Implements the logic behind the injection of code caves and variables into a target process' memory space. More...

Inherits RAMvader.NotifyPropertyChangedAdapter.

Public Member Functions
	Injector ()
	Constructor. The constructor of the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> class checks the code caves and variables for consistency, throwing an exception if there is any error found. More...

void	SetTargetProcess (RAMvaderTarget targetProc)
	Initializes or modifies the reference to the object used by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to perform write operations to the target process' memory. The Injector<TMemoryAlterationSetID, TCodeCave, TVariable> also uses this object to know the endianness and pointer size of the target process. More...

RAMvaderTarget	GetTargetProcess ()
	Retrieves the current reference to the object used by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to perform write operations to the target process' memory. The Injector<TMemoryAlterationSetID, TCodeCave, TVariable> also uses this object to know the endianness and pointer size of the target process. More...

void	SetCodeCavesSeparationBytes (byte[] byteSeq)
	Modifies the sequence of bytes used to separate two consecutive code caves. More...

byte []	GetCodeCavesSeparationBytes ()
	Retrieves the sequence of bytes used to separate two consecutive code caves. More...

void	SetVariablesSectionSeparationBytes (byte[] byteSeq)
	Modifies the sequence of bytes used to separate the injected code caves section from the injected variables section. More...

byte []	GetVariablesSectionSeparationBytes ()
	Retrieves the sequence of bytes used to separate the injected code caves section from the injected variables section. More...

IntPtr	GetBaseInjectionAddress ()
	Retrieves the address where the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> has injected its data on the target process. More...

int	GetCodeCaveOffset (TCodeCave codeCaveID)
	Retrieves the offset of a given code cave, relative to the base injection address into the target process' memory space. More...

AbsoluteMemoryAddress	GetInjectedCodeCaveAddress (TCodeCave codeCaveID)
	Retrieves the address of an injected code cave. This method should only be called after a base injection address has been defined for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to Inject code caves and variables. More...

byte []	GetInjectedCodeCaveAddressAsBytes (TCodeCave codeCaveID)
	Retrieves the address of an injected code cave, represented as bytes stored in the target process' memory space. More...

int	GetVariableOffset (TVariable varID)
	Retrieves the offset of a given variable, relative to the base injection address into the target process' memory space. More...

AbsoluteMemoryAddress	GetInjectedVariableAddress (TVariable varID)
	Retrieves the address of an injected variable. This method should only be called after a base injection address has been defined for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to Inject code caves and variables. More...

byte []	GetInjectedVariableAddressAsBytes (TVariable varID)
	Retrieves the address of an injected variable, represented as bytes stored in the target process' memory space. More...

int	GetVariableSize (TVariable varID)
	Retrieves the size of a given injection variable. More...

int	CalculateRequiredBytesCount ()
	Calculates the total number of required bytes to inject the code caves and variables into the target process' memory space. This calculation takes in consideration the separation bytes between two consecutive code caves, the separation between the code caves section and the variables section and the size of each one of the injection variables. More...

void	AddMemoryAlteration (TMemoryAlterationSetID memoryAlterationSetID, MemoryAlterationBase memoryAlteration)
	Adds a memory alteration to the set of alterations related to a given identifier. Memory alteration sets are kept in as list, and this method adds a memory alteration to the end of this list. The elements of a set of memory alterations are enabled/disabled in the order they get added to the list. You can then call SetMemoryAlterationsActive(TMemoryAlterationSetID, bool) to enable or disable the whole set of alterations related to an identifier. More...

bool	RemoveMemoryAlteration (TMemoryAlterationSetID memoryAlterationSetID, MemoryAlterationBase memoryAlteration)
	Removes a memory alteration from the set of alterations related to a given identifier. Memory alteration sets are kept in as list, and this method removes a memory alteration from this list. The elements of a set of memory alterations are enabled/disabled in the order they get added to the list. You can then call SetMemoryAlterationsActive(TMemoryAlterationSetID, bool) to enable or disable the whole set of alterations related to an identifier. More...

IEnumerable< MemoryAlterationBase >	GetMemoryAlterations (TMemoryAlterationSetID memoryAlterationSetID)
	Returns an enumerable object containing all memory alterations registered for a given memory alteration set. More...

bool	SetMemoryAlterationsActive (TMemoryAlterationSetID memoryAlterationSetID, bool bActivate)
	Activates or deactivates all the memory alterations registered for a given memory alterations set. More...

bool	SetAllMemoryAlterationsActive (bool bActivate)
	Activates or deactivates all the memory alterations registered with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>. More...

CodeCaveBuilder< TMemoryAlterationSetID, TCodeCave, TVariable >	NewCodeCave ()
	Instantiates a CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> to allow for the creation of a new code cave that can be used with this Injector<TMemoryAlterationSetID, TCodeCave, TVariable>. More...

void	Inject ()
	Allocates memory into the target process' memory space and injects the code caves and variables into that allocated memory. More...

void	Inject (MemoryAddress baseInjectionAddress)

int	GetCurrentInjectionOffset ()
	Called during the injection procedure to retrieve the number of bytes already generated by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> instance. This method is called by lower APIs which need to use the current injection position, mainly to generate instructions such as NEAR/FAR JUMPs and CALLs. More...

