-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathshell32.c
More file actions
35 lines (26 loc) · 1.29 KB
/
Copy pathshell32.c
File metadata and controls
35 lines (26 loc) · 1.29 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
#include "ntdll.h"
#include "shell32.h"
#include "intrinsics.h"
// ░░░ Initialization + State ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
Handle Shell32BaseAddress = null;
struct Shell32Functions Shell32 = { 0 };
boolean_t InitializeShell32()
{
if (NtDll.LdrLoadDll == null || NtDll.LdrGetProcedureAddressEx == null) return false;
UNICODE_STRING moduleName;
moduleName.Buffer = L"shell32";
moduleName.Length = 14;
moduleName.MaximumLength = 16;
return !LdrLoadDll(null, null, &moduleName, &Shell32BaseAddress);
}
// ░░░ Runtime Loaders ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
boolean_t LoadCommandLineToArgvW()
{
if (Shell32BaseAddress == null) return false;
if (Shell32.CommandLineToArgvW != null) return true;
STRING functionName;
functionName.Buffer = "CommandLineToArgvW";
functionName.Length = 56;
functionName.MaximumLength = 58;
return !NtDll.LdrGetProcedureAddressEx(Shell32BaseAddress, &functionName, null, &Shell32.CommandLineToArgvW, null);
}