bypassgetmodulebaseaddressandgetexportaddress's Introduction

Bypass GetModuleBaseAddress and GetExportAddress in C#

A proof of concept of real and native custom GetExportAddress (GetProcAddress) and GetModuleBaseAddress (GetModuleHandle) in C#.

This took me so long time to code and find resources about it (mostly old and not working anymore or C++). I decided to write that in C# because I didn't find C# implementation of those functions. Also most of native imports I wrote come from ReactOS code I translated to C# and then tested with ProcessHacker for PEB and Detect It Easy for Image structures.
Works with x86 and x64.

TODO

Some code refractoring & improvements
Some docs or explanations

bypassgetmodulebaseaddressandgetexportaddress's People

Contributors

Stargazers

Watchers

bypassgetmodulebaseaddressandgetexportaddress's Issues

Сonvert

Is it possible to convert this code to c++ ?

when use CreateProcess,it failed with error code 0xf10

Hi ! Here is my code :

[UnmanagedFunctionPointer(CallingConvention.Winapi)]
        public delegate bool Delegate_CreateProcessW(string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);

IntPtr ptrBaseAddres = CustomGetProcAndGetModule.GetExportAddress("kernel32.dll", "CreateProcessW");
Delegate_CreateProcessW D_CreateProcessW = (Delegate_CreateProcessW)Marshal.GetDelegateForFunctionPointer(ptrBaseAddres, typeof(Delegate_CreateProcessW));
retValue = D_CreateProcessW(program, cmd, ref pSec, ref tSec, false, 0x0020, IntPtr.Zero, null, ref s, out p);

and it will failed with error code 0xf10. I cannot find what happend

Recommend Projects