[Руководство] Класс для работы с памятью(Nt)

[крайслер]

В связи не некоторым ажиотажем в некоторых кругах))))

Использовано:

Цитата: NtOpenProcess NtClose NtWriteVirtualMemory NtProtectVirtualMemory

Реализовано:
NtWriteMemoryEx - запись в память массива байт
newGPA - аналог GetProcAdress
NtWriteMemory - запись данных в память по указанному типу
+ прочий вспомогательный "мусор"))


Работать должен как из под приложения(dll, но не проверял), так и в экстернал...


[Ссылки могут видеть только зарегистрированные пользователи. ]

cNtMemoryEdit.h

#pragma once

#include <Windows.h>
#include <tlHelp32.h>
#include <subauth.h>


typedef struct _CLIENT_ID
{
	PVOID UniqueProcess;
	PVOID UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
typedef struct _OBJECT_ATTRIBUTES
{
	ULONG           Length;
	HANDLE          RootDirectory;
	PUNICODE_STRING ObjectName;
	ULONG           Attributes;
	PVOID           SecurityDescriptor;
	PVOID           SecurityQualityOfService;
}  OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;



typedef NTSTATUS(NTAPI* NTWRITEVIRTUALMEMORY)(HANDLE, PVOID, PVOID, ULONG, PULONG);
typedef NTSTATUS(NTAPI* NTOPENPROCESS)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
typedef NTSTATUS(NTAPI* NTCLOSE)(HANDLE);
typedef NTSTATUS(NTAPI* NTALLOCATEVIRTUALMEMORY)(HANDLE, PVOID, ULONG, PULONG, ULONG, ULONG);//NtAllocateVirtualMemory
typedef NTSTATUS(NTAPI *NTPROTECTVIRTUALMEMORY)(HANDLE , PVOID *, PULONG , ULONG , PULONG );//NtProtectVirtualMemory



class cNtMemoryEdit
{
public:


	NTOPENPROCESS NtOpenProcess;
	NTCLOSE       NtClose;
	NTALLOCATEVIRTUALMEMORY NtAllocateVirtualMemory;
	NTWRITEVIRTUALMEMORY NtWriteVirtualMemory;
	NTPROTECTVIRTUALMEMORY NtProtectVirtualMemory;


	template <class cData>
	void NtWriteMemory(DWORD dwAddress, cData Value)
	{
		NtWriteVirtualMemory(m_pHandleProcess, (PVOID)dwAddress, &Value, sizeof(cData), NULL);
	}

	void   NtWriteMemoryEx(DWORD dwAddress, char *Patch_Bts);



	cNtMemoryEdit(TCHAR * m_pNameProcess);
	cNtMemoryEdit(void);
	virtual ~cNtMemoryEdit();

	FARPROC   newGPA(HMODULE Mod, TCHAR* fName);
	DWORD     ProcessID();

	DWORD  GetProcessID(){ return this->m_pID; }
	HANDLE GetHandleProcess(){ return this->m_pHandleProcess; }
private:
	TCHAR * m_pNameProcess;
	DWORD m_pID;
	HMODULE m_pNtdll;
	HANDLE m_pHandleProcess;
	CLIENT_ID m_pCID;
	OBJECT_ATTRIBUTES m_pATTRIBUTES;
	__int32 СharLength(char *chArray);
};




#define InitializeObjectAttributes(p, n, a, r, s) \
{ \
	(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
	(p)->RootDirectory = r; \
	(p)->Attributes = a; \
	(p)->ObjectName = n; \
	(p)->SecurityDescriptor = s; \
	(p)->SecurityQualityOfService = NULL; \
}

cNtMemoryEdit.cpp

#include "cNtMemoryEdit.h"


cNtMemoryEdit::cNtMemoryEdit(TCHAR * m_pNameProcess)
{
	ZeroMemory(this, sizeof(cNtMemoryEdit));
	ZeroMemory(&m_pATTRIBUTES, sizeof(m_pATTRIBUTES));

	this->m_pNameProcess = m_pNameProcess;
	
	this->m_pNtdll = GetModuleHandle(__TEXT("ntdll.dll"));
	if (!this->m_pNtdll)
		this->m_pNtdll = LoadLibrary(__TEXT("ntdll.dll"));

