我試圖修補戈朗的一大塊內存。我已關閉虛擬保護功能，并且內存塊正在更改為 RW，但我找不到用于復制到內存的 Golang 功能。我想從強勢外殼腳本中模擬這一點：[System.Runtime.InteropServices.Marshal]::Copy($patch, 0, $targetedAddress, 3)我目前擁有的戈朗代碼如下：var patch = []byte { 0x31, 0xC0, // xor rax, rax 0xC3, // ret}var oldfperms uint32virtualProt(unsafe.Pointer(&patchAddr), unsafe.Sizeof(uintptr(2)), uint32(0x40), unsafe.Pointer(&oldfperms)) // Modify region for ReadWritevar r uintptrfor _, b := range patch { r = (r << 8) | uintptr(b)}patch := unsafe.Pointer(uintptr(r)) // Attempting to copy into memory here and I'm stumpedfmt.Println(patch)var a uint32virtualProt(unsafe.Pointer(&patchAddr), unsafe.Sizeof(uintptr(2)), oldfperms, unsafe.Pointer(&a)) // Change region back to normal
1 回答
青春有我
TA貢獻1784條經驗 獲得超8個贊
沒關系。找到對 Win32 寫入過程內存函數的引用并使用該函數。
https://pkg.go.dev/github.com/0xrawsec/golang-win32/win32/kernel32#WriteProcessMemory
func WriteProcMem(currProccess uintptr, patchAddr uintptr, patch uintptr) bool {
kern32WriteMem := syscall.NewLazyDLL("kernel32.dll").NewProc("WriteProcessMemory")
_, _, _ = kern32WriteMem.Call(
currProccess,
patchAddr,
patch)
fmt.Println("[+] Patched Memory!")
return true
}
- 1 回答
- 0 關注
- 100 瀏覽
添加回答
舉報
0/150
提交
取消