Giter VIP home page Giter VIP logo

wow64pp's Introduction

wow64pp

An easy to use header only heavens gate implementation based on wow64ext X64Call however not using inline assembly allowing it to work on other compilers like MinGW.

Quick reference

Wow64pp only exposes 3 functions 2 of which have exception based and error_code based counterparts.

#include "wow64pp.hpp"
// ...

// equivalent of GetModuleHandle
auto x64_ntdll_handle = wow64pp::module_handle("ntdll.dll"); 
// or wow64pp::module_handle("ntdll.dll", error_code);

// equivalent of GetProcAddress
auto x64_NtQueryVirtualMemory = wow64pp::import(x64_ntdll_handle, "NtQueryVirtualMemory"); 
// or wow64pp::import(x64_ntdll_handle, "NtQueryVirtualMemory", error_code);

// after getting the function address you can call it using wow64pp::call_function by passing its address
// as the first argument, with the function arguments following.
winapi::MEMORY_BASIC_INFORMATION64 memory_info;
std::uint64_t result_len;
auto ec = wow64pp::call_function(x64_NtQueryVirtualMemory, process_handle, address
				, 0, &memory_info, sizeof(memory_info), &result_len);

wow64pp's People

Contributors

justasmasiulis avatar stevemk14ebr avatar vmcall avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar

wow64pp's Issues

Memory leak on call_function

Hello, I found a memory leak on this line, whenever call_function is called it's allocate a new page, is missing an if or make the call after the declaration of the variable allocated_shellcode.

Fix:

static void* allocated_shellcode = nullptr;

if ( !allocated_shellcode )
{
    // MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE
    allocated_shellcode =
        VirtualAlloc(nullptr, sizeof( shellcode ), 0x00001000 | 0x00002000, 0x40);

    if ( !allocated_shellcode )
        detail::throw_last_error( 
        "VirtualAlloc failed to allocate memory for call_function shellcode" );
}

Alternative fix:

static void* allocated_shellcode = VirtualAlloc(nullptr, sizeof(shellcode), 0x00001000 | 0x00002000, 0x40);

Included in new project, redefinition errors.

Hey,
After including in new project, I get "GetModuleHandleA" redefinition errors.
Error codes C2371,C2733.
I solved it somehow in my other project but can't remember how.
Any ideas?

Some problems with dlls other than ntdll.dll

Hey,
Could you provide some info about hooking dlls other than ntdll.dll?
I used this lib in my other project(compiled in VS19), but now doing:
auto x64_ntdll_handle = wow64pp::module_handle("Kernel32.dll");
Return error that the library could not be loaded.
Any idea why?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.