CreateRemoteThread, WriteProcessMemory and ReadProcessMemory

CHANGES.md

@@ -16,6 +16,8 @@ Features
 * [#271](https://github.com/twall/jna/pull/271): Added `com.sun.jna.platform.win32.Gdi32.ChoosePixelFormat` and `SetPixelFormat` - [@kc7bfi](https://github.com/kc7bfi).
 * [#271](https://github.com/twall/jna/pull/271): Added `com.sun.jna.platform.win32.OpenGL32`, `OpenGL32Util` and `WinOpenGL` - [@kc7bfi](https://github.com/kc7bfi).
 * [#250](https://github.com/twall/jna/pull/250): Added `com.sun.jna.platform.win32.Kernel32.GetPrivateProfileSection`, `GetPrivateProfileSectionNames` and `WritePrivateProfileSection` and corresponding `Kernel32Util` helpers - [@quipsy-karg](https://github.com/quipsy-karg).
+* [#286](https://github.com/twall/jna/pull/286): Added in com.sun.jna.platform.win32.Kernel32: CreateRemoteThread, WritePocessMemory and ReadProcessMemory - [@sstokic-tgm](https://github.com/sstokic-tgm).
+
 
 Bug Fixes
 ---------

contrib/platform/src/com/sun/jna/platform/win32/Kernel32.java

@@ -2042,4 +2042,89 @@ boolean WritePrivateProfileString(String lpAppName, String lpKeyName,
  * @return If the function succeeds, the return value is nonzero. If the function fails, the return value is zero.
  */
  boolean WritePrivateProfileSection(String lpAppName, String lpString, String lpFileName); 
+
+ /**
+ * Creates a thread that runs in the virtual address space of another process.
+ * 
+ * @param hProcess
+ * A handle to the process in which the thread is to be created. The handle must have the PROCESS_CREATE_THREAD, 
+ * PROCESS_QUERY_INFORMATION, PROCESS_VM_OPERATION, PROCESS_VM_WRITE, and PROCESS_VM_READ access rights, 
+ * and may fail without these rights on certain platforms.
+ * @param lpThreadAttributes
+ * A pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new thread and 
+ * determines whether child processes can inherit the returned handle. If lpThreadAttributes is NULL, the thread gets a 
+ * default security descriptor and the handle cannot be inherited. The access control lists (ACL) in the default 
+ * security descriptor for a thread come from the primary token of the creator.
+ * @param dwStackSize
+ * The initial size of the stack, in bytes. The system rounds this value to the nearest page. 
+ * If this parameter is 0 (zero), the new thread uses the default size for the executable.
+ * @param lpStartAddress
+ * A pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and 
+ * represents the starting address of the thread in the remote process. The function must exist in the remote process.
+ * @param lpParameter
+ * A pointer to a variable to be passed to the thread function.
+ * @param dwCreationFlags
+ * The flags that control the creation of the thread.
+ * 0 ... The thread runs immediately after creation.
+ * CREATE_SUSPENDED => 0x00000004 ... The thread is created in a suspended state, and does not run until the ResumeThread function is called.
+ * STACK_SIZE_PARAM_IS_A_RESERVATION => 0x00010000 ... The dwStackSize parameter specifies the initial reserve size of the stack. If this flag is not specified, dwStackSize specifies the commit size.
+ * @param lpThreadId
+ * A pointer to a variable that receives the thread identifier. If this parameter is NULL, the thread identifier is not returned.
+ * 
+ * @return If the function succeeds, the return value is a handle to the new thread. If the function fails, the return value is NULL. 
+ * To get extended error information, call GetLastError.
+ * 
+ * Note that CreateRemoteThread may succeed even if lpStartAddress points to data, code, or is not accessible. If the start address is 
+ * invalid when the thread runs, an exception occurs, and the thread terminates. Thread termination due to a invalid start address is 
+ * handled as an error exit for the thread's process. This behavior is similar to the asynchronous nature of CreateProcess, where the 
+ * process is created even if it refers to invalid or missing dynamic-link libraries (DLL).
+ */
+ HANDLE CreateRemoteThread(HANDLE hProcess, WinBase.SECURITY_ATTRIBUTES lpThreadAttributes, int dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, Pointer lpParameter, DWORD dwCreationFlags, Pointer lpThreadId);
+
+ /**
+ * Writes data to an area of memory in a specified process. The entire area to be written to must be accessible or the operation fails.
+ * 
+ * @param hProcess
+ * A handle to the process memory to be modified. The handle must have PROCESS_VM_WRITE and PROCESS_VM_OPERATION 
+ * access to the process.
+ * @param lpBaseAddress
+ * A pointer to the base address in the specified process to which data is written. Before data transfer occurs, the system 
+ * verifies that all data in the base address and memory of the specified size is accessible for write access, and if it is not 
+ * accessible, the function fails.
+ * @param lpBuffer
+ * A pointer to the buffer that contains data to be written in the address space of the specified process.
+ * @param nSize
+ * The number of bytes to be written to the specified process.
+ * @param lpNumberOfBytesWritten
+ * A pointer to a variable that receives the number of bytes transferred into the specified process. This parameter is optional.
+ * If lpNumberOfBytesWritten is NULL, the parameter is ignored.
+ * 
+ * @return If the function succeeds, the return value is nonzero.
+ * If the function fails, the return value is 0 (zero). To get extended error information, call GetLastError.
+ * The function fails if the requested write operation crosses into an area of the process that is inaccessible.
+ */
+ boolean WriteProcessMemory(HANDLE hProcess, Pointer lpBaseAddress, Pointer lpBuffer, int nSize, IntByReference lpNumberOfBytesWritten);
+
+ /**
+ * Reads data from an area of memory in a specified process. The entire area to be read must be accessible or the operation fails.
+ * 
+ * @param hProcess
+ * A handle to the process with memory that is being read. The handle must have PROCESS_VM_READ access to the process.
+ * @param lpBaseAddress
+ * A pointer to the base address in the specified process from which to read. Before any data transfer occurs, the system 
+ * verifies that all data in the base address and memory of the specified size is accessible for read access, and if it is not 
+ * accessible the function fails.
+ * @param lpBuffer
+ * A pointer to a buffer that receives the contents from the address space of the specified process.
+ * @param nSize
+ * The number of bytes to be read from the specified process.
+ * @param lpNumberOfBytesRead
+ * A pointer to a variable that receives the number of bytes transferred into the specified buffer.
+ * If lpNumberOfBytesRead is NULL, the parameter is ignored.
+ * 
+ * @return If the function succeeds, the return value is nonzero.
+ * If the function fails, the return value is 0 (zero). To get extended error information, call GetLastError.
+ * The function fails if the requested read operation crosses into an area of the process that is inaccessible.
+ */
+ boolean ReadProcessMemory(HANDLE hProcess, Pointer lpBaseAddress, Pointer lpBuffer, int nSize, IntByReference lpNumberOfBytesRead);
 }

