public static extern NtStatus NtAllocateVirtualMemory(
SafeKernelObjectHandle ProcessHandle,
ref IntPtr BaseAddress,
IntPtr ZeroBits,
ref IntPtr RegionSize,
MemoryAllocationType AllocationType,
MemoryAllocationProtect Protect
);
public static extern NtStatus NtAllocateVirtualMemoryEx(
SafeKernelObjectHandle ProcessHandle,
ref IntPtr BaseAddress,
ref IntPtr RegionSize,
MemoryAllocationType AllocationType,
MemoryAllocationProtect Protect,
MemExtendedParameter[] ExtendedParameters,
int ExtendedParameterCount
);
public IntPtr AllocateMemory(IntPtr newAddr, int size, MemoryAllocationType allocationType, MemoryProtection newProtection)
{
newAddr = VirtualAllocEx(handle, newAddr, size, (uint)allocationType, (uint)newProtection);
if (newAddr == IntPtr.Zero)
{
throw new Win32Exception();
}
return(newAddr);
}
/// <summary>
/// Allocate virtual memory in a process.
/// </summary>
/// <param name="process">The process to allocate in.</param>
/// <param name="base_address">Optional base address, if 0 will automatically select a base.</param>
/// <param name="region_size">The region size to allocate.</param>
/// <param name="allocation_type">The type of allocation.</param>
/// <param name="protect">The allocation protection.</param>
/// <returns>The address of the allocated region.</returns>
/// <exception cref="NtException">Thrown on error.</exception>
public static long AllocateMemory(SafeKernelObjectHandle process, long base_address,
long region_size, MemoryAllocationType allocation_type, MemoryAllocationProtect protect)
{
IntPtr base_address_ptr = new IntPtr(base_address);
IntPtr region_size_ptr = new IntPtr(region_size);
NtSystemCalls.NtAllocateVirtualMemory(process, ref base_address_ptr,
IntPtr.Zero, ref region_size_ptr, allocation_type, protect).ToNtException();
return(base_address_ptr.ToInt64());
}
/// <summary>
/// Allocates a block of memory in the target process.
/// </summary>
/// <param name="hProcess">Handle to the process in which memory will be allocated.</param>
/// <param name="nSize">Number of bytes to be allocated. Default is 0x1000.</param>
/// <param name="dwAllocationType">The type of memory allocation. See <see cref="MemoryAllocType"/></param>
/// <param name="dwProtect">The memory protection for the region of pages to be allocated. If the pages are being committed, you can specify any one of the <see cref="MemoryProtectType"/> constants.</param>
/// <returns>Returns zero on failure, or the base address of the allocated block of memory on success.</returns>
public static IntPtr AllocateMemory(IntPtr hProcess, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect)
{
IntPtr allocatedMemory = Imports.VirtualAllocEx(hProcess, 0, nSize, dwAllocationType, dwProtect);
if (allocatedMemory == IntPtr.Zero)
{
throw new NullReferenceException();
}
return(allocatedMemory);
}
/// <summary>
/// Allocate virtual memory in a process.
/// </summary>
/// <param name="process">The process to allocate in.</param>
/// <param name="base_address">Optional base address, if 0 will automatically select a base.</param>
/// <param name="region_size">The region size to allocate.</param>
/// <param name="allocation_type">The type of allocation.</param>
/// <param name="protect">The allocation protection.</param>
/// <param name="throw_on_error">True to throw on error.</param>
/// <returns>The address of the allocated region.</returns>
/// <exception cref="NtException">Thrown on error.</exception>
public static NtResult <long> AllocateMemory(SafeKernelObjectHandle process, long base_address,
long region_size, MemoryAllocationType allocation_type, MemoryAllocationProtect protect,
bool throw_on_error)
{
IntPtr base_address_ptr = new IntPtr(base_address);
IntPtr region_size_ptr = new IntPtr(region_size);
return(NtSystemCalls.NtAllocateVirtualMemory(process, ref base_address_ptr,
IntPtr.Zero, ref region_size_ptr, allocation_type, protect)
.CreateResult(throw_on_error, () => base_address_ptr.ToInt64()));
}
/// <summary>
/// Reserves, commits, or changes the state of a region of pages in the virtual address space of the calling process.
/// Memory allocated by this function is automatically initialized to zero.