IntPtr	GetCurrentInjectionAddress ()

void	ResetAllocatedMemoryData ()
	Resets the internal data of the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> regarding the memory region where it has injected its data. This method should be called whenever the target process is terminated or whenever the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> object needs to deallocate the memory it has allocated on the target process. More...

bool	WriteX86CallInstruction (MemoryAddress detourPoint, MemoryAddress targetAddress, int instructionSize)
	Writes a x86 CALL instruction at a specific point of the target process' memory space to enable the process' execution flow to be detoured to a specific address. More...

bool	WriteX86NearJumpInstruction (EJumpInstructionType jumpInstructionType, MemoryAddress detourPoint, MemoryAddress targetAddress, int instructionSize)
	Writes a x86 NEAR JUMP instruction at a specific point of the target process' memory space to enable the process' execution flow to be detoured to a specific address. More...

bool	WriteX86FarJumpInstruction (EJumpInstructionType jumpInstructionType, MemoryAddress detourPoint, MemoryAddress targetAddress, int instructionSize)
	Writes a x86 FAR JUMP instruction at a specific point of the target process' memory space to enable the process' execution flow to be detoured to a specific address. More...

bool	WriteVariableValue (TVariable variableID, object newValue)
	Updates the value of a given variable into the target process' memory. This method is safe, as it checks the given variable's metadata against the given value's type to see if it matches the variable's type before updating the variable's value. More...

bool	ReadVariableValue< T > (TVariable variableID, ref T outDestiny)
	Reads the current value of a given variable from the target process' memory. This method is safe, as it checks the given variable's metadata against the given output variable's type to see if it matches the injected variable's type before reading the output value. More...

void	SetCodeCaveDefinition (TCodeCave caveId, CodeCaveDefinition< TMemoryAlterationSetID, TCodeCave, TVariable > definition)

void	SetVariableDefinition (TVariable varId, VariableDefinition definition)

CodeCaveDefinition< TMemoryAlterationSetID, TCodeCave, TVariable >	GetCodeCaveDefinition (TCodeCave caveId)
	Retrieves the definition of the given code cave, that has been registered with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>, if any. More...

VariableDefinition	GetVariableDefinition (TVariable varId)
	Retrieves the definition of the given injection variable, that has been registered with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>, if any. More...

bool	ClearCodeCaveDefinition (TCodeCave caveId)

bool	ClearVariableDefinition (TVariable varId)

void	ClearAllCodeCaveDefinitions ()

void	ClearAllVariableDefinitions ()

Static Public Member Functions
static byte []	GetX86CallOpcode (MemoryAddress callInstructionAddress, MemoryAddress targetCallAddress, int instructionSize=LowLevel.INSTRUCTION_SIZE_x86_CALL, EEndianness endianness=EEndianness.evEndiannessDefault, EPointerSize pointerSize=EPointerSize.evPointerSizeDefault, EDifferentPointerSizeError diffPointerSizeError=EDifferentPointerSizeError.evThrowException)
	Utility method for retrieving a sequence of bytes which represent the machine-level opcode corresponding to a 32-bits CALL instruction. 64-bits CALL instructions are currently not supported by the RAMvader library. More...

static byte []	GetX86NearJumpOpcode (EJumpInstructionType jumpInstructionType, MemoryAddress jumpInstructionAddress, MemoryAddress targetJumpAddress, int instructionSize=LowLevel.INSTRUCTION_SIZE_x86_NEAR_JUMP, EPointerSize pointerSize=EPointerSize.evPointerSizeDefault)
	Utility method for retrieving a sequence of bytes which represent the machine-level opcode corresponding to a 32-bits NEAR JUMP instruction. 64-bits JUMP instructions are currently not supported by the RAMvader library. More...

static byte []	GetX86FarJumpOpcode (EJumpInstructionType jumpInstructionType, MemoryAddress jumpInstructionAddress, MemoryAddress targetJumpAddress, int instructionSize=LowLevel.INSTRUCTION_SIZE_x86_FAR_JUMP, EEndianness endianness=EEndianness.evEndiannessDefault, EPointerSize pointerSize=EPointerSize.evPointerSizeDefault, EDifferentPointerSizeError diffPointerSizeError=EDifferentPointerSizeError.evThrowException)
	Utility method for retrieving a sequence of bytes which represent the machine-level opcode corresponding to a x86 FAR JUMP instruction. 64-bits JUMP instructions are currently not supported by the RAMvader library. More...

Properties
IntPtr	BaseInjectionAddress `[get]`
	Keeps the base address of the memory which was allocated for the target process. Backed by the m_baseInjectionAddress field. More...

bool	IsInjected `[get]`
	A flag that is set to true whenever the Inject() (or Inject(MemoryAddress)) method is called and succeeds, and set to false whenever theResetAllocatedMemoryData gets called. More...

RAMvaderTarget	TargetProcess `[get]`
	The object used to attach to the target process, so that the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> can perform I/O operations into the target process' memory. Backed by the m_targetProcess field. More...

int	RequiredBytesCount `[get]`
	The total number of required bytes to inject the code caves and variables into the target process' memory space, as calculated by a call to the method CalculateRequiredBytesCount. More...

NestedPropertyIndexerCodeCaveOffset	CodeCaveOffset `[get]`
	Indexer property used to access the code cave offsets, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetCodeCaveOffset(TCodeCave) internally. Backed by the m_codeCaveOffset field. More...

NestedPropertyIndexerInjectedCodeCaveAddress	InjectedCodeCaveAddress `[get]`
	Indexer property used to access the address where a code cave has been injected, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetInjectedCodeCaveAddress(TCodeCave) internally. Backed by the m_injectedCodeCaveAddress field. More...

NestedPropertyIndexerVariableOffset	VariableOffset `[get]`
	Indexer property used to access variable offsets, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetVariableOffset(TVariable) internally. Backed by the m_variableOffset field. More...

