-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
23 changed files
with
383 additions
and
389 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,181 @@ | ||
| #include "MemoryMgr.h" | ||
|
|
||
| MemoryMgr::MemoryMgr() | ||
| { | ||
| ProcessID = 0; | ||
| kernelDriver = nullptr; | ||
| } | ||
|
|
||
| MemoryMgr::~MemoryMgr() | ||
| { | ||
| Detach(); | ||
| DisconnectDriver(); | ||
|
|
||
| ProcessID = 0; | ||
| kernelDriver = nullptr; | ||
| } | ||
|
|
||
| bool MemoryMgr::ConnectDriver(const LPCWSTR name) | ||
| { | ||
| kernelDriver = CreateFile(name, GENERIC_READ, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr); | ||
| if (kernelDriver == INVALID_HANDLE_VALUE) | ||
| return false; | ||
|
|
||
| return true; | ||
| } | ||
|
|
||
| bool MemoryMgr::DisconnectDriver() | ||
| { | ||
| if (kernelDriver != nullptr) | ||
| { | ||
| return CloseHandle(kernelDriver); | ||
| } | ||
| else | ||
| return false; | ||
| } | ||
|
|
||
| bool MemoryMgr::Attach(const DWORD pid) | ||
| { | ||
| Request req; | ||
| req.pid = reinterpret_cast<HANDLE>(pid); | ||
| ProcessID = pid; | ||
|
|
||
| return DeviceIoControl(kernelDriver, kernelCodes::ATTACH, &req, sizeof(req), &req, sizeof(req), nullptr, nullptr); | ||
| } | ||
|
|
||
| bool MemoryMgr::Detach() | ||
| { | ||
| if (kernelDriver != nullptr && ProcessID != 0) | ||
| { | ||
| Request req; | ||
| req.pid = reinterpret_cast<HANDLE>(ProcessID); | ||
| ProcessID = 0; | ||
|
|
||
| return DeviceIoControl(kernelDriver, kernelCodes::DETACH, &req, sizeof(req), &req, sizeof(req), nullptr, nullptr); | ||
| } | ||
| else | ||
| return false; | ||
| } | ||
|
|
||
| //template <typename ReadType> | ||
| //bool MemoryMgr::ReadMemory(DWORD64 address, ReadType& value) | ||
| //{ | ||
| // if (kernelDriver != nullptr && ProcessID != 0) | ||
| // { | ||
| // Request req; | ||
| // | ||
| // req.target = reinterpret_cast<PVOID>(address); | ||
| // req.buffer = &value; | ||
| // req.size = sizeof(ReadType); | ||
| // | ||
| // return DeviceIoControl(kernelDriver, kernelCodes::READ, &req, sizeof(req), &req, sizeof(req), nullptr, nullptr); | ||
| // } | ||
| // else | ||
| // return false; | ||
| //} | ||
|
|
||
| //template <typename ReadType> | ||
| //bool MemoryMgr::ReadMemory(DWORD64 address, ReadType& value, int size) | ||
| //{ | ||
| // if (kernelDriver != nullptr && ProcessID != 0) | ||
| // { | ||
| // Request req; | ||
| // | ||
| // req.target = reinterpret_cast<PVOID>(address); | ||
| // req.buffer = &value; | ||
| // req.size = size; | ||
| // | ||
| // return DeviceIoControl(kernelDriver, kernelCodes::READ, &req, sizeof(req), &req, sizeof(req), nullptr, nullptr); | ||
| // } | ||
| // else | ||
| // return false; | ||
| //} | ||
|
|
||
| DWORD64 MemoryMgr::TraceAddress(DWORD64 baseAddress, std::vector<DWORD> offsets) | ||
| { | ||
| if (kernelDriver != nullptr && ProcessID != 0) | ||
| { | ||
| DWORD64 address = 0; | ||
|
|
||
| if (offsets.size() == 0) | ||
| return baseAddress; | ||
|
|
||
| if (!ReadMemory<DWORD64>(baseAddress, address)) | ||
| return 0; | ||
|
|
||
| for (int i = 0; i < offsets.size() - 1; i++) | ||
| { | ||
| if (!ReadMemory<DWORD64>(address + offsets[i], address)) | ||
| return 0; | ||
| } | ||
| return address == 0 ? 0 : address + offsets[offsets.size() - 1]; | ||
| } | ||
| else | ||
| return 0; | ||
| } | ||
|
|
||
| DWORD MemoryMgr::GetProcessID(const wchar_t* processName) | ||
| { | ||
| DWORD processId = 0; | ||
| HANDLE snapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); | ||
|
|
||
| if (snapShot == INVALID_HANDLE_VALUE) | ||
| return processId; | ||
|
|
||
| PROCESSENTRY32W entry = {}; | ||
| entry.dwSize = sizeof(decltype(entry)); | ||
|
|
||
| if (Process32FirstW(snapShot, &entry) == TRUE) // Check if the first handle is the one we want | ||
| { | ||
| if (_wcsicmp(processName, entry.szExeFile) == 0) | ||
| processId = entry.th32ProcessID; | ||
|
|
||
| else | ||
| { | ||
| while (Process32NextW(snapShot, &entry) == TRUE) | ||
| { | ||
| if (_wcsicmp(processName, entry.szExeFile) == 0) | ||
| { | ||
| processId = entry.th32ProcessID; | ||
| break; | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| CloseHandle(snapShot); | ||
