	IN HANDLE				DirectoryHandle,
	OUT PDIRECTORY_CONTENTS	Buffer,
	IN ULONG				Length,
	IN BOOLEAN				ReturnSingleEntry,
	IN BOOLEAN				RestartScan,
	IN OUT PULONG			Index,
	OUT PULONG				ResultLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenSymbolicLinkObject(
	OUT PHANDLE				SymbolicLinkHandle,
	IN ACCESS_MASK			DesiredAccess,
	IN POBJECT_ATTRIBUTES	ObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
NtQuerySymbolicLinkObject(
	IN HANDLE			SymbolicLinkHandle,
	OUT PUNICODE_STRING	NameString,
	OUT PULONG			ResultLength OPTIONAL
);

// File functions
NTSYSAPI
NTSTATUS
NTAPI
NtCreateFile(
	PHANDLE				phFile,
	ACCESS_MASK			AccessMask,
	POBJECT_ATTRIBUTES	pObjectAttributes,
	PIO_STATUS_BLOCK	pIoStatusBlock,
	PLARGE_INTEGER		pliAllocationSize,
	ULONG				uFileAttributes,
	ULONG				uShareAccess,
	ULONG				uCreateDisposition,
	ULONG				uCreateOptions,
	PVOID				pEaBuffer,
	ULONG				uEaLength
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenFile(
	PHANDLE				phFile,
	ACCESS_MASK			AccessMask,

	POBJECT_ATTRIBUTES	pObjectAttributes,
	PIO_STATUS_BLOCK	pIoStatusBlock,
	ULONG				uShareAccess,
	ULONG				uOpenOptions
);

NTSYSAPI
NTSTATUS
NTAPI
NtDeleteFile(
	IN POBJECT_ATTRIBUTES	pObjectAttributes
);

typedef enum _FILE_INFORMATION_CLASS
{
    FileDirectoryInformation       = 1,
    FileFullDirectoryInformation, // 2
    FileBothDirectoryInformation, // 3
    FileBasicInformation,         // 4
    FileStandardInformation,      // 5
    FileInternalInformation,      // 6
    FileEaInformation,            // 7
    FileAccessInformation,        // 8
    FileNameInformation,          // 9
    FileRenameInformation,        // 10
    FileLinkInformation,          // 11
    FileNamesInformation,         // 12
    FileDispositionInformation,   // 13
    FilePositionInformation,      // 14
    FileFullEaInformation,        // 15
    FileModeInformation,          // 16
    FileAlignmentInformation,     // 17
    FileAllInformation,           // 18
    FileAllocationInformation,    // 19
    FileEndOfFileInformation,     // 20
    FileAlternateNameInformation, // 21
    FileStreamInformation,        // 22
    FilePipeInformation,          // 23
    FilePipeLocalInformation,     // 24
    FilePipeRemoteInformation,    // 25
    FileMailslotQueryInformation, // 26
    FileMailslotSetInformation,   // 27
    FileCompressionInformation,   // 28
    FileObjectIdInformation,      // 29
    FileCompletionInformation,    // 30
    FileMoveClusterInformation,   // 31
    FileInformationReserved32,    // 32
    FileInformationReserved33,    // 33
    FileNetworkOpenInformation,   // 34
    FileMaximumInformation
} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;

NTSYSAPI
NTSTATUS
NTAPI
NtQueryDirectoryFile(
    IN HANDLE FileHandle,
    IN HANDLE Event OPTIONAL,
    IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
    IN PVOID ApcContext OPTIONAL,
    OUT PIO_STATUS_BLOCK IoStatusBlock,
    OUT PVOID FileInformation,
    IN ULONG FileInformationLength,
    IN FILE_INFORMATION_CLASS FileInformationClass,
    IN BOOLEAN ReturnSingleEntry,
    IN PUNICODE_STRING FileName OPTIONAL,
	IN BOOLEAN RestartScan
);

typedef struct _FILE_DIRECTORY_INFORMATION
{
    ULONG			NextEntryOffset;
    ULONG			FileIndex;
    LARGE_INTEGER	CreationTime;
    LARGE_INTEGER	LastAccessTime;
    LARGE_INTEGER	LastWriteTime;
    LARGE_INTEGER	ChangeTime;
    LARGE_INTEGER	EndOfFile;
    LARGE_INTEGER	AllocationSize;
    ULONG			FileAttributes;
    ULONG			FileNameLength;
    WCHAR			FileName[1];
} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

typedef struct _FILE_FULL_DIR_INFORMATION
{
    ULONG			NextEntryOffset;
    ULONG			FileIndex;
    LARGE_INTEGER	CreationTime;
    LARGE_INTEGER	LastAccessTime;
    LARGE_INTEGER	LastWriteTime;
    LARGE_INTEGER	ChangeTime;
    LARGE_INTEGER	EndOfFile;
    LARGE_INTEGER	AllocationSize;
    ULONG			FileAttributes;
    ULONG			FileNameLength;
    ULONG			EaSize;
    WCHAR			FileName[1];
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;