NestedPropertyIndexerInjectedVariableAddress	InjectedVariableAddress `[get]`
	Indexer property used to access the address where a variable has been injected, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetInjectedVariableAddress(TVariable) internally. Backed by the m_injectedVariableAddress field. More...

NestedPropertyIndexerVariableSize	VariableSize `[get]`
	Indexer property used to retrieve the size of a variable, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetVariableSize(TVariable) internally. Backed by the m_variableSize field. More...

Additional Inherited Members
Protected Member Functions inherited from RAMvader.NotifyPropertyChangedAdapter
void	SendPropertyChangedNotification ([CallerMemberName] string propertyName="")
	This method should be called inside PROPERTY SETTER METHODS to notify listeners of the "property changed" event that the property has been updated. More...

Events inherited from RAMvader.NotifyPropertyChangedAdapter
PropertyChangedEventHandler	PropertyChanged
	Used for implementing the INotifyPropertyChanged interface. More...

Detailed Description

Implements the logic behind the injection of code caves and variables into a target process' memory space.

Template Parameters

TMemoryAlterationSetID	An enumerated type which specifies the identifiers for Memory Alteration Sets that can be enabled or disabled into the target process' memory space.
TCodeCave	An enumerated type which specifies the identifiers for code caves.
TVariable	An enumerated type which specifies the identifiers for variables to be injected at the target process.

Constructor & Destructor Documentation

◆ Injector()

RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.Injector ( )

Constructor. The constructor of the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> class checks the code caves and variables for consistency, throwing an exception if there is any error found.

Exceptions

UnsupportedDataTypeException	Thrown if any of the injection variables (enumerators of the type TVariable ) has a data type that is not supported by the RAMvader library.
InjectorGenericParametersException	Thrown in cases where there are any errors with the generic types defined for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>. The types TMemoryAlterationSetID , TCodeCave and TVariable MUST be enumerations.

Member Function Documentation

◆ AddMemoryAlteration()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.AddMemoryAlteration	(	TMemoryAlterationSetID	memoryAlterationSetID,
		MemoryAlterationBase	memoryAlteration
	)

Adds a memory alteration to the set of alterations related to a given identifier. Memory alteration sets are kept in as list, and this method adds a memory alteration to the end of this list. The elements of a set of memory alterations are enabled/disabled in the order they get added to the list. You can then call SetMemoryAlterationsActive(TMemoryAlterationSetID, bool) to enable or disable the whole set of alterations related to an identifier.

Parameters

memoryAlterationSetID	The identifier that identifies the set of alterations that can be enabled/disabled all at once.
memoryAlteration	An object representing the memory alteration that should be added to the given set.

◆ CalculateRequiredBytesCount()

int RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.CalculateRequiredBytesCount ( )

Calculates the total number of required bytes to inject the code caves and variables into the target process' memory space. This calculation takes in consideration the separation bytes between two consecutive code caves, the separation between the code caves section and the variables section and the size of each one of the injection variables.

Returns: Returns the number of bytes required to Inject into the target process' memory.

◆ ClearAllCodeCaveDefinitions()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.ClearAllCodeCaveDefinitions ( )

Clears the definition of all code caves, effectively making all of them "undefined" for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

Calling this will prevent the code caves from being injected in the target process' memory space - as their definition will be voided - until they get redefined/updated.

Currently, the definitions of code caves and injection variables can only be updated when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> is in the "not injected" state.

◆ ClearAllVariableDefinitions()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.ClearAllVariableDefinitions ( )

Clears the definition of all injection varibles, effectively making all of them "undefined" for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

Calling this will prevent the injection variables from being injected in the target process' memory space - as their definition will be voided - until they get redefined/updated.

Currently, the definitions of code caves and injection variables can only be updated when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> is in the "not injected" state.

◆ ClearCodeCaveDefinition()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.ClearCodeCaveDefinition ( TCodeCave caveId )

Clears the definition of a specific code cave, effectively making it "undefined" for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

Calling this will prevent the code cave from being injected in the target process' memory space - as its definition will be voided - until it gets redefined/updated.

Currently, the definitions of code caves and injection variables can only be updated when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> is in the "not injected" state.

Parameters

caveId The code cave whose definition will be cleared.

Returns: Returns a flag specifying if the definition has been found and removed.

◆ ClearVariableDefinition()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.ClearVariableDefinition ( TVariable varId )

Clears the definition of a specific injection variable, effectively making it "undefined" for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

Calling this will prevent the injection variable from being injected in the target process' memory space - as its definition will be voided - until it gets redefined/updated.

Currently, the definitions of code caves and injection variables can only be updated when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> is in the "not injected" state.

Parameters

varId The injection variable whose definition will be cleared.

Returns: Returns a flag specifying if the definition has been found and removed.

◆ GetBaseInjectionAddress()

IntPtr RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetBaseInjectionAddress ( )

Retrieves the address where the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> has injected its data on the target process.

Returns: Returns the base address where the injection has been performed. If the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> didn't perform the injection yet, the return value is IntPtr.Zero.

See also: Inject(), Inject(MemoryAddress)

◆ GetCodeCaveDefinition()

CodeCaveDefinition<TMemoryAlterationSetID, TCodeCave, TVariable> RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetCodeCaveDefinition ( TCodeCave caveId )

Retrieves the definition of the given code cave, that has been registered with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>, if any.

Parameters

caveId The identifier of the code cave whose definition is to be retrieved.

Returns: In case of success, returns the CodeCaveDefinition<TMemoryAlterationSetID, TCodeCave, TVariable> object representing the definition that has been registered for the given code cave.

In case of failure, returns

null

.