	InitializeObjectAttributes(&m_pATTRIBUTES, NULL, 0, NULL, NULL);
	NtOpenProcess = (NTOPENPROCESS)newGPA(this->m_pNtdll, "NtOpenProcess");
	NtClose = (NTCLOSE)newGPA(this->m_pNtdll, "NtClose");
	NtWriteVirtualMemory = (NTWRITEVIRTUALMEMORY)newGPA(this->m_pNtdll, "NtWriteVirtualMemory");
	NtProtectVirtualMemory = (NTPROTECTVIRTUALMEMORY)newGPA(this->m_pNtdll, "NtProtectVirtualMemory");


	this->m_pID = ProcessID();

	m_pCID.UniqueProcess = (HANDLE)this->m_pID;
	m_pCID.UniqueThread = 0;
	
	 NtOpenProcess(&this->m_pHandleProcess, PROCESS_ALL_ACCESS, &m_pATTRIBUTES, &m_pCID);

}
cNtMemoryEdit::cNtMemoryEdit(void)
{
	ZeroMemory(this, sizeof(cNtMemoryEdit));
	ZeroMemory(&m_pATTRIBUTES, sizeof(m_pATTRIBUTES));
	m_pNtdll = GetModuleHandle(__TEXT("ntdll.dll"));
	if (!m_pNtdll)
		m_pNtdll = LoadLibrary(__TEXT("ntdll.dll"));

	InitializeObjectAttributes(&m_pATTRIBUTES, NULL, 0, NULL, NULL);

	NtOpenProcess = (NTOPENPROCESS)newGPA(this->m_pNtdll, "NtOpenProcess");
	NtClose = (NTCLOSE)newGPA(this->m_pNtdll, "NtClose");
	NtWriteVirtualMemory = (NTWRITEVIRTUALMEMORY)newGPA(this->m_pNtdll, "NtWriteVirtualMemory");
	NtProtectVirtualMemory = (NTPROTECTVIRTUALMEMORY)newGPA(this->m_pNtdll, "NtProtectVirtualMemory");

	this->m_pID = GetCurrentProcessId();


	m_pCID.UniqueProcess = (HANDLE)this->m_pID;
	m_pCID.UniqueThread = 0;

	NtOpenProcess(&this->m_pHandleProcess, PROCESS_ALL_ACCESS, &m_pATTRIBUTES, &m_pCID);
}


void    cNtMemoryEdit::NtWriteMemoryEx(DWORD dwAdress, char *pBYTE)
{
	DWORD OldProtection;
	__int32 iSize = СharLength(pBYTE);
	NtProtectVirtualMemory(this->m_pHandleProcess, (PVOID*)dwAdress, (PULONG)iSize, PAGE_EXECUTE_READWRITE, &OldProtection);
	for (__int32 i = 0; i < iSize; i++)
		NtWriteMemory<BYTE>(dwAdress + i, pBYTE[i]);
	NtProtectVirtualMemory(this->m_pHandleProcess, (PVOID*)dwAdress, (PULONG)iSize, OldProtection, &OldProtection);
}





__int32 cNtMemoryEdit::СharLength(char *chArray)
{
	for (__int32 iLength = 1; iLength < MAX_PATH; iLength++)
	if (chArray[iLength] == '\0')
		return iLength;
	return 0;
}
DWORD cNtMemoryEdit::ProcessID()
{
	DWORD	pID = 0;
	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	PROCESSENTRY32 process;
	process.dwSize = sizeof(PROCESSENTRY32);
	if (Process32First(snapshot, &process))
	{
		while (Process32Next(snapshot, &process))
		{
			if (_stricmp(process.szExeFile, this->m_pNameProcess) == 0)
			{
				pID = process.th32ProcessID;
				break;
			}
		}
	}
	CloseHandle(snapshot);
	return pID;
}
FARPROC  cNtMemoryEdit::newGPA(HMODULE Mod, TCHAR* fName)
{
	ULONG Portable_Executable;
	PIMAGE_EXPORT_DIRECTORY EXPORT_DIRECTORY;

	PULONG  RVAPointer;
	PUSHORT oTb_RVA;
	PULONG  dwTbRVA;
	ULONG  uReturn = 0;
	USHORT strTMP = 0;
	USHORT tmpINDEX;
	char * tmpName;
	ULONG Adress;
	ULONG size_CNT;

	if ((ULONG)fName <= 0xFFFF)
		strTMP = (USHORT)fName;

	if (Mod)
	{
		Portable_Executable =
			*(ULONG*)((ULONG)Mod + 0x3C) + (ULONG)Mod;
		EXPORT_DIRECTORY =
			(PIMAGE_EXPORT_DIRECTORY)(*(ULONG*)((ULONG)Portable_Executable + 0x78) + (ULONG)Mod);

		RVAPointer =
			(ULONG*)(EXPORT_DIRECTORY->AddressOfNames + (ULONG)Mod);
		oTb_RVA =
			(USHORT*)(EXPORT_DIRECTORY->AddressOfNameOrdinals + (ULONG)Mod);
		dwTbRVA =
			(ULONG*)(EXPORT_DIRECTORY->AddressOfFunctions + (ULONG)Mod);

		if (EXPORT_DIRECTORY->NumberOfNames > EXPORT_DIRECTORY->NumberOfFunctions)
			size_CNT = EXPORT_DIRECTORY->NumberOfNames;
		else
			size_CNT = EXPORT_DIRECTORY->NumberOfFunctions;

		for (USHORT i = 0; i < size_CNT; i++)
		{
			if (i < EXPORT_DIRECTORY->NumberOfFunctions)
			{
				tmpName = (char*)(RVAPointer[i] + (ULONG)Mod);
				tmpINDEX = oTb_RVA[i];
			}
			else
			{
				tmpName = 0;
				tmpINDEX = i;
			}
			Adress = dwTbRVA[tmpINDEX] + (ULONG)Mod;
			if ((strTMP == tmpINDEX + EXPORT_DIRECTORY->Base) || (tmpName && !strcmp(tmpName, fName))) // wcscmp
			{
				uReturn = Adress;
				break;
			}
		}
	}
	return (FARPROC)uReturn;
}
cNtMemoryEdit::~cNtMemoryEdit()
{
	ZeroMemory(this, sizeof(cNtMemoryEdit));
	NtClose(this->m_pHandleProcess);
}

Пример использования:

#include <Windows.h>
#include <conio.h>
#include <iostream>
#include  "cNtMemoryEdit.h"
ULONG GetDebugPrivileges();
cNtMemoryEdit *NtMemoryEdit = new cNtMemoryEdit("Test.exe");
int main()
{
	SetConsoleTitle("cNtMemoryEdit Test");
	GetDebugPrivileges();
	printf("ID:: %d\n", NtMemoryEdit->GetProcessID());
	printf("HANDLE:: 0x%X (%d)\n", NtMemoryEdit->GetHandleProcess(), NtMemoryEdit->GetHandleProcess());

	NtMemoryEdit->NtWriteMemory<int>(0x024B3A40, 379);

	//TerminateProcess(NtMemoryEdit->GetHandleProcess(), 0);
	getch();
	return 0;
}
ULONG GetDebugPrivileges()
{
	TOKEN_PRIVILEGES tokenPrvlgs;
	HANDLE hToken = 0;

	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken))
		return 0;

	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tokenPrvlgs.Privileges[0].Luid))
		return 0;

	tokenPrvlgs.PrivilegeCount = 1;
	tokenPrvlgs.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPrvlgs, 0, NULL, NULL))
	{
		return 0;
	}

	CloseHandle(hToken);
	return 1;
}

[Srakabomja]

Чем отличаются от стандартных? Принципы работы вроде те же, просто они переименованы

[крайслер]

Цитата: Сообщение от Srakabomja Чем отличаются от стандартных? Принципы работы вроде те же, просто они переименованы

Кроме уровня обработки не чем))0

[primeval1]

Спасибо, познавательно и удобно!

П.С. На много быстрее стандартного чтения?

[soldat2022]

Цитата: ULONG GetDebugPrivileges()

Тогда уж и это заменить на натив (RtlAdjustPrivilege).