Exemplo n.º 1
0
        /// <summary>
        /// Get the address of an exported module function.
        /// </summary>
        /// <param name="module">Module address.</param>
        /// <param name="functionName">Name of the exported method.</param>
        /// <param name="address">Address to the function.</param>
        public void GetFunctionAddress(IntPtr module, string functionName, out IntPtr address)
        {
            var getProcAddressParams = new GetProcAddressParams(module, this.WriteNullTerminatedASCIIString(functionName));
            var lpParameter          = this.circularBuffer.Add(ref getProcAddressParams);

            if (lpParameter == IntPtr.Zero)
            {
                throw new Exception("Unable to allocate GetProcAddress parameter ptr");
            }

            var threadHandle = CreateRemoteThread(
                this.targetProcess.Handle,
                IntPtr.Zero,
                UIntPtr.Zero,
                this.getProcAddressShellPtr,
                lpParameter,
                CreateThreadFlags.RunImmediately,
                out _);

            _ = WaitForSingleObject(threadHandle, uint.MaxValue);

            this.extMemory.Read(this.getProcAddressRetPtr, out address);

            if (address == IntPtr.Zero)
            {
                throw new Exception($"Error calling GetProcAddress with {functionName}");
            }
        }
Exemplo n.º 2
0
        /* Call Shellcode */

        public long GetProcAddress(long hModule, string functionName)
        {
            var    getProcAddressParams = new GetProcAddressParams(hModule, WriteNullTerminatedASCIIString(functionName));
            long   lpParameter          = (long)_circularBuffer.Add(ref getProcAddressParams);
            IntPtr threadHandle         = CreateRemoteThread(_targetProcess.Handle, IntPtr.Zero, UIntPtr.Zero, (IntPtr)_getProcAddressShellPtr, (IntPtr)lpParameter, CREATE_THREAD_FLAGS.RUN_IMMEDIATELY, out uint threadId);

            WaitForSingleObject(threadHandle, uint.MaxValue);

            _memory.Read((IntPtr)_getProcAddressReturnValuePtr, out long value);
            return(value);
        }