| return processId; | ||
| } | ||
|
|
||
| DWORD64 MemoryMgr::GetModuleBase(const DWORD pid, const wchar_t* moduleName) { | ||
| DWORD64 moduleBase = 0; | ||
|
|
||
| // Snap-shot of process' modules (dlls). | ||
| HANDLE snapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pid); | ||
| if (snapShot == INVALID_HANDLE_VALUE) | ||
| return moduleBase; | ||
|
|
||
| MODULEENTRY32W entry = {}; | ||
| entry.dwSize = sizeof(decltype(entry)); | ||
|
|
||
| if (Module32FirstW(snapShot, &entry) == TRUE) | ||
| { | ||
| if (wcsstr(moduleName, entry.szModule) != nullptr) | ||
| moduleBase = reinterpret_cast<DWORD64>(entry.modBaseAddr); | ||
|
|
||
| else | ||
| { | ||
| while (Module32NextW(snapShot, &entry) == TRUE) | ||
| { | ||
| if (wcsstr(moduleName, entry.szModule) != nullptr) | ||
| { | ||
| moduleBase = reinterpret_cast<DWORD64>(entry.modBaseAddr); | ||
| break; | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| CloseHandle(snapShot); | ||
| return moduleBase; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| #pragma once | ||
| #include <iostream> | ||
| #include <Windows.h> | ||
| #include <Tlhelp32.h> | ||
| #include <string> | ||
| #include <vector> | ||
|
|
||
| namespace kernelCodes | ||
| { | ||
| inline const ULONG ATTACH = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x4462, METHOD_BUFFERED, FILE_SPECIAL_ACCESS); | ||
| inline const ULONG READ = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x4472, METHOD_BUFFERED, FILE_SPECIAL_ACCESS); | ||
| inline const ULONG WRITE = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x4482, METHOD_BUFFERED, FILE_SPECIAL_ACCESS); | ||
| inline const ULONG DETACH = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x4492, METHOD_BUFFERED, FILE_SPECIAL_ACCESS); | ||
| } | ||
|
|
||
| class MemoryMgr | ||
| { | ||
| public: | ||
| MemoryMgr(); | ||
| ~MemoryMgr(); | ||
|
|
||
| bool ConnectDriver(const LPCWSTR); | ||
| bool DisconnectDriver(); | ||
|
|
||
| bool Attach(const DWORD); | ||
| bool Detach(); | ||
|
|
||
| template <typename ReadType> | ||
| bool ReadMemory(DWORD64 address, ReadType& value) | ||
| { | ||
| if (kernelDriver != nullptr && ProcessID != 0) | ||
| { | ||
| Request req; | ||
|
|
||
| req.target = reinterpret_cast<PVOID>(address); | ||
| req.buffer = &value; | ||
| req.size = sizeof(ReadType); | ||
|
|
||
| return DeviceIoControl(kernelDriver, kernelCodes::READ, &req, sizeof(req), &req, sizeof(req), nullptr, nullptr); | ||
| } | ||
| else | ||
| return false; | ||
| } | ||
|
|
||
| template <typename ReadType> | ||
| bool ReadMemory(DWORD64 address, ReadType& value, int size) | ||
| { | ||
| if (kernelDriver != nullptr && ProcessID != 0) | ||
| { | ||
| Request req; | ||
|
|
||
| req.target = reinterpret_cast<PVOID>(address); | ||
| req.buffer = &value; | ||
| req.size = size; | ||
|
|
||
| return DeviceIoControl(kernelDriver, kernelCodes::READ, &req, sizeof(req), &req, sizeof(req), nullptr, nullptr); | ||
| } | ||
| else | ||
| return false; | ||
| } | ||
|
|
||
| DWORD64 TraceAddress(DWORD64, std::vector<DWORD>); | ||
|
|
||
| static DWORD GetProcessID(const wchar_t*); | ||
| static DWORD64 GetModuleBase(const DWORD, const wchar_t*); | ||
|
|
||
| private: | ||
| DWORD ProcessID; | ||
| HANDLE kernelDriver; | ||
|
|
||
| struct Request | ||
| { | ||
| HANDLE pid; | ||
|
|
||
| PVOID target; | ||
| PVOID buffer; | ||
|
|
||
| SIZE_T size; | ||
| SIZE_T rtrn_size; | ||
| }; | ||
|
|
||
| //static struct | ||
| //{ | ||
| // static const ULONG ATTACH = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x4462, METHOD_BUFFERED, FILE_SPECIAL_ACCESS); | ||
| // static const ULONG READ = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x4472, METHOD_BUFFERED, FILE_SPECIAL_ACCESS); | ||
| // static const ULONG WRITE = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x4482, METHOD_BUFFERED, FILE_SPECIAL_ACCESS); | ||
| // static const ULONG DETACH = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x4492, METHOD_BUFFERED, FILE_SPECIAL_ACCESS); | ||
| //}Codes; | ||
|
|
||
| }; | ||
|
|
||
| inline MemoryMgr memoryManager; | ||
|
|
Oops, something went wrong.