◆ GetCodeCaveOffset()

int RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetCodeCaveOffset ( TCodeCave codeCaveID )

Retrieves the offset of a given code cave, relative to the base injection address into the target process' memory space.

Parameters

codeCaveID The identifier of the code cave.

Returns: Returns the offset of the given code cave.

Exceptions

InjectionArtifactNotFoundException Thrown when the artifact (injection variable or code cave) could not be found by the method.

◆ GetCodeCavesSeparationBytes()

byte [] RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetCodeCavesSeparationBytes ( )

Retrieves the sequence of bytes used to separate two consecutive code caves.

Returns: Returns the sequence of bytes used to separate two consecutive code caves in memory.

◆ GetCurrentInjectionAddress()

IntPtr RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetCurrentInjectionAddress ( )

Called during the injection procedure to retrieve the address right after the last byte generated by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> instance. This method is called by lower APIs which need to use the current injection position, mainly to generate instructions such as NEAR/FAR JUMPs and CALLs.

The return value of this method is effectivelly the sum of BaseInjectionAddress with the return value of the GetCurrentInjectionOffset method.

Returns: The return value of this method is effectivelly the sum of BaseInjectionAddress with the return value of the GetCurrentInjectionOffset method.

See also: GetCurrentInjectionAddress

◆ GetCurrentInjectionOffset()

int RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetCurrentInjectionOffset ( )

Called during the injection procedure to retrieve the number of bytes already generated by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> instance. This method is called by lower APIs which need to use the current injection position, mainly to generate instructions such as NEAR/FAR JUMPs and CALLs.

Returns: Returns the number of bytes that have already been generated by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> during an injection procedure.

If the injection procedure hasn't started yet, or the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> finds itself in "not injected" state, the return value is zero.

If this method is called after a successful injection procedure, the return value is the total number of injected bytes (which is effectivelly the same result of calling CalculateRequiredBytesCount).

If this method is called during the injection procedure (which is usually done when processing CodeCaveArtifact<TMemoryAlterationSetID, TCodeCave, TVariable> objects that compose the code caves to be injected), the return value is the total number of bytes that have been injected so far by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

See also: GetCurrentInjectionAddress

◆ GetInjectedCodeCaveAddress()

AbsoluteMemoryAddress RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetInjectedCodeCaveAddress ( TCodeCave codeCaveID )

Retrieves the address of an injected code cave. This method should only be called after a base injection address has been defined for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to Inject code caves and variables.

Parameters

codeCaveID The identifier of the target code cave.

Returns: Returns the address of the given code cave, into the target process' memory space.

Exceptions

InjectionArtifactNotFoundException Thrown when the artifact (injection variable or code cave) could not be found by the method.

◆ GetInjectedCodeCaveAddressAsBytes()

byte [] RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetInjectedCodeCaveAddressAsBytes ( TCodeCave codeCaveID )

Retrieves the address of an injected code cave, represented as bytes stored in the target process' memory space.

Parameters

codeCaveID The identifier of the target code cave.

Returns: Returns the array of bytes representing the address of the injected code cave, as it is to be stored into the target process' memory space.

Exceptions

NullReferenceException Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).

◆ GetInjectedVariableAddress()

AbsoluteMemoryAddress RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetInjectedVariableAddress ( TVariable varID )

Retrieves the address of an injected variable. This method should only be called after a base injection address has been defined for the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to Inject code caves and variables.

Parameters

varID The identifier of the target variable.

Returns: Returns the address of the given variable, into the target process' memory space.

Exceptions

InjectionArtifactNotFoundException Thrown when the artifact (injection variable or code cave) could not be found by the method.

◆ GetInjectedVariableAddressAsBytes()

byte [] RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetInjectedVariableAddressAsBytes ( TVariable varID )

Retrieves the address of an injected variable, represented as bytes stored in the target process' memory space.

Parameters

varID The identifier of the target variable.

Returns: Returns the array of bytes representing the address of the injected variable, as it is to be stored into the target process' memory space.

Exceptions

NullReferenceException Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).

◆ GetMemoryAlterations()

IEnumerable<MemoryAlterationBase> RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetMemoryAlterations ( TMemoryAlterationSetID memoryAlterationSetID )

Returns an enumerable object containing all memory alterations registered for a given memory alteration set.

Parameters

memoryAlterationSetID The identifier that identifies the set of alterations that can be enabled/disabled all at once.

Returns: Returns an enumerable list containing all the memory alterations in the given set.

◆ GetTargetProcess()

RAMvaderTarget RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetTargetProcess ( )

Retrieves the current reference to the object used by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to perform write operations to the target process' memory. The Injector<TMemoryAlterationSetID, TCodeCave, TVariable> also uses this object to know the endianness and pointer size of the target process.

Returns: Returns the object used for performing memory I/O operations on the target process.

See also: SetTargetProcess(RAMvaderTarget)

◆ GetVariableDefinition()

VariableDefinition RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetVariableDefinition ( TVariable varId )

Retrieves the definition of the given injection variable, that has been registered with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>, if any.

Parameters

varId The identifier of the injection variable whose definition is to be retrieved.

Returns: In case of success, returns the VariableDefinition object representing the definition that has been registered for the given injection variable.

In case of failure, returns

null

.

◆ GetVariableOffset()

int RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetVariableOffset ( TVariable varID )

Retrieves the offset of a given variable, relative to the base injection address into the target process' memory space.

Parameters

varID The identifier of the variable whose offset is to be retrieved.

Returns: Returns the offset to given variable.

Exceptions

InjectionArtifactNotFoundException Thrown when the artifact (injection variable or code cave) could not be found by the method.

