VirtualAlloc about memprocfs HOT 3 CLOSED

VirtualAlloc inside a process is not possible right now.

Also, I really doubt that I'll be able to add this feature in a stable manner; the memory manager structures may change much faster than I'm able to tamper with them via DMA; making the whole thing very unstable.

The way to go around this is most likely to temporarily insert some kind of shellcode snippet inside the process doing the actual VirtualAlloc,; but thats not really what MemProcFS is about right now.

I might add more offensive features like that in the future to MemProcFS; or if you prefer to use the API for it you could probably code a small program doing exactly that already. But now MemProcFS is a memory analysis library (i.e. no functionality for active exploitation built-in by default).

from memprocfs.

I see, would something like this work for MemProcFS?

void* AllocateProcessMemory(unsigned __int32 ProcessId, unsigned __int64 Size)
{
	PEPROCESS TargetProcess = nullptr;
 
	if (!NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)ProcessId, &TargetProcess)))
		return (void*)-1;
 
	KeAttachProcess((PKPROCESS)TargetProcess);
 
 
	void* NewAllocation = 0;
	unsigned __int64 NewAllocationSize = Size;
	ZwAllocateVirtualMemory(NtCurrentProcess(), &NewAllocation, 0, &NewAllocationSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
 
	KeDetachProcess();
	ObDereferenceObject(TargetProcess);
 
	return (void*)NewAllocation;
}

from memprocfs.

Problem is that MemProcFS analyzes the memory of a target system; pretty much in real time yes; but it does not run on the target system. It does not have code execution on the target system. I therefore cannot execute in the target systems kernel context.

Now, I have kernel modules and such for PCILeech which is more focusing on the offensive side that executes in the target system kernel. But PCILeech is a different product from MemProcFS.

Right now I'm not very likely to add it to MemProcFS in the short run, maybe in the future, but that would require substantial changes from my side to accommodate this.

from memprocfs.