Skip to content

Instantly share code, notes, and snippets.

@NaniteFactory
Last active May 31, 2022 03:10
Show Gist options
  • Save NaniteFactory/ed75f6b04f7a3f509a1b05ed131f0722 to your computer and use it in GitHub Desktop.
Save NaniteFactory/ed75f6b04f7a3f509a1b05ed131f0722 to your computer and use it in GitHub Desktop.
golang runtime bytes patch in windows
package main
import (
"unsafe"
"github.com/nanitefactory/memory"
"github.com/nanitefactory/outputdbg"
)
// #include <windows.h>
import "C"
func test() {
// target
lpBaseAddress := uintptr(0x004014D0) // where to patch
nSize := uintptr(6) // nSize AOB
// unprotect and protect back
protectBack, err := memory.Unprotect(lpBaseAddress, nSize)
outputdbg.LogPrintln("Unprotect called")
if err != nil {
outputdbg.LogPrintln(err)
}
defer func() {
err := protectBack()
outputdbg.LogPrintln("Protect back called")
if err != nil {
outputdbg.LogPrintln(err)
}
}()
// patch 1
arr := (*[6]byte)(unsafe.Pointer(lpBaseAddress)) // where to patch
outputdbg.LogPrintln(arr)
*arr = [6]byte{0x90, 0x90, 0x90, 0x90, 0x90, 0x90}
outputdbg.LogPrintln(arr)
// patch 2
toWrite := [6]byte{0x80, 0x80, 0x80, 0x80, 0x80, 0x80}
memory.WriteProcessMemory(lpBaseAddress, toWrite[:])
outputdbg.LogPrintln(arr)
}
// This test works nice as intended.
func main() {
test()
for {
// So you can see what's patched with your runtime debugger.
}
}
/*
2018/12/20 21:39:06 Unprotect called
2018/12/20 21:39:06 &[40 195 15 31 64 0]
2018/12/20 21:39:06 &[144 144 144 144 144 144]
2018/12/20 21:39:06 &[128 128 128 128 128 128]
2018/12/20 21:39:06 Protect back called
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment