winapi 리스트

VirtualAlloc - Allocate memory on current process

MSDN

PInvoke.net

시그니쳐

LPVOID VirtualAlloc(
  LPVOID lpAddress,
  SIZE_T dwSize,
  DWORD flAllocationType,
  DWORD flProtect
);

파라미터

• lpAddress - Address of the memory to be allocated

  • 0 = API chooses the location automatically

• dwSize - Size of the allocation

• flAllocationType - Memory allocation type

  • Usually MEM_COMMIT | MEM_RESERVE = 0x3000

• flProtect = Memory Protection constants - link

  • 0x20 = RX

  • 0x40 = RWX

  • 0x04 = RW

VirtualAllocEx - Allocate memory on a remote process

MSDN

PInvoke.net

시그니쳐

LPVOID VirtualAllocEx(
  HANDLE hProcess,
  LPVOID lpAddress,
  SIZE_T dwSize,
  DWORD flAllocationType,
  DWORD flProtect
);

파라미터

• hProcess - Target process's handle

• lpAddress - Start address to allocate the memory

  • 0 = VirtualAllocEx automatically chooses the starting address for us (checkout DripLoader)

• dwSize - Length/Amount of memory to allocate

• flAllocationType - Typo of memory allocation. Usually MEM_COMMIT | MEM_RESERVE = 0x3000

• flProtect = Memory Protection constants - link

  • 0x20 = RX

  • 0x40 = RWX

  • 0x04 = RW

OpenProcess - Retrieve a handle to a remote process based on PID

MSDN

PInvoke.net

시그니쳐

HANDLE OpenProcess(
  DWORD dwDesiredAccess,
  BOOL bInheritHandle,
  DWORD dwProcessId
);

파라미터

• dwDesiredAccess - Access right to obtain in target process. Usually PROCESS_ALL_ACCESS (0x001F0FF)

• bInheritHandle - True/False on whether the handle can be inherited to child process or not. Usually False, because we just don't care.

• dwProcessId - Target process's PID

VirtualProtect - Change memory protection

MSDN

PInvoke.net

시그니쳐

BOOL VirtualProtect(
 LPVOID lpAddress,
 SIZE_T dwSize,
 DWORD flNewProtect,
 PDWORD lpflOldProtect
);

파라미터

• lpAddress - Pointer to the start of the memory address

• dwSize - Size of the memory to change the protection, in bytes.

  • Usually lpAddress + dwSize, or the shellcode's length

• flNewProtect - Memory protection constant

• lpflOldProtect - Pointer to a variable with current memory protection. Usually just 0.

VirtualProtectEx - Change memory protection of a remote process

VirtualAlloc

MSDN

PInvoke.net

시그니쳐

파라미터

• a

• b

---

VirtualAlloc

MSDN

PInvoke.net

시그니쳐

파라미터

• a

• b

---

VirtualAlloc

MSDN

PInvoke.net

시그니쳐

파라미터

• a

• b

---