示例#1
0
        public static void RtlInitUnicodeString(ref SpDi.Native.UNICODE_STRING DestinationString, [MarshalAs(UnmanagedType.LPWStr)] string SourceString)
        {
            object[] funcargs =
            {
                DestinationString, SourceString
            };

            Generic.DynamicAPIInvoke(@"ntdll.dll", @"RtlInitUnicodeString", typeof(DELEGATES.RtlInitUnicodeString), ref funcargs);

            DestinationString = (SpDi.Native.UNICODE_STRING)funcargs[0];
        }
示例#2
0
        public static IntPtr LoadModuleFromDisk(string DLLPath)
        {
            SpDi.Native.UNICODE_STRING uModuleName = new SpDi.Native.UNICODE_STRING();
            Native.RtlInitUnicodeString(ref uModuleName, DLLPath);

            IntPtr hModule = IntPtr.Zero;

            SpDi.Native.NTSTATUS CallResult = Native.LdrLoadDll(IntPtr.Zero, 0, ref uModuleName, ref hModule);
            if (CallResult != SpDi.Native.NTSTATUS.Success || hModule == IntPtr.Zero)
            {
                return(IntPtr.Zero);
            }

            return(hModule);
        }
示例#3
0
        public static string GetFilenameFromMemoryPointer(IntPtr hProc, IntPtr pMem)
        {
            IntPtr pBase      = IntPtr.Zero;
            IntPtr RegionSize = (IntPtr)0x500;
            IntPtr pAlloc     = NtAllocateVirtualMemory(hProc, ref pBase, IntPtr.Zero, ref RegionSize, SpDi.Win32.Kernel32.MEM_COMMIT | SpDi.Win32.Kernel32.MEM_RESERVE, SpDi.Win32.WinNT.PAGE_READWRITE);

            SpDi.Native.MEMORYINFOCLASS memoryInfoClass = SpDi.Native.MEMORYINFOCLASS.MemorySectionName;
            UInt32 MemoryInformationLength = 0x500;
            UInt32 Retlen = 0;

            object[] funcargs =
            {
                hProc, pMem, memoryInfoClass, pAlloc, MemoryInformationLength, Retlen
            };

            SpDi.Native.NTSTATUS retValue = (SpDi.Native.NTSTATUS)Generic.DynamicAPIInvoke(@"ntdll.dll", @"NtQueryVirtualMemory", typeof(DELEGATES.NtQueryVirtualMemory), ref funcargs);

            string FilePath = string.Empty;

            if (retValue == SpDi.Native.NTSTATUS.Success)
            {
                SpDi.Native.UNICODE_STRING sn = (SpDi.Native.UNICODE_STRING)Marshal.PtrToStructure(pAlloc, typeof(SpDi.Native.UNICODE_STRING));
                FilePath = Marshal.PtrToStringUni(sn.Buffer);
            }

            NtFreeVirtualMemory(hProc, ref pAlloc, ref RegionSize, SpDi.Win32.Kernel32.MEM_RELEASE);
            if (retValue == SpDi.Native.NTSTATUS.AccessDenied)
            {
                throw new UnauthorizedAccessException("Access is denied.");
            }
            if (retValue == SpDi.Native.NTSTATUS.AccessViolation)
            {
                throw new InvalidOperationException("The specified base address is an invalid virtual address.");
            }
            if (retValue == SpDi.Native.NTSTATUS.InfoLengthMismatch)
            {
                throw new InvalidOperationException("The MemoryInformation buffer is larger than MemoryInformationLength.");
            }
            if (retValue == SpDi.Native.NTSTATUS.InvalidParameter)
            {
                throw new InvalidOperationException("The specified base address is outside the range of accessible addresses.");
            }
            return(FilePath);
        }
示例#4
0
文件: Map.cs 项目: ndur0/LightsOut
        public static PE.PE_MANUAL_MAP MapModuleFromDisk(string DLLPath)
        {
            if (!File.Exists(DLLPath))
            {
                throw new InvalidOperationException("Filepath not found.");
            }

