MemoryManager.c File Reference

Reading/Writing memory and all memory affairs. More...

#include "pch.h"

Functions
BOOLEAN	MemoryManagerReadProcessMemoryNormal (HANDLE PID, PVOID Address, DEBUGGER_READ_MEMORY_TYPE MemType, PVOID UserBuffer, SIZE_T Size, PSIZE_T ReturnSize)
	Read process memory.

Detailed Description

Reading/Writing memory and all memory affairs.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-24

Copyright

This project is released under the GNU Public License v3.

Function Documentation

MemoryManagerReadProcessMemoryNormal()

BOOLEAN MemoryManagerReadProcessMemoryNormal	(	HANDLE	PID,
		PVOID	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemType,
		PVOID	UserBuffer,
		SIZE_T	Size,
		PSIZE_T	ReturnSize )

Read process memory.

This function should not be called from vmx-root mode

Parameters

PID	Target Process Id
Address	Target Address
MemType	Type of memory
UserBuffer	Buffer to save to the user. This buffer must be in nonpageable memory.
Size	Size of read
ReturnSize	Return Size

Returns

BOOLEAN

{
    PEPROCESS        SourceProcess;
    MM_COPY_ADDRESS  CopyAddress         = {0};
    KAPC_STATE       State               = {0};
    PHYSICAL_ADDRESS TempPhysicalAddress = {0};
 
    //
    // Check if we want another process memory, this way we attach to that process
    // the find the physical address of the memory and read it from here using physical
    // address
 
    //
    // The second thing that we consider here is reading a physical address doesn't
    // need to attach to another process
    //
    if (PsGetCurrentProcessId() != PID && MemType == DEBUGGER_READ_VIRTUAL_ADDRESS)
    {
        //
        // User needs another process memory
        //
 
        if (PsLookupProcessByProcessId(PID, &SourceProcess) != STATUS_SUCCESS)
        {
            //
            // if the process not found
            //
            return FALSE;
        }
        __try
        {
            KeStackAttachProcess(SourceProcess, &State);
 
            //
            // We're in context of another process let's read the memory
            //
            TempPhysicalAddress = MmGetPhysicalAddress(Address);
 
            KeUnstackDetachProcess(&State);
 
            //
            // Now we have to read the physical address
            //
            CopyAddress.PhysicalAddress.QuadPart = TempPhysicalAddress.QuadPart;
            MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_PHYSICAL, ReturnSize);
 
            ObDereferenceObject(SourceProcess);
 
            return TRUE;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            KeUnstackDetachProcess(&State);
 
            ObDereferenceObject(SourceProcess);
 
            return FALSE;
        }
    }
    else
    {
        //
        // Process needs itself memory
        //
        __try
        {
            if (MemType == DEBUGGER_READ_VIRTUAL_ADDRESS)
            {
                CopyAddress.VirtualAddress = Address;
                MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_VIRTUAL, ReturnSize);
            }
            else if (MemType == DEBUGGER_READ_PHYSICAL_ADDRESS)
            {
                //
                // Check whether the physical memory is valid or not
                //
                if (!CheckAddressPhysical((UINT64)Address))
                {
                    return FALSE;
                }
 
                CopyAddress.PhysicalAddress.QuadPart = (LONGLONG)Address;
                MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_PHYSICAL, ReturnSize);
            }
            else
            {
                //
                // Type is not recognized
                //
                return FALSE;
            }
 
            //
            // MmCopyVirtualMemory(SourceProcess, Address, TargetProcess, UserBuffer, Size, KernelMode, ReturnSize);
            // memcpy(UserBuffer, Address, Size);
            //
 
            return TRUE;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            return FALSE;
        }
    }
}