/// </summary>
/// <param name="lpAddress" type="LPVOID">
/// The starting address of the region to allocate.
/// If the memory is being reserved, the specified address is rounded down to the nearest multiple of the allocation granularity.
/// If the memory is already reserved and is being committed, the address is rounded down to the next page boundary.
/// To determine the size of a page and the allocation granularity on the host computer, use the GetSystemInfo function.
/// If this parameter is NULL, the system determines where to allocate the region.
/// </param>
/// <param name="dwSize">
/// The size of the region, in bytes.
/// If the lpAddress parameter is NULL, this value is rounded up to the next page boundary.
/// Otherwise, the allocated pages include all pages containing one or more bytes in the range from lpAddress to lpAddress+dwSize.
/// This means that a 2-byte range straddling a page boundary causes both pages to be included in the allocated region.
/// </param>
/// <param name="flAllocationType">
/// The type of memory allocation.
/// </param>
/// <param name="flProtect">The memory protection for the region of pages to be allocated.
/// If the pages are being committed, you can specify any one of the memory protection constants.
/// If lpAddress specifies an address within an enclave, flProtect cannot be any of the following values:
/// PAGE_NOACCESS
/// PAGE_GUARD
/// PAGE_NOCACHE
/// PAGE_WRITECOMBINE
/// </param>
/// <returns>
/// If the function succeeds, the return value is the base address of the allocated region of pages.
/// If the function fails, the return value is NULL.To get extended error information, call GetLastError.
/// </returns>
public static IntPtr VirtualAlloc(IntPtr lpAddress, IntPtr dwSize, MemoryAllocationType flAllocationType, MemoryProtectionConstants flProtect)
{
const string flagNotSupported = "Flag not supported by the VirtualAlloc or VirtualAllocEx functions: ";
if ((flProtect & MemoryProtectionConstants.PageExecuteReadwrite) != 0)
{
throw new InvalidOperationException(flagNotSupported + nameof(MemoryProtectionConstants.PageExecuteReadwrite));
}
if ((flProtect & MemoryProtectionConstants.PageWritecopy) != 0)
{
throw new InvalidOperationException(flagNotSupported + nameof(MemoryProtectionConstants.PageWritecopy));
}
if ((flAllocationType & MemoryAllocationType.MemLargePages) != 0)
{
const string specifyLargeMustAlso = "If you specify " + nameof(MemoryAllocationType.MemLargePages) + "you must also specify: ";
if ((flAllocationType & MemoryAllocationType.MemReserve) == 0)
{
throw new InvalidOperationException(specifyLargeMustAlso + nameof(MemoryAllocationType.MemReserve));
}
if ((flAllocationType & MemoryAllocationType.MemCommit) == 0)
{
throw new InvalidOperationException(specifyLargeMustAlso + nameof(MemoryAllocationType.MemCommit));
}
}
if ((flAllocationType & MemoryAllocationType.MemPhysical) != 0 && (flAllocationType ^ MemoryAllocationType.MemReserve) != 0)
{
throw new InvalidOperationException(nameof(MemoryAllocationType.MemPhysical) + " must be used with " + nameof(MemoryAllocationType.MemReserve) + " and no other values");
}
if ((flAllocationType & MemoryAllocationType.MemWriteWatch) != 0 && (flAllocationType & MemoryAllocationType.MemReserve) == 0)
{
throw new InvalidOperationException("If you specify " + nameof(MemoryAllocationType.MemWriteWatch) + ", you must also specify " + nameof(MemoryAllocationType.MemReserve));
}
if ((flAllocationType & MemoryAllocationType.MemResetUndo) != 0 && flAllocationType != MemoryAllocationType.MemResetUndo)
{
throw new InvalidOperationException(nameof(MemoryAllocationType.MemResetUndo) + " cannot be used with any other value.");
}
return(VirtualAllocInterop(lpAddress, dwSize, flAllocationType, flProtect));
}
public LargePageMemoryChunk(ulong length)
{
const MemoryAllocationType flags = MemoryAllocationType.MemReserve | MemoryAllocationType.MemCommit;
const string lockMemory = "SeLockMemoryPrivilege";
_bytesReserved = MemoryAlignmentHelper.LargePageMultiple(length);
try
{
using var privs = PrivilegeHolder.EnablePrivilege(lockMemory);
if (privs != null)
{
const MemoryAllocationType largeFlag = flags | MemoryAllocationType.MemLargePages;
_ptr = NativeMethods.VirtualAlloc(IntPtr.Zero, (IntPtr)_bytesReserved, largeFlag, MemoryProtectionConstants.PageReadwrite);
GC.KeepAlive(privs);
}
}
catch (ObjectDisposedException)
{
// TODO: fix the underlying cause
}
_ptr = NativeMethods.VirtualAlloc(IntPtr.Zero, (IntPtr)_bytesReserved, flags, MemoryProtectionConstants.PageReadwrite);
}
/// <summary>
/// Reserves or commits a region of memory within the virtual address space of a specified process.
