Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- bool AddressValidRw(ULONG_PTR address, SIZE_T list_size = 0) {
- typedef struct _MEMORY_WORKING_SET_EX_BLOCK
- {
- union
- {
- struct
- {
- ULONG_PTR Valid : 1;
- ULONG_PTR ShareCount : 3;
- ULONG_PTR Win32Protection : 11;
- ULONG_PTR Shared : 1;
- ULONG_PTR Node : 6;
- ULONG_PTR Locked : 1;
- ULONG_PTR LargePage : 1;
- ULONG_PTR Priority : 3;
- ULONG_PTR Reserved : 3;
- ULONG_PTR SharedOriginal : 1;
- ULONG_PTR Bad : 1;
- ULONG_PTR ReservedUlong : 32;
- };
- struct
- {
- ULONG_PTR Valid : 1;
- ULONG_PTR Reserved0 : 14;
- ULONG_PTR Shared : 1;
- ULONG_PTR Reserved1 : 5;
- ULONG_PTR PageTable : 1;
- ULONG_PTR Location : 2;
- ULONG_PTR Priority : 3;
- ULONG_PTR ModifiedList : 1;
- ULONG_PTR Reserved2 : 2;
- ULONG_PTR SharedOriginal : 1;
- ULONG_PTR Bad : 1;
- ULONG_PTR ReservedUlong : 32;
- } Invalid;
- };
- } MEMORY_WORKING_SET_EX_BLOCK, * PMEMORY_WORKING_SET_EX_BLOCK;
- typedef struct _MEMORY_WORKING_SET_EX_INFORMATION
- {
- PVOID VirtualAddress;
- union
- {
- MEMORY_WORKING_SET_EX_BLOCK VirtualAttributes;
- ULONG_PTR Long;
- } u1;
- } MEMORY_WORKING_SET_EX_INFORMATION, * PMEMORY_WORKING_SET_EX_INFORMATION;
- if (!address)
- return false;
- static CONTEXT drs = { 0 };
- if (!drs.Dr0 || !drs.Dr1 || !drs.Dr2 || !drs.Dr3) {
- if (HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, Global::firstTid)) {
- drs.ContextFlags = CONTEXT_DEBUG_REGISTERS;
- if (!GetThreadContext(hThread, &drs)){
- CloseHandle(hThread);
- return false;
- }
- CloseHandle(hThread);
- }
- else
- return false;
- if (!drs.Dr0 || !drs.Dr1 || !drs.Dr2 || !drs.Dr3)
- return false;
- }
- auto addressInside = [](ULONG_PTR addr) {
- return (addr >= drs.Dr0 && addr < drs.Dr0 + sizeof(ULONG))
- || (addr >= drs.Dr1 && addr < drs.Dr1 + sizeof(ULONG))
- || (addr >= drs.Dr2 && addr < drs.Dr2 + sizeof(ULONG))
- || (addr >= drs.Dr3 && addr < drs.Dr3 + sizeof(ULONG));
- };
- if (addressInside((ULONG_PTR)address)) {
- sp("addressinside trap!!");
- return false;
- }
- MEMORY_WORKING_SET_EX_INFORMATION mwse = { 0 };
- mwse.VirtualAddress = (PVOID)address;
- SIZE_T retLen = 0;
- static PVOID FAddr = nullptr;
- if (!FAddr)
- FAddr = EPtr(GetProcAddress(GetModuleHandleA(E("ntdll.dll")), E("NtQueryVirtualMemory")));
- NTSTATUS status = reinterpret_cast<NTSTATUS(*)(HANDLE, PVOID, ULONGLONG, PVOID, SIZE_T, PSIZE_T)>(EPtr(FAddr))((HANDLE)(-1), (PVOID)address, 4, &mwse, sizeof(mwse), &retLen);
- if (!NT_SUCCESS(status)
- || !mwse.u1.VirtualAttributes.Valid
- || mwse.u1.VirtualAttributes.Bad
- || mwse.u1.VirtualAttributes.Win32Protection != PAGE_READWRITE) {
- sp("trappage!!");
- return false;
- }
- if (list_size) {
- MEMORY_BASIC_INFORMATION mbi = { 0 };
- status = reinterpret_cast<NTSTATUS(*)(HANDLE, PVOID, ULONGLONG, PVOID, SIZE_T, PSIZE_T)>(EPtr(FAddr))((HANDLE)(-1), (PVOID)address, 0, &mbi, sizeof(mbi), &retLen);
- if (!NT_SUCCESS(status)
- || mbi.RegionSize < list_size) {
- sp("dividedlist!!");
- return false;
- }
- }
- return true;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement