internal SafeThreadHandle Invoke(SafeProcessHandle processHandle, IntPtr startAddress, IntPtr parameter) { // Initialise a buffer to store the returned thread handle var threadHandleBuffer = LocalMemoryTools.AllocateMemoryForBuffer(IntPtr.Size); // Perform the syscall const Enumerations.ThreadAccessMask desiredAccess = Enumerations.ThreadAccessMask.SpecificRightsAll | Enumerations.ThreadAccessMask.StandardRightsAll; var syscallResult = _ntCreateThreadExDelegate(threadHandleBuffer, desiredAccess, IntPtr.Zero, processHandle, startAddress, parameter, Enumerations.ThreadCreationType.HideFromDebugger, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero); if (syscallResult != Enumerations.NtStatus.Success) { ExceptionHandler.ThrowWin32Exception("Failed to create a thread in the target process", syscallResult); } try { return(new SafeThreadHandle(Marshal.PtrToStructure <IntPtr>(threadHandleBuffer), true)); } finally { LocalMemoryTools.FreeMemoryForBuffer(threadHandleBuffer); } }
internal IntPtr Invoke(SafeProcessHandle processHandle, IntPtr baseAddress) { // Initialise a buffer to store the returned memory basic information structure var memoryBasicInformationBuffer = LocalMemoryTools.AllocateMemoryForBuffer(Marshal.SizeOf <Structures.MemoryBasicInformation>()); // Perform the syscall var syscallResult = _ntQueryVirtualMemoryDelegate(processHandle, baseAddress, Enumerations.MemoryInformationClass.BasicInformation, memoryBasicInformationBuffer, (ulong)Marshal.SizeOf <Structures.MemoryBasicInformation>(), IntPtr.Zero); if (syscallResult != Enumerations.NtStatus.Success) { ExceptionHandler.ThrowWin32Exception("Failed to query memory in the target process", syscallResult); } return(memoryBasicInformationBuffer); }
internal IntPtr Invoke(SafeProcessHandle processHandle, IntPtr baseAddress, int bytesToRead) { // Initialise a buffer to store the returned bytes read var bytesReadBuffer = LocalMemoryTools.AllocateMemoryForBuffer(bytesToRead); // Perform the syscall var syscallResult = _ntReadVirtualMemoryDelegate(processHandle, baseAddress, bytesReadBuffer, (ulong)bytesToRead, IntPtr.Zero); if (syscallResult != Enumerations.NtStatus.Success) { ExceptionHandler.ThrowWin32Exception("Failed to read memory from the target process", syscallResult); } return(bytesReadBuffer); }
internal IntPtr Invoke(SafeProcessHandle processHandle, Enumerations.ProcessInformationClass processInformationClass) { // Initialise a buffer to store the returned process information structure var bufferSize = processInformationClass == Enumerations.ProcessInformationClass.BasicInformation ? Marshal.SizeOf <Structures.ProcessBasicInformation>() : sizeof(ulong); var processInformationBuffer = LocalMemoryTools.AllocateMemoryForBuffer(bufferSize); // Perform the syscall var syscallResult = _ntQueryInformationProcessDelegate(processHandle, processInformationClass, processInformationBuffer, (ulong)bufferSize, IntPtr.Zero); if (syscallResult != Enumerations.NtStatus.Success) { ExceptionHandler.ThrowWin32Exception("Failed to query the information of the target process", syscallResult); } return(processInformationBuffer); }
internal SafeProcessHandle Invoke(int processId) { // Initialise a buffer to store the returned process handle var processHandleBuffer = LocalMemoryTools.AllocateMemoryForBuffer(IntPtr.Size); // Store an empty object attributes structure in a buffer var objectAttributesBuffer = LocalMemoryTools.StoreStructureInBuffer(new Structures.ObjectAttributes()); // Store a client id structure in a buffer var clientId = new Structures.ClientId { UniqueProcess = new IntPtr(processId), UniqueThread = IntPtr.Zero }; var clientIdBuffer = LocalMemoryTools.StoreStructureInBuffer(clientId); // Perform the syscall var syscallResult = _ntOpenProcessDelegate(processHandleBuffer, Enumerations.ProcessAccessMask.AllAccess, objectAttributesBuffer, clientIdBuffer); if (syscallResult != Enumerations.NtStatus.Success) { ExceptionHandler.ThrowWin32Exception("Failed to open a handle to the target process", syscallResult); } try { return(new SafeProcessHandle(Marshal.PtrToStructure <IntPtr>(processHandleBuffer), true)); } finally { LocalMemoryTools.FreeMemoryForBuffer(processHandleBuffer); LocalMemoryTools.FreeMemoryForBuffer(objectAttributesBuffer); LocalMemoryTools.FreeMemoryForBuffer(clientIdBuffer); } }
internal Enumerations.MemoryProtectionType Invoke(SafeProcessHandle processHandle, IntPtr baseAddress, int size, Enumerations.MemoryProtectionType protectionType) { // Store the base address of the memory region to protect in a buffer var baseAddressBuffer = LocalMemoryTools.StoreStructureInBuffer(baseAddress); // Store the protection size in a buffer var sizeBuffer = LocalMemoryTools.StoreStructureInBuffer(size); // Initialise a buffer to store the returned old protection of the memory region var oldProtectionBuffer = LocalMemoryTools.AllocateMemoryForBuffer(sizeof(ulong)); // Perform the syscall var syscallResult = _ntProtectVirtualMemoryDelegate(processHandle, baseAddressBuffer, sizeBuffer, protectionType, oldProtectionBuffer); if (syscallResult != Enumerations.NtStatus.Success) { ExceptionHandler.ThrowWin32Exception("Failed to protect memory in the target process", syscallResult); } try { return((Enumerations.MemoryProtectionType)Marshal.PtrToStructure <ulong>(oldProtectionBuffer)); } finally { LocalMemoryTools.FreeMemoryForBuffer(baseAddressBuffer); LocalMemoryTools.FreeMemoryForBuffer(sizeBuffer); LocalMemoryTools.FreeMemoryForBuffer(oldProtectionBuffer); } }