| 71 | } |
| 72 | |
| 73 | DWORD64 AllocateHiddenMemory(LPVOID lpAddress, SIZE_T dwSize,ENCRYPTDATAPROC Encrypt, DECRYPTDATAPROC Decrypt) |
| 74 | { |
| 75 | PVOID allocated = VirtualAlloc(lpAddress, dwSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); |
| 76 | if (allocated != NULL) |
| 77 | { |
| 78 | DWORD OldProtect = 0; |
| 79 | dwSize = ((dwSize-1) & 0xfffffffffffff000) + 0x1000;//size是0 就走不到这里 |
| 80 | |
| 81 | PROTECTEDMEMORY protected_mem = { 0 }; |
| 82 | protected_mem.lpAddress = (DWORD64)allocated; |
| 83 | protected_mem.dwSize = dwSize; |
| 84 | protected_mem.ExecutingProtection = FALSE; |
| 85 | protected_mem.Protected = TRUE; |
| 86 | protected_mem.Encrypt = Encrypt; |
| 87 | protected_mem.Decrypt = Decrypt; |
| 88 | |
| 89 | |
| 90 | if(!Encrypt) |
| 91 | EncryptData((DWORD64)allocated, dwSize); |
| 92 | else |
| 93 | Encrypt((DWORD64)allocated, dwSize); |
| 94 | |
| 95 | PagesOfNoAccessOfData.push_back(protected_mem); |
| 96 | |
| 97 | VirtualProtect(allocated, dwSize, PAGE_NOACCESS, &OldProtect); |
| 98 | } |
| 99 | |
| 100 | return (DWORD64)allocated; |
| 101 | } |
| 102 | |
| 103 | BOOL FreeHiddenMemory(DWORD64 lpAddress) |
| 104 | { |