if (!NT_SUCCESS(PsLookupProcessByProcessId(PID, &Process)))
{
DPRINT("[MuQ]AttachFail \n");
break;
}
DPRINT("Tring to attach the process \n");
KeStackAttachProcess(Process, &pKs);
if(MmIsAddressValid(rStruct->TargetAddress))
{
DPRINT("Allocating MDL \n");
Mysleep(1500);
pMdl = IoAllocateMdl(rStruct->TargetAddress, rStruct->WriteSize, FALSE, FALSE, NULL);
if(pMdl)
{
DPRINT("MmProbeAndLockPages \n");
Mysleep(1500);
MmProbeAndLockPages(pMdl, KernelMode, IoReadAccess);
DPRINT("Mapping MDL \n");
PVOID Mapping = MmMapLockedPagesSpecifyCache(pMdl, KernelMode, MmNonCached, NULL, FALSE, NormalPagePriority);
if(MmIsAddressValid(Mapping))
{
DPRINT(" MDL Map Success: %X \n", Mapping);
Mysleep(1500);
MmProtectMdlSystemAddress(pMdl, PAGE_READWRITE);
DPRINT("Trying to Copy Memory \n");
Mysleep(1500);
__try
{
memcpy(Mapping,rStruct->WriteBuffer,rStruct->WriteSize);
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
KeUnstackDetachProcess(&pKs);
break;
}
}
else { DPRINT("Address Not Valid 1\n"); }
MmUnmapLockedPages(Mapping, pMdl);
IoFreeMdl(pMdl);
}
else { DPRINT("MDL Allocate Failed \n"); }
}
else { DPRINT("Address Not Valid 0\n"); }
KeUnstackDetachProcess(&pKs);
ObDereferenceObject(Process);
break;
}