mirror of
https://github.com/SECFORCE/SharpWhispers
synced 2026-06-08 12:28:14 +00:00
1 line
11 KiB
JSON
1 line
11 KiB
JSON
{"NtAllocateVirtualMemory": "public static Data.Native.NTSTATUS NtAllocateVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, IntPtr zeroBits, ref IntPtr regionSize, uint allocationType, uint protect)\n{\n\n object[] funcargs =\n {\n processHandle, baseAddress, zeroBits, regionSize, allocationType, protect\n };\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtAllocateVirtualMemory\", typeof(Delegate.NtAllocateVirtualMemory), ref funcargs);\n\n // Set out values\n baseAddress = (IntPtr)funcargs[1];\n regionSize = (IntPtr)funcargs[3];\n\n return retValue;\n}\n\n", "NtCreateThreadEx": "public static Data.Native.NTSTATUS NtCreateThreadEx(ref IntPtr threadHandle, Data.Win32.WinNT.ACCESS_MASK desiredAccess, IntPtr objectAttributes, IntPtr processHandle, IntPtr startAddress, IntPtr parameter, bool createSuspended, int stackZeroBits, int sizeOfStack, int maximumStackSize, IntPtr attributeList)\n{\n object[] funcargs =\n {\n threadHandle, desiredAccess, objectAttributes, processHandle, startAddress, parameter, createSuspended, stackZeroBits,\n sizeOfStack, maximumStackSize, attributeList\n};\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtCreateThreadEx\",\n typeof(Delegate.NtCreateThreadEx), ref funcargs);\n\n threadHandle = (IntPtr)funcargs[0];\n return retValue;\n}\n\n", "NtCreateSection": "public static Data.Native.NTSTATUS NtCreateSection(ref IntPtr sectionHandle, uint desiredAccess, IntPtr objectAttributes, ref ulong maximumSize, uint sectionPageProtection, uint allocationAttributes, IntPtr fileHandle)\n{\n object[] funcargs =\n {\n sectionHandle, desiredAccess, objectAttributes, maximumSize, sectionPageProtection, allocationAttributes, fileHandle\n};\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtCreateSection\", typeof(Delegate.NtCreateSection), ref funcargs);\n\n if (retValue != Data.Native.NTSTATUS.Success)\n throw new InvalidOperationException(\"Unable to create section, \" + retValue);\n\n sectionHandle = (IntPtr)funcargs[0];\n maximumSize = (ulong)funcargs[3];\n\n return retValue;\n}\n\n", "NtUnmapViewOfSection": "public static Data.Native.NTSTATUS NtUnmapViewOfSection(IntPtr hProc, IntPtr baseAddr)\n{\n object[] funcargs =\n {\n hProc, baseAddr\n};\n\n var result = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtUnmapViewOfSection\", typeof(Delegate.NtUnmapViewOfSection), ref funcargs);\n\n return result;\n}\n\n", "NtMapViewOfSection": "public static Data.Native.NTSTATUS NtMapViewOfSection(IntPtr sectionHandle, IntPtr processHandle, ref IntPtr baseAddress, IntPtr zeroBits, IntPtr commitSize, IntPtr sectionOffset, ref ulong viewSize, uint inheritDisposition, uint allocationType, uint win32Protect)\n{\n object[] funcargs =\n {\n sectionHandle, processHandle, baseAddress, zeroBits, commitSize, sectionOffset, viewSize, inheritDisposition, allocationType,\n win32Protect\n};\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtMapViewOfSection\", typeof(Delegate.NtMapViewOfSection), ref funcargs);\n\n if (retValue != Data.Native.NTSTATUS.Success && retValue != Data.Native.NTSTATUS.ImageNotAtBase)\n throw new InvalidOperationException(\"Unable to map view of section, \" + retValue);\n\n baseAddress = (IntPtr)funcargs[2];\n viewSize = (ulong)funcargs[6];\n\n return retValue;\n}\n\n\n", "NtQueryInformationProcess": "public static Data.Native.NTSTATUS NtQueryInformationProcess(IntPtr hProcess, Data.Native.PROCESSINFOCLASS processInfoClass, out IntPtr pProcInfo)\n{\n int processInformationLength;\n uint retLen = 0;\n\n switch (processInfoClass)\n {\n case Data.Native.PROCESSINFOCLASS.ProcessWow64Information:\n pProcInfo = Marshal.AllocHGlobal(IntPtr.Size);\n DynamicSysInvoke.RtlZeroMemory(pProcInfo, IntPtr.Size);\n processInformationLength = IntPtr.Size;\n break;\n\n case Data.Native.PROCESSINFOCLASS.ProcessBasicInformation:\n var pbi = new Data.Native.PROCESS_BASIC_INFORMATION();\n pProcInfo = Marshal.AllocHGlobal(Marshal.SizeOf(pbi));\n DynamicSysInvoke.RtlZeroMemory(pProcInfo, Marshal.SizeOf(pbi));\n Marshal.StructureToPtr(pbi, pProcInfo, true);\n processInformationLength = Marshal.SizeOf(pbi);\n break;\n\n default:\n throw new InvalidOperationException($\"Invalid ProcessInfoClass: {processInfoClass}\");\n }\n\n object[] funcargs =\n {\n hProcess, processInfoClass, pProcInfo, processInformationLength, retLen\n};\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtQueryInformationProcess\", typeof(Delegate.NtQueryInformationProcess), ref funcargs);\n\n if (retValue != Data.Native.NTSTATUS.Success)\n throw new UnauthorizedAccessException(\"Access is denied.\");\n\n pProcInfo = (IntPtr)funcargs[2];\n\n return retValue;\n}\n\n", "NtFreeVirtualMemory": "public static void NtFreeVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, ref IntPtr regionSize, uint freeType)\n{\n object[] funcargs =\n {\n processHandle, baseAddress, regionSize, freeType\n};\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtFreeVirtualMemory\", typeof(Delegate.NtFreeVirtualMemory), ref funcargs);\n\n switch (retValue)\n {\n case Data.Native.NTSTATUS.AccessDenied:\n throw new UnauthorizedAccessException(\"Access is denied.\");\n case Data.Native.NTSTATUS.InvalidHandle:\n throw new InvalidOperationException(\"An invalid HANDLE was specified.\");\n }\n\n if (retValue != Data.Native.NTSTATUS.Success)\n throw new InvalidOperationException(\"There is a mismatch between the type of object that is required by the requested operation and the type of object that is specified in the request.\");\n}\n\n", "NtProtectVirtualMemory": "public static uint NtProtectVirtualMemory(IntPtr processHandle, ref IntPtr baseAddress, ref IntPtr regionSize, uint newProtect)\n{\n uint oldProtect = 0;\n object[] funcargs =\n {\n processHandle, baseAddress, regionSize, newProtect, oldProtect\n};\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtProtectVirtualMemory\", typeof(Delegate.NtProtectVirtualMemory), ref funcargs);\n\n if (retValue != Data.Native.NTSTATUS.Success)\n throw new InvalidOperationException(\"Failed to change memory protection, \" + retValue);\n\n oldProtect = (uint)funcargs[4];\n return oldProtect;\n}\n\n", "NtWriteVirtualMemory": "public static uint NtWriteVirtualMemory(IntPtr processHandle, IntPtr baseAddress, IntPtr buffer, uint bufferLength)\n{\n uint bytesWritten = 0;\n object[] funcargs =\n {\n processHandle, baseAddress, buffer, bufferLength, bytesWritten\n};\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtWriteVirtualMemory\", typeof(Delegate.NtWriteVirtualMemory), ref funcargs);\n\n if (retValue != Data.Native.NTSTATUS.Success)\n throw new InvalidOperationException(\"Failed