插APC驱动读写

最新推荐文章于 2024-02-02 14:17:41 发布

CalvinXu17

最新推荐文章于 2024-02-02 14:17:41 发布

阅读量1.2k

点赞数 1

文章标签：驱动

本文链接：https://blog.youkuaiyun.com/qq_41208289/article/details/88201039

版权

//插APC温柔读内存
BOOLEAN APCReadProcessMemory(ULONG PID, PVOID targetaddress, ULONG length, PVOID retdata)
{
	PEPROCESS pepro;
	KAPC_STATE kapc = { 0 };
	pepro = LookupProcess((HANDLE)PID);
	if (pepro == NULL)
		return FALSE;
	ObDereferenceObject(pepro);
	__try
	{
		KeStackAttachProcess(pepro, &kapc);
		ProbeForRead(targetaddress, length, sizeof(CHAR));
		RtlCopyMemory(retdata, targetaddress, length);
		KeUnstackDetachProcess(&kapc);
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		KeUnstackDetachProcess(&kapc);
		return FALSE;
	}	
	return TRUE;
}


//插APC温柔写内存
BOOLEAN APCWriteProcessMemory(ULONG PID, PVOID targetaddress, ULONG length, PVOID Indata)
{
	PEPROCESS pepro;
	KAPC_STATE kapc = { 0 };
	pepro = LookupProcess((HANDLE)PID);
	if (pepro == NULL)
		return FALSE;
	ObDereferenceObject(pepro);
	ULONG64 Cr0;
	__try
	{
		KeStackAttachProcess(pepro, &kapc);
		ProbeForWrite(targetaddress, length, sizeof(CHAR));
		_disable();
		Cr0 = __readcr0();
		Cr0 &= 0xfffffffffffeffff;
		__writecr0(Cr0);
		_enable();
		memcpy(targetaddress, Indata, length);
		_disable();
		Cr0 |= 10000;
		__writecr0(Cr0);
		_enable();
		KeUnstackDetachProcess(&kapc);
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		_disable();
		Cr0 |= 10000;
		__writecr0(Cr0);
		_enable();
		KeUnstackDetachProcess(&kapc);
		return FALSE;
	}
	return TRUE;
}