◆ GetVariableSize()

int RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetVariableSize ( TVariable varID )

Retrieves the size of a given injection variable.

Parameters

varID The identifier of the variable whose size is to be retrieved.

Returns: Returns the size of the given injection variable, given in bytes. If the variable has no definition set for it, the returned size is ZERO.

Exceptions

NullReferenceException Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).

◆ GetVariablesSectionSeparationBytes()

byte [] RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetVariablesSectionSeparationBytes ( )

Retrieves the sequence of bytes used to separate the injected code caves section from the injected variables section.

Returns: Returns the sequence of bytes used to separate two consecutive code caves in memory.

◆ GetX86CallOpcode()

static byte [] RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetX86CallOpcode	(	MemoryAddress	callInstructionAddress,
		MemoryAddress	targetCallAddress,
		int	instructionSize = `LowLevel.INSTRUCTION_SIZE_x86_CALL`,
		EEndianness	endianness = `EEndianness.evEndiannessDefault`,
		EPointerSize	pointerSize = `EPointerSize.evPointerSizeDefault`,
		EDifferentPointerSizeError	diffPointerSizeError = `EDifferentPointerSizeError.evThrowException`
	)

static

Utility method for retrieving a sequence of bytes which represent the machine-level opcode corresponding to a 32-bits CALL instruction. 64-bits CALL instructions are currently not supported by the RAMvader library.

Parameters

callInstructionAddress	The address of the CALL instruction itself.
targetCallAddress	The address which should be called by the CALL instruction.
instructionSize	When replacing an instruction in a target process' memory space by a CALL instruction, this parameter specifies the size of the instruction to be replaced. If this size is larger than the size of a CALL instruction, the remaining bytes are filled with NOP opcodes in the returned bytes sequence, so that the CALL instruction might replace other instructions while keeping the consistency of its surrounding instructions when a RET instruction is used to return from the CALL.
endianness	The endianness to be used for the offset of the CALL opcode.
pointerSize	The size of pointer to be used for the offset of the CALL opcode.
diffPointerSizeError	The policy for handling errors regarding different sizes of pointers between RAMvader process' pointers and the pointers size defined by the "pointerSize" parameter.

Returns: Returns a sequence of bytes representing the CALL opcode that composes the given instruction.

Exceptions

InstructionTooLargeException Thrown when the given instruction size is less than the size required to generate the instruction.

◆ GetX86FarJumpOpcode()

static byte [] RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetX86FarJumpOpcode	(	EJumpInstructionType	jumpInstructionType,
		MemoryAddress	jumpInstructionAddress,
		MemoryAddress	targetJumpAddress,
		int	instructionSize = `LowLevel.INSTRUCTION_SIZE_x86_FAR_JUMP`,
		EEndianness	endianness = `EEndianness.evEndiannessDefault`,
		EPointerSize	pointerSize = `EPointerSize.evPointerSizeDefault`,
		EDifferentPointerSizeError	diffPointerSizeError = `EDifferentPointerSizeError.evThrowException`
	)

static

Utility method for retrieving a sequence of bytes which represent the machine-level opcode corresponding to a x86 FAR JUMP instruction. 64-bits JUMP instructions are currently not supported by the RAMvader library.

Parameters

jumpInstructionType	The specific type of jump instruction to be generated.
jumpInstructionAddress	The address of the JUMP instruction itself.
targetJumpAddress	The address to which the JUMP instruction should jump.
instructionSize	When replacing an instruction in a target process' memory space by a JUMP instruction, this parameter specifies the size of the instruction to be replaced. If this size is larger than the size of a JUMP instruction, the remaining bytes are filled with NOP opcodes in the returned bytes sequence, so that the JUMP instruction might replace other instructions while keeping the consistency of its surrounding instructions when the flow of code returns from the jump (if that ever happens).
endianness	The endianness to be used for the offset of the JUMP opcode.
pointerSize	The size of pointer to be used for the offset of the JUMP opcode.
diffPointerSizeError	The policy for handling errors regarding different sizes of pointers between RAMvader process' pointers and the pointers size defined by the "pointerSize" parameter.

Returns: Returns a sequence of bytes representing the JUMP opcode that composes the given instruction.

Exceptions

IllegalInstructionGenerationException	Thrown when the instruction cannot be generated, because the generated instruction would be illegal.
InstructionTooLargeException	Thrown when the given instruction size is less than the size required to generate the instruction.

◆ GetX86NearJumpOpcode()

static byte [] RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.GetX86NearJumpOpcode	(	EJumpInstructionType	jumpInstructionType,
		MemoryAddress	jumpInstructionAddress,
		MemoryAddress	targetJumpAddress,
		int	instructionSize = `LowLevel.INSTRUCTION_SIZE_x86_NEAR_JUMP`,
		EPointerSize	pointerSize = `EPointerSize.evPointerSizeDefault`
	)

static

Utility method for retrieving a sequence of bytes which represent the machine-level opcode corresponding to a 32-bits NEAR JUMP instruction. 64-bits JUMP instructions are currently not supported by the RAMvader library.

Parameters

jumpInstructionType	The specific type of jump instruction to be generated.
jumpInstructionAddress	The address of the JUMP instruction itself.
targetJumpAddress	The address to which the JUMP instruction should jump.
instructionSize	When replacing an instruction in a target process' memory space by a JUMP instruction, this parameter specifies the size of the instruction to be replaced. If this size is larger than the size of a JUMP instruction, the remaining bytes are filled with NOP opcodes in the returned bytes sequence, so that the JUMP instruction might replace other instructions while keeping the consistency of its surrounding instructions when the flow of code returns from the jump (if that ever happens).
pointerSize	The size of pointer to be used for the offset of the JUMP opcode.

