private void MapSections(PeFile peHeaders, IntPtr baseAddress, IntPtr remoteAddress) { var processId = _process.Id; // Get the dll section headers var sectionHeaders = peHeaders.ImageSectionHeaders; foreach (var section in sectionHeaders) { // Get the protection of the section var sectionProtection = GetSectionProtection((Native.DataSectionFlags)section.Characteristics); // Determine the address to map the section to in the process var sectionAddress = remoteAddress + (int)section.VirtualAddress; // Get the address of the raw data of the section in the host process var rawDataAddress = baseAddress + (int)section.PointerToRawData; // Get the size of the raw data of the section var rawDataSize = (int)section.SizeOfRawData; // Get the raw data of the section var rawData = new byte[rawDataSize]; Marshal.Copy(rawDataAddress, rawData, 0, rawDataSize); // Map the section into the process try { _memoryModule.WriteMemory(processId, sectionAddress, rawData); } catch (Win32Exception) { ExceptionHandler.ThrowWin32Exception("Failed to write a section into the process"); } // Adjust the protection of the section in the process try { _memoryModule.ProtectMemory(processId, sectionAddress, rawDataSize, sectionProtection); } catch (Win32Exception) { ExceptionHandler.ThrowWin32Exception("Failed to adjust the protection of a section in the process"); } } }
public void TestProtectMemory() { // Allocate memory in the host process const int testRegionSize = 32; var testRegionAddress = _memoryModule.AllocateMemory(_hostProcessName, testRegionSize); // Protect the memory that was allocated var result = _memoryModule.ProtectMemory(_hostProcessName, testRegionAddress, testRegionSize, 0x01); Assert.True(result); // Free the memory that was allocated _memoryModule.FreeMemory(_hostProcessName, testRegionAddress); }