Beispiel #1
0
        public NhaamaHandle(IntPtr handle, NhaamaProcess process)
        {
            _handle  = handle;
            _process = process;

            IntPtr dupHandle = IntPtr.Zero;

            var status = NtDll.NtDuplicateObject(process.BaseProcess.Handle, handle, Process.GetCurrentProcess().Handle, out dupHandle, 0, false, DuplicateOptions.DUPLICATE_SAME_ACCESS);

            if (status != NtStatus.Success)
            {
                throw new Exception($"Could not duplicate handle. (NtStatus:{status.ToString()})");
            }

            var objectNameInformationPtr = NtDll.NtQueryObject(dupHandle, OBJECT_INFORMATION_CLASS.ObjectNameInformation);

            if (objectNameInformationPtr == IntPtr.Zero)
            {
                return;
            }

            var objInfo = Marshal.PtrToStructure <Native.Structs.OBJECT_NAME_INFORMATION>(objectNameInformationPtr);

            if (objInfo.Name.ToString() != null)
            {
                Name = objInfo.Name.ToString();
            }

            Marshal.FreeHGlobal(objectNameInformationPtr);
            NtDll.NtClose(dupHandle);
        }
Beispiel #2
0
        /// <summary>
        /// Resolve a pointer for the specified Process based on prior set values.
        /// </summary>
        /// <param name="process">The Process to act on.</param>
        public void Resolve(NhaamaProcess process)
        {
            Address = 0;

            var currentAddress = process.ReadUInt64((ulong)Module.BaseAddress + PointerPath[0]);

            for (int i = 1; i < PointerPath.Length; i++)
            {
                Address        = currentAddress + PointerPath[i];
                currentAddress = process.ReadUInt64(Address);
            }
        }
Beispiel #3
0
        public Pointer(NhaamaProcess process, string code)
        {
            var parts = code.Split('+');

            Module = process.BaseProcess.Modules.Cast <ProcessModule>().First(x => x.ModuleName == parts[0]);

            var path = parts[1].Split(',');

            PointerPath = new ulong[path.Length];
            for (int i = 0; i < path.Length; i++)
            {
                PointerPath[i] = ulong.Parse(path[i], NumberStyles.HexNumber);
            }

            Resolve(process);
        }
Beispiel #4
0
        /// <summary>
        /// Resolve a Pointer starting from the specified Module.
        /// </summary>
        /// <param name="process">The Process to act on.</param>
        /// /// <param name="module">The Module to start from.</param>
        /// <param name="pointerPath">The offsets needed to resolve the pointer.</param>
        /// <exception cref="ArgumentNullException">Gets thrown when the pointer path is null.</exception>
        /// <exception cref="ArgumentException">Gets thrown when the pointer path is empty.</exception>
        public Pointer(NhaamaProcess process, ProcessModule module, params ulong[] pointerPath)
        {
            if (pointerPath == null)
            {
                throw new ArgumentNullException("Pointer path must not be null.");
            }

            if (pointerPath.Length == 0)
            {
                throw new ArgumentException("Pointer path must have at least one step.");
            }

            PointerPath = pointerPath;
            Module      = module;

            Resolve(process);
        }
Beispiel #5
0
 /// <summary>
 /// Resolve a Pointer starting from the Process Base Address.
 /// </summary>
 /// <param name="process">The Process to act on.</param>
 /// <param name="pointerPath">The offsets needed to resolve the pointer.</param>
 public Pointer(NhaamaProcess process, params ulong[] pointerPath) : this(process,
                                                                          process.BaseProcess.MainModule, pointerPath)
 {
 }