public static Dictionary <string, string> GetApiSetMapping() { SpDi.Native.PROCESS_BASIC_INFORMATION pbi = Native.NtQueryInformationProcessBasicInformation((IntPtr)(-1)); UInt32 ApiSetMapOffset = IntPtr.Size == 4 ? (UInt32)0x38 : 0x68; Dictionary <string, string> ApiSetDict = new Dictionary <string, string>(); IntPtr pApiSetNamespace = Marshal.ReadIntPtr((IntPtr)((UInt64)pbi.PebBaseAddress + ApiSetMapOffset)); PE.ApiSetNamespace Namespace = (PE.ApiSetNamespace)Marshal.PtrToStructure(pApiSetNamespace, typeof(PE.ApiSetNamespace)); for (var i = 0; i < Namespace.Count; i++) { PE.ApiSetNamespaceEntry SetEntry = new PE.ApiSetNamespaceEntry(); SetEntry = (PE.ApiSetNamespaceEntry)Marshal.PtrToStructure((IntPtr)((UInt64)pApiSetNamespace + (UInt64)Namespace.EntryOffset + (UInt64)(i * Marshal.SizeOf(SetEntry))), typeof(PE.ApiSetNamespaceEntry)); string ApiSetEntryName = Marshal.PtrToStringUni((IntPtr)((UInt64)pApiSetNamespace + (UInt64)SetEntry.NameOffset), SetEntry.NameLength / 2) + ".dll"; PE.ApiSetValueEntry SetValue = new PE.ApiSetValueEntry(); SetValue = (PE.ApiSetValueEntry)Marshal.PtrToStructure((IntPtr)((UInt64)pApiSetNamespace + (UInt64)SetEntry.ValueOffset), typeof(PE.ApiSetValueEntry)); string ApiSetValue = string.Empty; if (SetValue.ValueCount != 0) { ApiSetValue = Marshal.PtrToStringUni((IntPtr)((UInt64)pApiSetNamespace + (UInt64)SetValue.ValueOffset), SetValue.ValueCount / 2); } ApiSetDict.Add(ApiSetEntryName, ApiSetValue); } return(ApiSetDict); }
public static IntPtr GetPebLdrModuleEntry(string DLLName) { SpDi.Native.PROCESS_BASIC_INFORMATION pbi = Native.NtQueryInformationProcessBasicInformation((IntPtr)(-1)); bool Is32Bit = false; UInt32 LdrDataOffset = 0; UInt32 InLoadOrderModuleListOffset = 0; if (IntPtr.Size == 4) { Is32Bit = true; LdrDataOffset = 0xc; InLoadOrderModuleListOffset = 0xC; } else { LdrDataOffset = 0x18; InLoadOrderModuleListOffset = 0x10; } IntPtr PEB_LDR_DATA = Marshal.ReadIntPtr((IntPtr)((UInt64)pbi.PebBaseAddress + LdrDataOffset)); IntPtr pInLoadOrderModuleList = (IntPtr)((UInt64)PEB_LDR_DATA + InLoadOrderModuleListOffset); SpDi.Native.LIST_ENTRY le = (SpDi.Native.LIST_ENTRY)Marshal.PtrToStructure(pInLoadOrderModuleList, typeof(SpDi.Native.LIST_ENTRY)); IntPtr flink = le.Flink; IntPtr hModule = IntPtr.Zero; SpDi.PE.LDR_DATA_TABLE_ENTRY dte = (SpDi.PE.LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(flink, typeof(SpDi.PE.LDR_DATA_TABLE_ENTRY)); while (dte.InLoadOrderLinks.Flink != le.Blink) { if (Marshal.PtrToStringUni(dte.FullDllName.Buffer).EndsWith(DLLName, StringComparison.OrdinalIgnoreCase)) { hModule = dte.DllBase; } flink = dte.InLoadOrderLinks.Flink; dte = (SpDi.PE.LDR_DATA_TABLE_ENTRY)Marshal.PtrToStructure(flink, typeof(SpDi.PE.LDR_DATA_TABLE_ENTRY)); } return(hModule); }
public static SpDi.Native.NTSTATUS NtQueryInformationProcess(IntPtr hProcess, SpDi.Native.PROCESSINFOCLASS processInfoClass, out IntPtr pProcInfo) { int processInformationLength; UInt32 RetLen = 0; switch (processInfoClass) { case SpDi.Native.PROCESSINFOCLASS.ProcessWow64Information: pProcInfo = Marshal.AllocHGlobal(IntPtr.Size); RtlZeroMemory(pProcInfo, IntPtr.Size); processInformationLength = IntPtr.Size; break; case SpDi.Native.PROCESSINFOCLASS.ProcessBasicInformation: SpDi.Native.PROCESS_BASIC_INFORMATION PBI = new SpDi.Native.PROCESS_BASIC_INFORMATION(); pProcInfo = Marshal.AllocHGlobal(Marshal.SizeOf(PBI)); RtlZeroMemory(pProcInfo, Marshal.SizeOf(PBI)); Marshal.StructureToPtr(PBI, pProcInfo, true); processInformationLength = Marshal.SizeOf(PBI); break; default: throw new InvalidOperationException($"Invalid ProcessInfoClass: {processInfoClass}"); } object[] funcargs = { hProcess, processInfoClass, pProcInfo, processInformationLength, RetLen }; SpDi.Native.NTSTATUS retValue = (SpDi.Native.NTSTATUS)Generic.DynamicAPIInvoke(@"ntdll.dll", @"NtQueryInformationProcess", typeof(DELEGATES.NtQueryInformationProcess), ref funcargs); if (retValue != SpDi.Native.NTSTATUS.Success) { throw new UnauthorizedAccessException("Access is denied."); } pProcInfo = (IntPtr)funcargs[2]; return(retValue); }