Esempio n. 1
0
        /// <summary>
        ///     Executes the assembly code located in the remote process at the specified address.
        /// </summary>
        /// <param name="address">The address where the assembly code is located.</param>
        /// <param name="callingConvention">The calling convention used to execute the assembly code with the parameters.</param>
        /// <param name="parameters">An array of parameters used to execute the assembly code.</param>
        /// <returns>The return value is the exit code of the thread created to execute the assembly code.</returns>
        public T Execute <T>(IntPtr address, Native.Types.CallingConventions callingConvention,
                             params dynamic[] parameters)
        {
            // Marshal the parameters
            var marshalledParameters =
                parameters.Select(p => MarshalValue.Marshal(Process, p)).Cast <IMarshalledValue>().ToArray();
            // Start a transaction
            AssemblyTransaction t;

            using (t = BeginTransaction())
            {
                // Get the object dedicated to create mnemonics for the given calling convention
                var calling = CallingConventionSelector.Get(callingConvention);
                // Push the parameters
                t.AddLine(calling.FormatParameters(marshalledParameters.Select(p => p.Reference).ToArray()));
                // Call the function
                t.AddLine(calling.FormatCalling(address));
                // Clean the parameters
                if (calling.Cleanup == CleanupTypes.Caller)
                {
                    t.AddLine(calling.FormatCleaning(marshalledParameters.Length));
                }
                // Add the return mnemonic
                t.AddLine("retn");
            }

            // Clean the marshalled parameters
            foreach (var parameter in marshalledParameters)
            {
                parameter.Dispose();
            }
            // Return the exit code
            return(t.GetExitCode <T>());
        }
Esempio n. 2
0
 /// <summary>Executes the assembly code located in the remote process at the specified address.</summary>
 /// <param name="address">The address where the assembly code is located.</param>
 /// <param name="callingConvention">
 ///   The calling convention used to execute the assembly code with
 ///   the parameters.
 /// </param>
 /// <param name="executingThread">Thread to hijack.</param>
 /// <returns>The return value is the exit code of the thread created to execute the assembly code.</returns>
 public IntPtr Execute(IntPtr address,
                       Native.Types.CallingConventions callingConvention,
                       IRemoteThread executingThread)
 {
     return(Execute <IntPtr>(address,
                             callingConvention,
                             executingThread));
 }
Esempio n. 3
0
 /// <summary>
 ///   Executes asynchronously the assembly code located in the remote process at the
 ///   specified address.
 /// </summary>
 /// <param name="address">The address where the assembly code is located.</param>
 /// <param name="callingConvention">
 ///   The calling convention used to execute the assembly code with
 ///   the parameters.
 /// </param>
 /// <param name="executingThread">Thread to hijack. Will create a new thread if null.</param>
 /// <param name="parameters">An array of parameters used to execute the assembly code.</param>
 /// <returns>
 ///   The return value is an asynchronous operation that return the exit code of the thread
 ///   created to execute the assembly code.
 /// </returns>
 public Task <IntPtr> ExecuteAsync(IntPtr address,
                                   Native.Types.CallingConventions callingConvention,
                                   IRemoteThread executingThread = null,
                                   params dynamic[]                parameters)
 {
     return(ExecuteAsync <IntPtr>(address,
                                  callingConvention,
                                  executingThread,
                                  parameters));
 }
Esempio n. 4
0
        /// <summary>
        ///     Gets a calling convention object according the given type.
        /// </summary>
        /// <param name="callingConvention">The type of calling convention to get.</param>
        /// <returns>The return value is a singleton of a <see cref="ICallingConvention" /> child.</returns>
        public static ICallingConvention Get(Native.Types.CallingConventions callingConvention)
        {
            switch (callingConvention)
            {
            case Native.Types.CallingConventions.Cdecl:
                return(Singleton <CdeclCallingConvention> .Instance);

            case Native.Types.CallingConventions.Stdcall:
                return(Singleton <StdcallCallingConvention> .Instance);

            case Native.Types.CallingConventions.Fastcall:
                return(Singleton <FastcallCallingConvention> .Instance);

            case Native.Types.CallingConventions.Thiscall:
                return(Singleton <ThiscallCallingConvention> .Instance);

            default:
                throw new ApplicationException("Unsupported calling convention.");
            }
        }
Esempio n. 5
0
        /// <summary>Executes the assembly code located in the remote process at the specified address.</summary>
        /// <param name="address">The address where the assembly code is located.</param>
        /// <param name="callingConvention">
        ///   The calling convention used to execute the assembly code with
        ///   the parameters.
        /// </param>
        /// <param name="executingThread">Thread to hijack.</param>
        /// <returns>The return value is the exit code of the thread created to execute the assembly code.</returns>
        public T Execute <T>(IntPtr address,
                             Native.Types.CallingConventions callingConvention,
                             IRemoteThread executingThread)
        {
            // Start a transaction
            AssemblyTransaction t;

            using (t = BeginTransaction(true,
                                        executingThread))
            {
                // Get the object dedicated to create mnemonics for the given calling convention
                var calling = CallingConventionSelector.Get(callingConvention);

                // Call the function
                t.AddLine(calling.FormatCalling(address));

                // Add the return mnemonic
                t.AddLine("retn");
            }

            return(t.GetExitCode <T>());
        }
Esempio n. 6
0
 /// <summary>
 ///     Executes asynchronously the assembly code located in the remote process at the specified address.
 /// </summary>
 /// <param name="address">The address where the assembly code is located.</param>
 /// <param name="callingConvention">The calling convention used to execute the assembly code with the parameters.</param>
 /// <param name="parameters">An array of parameters used to execute the assembly code.</param>
 /// <returns>
 ///     The return value is an asynchronous operation that return the exit code of the thread created to execute the
 ///     assembly code.
 /// </returns>
 public Task <IntPtr> ExecuteAsync(IntPtr address, Native.Types.CallingConventions callingConvention,
                                   params dynamic[] parameters)
 {
     return(ExecuteAsync <IntPtr>(address, callingConvention, parameters));
 }
Esempio n. 7
0
 /// <summary>
 ///     Executes asynchronously the assembly code located in the remote process at the specified address.
 /// </summary>
 /// <param name="address">The address where the assembly code is located.</param>
 /// <param name="callingConvention">The calling convention used to execute the assembly code with the parameters.</param>
 /// <param name="parameters">An array of parameters used to execute the assembly code.</param>
 /// <returns>
 ///     The return value is an asynchronous operation that return the exit code of the thread created to execute the
 ///     assembly code.
 /// </returns>
 public Task <T> ExecuteAsync <T>(IntPtr address, Native.Types.CallingConventions callingConvention,
                                  params dynamic[] parameters)
 {
     return(Task.Run(() => Execute <T>(address, callingConvention, parameters)));
 }