-
Notifications
You must be signed in to change notification settings - Fork 18
Expand file tree
/
Copy pathfileMap.cpp
More file actions
114 lines (109 loc) · 3.37 KB
/
Copy pathfileMap.cpp
File metadata and controls
114 lines (109 loc) · 3.37 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
//////////////////////////////////////////////////////////////////////////
// File map to memory to pass SSDT hook
#include "../basic_fun.h"
static T_status LoadFileAsMemory(HANDLE hFile,PBLPP_MAP_FILE_STRUCT pMapFile,T_bool bToWrite)
{
HANDLE hMapping;
LPVOID ImageBase;
LARGE_INTEGER Size;
if (INVALID_HANDLE_VALUE == hFile)
{
DWORD LastErr = GetLastError();
if (ERROR_FILE_NOT_FOUND == LastErr ||
ERROR_PATH_NOT_FOUND == LastErr)
{
return T_STATUS_NOT_FOUND;
}
return T_STATUS_ACCESS_DENIED;
}
if (!GetFileSizeEx(hFile,&Size))
{
CloseHandle(hFile);
return T_STATUS_ACCESS_DENIED;
}
pMapFile->FileSize = Size;
hMapping = CreateFileMapping
(hFile,NULL,
bToWrite?(PAGE_READWRITE):(PAGE_READONLY),
0,0,NULL);
if(NULL == hMapping)
{
CloseHandle(hFile);
return T_STATUS_ACCESS_DENIED;
}
ImageBase = MapViewOfFile
(hMapping,
bToWrite?(FILE_MAP_READ|FILE_MAP_WRITE):(FILE_MAP_READ),
0,0,0);
if(NULL == ImageBase)
{
CloseHandle(hMapping);
CloseHandle(hFile);
return T_STATUS_ACCESS_DENIED;
}
pMapFile->hFile = hFile;
pMapFile->hMapping = hMapping;
pMapFile->ImageBase = ImageBase;
return T_STATUS_SUCCESS;
}
T_status blpp_fs_LoadFileAsMemoryA(PCT_str lpFilename,PBLPP_MAP_FILE_STRUCT pMapFile,T_bool bToWrite,T_bool bUseBypass)
{
HANDLE hFile;
if (bUseBypass)
{
hFile = blpp_fs_CreateFileBypassA
(lpFilename,
bToWrite?(GENERIC_READ|GENERIC_WRITE):(GENERIC_READ),
bToWrite?(FILE_SHARE_READ|FILE_SHARE_WRITE):(FILE_SHARE_READ),
OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL);
}
else
{
hFile = CreateFileA
(lpFilename,
bToWrite?(GENERIC_READ|GENERIC_WRITE):(GENERIC_READ),
bToWrite?(FILE_SHARE_READ|FILE_SHARE_WRITE):(FILE_SHARE_READ),
NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
}
return LoadFileAsMemory(hFile,pMapFile,bToWrite);
}
T_status blpp_fs_LoadFileAsMemoryW(PCT_wstr lpFilename,PBLPP_MAP_FILE_STRUCT pMapFile,T_bool bToWrite,T_bool bUseBypass)
{
HANDLE hFile;
if (bUseBypass)
{
hFile = blpp_fs_CreateFileBypassW
(lpFilename,
bToWrite?(GENERIC_READ|GENERIC_WRITE):(GENERIC_READ),
bToWrite?(FILE_SHARE_READ|FILE_SHARE_WRITE):(FILE_SHARE_READ),
OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL);
}
else
{
hFile = CreateFileW
(lpFilename,
bToWrite?(GENERIC_READ|GENERIC_WRITE):(GENERIC_READ),
bToWrite?(FILE_SHARE_READ|FILE_SHARE_WRITE):(FILE_SHARE_READ),
NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
}
return LoadFileAsMemory(hFile,pMapFile,bToWrite);
}
T_void blpp_fs_UnLoadFileMemory(PBLPP_MAP_FILE_STRUCT pMapFile)
{
if(pMapFile->ImageBase)
{
UnmapViewOfFile(pMapFile->ImageBase);
pMapFile->ImageBase = NULL;
}
if(pMapFile->hMapping)
{
CloseHandle(pMapFile->hMapping);
pMapFile->hMapping = NULL;
}
if(pMapFile->hFile)
{
CloseHandle(pMapFile->hFile);
pMapFile->hFile = NULL;
}
pMapFile->FileSize.QuadPart = 0;
}