section.cpp

#include "include/section.h"

ExtendedSection::ExtendedSection(HANDLE processHandle, ULONG sectionPageProtection, ULONG allocationAttributes, ULONG extendedParametersCount, POBJECT_ATTRIBUTES objectAttributes, PLARGE_INTEGER maximumSize, PMEM_EXTENDED_PARAMETER extendedParameters, HANDLE fileHandle)
{
	NTSTATUS stat;
	this->processhandle = processHandle;
	this->sectionpageprotection = sectionPageProtection;
	this->allocationattributes = allocationAttributes;
	this->extendedparameterscount = extendedParametersCount;
	this->extendedparameters = extendedParameters;
	this->maximumsize = maximumSize;
	stat = Sw3NtCreateSectionEx(&this->handle, SECTION_ALL_ACCESS, objectAttributes, maximumSize, sectionPageProtection, allocationAttributes, fileHandle, extendedParameters, extendedParametersCount);
	if (stat != 0) {
		printf("[%s] Failed at creating remote section (%x)\n", __FUNCTION__, stat);
		handle = nullptr;
	}
}

NTSTATUS ExtendedSection::map(SIZE_T mapSize, PLARGE_INTEGER sectionOffset, ULONG protect)
{
	NTSTATUS stat;
	if (handle == nullptr) {
		return STATUS_INVALID_HANDLE;
	}

	LARGE_INTEGER offset = { 0 };
	if (sectionOffset != nullptr) {
		offset = *sectionOffset;
	}

	SIZE_T size = mapSize;
	if (size == 0) {
		if (maximumsize != nullptr) {
			size = static_cast<SIZE_T>(maximumsize->QuadPart);
		}
		else {
			return STATUS_INVALID_PARAMETER;
		}
	}
	stat = Sw3NtMapViewOfSectionEx(handle, GetCurrentProcess(), &offset, &baseaddress, &size, 0, protect, extendedparameters, extendedparameterscount);
	if (stat == 0) {
		return 0;
	}
	return stat;
}

NTSTATUS ExtendedSection::map_remote(SIZE_T mapSize, PLARGE_INTEGER sectionOffset, ULONG protect)
{
	NTSTATUS stat;
	if (handle == nullptr) {
		return STATUS_INVALID_HANDLE;
	}

	LARGE_INTEGER offset = { 0 };
	if (sectionOffset != nullptr) {
		offset = *sectionOffset;
	}

	SIZE_T size = mapSize;
	if (size == 0) {
		if (maximumsize != nullptr) {
			size = static_cast<SIZE_T>(maximumsize->QuadPart);
		}
		else {
			return STATUS_INVALID_PARAMETER;
		}
	}
	stat = Sw3NtMapViewOfSectionEx(handle, processhandle, &offset, &baseaddress, &size, 0, protect, extendedparameters, extendedparameterscount);
	if (stat == 0) {
		return 0;
	}
	return stat;
}

NTSTATUS ExtendedSection::unmap()
{
	NTSTATUS stat;
	if (baseaddress == nullptr) {
		return 0;
	}
	stat = Sw3NtUnmapViewOfSectionEx(GetCurrentProcess(), baseaddress, extendedparameterscount);
	if (stat == 0) {
		baseaddress = nullptr;
	}
	return stat;
}

NTSTATUS ExtendedSection::unmap_remote()
{
	NTSTATUS stat;
	if (baseaddress == nullptr) {
		return 0;
	}
	stat = Sw3NtUnmapViewOfSectionEx(processhandle, baseaddress, extendedparameterscount);
	if (stat == 0) {
		baseaddress = nullptr;
	}
	return stat;
}

HANDLE ExtendedSection::get_file_handle()
{
	return this->filehandle;
}

HANDLE ExtendedSection::get_handle()
{
	return this->handle;
}

ULONG ExtendedSection::get_section_page_protection()
{
	return this->sectionpageprotection;
}

ULONG ExtendedSection::get_extended_parameters_count()
{
	return this->extendedparameterscount;
}

PLARGE_INTEGER ExtendedSection::get_maximum_size()
{
	return this->maximumsize;
}

POBJECT_ATTRIBUTES ExtendedSection::get_object_attributes()
{
	return this->objectattributes;
}

PMEM_EXTENDED_PARAMETER ExtendedSection::get_extended_parameters()
{
	return this->extendedparameters;
}

PVOID ExtendedSection::get_base_address()
{
	return this->baseaddress;
}

ExtendedSection::~ExtendedSection()
{
	if (handle != nullptr) {
		Sw3NtClose(handle);
	}
}

NormalSection::NormalSection(HANDLE processHandle, HANDLE fileHandle, ULONG sectionPageProtection, ULONG allocationAttributes, PLARGE_INTEGER maximumSize, OBJECT_ATTRIBUTES objectAttributes)
{
	NTSTATUS stat;
	this->processhandle = processHandle;
	this->filehandle = fileHandle;
	this->sectionpageprotection = sectionPageProtection;
	this->allocationattributes = allocationAttributes;
	this->maximumsize = maximumSize;
	this->objectattributes = objectAttributes;
	stat = Sw3NtCreateSection(&this->handle, SECTION_ALL_ACCESS, &this->objectattributes, this->maximumsize, this->sectionpageprotection, this->allocationattributes, this->filehandle);
	if (stat != 0) {
		printf("[%s] Failed at creating section (%x)\n", __FUNCTION__, stat);
		handle = nullptr;
	}
}

