ed/raddebugger
1
0
Fork 0
mirror of https://github.com/Ed94/raddebugger.git synced 2026-08-04 21:08:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

pass over logging, include a lot of extra info in ctrl thread log; demon abstraction for target-process memory allocation/protection; switch spoofs to being in allocated page, rather than at bogus address

Browse Source
This commit is contained in:
Ryan Fleury
2024-06-19 11:12:21 -07:00
parent f6eec680bc
commit 376a7c48a5
13 changed files with 315 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/demon/demon_core.h
+5
View File
@@ -217,6 +217,11 @@ internal void dmn_access_close(void);
#define DMN_AccessScope DeferLoopChecked(dmn_access_open(), dmn_access_close())
//- rjf: processes
internal U64 dmn_process_memory_reserve(DMN_Handle process, U64 vaddr, U64 size);
internal void dmn_process_memory_commit(DMN_Handle process, U64 vaddr, U64 size);
internal void dmn_process_memory_decommit(DMN_Handle process, U64 vaddr, U64 size);
internal void dmn_process_memory_release(DMN_Handle process, U64 vaddr, U64 size);
internal void dmn_process_memory_protect(DMN_Handle process, U64 vaddr, U64 size, OS_AccessFlags flags);
internal U64 dmn_process_read(DMN_Handle process, Rng1U64 range, void *dst);
internal B32 dmn_process_write(DMN_Handle process, Rng1U64 range, void *src);
#define dmn_process_read_struct(process, vaddr, ptr) dmn_process_read((process), r1u64((vaddr), (vaddr)+(sizeof(*ptr))), ptr)
src/demon/win32/demon_core_win32.c
+67
View File
@@ -2581,6 +2581,73 @@ dmn_access_close(void)
//- rjf: processes
internal U64
dmn_process_memory_reserve(DMN_Handle process, U64 vaddr, U64 size)
{
U64 result = 0;
DMN_AccessScope
{
DMN_W32_Entity *process_entity = dmn_w32_entity_from_handle(process);
result = (U64)VirtualAllocEx(process_entity->handle, (void *)vaddr, size, MEM_RESERVE, PAGE_READWRITE);
if(result == 0)
{
result = (U64)VirtualAllocEx(process_entity->handle, 0, size, MEM_RESERVE, PAGE_READWRITE);
}
}
return result;
}
internal void
dmn_process_memory_commit(DMN_Handle process, U64 vaddr, U64 size)
{
DMN_AccessScope
{
DMN_W32_Entity *process_entity = dmn_w32_entity_from_handle(process);
(U64)VirtualAllocEx(process_entity->handle, (void *)vaddr, size, MEM_COMMIT, PAGE_READWRITE);
}
}
internal void
dmn_process_memory_decommit(DMN_Handle process, U64 vaddr, U64 size)
{
DMN_AccessScope
{
DMN_W32_Entity *process_entity = dmn_w32_entity_from_handle(process);
VirtualFreeEx(process_entity->handle, (void *)vaddr, size, MEM_DECOMMIT);
}
}
internal void
dmn_process_memory_release(DMN_Handle process, U64 vaddr, U64 size)
{
DMN_AccessScope
{
DMN_W32_Entity *process_entity = dmn_w32_entity_from_handle(process);
VirtualFreeEx(process_entity->handle, (void *)vaddr, 0, MEM_RELEASE);
}
}
internal void
dmn_process_memory_protect(DMN_Handle process, U64 vaddr, U64 size, OS_AccessFlags flags)
{
DMN_AccessScope
{
DMN_W32_Entity *process_entity = dmn_w32_entity_from_handle(process);
DWORD old_flags = 0;
DWORD new_flags = PAGE_NOACCESS;
switch(flags)
{
default:{}break;
case OS_AccessFlag_Execute:{new_flags = PAGE_EXECUTE;}break;
case OS_AccessFlag_Execute|OS_AccessFlag_Read:{new_flags = PAGE_EXECUTE_READ;}break;
case OS_AccessFlag_Execute|OS_AccessFlag_Read|OS_AccessFlag_Write:{new_flags = PAGE_EXECUTE_READWRITE;}break;
case OS_AccessFlag_Read:{new_flags = PAGE_READONLY;}break;
case OS_AccessFlag_Read|OS_AccessFlag_Write:{new_flags = PAGE_READWRITE;}break;
}
VirtualProtectEx(process_entity->handle, (void *)vaddr, size, new_flags, &old_flags);
}
}
internal U64
dmn_process_read(DMN_Handle process, Rng1U64 range, void *dst)
{