Function nt_write_virtual_memory

loader/dinvoke/src/lib.rs:1017–1049

Dynamically calls NtWriteVirtualMemory. It will return the NTSTATUS value returned by the call.

(mut handle: HANDLE, base_address: PVOID, mut buffer: PVOID, mut size: usize, bytes_written: *mut usize)

///
/// It will return the NTSTATUS value returned by the call.
pub fn nt_write_virtual_memory (mut handle: HANDLE, base_address: PVOID, mut buffer: PVOID, mut size: usize, bytes_written: *mut usize) -> i32 {

    unsafe 
    {
        let ret;
        let func_ptr: data::NtWriteVirtualMemory;
        let ntdll = get_module_base_address(&lc!("ntdll.dll"));

        if HARDWARE_BREAKPOINTS
        {
            let addr = get_function_address(ntdll, &lc!("NtWriteVirtualMemory")) as usize;
            HARDWARE_EXCEPTION_FUNCTION =  ExceptionHandleFunction::NtWriteVirtualMemory;
            NT_WRITE_VIRTUAL_MEMORY_ARGS.handle = handle;
            NT_WRITE_VIRTUAL_MEMORY_ARGS.base_address = base_address;
            NT_WRITE_VIRTUAL_MEMORY_ARGS.buffer = buffer;
            NT_WRITE_VIRTUAL_MEMORY_ARGS.size = size;
            set_hardware_breakpoint(find_syscall_address(addr));

            handle = HANDLE {0: -1};
            let buff = vec![20];
            buffer = std::mem::transmute(buff.as_ptr());
            size = buff.len();
        }

        dynamic_invoke!(ntdll,&lc!("NtWriteVirtualMemory"),func_ptr,ret,handle,base_address,buffer,size,bytes_written);

        match ret {
            Some(x) => return x,
            None => return -1,
        }
    }

}

/// Dynamically calls NtAllocateVirtualMemory.
///