Read Protected program memory with .sys driver c#

0

Sorry i am very newer in this part and i am going to confuse every step ...

I Want to read a protected memory that need to bypass protection to enter. I have a hookdriver.sys file and want to bypass the protection and read How can i connect the hookdrv.sys to my codes and read the protected memory?

Tried run the .sys file in services and using this code Maybe this code is completely wrong because i am very confused

[DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        [DllImport("kernel32.dll")]
        public static extern bool ReadProcessMemory(IntPtr hProcess, UIntPtr lpBaseAddress,
        UIntPtr dwSize, out ulong lpNumberOfBytesRead);
        const uint DELETE = 0x00010000;
        const uint READ_CONTROL = 0x00020000;
        const uint WRITE_DAC = 0x00040000;
        const uint WRITE_OWNER = 0x00080000;
        const uint SYNCHRONIZE = 0x00100000;
        const uint END = 0xFFF; //if you have Windows XP or Windows Server 2003 you must change this to 0xFFFF
        const uint PROCESS_ALL_ACCESS = (DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER | SYNCHRONIZE | END);


        public bool ReadProcessMem(ulong BaseAddress, out byte[] Buffer, int BufferSize, out ulong NumberofBytesRead)
        {

            byte[] buf = new byte[BufferSize];
            bool b = ReadProcessMemory(pInstance, new UIntPtr (BaseAddress), new UIntPtr((uint)buf.Length), out NumberofBytesRead);
            Buffer = buf;
            return b;
        }
c#
kernel
asked on Stack Overflow Mar 26, 2021 by Farhang

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0