internal SafeThreadHandle Invoke(SafeProcessHandle processHandle, IntPtr startAddress, IntPtr parameter)
{
// Initialise a buffer to store the returned thread handle
var threadHandleBuffer = LocalMemoryTools.AllocateMemoryForBuffer(IntPtr.Size);
// Perform the syscall
const Enumerations.ThreadAccessMask desiredAccess = Enumerations.ThreadAccessMask.SpecificRightsAll | Enumerations.ThreadAccessMask.StandardRightsAll;
var syscallResult = _ntCreateThreadExDelegate(threadHandleBuffer, desiredAccess, IntPtr.Zero, processHandle, startAddress, parameter, Enumerations.ThreadCreationType.HideFromDebugger, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
if (syscallResult != Enumerations.NtStatus.Success)
{
ExceptionHandler.ThrowWin32Exception("Failed to create a thread in the target process", syscallResult);
}
try
{
return(new SafeThreadHandle(Marshal.PtrToStructure <IntPtr>(threadHandleBuffer), true));
}
finally
{
LocalMemoryTools.FreeMemoryForBuffer(threadHandleBuffer);
}
}
internal IntPtr Invoke(SafeProcessHandle processHandle, IntPtr baseAddress)
{
// Initialise a buffer to store the returned memory basic information structure
var memoryBasicInformationBuffer = LocalMemoryTools.AllocateMemoryForBuffer(Marshal.SizeOf <Structures.MemoryBasicInformation>());
// Perform the syscall
var syscallResult = _ntQueryVirtualMemoryDelegate(processHandle, baseAddress, Enumerations.MemoryInformationClass.BasicInformation, memoryBasicInformationBuffer, (ulong)Marshal.SizeOf <Structures.MemoryBasicInformation>(), IntPtr.Zero);
if (syscallResult != Enumerations.NtStatus.Success)
{
ExceptionHandler.ThrowWin32Exception("Failed to query memory in the target process", syscallResult);
}
return(memoryBasicInformationBuffer);
}
internal IntPtr Invoke(SafeProcessHandle processHandle, IntPtr baseAddress, int bytesToRead)
{
// Initialise a buffer to store the returned bytes read
var bytesReadBuffer = LocalMemoryTools.AllocateMemoryForBuffer(bytesToRead);
// Perform the syscall
var syscallResult = _ntReadVirtualMemoryDelegate(processHandle, baseAddress, bytesReadBuffer, (ulong)bytesToRead, IntPtr.Zero);
if (syscallResult != Enumerations.NtStatus.Success)
{
ExceptionHandler.ThrowWin32Exception("Failed to read memory from the target process", syscallResult);
}
return(bytesReadBuffer);
}
internal IntPtr Invoke(SafeProcessHandle processHandle, Enumerations.ProcessInformationClass processInformationClass)
{
// Initialise a buffer to store the returned process information structure
var bufferSize = processInformationClass == Enumerations.ProcessInformationClass.BasicInformation ? Marshal.SizeOf <Structures.ProcessBasicInformation>() : sizeof(ulong);
var processInformationBuffer = LocalMemoryTools.AllocateMemoryForBuffer(bufferSize);
// Perform the syscall
var syscallResult = _ntQueryInformationProcessDelegate(processHandle, processInformationClass, processInformationBuffer, (ulong)bufferSize, IntPtr.Zero);
if (syscallResult != Enumerations.NtStatus.Success)
{
ExceptionHandler.ThrowWin32Exception("Failed to query the information of the target process", syscallResult);
}
return(processInformationBuffer);
}
internal SafeProcessHandle Invoke(int processId)
{
// Initialise a buffer to store the returned process handle
var processHandleBuffer = LocalMemoryTools.AllocateMemoryForBuffer(IntPtr.Size);
// Store an empty object attributes structure in a buffer
var objectAttributesBuffer = LocalMemoryTools.StoreStructureInBuffer(new Structures.ObjectAttributes());
// Store a client id structure in a buffer
var clientId = new Structures.ClientId {
UniqueProcess = new IntPtr(processId), UniqueThread = IntPtr.Zero
};
var clientIdBuffer = LocalMemoryTools.StoreStructureInBuffer(clientId);
// Perform the syscall
var syscallResult = _ntOpenProcessDelegate(processHandleBuffer, Enumerations.ProcessAccessMask.AllAccess, objectAttributesBuffer, clientIdBuffer);
if (syscallResult != Enumerations.NtStatus.Success)
{
ExceptionHandler.ThrowWin32Exception("Failed to open a handle to the target process", syscallResult);
}
try
{
return(new SafeProcessHandle(Marshal.PtrToStructure <IntPtr>(processHandleBuffer), true));
}
finally
{
LocalMemoryTools.FreeMemoryForBuffer(processHandleBuffer);
LocalMemoryTools.FreeMemoryForBuffer(objectAttributesBuffer);
LocalMemoryTools.FreeMemoryForBuffer(clientIdBuffer);
}
}
internal Enumerations.MemoryProtectionType Invoke(SafeProcessHandle processHandle, IntPtr baseAddress, int size, Enumerations.MemoryProtectionType protectionType)
{
// Store the base address of the memory region to protect in a buffer
var baseAddressBuffer = LocalMemoryTools.StoreStructureInBuffer(baseAddress);
// Store the protection size in a buffer
var sizeBuffer = LocalMemoryTools.StoreStructureInBuffer(size);
// Initialise a buffer to store the returned old protection of the memory region
var oldProtectionBuffer = LocalMemoryTools.AllocateMemoryForBuffer(sizeof(ulong));
// Perform the syscall
var syscallResult = _ntProtectVirtualMemoryDelegate(processHandle, baseAddressBuffer, sizeBuffer, protectionType, oldProtectionBuffer);
if (syscallResult != Enumerations.NtStatus.Success)
{
ExceptionHandler.ThrowWin32Exception("Failed to protect memory in the target process", syscallResult);
}
try
{
return((Enumerations.MemoryProtectionType)Marshal.PtrToStructure <ulong>(oldProtectionBuffer));
}
finally
{
LocalMemoryTools.FreeMemoryForBuffer(baseAddressBuffer);
LocalMemoryTools.FreeMemoryForBuffer(sizeBuffer);
LocalMemoryTools.FreeMemoryForBuffer(oldProtectionBuffer);
}
}