Ejemplo n.º 1
0
        /// <summary>
        ///     Executes the assembly code located in the remote process at the specified address.
        /// </summary>
        /// <param name="address">The address where the assembly code is located.</param>
        /// <param name="callingConvention">The calling convention used to execute the assembly code with the parameters.</param>
        /// <param name="parameters">An array of parameters used to execute the assembly code.</param>
        /// <returns>The return value is the exit code of the thread created to execute the assembly code.</returns>
        public T Execute <T>(IntPtr address, Native.Types.CallingConventions callingConvention,
                             params dynamic[] parameters)
        {
            // Marshal the parameters
            var marshalledParameters =
                parameters.Select(p => MarshalValue.Marshal(Process, p)).Cast <IMarshalledValue>().ToArray();
            // Start a transaction
            AssemblyTransaction t;

            using (t = BeginTransaction())
            {
                // Get the object dedicated to create mnemonics for the given calling convention
                var calling = CallingConventionSelector.Get(callingConvention);
                // Push the parameters
                t.AddLine(calling.FormatParameters(marshalledParameters.Select(p => p.Reference).ToArray()));
                // Call the function
                t.AddLine(calling.FormatCalling(address));
                // Clean the parameters
                if (calling.Cleanup == CleanupTypes.Caller)
                {
                    t.AddLine(calling.FormatCleaning(marshalledParameters.Length));
                }
                // Add the return mnemonic
                t.AddLine("retn");
            }

            // Clean the marshalled parameters
            foreach (var parameter in marshalledParameters)
            {
                parameter.Dispose();
            }
            // Return the exit code
            return(t.GetExitCode <T>());
        }
Ejemplo n.º 2
0
        public T Execute <T>(IntPtr address, CallingConvention callingConvention, params dynamic[] parameters)
        {
            var marshalledParameters = parameters.Select(p => MarshalValue.Marshal(m_Process, p)).Cast <IMarshalledValue>().ToArray();

            var calling = callingConvention == CallingConvention.Default ?
                          CallingConventionSelector.Get(m_Process.Is64Bit ? CallingConvention.FastCall64 : CallingConvention.StdCall) :
                          CallingConventionSelector.Get(m_Process.Is64Bit ? CallingConvention.FastCall64 : callingConvention);

            AssemblyTransaction t;

            using (t = BeginTransaction()) {
                t.Add(calling.FormatCall(address, marshalledParameters.Select(p => p.Reference).ToArray()));
            }

            foreach (var parameter in marshalledParameters)
            {
                parameter.Dispose();
            }

            return(t.GetExitCode <T>());
        }
Ejemplo n.º 3
0
        /// <summary>Executes the assembly code located in the remote process at the specified address.</summary>
        /// <param name="address">The address where the assembly code is located.</param>
        /// <param name="callingConvention">
        ///   The calling convention used to execute the assembly code with
        ///   the parameters.
        /// </param>
        /// <param name="executingThread">Thread to hijack.</param>
        /// <returns>The return value is the exit code of the thread created to execute the assembly code.</returns>
        public T Execute <T>(IntPtr address,
                             Native.Types.CallingConventions callingConvention,
                             IRemoteThread executingThread)
        {
            // Start a transaction
            AssemblyTransaction t;

            using (t = BeginTransaction(true,
                                        executingThread))
            {
                // Get the object dedicated to create mnemonics for the given calling convention
                var calling = CallingConventionSelector.Get(callingConvention);

                // Call the function
                t.AddLine(calling.FormatCalling(address));

                // Add the return mnemonic
                t.AddLine("retn");
            }

            return(t.GetExitCode <T>());
        }