-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathmemory.cpp
More file actions
122 lines (109 loc) · 3.4 KB
/
Copy pathmemory.cpp
File metadata and controls
122 lines (109 loc) · 3.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
#include "include/memory.h"
Memory::Memory(HANDLE processHandle, SIZE_T size, ULONG allocationType, ULONG protect)
{
NTSTATUS stat;
this->size = size;
this->allocationtype = allocationType;
this->protect = protect;
this->processhandle = processHandle;
if (this->processhandle == NULL || this->processhandle == INVALID_HANDLE_VALUE) {
printf("[%s] Received an invalid handle: %p\n", __FUNCTION__, this->processhandle);
this->size = 0;
return;
}
stat = Sw3NtAllocateVirtualMemory(this->processhandle, &this->baseaddress, 0, &this->size, this->allocationtype, this->protect);
if (stat != 0) {
printf("[%s] Failed at allocating memory (%x)\n", __FUNCTION__, stat);
return;
}
}
Memory::Memory(HANDLE processHandle, PVOID existingAddress, SIZE_T size)
{
this->processhandle = processHandle;
this->baseaddress = existingAddress; // Use the found cave
this->size = size;
// Set these to 0 or a special flag to indicate we didn't allocate it
this->allocationtype = 0;
this->protect = 0;
}
PVOID Memory::get_base_address()
{
return this->baseaddress;
}
SIZE_T Memory::get_size()
{
return this->size;
}
ULONG Memory::get_allocation_type()
{
return this->allocationtype;
}
ULONG Memory::get_protect()
{
return this->protect;
}
NTSTATUS Memory::write_mem(PVOID data, SIZE_T size, PSIZE_T bytesWritten)
{
NTSTATUS stat;
if (size > this->size) {
printf("[%s] Size for writing is too big for allocated memory. Max size: %i\n", __FUNCTION__, this->size);
return STATUS_INVALID_PARAMETER;
}
stat = Sw3NtWriteVirtualMemory(this->processhandle, this->baseaddress, data, size, bytesWritten);
if (stat == 0) {
return 0;
}
return stat;
}
NTSTATUS Memory::read_mem(PVOID data, SIZE_T size, PSIZE_T bytesRead)
{
NTSTATUS stat;
if (size > this->size) {
printf("[%s] Size for reading is too big for allocated memory. Max size: %i\n", __FUNCTION__, this->size);
return STATUS_INVALID_PARAMETER;
}
stat = Sw3NtReadVirtualMemory(this->processhandle, this->baseaddress, data, size, bytesRead);
if (stat == 0) {
return 0;
}
return stat;
}
NTSTATUS Memory::write_mem_at_offset(int offset, PVOID data, SIZE_T size, PSIZE_T bytesWritten) {
NTSTATUS stat;
if (size > this->size) {
printf("[%s] Size for writing is too big for allocated memory. Max size: %i\n", __FUNCTION__, this->size);
return STATUS_INVALID_PARAMETER;
}
stat = Sw3NtWriteVirtualMemory(this->processhandle, (PVOID)((uintptr_t)this->baseaddress + offset), data, size, bytesWritten);
if (stat == 0) {
return 0;
}
return stat;
}
NTSTATUS Memory::read_mem_at_offset(int offset, PVOID data, SIZE_T size, PSIZE_T bytesRead) {
NTSTATUS stat;
if (size > this->size) {
printf("[%s] Size for reading is too big for allocated memory. Max size: %i\n", __FUNCTION__, this->size);
return STATUS_INVALID_PARAMETER;
}
stat = Sw3NtReadVirtualMemory(this->processhandle, (PVOID)((uintptr_t)this->baseaddress + offset), data, size, bytesRead);
if (stat == 0) {
return 0;
}
return stat;
}
NTSTATUS Memory::change_protection(SIZE_T size, uint32_t protection, DWORD originalProtection) {
NTSTATUS stat;
if (size > this->size) {
printf("[%s] Size for changing protection is too big for allocated memory. Max size: %i\n", __FUNCTION__, this->size);
return STATUS_INVALID_PARAMETER;
}
stat = Sw3NtProtectVirtualMemory(this->processhandle, &this->baseaddress, &size, protection, &originalProtection);
if (stat == 0) {
return 0;
}
return stat;
}
Memory::~Memory()
{
}