[ProtectedOverride]

in my scenario I do want the task manager to reflect the change :) Anyway I have a way around that. If I can get it working on 64bit I have a workable solution. Tried with "AnyCPU" compiling, no luck, fails to write back change as before. When you say need 64 bit address, what part of the code is 32 bit specific?

Thanks

[Paskowsky]

in my scenario I do want the task manager to reflect the change :) Anyway I have a way around that. If I can get it working on 64bit I have a workable solution. Tried with "AnyCPU" compiling, no luck, fails to write back change as before. When you say need 64 bit address, what part of the code is 32 bit specific?

Thanks

What changes from x86 to x64 is offsets from PEB base address since different data types are used and so IntPtr size is 8 instead of 4

like here :

Code

if (!ReadProcessMemory(hProcess, peb + 0x10, (IntPtr)(&rtlUserProcParamsAddress), Marshal.SizeOf(typeof(IntPtr)), out intOutput))

Take a look at this website : https://www.geoffchappell.com/studies/wi.../index.htm


peb + 0x10 would become peb + 0x20

Regards,
Paskowsky 🤝

[ProtectedOverride]

What changes from x86 to x64 is offsets from PEB base address since different data types are used and so IntPtr size is 8 instead of 4

like here :

Code

if (!ReadProcessMemory(hProcess, peb + 0x10, (IntPtr)(&rtlUserProcParamsAddress), Marshal.SizeOf(typeof(IntPtr)), out intOutput))

Take a look at this website : https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm


peb + 0x10 would become peb + 0x20

Regards,
Paskowsky 🤝

Thank you @Paskowsky, this has helped a lot, made some progress but having trouble allocting memory in 64bit process, presumably I need to change this:

/* allocate memory for Input /
Current_ImageBase.Length = (ushort)(input.Length 2);
pNewAddr = VirtualAllocEx(hProcess, IntPtr.Zero, Current_ImageBase.Length, /* AllocationType.Commit / 0x1000 | / AllocationType.Reserve / 0x2000, / MemoryProtection.ExecuteReadWrite */ 0x40);
if (pNewAddr == IntPtr.Zero)
{
Console.WriteLine("ERROR: Could not allocate memory in target process.\n");
return false;
}

[Paskowsky]

Thank you @Paskowsky, this has helped a lot, made some progress but having trouble allocting memory in 64bit process, presumably I need to change this:

/* allocate memory for Input /
           Current_ImageBase.Length = (ushort)(input.Length 2);
           pNewAddr = VirtualAllocEx(hProcess, IntPtr.Zero, Current_ImageBase.Length, /* AllocationType.Commit / 0x1000 | / AllocationType.Reserve / 0x2000, / MemoryProtection.ExecuteReadWrite */ 0x40);
           if (pNewAddr == IntPtr.Zero)
           {
               Console.WriteLine("_error_: Could not allocate memory in target process.\n");
               return false;
           }

[code]
throw new Win32Exception(Marshal.GetLastWin32Error());
[code]

inside the if, it will show what error you are getting from windows.

[SKIDROOTKIT]

Thank you @Paskowsky, this has helped a lot, made some progress but having trouble allocting memory in 64bit process, presumably I need to change this:

/* allocate memory for Input /
           Current_ImageBase.Length = (ushort)(input.Length 2);
           pNewAddr = VirtualAllocEx(hProcess, IntPtr.Zero, Current_ImageBase.Length, /* AllocationType.Commit / 0x1000 | / AllocationType.Reserve / 0x2000, / MemoryProtection.ExecuteReadWrite */ 0x40);
           if (pNewAddr == IntPtr.Zero)
           {
               Console.WriteLine("_error_: Could not allocate memory in target process.\n");
               return false;
           }

Are both your own process & the remote process running as the same architecture? (64 bit, not wow64)
Does hProcess have the PROCESS_VM_OPERATION process access right?

[ProtectedOverride]

My issue was i had changed the memory protection setting on VirtualAllocEx. I made some progress in that CommandLine was being blanked. Away for a couple of days but ill do some more testing when I get back to see if I can figure what I might have missed.

[ProtectedOverride]

Thanks for all the help, got this working, my final problem was I was using 0x78 rather then 0x70. Updated this and got it working on x64 :)