public static IEnumerable <IntPtr> EnumerateHeaps(IntPtr pebAddress) { DbgOffset pebOffset = DbgOffset.Get("_PEB"); IntPtr processHeapsPtr = pebOffset.GetPointer(pebAddress, "ProcessHeaps").ReadPtr(); if (processHeapsPtr == IntPtr.Zero) { yield break; } if (pebOffset.TryRead <int>(pebAddress, "NumberOfHeaps", out int numberOfHeaps) == false) { yield break; } for (int i = 0; i < numberOfHeaps; i++) { IntPtr entryPtr = processHeapsPtr + (IntPtr.Size * i); yield return(entryPtr.ReadPtr()); } }
// Prerequisite: // Register and start "KernelMemoryIO" kernel driver // https://github.com/stjeong/KernelMemoryIO/tree/master/KernelMemoryIO // // sc create "KernelMemoryIO" binPath= "D:\Debug\KernelMemoryIO.sys" type= kernel start= demand // sc delete "KernelMemoryIO" // net start KernelMemoryIO // net stop KernelMemoryIO static void Main(string[] _) { Console.WriteLine("Version 1.0"); int processId = Process.GetCurrentProcess().Id; using (KernelMemoryIO memoryIO = new KernelMemoryIO()) { if (memoryIO.IsInitialized == false) { Console.WriteLine("Failed to open device"); return; } /* * // 0xFFFF850953C62080 from process explorer (Handles view pane: Ctrl+H) * // It must be a Handle of Thead type. * IntPtr ethreadPtr = new IntPtr(unchecked((long)0xFFFF850953C62080)); */ IntPtr ethreadPtr = GetEThread(); var ethreadOffset = DbgOffset.Get("_ETHREAD"); var kthreadOffset = DbgOffset.Get("_KTHREAD"); var eprocessOffset = DbgOffset.Get("_EPROCESS"); { // +0x648 Cid : _CLIENT_ID IntPtr clientIdPtr = ethreadOffset.GetPointer(ethreadPtr, "Cid"); _CLIENT_ID cid = memoryIO.ReadMemory <_CLIENT_ID>(clientIdPtr); if (cid.UniqueProcess.ToInt32() != processId) { Console.WriteLine("failed to read"); return; } Console.WriteLine($"PID: {cid.Pid} ({cid.Pid:x})"); Console.WriteLine($"TID: {cid.Tid} ({cid.Tid:x})"); } { // +0x220 Process : Ptr64 _KPROCESS IntPtr kprocessPosPtr = kthreadOffset.GetPointer(ethreadPtr, "Process"); IntPtr kprocessPtr = memoryIO.ReadMemory <IntPtr>(kprocessPosPtr); Console.WriteLine($"_EPROCESS: {kprocessPtr} ({kprocessPtr.ToInt64():x})"); { // +0x3d0 Cookie : Uint4B IntPtr cookiePtr = eprocessOffset.GetPointer(kprocessPtr, "Cookie"); int oldCookie = memoryIO.ReadMemory <int>(cookiePtr); Console.WriteLine($"[OLD] _EPROCESS.cookie: {oldCookie}({oldCookie:x})"); int writtenBytes = memoryIO.WriteMemory <int>(cookiePtr, 0x5000); Console.WriteLine("Written = " + writtenBytes); int newCookie = memoryIO.ReadMemory <int>(cookiePtr); Console.WriteLine($"[NEW] _EPROCESS.cookie: {newCookie}({newCookie:x})"); memoryIO.WriteMemory <int>(cookiePtr, oldCookie); Console.WriteLine("Written = " + writtenBytes); } } //Console.WriteLine($"Current Position: {memoryIO.Position}({memoryIO.Position.ToInt64():x})"); //memoryIO.Position = ethreadPtr; //Console.WriteLine($"Current Position: {memoryIO.Position}({memoryIO.Position.ToInt64():x})"); } }