龙马谷论坛 › 驱动开发技术 › 内核下对进程只读内存的安全写入方法SafeCopyMemory

百鬼夜行天 发表于 2021-5-5 13:55:30

内核下对进程只读内存的安全写入方法SafeCopyMemory

内核下对进程只读内存的安全写入方法SafeCopyMemory

测试过了,好用.

BOOLEAN SafeCopyMemory(PVOID pDestination, PVOID pSourceAddress, SIZE_T SizeOfCopy)
{
   PMDL pMdl = NULL;
   PVOID pSafeAddress = NULL;
   if (!MmIsAddressValid(pDestination) || !MmIsAddressValid(pSourceAddress))
         return FALSE;
   pMdl = IoAllocateMdl(pDestination, (ULONG)SizeOfCopy, FALSE, FALSE, NULL);
   if (!pMdl)
         return FALSE;
   __try
   {
         MmProbeAndLockPages(pMdl, KernelMode, IoReadAccess);
   }
   __except (EXCEPTION_EXECUTE_HANDLER)
   {
         IoFreeMdl(pMdl);
         return FALSE;
   }
   pSafeAddress = MmGetSystemAddressForMdlSafe(pMdl, NormalPagePriority);
   if (!pSafeAddress)
         return FALSE;
   __try
   {
         RtlMoveMemory(pSafeAddress, pSourceAddress, SizeOfCopy);
   }
   __except (EXCEPTION_EXECUTE_HANDLER)
   {
         ;
   }
   MmUnlockPages(pMdl);
   IoFreeMdl(pMdl);
   return TRUE;
}

void Test()
{
   PVOID HookCode = ExAllocatePool(NonPagedPool, 0x200);
   RtlFillMemory(HookCode, 0x200, 0x90);
   RtlMoveMemory(HookCode, NtOpenProcess, 0x3);
   SafeCopyMemory(NtOpenProcess, HookCode, 0x3);
}

查看完整版本: 内核下对进程只读内存的安全写入方法SafeCopyMemory