-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsample_code.txt
More file actions
145 lines (118 loc) · 3.74 KB
/
Copy pathsample_code.txt
File metadata and controls
145 lines (118 loc) · 3.74 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
// Returns the 32-bit Eflags
__declspec(naked) __declspec(dllexport) ui Get_Eflags(void)
{
__asm {
pushfd
pop eax
ret
}
}
// This function has the effect of pushing an INT value onto the stack
// { Returns that INT. }
__declspec(naked) __declspec(dllexport) ui pushint(ui value)
{
__asm {
mov ecx,[esp] ;; ecx = return address
mov eax,[esp+4] ;; eax = value
add esp,4 ;; ESP now points to value on stack
jmp short ecx
ret
}
}
// This function has the effect of popping an INT value from the stack
__declspec(naked) __declspec(dllexport) ui popint(void)
{
__asm {
mov ecx,[esp] ;; ecx = return address
mov eax,[esp+4] ;; eax = previous value pushed
add esp,8
jmp short ecx
ret
}
}
// This function has the effect of pushing a FLOAT value onto the stack
// { Returns that FLOAT. }
__declspec(naked) __declspec(dllexport) float pushfloat(float value)
{
__asm {
mov ecx,[esp] ;; ecx = return address
mov eax,[esp+4] ;; eax = value
add esp,4 ;; ESP now points to value on stack
jmp short ecx
ret
}
}
// This function has the effect of popping a FLOAT value from the stack
__declspec(naked) __declspec(dllexport) float popfloat(void)
{
__asm {
mov ecx,[esp] ;; ecx = return address
mov eax,[esp+4] ;; eax = previous value pushed
add esp,8
jmp short ecx
ret
}
}
//////////////////////////////////////////////////////////////////////////////////////////////////////
//size_t
//SIZE_T WINAPI VirtualQuery
// (
// _In_opt_ LPCVOID lpAddress,
// _Out_ PMEMORY_BASIC_INFORMATION lpBuffer,
// _In_ SIZE_T dwLength
//);
// Reference :: http://tinyurl.com/m9fzs86
// Retrieves information about a range of pages in the virtual address space of the calling process.
// i_Address = an instruction address, (such as an instruction pointer)
// mbi = a pointer to a MEMORY_BASIC_INFORMATION structure
//
__declspec(dllexport) size_t WINAPI VirtQuery(ui *i_Address, PMEMORY_BASIC_INFORMATION mbi, size_t length)
{
return VirtualQuery(i_Address,mbi,length);
}
// Reference :: http://tinyurl.com/nomrkmw
// Retrieves information about a range of pages within the virtual address space of a specified process.
// mbi = a pointer to a MEMORY_BASIC_INFORMATION structure
//
__declspec(dllexport) size_t WINAPI VirtQueryEx(HANDLE hProcess, void *dwStart, PMEMORY_BASIC_INFORMATION mbi, size_t dwLength)
{
return VirtualQueryEx( hProcess, dwStart, mbi, dwLength);
}
__declspec(dllexport) _Bool WINAPI VirtProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect,PDWORD lpflOldProtect)
{
return VirtualProtect(lpAddress, dwSize, flNewProtect, lpflOldProtect);
}
__declspec(dllexport) _Bool WINAPI VirtProtectEx(HANDLE hProcess, LPVOID lpAddress,SIZE_T dwSize, DWORD flNewProtect,PDWORD lpflOldProtect)
{
return VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect, lpflOldProtect);
}
/*
BOOL WINAPI VirtualProtectEx(
_In_ HANDLE hProcess,
_In_ LPVOID lpAddress,
_In_ SIZE_T dwSize,
_In_ DWORD flNewProtect,
_Out_ PDWORD lpflOldProtect
);
*/
/*
BOOL WINAPI VirtualProtect(
_In_ LPVOID lpAddress,
_In_ SIZE_T dwSize,
_In_ DWORD flNewProtect,
_Out_ PDWORD lpflOldProtect
);
*/
/*
BOOL WINAPI ReadProcessMemory(
_In_ HANDLE hProcess,
_In_ LPCVOID lpBaseAddress,
_Out_ LPVOID lpBuffer,
_In_ SIZE_T nSize,
_Out_ SIZE_T *lpNumberOfBytesRead
);
*/
__declspec(dllexport) BOOL WINAPI ReadProcessMemm(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead)
{
return ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead);
}