            SpDi.Native.UNICODE_STRING ObjectName = new SpDi.Native.UNICODE_STRING();
            SpDi2.Native.RtlInitUnicodeString(ref ObjectName, (@"\??\" + DLLPath));
            IntPtr pObjectName = Marshal.AllocHGlobal(Marshal.SizeOf(ObjectName));

            Marshal.StructureToPtr(ObjectName, pObjectName, true);

            SpDi.Native.OBJECT_ATTRIBUTES objectAttributes = new SpDi.Native.OBJECT_ATTRIBUTES();
            objectAttributes.Length     = Marshal.SizeOf(objectAttributes);
            objectAttributes.ObjectName = pObjectName;
            objectAttributes.Attributes = 0x40;

            SpDi.Native.IO_STATUS_BLOCK ioStatusBlock = new SpDi.Native.IO_STATUS_BLOCK();

            IntPtr hFile = IntPtr.Zero;

            SpDi2.Native.NtOpenFile(
                ref hFile,
                SpDi.Win32.Kernel32.FileAccessFlags.FILE_READ_DATA |
                SpDi.Win32.Kernel32.FileAccessFlags.FILE_EXECUTE |
                SpDi.Win32.Kernel32.FileAccessFlags.FILE_READ_ATTRIBUTES |
                SpDi.Win32.Kernel32.FileAccessFlags.SYNCHRONIZE,
                ref objectAttributes, ref ioStatusBlock,
                SpDi.Win32.Kernel32.FileShareFlags.FILE_SHARE_READ |
                SpDi.Win32.Kernel32.FileShareFlags.FILE_SHARE_DELETE,
                SpDi.Win32.Kernel32.FileOpenFlags.FILE_SYNCHRONOUS_IO_NONALERT |
                SpDi.Win32.Kernel32.FileOpenFlags.FILE_NON_DIRECTORY_FILE
                );

            IntPtr hSection = IntPtr.Zero;
            ulong  MaxSize  = 0;

            SpDi.Native.NTSTATUS ret = SpDi2.Native.NtCreateSection(
                ref hSection,
                (UInt32)SpDi.Win32.WinNT.ACCESS_MASK.SECTION_ALL_ACCESS,
                IntPtr.Zero,
                ref MaxSize,
                SpDi.Win32.WinNT.PAGE_READONLY,
                SpDi.Win32.WinNT.SEC_IMAGE,
                hFile
                );

            IntPtr pBaseAddress = IntPtr.Zero;

            SpDi2.Native.NtMapViewOfSection(
                hSection, (IntPtr)(-1), ref pBaseAddress,
                IntPtr.Zero, IntPtr.Zero, IntPtr.Zero,
                ref MaxSize, 0x2, 0x0,
                SpDi.Win32.WinNT.PAGE_READWRITE
                );

            PE.PE_MANUAL_MAP SecMapObject = new PE.PE_MANUAL_MAP
            {
                PEINFO     = SpDi2.Generic.GetPeMetaData(pBaseAddress),
                ModuleBase = pBaseAddress
            };

            return(SecMapObject);
        }
示例#5
0
        public static SpDi.Native.NTSTATUS LdrLoadDll(IntPtr PathToFile, UInt32 dwFlags, ref SpDi.Native.UNICODE_STRING ModuleFileName, ref IntPtr ModuleHandle)
        {
            object[] funcargs =
            {
                PathToFile, dwFlags, ModuleFileName, ModuleHandle
            };

            SpDi.Native.NTSTATUS retValue = (SpDi.Native.NTSTATUS)Generic.DynamicAPIInvoke(@"ntdll.dll", @"LdrLoadDll", typeof(DELEGATES.LdrLoadDll), ref funcargs);

            ModuleHandle = (IntPtr)funcargs[3];

            return(retValue);
        }