#pragma once #include "..\commons.h" #define RTL_MAXIMUM_ATOM_LENGTH 255 void cleanUnrelatedAtomBombingCandidates( std::vector candidates, const PROCESS_INFORMATION &p ); HANDLE findAlertableThread( HANDLE hp, DWORD pid ); std::pair findAlertableThread2( HANDLE hp, DWORD pid ); std::map findAlertableThreads( HANDLE hp, DWORD pid, bool onlyFirst ); void atomBombQueueThreadApc( void* address, HANDLE remoteThread, PVOID arg1, bool suspendThread, bool dontCloseHandle ); void atomBombQueueThreadApcEx( void* address, HANDLE remoteThread, PVOID arg1, PVOID arg2, PVOID arg3, bool suspendThread, bool dontCloseHandle = false ); std::map _findAlertableThreads( HANDLE hp, DWORD pid, bool onlyFirst ); std::vector findAtomBombingCandidates( bool onlyFirst = true, std::set *constraintedSetOfPids = nullptr ); size_t atomBombingInChunks( HANDLE alertableThread, uint8_t* targetAddr, uint8_t* payload, size_t offset, size_t payloadSize, bool suspendThread ); bool bombTheAtoms( PROCESS_INFORMATION *pinfo, uint8_t* targetAddr, uint8_t* payload, size_t payloadSize, DWORD protection, HANDLE *externalAlertableThread = NULL );