Пример #1
0
        private static void InitAPI()
        {
            IntPtr lpKernel32 = GetKernel32BaseAddress();
            IntPtr lpNtdll    = GetNtdllBaseAddress();

            // kernel32 functions
            CreateProcessW       = LoadFunction <t_CreateProcessW>(lpKernel32, 0xA0F20974);
            GetThreadContext     = LoadFunction <t_GetThreadContext>(lpKernel32, 0xCF0067E3);
            ReadProcessMemory    = LoadFunction <t_ReadProcessMemory>(lpKernel32, 0x3301084);
            NtUnmapViewOfSection = LoadFunction <t_NtUnmapViewOfSection>(lpNtdll, 0x424ED548);
            VirtualAllocEx       = LoadFunction <t_VirtualAllocEx>(lpKernel32, 0x99B37A95);
            VirtualProtectEx     = LoadFunction <t_VirtualProtectEx>(lpKernel32, 0x687D2F5B);
            VirtualQueryEx       = LoadFunction <t_VirtualQueryEx>(lpKernel32, 0x92F50AF2);
            VirtualFreeEx        = LoadFunction <t_VirtualFreeEx>(lpKernel32, 0x33A84D20);
            WriteProcessMemory   = LoadFunction <t_WriteProcessMemory>(lpKernel32, 0x8C1E9A9B);
            WriteProcessMemory2  = LoadFunction <t_WriteProcessMemory2>(lpKernel32, 0x8C1E9A9B);
            SetThreadContext     = LoadFunction <t_SetThreadContext>(lpKernel32, 0xEE430B5F);
            ResumeThread         = LoadFunction <t_ResumeThread>(lpKernel32, 0x6426F5F3);
            QueueUserAPC         = LoadFunction <t_QueueUserAPC>(lpKernel32, 0x7D81A082);

            // ntdll functions
            NtQueueApcThread        = LoadFunction <t_NtQueueApcThread>(lpNtdll, 0x22FA0B1F);
            NtAlertResumeThread     = LoadFunction <t_NtAlertResumeThread>(lpNtdll, 0x4E44E6F7);
            NtAllocateVirtualMemory = LoadFunction <t_NtAllocateVirtualMemory>(lpNtdll, 0x3F47E8B);
        }
Пример #2
0
        private static void InitAPI()
        {
            IntPtr lpKernel32 = GetKernel32BaseAddress();
            IntPtr lpNtdll    = GetNtdllBaseAddress();

            CreateProcessW     = LoadFunction <t_CreateProcessW>(lpKernel32, FNVHash("CreateProcessW"));
            GetThreadContext   = LoadFunction <t_GetThreadContext>(lpKernel32, FNVHash("GetThreadContext"));
            ReadProcessMemory  = LoadFunction <t_ReadProcessMemory>(lpKernel32, FNVHash("ReadProcessMemory"));
            VirtualAllocEx     = LoadFunction <t_VirtualAllocEx>(lpKernel32, FNVHash("VirtualAllocEx"));
            VirtualProtectEx   = LoadFunction <t_VirtualProtectEx>(lpKernel32, FNVHash("VirtualProtectEx"));
            VirtualQueryEx     = LoadFunction <t_VirtualQueryEx>(lpKernel32, FNVHash("VirtualQueryEx"));
            VirtualFreeEx      = LoadFunction <t_VirtualFreeEx>(lpKernel32, FNVHash("VirtualFreeEx"));
            WriteProcessMemory = LoadFunction <t_WriteProcessMemory>(lpKernel32, FNVHash("WriteProcessMemory"));
            SetThreadContext   = LoadFunction <t_SetThreadContext>(lpKernel32, FNVHash("SetThreadContext"));
            ResumeThread       = LoadFunction <t_ResumeThread>(lpKernel32, FNVHash("ResumeThread"));

            // ntdll functions
            NtQueueApcThread    = LoadFunction <t_NtQueueApcThread>(lpNtdll, FNVHash("NtQueueApcThread"));
            NtAlertResumeThread = LoadFunction <t_NtAlertResumeThread>(lpNtdll, FNVHash("NtAlertResumeThread"));
        }