modules

Documentation

Index

• Constants
• func GetPID(process string) uint32
• func IsWOW64Process() bool
• func ReloadDll(dll string)
• func SePrivEnable(s string) error
• func Unhook(pid int, dll string) error

Constants

const (
	PROCESS_VM_OPERATION uint32 = 0x0008
	PROCESS_VM_WRITE     uint32 = 0x0020
)

Functions

func GetPID

func GetPID(process string) uint32

Get PID of a provided process name

func IsWOW64Process

func IsWOW64Process() bool

Checks if the current process is 32bit

func ReloadDll

func ReloadDll(dll string)

Refreshes the provided DLL by reading the text section from disk and re-writing the dll in memeory

func SePrivEnable

func SePrivEnable(s string) error

Enable SePriv

func Unhook

func Unhook(pid int, dll string) error

ETW bypass by injecting into the provided PID and overwriting the NTDLL.EtwEventWrite function