private static extern IntPtr CreateFileMapping( IntPtr hFile, IntPtr lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
private static extern SafeWin32Handle CreateFileMapping( SafeFileHandle hFile, IntPtr lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
public bool ProtectMemory(IntPtr address, int size, PageProtection newProtection, out PageProtection oldProtection) { bool success = NativeMethods.VirtualProtectEx(ProcessHandle, address, (UIntPtr)size, newProtection, out var oldProtect); oldProtection = (PageProtection)oldProtect; return(success); }
/// <summary> /// Read memory from a process and attempts to temporarily change memory protection if it fails the first time /// </summary> private bool ReadProcessMemoryEx(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, IntPtr dwSize, out IntPtr lpNumberOfBytesRead) { bool success = ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, dwSize, out lpNumberOfBytesRead); if (!success) { MEMORY_BASIC_INFORMATION64 mbi; if (VirtualQueryEx(hProcess, lpBaseAddress, out mbi, MEMORY_BASIC_INFORMATION64.Size) > 0) { bool changePageProtection = true; PageProtection newPageProtection = default(PageProtection); // Attempt to give reasonable read access based on the current page protection switch (mbi.Protect) { case PageProtection.PAGE_NOACCESS: newPageProtection = PageProtection.PAGE_READONLY; break; case PageProtection.PAGE_EXECUTE: newPageProtection = PageProtection.PAGE_EXECUTE_READ; break; case PageProtection.PAGE_EXECUTE_WRITECOPY: newPageProtection = PageProtection.PAGE_EXECUTE_READWRITE; break; case PageProtection.PAGE_WRITECOPY: newPageProtection = PageProtection.PAGE_READWRITE; break; default: changePageProtection = false; break; } if (changePageProtection) { PageProtection oldPageProtection = default(PageProtection); if (!VirtualProtectEx(hProcess, lpBaseAddress, dwSize, newPageProtection, out oldPageProtection)) { // We failed to obtain access return(false); } success = ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, dwSize, out lpNumberOfBytesRead); // Restore the old page protection VirtualProtectEx(hProcess, lpBaseAddress, dwSize, oldPageProtection, out oldPageProtection); } } } return(success); }
/// <summary> /// Writes memory to a process and attempts to temporarily change memory page protection if it fails the first time /// </summary> private bool WriteProcessMemoryEx(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, IntPtr nSize, out IntPtr lpNumberOfBytesWritten) { bool success = WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, out lpNumberOfBytesWritten); if (!success) { // We probably don't have access to this page. Change the page protection to gain access PageProtection oldPageProtection = default(PageProtection); if (!VirtualProtectEx(hProcess, lpBaseAddress, nSize, PageProtection.PAGE_EXECUTE_READWRITE, out oldPageProtection)) { // We failed to obtain access return(false); } success = WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, out lpNumberOfBytesWritten); // Restore the old page protection VirtualProtectEx(hProcess, lpBaseAddress, nSize, oldPageProtection, out oldPageProtection); } return(success); }
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, PageProtection flNewProtect, ref int lpflOldProtect);
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint flAllocationType, PageProtection flProtect);
static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, PageProtection flNewProtect, out PageProtection lpflOldProtect);
public static extern SafeWin32Handle CreateFileMapping( SafeFileHandle hFile, IntPtr lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
public static extern IntPtr CreateFileMapping(IntPtr hFile, ref SecurityAttributes lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
public static extern IntPtr CreateFileMapping(IntPtr hFile, ref SECURITY_ATTRIBUTES lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
public static extern NtStatus NtAllocateVirtualMemory([In] IntPtr processHandle, [In, Out] ref IntPtr baseAddress, [In] uint zeroBits, [In, Out] ref UIntPtr regionSize, [In] MemoryAllocationType allocationType, [In] PageProtection protect);
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwsize, AllocationType flAllocationType, PageProtection flProtect);
internal static extern IntPtr CreateFileMapping(IntPtr hFile, IntPtr lpFileMappingAttributes, PageProtection flProtect, uint dwMaximumSizeHigh, uint dwMaximumSizeLow, string lpName);
public static extern IntPtr CreateFileMapping(IntPtr hFile, IntPtr lpFileMappingAttributes, PageProtection flProtect, int dwMaximumSizeHigh, int dwMaximumSizeLow, [MarshalAs(UnmanagedType.LPStr)] string lpName);
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, AllocationType flAllocationType, PageProtection flProtect);
static private extern void *VirtualAlloc( void *lpAddress, uint dwSize, /*AllocationType*/ uint flAllocationType, PageProtection flProtect );
internal static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpBaseAddress, UIntPtr dwSize, PageProtection flNewProtect, out IntPtr lpflOldProtect);