static void Main(string[] args) { Process process = Process.GetProcessesByName("notepad").FirstOrDefault(); IntPtr hProcess = Processthreadsapi.OpenProcess(Winnt.ProcessAccessFlags.PROCESS_ALL_ACCESS, false, process.Id); if (hProcess == IntPtr.Zero) { Console.WriteLine("Failed on OpenProcess. Handle is invalid."); return; } if (Memoryapi.VirtualQueryEx(hProcess, process.MainModule.BaseAddress, out Winnt.MEMORY_BASIC_INFORMATION basicInformation, Marshal.SizeOf(typeof(Winnt.MEMORY_BASIC_INFORMATION))) == 0) { Console.WriteLine("Failed on VirtualQueryEx. Return is 0 bytes."); return; } IntPtr regionBase = basicInformation.baseAddress; IntPtr regionSize = basicInformation.regionSize; Ntpsapi.NtSuspendProcess(hProcess); RemapMemoryRegion(hProcess, regionBase, regionSize.ToInt32(), Winnt.MemoryProtectionConstraints.PAGE_EXECUTE_READWRITE); Ntpsapi.NtResumeProcess(hProcess); Handleapi.CloseHandle(hProcess); }
static void Main(string[] args) { //Set this bool to true if the region data is not obscured. bool sectioned = true; Process targetProc = Process.GetProcessesByName("notepad").FirstOrDefault(); //Open a handle to the target process IntPtr hProcess = Processthreadsapi.OpenProcess(ProcessAccessFlags.PROCESS_ALL_ACCESS, false, targetProc.Id); if (hProcess == IntPtr.Zero) { NativeError("OpenProcess"); } IntPtr baseAddress; int regionSize; if (sectioned) { //Set the base module address and the size. baseAddress = targetProc.MainModule.BaseAddress; regionSize = targetProc.MainModule.ModuleMemorySize; } else { //Query the process and get the baseInfo structure. /*Very specific practice for very specifc apps. .NET has built in methods for standard apps. * See: Process Class Base Address + ModuleMemorySize*/ if (Memoryapi.VirtualQueryEx ( hProcess, targetProc.MainModule.BaseAddress, out MEMORY_BASIC_INFORMATION basicInfo, Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION))) == 0 ) { NativeError("VirtualQueryEx"); } baseAddress = basicInfo.baseAddress; regionSize = (int)basicInfo.regionSize; } Ntpsapi.NtSuspendProcess(hProcess); //Allocate a buffer to read the region to. IntPtr buffer = Memoryapi.VirtualAlloc(IntPtr.Zero, regionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); if (buffer == IntPtr.Zero) { NativeError("VirtualAlloc"); } //Read the data into the buffer. if (!Memoryapi.ReadProcessMemory(hProcess, baseAddress, buffer, regionSize, out _)) { NativeError("ReadProcessMemory"); } IntPtr hSection = IntPtr.Zero; long sectionMaxSize = (long)regionSize; //Create a section object to share between local and remote process. if (Ntifs.NtCreateSection ( ref hSection, SECTION_ALL_ACCESS, IntPtr.Zero, ref sectionMaxSize, PAGE_EXECUTE_READWRITE, SEC_COMMIT, IntPtr.Zero ) != Ntifs.Ntstatus.STATUS_SUCCESS) { NativeError("NtCreateSection"); } //Unmap the memory at the base of the remote process. if (Ntapi.NtUnmapViewOfSection(hProcess, baseAddress) != Ntifs.Ntstatus.STATUS_SUCCESS) { NativeError("NtUnmapViewOfSection"); } IntPtr viewBase = baseAddress; long sectionOffset = default; uint viewSize = default; //Map a region back to the original region location with new rights. if (Ntapi.NtMapViewOfSection ( hSection, hProcess, ref viewBase, UIntPtr.Zero, regionSize, ref sectionOffset, ref viewSize, 2 /*ViewUnmap*/, 0, PAGE_EXECUTE_READWRITE /*Set to the desired new access rights*/ ) != Ntifs.Ntstatus.STATUS_SUCCESS) { NativeError("NtMapViewOfSection"); } //Write the memory back to the updated region. if (!Memoryapi.WriteProcessMemory(hProcess, viewBase, buffer, (int)viewSize, out IntPtr _)) { NativeError("WriteProcessMemory"); } //Empty the buffer Memoryapi.VirtualFree(buffer, 0, MemFree.MEM_RELEASE); //Close the section handle Handleapi.CloseHandle(hSection); //Resume the process Ntpsapi.NtResumeProcess(hProcess); }
public static int FindInBaseModule(Process process, byte[] pattern, out IntPtr[] offsets, bool wildcard = false, byte wildcardChar = 0xff, bool findAll = false) { List <IntPtr> offsetList = new List <IntPtr>(); offsets = new IntPtr[] { (IntPtr)0 }; //Create a handle to the process IntPtr processHandle = Processthreadsapi.OpenProcess(0x0010 | 0x0020 | 0x0008, false, process.Id); //Initialize the a modInfo struct as new so the size can be safely obtained var modInfo = new Psapi.ModuleInfo(); //Allocated some memory for a ptr IntPtr modInfoPtr = Marshal.AllocHGlobal(Marshal.SizeOf(modInfo)); //Get the module info for the process base bool ntStatus = Psapi.GetModuleInformation(processHandle, process.MainModule.BaseAddress, modInfoPtr, (uint)Marshal.SizeOf(modInfo)); if (!ntStatus) { return(Marshal.GetLastWin32Error()); } //Convert the ptr to the structure modInfo = (Psapi.ModuleInfo)Marshal.PtrToStructure(modInfoPtr, typeof(Psapi.ModuleInfo)); //Allocate a new buffer based on the size of the image byte[] lpBuffer = new byte[modInfo.SizeOfImage]; //Read the entire image into the buffer ntStatus = Memoryapi.ReadProcessMemory(processHandle, process.MainModule.BaseAddress, lpBuffer, (int)modInfo.SizeOfImage, out IntPtr _); if (!ntStatus) { return(Marshal.GetLastWin32Error()); } for (int i = 0; i < lpBuffer.Length; i++) { //Create a new array to copy potential matches to byte[] tempArray = new byte[pattern.Length]; if (lpBuffer[i] == pattern[0]) { if ((lpBuffer.Length - lpBuffer[i]) < pattern.Length) { continue; } for (int x = 0; x < pattern.Length; x++) { tempArray[x] = lpBuffer[i + x]; } if (wildcard) { bool match = true; for (int x = 0; x < pattern.Length; x++) { if (pattern[x] == tempArray[x] || pattern[x] == wildcardChar) { continue; } else { match = false; break; } } if (match) { offsetList.Add((IntPtr)i); } } else { if (Enumerable.SequenceEqual(tempArray, pattern)) { //Add the index of the byte[] to the offset list offsetList.Add((IntPtr)i); if (!findAll) { break; } } } } } offsets = offsetList.ToArray(); Handleapi.CloseHandle(processHandle); Marshal.FreeHGlobal(modInfoPtr); return(0); }