public static extern NtStatus NtAllocateVirtualMemory( SafeKernelObjectHandle ProcessHandle, ref IntPtr BaseAddress, IntPtr ZeroBits, ref IntPtr RegionSize, MemoryAllocationType AllocationType, MemoryAllocationProtect Protect );
public static extern NtStatus NtAllocateVirtualMemoryEx( SafeKernelObjectHandle ProcessHandle, ref IntPtr BaseAddress, ref IntPtr RegionSize, MemoryAllocationType AllocationType, MemoryAllocationProtect Protect, MemExtendedParameter[] ExtendedParameters, int ExtendedParameterCount );
public IntPtr AllocateMemory(IntPtr newAddr, int size, MemoryAllocationType allocationType, MemoryProtection newProtection) { newAddr = VirtualAllocEx(handle, newAddr, size, (uint)allocationType, (uint)newProtection); if (newAddr == IntPtr.Zero) { throw new Win32Exception(); } return(newAddr); }
/// <summary> /// Allocate virtual memory in a process. /// </summary> /// <param name="process">The process to allocate in.</param> /// <param name="base_address">Optional base address, if 0 will automatically select a base.</param> /// <param name="region_size">The region size to allocate.</param> /// <param name="allocation_type">The type of allocation.</param> /// <param name="protect">The allocation protection.</param> /// <returns>The address of the allocated region.</returns> /// <exception cref="NtException">Thrown on error.</exception> public static long AllocateMemory(SafeKernelObjectHandle process, long base_address, long region_size, MemoryAllocationType allocation_type, MemoryAllocationProtect protect) { IntPtr base_address_ptr = new IntPtr(base_address); IntPtr region_size_ptr = new IntPtr(region_size); NtSystemCalls.NtAllocateVirtualMemory(process, ref base_address_ptr, IntPtr.Zero, ref region_size_ptr, allocation_type, protect).ToNtException(); return(base_address_ptr.ToInt64()); }
/// <summary> /// Allocates a block of memory in the target process. /// </summary> /// <param name="hProcess">Handle to the process in which memory will be allocated.</param> /// <param name="nSize">Number of bytes to be allocated. Default is 0x1000.</param> /// <param name="dwAllocationType">The type of memory allocation. See <see cref="MemoryAllocType"/></param> /// <param name="dwProtect">The memory protection for the region of pages to be allocated. If the pages are being committed, you can specify any one of the <see cref="MemoryProtectType"/> constants.</param> /// <returns>Returns zero on failure, or the base address of the allocated block of memory on success.</returns> public static IntPtr AllocateMemory(IntPtr hProcess, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect) { IntPtr allocatedMemory = Imports.VirtualAllocEx(hProcess, 0, nSize, dwAllocationType, dwProtect); if (allocatedMemory == IntPtr.Zero) { throw new NullReferenceException(); } return(allocatedMemory); }
/// <summary> /// Allocate virtual memory in a process. /// </summary> /// <param name="process">The process to allocate in.</param> /// <param name="base_address">Optional base address, if 0 will automatically select a base.</param> /// <param name="region_size">The region size to allocate.</param> /// <param name="allocation_type">The type of allocation.</param> /// <param name="protect">The allocation protection.</param> /// <param name="throw_on_error">True to throw on error.</param> /// <returns>The address of the allocated region.</returns> /// <exception cref="NtException">Thrown on error.</exception> public static NtResult <long> AllocateMemory(SafeKernelObjectHandle process, long base_address, long region_size, MemoryAllocationType allocation_type, MemoryAllocationProtect protect, bool throw_on_error) { IntPtr base_address_ptr = new IntPtr(base_address); IntPtr region_size_ptr = new IntPtr(region_size); return(NtSystemCalls.NtAllocateVirtualMemory(process, ref base_address_ptr, IntPtr.Zero, ref region_size_ptr, allocation_type, protect) .CreateResult(throw_on_error, () => base_address_ptr.ToInt64())); }
