Question about PEB Patching - Help me fix it

Bejn

New member
Joined
Sep 24, 2011
Messages
1
Programming Experience
3-5
VB.NET:
    <StructLayout(LayoutKind.Sequential)> _
    Public Structure PROCESS_BASIC_INFORMATION
        Public ExitStatus As IntPtr
        Public PebBaseAddress As IntPtr
        Public AffinityMask As IntPtr
        Public BasePriority As IntPtr
        Public UniqueProcessId As IntPtr
        Public InheritedFromUniqueProcessId As IntPtr
    End Structure


    <DllImport("kernel32.dll")> _
    Private Shared Function OpenProcess(ByVal Access As UInt32, ByVal bInheritHandle As Boolean, ByVal PID As Integer) As IntPtr
    End Function





    <DllImport("ntdll.dll")> _
    Private Shared Function NtQueryInformationProcess(ByVal hProcess As IntPtr, ByVal processInformationClass As UInt32, ByRef processBasicInformation As PROCESS_BASIC_INFORMATION, ByVal processInformationLength As Integer, ByRef returnLength As UInt32) As UInt32
    End Function




    <DllImport("kernel32.dll")> _
    Private Shared Function VirtualAllocEx(ByVal process As IntPtr, ByVal address As IntPtr, ByVal size As UInt32, ByVal type As UInt32, ByVal protect As UInt32) As IntPtr
    End Function

    <DllImport("ntdll.dll")> _
    Private Shared Function ZwReadVirtualMemory(ByVal hProcess As IntPtr, ByVal address As IntPtr, <Out()> ByRef buffer As Integer, ByVal Size As UInt64, ByRef ReadSize As UInt64) As UInt32
    End Function

    <DllImport("ntdll.dll")> _
    Private Shared Function ZwUnmapViewOfSection(ByVal process As IntPtr, ByVal address As IntPtr) As Boolean
    End Function

    <DllImport("ntdll.dll")> _
    Private Shared Function ZwWriteVirtualMemory(ByVal hProcess As IntPtr, ByVal address As IntPtr, ByVal buffer As Byte(), ByVal Size As UInt64, ByRef ReadSize As UInt64) As UInt32
    End Function




    Public Shared Function ReplaceExecutablePath(ByVal PID As Integer, ByVal NewString As String) As Boolean
        Dim obj2 As Object
        Try
            Dim num As Integer
            Thread.Sleep(1)
            Dim hProcess As IntPtr = OpenProcess(&H1F0FFF, False, PID)
            Dim processBasicInformation As New PROCESS_BASIC_INFORMATION
            Dim returnLength As UInt32 = 0
            NtQueryInformationProcess(hProcess, 0, processBasicInformation, Marshal.SizeOf(processBasicInformation), returnLength)
            Dim bytes As Byte() = Encoding.Unicode.GetBytes(NewString)
            Dim ptr2 As New IntPtr
            Dim address As New IntPtr((processBasicInformation.PebBaseAddress.ToInt32 + 12))
            Dim num3 As Integer = CInt(ptr2)
            Dim readSize As UInt64 = 0
            ZwReadVirtualMemory(hProcess, address, num3, 4, readSize)
            ptr2 = CType(num3, IntPtr)
            address = New IntPtr((ptr2.ToInt32 + 20))
            readSize = 0
            ZwReadVirtualMemory(hProcess, address, num, 4, readSize)
            Dim ptr3 As IntPtr = VirtualAllocEx(hProcess, IntPtr.Zero, CType(bytes.Length, UInt32), &H1000, 4)
            readSize = 0
            ZwWriteVirtualMemory(hProcess, ptr3, bytes, CULng(bytes.Length), readSize)
            Dim buffer As Byte() = BitConverter.GetBytes(Short.Parse(Convert.ToString(bytes.Length)))
            address = New IntPtr((num + &H20))
            readSize = 0
            ZwWriteVirtualMemory(hProcess, address, BitConverter.GetBytes(ptr3.ToInt32), 4, readSize)
            address = New IntPtr((num + 30))
            readSize = 0
            ZwWriteVirtualMemory(hProcess, address, buffer, 2, readSize)
            address = New IntPtr((num + &H1C))
            readSize = 0
            ZwWriteVirtualMemory(hProcess, address, buffer, 2, readSize)
            obj2 = True
        Catch exception1 As Exception
            obj2 = False
        End Try
        Return obj2

    End Function

This is my code used for PEB Patching. Only thing that is troubling me is and error when i try to use it in my application.

Please, help me fix it.
 
Back
Top