private static extern IntPtr CreateFileMapping(
IntPtr hFile,
IntPtr lpFileMappingAttributes,
PageProtection flProtect,
uint dwMaximumSizeHigh,
uint dwMaximumSizeLow,
string lpName);
private static extern SafeWin32Handle CreateFileMapping(
SafeFileHandle hFile,
IntPtr lpFileMappingAttributes,
PageProtection flProtect,
uint dwMaximumSizeHigh,
uint dwMaximumSizeLow,
string lpName);
public bool ProtectMemory(IntPtr address, int size, PageProtection newProtection, out PageProtection oldProtection)
{
bool success = NativeMethods.VirtualProtectEx(ProcessHandle, address, (UIntPtr)size, newProtection, out var oldProtect);
oldProtection = (PageProtection)oldProtect;
return(success);
}
/// <summary>
/// Read memory from a process and attempts to temporarily change memory protection if it fails the first time
/// </summary>
private bool ReadProcessMemoryEx(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, IntPtr dwSize, out IntPtr lpNumberOfBytesRead)
{
bool success = ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, dwSize, out lpNumberOfBytesRead);
if (!success)
{
MEMORY_BASIC_INFORMATION64 mbi;
if (VirtualQueryEx(hProcess, lpBaseAddress, out mbi, MEMORY_BASIC_INFORMATION64.Size) > 0)
{
bool changePageProtection = true;
PageProtection newPageProtection = default(PageProtection);
// Attempt to give reasonable read access based on the current page protection
switch (mbi.Protect)
{
case PageProtection.PAGE_NOACCESS:
newPageProtection = PageProtection.PAGE_READONLY;
break;
case PageProtection.PAGE_EXECUTE:
newPageProtection = PageProtection.PAGE_EXECUTE_READ;
break;
case PageProtection.PAGE_EXECUTE_WRITECOPY:
newPageProtection = PageProtection.PAGE_EXECUTE_READWRITE;
break;
case PageProtection.PAGE_WRITECOPY:
newPageProtection = PageProtection.PAGE_READWRITE;
break;
default:
changePageProtection = false;
break;
}
if (changePageProtection)
{
PageProtection oldPageProtection = default(PageProtection);
if (!VirtualProtectEx(hProcess, lpBaseAddress, dwSize, newPageProtection, out oldPageProtection))
{
// We failed to obtain access
return(false);
}
success = ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, dwSize, out lpNumberOfBytesRead);
// Restore the old page protection
VirtualProtectEx(hProcess, lpBaseAddress, dwSize, oldPageProtection, out oldPageProtection);
}
}
}
return(success);
}
/// <summary>
/// Writes memory to a process and attempts to temporarily change memory page protection if it fails the first time
/// </summary>
private bool WriteProcessMemoryEx(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, IntPtr nSize, out IntPtr lpNumberOfBytesWritten)
{
bool success = WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, out lpNumberOfBytesWritten);
if (!success)
{
// We probably don't have access to this page. Change the page protection to gain access
PageProtection oldPageProtection = default(PageProtection);
if (!VirtualProtectEx(hProcess, lpBaseAddress, nSize, PageProtection.PAGE_EXECUTE_READWRITE, out oldPageProtection))
{
// We failed to obtain access
return(false);
}
success = WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, out lpNumberOfBytesWritten);
// Restore the old page protection
VirtualProtectEx(hProcess, lpBaseAddress, nSize, oldPageProtection, out oldPageProtection);
}
return(success);
}
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, PageProtection flNewProtect, ref int lpflOldProtect);
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint flAllocationType, PageProtection flProtect);
static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, PageProtection flNewProtect, out PageProtection lpflOldProtect);
public static extern SafeWin32Handle CreateFileMapping(
SafeFileHandle hFile,
IntPtr lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh,
uint dwMaximumSizeLow, string lpName);
public static extern IntPtr CreateFileMapping(IntPtr hFile,
ref SecurityAttributes lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh,
uint dwMaximumSizeLow, string lpName);
public static extern IntPtr CreateFileMapping(IntPtr hFile, ref SECURITY_ATTRIBUTES lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
public static extern NtStatus NtAllocateVirtualMemory([In] IntPtr processHandle, [In, Out] ref IntPtr baseAddress, [In] uint zeroBits, [In, Out] ref UIntPtr regionSize, [In] MemoryAllocationType allocationType, [In] PageProtection protect);
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwsize, AllocationType flAllocationType, PageProtection flProtect);
internal static extern IntPtr CreateFileMapping(IntPtr hFile, IntPtr lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
public static extern IntPtr CreateFileMapping(IntPtr hFile, ref SecurityAttributes lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
public static extern IntPtr CreateFileMapping(IntPtr hFile,
IntPtr lpFileMappingAttributes, PageProtection flProtect, int dwMaximumSizeHigh,
int dwMaximumSizeLow, [MarshalAs(UnmanagedType.LPStr)] string lpName);
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, AllocationType flAllocationType, PageProtection flProtect);
public static extern IntPtr CreateFileMapping(IntPtr hFile,
IntPtr lpFileMappingAttributes, PageProtection flProtect, int dwMaximumSizeHigh,
int dwMaximumSizeLow, [MarshalAs(UnmanagedType.LPStr)] string lpName);
static private extern void *VirtualAlloc(
void *lpAddress,
uint dwSize,
/*AllocationType*/ uint flAllocationType,
PageProtection flProtect
);
public static extern IntPtr CreateFileMapping(IntPtr hFile, ref SECURITY_ATTRIBUTES lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
internal static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpBaseAddress, UIntPtr dwSize, PageProtection flNewProtect, out IntPtr lpflOldProtect);
