//写内存
VOID KeWriteProcessMemory(PEPROCESS Process, unsigned char* WriteBuff, PVOID TargetAddress, SIZE_T Size)
{
//在进入进程地址空间之前先赋值
unsigned char* GetData;
__try
{
GetData = ExAllocatePool(PagedPool, Size);
}
__except (1)
{
DbgPrint("内存分配失败");
return;
}
for (int i = 0; i < Size; i++)
{
GetData[i] = WriteBuff[i];
}
KAPC_STATE stack = { 0 };
KeStackAttachProcess(Process, &stack);
ULONG uOldProtect = 0;
ZwProtectVirtualMemory(NtCurrentProcess(), &TargetAddress, &Size, PAGE_EXECUTE_READWRITE, &uOldProtect);
PMDL mdl = IoAllocateMdl(TargetAddress, Size, 0, 0, NULL);
if (mdl == NULL)
{
DbgPrint("创建MDL失败");
return;
}
MmBuildMdlForNonPagedPool(mdl);
unsigned char* ChangeData = NULL;
__try
{
ChangeData = MmMapLockedPages(mdl, KernelMode);
RtlCopyMemory(ChangeData, GetData, Size);
}
__except (1)
{
DbgPrint("内存映射失败,%d", sizeof(ChangeData));
goto END;
}
ZwProtectVirtualMemory(NtCurrentProcess(), &TargetAddress, &Size, uOldProtect, 0);
END:
IoFreeMdl(mdl);
ExFreePool(GetData);
KeUnstackDetachProcess(&stack);
ObDereferenceObject(Process);
}
