public static List <MemoryBasicInformation> LoadRegions(SafeMemoryHandle processHandle, IntPtr startAddress, IntPtr endAddress, MemoryAllocationState memoryAllocationState = MemoryAllocationState.MEM_COMMIT, MemoryProtectionType memoryProtectionType = MemoryProtectionType.PAGE_ACCESSIBLE) { List <MemoryBasicInformation> regions = new List <MemoryBasicInformation>(); if (startAddress == endAddress) { return(regions); } if (endAddress == IntPtr.Zero) { endAddress = new IntPtr(0x7fffffffffff); } IntPtr seek = startAddress; do { MemoryBasicInformation region = Native.Query(processHandle, seek, MarshalType <MemoryBasicInformation> .Size); if ((region.State & memoryAllocationState) != 0 && (region.Protect & memoryProtectionType) != 0) { regions.Add(region); } seek = IntPtr.Add(region.BaseAddress, region.RegionSize.ToInt32()); }while (seek.ToInt64() < endAddress.ToInt64()); return(regions); }
public MemoryProtectionOperation(IntPtr address, int size, int flNewProtect) { Address = address; _size = size; _type = MemoryProtectionType.Local; VirtualProtect(Address, size, flNewProtect, out _oldProtect); }
/// <summary> /// Out of process memory protection operation. /// </summary> /// <param name="hProcess"></param> /// <param name="address"></param> /// <param name="size"></param> /// <param name="flNewProtect"></param> public MemoryProtectionOperation(IntPtr hProcess, IntPtr address, int size, MemoryProtectionType flNewProtect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { HProcess = hProcess; Address = address; Size = size; FlNewProtect = flNewProtect; OutOfProcess = true; }
public MemoryProtectionOperation(IntPtr hProcess, IntPtr address, int size, int flNewProtect) { _hProcess = hProcess; Address = address; _size = size; _type = MemoryProtectionType.External; VirtualProtectEx(hProcess, Address, size, flNewProtect, out _oldProtect); }
public MemoryProtection(SafeMemoryHandle processHandle, IntPtr address, int size, MemoryProtectionType protection = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { ProcessHandle = processHandle; Address = address; Size = size; NewProtection = protection; OldProtection = NativeMethods.ChangeMemoryProtection(ProcessHandle, Address, Size, NewProtection); }
public static IntPtr Alloc([Optional] IntPtr address, int size, MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { IntPtr memAddress = Imports.VirtualAlloc(address, size, MemoryAllocationState.MEM_COMMIT, protect); if (memAddress == IntPtr.Zero) { throw new Win32Exception($"[Win32 Error: {Marshal.GetLastWin32Error()}] " + $"Unable to allocate memory at 0x{address.ToString($"X{IntPtr.Size}")}[Size: {size}]"); } return(memAddress); }
public static MemoryProtectionType ChangeMemoryProtection(SafeMemoryHandle processHandle, IntPtr address, int size, MemoryProtectionType newProtect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { MemoryProtectionType oldProtect; if (!Imports.VirtualProtectEx(processHandle, address, size, newProtect, out oldProtect)) { throw new Win32Exception($"[Win32 Error: {Marshal.GetLastWin32Error()}] " + $"Unable to change memory protection of process handle " + $"0x{processHandle.DangerousGetHandle().ToString("X")} at 0x{address.ToString($"X{IntPtr.Size}")}[Size: {size}] to {newProtect.ToString("X")}"); } return(oldProtect); }
public static IntPtr Allocate([Optional] IntPtr address, int size, MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { var ret = Imports.VirtualAlloc(address, size, MemoryAllocationState.MEM_COMMIT, protect); if (ret.Equals(0)) { throw new Win32Exception(string.Format("[Error Code: {0}] Unable to allocate memory at 0x{1}[Size: {2}]", Marshal.GetLastWin32Error(), address.ToString($"X{IntPtr.Size}"), size)); } return(ret); }
public static MemoryProtectionType ChangeMemoryProtection(IntPtr address, int size, MemoryProtectionType newProtect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { MemoryProtectionType oldProtect; if (!Imports.VirtualProtect(address, size, newProtect, out oldProtect)) { throw new Win32Exception( $"[Error Code: {Marshal.GetLastWin32Error()}] Unable to change memory protection at 0x{address.ToString($"X{IntPtr.Size}")}[Size: {size}] to {newProtect.ToString("X")}"); } return(oldProtect); }
public static IntPtr Allocate(SafeMemoryHandle processHandle, [Optional] IntPtr address, int size, MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { var ret = Imports.VirtualAllocEx(processHandle, address, size, MemoryAllocationState.MEM_COMMIT, protect); if (ret.Equals(0)) { throw new Win32Exception(string.Format( "[Error Code: {0}] Unable to allocate memory to process handle 0x{1} at 0x{2}[Size: {3}]", Marshal.GetLastWin32Error(), processHandle.DangerousGetHandle().ToString("X"), address.ToString($"X{IntPtr.Size}"), size)); } return(ret); }
public static extern bool VirtualProtect(IntPtr address, UIntPtr size, MemoryProtectionType protectionType, out MemoryProtectionType oldProtectionType);