Returns: Returns a sequence of bytes representing the JUMP opcode that composes the given instruction.

Exceptions

IllegalInstructionGenerationException	Thrown when the instruction cannot be generated, because the generated instruction would be illegal.
InstructionTooLargeException	Thrown when the given instruction size is less than the size required to generate the instruction.

◆ Inject() [1/2]

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.Inject ( )

Allocates memory into the target process' memory space and injects the code caves and variables into that allocated memory.

Exceptions

NullReferenceException	Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).
InstanceNotAttachedException	Thrown when the RAMvaderTarget instance has not been attached to a target process before the method is called.
VirtualMemoryAllocationException	Thrown when the method cannot allocate virtual memory in the target process' memory space, to inject the data in the target process. Some softwares might implement security schemes that prevent you from allocating virtual memory on them, which in turn might require you to use manual injection of data (see Inject(MemoryAddress)).

See also: GetBaseInjectionAddress

◆ Inject() [2/2]

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.Inject ( MemoryAddress baseInjectionAddress )

Injects the code caves and variables into the target process' memory space. This overloaded version of the Inject() method can be used to Inject the code caves into a specific point of the target process' memory space. Notice, though, that for the code caves to work correctly, they need to be injected into a memory region with appropriate permissions. Those are usually READ+WRITE+EXECUTE permissions (READ+WRITE for injected variables and EXECUTE for allowing the target process to execute the code caves). If you need to calculate the total number of bytes required by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to inject the code caves and variables, see CalculateRequiredBytesCount.

Notice that you should not use the InjectedCodeCaveMemoryAddress<TMemoryAlterationSetID, TCodeCave, TVariable> and InjectedVariableMemoryAddress<TMemoryAlterationSetID, TCodeCave, TVariable> classes to specify the injection point for this method, because for these classes to solve the right base address, they would require a previous injection to have happened already.

Parameters

baseInjectionAddress The address - into the target process' memory space - where the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> will Inject the code caves and variables. A value of "IntPtr.Zero" will cause the method to exit without any effect on the target process' memory space.

Exceptions

NullReferenceException	Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).
InstanceNotAttachedException	Thrown when the RAMvaderTarget instance has not been attached to a target process before the method is called.
RequiredWriteException	Thrown when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> fails to write the injection data in the target process' memory space.

See also: GetBaseInjectionAddress

◆ NewCodeCave()

CodeCaveBuilder<TMemoryAlterationSetID,TCodeCave,TVariable> RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.NewCodeCave ( )

Instantiates a CodeCaveBuilder<TMemoryAlterationSetID, TCodeCave, TVariable> to allow for the creation of a new code cave that can be used with this Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

Returns: Returns a builder that can be used to create a new code cave for this Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

◆ ReadVariableValue< T >()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.ReadVariableValue< T >	(	TVariable	variableID,
		ref T	outDestiny
	)

Reads the current value of a given variable from the target process' memory. This method is safe, as it checks the given variable's metadata against the given output variable's type to see if it matches the injected variable's type before reading the output value.

Template Parameters

T	The type of the variable to be read, which must match the type of the injected variable.

Parameters

variableID	The identifier of the variable whose value is to be read from the target process' memory space.
outDestiny	The result of the reading will be stored in this variable. The referenced variable's data must be of the same type as declared for the variable defined in parameter variableID .

Returns: Returns the result of the read operation performed by a call to RAMvaderTarget.ReadFromTarget<T>(MemoryAddress, ref T).

Exceptions

NullReferenceException	Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).
InstanceNotAttachedException	Thrown when the RAMvaderTarget instance has not been attached to a target process before the method is called.
InjectionArtifactNotFoundException	Thrown when the variable has not been injected in the target process' memory space. This happens when the variable has no definition (VariableDefinition) registered for it with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

◆ RemoveMemoryAlteration()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.RemoveMemoryAlteration	(	TMemoryAlterationSetID	memoryAlterationSetID,
		MemoryAlterationBase	memoryAlteration
	)

Removes a memory alteration from the set of alterations related to a given identifier. Memory alteration sets are kept in as list, and this method removes a memory alteration from this list. The elements of a set of memory alterations are enabled/disabled in the order they get added to the list. You can then call SetMemoryAlterationsActive(TMemoryAlterationSetID, bool) to enable or disable the whole set of alterations related to an identifier.

Parameters

memoryAlterationSetID	The identifier that identifies the set of alterations that can be enabled/disabled all at once.
memoryAlteration	The memory alteration to be removed from the given set.

Returns: Returns a flag specifying if the alteration has been removed from the set.

◆ ResetAllocatedMemoryData()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.ResetAllocatedMemoryData ( )

Resets the internal data of the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> regarding the memory region where it has injected its data. This method should be called whenever the target process is terminated or whenever the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> object needs to deallocate the memory it has allocated on the target process.

◆ SetAllMemoryAlterationsActive()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.SetAllMemoryAlterationsActive ( bool bActivate )

Activates or deactivates all the memory alterations registered with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

Parameters

bActivate A flag specifying if the alterations should be activated or deactivated.

Returns: Returns a flag specifying if all alterations have been activated. If any of the memory alterations in a set fail to be activated/deactivated, the returned value is false.

◆ SetCodeCaveDefinition()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.SetCodeCaveDefinition	(	TCodeCave	caveId,
		CodeCaveDefinition< TMemoryAlterationSetID, TCodeCave, TVariable >	definition
	)

Updates the definition of a given code cave.

