예제 #1
0
        private unsafe IntPtr RemapNtModule()
        {
            var baseAddress = IntPtr.Zero;
            var uni         = new UNICODE_STRING();

            if (Is32Bits)
            {
                RtlInitUnicodeString(ref uni, $"\\KnownDlls32\\{ModuleName}");
            }
            else
            {
                RtlInitUnicodeString(ref uni, $"\\KnownDlls\\{ModuleName}");
            }

            var objAttribute = new OBJECT_ATTRIBUTES
            {
                Length     = sizeof(OBJECT_ATTRIBUTES),
                ObjectName = &uni,
                Attributes = 0x00000040
            };

            NtOpenSection(out var handler, 0x04, ref objAttribute);

            NtMapViewOfSection(handler, (IntPtr)(-1), ref baseAddress, IntPtr.Zero, IntPtr.Zero, out _, out _, 1, 0,
                               0x02);
            NtClose(handler);
            return(baseAddress);
        }
예제 #2
0
 public static extern void RtlInitUnicodeString(ref UNICODE_STRING DestinationString,
                                                [MarshalAs(UnmanagedType.LPWStr)] string SourceString);