@@ -10,8 +10,8 @@ const PLDR_DATA_TABLE_ENTRY = *LDR_DATA_TABLE_ENTRY;
1010const BYTE = windows .BYTE ;
1111const PBYTE = * BYTE ;
1212
13- const NtAllocateVirtualMemory_FnType = fn (hProcess : windows.HANDLE , ppBaseAddress : * ? * anyopaque , zeroBits : usize , regionSize : * usize , allocType : u32 , protect : u32 ) callconv (std .builtin .CallingConvention .c ) windows .NTSTATUS ;
14- const NtProtectVirtualMemory_FnType = fn (hProcess : windows.HANDLE , ppBaseAddress : * ? * anyopaque , regionSize : * usize , NewProtection : u32 , OldProtection : * u32 ) callconv (std .builtin .CallingConvention .c ) windows .NTSTATUS ;
13+ const NtAllocateVirtualMemory_FnType = fn (hProcess : windows.HANDLE , ppBaseAddress : * ? * anyopaque , zeroBits : usize , regionSize : * usize , allocType : u32 , protect : u32 ) callconv (std .builtin .CallingConvention .x86_64_win ) windows .NTSTATUS ;
14+ const NtProtectVirtualMemory_FnType = fn (hProcess : windows.HANDLE , ppBaseAddress : * ? * anyopaque , regionSize : * usize , NewProtection : u32 , OldProtection : * u32 ) callconv (std .builtin .CallingConvention .x86_64_win ) windows .NTSTATUS ;
1515const NtCreateThreadEx_FnType = fn (
1616 ThreadHandle : * ? * windows.HANDLE ,
1717 DesiredAccess : windows.ACCESS_MASK ,
@@ -24,29 +24,29 @@ const NtCreateThreadEx_FnType = fn (
2424 StackSize : ? * void ,
2525 MaximumStackSize : ? * void ,
2626 AttributeList : ? * void ,
27- ) callconv (std .builtin .CallingConvention .c ) windows .NTSTATUS ;
27+ ) callconv (std .builtin .CallingConvention .x86_64_win ) windows .NTSTATUS ;
2828const NtWaitForSingleObject_FnType = fn (
2929 handle : ? * windows.HANDLE ,
3030 alertable : bool ,
3131 timeout : ? * void ,
32- ) callconv (std .builtin .CallingConvention .c ) windows .NTSTATUS ;
33- const NtOpenKey_FnType = fn (hProcess : * windows.HANDLE , DesiredAccess : windows.ACCESS_MASK , ObjectAttributes : * const windows.OBJECT_ATTRIBUTES ) callconv (std .builtin .CallingConvention .c ) windows .NTSTATUS ;
32+ ) callconv (std .builtin .CallingConvention .x86_64_win ) windows .NTSTATUS ;
33+ const NtOpenKey_FnType = fn (hProcess : * windows.HANDLE , DesiredAccess : windows.ACCESS_MASK , ObjectAttributes : * const windows.OBJECT_ATTRIBUTES ) callconv (std .builtin .CallingConvention .x86_64_win ) windows .NTSTATUS ;
3434
3535const NtAllocateVirtualMemory_Fn : * const NtAllocateVirtualMemory_FnType = @ptrCast (@extern (* const NtAllocateVirtualMemory_FnType , .{ .name = "RunSyscall" }));
3636const NtProtectVirtualMemory_Fn : * const NtProtectVirtualMemory_FnType = @ptrCast (@extern (* const NtProtectVirtualMemory_FnType , .{ .name = "RunSyscall" }));
3737const NtCreateThreadEx_Fn : * const NtCreateThreadEx_FnType = @ptrCast (@extern (* const NtCreateThreadEx_FnType , .{ .name = "RunSyscall" }));
3838const NtWaitForSingleObject_Fn : * const NtWaitForSingleObject_FnType = @ptrCast (@extern (* const NtWaitForSingleObject_FnType , .{ .name = "RunSyscall" }));