/// The function initializes the memory it allocates to zero, unless MEM_RESET is used.
/// </summary>
/// <param name="processHandle"></param>
/// <param name="address"></param>
/// <param name="size"></param>
/// <param name="type"></param>
/// <param name="protect"></param>
/// <returns></returns>
public static UIntPtr VirtualAllocEx(IntPtr processHandle, UIntPtr address, uint size, MemoryAllocationType type, MemoryProtect protect)
{
UIntPtr addr = UnmanagedVirtualAllocEx(processHandle, address, size, type, protect);
if (addr == UIntPtr.Zero)
{
throw new Win32Exception();
}
return addr;
}
internal static extern IntPtr VirtualAllocEx(SafeMemoryHandle hProcess, uint dwAddress, int nSize,
MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, MemoryAllocationType flAllocationType, MemProtection flProtect);
public MemoryAllocation(int begin, int end, MemoryAllocationType type)
{
Begin = begin;
End = end;
Type = type;
}
internal static extern IntPtr VirtualAllocEx(SafeProcessHandle processHandle, IntPtr baseAddress, int allocationSize, MemoryAllocationType allocationType, MemoryProtectionType protectionType);
static extern bool UnmanagedVirtualFreeEx(IntPtr hProcess, UIntPtr lpAddress,
uint dwSize, MemoryAllocationType dwFreeType);
public static IntPtr Alloc(MemoryAllocationType allocationType, int size)
{
LoadUtilsNativeWrapperLibrary();
return(NativeUtils_Alloc(allocationType, size));
}
static extern UIntPtr UnmanagedVirtualAllocEx(IntPtr hProcess, UIntPtr lpAddress,
uint dwSize, MemoryAllocationType flAllocationType, MemoryProtect flProtect);
public IntPtr MapFileView(FileMapping fileMapping, UInt64 offset, IntPtr baseAddress, MemoryProtection memoryProtection, uint size = 0, MemoryAllocationType allocationType = MemoryAllocationType.None)
{
IntPtr result = MapViewOfFile2(fileMapping.handle, handle, offset, baseAddress, size, (uint)allocationType, (uint)memoryProtection);
if (result == IntPtr.Zero)
{
throw new Win32Exception();
}
return(result);
}
public IntPtr MapFileView(FileMapping fileMapping, UInt64 offset, MemoryProtection memoryProtection, uint size = 0, MemoryAllocationType allocationType = MemoryAllocationType.None)
{
return(MapFileView(fileMapping, offset, IntPtr.Zero, memoryProtection, size, allocationType));
}
private static extern IntPtr VirtualAllocInterop(IntPtr lpAddress, IntPtr dwSize, MemoryAllocationType flAllocationType, MemoryProtectionConstants flProtect);
internal static extern IntPtr VirtualAlloc(
IntPtr lpAddress,
UIntPtr dwSize,
MemoryAllocationType flAllocationType,
MemoryProtection flProtect);
/// <summary>
/// Releases and/or decommits a region of memory within the virtual address space of a specified process.
