VerifySpoof
Süper Üye
Döngü ntdll.dll sonra oyunun korumalı belleği değiştirebilirsiniz NtWriteVirtualMemory
C++:
char loop[] = { 0xEB, 0xFC };
void* NtWriteVirtualMemory = (BYTE*)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtWriteVirtualMemory") + 0x12;
for (int i = 0; i < 2; ++i)
{
Driver().WriteMem(pids.back(), (ptr_t)NtWriteVirtualMemory + i, 1, (PVOID)loop[i]);
}Driver().WriteMem - remap memory
C++:
DL Mdl = IoAllocateMdl(pCopy->targetPtr, pCopy->size, FALSE, FALSE, NULL);
__try {
// Locking and mapping memory with RW-rights:
//MmProbeAndLockPages(Mdl, KernelMode, IoReadAccess);
MmProbeAndLockProcessPages(Mdl, pProcess, KernelMode, IoReadAccess);
PVOID Mapping = MmMapLockedPagesSpecifyCache(Mdl, KernelMode, MmNonCached, NULL, FALSE, NormalPagePriority);
MmProtectMdlSystemAddress(Mdl, PAGE_READWRITE);
// Write your buffer to mapping:
RtlCopyMemory(Mapping, &pCopy->localbuf, pCopy->size);
// Resources freeing:
MmUnmapLockedPages(Mapping, Mdl);
MmUnlockPages(Mdl);
IoFreeMdl(Mdl);
}
__except (EXCEPTION_EXECUTE_HANDLER) {
IoFreeMdl(Mdl);
return STATUS_ACCESS_DENIED;
}
return STATUS_SUCCESS;
