内核下对进程只读内存的安全写入方法SafeCopyMemory

百鬼夜行天

内核下对进程只读内存的安全写入方法SafeCopyMemory

测试过了,好用.

1. BOOLEAN SafeCopyMemory(PVOID pDestination, PVOID pSourceAddress, SIZE_T SizeOfCopy)
   
2. {
   
3.      PMDL pMdl = NULL;
   
4.      PVOID pSafeAddress = NULL;
   
5.      if (!MmIsAddressValid(pDestination) || !MmIsAddressValid(pSourceAddress))
   
6.          return FALSE;
   
7.      pMdl = IoAllocateMdl(pDestination, (ULONG)SizeOfCopy, FALSE, FALSE, NULL);
   
8.      if (!pMdl)
   
9.          return FALSE;
   
10.      __try
    
11.      {
    
12.          MmProbeAndLockPages(pMdl, KernelMode, IoReadAccess);
    
13.      }
    
14.      __except (EXCEPTION_EXECUTE_HANDLER)
    
15.      {
    
16.          IoFreeMdl(pMdl);
    
17.          return FALSE;
    
18.      }
    
19.      pSafeAddress = MmGetSystemAddressForMdlSafe(pMdl, NormalPagePriority);
    
20.      if (!pSafeAddress)
    
21.          return FALSE;
    
22.      __try
    
23.      {
    
24.          RtlMoveMemory(pSafeAddress, pSourceAddress, SizeOfCopy);
    
25.      }
    
26.      __except (EXCEPTION_EXECUTE_HANDLER)
    
27.      {
    
28.          ;
    
29.      }
    
30.      MmUnlockPages(pMdl);
    
31.      IoFreeMdl(pMdl);
    
32.      return TRUE;
    
33. }
    
34. 
    
35. void Test()
    
36. {
    
37.      PVOID HookCode = ExAllocatePool(NonPagedPool, 0x200);
    
38.      RtlFillMemory(HookCode, 0x200, 0x90);
    
39.      RtlMoveMemory(HookCode, NtOpenProcess, 0x3);
    
40.      SafeCopyMemory(NtOpenProcess, HookCode, 0x3);
    
41. }

复制代码