contrib/platform/test/com/sun/jna/platform/win32/Kernel32Test.java

@@ -593,4 +593,80 @@ public final void testWritePrivateProfileSection() throws IOException {
  reader.close();
  }
 
+ public void testWriteProcessMemory() {
+
+ Kernel32 kernel = Kernel32.INSTANCE;
+
+ final int dwDesiredAccess = 0x1F0FFF; //ALL_ACCESS
+ final boolean bInheritHandle = true;
+ final int dwProcessId = 5088; //PID of Process
+
+ HANDLE handle = kernel.OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
+
+ if (handle == null) {
+ int lastError = kernel.GetLastError();
+ System.out.println("lastError = " + lastError);
+ throw new RuntimeException("no such pid");
+ }
+
+ int lpBaseAddress = 0x148712A4; //Address to manipulate
+ int nSize = 32; //size of address type
+
+ Memory lpBuffer = new Memory(nSize);
+ int dataToWrite = 1;
+ lpBuffer.setInt(0, dataToWrite);
+ boolean successWrite = kernel.WriteProcessMemory(handle, lpBaseAddress, lpBuffer, nSize, null);
+
+ assertTrue(successWrite);
+
+ lpBuffer.finalize();
+ }
+
+ public void testReadProcessMemory() {
+
+ Kernel32 kernel = Kernel32.INSTANCE;
+
+ final int dwDesiredAccess = 0x1F0FFF; //ALL_ACCESS
+ final boolean bInheritHandle = true;
+ final int dwProcessId = 5088; //PID of Process
+
+ HANDLE handle = kernel.OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
+
+ if (handle == null) {
+ int lastError = kernel.GetLastError();
+ System.out.println("lastError = " + lastError);
+ throw new RuntimeException("no such pid");
+ }
+
+ int lpBaseAddress = 0x034685FC; // Address to read
+ int nSize = 8;
+ Memory lpBuffer = new Memory(nSize);
+ char[] buffer = new char[lpBuffer + 1];
+ boolean successRead = kernel.ReadProcessMemory(handle, lpBaseAddress, buffer, nSize, null);
+
+ assertTrue(successRead);
+
+ lpBuffer.finalize();
+ }
+
+ public void testCreateRemoteThread() {
+
+ Kernel32 kernel = Kernel32.INSTANCE;
+
+ final int dwDesiredAccess = 0x1F0FFF; //ALL_ACCESS
+ final boolean bInheritHandle = true;
+ final int dwProcessId = 5088; //PID of Process
+
+ HANDLE hProc = kernel.OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
+
+ if (hProc == null) {
+ int lastError = kernel.GetLastError();
+ System.out.println("lastError = " + lastError);
+ throw new RuntimeException("no such pid");
+ }
+
+ HANDLE hRemoteThread = kernel.CreateRemoteThread(hProc, null, 0, null, null, 0, null);
+ assertNull(hRemoteThread);
+ assertEquals(WinError.ERROR_INVALID_HANDLE, kernel.GetLastError());
+ }
 }