internal static extern IntPtr VirtualAllocEx(SafeMemoryHandle hProcess, uint dwAddress, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
/// <summary> /// Allocates memory inside the opened process. /// </summary> /// <param name="size">Number of bytes to allocate.</param> /// <param name="allocationType">Type of memory allocation. See <see cref="MemoryAllocationType" />.</param> /// <param name="protect">Type of memory protection. See <see cref="MemoryProtectionType" /></param> /// <returns>Returns NULL on failure, or the base address of the allocated memory on success.</returns> internal IntPtr AllocateMemory(int size, MemoryAllocationType allocationType = MemoryAllocationType.MEM_COMMIT, MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { return(Imports.VirtualAllocEx(ProcessHandle, 0, size, allocationType, protect)); }
internal static extern IntPtr VirtualAllocEx(SafeProcessHandle processHandle, IntPtr baseAddress, int allocationSize, MemoryAllocationType allocationType, MemoryProtectionType protectionType);
internal static extern bool VirtualProtect(IntPtr lpAddress, int nSize, MemoryProtectionType flNewProtect, out MemoryProtectionType lpflOldProtect);
internal static extern bool VirtualProtectEx(SafeMemoryHandle hProcess, IntPtr lpAddress, int nSize, MemoryProtectionType flNewProtect, out MemoryProtectionType lpflOldProtect);
internal static extern IntPtr VirtualAllocEx( SafeMemoryHandle hProcess, [Optional] IntPtr lpAddress, int dwSize, MemoryAllocationState dwAllocationType, MemoryProtectionType dwProtect);
internal static IntPtr AllocateVirtualMemory(SafeProcessHandle processHandle, IntPtr baseAddress, int allocationSize, MemoryProtectionType protectionType) { var regionAddress = Kernel32.VirtualAllocEx(processHandle, baseAddress, allocationSize, MemoryAllocationType.Commit | MemoryAllocationType.Reserve, protectionType); if (regionAddress == IntPtr.Zero) { throw new PInvokeException("Failed to call VirtualAllocEx"); } return(regionAddress); }
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, uint dwAddress, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
/// <summary> /// Allocates a block of memory in the target process. /// </summary> /// <param name="hProcess">Handle to the process in which memory will be allocated.</param> /// <param name="nSize">Number of bytes to be allocated. Default is 0x1000.</param> /// <param name="dwAllocationType">The type of memory allocation. See <see cref="MemoryAllocType"/></param> /// <param name="dwProtect">The memory protection for the region of pages to be allocated. If the pages are being committed, you can specify any one of the <see cref="MemoryProtectType"/> constants.</param> /// <returns>Returns zero on failure, or the base address of the allocated block of memory on success.</returns> public static IntPtr AllocateMemory(IntPtr hProcess, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect) { IntPtr allocatedMemory = Imports.VirtualAllocEx(hProcess, 0, nSize, dwAllocationType, dwProtect); if (allocatedMemory == IntPtr.Zero) { throw new NullReferenceException(); } return(allocatedMemory); }
internal static extern bool VirtualProtectEx(SafeProcessHandle processHandle, IntPtr baseAddress, int protectionSize, MemoryProtectionType protectionType, out MemoryProtectionType oldProtectionType);
internal IntPtr AllocateVirtualMemory(int allocationSize, MemoryProtectionType protectionType) { return(AllocateVirtualMemory(IntPtr.Zero, allocationSize, protectionType)); }
/// <summary> /// In process memory protection operation. /// </summary> /// <param name="address"></param> /// <param name="size"></param> /// <param name="flNewProtect"></param> public MemoryProtectionOperation(IntPtr address, int size, MemoryProtectionType flNewProtect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) : this(IntPtr.Zero, address, size, flNewProtect) { OutOfProcess = false; }
public static extern VirtualAllocRegion VirtualAlloc(IntPtr address, UIntPtr size, VirtualAllocType allocType, MemoryProtectionType protectionType);
internal static extern IntPtr VirtualAlloc([Optional] IntPtr lpAddress, int nSize, MemoryAllocationState dwAllocationType, MemoryProtectionType dwProtect);
private static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, MemoryProtectionType flNewProtect, out MemoryProtectionType lpflOldProtect);
internal static MemoryProtectionType ProtectVirtualMemory(SafeProcessHandle processHandle, IntPtr baseAddress, int protectionSize, MemoryProtectionType protectionType) { if (!Kernel32.VirtualProtectEx(processHandle, baseAddress, protectionSize, protectionType, out var oldProtectionType)) { throw new PInvokeException("Failed to call VirtualProtectEx"); } return(oldProtectionType); }
internal static extern bool VirtualProtect(IntPtr baseAddress, int protectionSize, MemoryProtectionType protectionType, out MemoryProtectionType oldProtectionType);