Function OperateProcessMemory

Source/Client/NM_Sys/API/ProcessesUtils.cpp:302–391

		_IRQL_requires_max_(APC_LEVEL)
		NTSTATUS OperateProcessMemory(PEPROCESS Process, __in_data_source(USER_MODE) PVOID BaseAddress, PVOID Buffer, ULONG Size, MEMORY_OPERATION_TYPE Operation)
		{
			if (!Process)
				return STATUS_INVALID_PARAMETER_1;

			if (!BaseAddress || AddressRange::IsKernelAddress(BaseAddress)) 
				return STATUS_INVALID_PARAMETER_2;

			if (!Buffer) 
				return STATUS_INVALID_PARAMETER_3;

			if (!Size)
				return STATUS_INVALID_PARAMETER_4;

			// Attempt to lock process memory from freeing:
			HANDLE hProcessSecure = NULL;
			if (!VirtualMemory::SecureProcessMemory(Process, BaseAddress, Size, PAGE_READONLY, &hProcessSecure))
				return STATUS_NOT_LOCKED;

			// Attempt to lock buffer memory if it is usermode memory:
			HANDLE hBufferSecure = NULL;
			BOOLEAN IsBufferUsermode = AddressRange::IsUserAddress(Buffer);
			if (IsBufferUsermode) 
			{
				if (!VirtualMemory::SecureMemory(Buffer, Size, PAGE_READWRITE, &hBufferSecure)) 
				{
					VirtualMemory::UnsecureProcessMemory(Process, hProcessSecure);
					return STATUS_NOT_LOCKED;
				}
			}

			// Attempt to map process memory:
			Mdl::MAPPING_INFO ProcessMapping = {};
			NTSTATUS Status = Mdl::MapMemory(&ProcessMapping, Process, NULL, BaseAddress, Size);

			if (!NT_SUCCESS(Status)) 
			{ 
				VirtualMemory::UnsecureProcessMemory(Process, hProcessSecure);

				if (IsBufferUsermode) 
					VirtualMemory::UnsecureMemory(hBufferSecure);

				return STATUS_NOT_MAPPED_VIEW;
			}

			// Attempt to map buffer memory:
			Mdl::MAPPING_INFO BufferMapping = {};

			Status = Mdl::MapMemory(&BufferMapping, NULL, NULL, Buffer, Size);
			if (!NT_SUCCESS(Status)) 
			{
				Mdl::UnmapMemory(&ProcessMapping);

				VirtualMemory::UnsecureProcessMemory(Process, hProcessSecure);

				if (IsBufferUsermode) 
					VirtualMemory::UnsecureMemory(hBufferSecure);