/// </summary>
/// <param name="processHandle"></param>
/// <param name="address"></param>
/// <param name="size"></param>
/// <param name="type"></param>
public static void VirtualFreeEx(IntPtr processHandle, UIntPtr address, uint size, MemoryAllocationType type)
{
if (!UnmanagedVirtualFreeEx(processHandle, address, size, type))
{
throw new Win32Exception();
}
}
static extern UIntPtr UnmanagedVirtualAllocEx(IntPtr hProcess, UIntPtr lpAddress,
uint dwSize, MemoryAllocationType flAllocationType, MemoryProtect flProtect);
public static extern NtStatus NtAllocateVirtualMemory([In] IntPtr processHandle, [In, Out] ref IntPtr baseAddress, [In] uint zeroBits, [In, Out] ref UIntPtr regionSize, [In] MemoryAllocationType allocationType, [In] PageProtection protect);
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, uint dwAddress, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
static extern IntPtr NativeUtils_Alloc(MemoryAllocationType allocationType, int size);
static extern bool UnmanagedVirtualFreeEx(IntPtr hProcess, UIntPtr lpAddress,
uint dwSize, MemoryAllocationType dwFreeType);
public static extern Ntstatus NtMapViewOfSection(IntPtr sectionHandle, IntPtr processHandle, ref IntPtr baseAddress, UIntPtr ZeroBits, int commitSize, ref long SectionOffset, ref uint ViewSize, uint InheritDisposition, MemoryAllocationType allocationType, MemoryProtectionConstraints win32Protect);
/// <summary>
/// Allocates memory inside the opened process.
/// </summary>
/// <param name="size">Number of bytes to allocate.</param>
/// <param name="allocationType">Type of memory allocation. See <see cref="MemoryAllocationType" />.</param>
/// <param name="protect">Type of memory protection. See <see cref="MemoryProtectionType" /></param>
/// <returns>Returns NULL on failure, or the base address of the allocated memory on success.</returns>
internal IntPtr AllocateMemory(int size, MemoryAllocationType allocationType = MemoryAllocationType.MEM_COMMIT,
MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE)
{
return(Imports.VirtualAllocEx(ProcessHandle, 0, size, allocationType, protect));
}
/// <summary>
/// Reserves or commits a region of memory within the virtual address space of a specified process.
/// The function initializes the memory it allocates to zero, unless MEM_RESET is used.
/// </summary>
/// <param name="processHandle"></param>
/// <param name="address"></param>
/// <param name="size"></param>
/// <param name="type"></param>
/// <param name="protect"></param>
/// <returns></returns>
public static UIntPtr VirtualAllocEx(IntPtr processHandle, UIntPtr address, uint size, MemoryAllocationType type, MemoryProtect protect)
{
UIntPtr addr = UnmanagedVirtualAllocEx(processHandle, address, size, type, protect);
if (addr == UIntPtr.Zero)
{
throw new Win32Exception();
}
return(addr);
}
internal static extern IntPtr VirtualAllocEx(SafeMemoryHandle hProcess, uint dwAddress, int nSize,
MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
/// <summary>
/// Releases and/or decommits a region of memory within the virtual address space of a specified process.
/// </summary>
/// <param name="processHandle"></param>
/// <param name="address"></param>
/// <param name="size"></param>
/// <param name="type"></param>
public static void VirtualFreeEx(IntPtr processHandle, UIntPtr address, uint size, MemoryAllocationType type)
{
if (!UnmanagedVirtualFreeEx(processHandle, address, size, type))
{
throw new Win32Exception();
}
}
public static extern IntPtr VirtualAlloc(IntPtr blockAddress, UIntPtr sizeInBytes,
MemoryAllocationType allocationType, MemoryProtection protection);
public static IntPtr VirtualAlloc(UIntPtr sizeInBytes, MemoryAllocationType allocationType,
MemoryProtection protection)
{
return VirtualAlloc(IntPtr.Zero, sizeInBytes, allocationType, protection);
}
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, MemoryAllocationType flAllocationType, MemoryProtectionConstraints flProtect);
/// <summary>
/// Reserves, commits, or changes the state of a region of pages in the virtual address space of the calling process.
/// Memory allocated by this function is automatically initialized to zero.
/// </summary>
/// <param name="sizeInBytes">The size of the region, in bytes</param>
/// <param name="allocationType">The type of memory allocation.</param>
/// <param name="protection">The memory protection for the region of pages to be allocated.</param>
/// <returns>The base address of the allocated region of pages.</returns>
public static void* VirtualAlloc(ulong sizeInBytes, MemoryAllocationType allocationType, MemoryProtection protection)
{
var pointer = VirtualAlloc(IntPtr.Zero, new UIntPtr(sizeInBytes), allocationType, protection).ToPointer();
if (pointer == null)
throw new InvalidOperationException(Marshal.GetLastWin32Error().ToString());
return pointer;
}