to write memory, \" + retValue);\n\n bytesWritten = (uint)funcargs[4];\n return bytesWritten;\n}\n\n", "NtOpenFile": "public static IntPtr NtOpenFile(ref IntPtr fileHandle, Data.Win32.Kernel32.FileAccessFlags desiredAccess, ref Data.Native.OBJECT_ATTRIBUTES objectAttributes, ref Data.Native.IO_STATUS_BLOCK ioStatusBlock, Data.Win32.Kernel32.FileShareFlags shareAccess, Data.Win32.Kernel32.FileOpenFlags openOptions)\n{\n object[] funcargs =\n {\n fileHandle, desiredAccess, objectAttributes, ioStatusBlock, shareAccess, openOptions\n};\n\n var retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtOpenFile\", typeof(Delegate.NtOpenFile), ref funcargs);\n\n if (retValue != Data.Native.NTSTATUS.Success)\n throw new InvalidOperationException(\"Failed to open file, \" + retValue);\n\n fileHandle = (IntPtr)funcargs[0];\n return fileHandle;\n}\n\n\n\n", "NtReadVirtualMemory": "public static UInt32 NtReadVirtualMemory(IntPtr ProcessHandle, IntPtr BaseAddress, IntPtr Buffer, ref UInt32 NumberOfBytesToRead)\n{\n // Craft an array for the arguments\n UInt32 NumberOfBytesRead = 0;\n object[] funcargs =\n {\n ProcessHandle, BaseAddress, Buffer, NumberOfBytesToRead, NumberOfBytesRead\n };\n\n Data.Native.NTSTATUS retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtReadVirtualMemory\", typeof(Delegate.NtReadVirtualMemory), ref funcargs);\n if (retValue != Data.Native.NTSTATUS.Success)\n {\n throw new InvalidOperationException(\"Failed to read memory, \" + retValue);\n }\n\n NumberOfBytesRead = (UInt32)funcargs[4];\n return NumberOfBytesRead;\n}\n\n\n", "NtOpenProcess": "public static IntPtr NtOpenProcess(UInt32 ProcessId, Data.Win32.Kernel32.ProcessAccessFlags DesiredAccess)\n{\n // Create OBJECT_ATTRIBUTES & CLIENT_ID ref's\n IntPtr ProcessHandle = IntPtr.Zero;\n Data.Native.OBJECT_ATTRIBUTES oa = new Data.Native.OBJECT_ATTRIBUTES();\n Data.Native.CLIENT_ID ci = new Data.Native.CLIENT_ID();\n ci.UniqueProcess = (IntPtr)ProcessId;\n\n // Craft an array for the arguments\n object[] funcargs =\n {\n ProcessHandle, DesiredAccess, oa, ci\n };\n\n Data.Native.NTSTATUS retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtOpenProcess\", typeof(Delegate.NtOpenProcess), ref funcargs);\n if (retValue != Data.Native.NTSTATUS.Success && retValue == Data.Native.NTSTATUS.InvalidCid)\n {\n throw new InvalidOperationException(\"An invalid client ID was specified.\");\n }\n if (retValue != Data.Native.NTSTATUS.Success)\n {\n throw new UnauthorizedAccessException(\"Access is denied.\");\n }\n\n // Update the modified variables\n ProcessHandle = (IntPtr)funcargs[0];\n\n return ProcessHandle;\n}\n\n\n", "NtQueryVirtualMemory": "public static Data.Native.NTSTATUS NtQueryVirtualMemory(\n IntPtr processHandle,\n IntPtr baseAddress,\n Data.Native.MEMORYINFOCLASS memoryInformationClass,\n IntPtr memoryInformation,\n uint memoryInformationLength,\n ref uint returnLength)\n{\n // TODO: NOT TESTED\n // Check that memoryInformation is handled correctly\n\n \n // Craft an array for the arguments\n object[] funcargs =\n {\n processHandle, baseAddress, memoryInformationClass, memoryInformation, memoryInformationLength, returnLength\n };\n\n Data.Native.NTSTATUS retValue = (Data.Native.NTSTATUS)DynamicSysInvoke.DynamicSyscallInvoke(\"NtQueryVirtualMemory\", typeof(Delegate.NtQueryVirtualMemory), ref funcargs);\n\n return retValue;\n}"} |