text: #pragma once
  #define STATUS_UNSUCCESSFUL 0xC0000001
  
  #define InitializeObjectAttributes( p, n, a, r, s ) { \
    (p)->Length = sizeof( OBJECT_ATTRIBUTES );          \
    (p)->RootDirectory = r;                             \
    (p)->Attributes = a;                                \
    (p)->ObjectName = n;                                \
    (p)->SecurityDescriptor = s;                        \
    (p)->SecurityQualityOfService = NULL;               \
  }
  
  enum { SystemModuleInformation = 11 };
  enum { ProcessAccessToken = 0x09 };
  
  typedef PVOID *PEPROCESS;
  
  typedef PEPROCESS(WINAPI *_PsGetCurrentProcess)(void);
  
  typedef ULONG(__cdecl  *_DbgPrintEx)(_In_ ULONG ComponentId, _In_ ULONG Level, PCHAR  Format, ...);
  
  typedef struct {
  	HANDLE UniqueProcess;
  	HANDLE UniqueThread;
  } CLIENT_ID, *PCLIENT_ID;
  
  typedef NTSTATUS(WINAPI *_NtFsControlFile)(
  	HANDLE           FileHandle,
  	HANDLE           Event,
  	PIO_APC_ROUTINE  ApcRoutine,
  	PVOID            ApcContext,
  	PIO_STATUS_BLOCK IoStatusBlock,
  	ULONG            FsControlCode,
  	PVOID            InputBuffer,
  	ULONG            InputBufferLength,
  	PVOID            OutputBuffer,
  	ULONG            OutputBufferLength
  	);
  
  typedef NTSTATUS(WINAPI *_NtQuerySystemInformation)(
  	SYSTEM_INFORMATION_CLASS SystemInformationClass,
  	PVOID SystemInformation,
  	ULONG SystemInformationLength,
  	PULONG ReturnLength
  	);
  
  typedef NTSTATUS(WINAPI *_ZwOpenProcess)(
  	PHANDLE            ProcessHandle,
  	ACCESS_MASK        DesiredAccess,
  	POBJECT_ATTRIBUTES ObjectAttributes,
  	PCLIENT_ID         ClientId
  	);
  
  typedef NTSTATUS(WINAPI *_ZwDuplicateToken)(
  	HANDLE             ExistingTokenHandle,
  	ACCESS_MASK        DesiredAccess,
  	POBJECT_ATTRIBUTES ObjectAttributes,
  	BOOLEAN            EffectiveOnly,
  	TOKEN_TYPE         TokenType,
  	PHANDLE            NewTokenHandle
  	);
  
  typedef NTSTATUS(WINAPI *_ZwOpenProcessToken)(
  	HANDLE      ProcessHandle,
  	ACCESS_MASK DesiredAccess,
  	PHANDLE     TokenHandle
  	);
  
  typedef NTSTATUS(WINAPI *_ZwSetInformationProcess)(
  	HANDLE   ProcessHandle,
  	PROCESSINFOCLASS   ProcessInformationClass,
  	PVOID  ProcessInformation,
  	ULONG  ProcessInformationLength
  	);
  
  
  typedef DWORD(WINAPI *_NtAllocateVirtualMemory)(
  	HANDLE ProcessHandle,
  	PVOID *BaseAddress,
  	ULONG ZeroBits,
  	PULONG RegionSize,
  	ULONG AllocationType,
  	ULONG Protect
  	);
  
  typedef  NTSTATUS(WINAPI *_PsLookupProcessByProcessId)(
  	_In_  HANDLE    ProcessId,
  	_Out_ PEPROCESS *Process
  	);
  
  typedef BOOL(WINAPI *_ZwClose)(
  	_In_ HANDLE hObject
  	);
  
  typedef struct _PROCESS_ACCESS_TOKEN {
  	HANDLE Token;
  	HANDLE Thread;
  } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
  
  /* Hacked up from Process Hacker source */
  typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
  	HANDLE Section;
  	PVOID MappedBase;
  	PVOID ImageBase;
  	ULONG ImageSize;
  	ULONG Flags;
  	USHORT LoadOrderIndex;
  	USHORT InitOrderIndex;
  	USHORT LoadCount;
  	USHORT OffsetToFileName;
  	UCHAR  FullPathName[256];
  } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
  
  typedef struct _RTL_PROCESS_MODULES {
  	ULONG NumberOfModules;
  	SYSTEM_MODULE_INFORMATION_ENTRY Modules[1];
  } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
  
  typedef struct {
  	ULONG pad1[12];
  	DWORD addrPtr;
  	ULONG pad2[14];
  	DWORD evilAddr;
  } BAD_DEVICE_OBJECT, *PBAD_DEVICE_OBJECT;
  
  
  
  
  
  