eflayMapHack/win32.cs at master · gxrsprite/eflayMapHack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
using System;
using System.Windows;
using System.Windows.Documents;
using System.Diagnostics;
using System.Threading;
using System.Runtime.InteropServices;
using System.Windows.Forms;
using System.Windows.Interop;
using System.Xml;
using System.Collections;
using System.Collections.Generic;
using System.Drawing;
using System.Text;

namespace eflayMH_WPF
{
	unsafe class win32
	{
		[DllImport("kernel32.dll", SetLastError = true)]
		public static extern int QueryDosDevice(string lpDeviceName, StringBuilder lpTargetPath, int ucchMax);

		static public Dictionary<string, string> DeviceNameAndPath = new Dictionary<string, string>();

		public static string DeviceName2Path(string sbProcImagePath)
		{
			int iRet;
			string strImageFilePath = "";
			if (sbProcImagePath.Length > 0)
			{
				int iDeviceIndex = sbProcImagePath.ToString().IndexOf("\\", "\\Device\\HarddiskVolume".Length);
				string strDevicePath = sbProcImagePath.ToString().Substring(0, iDeviceIndex);

				string DiskName = "";
				if(DeviceNameAndPath.TryGetValue(strDevicePath,out DiskName))
				{
					return DiskName+ ":"+sbProcImagePath.ToString().Replace(strDevicePath, "");
				}

				int iStartDisk = (int)'A';
				while (iStartDisk <= (int)'Z')
				{
					StringBuilder sbWindowImagePath = new StringBuilder(256);
					iRet = QueryDosDevice(((char)iStartDisk).ToString() + ":", sbWindowImagePath, sbWindowImagePath.Capacity);
					if (iRet != 0)
					{

						if (sbWindowImagePath.ToString() == strDevicePath)
						{
							DeviceNameAndPath.Add(strDevicePath,((char)iStartDisk).ToString());
							strImageFilePath = ((char)iStartDisk).ToString() + ":" + sbProcImagePath.ToString().Replace(strDevicePath, "");
							break;
						}
					}
					iStartDisk++;
				}

			}
			return strImageFilePath;
		}

		[DllImport("ntdll.dll", SetLastError = true)]
		public extern static int ZwQueryVirtualMemory(IntPtr ProcessHandle,int BaseAddress,MemoryInformationClass _MemoryInformationClass,IntPtr MemoryInformation,Int32 MemoryInformationLength,out int ReturnLenth);

		[DllImport("ntdll.dll", SetLastError = true)]
		public extern static int ZwQueryVirtualMemory(IntPtr ProcessHandle,int BaseAddress,MemoryInformationClass _MemoryInformationClass,[Out] void* mbi,Int32 MemoryInformationLength,out int Zero);
		[DllImport("ntdll.dll", SetLastError = true)]
		public extern static int ZwQueryVirtualMemory(IntPtr ProcessHandle,int BaseAddress,MemoryInformationClass _MemoryInformationClass,[Out] out MEMORY_SECTION_NAME mbi,Int32 MemoryInformationLength,out int Zero);
		[DllImport("ntdll.dll", SetLastError = true)]
		public extern static int ZwQueryVirtualMemory(IntPtr ProcessHandle,int BaseAddress,MemoryInformationClass _MemoryInformationClass,[Out] byte[] MSN,Int32 MemoryInformationLength,out int Zero);


		public enum MbiType
		{
			MEM_IMAGE = 0x1000000,MEM_MAPPED = 0x40000,MEM_PRIVATE = 0x20000
		}

		public struct   MemoryBasicInformation
		{
			public IntPtr BaseAddress;
			public IntPtr AllocationBase;
			public UInt32 AllocationProtect;
			public IntPtr RegionSize;
			public UInt32 State;
			public UInt32 Protect;
			public UInt32 lType;
		}


		public  enum MemoryInformationClass
		{
			MemoryBasicInformation,
			MemoryWorkingSetList,
			MemorySectionName,
			MemoryBasicVlmInformation
		}

		[StructLayout(LayoutKind.Sequential)]
		public struct MEMORY_SECTION_NAME
		{
			public UNICODE_STRING usstring;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 520)]
            public byte[] bt;


		}

		[StructLayout(LayoutKind.Sequential)]
		public struct UNICODE_STRING2
		{
			public ushort Length;
			public ushort MaximumLength;
			public int buffer;

		}


		[StructLayout(LayoutKind.Sequential)]
		public struct UNICODE_STRING : IDisposable
		{
			public ushort Length;
			public ushort MaximumLength;
			public IntPtr buffer;


			public UNICODE_STRING(string s)
			{
				Length = (ushort)(s.Length * 2);
				MaximumLength = (ushort)(Length + 2);
				buffer = Marshal.StringToHGlobalUni(s);
			}

			public void Dispose()
			{
				Marshal.FreeHGlobal(buffer);
				buffer = IntPtr.Zero;
			}

			public override string ToString()
			{
				return Marshal.PtrToStringUni(buffer);
			}
		}


	}//end of class win32
}//end of namespace eflayMH_WPF