![]() |
RAMvader
1.3
A C# library which provides access to other processes' memory space.
|
This class represents the artifacts that can be added to a code cave. Artifacts may include: byte sequences, addresses of injected variables, assembly instructions, etc. Futurely, new kinds of artifacts might be created for making the process of building of code caves easier, more flexible and more powerful. During the injection process, the CodeInjection.Injector<TMemoryAlterationSetID, TCodeCave, TVariable> will use the artifacts of each code cave to build the byte codes of each one of the code caves that need to be injected. More...
Inherited by RAMvader.CodeInjection.CodeCaveArtifactCodeCaveAddress< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactSignedBytesSequence< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactUnsignedBytesSequence< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactVariableAddress< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactX86Call< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactX86FarJump< TMemoryAlterationSetID, TCodeCave, TVariable >, and RAMvader.CodeInjection.CodeCaveArtifactX86NearJump< TMemoryAlterationSetID, TCodeCave, TVariable >.
Public Member Functions | |
void | LockWithInjector (Injector< TMemoryAlterationSetID, TCodeCave, TVariable > injectorRef) |
Injector< TMemoryAlterationSetID, TCodeCave, TVariable > | GetLockingInjector () |
Retrieves the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> instance that is currently locking this object, during an injection procedure. More... | |
void | ReleaseFromInjector () |
Releases this instance from the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> that is currently using it. During the injection process, the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> that needs to use a CodeCaveArtifact<TMemoryAlterationSetID, TCodeCave, TVariable> locks it for its own use, and after the injection it releases it by calling this method, allowing other Injector<TMemoryAlterationSetID, TCodeCave, TVariable>s to lock and use this instance. More... | |
abstract byte [] | GenerateArtifactBytes () |
Generates the bytes which correspond to the artifact instance. These bytes are the ones to be actually written to the target process' memory space by the CodeInjection.Injector<TMemoryAlterationSetID, TCodeCave, TVariable> during the injection procedure. More... | |
abstract int | GetTotalSize (RAMvaderTarget target) |
Retrieves the total size of a given artifact, in bytes. More... | |
This class represents the artifacts that can be added to a code cave. Artifacts may include: byte sequences, addresses of injected variables, assembly instructions, etc. Futurely, new kinds of artifacts might be created for making the process of building of code caves easier, more flexible and more powerful. During the injection process, the CodeInjection.Injector<TMemoryAlterationSetID, TCodeCave, TVariable> will use the artifacts of each code cave to build the byte codes of each one of the code caves that need to be injected.
|
pure virtual |
Generates the bytes which correspond to the artifact instance. These bytes are the ones to be actually written to the target process' memory space by the CodeInjection.Injector<TMemoryAlterationSetID, TCodeCave, TVariable> during the injection procedure.
Implemented in RAMvader.CodeInjection.CodeCaveArtifactX86FarJump< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactX86NearJump< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactSignedBytesSequence< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactX86Call< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactCodeCaveAddress< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactUnsignedBytesSequence< TMemoryAlterationSetID, TCodeCave, TVariable >, and RAMvader.CodeInjection.CodeCaveArtifactVariableAddress< TMemoryAlterationSetID, TCodeCave, TVariable >.
Injector<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.CodeCaveArtifact< TMemoryAlterationSetID, TCodeCave, TVariable >.GetLockingInjector | ( | ) |
Retrieves the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> instance that is currently locking this object, during an injection procedure.
|
pure virtual |
Retrieves the total size of a given artifact, in bytes.
target | The instance of RAMvaderTarget that is setup to access the target process' memory space. This instance is used to know properties of the target process, such as its pointers size. |
Implemented in RAMvader.CodeInjection.CodeCaveArtifactX86FarJump< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactX86NearJump< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactX86Call< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactSignedBytesSequence< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactCodeCaveAddress< TMemoryAlterationSetID, TCodeCave, TVariable >, RAMvader.CodeInjection.CodeCaveArtifactVariableAddress< TMemoryAlterationSetID, TCodeCave, TVariable >, and RAMvader.CodeInjection.CodeCaveArtifactUnsignedBytesSequence< TMemoryAlterationSetID, TCodeCave, TVariable >.
void RAMvader.CodeInjection.CodeCaveArtifact< TMemoryAlterationSetID, TCodeCave, TVariable >.LockWithInjector | ( | Injector< TMemoryAlterationSetID, TCodeCave, TVariable > | injectorRef | ) |
Sets the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> instance which is currently using the CodeCaveArtifact<TMemoryAlterationSetID, TCodeCave, TVariable> instance. This method should be called only by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>, during the injection process.
ATTENTION: This method is currently NOT thread safe.
injectorRef | A reference to the injector wich will be using this instance. |
InvalidOperationException | Thrown when this instance is already locked by an Injector<TMemoryAlterationSetID, TCodeCave, TVariable>, which hasn't called ReleaseFromInjector yet in order to release the instance to be used by another Injector<TMemoryAlterationSetID, TCodeCave, TVariable>. |
void RAMvader.CodeInjection.CodeCaveArtifact< TMemoryAlterationSetID, TCodeCave, TVariable >.ReleaseFromInjector | ( | ) |
Releases this instance from the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> that is currently using it. During the injection process, the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> that needs to use a CodeCaveArtifact<TMemoryAlterationSetID, TCodeCave, TVariable> locks it for its own use, and after the injection it releases it by calling this method, allowing other Injector<TMemoryAlterationSetID, TCodeCave, TVariable>s to lock and use this instance.
InvalidOperationException | Thrown when there are currently no Injector<TMemoryAlterationSetID, TCodeCave, TVariable> instance locking the object. |