public IMemoryModule LoadLibrary(string pathToDll, bool resolveReferences = true) { byte[] loadLibraryOpcodes = LoadLibraryPayload(pathToDll); IMemoryAddress allocatedMemory = AllocateManagedMemory(loadLibraryOpcodes.Length); if (Kernel32.WriteProcessMemory(NativeProcess.Handle, allocatedMemory.Address, loadLibraryOpcodes, loadLibraryOpcodes.Length, out IntPtr _)) { IMemoryModule kernel32Module = Modules["kernel32.dll"]; IMemoryAddress loadLibraryAddress; if (resolveReferences) { loadLibraryAddress = kernel32Module.GetProcAddress("LoadLibraryW"); } else { loadLibraryAddress = kernel32Module.GetProcAddress("LoadLibraryExW"); } if (loadLibraryAddress == null) { throw new Win32Exception($"Couldn't get proc address, error code: {Marshal.GetLastWin32Error()}."); } if (CreateRemoteThread(loadLibraryAddress, allocatedMemory) == IntPtr.Zero) { throw new Win32Exception($"Couldn't create a remote thread, error code: {Marshal.GetLastWin32Error()}."); } } RefreshModules(); return(Modules[Path.GetFileName(pathToDll).ToLower()]); }
protected override Delegate ToCallDelegate() { GameSharpProcess process = GameSharpProcess.Instance; IMemoryModule kernel32 = process.Modules["kernel32.dll"]; IMemoryAddress IsDebuggerPresentPtr = kernel32.GetProcAddress("IsDebuggerPresent"); return(IsDebuggerPresentPtr.ToDelegate <IsDebuggerPresentDelegate>()); }
protected override Delegate ToCallDelegate() { GameSharpProcess process = GameSharpProcess.Instance; IMemoryModule ntdll = process.Modules["ntdll.dll"]; IMemoryAddress ntQueryInformationProcessPtr = ntdll.GetProcAddress("NtQueryInformationProcess"); return(ntQueryInformationProcessPtr.ToDelegate <NtQueryInformationProcessDelegate>()); }
protected override Delegate ToCallDelegate() { GameSharpProcess process = GameSharpProcess.Instance; IMemoryModule user32dll = process.Modules["user32.dll"]; IMemoryAddress messageBoxWPtr = user32dll.GetProcAddress("MessageBoxW"); return(messageBoxWPtr.ToDelegate <MessageBoxWDelegate>()); }
private void ValidateDbgBreakPoint() { IMemoryModule ntdll = Process.Modules["ntdll.dll"]; IMemoryAddress dbgBreakPointPtr = ntdll.GetProcAddress("DbgBreakPoint"); byte dbgBreakPointByte = dbgBreakPointPtr.Read <byte>(); if (dbgBreakPointByte == 0xC3) { MemoryPatches.Add(new MemoryPatch(dbgBreakPointPtr, new byte[] { 0xCC })); } }
public void InsertMemoryModule <T>(IMemoryModule <T> module) where T : class { var type = typeof(T); if (memorymodules.ContainsKey(type)) { refcounts[type]++; } else { refcounts.Add(type, 1); memorymodules.Add(type, module); } }
/// <summary> /// Initializes a new instance of the <see cref="MemoryScanner" /> class. /// </summary> /// <param name="module"><see cref="ProcessModule"/> which we are going to scan.</param> public MemoryScanner(IMemoryModule module) { ModuleBase = module.MemoryAddress; Bytes = ModuleBase.Read(module.ModuleMemorySize); }