public static ulong CreateSection(this Process process, NT.MemoryProtection memoryProtection, long size)
{
var result = NT.NtCreateSection(out ulong sectionHandle, NT.ACCESS_MASK.GENERIC_ALL, 0, out size, memoryProtection, 0x8000000 /*SEC_COMMIT*/, 0);
if (result != 0)
{
throw new Exception($"CreateSection - NtCreateSection() failed - {result.ToString("x2")}");
}
return(sectionHandle);
}
public static ulong MapSection(this Process process, ulong sectionHandle, NT.MemoryProtection memoryProtection)
{
ulong memoryPointer = 0;
var result = NT.NtMapViewOfSection(sectionHandle, process.Handle, ref memoryPointer, 0, 0, 0, out uint viewSize, 2, 0, memoryProtection);
if (result != 0)
{
throw new Exception($"MapSection - NtMapViewOfSection() failed - {result.ToString("x2")}");
}
return(memoryPointer);
}
public static extern int NtMapViewOfSection(
ulong SectionHandle, IntPtr ProcessHandle, ref ulong BaseAddress,
ulong ZeroBits, uint CommitSize, long SectionOffset,
out uint ViewSize, uint InheritDisposition, uint AllocationType,
NT.MemoryProtection Win32Protect);
public static extern uint NtCreateSection(
out ulong SectionHandle, ACCESS_MASK DesiredAccess, int ObjectAttributes,
out long MaximumSize, NT.MemoryProtection SectionPageProtection, uint AllocationAttributes,
ulong FileHandle);
public static extern bool VirtualProtectEx(IntPtr hProcess, ulong lpAddress, int dwSize, NT.MemoryProtection flNewProtect, out NT.MemoryProtection lpflOldProtect);
public static ulong AllocateAndWrite(this Process process, byte[] buffer, NT.AllocationType allocationType, NT.MemoryProtection memoryProtection)
{
ulong allocatedMemory = process.AllocateMemory((uint)buffer.Length, allocationType, memoryProtection);
process.WriteRawMemory(buffer, allocatedMemory);
return(allocatedMemory);
}
public static NT.MemoryProtection VirtualProtect(this Process process, ulong memoryPointer, int size, NT.MemoryProtection newProtect)
{
if (!NT.VirtualProtectEx(process.Handle, memoryPointer, size, newProtect, out NT.MemoryProtection oldProtect))
{
throw new Exception($"VirtualProtect - VirtualProtectEx() failed - {Marshal.GetLastWin32Error().ToString("x2")}");
}
return(oldProtect);
}
public static ulong AllocateMemory(this Process process, uint length, NT.AllocationType allocationType, NT.MemoryProtection memoryProtection) => NT.VirtualAllocEx(process.Handle, 0, length, allocationType, memoryProtection);