Currently, the definitions of code caves and injection variables can only be updated when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> is in the "not injected" state.

Parameters

caveId	The identifier of the code cave whose definition is to be updated.
definition	An object representing the new definition of the given code cave.

Exceptions

InstanceAlreadyInjectedException Thrown when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>'s instance is already in "injected" state (this method must be called before that state is entered).

◆ SetCodeCavesSeparationBytes()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.SetCodeCavesSeparationBytes ( byte [] byteSeq )

Modifies the sequence of bytes used to separate two consecutive code caves.

Parameters

byteSeq The new sequence of bytes to use as a separator. This can be an empty array, but should not be null.

◆ SetMemoryAlterationsActive()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.SetMemoryAlterationsActive	(	TMemoryAlterationSetID	memoryAlterationSetID,
		bool	bActivate
	)

Activates or deactivates all the memory alterations registered for a given memory alterations set.

Parameters

memoryAlterationSetID	The identifier that identifies the set of alterations that can be enabled/disabled all at once.
bActivate	A flag specifying if the alterations should be activated or deactivated.

Returns: Returns a flag specifying if all alterations have been activated. If any of the memory alterations in a set fail to be activated/deactivated, the returned value is false.

◆ SetTargetProcess()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.SetTargetProcess ( RAMvaderTarget targetProc )

Initializes or modifies the reference to the object used by the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> to perform write operations to the target process' memory. The Injector<TMemoryAlterationSetID, TCodeCave, TVariable> also uses this object to know the endianness and pointer size of the target process.

Parameters

targetProc The object used for performing memory I/O operations on the target process.

See also: GetTargetProcess

◆ SetVariableDefinition()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.SetVariableDefinition	(	TVariable	varId,
		VariableDefinition	definition
	)

Updates the definition of a given injection variable.

Currently, the definitions of code caves and injection variables can only be updated when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> is in the "not injected" state.

Parameters

varId	The identifier of the injection variable whose definition is to be updated.
definition	An object representing the new definition of the given injection variable.

Exceptions

InstanceAlreadyInjectedException	Thrown when the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>'s instance is already in "injected" state (this method must be called before that state is entered).
UnsupportedDataTypeException	Throw when the type of the

◆ SetVariablesSectionSeparationBytes()

void RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.SetVariablesSectionSeparationBytes ( byte [] byteSeq )

Modifies the sequence of bytes used to separate the injected code caves section from the injected variables section.

Parameters

byteSeq The new sequence of bytes to use as a separator. This can be an empty array, but should not be null.

◆ WriteVariableValue()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.WriteVariableValue	(	TVariable	variableID,
		object	newValue
	)

Updates the value of a given variable into the target process' memory. This method is safe, as it checks the given variable's metadata against the given value's type to see if it matches the variable's type before updating the variable's value.

Parameters

variableID	The identifier of the injected variable whose value is to be updated.
newValue	The new value for the variable.

Returns: Returns the result of the write operation performed by a call to RAMvaderTarget.WriteToTarget(MemoryAddress, object).

Exceptions

NullReferenceException	Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).
InstanceNotAttachedException	Thrown when the RAMvaderTarget instance has not been attached to a target process before the method is called.
UnmatchedDataTypeException	Thrown when "newValue" does not match the injection variable's type.
InjectionArtifactNotFoundException	Thrown when the variable has not been injected in the target process' memory space. This happens when the variable has no definition (VariableDefinition) registered for it with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.

◆ WriteX86CallInstruction()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.WriteX86CallInstruction	(	MemoryAddress	detourPoint,
		MemoryAddress	targetAddress,
		int	instructionSize
	)

Writes a x86 CALL instruction at a specific point of the target process' memory space to enable the process' execution flow to be detoured to a specific address.

Parameters

detourPoint	The address of the target process' memory space where the CALL instruction will be written.
targetAddress	The address to where the target process' execution should be diverted.
instructionSize	The size of the instruction that is going to be replaced by the CALL instruction. This is used to fill the remaining bytes of the instruction with NOP opcodes, so that when the execution flows back from the CALL instruction, nothing unexpected happens.

Returns: Returns a flag indicating the success of the operation.

Exceptions

NullReferenceException	Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).
InstanceNotAttachedException	Thrown when the RAMvaderTarget instance has not been attached to a target process before the method is called.

◆ WriteX86FarJumpInstruction()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.WriteX86FarJumpInstruction	(	EJumpInstructionType	jumpInstructionType,
		MemoryAddress	detourPoint,
		MemoryAddress	targetAddress,
		int	instructionSize
	)

Writes a x86 FAR JUMP instruction at a specific point of the target process' memory space to enable the process' execution flow to be detoured to a specific address.

Parameters

jumpInstructionType	The specific type of jump instruction to be written.
detourPoint	The address of the target process' memory space where the JUMP instruction will be written.
targetAddress	The address to where the target process' execution should be diverted.
instructionSize	The size of the instruction that is going to be replaced by the JUMP instruction. This is used to fill the remaining bytes of the instruction with NOP opcodes, to keep the other instructions' balance unaffected by the new jump instruction.

Returns: Returns a flag indicating the success of the operation.

Exceptions

NullReferenceException	Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).
InstanceNotAttachedException	Thrown when the RAMvaderTarget instance has not been attached to a target process before the method is called.

◆ WriteX86NearJumpInstruction()

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.WriteX86NearJumpInstruction	(	EJumpInstructionType	jumpInstructionType,
		MemoryAddress	detourPoint,
		MemoryAddress	targetAddress,
		int	instructionSize
	)

Writes a x86 NEAR JUMP instruction at a specific point of the target process' memory space to enable the process' execution flow to be detoured to a specific address.

