public static void RtlGetVersion(ref SpDi.Native.OSVERSIONINFOEX VersionInformation) { object[] funcargs = { VersionInformation }; SpDi.Native.NTSTATUS retValue = (SpDi.Native.NTSTATUS)Generic.DynamicAPIInvoke(@"ntdll.dll", @"RtlGetVersion", typeof(DELEGATES.RtlGetVersion), ref funcargs); if (retValue != SpDi.Native.NTSTATUS.Success) { throw new InvalidOperationException("Failed get procedure address, " + retValue); } VersionInformation = (SpDi.Native.OSVERSIONINFOEX)funcargs[0]; }
public static void RewriteModuleIAT(PE.PE_META_DATA PEINFO, IntPtr ModuleMemoryBase) { PE.IMAGE_DATA_DIRECTORY idd = PEINFO.Is32Bit ? PEINFO.OptHeader32.ImportTable : PEINFO.OptHeader64.ImportTable; IntPtr pImportTable = (IntPtr)((UInt64)ModuleMemoryBase + idd.VirtualAddress); SpDi.Native.OSVERSIONINFOEX OSVersion = new SpDi.Native.OSVERSIONINFOEX(); SpDi2.Native.RtlGetVersion(ref OSVersion); Dictionary <string, string> ApiSetDict = new Dictionary <string, string>(); if (OSVersion.MajorVersion >= 10) { ApiSetDict = SpDi2.Generic.GetApiSetMapping(); } int counter = 0; SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR iid = new SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR(); iid = (SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR)Marshal.PtrToStructure( (IntPtr)((UInt64)pImportTable + (uint)(Marshal.SizeOf(iid) * counter)), typeof(SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR) ); while (iid.Name != 0) { string DllName = string.Empty; try { DllName = Marshal.PtrToStringAnsi((IntPtr)((UInt64)ModuleMemoryBase + iid.Name)); } catch { } if (DllName == string.Empty) { throw new InvalidOperationException("Failed to read DLL name."); } else { if (OSVersion.MajorVersion >= 10 && (DllName.StartsWith("api-") || DllName.StartsWith("ext-")) && ApiSetDict.ContainsKey(DllName) && ApiSetDict[DllName].Length > 0) { DllName = ApiSetDict[DllName]; } IntPtr hModule = SpDi2.Generic.GetLoadedModuleAddress(DllName); if (hModule == IntPtr.Zero) { hModule = SpDi2.Generic.LoadModuleFromDisk(DllName); if (hModule == IntPtr.Zero) { throw new FileNotFoundException(DllName + ", unable to find the specified file."); } } if (PEINFO.Is32Bit) { PE.IMAGE_THUNK_DATA32 oft_itd = new PE.IMAGE_THUNK_DATA32(); for (int i = 0; true; i++) { oft_itd = (PE.IMAGE_THUNK_DATA32)Marshal.PtrToStructure((IntPtr)((UInt64)ModuleMemoryBase + iid.OriginalFirstThunk + (UInt32)(i * (sizeof(UInt32)))), typeof(PE.IMAGE_THUNK_DATA32)); IntPtr ft_itd = (IntPtr)((UInt64)ModuleMemoryBase + iid.FirstThunk + (UInt64)(i * (sizeof(UInt32)))); if (oft_itd.AddressOfData == 0) { break; } if (oft_itd.AddressOfData < 0x80000000) { IntPtr pImpByName = (IntPtr)((UInt64)ModuleMemoryBase + oft_itd.AddressOfData + sizeof(UInt16)); IntPtr pFunc = IntPtr.Zero; pFunc = SpDi2.Generic.GetNativeExportAddress(hModule, Marshal.PtrToStringAnsi(pImpByName)); Marshal.WriteInt32(ft_itd, pFunc.ToInt32()); } else { ulong fOrdinal = oft_itd.AddressOfData & 0xFFFF; IntPtr pFunc = IntPtr.Zero; pFunc = SpDi2.Generic.GetNativeExportAddress(hModule, (short)fOrdinal); Marshal.WriteInt32(ft_itd, pFunc.ToInt32()); } } } else { PE.IMAGE_THUNK_DATA64 oft_itd = new PE.IMAGE_THUNK_DATA64(); for (int i = 0; true; i++) { oft_itd = (PE.IMAGE_THUNK_DATA64)Marshal.PtrToStructure((IntPtr)((UInt64)ModuleMemoryBase + iid.OriginalFirstThunk + (UInt64)(i * (sizeof(UInt64)))), typeof(PE.IMAGE_THUNK_DATA64)); IntPtr ft_itd = (IntPtr)((UInt64)ModuleMemoryBase + iid.FirstThunk + (UInt64)(i * (sizeof(UInt64)))); if (oft_itd.AddressOfData == 0) { break; } if (oft_itd.AddressOfData < 0x8000000000000000) { IntPtr pImpByName = (IntPtr)((UInt64)ModuleMemoryBase + oft_itd.AddressOfData + sizeof(UInt16)); IntPtr pFunc = IntPtr.Zero; pFunc = SpDi2.Generic.GetNativeExportAddress(hModule, Marshal.PtrToStringAnsi(pImpByName)); Marshal.WriteInt64(ft_itd, pFunc.ToInt64()); } else { ulong fOrdinal = oft_itd.AddressOfData & 0xFFFF; IntPtr pFunc = IntPtr.Zero; pFunc = SpDi2.Generic.GetNativeExportAddress(hModule, (short)fOrdinal); Marshal.WriteInt64(ft_itd, pFunc.ToInt64()); } } } counter++; iid = (SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR)Marshal.PtrToStructure( (IntPtr)((UInt64)pImportTable + (uint)(Marshal.SizeOf(iid) * counter)), typeof(SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR) ); } } }