Module memory

Source

Structs§

MemProtect
MemoryPattern

Functions§

check_valid_region
This function will use the WinAPI to check if the region to scan is valid. A region is not valid when it’s free or when VirtualQuery returns an error at the moment of querying that region.
hook_function
Injects a jmp in the target address. The minimum length of it is 12 bytes. In case the space is bigger than 14 bytes, it’ll inject a non-dirty trampoline, and will nop the rest of the instructions.
resolve_module_path
Get DLL’s parent path
write_aob
Write an array of bytes to the desired ptr address.