3939const NtOpenKey_Fn : * const NtOpenKey_FnType = @ptrCast (@extern (* const NtOpenKey_FnType , .{ .name = "RunSyscall" }));
4040
41- pub fn run_NtAllocateVirtualMemory (hProcess : windows.HANDLE , ppBaseAddress : * ? * anyopaque , zeroBits : usize , regionSize : * usize , allocType : u32 , protect : u32 ) callconv (std .builtin .CallingConvention .c ) windows.NTSTATUS {
41+ pub fn run_NtAllocateVirtualMemory (hProcess : windows.HANDLE , ppBaseAddress : * ? * anyopaque , zeroBits : usize , regionSize : * usize , allocType : u32 , protect : u32 ) callconv (std .builtin .CallingConvention .x86_64_win ) windows.NTSTATUS {
4242 SetSyscall (g_Nt .NtAllocateVirtualMemory ) catch | err | {
4343 std .debug .print ("SetSyscall failed: {}\n " , .{err });
4444 return ;
4545 };
4646 return NtAllocateVirtualMemory_Fn (hProcess , ppBaseAddress , zeroBits , regionSize , allocType , protect );
4747}
4848
49- pub fn run_NtProtectVirtualMemory (hProcess : windows.HANDLE , ppBaseAddress : * ? * anyopaque , regionSize : * usize , NewProtection : u32 , OldProtection : * u32 ) callconv (std .builtin .CallingConvention .c ) windows.NTSTATUS {
49+ pub fn run_NtProtectVirtualMemory (hProcess : windows.HANDLE , ppBaseAddress : * ? * anyopaque , regionSize : * usize , NewProtection : u32 , OldProtection : * u32 ) callconv (std .builtin .CallingConvention .x86_64_win ) windows.NTSTATUS {
5050 SetSyscall (g_Nt .NtProtectVirtualMemory ) catch | err | {
5151 std .debug .print ("SetSyscall failed: {}\n " , .{err });
5252 return ;
@@ -66,7 +66,7 @@ pub fn run_NtCreateThreadEx(
6666 StackSize : ? * void ,
6767 MaximumStackSize : ? * void ,
6868 AttributeList : ? * void ,
69- ) callconv (std .builtin .CallingConvention .c ) windows.NTSTATUS {
69+ ) callconv (std .builtin .CallingConvention .x86_64_win ) windows.NTSTATUS {
7070 SetSyscall (g_Nt .NtCreateThreadEx ) catch | err | {
7171 std .debug .print ("SetSyscall failed: {}\n " , .{err });
7272 return ;
@@ -78,15 +78,15 @@ pub fn run_NtWaitForSingleObject(
7878 handle : ? * windows.HANDLE ,
7979 alertable : bool ,
8080 timeout : ? * void ,
81- ) callconv (std .builtin .CallingConvention .c ) windows.NTSTATUS {
81+ ) callconv (std .builtin .CallingConvention .x86_64_win ) windows.NTSTATUS {
8282 SetSyscall (g_Nt .NtWaitForSingleObject ) catch | err | {
8383 std .debug .print ("SetSyscall failed: {}\n " , .{err });
8484 return ;
8585 };
8686 return NtWaitForSingleObject_Fn (handle , alertable , timeout );
8787}
8888
89- pub fn run_NtOpenKey (hProcess : * windows.HANDLE , DesiredAccess : windows.ACCESS_MASK , ObjectAttributes : * const windows.OBJECT_ATTRIBUTES ) callconv (std .builtin .CallingConvention .c ) windows.NTSTATUS {
89+ pub fn run_NtOpenKey (hProcess : * windows.HANDLE , DesiredAccess : windows.ACCESS_MASK , ObjectAttributes : * const windows.OBJECT_ATTRIBUTES ) callconv (std .builtin .CallingConvention .x86_64_win ) windows.NTSTATUS {
9090 SetSyscall (g_Nt .NtAllocateVirtualMemory ) catch | err | {
9191 std .debug .print ("SetSyscall failed: {}\n " , .{err });
9292 return ;
0 commit comments