/// <summary> /// Reserves, commits, or changes the state of a region of pages in the virtual address space of the calling process. /// Memory allocated by this function is automatically initialized to zero. /// </summary> /// <param name="lpAddress" type="LPVOID"> /// The starting address of the region to allocate. /// If the memory is being reserved, the specified address is rounded down to the nearest multiple of the allocation granularity. /// If the memory is already reserved and is being committed, the address is rounded down to the next page boundary. /// To determine the size of a page and the allocation granularity on the host computer, use the GetSystemInfo function. /// If this parameter is NULL, the system determines where to allocate the region. /// </param> /// <param name="dwSize"> /// The size of the region, in bytes. /// If the lpAddress parameter is NULL, this value is rounded up to the next page boundary. /// Otherwise, the allocated pages include all pages containing one or more bytes in the range from lpAddress to lpAddress+dwSize. /// This means that a 2-byte range straddling a page boundary causes both pages to be included in the allocated region. /// </param> /// <param name="flAllocationType"> /// The type of memory allocation. /// </param> /// <param name="flProtect">The memory protection for the region of pages to be allocated. /// If the pages are being committed, you can specify any one of the memory protection constants. /// If lpAddress specifies an address within an enclave, flProtect cannot be any of the following values: /// PAGE_NOACCESS /// PAGE_GUARD /// PAGE_NOCACHE /// PAGE_WRITECOMBINE /// </param> /// <returns> /// If the function succeeds, the return value is the base address of the allocated region of pages. /// If the function fails, the return value is NULL.To get extended error information, call GetLastError. /// </returns> public static IntPtr VirtualAlloc(IntPtr lpAddress, IntPtr dwSize, MemoryAllocationType flAllocationType, MemoryProtectionConstants flProtect) { const string flagNotSupported = "Flag not supported by the VirtualAlloc or VirtualAllocEx functions: "; if ((flProtect & MemoryProtectionConstants.PageExecuteReadwrite) != 0) { throw new InvalidOperationException(flagNotSupported + nameof(MemoryProtectionConstants.PageExecuteReadwrite)); } if ((flProtect & MemoryProtectionConstants.PageWritecopy) != 0) { throw new InvalidOperationException(flagNotSupported + nameof(MemoryProtectionConstants.PageWritecopy)); } if ((flAllocationType & MemoryAllocationType.MemLargePages) != 0) { const string specifyLargeMustAlso = "If you specify " + nameof(MemoryAllocationType.MemLargePages) + "you must also specify: "; if ((flAllocationType & MemoryAllocationType.MemReserve) == 0) { throw new InvalidOperationException(specifyLargeMustAlso + nameof(MemoryAllocationType.MemReserve)); } if ((flAllocationType & MemoryAllocationType.MemCommit) == 0) { throw new InvalidOperationException(specifyLargeMustAlso + nameof(MemoryAllocationType.MemCommit)); } } if ((flAllocationType & MemoryAllocationType.MemPhysical) != 0 && (flAllocationType ^ MemoryAllocationType.MemReserve) != 0) { throw new InvalidOperationException(nameof(MemoryAllocationType.MemPhysical) + " must be used with " + nameof(MemoryAllocationType.MemReserve) + " and no other values"); } if ((flAllocationType & MemoryAllocationType.MemWriteWatch) != 0 && (flAllocationType & MemoryAllocationType.MemReserve) == 0) { throw new InvalidOperationException("If you specify " + nameof(MemoryAllocationType.MemWriteWatch) + ", you must also specify " + nameof(MemoryAllocationType.MemReserve)); } if ((flAllocationType & MemoryAllocationType.MemResetUndo) != 0 && flAllocationType != MemoryAllocationType.MemResetUndo) { throw new InvalidOperationException(nameof(MemoryAllocationType.MemResetUndo) + " cannot be used with any other value."); } return(VirtualAllocInterop(lpAddress, dwSize, flAllocationType, flProtect)); }