typedef struct _FILE_BOTH_DIR_INFORMATION
{
    ULONG			NextEntryOffset;
    ULONG			FileIndex;
    LARGE_INTEGER	CreationTime;
    LARGE_INTEGER	LastAccessTime;
    LARGE_INTEGER	LastWriteTime;
    LARGE_INTEGER	ChangeTime;
    LARGE_INTEGER	EndOfFile;
    LARGE_INTEGER	AllocationSize;
    ULONG			FileAttributes;
    ULONG			FileNameLength;
    ULONG			EaSize;
    CCHAR			ShortNameLength;
    WCHAR			ShortName[12];
    WCHAR			FileName[1];
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

typedef struct _FILE_BASIC_INFORMATION
{                    
    LARGE_INTEGER	CreationTime;                             
    LARGE_INTEGER	LastAccessTime;                           
    LARGE_INTEGER	LastWriteTime;                            
    LARGE_INTEGER	ChangeTime;                               
    ULONG			FileAttributes;                                   
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;         

typedef struct _FILE_STANDARD_INFORMATION
{                 
    LARGE_INTEGER	AllocationSize;                           
    LARGE_INTEGER	EndOfFile;                                
    ULONG			NumberOfLinks;                                    
    BOOLEAN			DeletePending;                                  
    BOOLEAN			Directory;                                      
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;   
                                                            
typedef struct _FILE_INTERNAL_INFORMATION
{
    LARGE_INTEGER	IndexNumber;
} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;

typedef struct _FILE_EA_INFORMATION
{
    ULONG	EaSize;
} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;

typedef struct _FILE_ACCESS_INFORMATION
{
    ACCESS_MASK	AccessFlags;
} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;

typedef struct _FILE_NAME_INFORMATION
{
    ULONG	FileNameLength;
    WCHAR	FileName[1];
} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;

typedef struct _FILE_RENAME_INFORMATION
{
    BOOLEAN	ReplaceIfExists;
    HANDLE	RootDirectory;
    ULONG	FileNameLength;
    WCHAR	FileName[1];
} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;

typedef struct _FILE_LINK_INFORMATION
{
    BOOLEAN	ReplaceIfExists;
    HANDLE	RootDirectory;
    ULONG	FileNameLength;
    WCHAR	FileName[1];
} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;

typedef struct _FILE_NAMES_INFORMATION
{
    ULONG	NextEntryOffset;
    ULONG	FileIndex;
    ULONG	FileNameLength;
    WCHAR	FileName[1];
} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;

typedef struct _FILE_ALLOCATION_INFORMATION
{
    LARGE_INTEGER	AllocationSize;
} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;

typedef struct _FILE_COMPRESSION_INFORMATION
{
    LARGE_INTEGER   CompressedFileSize;
    USHORT          CompressionFormat;
    UCHAR           CompressionUnitShift;
    UCHAR           ChunkShift;
    UCHAR           ClusterShift;
    UCHAR           Reserved[3];
} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;

typedef struct _FILE_COMPLETION_INFORMATION
{
    HANDLE  Port;
    ULONG   Key;
} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
NtQueryInformationFile(
    IN HANDLE					FileHandle,
    OUT PIO_STATUS_BLOCK		IoStatusBlock,
    OUT PVOID					FileInformation,
    IN ULONG					Length,
    IN FILE_INFORMATION_CLASS	FileInformationClass
);

NTSYSAPI
NTSTATUS

NTAPI
NtDeviceIoControlFile(
    IN HANDLE				FileHandle,
    IN HANDLE				Event OPTIONAL,
    IN PIO_APC_ROUTINE		ApcRoutine OPTIONAL,
    IN PVOID				ApcContext OPTIONAL,
    OUT PIO_STATUS_BLOCK	IoStatusBlock,
    IN ULONG				IoControlCode,
    IN PVOID				InputBuffer OPTIONAL,
    IN ULONG				InputBufferLength,
    OUT PVOID				OutputBuffer OPTIONAL,
    IN ULONG				OutputBufferLength
);

NTSYSAPI
NTSTATUS
NTAPI
NtFsControlFile(
    IN HANDLE				FileHandle,
    IN HANDLE				Event OPTIONAL,
    IN PIO_APC_ROUTINE		ApcRoutine OPTIONAL,
    IN PVOID				ApcContext OPTIONAL,
    OUT PIO_STATUS_BLOCK	IoStatusBlock,
    IN ULONG				FsControlCode,
    IN PVOID				InputBuffer OPTIONAL,
    IN ULONG				InputBufferLength,
    OU
上一页 1 2 3 45
💿 文件大小 122 K
👤 上传用户 GreatMarxist
📂 所属分类 Internet/网络编程
🏷️ 相关标签

#explorer #2121 #exe #进程
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -