Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NtCreateSection #17

Closed
wants to merge 7 commits into from
Closed

NtCreateSection #17

wants to merge 7 commits into from

Conversation

nodauf
Copy link
Contributor

@nodauf nodauf commented Dec 14, 2021

Add NtCreateSection

@nodauf
Copy link
Contributor Author

nodauf commented Dec 15, 2021

A quick and dirty code to test this function:

        // NtOpenFile
	var fileHandle ntdll.Handle
	var objectAttributs ntdll.ObjectAttributes
	var ioStatusBlock ntdll.IoStatusBlock
	objectAttributs.Length = uint32(unsafe.Sizeof(objectAttributs))
	objectAttributs.ObjectName = ntdll.NewUnicodeString(`\??\` + path)
	objectAttributs.Attributes = 0x40
	status := ntdll.NtOpenFile(&fileHandle, ntdll.FILE_READ_DATA|ntdll.FILE_EXECUTE|ntdll.FILE_READ_ATTRIBUTES|ntdll.SYNCHRONIZE, &objectAttributs, &ioStatusBlock, ntdll.FILE_SHARE_DELETE|ntdll.FILE_SHARE_READ, ntdll.FILE_NON_DIRECTORY_FILE|ntdll.FILE_SYNCHRONOUS_IO_NONALERT)
	fmt.Println(status)

        // NtCreateSection
	var sectionHandle ntdll.Handle
	status = ntdll.NtCreateSection(&sectionHandle, ntdll.SECTION_ALL_ACCESS, nil, nil, ntdll.PAGE_READONLY, ntdll.SEC_IMAGE, fileHandle)
	fmt.Println(status)
	fmt.Println(fileHandle)

@hillu
Copy link
Owner

hillu commented Dec 17, 2021

Edited and merged the commit set. Everythinig should be there as of 0dd7663. Thank you!

@hillu hillu closed this Dec 17, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants