diff --git a/MemoryModule/Initialize.cpp b/MemoryModule/Initialize.cpp index 032dc37..d013211 100644 --- a/MemoryModule/Initialize.cpp +++ b/MemoryModule/Initialize.cpp @@ -1,5 +1,64 @@ #include "stdafx.h" +#include -VOID Initialize() { +BOOLEAN MmpBuildSectionName(_Out_ PUNICODE_STRING SectionName) { + WCHAR buffer[128]; + wsprintfW(buffer, L"\\Sessions\\%d\\BaseNamedObjects\\MMPP%d", NtCurrentPeb()->SessionId, (unsigned int)NtCurrentProcessId()); + return RtlCreateUnicodeString(SectionName, buffer); +} + +VOID InitializeLockHeld() { + NTSTATUS status; + HANDLE hSection; + OBJECT_ATTRIBUTES oa; + LARGE_INTEGER li; + UNICODE_STRING us{}; + + li.QuadPart = 0x1000; + + do { + + if (!MmpBuildSectionName(&us))break; + + InitializeObjectAttributes(&oa, &us, 0, nullptr, nullptr); + + status = NtCreateSection( + &hSection, + SECTION_ALL_ACCESS, + &oa, + &li, + PAGE_READWRITE, + SEC_COMMIT | SEC_BASED, + nullptr + ); + if (!NT_SUCCESS(status)) { + if (status != STATUS_OBJECT_NAME_COLLISION) break; + + status = NtOpenSection( + &hSection, + SECTION_ALL_ACCESS, + &oa + ); + if (!NT_SUCCESS(status))break; + } + + PVOID BaseAddress = 0; + SIZE_T ViewSize = 0; + status = NtMapViewOfSection( + hSection, + NtCurrentProcess(), + &BaseAddress, + 0, + 0, + nullptr, + &ViewSize, + ViewUnmap, + 0, + PAGE_READWRITE + ); + + } while (false); + + RtlFreeUnicodeString(&us); } diff --git a/test/test.cpp b/test/test.cpp index 29a047a..4e376c4 100644 --- a/test/test.cpp +++ b/test/test.cpp @@ -132,7 +132,77 @@ int test_user32() { return 0; } +void test() { + + NTSTATUS status; + HANDLE hSection; + OBJECT_ATTRIBUTES oa; + LARGE_INTEGER li; + UNICODE_STRING us; + SECTION_BASIC_INFORMATION sbi; + PVOID BaseAddress = 0; + SIZE_T ViewSize = 0; + + li.QuadPart = 0x1000; + + RtlInitUnicodeString(&us, L"\\Sessions\\2\\BaseNamedObjects\\SectionTest"); + + InitializeObjectAttributes(&oa, &us, 0, nullptr, nullptr); + + status = NtCreateSection( + &hSection, + SECTION_ALL_ACCESS, + &oa, + &li, + PAGE_READWRITE, + SEC_COMMIT | SEC_BASED, + nullptr + ); + + if (NT_SUCCESS(status)) { + + status = NtQuerySection( + hSection, + SECTION_INFORMATION_CLASS::SectionBasicInformation, + &sbi, + sizeof(sbi), + nullptr + ); + + status = NtMapViewOfSection( + hSection, + NtCurrentProcess(), + &BaseAddress, + 0, + 0, + nullptr, + &ViewSize, + ViewUnmap, + 0, + PAGE_READWRITE + ); + if (NT_SUCCESS(status)) { + + status = NtQuerySection( + hSection, + SECTION_INFORMATION_CLASS::SectionBasicInformation, + &sbi, + sizeof(sbi), + nullptr + ); + + status = NtUnmapViewOfSection( + NtCurrentProcess(), + BaseAddress + ); + } + + NtClose(hSection); + } + +} + int main() { - test_a_dll(); + test(); return 0; }