Method MapSectionForShellCode

KernelLibrary/Section.cpp:411–464

}

NTSTATUS Section::MapSectionForShellCode(DllStats* pDllStats,
	PVOID* pBaseAddr) {
	ASSERT(pDllStats);
	NTSTATUS status = STATUS_SUCCESS;

	PVOID baseAddress = nullptr;

	if (!pDllStats->IsVaid()) {
		status = STATUS_INVALID_PARAMETER_MIX;
		return status;
	}

	PVOID reservedAddr = pDllStats->PreferredAddress;
	SIZE_T regionSize = pDllStats->SizeOfImage;

	status = ZwAllocateVirtualMemory(NtCurrentProcess(),
		&reservedAddr, 0, &regionSize,
		MEM_RESERVE, PAGE_NOACCESS);

	if (status != STATUS_SUCCESS &&
		status != STATUS_CONFLICTING_ADDRESSES) {
		LogError("Error: (0x%X) MapSectionForShellCode > ZwAllocateVirtualMemory, PID=%u, sectionType=%c, "
			"addr=0x%p, sz=0x%X\n",
			status, PsGetCurrentProcessId(),
			pDllStats->Type, pDllStats->PreferredAddress,
			pDllStats->SizeOfImage);
		return status;
	}

	SIZE_T viewSize = 0;
	LARGE_INTEGER offset{};

	status = MmMapViewOfSection(pDllStats->Section,
		IoGetCurrentProcess(), &baseAddress, 0, 0,
		&offset, &viewSize, ViewUnmap, 0, PAGE_EXECUTE);

	if (!NT_SUCCESS(status)) {
		LogError("ERROR: (0x%X) MapSectionForShellCode > MmMapViewOfSection, "
			"PID = % u, sectionType = % c",
			status,
			PsGetCurrentProcessId(),
			pDllStats->Type
		);
		return status;
	}

	regionSize = 0;
	status = ZwFreeVirtualMemory(NtCurrentProcess(), &reservedAddr, &regionSize, MEM_RELEASE);

	if (pBaseAddr)
		*pBaseAddr = baseAddress;

	return status;
}