NormalSection::NormalSection(HANDLE processHandle, PWSTR sectionName, ACCESS_MASK desiredAccess, OBJECT_ATTRIBUTES objectAttributes, HANDLE remoteHandle)
{
	NTSTATUS status;
	this->processhandle = processHandle;
	this->filehandle = nullptr;
	this->sectionpageprotection = 0;
	this->handle = remoteHandle;

	HANDLE localHandle = nullptr;
	UNICODE_STRING name;
	name.Buffer = sectionName;
	name.Length = wcslen(sectionName) * sizeof(WCHAR);
	name.MaximumLength = name.Length + sizeof(WCHAR);  // Allow room for a null terminator if needed
#define OBJ_CASE_INSENSITIVE 0x00000040
	InitializeObjectAttributes(&objectAttributes, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);

	status = Sw3NtOpenSection(&localHandle, desiredAccess, &objectAttributes);
	if (!NT_SUCCESS(status)) {
		if (status == STATUS_ACCESS_DENIED) {
			return;
		}
		printf("[%s] Failed to open section %ws (%x)\n", __FUNCTION__, sectionName, status);
		return;
	}
	SECTION_BASIC_INFORMATION sbi = {};
	status = Sw3NtQuerySection(localHandle, SectionBasicInformation, &sbi, sizeof(sbi), NULL);
	if (!NT_SUCCESS(status)) {
		printf("[%s] Failed to query section information (%x)\n", __FUNCTION__, status);
		CloseHandle(this->handle);
		this->handle = nullptr;
		return;
	}
	this->objectattributes = objectAttributes;
	this->allocationattributes = sbi.Attributes;
	this->maximumsize = new LARGE_INTEGER(sbi.MaximumSize);
	CloseHandle(localHandle);
}

NTSTATUS NormalSection::map(SIZE_T mapSize, PLARGE_INTEGER sectionOffset, ULONG protect)
{

	NTSTATUS stat;
	if (handle == nullptr) {
		return STATUS_INVALID_HANDLE;
	}

	LARGE_INTEGER offset = { 0 };
	if (sectionOffset != nullptr) {
		offset = *sectionOffset;
	}

	SIZE_T size = mapSize;
	if (size == 0) {
		if (maximumsize != nullptr) {
			size = static_cast<SIZE_T>(maximumsize->QuadPart);
		}
		else {
			return STATUS_INVALID_PARAMETER;
		}
	}
	stat = Sw3NtMapViewOfSection(this->handle, GetCurrentProcess(), &baseaddress, 0, 0, &offset, &size, ViewUnmap, 0, protect);
	if (stat == 0) {
		return 0;
	}
	return stat;
}

NTSTATUS NormalSection::map_remote(SIZE_T mapSize, PLARGE_INTEGER sectionOffset, ULONG protect)
{
	NTSTATUS stat;
	if (handle == nullptr) {
		return STATUS_INVALID_HANDLE;
	}

	LARGE_INTEGER offset = { 0 };
	if (sectionOffset != nullptr) {
		offset = *sectionOffset;
	}

	SIZE_T size = mapSize;
	if (size == 0) {
		if (maximumsize != nullptr) {
			size = static_cast<SIZE_T>(maximumsize->QuadPart);
		}
		else {
			return STATUS_INVALID_PARAMETER;
		}
	}
	stat = Sw3NtMapViewOfSection(handle, processhandle, &baseaddress, 0, 0, &offset, &size, ViewUnmap, 0, protect);
	if (stat == 0) {
		return 0;
	}
	return stat;
}

NTSTATUS NormalSection::unmap()
{
	NTSTATUS stat;
	if (baseaddress == nullptr) {
		return 0;
	}
	stat = Sw3NtUnmapViewOfSection(GetCurrentProcess(), baseaddress);
	if (stat == 0) {
		baseaddress = nullptr;
	}
	return stat;
}

NTSTATUS NormalSection::unmap_remote()
{
	NTSTATUS stat;
	if (baseaddress == nullptr) {
		return 0;
	}
	stat = Sw3NtUnmapViewOfSection(processhandle, baseaddress);
	if (stat == 0) {
		baseaddress = nullptr;
	}
	return stat;
}

HANDLE NormalSection::get_file_handle()
{
	return this->filehandle;
}

HANDLE NormalSection::get_handle()
{
	return this->handle;
}

ULONG NormalSection::get_section_page_protection()
{
	return this->sectionpageprotection;
}

PLARGE_INTEGER NormalSection::get_maximum_size()
{
	return this->maximumsize;
}

OBJECT_ATTRIBUTES NormalSection::get_object_attributes()
{
	return this->objectattributes;
}

PVOID NormalSection::get_base_address()
{
	return this->baseaddress;
}


NormalSection::~NormalSection() {
	if (handle != nullptr) {
		Sw3NtClose(handle);
	}
}