protected override Delegate InitializeDelegate()
{
GameSharpProcess process = GameSharpProcess.Instance;
ModulePointer ntdll = process.Modules["ntdll.dll"];
IMemoryPointer ntQueryInformationProcessPtr = ntdll.GetProcAddress("NtQueryInformationProcess");
return(ntQueryInformationProcessPtr.ToDelegate <NtQueryInformationProcessDelegate>());
}
protected override Delegate InitializeDelegate()
{
IProcess process = GameSharpProcess.Instance;
ModulePointer kernel32 = process.Modules["kernel32.dll"];
IMemoryPointer IsDebuggerPresentPtr = kernel32.GetProcAddress("IsDebuggerPresent");
return(IsDebuggerPresentPtr.ToDelegate <IsDebuggerPresentDelegate>());
}
protected override Delegate InitializeDelegate()
{
GameSharpProcess process = GameSharpProcess.Instance;
ModulePointer user32dll = process.Modules["user32.dll"];
IMemoryPointer messageBoxWPtr = user32dll.GetProcAddress("MessageBoxW");
return(messageBoxWPtr.ToDelegate <MessageBoxWDelegate>());
}
public override Delegate GetHookDelegate()
{
GameSharpProcess process = GameSharpProcess.Instance;
ModulePointer user32dll = process.Modules["user32.dll"];
IMemoryPointer messageBoxWPtr = user32dll.GetProcAddress("MessageBoxW");
return(messageBoxWPtr.ToDelegate <HookMessageBoxWDelegate>());
}
public uint Call(IntPtr handle, ProcessInformationClass pic, out IMemoryPointer result, int resultLength, out IMemoryPointer bytesRead)
{
IMemoryPointer bytesReadInternal = GameSharpProcess.Instance.AllocateManagedMemory(resultLength);
IMemoryPointer resultInternal = GameSharpProcess.Instance.AllocateManagedMemory(resultLength);
uint retval = Call <uint>(handle, pic, resultInternal.Address, (uint)resultLength, bytesReadInternal.Address);
bytesRead = bytesReadInternal;
result = resultInternal;
return(retval);
}
/// <summary>
/// Wrapper for the defautl WinApi NtQueryInformationProcess, makes the code more readable.
/// </summary>
/// <typeparam name="T"></typeparam>
/// <param name="process"></param>
/// <param name="pic"></param>
/// <returns></returns>
public static T WinApiNtQueryInformationProcess <T>(GameSharpProcess process, ProcessInformationClass pic) where T : struct
{
T returnResult = default;
IMemoryPointer ntResult = process.AllocateManagedMemory(Marshal.SizeOf <T>());
uint result = Ntdll.NtQueryInformationProcess(process.NativeHandle, pic, ntResult.Address, Marshal.SizeOf <T>(), out int _);
if (result == 0)
{
returnResult = ntResult.Read <T>();
}
else
{
LoggingService.Error(
$"Couldn't query NtQueryInformationProcess, Error code: {Marshal.GetLastWin32Error().ToString("X")}, " +
$"Return value of NtQueryInformationProcess function is 0x{result.ToString("X")}.");
}
return(returnResult);
}
public void AddMetadata(int index, IMemoryPointer textPointer, TextWriter output)
{
output.WriteLine("##Index: {0}", index.ToHexString("0x"));
output.WriteLine("##Memory: {0}", textPointer);
output.WriteLine();
}