Method RemapSelfImage

Self-Remapping Code/remap.cpp:8–133

#include "ntapi.h"

void remap::RemapSelfImage(const PVOID RegionBase)
{
    PE_HEADER pe;
    if (!FillPEHeader(SIZE_T(RegionBase), pe))
        return;

    // Create a section to store the remapped image.
    HANDLE hRemapSection = NULL;
    LARGE_INTEGER sectionMaxSize = {};
    sectionMaxSize.QuadPart = pe.optionalHeader->SizeOfImage;
    ntapi::NTSTATUS status = ntapi::NtCreateSection(&hRemapSection,
                                                    SECTION_ALL_ACCESS,
                                                    NULL,
                                                    &sectionMaxSize,
                                                    PAGE_EXECUTE_READWRITE,
                                                    SEC_COMMIT | ntapi::SEC_NO_CHANGE,
                                                    NULL);
    if (status != ntapi::STATUS_SUCCESS)
    {
        printf("NtCreateSection failed:  0x%08X.\n", status);
        return;
    }

    // Map an image-sized view of the remap section with write protection.
    PVOID copyViewBase = NULL;
    LARGE_INTEGER copySectionOffset = {};
    SIZE_T copyViewSize = 0;
    status = ntapi::NtMapViewOfSection(hRemapSection,
                                       GetCurrentProcess(),
                                       &copyViewBase,
                                       0,
                                       pe.optionalHeader->SizeOfImage,
                                       &copySectionOffset,
                                       &copyViewSize,
                                       ntapi::ViewUnmap,
                                       0,
                                       PAGE_READWRITE);
    if (status != ntapi::STATUS_SUCCESS)
    {
        printf("NtMapViewOfSection failed for copy view:  0x%08X.\n", status);
        return;
    }

    // Write the image to the physical memory represented by the remap section.
    memcpy(copyViewBase, PVOID(pe.optionalHeader->ImageBase), pe.optionalHeader->SizeOfImage);

    // Unmap the image.
    status = ntapi::NtUnmapViewOfSection(GetCurrentProcess(), PVOID(pe.optionalHeader->ImageBase));
    if (status != ntapi::STATUS_SUCCESS)
    {
        printf("NtUnmapViewOfSection failed for image:  0x%08X.\n", status);
        return;
    }

    // Reconstruct the image by mapping aligned views of the remap section for the image's PE Sections.
    // Each view represents one or more PE Sections (including the PE Header).
    // ntapi::SEC_NO_CHANGE causes future attempts to change the protection of pages in these views to 
    // fail with status code STATUS_INVALID_PAGE_PROTECTION.