public LargePageMemoryChunk(ulong length) { const MemoryAllocationType flags = MemoryAllocationType.MemReserve | MemoryAllocationType.MemCommit; const string lockMemory = "SeLockMemoryPrivilege"; _bytesReserved = MemoryAlignmentHelper.LargePageMultiple(length); try { using var privs = PrivilegeHolder.EnablePrivilege(lockMemory); if (privs != null) { const MemoryAllocationType largeFlag = flags | MemoryAllocationType.MemLargePages; _ptr = NativeMethods.VirtualAlloc(IntPtr.Zero, (IntPtr)_bytesReserved, largeFlag, MemoryProtectionConstants.PageReadwrite); GC.KeepAlive(privs); } } catch (ObjectDisposedException) { // TODO: fix the underlying cause } _ptr = NativeMethods.VirtualAlloc(IntPtr.Zero, (IntPtr)_bytesReserved, flags, MemoryProtectionConstants.PageReadwrite); }
/// <summary> /// Reserves or commits a region of memory within the virtual address space of a specified process. /// The function initializes the memory it allocates to zero, unless MEM_RESET is used. /// </summary> /// <param name="processHandle"></param> /// <param name="address"></param> /// <param name="size"></param> /// <param name="type"></param> /// <param name="protect"></param> /// <returns></returns> public static UIntPtr VirtualAllocEx(IntPtr processHandle, UIntPtr address, uint size, MemoryAllocationType type, MemoryProtect protect) { UIntPtr addr = UnmanagedVirtualAllocEx(processHandle, address, size, type, protect); if (addr == UIntPtr.Zero) { throw new Win32Exception(); } return addr; }
internal static extern IntPtr VirtualAllocEx(SafeMemoryHandle hProcess, uint dwAddress, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, MemoryAllocationType flAllocationType, MemProtection flProtect);
public MemoryAllocation(int begin, int end, MemoryAllocationType type) { Begin = begin; End = end; Type = type; }
internal static extern IntPtr VirtualAllocEx(SafeProcessHandle processHandle, IntPtr baseAddress, int allocationSize, MemoryAllocationType allocationType, MemoryProtectionType protectionType);
static extern bool UnmanagedVirtualFreeEx(IntPtr hProcess, UIntPtr lpAddress, uint dwSize, MemoryAllocationType dwFreeType);
public static IntPtr Alloc(MemoryAllocationType allocationType, int size) { LoadUtilsNativeWrapperLibrary(); return(NativeUtils_Alloc(allocationType, size)); }
static extern UIntPtr UnmanagedVirtualAllocEx(IntPtr hProcess, UIntPtr lpAddress, uint dwSize, MemoryAllocationType flAllocationType, MemoryProtect flProtect);
public IntPtr MapFileView(FileMapping fileMapping, UInt64 offset, IntPtr baseAddress, MemoryProtection memoryProtection, uint size = 0, MemoryAllocationType allocationType = MemoryAllocationType.None) { IntPtr result = MapViewOfFile2(fileMapping.handle, handle, offset, baseAddress, size, (uint)allocationType, (uint)memoryProtection); if (result == IntPtr.Zero) { throw new Win32Exception(); } return(result); }
public IntPtr MapFileView(FileMapping fileMapping, UInt64 offset, MemoryProtection memoryProtection, uint size = 0, MemoryAllocationType allocationType = MemoryAllocationType.None) { return(MapFileView(fileMapping, offset, IntPtr.Zero, memoryProtection, size, allocationType)); }
private static extern IntPtr VirtualAllocInterop(IntPtr lpAddress, IntPtr dwSize, MemoryAllocationType flAllocationType, MemoryProtectionConstants flProtect);
internal static extern IntPtr VirtualAlloc( IntPtr lpAddress, UIntPtr dwSize, MemoryAllocationType flAllocationType, MemoryProtection flProtect);
/// <summary> /// Releases and/or decommits a region of memory within the virtual address space of a specified process. /// </summary> /// <param name="processHandle"></param> /// <param name="address"></param> /// <param name="size"></param> /// <param name="type"></param> public static void VirtualFreeEx(IntPtr processHandle, UIntPtr address, uint size, MemoryAllocationType type) { if (!UnmanagedVirtualFreeEx(processHandle, address, size, type)) { throw new Win32Exception(); } }
static extern UIntPtr UnmanagedVirtualAllocEx(IntPtr hProcess, UIntPtr lpAddress, uint dwSize, MemoryAllocationType flAllocationType, MemoryProtect flProtect);
public static extern NtStatus NtAllocateVirtualMemory([In] IntPtr processHandle, [In, Out] ref IntPtr baseAddress, [In] uint zeroBits, [In, Out] ref UIntPtr regionSize, [In] MemoryAllocationType allocationType, [In] PageProtection protect);
