private unsafe IntPtr RemapNtModule() { var baseAddress = IntPtr.Zero; var uni = new UNICODE_STRING(); if (Is32Bits) { RtlInitUnicodeString(ref uni, $"\\KnownDlls32\\{ModuleName}"); } else { RtlInitUnicodeString(ref uni, $"\\KnownDlls\\{ModuleName}"); } var objAttribute = new OBJECT_ATTRIBUTES { Length = sizeof(OBJECT_ATTRIBUTES), ObjectName = &uni, Attributes = 0x00000040 }; NtOpenSection(out var handler, 0x04, ref objAttribute); NtMapViewOfSection(handler, (IntPtr)(-1), ref baseAddress, IntPtr.Zero, IntPtr.Zero, out _, out _, 1, 0, 0x02); NtClose(handler); return(baseAddress); }
public static extern void RtlInitUnicodeString(ref UNICODE_STRING DestinationString, [MarshalAs(UnmanagedType.LPWStr)] string SourceString);