View difference between Paste ID: rVbpLahs and 8s0jC3aT
SHOW: | | - or go back to the newest paste.
1
using System;
2
using System.Runtime.InteropServices;
3
4
class Program
5
{
6
    [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
7
    public delegate uint Ret1ArgDelegate(uint arg1);
8
9
    [DllImport("kernel32.dll", SetLastError=true)]
10
    static extern IntPtr VirtualAlloc(IntPtr lpAddress, UIntPtr dwSize,
11
                                      AllocationType flAllocationType, MemoryProtection flProtect);
12
                                      
13
    [DllImport("kernel32.dll", SetLastError=true)]
14
    static extern bool VirtualFree(IntPtr lpAddress, UIntPtr dwSize,
15
                                   FreeType freeType);
16
                                   
17
  [Flags]
18
  public enum AllocationType:uint
19
  {
20
    COMMIT=0x1000,
21
    RESERVE=0x2000,
22
    RESET=0x80000,
23
    LARGE_PAGES=0x20000000,
24
    PHYSICAL=0x400000,
25
    TOP_DOWN=0x100000,
26
    WRITE_WATCH=0x200000
27
  }
28
29
  [Flags]
30
  public enum MemoryProtection:uint
31
  {
32
    EXECUTE=0x10,
33
    EXECUTE_READ=0x20,
34
    EXECUTE_READWRITE=0x40,
35
    EXECUTE_WRITECOPY=0x80,
36
    NOACCESS=0x01,
37
    READONLY=0x02,
38
    READWRITE=0x04,
39
    WRITECOPY=0x08,
40
    GUARD_Modifierflag=0x100,
41
    NOCACHE_Modifierflag = 0x200,
42
    WRITECOMBINE_Modifierflag = 0x400
43
  }
44
45
  [Flags]
46
  public enum FreeType:uint
47
  {
48
    DECOMMIT = 0x4000,
49
    RELEASE = 0x8000
50
  }    
51-
    public static byte[] asmBytes = new byte[]
51+
  
52
  public static byte[] asmBytesX86 = new byte[]
53
        {        
54
0x55,             // push ebp
55
0x8B, 0xEC,       // mov ebp, esp 
56
0x8B, 0x45, 0x08, // mov eax, [ebp+8]
57
0xD1, 0xC8,       // ror eax, 1
58
0x5D,             // pop ebp 
59
0xC3              // ret
60
        };
61-
    static void Main(string[] args)
61+
62-
    {
62+
  public static byte[] asmBytesX64 = new byte[]
63
        {        
64
0x89, 0xC8,       // mov rax, rcx 
65
0xD1, 0xC8,       // ror eax, 1
66
0xC3              // ret
67
        };
68
        
69
  static void Main(string[] args)
70
  {
71
    	byte[] asmBytes = (IntPtr.Size == 4)?asmBytesX86:asmBytesX64;
72
    	IntPtr executableMemory = VirtualAlloc(IntPtr.Zero, (UIntPtr) asmBytes.Length, AllocationType.COMMIT, MemoryProtection.EXECUTE_READWRITE);
73
    	Marshal.Copy(asmBytes, 0, executableMemory, asmBytes.Length);
74
        Ret1ArgDelegate del = (Ret1ArgDelegate) Marshal.GetDelegateForFunctionPointer (executableMemory, typeof(Ret1ArgDelegate));
75
	
76
        uint n = (uint)0xFFFFFFFC;
77
        n = del(n);
78
        Console.WriteLine("{0:x}", n);
79
         
80
        VirtualFree(executableMemory, UIntPtr.Zero, FreeType.DECOMMIT);
81
    }
82
}