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, uint dwAddress, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
static extern IntPtr NativeUtils_Alloc(MemoryAllocationType allocationType, int size);
static extern bool UnmanagedVirtualFreeEx(IntPtr hProcess, UIntPtr lpAddress, uint dwSize, MemoryAllocationType dwFreeType);
public static extern Ntstatus NtMapViewOfSection(IntPtr sectionHandle, IntPtr processHandle, ref IntPtr baseAddress, UIntPtr ZeroBits, int commitSize, ref long SectionOffset, ref uint ViewSize, uint InheritDisposition, MemoryAllocationType allocationType, MemoryProtectionConstraints win32Protect);
/// <summary> /// Allocates memory inside the opened process. /// </summary> /// <param name="size">Number of bytes to allocate.</param> /// <param name="allocationType">Type of memory allocation. See <see cref="MemoryAllocationType" />.</param> /// <param name="protect">Type of memory protection. See <see cref="MemoryProtectionType" /></param> /// <returns>Returns NULL on failure, or the base address of the allocated memory on success.</returns> internal IntPtr AllocateMemory(int size, MemoryAllocationType allocationType = MemoryAllocationType.MEM_COMMIT, MemoryProtectionType protect = MemoryProtectionType.PAGE_EXECUTE_READWRITE) { return(Imports.VirtualAllocEx(ProcessHandle, 0, size, allocationType, protect)); }
/// <summary> /// Reserves or commits a region of memory within the virtual address space of a specified process. /// The function initializes the memory it allocates to zero, unless MEM_RESET is used. /// </summary> /// <param name="processHandle"></param> /// <param name="address"></param> /// <param name="size"></param> /// <param name="type"></param> /// <param name="protect"></param> /// <returns></returns> public static UIntPtr VirtualAllocEx(IntPtr processHandle, UIntPtr address, uint size, MemoryAllocationType type, MemoryProtect protect) { UIntPtr addr = UnmanagedVirtualAllocEx(processHandle, address, size, type, protect); if (addr == UIntPtr.Zero) { throw new Win32Exception(); } return(addr); }
internal static extern IntPtr VirtualAllocEx(SafeMemoryHandle hProcess, uint dwAddress, int nSize, MemoryAllocationType dwAllocationType, MemoryProtectionType dwProtect);
/// <summary> /// Releases and/or decommits a region of memory within the virtual address space of a specified process. /// </summary> /// <param name="processHandle"></param> /// <param name="address"></param> /// <param name="size"></param> /// <param name="type"></param> public static void VirtualFreeEx(IntPtr processHandle, UIntPtr address, uint size, MemoryAllocationType type) { if (!UnmanagedVirtualFreeEx(processHandle, address, size, type)) { throw new Win32Exception(); } }
public static extern IntPtr VirtualAlloc(IntPtr blockAddress, UIntPtr sizeInBytes, MemoryAllocationType allocationType, MemoryProtection protection);
public static IntPtr VirtualAlloc(UIntPtr sizeInBytes, MemoryAllocationType allocationType, MemoryProtection protection) { return VirtualAlloc(IntPtr.Zero, sizeInBytes, allocationType, protection); }
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, MemoryAllocationType flAllocationType, MemoryProtectionConstraints flProtect);
/// <summary> /// Reserves, commits, or changes the state of a region of pages in the virtual address space of the calling process. /// Memory allocated by this function is automatically initialized to zero. /// </summary> /// <param name="sizeInBytes">The size of the region, in bytes</param> /// <param name="allocationType">The type of memory allocation.</param> /// <param name="protection">The memory protection for the region of pages to be allocated.</param> /// <returns>The base address of the allocated region of pages.</returns> public static void* VirtualAlloc(ulong sizeInBytes, MemoryAllocationType allocationType, MemoryProtection protection) { var pointer = VirtualAlloc(IntPtr.Zero, new UIntPtr(sizeInBytes), allocationType, protection).ToPointer(); if (pointer == null) throw new InvalidOperationException(Marshal.GetLastWin32Error().ToString()); return pointer; }