Parameters

jumpInstructionType	The specific type of jump instruction to be written.
detourPoint	The address of the target process' memory space where the JUMP instruction will be written.
targetAddress	The address to where the target process' execution should be diverted.
instructionSize	The size of the instruction that is going to be replaced by the JUMP instruction. This is used to fill the remaining bytes of the instruction with NOP opcodes, to keep the other instructions' balance unaffected by the new jump instruction.

Returns: Returns a flag indicating the success of the operation.

Exceptions

NullReferenceException	Thrown when the RAMvaderTarget associated with the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> hasn't been set. A RAMvaderTarget instance can be associated to an Injector<TMemoryAlterationSetID, TCodeCave, TVariable> by calling the method Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.SetTargetProcess(RAMvaderTarget).
InstanceNotAttachedException	Thrown when the RAMvaderTarget instance has not been attached to a target process before the method is called.

Property Documentation

◆ BaseInjectionAddress

IntPtr RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.BaseInjectionAddress

get

Keeps the base address of the memory which was allocated for the target process. Backed by the m_baseInjectionAddress field.

◆ CodeCaveOffset

NestedPropertyIndexerCodeCaveOffset RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.CodeCaveOffset

get

Indexer property used to access the code cave offsets, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetCodeCaveOffset(TCodeCave) internally. Backed by the m_codeCaveOffset field.

◆ InjectedCodeCaveAddress

NestedPropertyIndexerInjectedCodeCaveAddress RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.InjectedCodeCaveAddress

get

Indexer property used to access the address where a code cave has been injected, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetInjectedCodeCaveAddress(TCodeCave) internally. Backed by the m_injectedCodeCaveAddress field.

◆ InjectedVariableAddress

NestedPropertyIndexerInjectedVariableAddress RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.InjectedVariableAddress

get

Indexer property used to access the address where a variable has been injected, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetInjectedVariableAddress(TVariable) internally. Backed by the m_injectedVariableAddress field.

◆ IsInjected

bool RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.IsInjected

get

A flag that is set to true whenever the Inject() (or Inject(MemoryAddress)) method is called and succeeds, and set to false whenever theResetAllocatedMemoryData gets called.

◆ RequiredBytesCount

int RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.RequiredBytesCount

get

The total number of required bytes to inject the code caves and variables into the target process' memory space, as calculated by a call to the method CalculateRequiredBytesCount.

◆ TargetProcess

RAMvaderTarget RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.TargetProcess

get

The object used to attach to the target process, so that the Injector<TMemoryAlterationSetID, TCodeCave, TVariable> can perform I/O operations into the target process' memory. Backed by the m_targetProcess field.

◆ VariableOffset

NestedPropertyIndexerVariableOffset RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.VariableOffset

get

Indexer property used to access variable offsets, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetVariableOffset(TVariable) internally. Backed by the m_variableOffset field.

◆ VariableSize

NestedPropertyIndexerVariableSize RAMvader.CodeInjection.Injector< TMemoryAlterationSetID, TCodeCave, TVariable >.VariableSize

get

Indexer property used to retrieve the size of a variable, usually for WPF Binding purposes. Calls Injector<TMemoryAlterationSetID, TCodeCave, TVariable>.GetVariableSize(TVariable) internally. Backed by the m_variableSize field.

Public Member Functions

Static Public Member Functions

Properties

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

◆ Injector()

Member Function Documentation

◆ AddMemoryAlteration()

◆ CalculateRequiredBytesCount()

◆ ClearAllCodeCaveDefinitions()

◆ ClearAllVariableDefinitions()

◆ ClearCodeCaveDefinition()

◆ ClearVariableDefinition()

◆ GetBaseInjectionAddress()

◆ GetCodeCaveDefinition()

◆ GetCodeCaveOffset()

◆ GetCodeCavesSeparationBytes()

◆ GetCurrentInjectionAddress()

◆ GetCurrentInjectionOffset()

◆ GetInjectedCodeCaveAddress()

◆ GetInjectedCodeCaveAddressAsBytes()

◆ GetInjectedVariableAddress()

◆ GetInjectedVariableAddressAsBytes()

◆ GetMemoryAlterations()

◆ GetTargetProcess()

◆ GetVariableDefinition()

◆ GetVariableOffset()

◆ GetVariableSize()

◆ GetVariablesSectionSeparationBytes()

◆ GetX86CallOpcode()

◆ GetX86FarJumpOpcode()

◆ GetX86NearJumpOpcode()

◆ Inject() [1/2]

◆ Inject() [2/2]

◆ NewCodeCave()

◆ ReadVariableValue< T >()

◆ RemoveMemoryAlteration()

◆ ResetAllocatedMemoryData()

◆ SetAllMemoryAlterationsActive()

◆ SetCodeCaveDefinition()

◆ SetCodeCavesSeparationBytes()

◆ SetMemoryAlterationsActive()

◆ SetTargetProcess()

◆ SetVariableDefinition()

◆ SetVariablesSectionSeparationBytes()

◆ WriteVariableValue()

◆ WriteX86CallInstruction()

◆ WriteX86FarJumpInstruction()

◆ WriteX86NearJumpInstruction()

Property Documentation

◆ BaseInjectionAddress

◆ CodeCaveOffset

◆ InjectedCodeCaveAddress

◆ InjectedVariableAddress

◆ IsInjected

◆ RequiredBytesCount

◆ TargetProcess

◆ VariableOffset

◆ VariableSize