admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

update MemorySetSectionProtection

Browse Source
This commit is contained in:
Boring
2023-12-14 19:44:30 +08:00
parent c55c84c0e7
commit 64675a3f89
1 changed files with 7 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/MemoryModule.cpp
+7 -23
View File
@@ -171,35 +171,19 @@ NTSTATUS MemorySetSectionProtection(
NTSTATUS status = STATUS_SUCCESS;
PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(lpNtHeaders);
//
// Determine whether it is a .NET assembly
//
auto& com = lpNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR];
bool CorImage = com.Size && com.VirtualAddress;
for (DWORD i = 0; i < lpNtHeaders->FileHeader.NumberOfSections; ++i, ++section) {
LPVOID address = LPBYTE(base) + section->VirtualAddress;
SIZE_T size = AlignValueUp(section->Misc.VirtualSize, lpNtHeaders->OptionalHeader.SectionAlignment);
if (section->Characteristics & IMAGE_SCN_MEM_DISCARDABLE && !CorImage) {
//
// If it is a .NET assembly, we cannot release this memory block
//
#pragma warning(disable:6250)
VirtualFree(address, size, MEM_DECOMMIT);
#pragma warning(default:6250)
}
else {
BOOL executable = (section->Characteristics & IMAGE_SCN_MEM_EXECUTE) != 0,
readable = (section->Characteristics & IMAGE_SCN_MEM_READ) != 0,
writeable = (section->Characteristics & IMAGE_SCN_MEM_WRITE) != 0;
DWORD protect = ProtectionFlags[executable][readable][writeable], oldProtect;
BOOL executable = (section->Characteristics & IMAGE_SCN_MEM_EXECUTE) != 0,
readable = (section->Characteristics & IMAGE_SCN_MEM_READ) != 0,
writeable = (section->Characteristics & IMAGE_SCN_MEM_WRITE) != 0;
DWORD protect = ProtectionFlags[executable][readable][writeable], oldProtect;
if (section->Characteristics & IMAGE_SCN_MEM_NOT_CACHED) protect |= PAGE_NOCACHE;
if (section->Characteristics & IMAGE_SCN_MEM_NOT_CACHED) protect |= PAGE_NOCACHE;
status = NtProtectVirtualMemory(NtCurrentProcess(), &address, &size, protect, &oldProtect);
if (!NT_SUCCESS(status))break;
}
status = NtProtectVirtualMemory(NtCurrentProcess(), &address, &size, protect, &oldProtect);
if (!NT_SUCCESS(status))break;
}
return status;