mempage_data.cpp

Go to the documentation of this file.

#include "mempage_data.h"
#include "module_data.h"
#include "../utils/process_util.h"
 
using namespace pesieve;
 
bool pesieve::MemPageData::fillInfo()
{
    MEMORY_BASIC_INFORMATION page_info = { 0 };
    SIZE_T out = VirtualQueryEx(this->processHandle, (LPCVOID) start_va, &page_info, sizeof(page_info));
    if (out != sizeof(page_info)) {
        if (GetLastError() == ERROR_INVALID_PARAMETER) {
            return false;
        }
#ifdef _DEBUG
        std::cout << "Could not query page: " << std::hex << start_va << ". Error: " << GetLastError() << std::endl;
#endif
        return false;
    }
    initial_protect = page_info.AllocationProtect;
    mapping_type = page_info.Type;
    protection = page_info.Protect;
    alloc_base = (ULONGLONG) page_info.AllocationBase;
    region_start = (ULONGLONG) page_info.BaseAddress;
    region_end = region_start + page_info.RegionSize;
    is_info_filled = true;
    return true;
}
 
bool pesieve::MemPageData::loadModuleName()
{
    const HMODULE mod_base = (HMODULE)this->alloc_base;
    std::string module_name = RemoteModuleData::getModuleName(processHandle, mod_base);
    if (module_name.length() == 0) {
#ifdef _DEBUG
        std::cerr << "Could not retrieve module name" << std::endl;
#endif
        return false;
    }
    this->module_name = module_name;
    return true;
}
 
bool pesieve::MemPageData::loadMappedName()
{
    if (!isInfoFilled() && !fillInfo()) {
        return false;
    }
    std::string mapped_filename = RemoteModuleData::getMappedName(this->processHandle, (HMODULE)this->alloc_base);
    if (mapped_filename.length() == 0) {
#ifdef _DEBUG
        std::cerr << "Could not retrieve name" << std::endl;
#endif
        return false;
    }
    this->mapped_name = mapped_filename;
    return true;
}
 
bool pesieve::MemPageData::isRealMapping()
{
    if (!loadMappedName()) {
#ifdef _DEBUG
        std::cerr << "Could not retrieve name" << std::endl;
#endif
        return false;
    }
    PVOID old_val = nullptr;
    util::wow64_disable_fs_redirection(&old_val);
    HANDLE file = CreateFileA(this->mapped_name.c_str(), GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
    util::wow64_revert_fs_redirection(old_val);
    if(file == INVALID_HANDLE_VALUE) {
#ifdef _DEBUG
        std::cerr << "Could not open file!" << std::endl;
#endif
        return false;
    }
    HANDLE mapping = CreateFileMapping(file, 0, PAGE_READONLY, 0, 0, 0);
    if (!mapping) {
#ifdef _DEBUG
        std::cerr << "Could not create mapping!" << std::endl;
#endif
        CloseHandle(file);
        return false;
    }
    BYTE *rawData = (BYTE*) MapViewOfFile(mapping, FILE_MAP_READ, 0, 0, 0);
    if (rawData == nullptr) {
#ifdef _DEBUG
        std::cerr << "Could not map view of file: " << this->mapped_name << std::endl;
#endif
        CloseHandle(mapping);
        CloseHandle(file);
        return false;
    }
 
    bool is_same = false;
    if (this->load()) {
        size_t r_size = GetFileSize(file, 0);
        is_same = this->loadedData.isDataContained(rawData, r_size);
    }
    else {
#ifdef _DEBUG
        std::cerr << "[" << std::hex << start_va << "] Page not loaded!" << std::endl;
#endif
    }
    UnmapViewOfFile(rawData);
    CloseHandle(mapping);
    CloseHandle(file);
    return is_same;
}
 
bool pesieve::MemPageData::_loadRemote()
{
    _freeRemote();
    size_t region_size = size_t(this->region_end - this->start_va);
    if (stop_va && ( stop_va >= start_va  && stop_va < this->region_end)) {
        region_size = size_t(this->stop_va - this->start_va);
    }
    
    if (region_size == 0) {
        return false;
    }
    if (!loadedData.allocBuffer(region_size)) {
        return false;
    }
    const bool can_force_access = is_process_refl ? true : false;
    const size_t size_read = peconv::read_remote_region(this->processHandle, (BYTE*)this->start_va, loadedData.data, loadedData.getDataSize(), can_force_access);
    if (size_read == 0) {
        _freeRemote();
#ifdef _DEBUG
        std::cerr << "Cannot read remote memory!" << std::endl;
#endif
        return false;
    }
    loadedData.trim();
    return true;
}