update

2026-06-08 13:15:33 +00:00 · 2022-09-30 22:47:48 +08:00
parent 3b2f04e6d5
commit 0c4f334418
2 changed files with 131 additions and 2 deletions
@@ -1,5 +1,64 @@
 #include "stdafx.h"
+#include <wchar.h>

-VOID Initialize() {
+BOOLEAN MmpBuildSectionName(_Out_ PUNICODE_STRING SectionName) {
+	WCHAR buffer[128];

+	wsprintfW(buffer, L"\\Sessions\\%d\\BaseNamedObjects\\MMPP%d", NtCurrentPeb()->SessionId, (unsigned int)NtCurrentProcessId());
+	return RtlCreateUnicodeString(SectionName, buffer);
+}
+
+VOID InitializeLockHeld() {
+    NTSTATUS status;
+    HANDLE hSection;
+    OBJECT_ATTRIBUTES oa;
+    LARGE_INTEGER li;
+    UNICODE_STRING us{};
+
+    li.QuadPart = 0x1000;
+
+    do {
+
+        if (!MmpBuildSectionName(&us))break;
+
+        InitializeObjectAttributes(&oa, &us, 0, nullptr, nullptr);
+
+        status = NtCreateSection(
+            &hSection,
+            SECTION_ALL_ACCESS,
+            &oa,
+            &li,
+            PAGE_READWRITE,
+            SEC_COMMIT | SEC_BASED,
+            nullptr
+        );
+        if (!NT_SUCCESS(status)) {
+            if (status != STATUS_OBJECT_NAME_COLLISION) break;
+
+            status = NtOpenSection(
+                &hSection,
+                SECTION_ALL_ACCESS,
+                &oa
+            );
+            if (!NT_SUCCESS(status))break;
+        }
+
+        PVOID BaseAddress = 0;
+        SIZE_T ViewSize = 0;
+        status = NtMapViewOfSection(
+            hSection,
+            NtCurrentProcess(),
+            &BaseAddress,
+            0,
+            0,
+            nullptr,
+            &ViewSize,
+            ViewUnmap,
+            0,
+            PAGE_READWRITE
+        );
+
+    } while (false);
+
+    RtlFreeUnicodeString(&us);
 }
@@ -132,7 +132,77 @@ int test_user32() {
    return 0;
 }

+void test() {
+
+    NTSTATUS status;
+    HANDLE hSection;
+    OBJECT_ATTRIBUTES oa;
+    LARGE_INTEGER li;
+    UNICODE_STRING us;
+    SECTION_BASIC_INFORMATION sbi;
+    PVOID BaseAddress = 0;
+    SIZE_T ViewSize = 0;
+
+    li.QuadPart = 0x1000;
+
+    RtlInitUnicodeString(&us, L"\\Sessions\\2\\BaseNamedObjects\\SectionTest");
+
+    InitializeObjectAttributes(&oa, &us, 0, nullptr, nullptr);
+
+    status = NtCreateSection(
+        &hSection,
+        SECTION_ALL_ACCESS,
+        &oa,
+        &li,
+        PAGE_READWRITE,
+        SEC_COMMIT | SEC_BASED,
+        nullptr
+    );
+
+    if (NT_SUCCESS(status)) {
+
+        status = NtQuerySection(
+            hSection,
+            SECTION_INFORMATION_CLASS::SectionBasicInformation,
+            &sbi,
+            sizeof(sbi),
+            nullptr
+        );
+
+        status = NtMapViewOfSection(
+            hSection,
+            NtCurrentProcess(),
+            &BaseAddress,
+            0,
+            0,
+            nullptr,
+            &ViewSize,
+            ViewUnmap,
+            0,
+            PAGE_READWRITE
+        );
+        if (NT_SUCCESS(status)) {
+
+            status = NtQuerySection(
+                hSection,
+                SECTION_INFORMATION_CLASS::SectionBasicInformation,
+                &sbi,
+                sizeof(sbi),
+                nullptr
+            );
+
+            status = NtUnmapViewOfSection(
+                NtCurrentProcess(),
+                BaseAddress
+            );
+        }
+
+        NtClose(hSection);
+    }
+
+}
+
 int main() {
-    test_a_dll();
+    test();
    return 0;
 }