[ProtectedOverride]

Hi,

I have been playing around reading and writing to the PEB of an external process using ReadProcessMemory and WriteProcessMemory which is part of kernel32.dll. Whilst I am able to read values, such as CommandLine, I do not seem to be able to then change this by using WriteProcessMemory. Does anyone have an example of this that would help me do this?

Thanks
James

[HFDone]

you need to use unicode string

[ProtectedOverride]

This is what I am trying:
byte[] dataBuffer = Encoding.Unicode.GetBytes("NEW STRING");
IntPtr bytesWritten = IntPtr.Zero;
int cnt = 0;

WriteProcessMemory(handle, us.Buffer, dataBuffer, dataBuffer.Length, ref cnt)

[HFDone]

search for peb patch and see how its done

[GraeskMytologi]

Hi,

I have been playing around reading and writing to the PEB of an external process using ReadProcessMemory and WriteProcessMemory which is part of kernel32.dll. Whilst I am able to read values, such as CommandLine, I do not seem to be able to then change this by using WriteProcessMemory. Does anyone have an example of this that would help me do this?

Thanks
James

You need to change the protection level with VirtualProtectEx

[Paskowsky]

Hi,

I have been playing around reading and writing to the PEB of an external process using ReadProcessMemory and WriteProcessMemory which is part of kernel32.dll. Whilst I am able to read values, such as CommandLine, I do not seem to be able to then change this by using WriteProcessMemory. Does anyone have an example of this that would help me do this?

Thanks
James

What error WriteProcessMemory shows you?

If i remeber correctly in PEB strings are stored as UNICODE_STRING

Code

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    WCHAR *Buffer;
} UNICODE_STRING, PUNICODE_STRING;

so to replace a string with another you can allocate a new RW memory page, write your custom string and edit the PEB CommandLine pointer and lenght to point to allocated value.

Regards,
Paskowsky

[Skofos]

always using @Amaa game trainer. WriteProcessMemory and ReadProcessMemory : GitHub - ama6nen/project-autism: Project-autism (old growtopia trainer) 2017 source code

[ProtectedOverride]

@HFDone I tried the example back from 2011:

pastebin dot com/8mujr2ps

However I find I am taking this path:

if (!WriteProcessMemory(hProcess, rtlUserProcParamsAddress + 0x70, (IntPtr)(&Current_ImageBase), Marshal.SizeOf(typeof(UNICODE_STRING)), out intPtrOutput))
{
Console.WriteLine("ERROR: Failed to reflect change back to PEB.\n");
return false;
}

Could this be that the code has some "32Bit" specifics that need changing for working with 64Bit? I have not worked at this low of a level when programming before so just trying to understand.

Thanks
James

---

Further update, I had a play with someone else implementation:

pastebin dot com/Z9hdggtM

However this part:

status = NtProtectVirtualMemory(hProc, ref lpRemoteCommandLine, ref dwSizeUnicodeString, 0x04 /* read, write */, ref dwOldProtections);

Causes the applicaiton to exit with an "Access Violation"..Is this just .NET doing something I can bypass?

[HFDone]

are you using v2 using System; using System.Linq; using System.Collections.Generic; using Syst - Pastebin.com
you should enable safe code in vs to use it
you have wrong value in the second param should be + 0x40
Current_ImageBase.buffer = pNewAddr;
if (!WriteProcessMemory(hProcess, rtlUserProcParamsAddress + 0x40, (IntPtr)(&Current_ImageBase), Marshal.SizeOf(typeof(UNICODE_STRING)), out intPtrOutput)) {
Console.WriteLine("ERROR: Failed to reflect change back to PEB.\n");
return false;
}

[ProtectedOverride]

is that the "Allow unsafe code: enabled" in Build properties? I have that ticked. Tried with 0x70 , as I noted 0x40 was for windows title..oops but getting the same error, the bool returns false when using this example... hmmm

[HFDone]

create new project c&p the pastebin code run notepad and try it

[ProtectedOverride]

ok so, if I comiple as x64 and run it against an x64 process this is when I get the above error. If I compile as x32 and run against x32 process I get no error. However I do not see the change reflected in Task Manager under "Command Line". I do close and reopen to get it to refresh it's values. Any ideas?

---

Update:

It seems it is working for 32Bit against 32Bit when I check in process explorer but Task manager does not reflect the change, any ideas if I can mitigate this? Regarding the 64Bit problem I am guessing I need to look at the variable types used maybe?

[HFDone]

the patch is in memory and probably the task get the cmd from the file
for 64 bit you need 64 bit address or you can use anycpu option to work with both

[ProtectedOverride]

but the command is only in memory? Lets sya I execute SomeProcess.exe -t SuperSecretArgument ... Are you saying I can not "overwrite" the "SuperSecretArgument" from task manager?
Thanks!

[HFDone]

task just show you the process info
anyway you dont really want the task show you change it