Native WriteProcessMemory Api Replacement

Post date: Sep 15, 2010 12:25:15 AM

This unit enables you to replace WriteProcessMemory calls with the native api equivalents.

The attached delphi source code details usage of the unit in the External Downloader example.

unit uWriteProcessMemory;
{
  Author: Counterstrikewi
  Thank you: fijack
  Compiled: Delphi 2007
  Website: www.delphibasics.info
}
interface
uses
  Windows;
function xWriteProcessMemory(hProcess: THandle;
                             lpBaseAddress: Pointer;
                             lpBuffer: Pointer;
                             nSize: DWORD;
                         var lpNumberOfBytesWritten: DWORD
                             ): BOOL; stdcall;
implementation
type
  PPVOID = ^Pointer;
  PULONG = ^LongWord;
  TNtProtectVirtualMemory = function (ProcessHandle: THandle; BaseAddress: PPVOID; ProtectSize: PULONG; NewProtect: Longword; OldProtect: PULONG): Longint; stdcall;
  TNtWriteVirtualMemory = function (ProcessHandle: THandle; BaseAddress: Pointer; Buffer: Pointer; BufferLength: Longword; ReturnLength: PULONG): Longint; stdcall;
  TNtFlushInstructionCache = function (ProcessHandle: THandle; BaseAddress: Pointer; FlushSize: Longword): Longint; stdcall;
var
  hNtdll : THandle;
  xNtProtectVirtualMemory : TNtProtectVirtualMemory;
  xNtWriteVirtualMemory : TNtWriteVirtualMemory;
  xNtFlushInstructionCache : TNtFlushInstructionCache;
function xWriteProcessMemory(hProcess: THandle;
                             lpBaseAddress: Pointer;
                             lpBuffer: Pointer;
                             nSize: DWORD;
                         var lpNumberOfBytesWritten: DWORD
                             ): BOOL; stdcall;
var
  NumberOfBytesWritten, OldAccessProtection, Status : DWord;
begin
  Result := False;
  lpNumberOfBytesWritten := 0;
  Status := xNtProtectVirtualMemory(hProcess, @lpBaseAddress, @nSize, PAGE_READWRITE, @OldAccessProtection);
  if Status = 0 then
  begin
    Status := xNtWriteVirtualMemory( hProcess, lpBaseAddress, lpBuffer, nSize, @NUmberOfBytesWritten);
    if (Status = 0) and (NumberOfBytesWritten = nSize) then
    begin
      Status := xNtFlushInstructionCache(hProcess,lpBaseAddress,nSize);
      If Status = 0 then
      begin
        lpNumberOfBytesWritten := NumberOfBytesWritten;
        Result := True;
      end;
    end;
  end;
end;
initialization
  hNtdll := GetModuleHandleA('ntdll.dll');
  xNtProtectVirtualMemory := GetProcAddress(hNtdll, 'NtProtectVirtualMemory');
  xNtWriteVirtualMemory := GetProcAddress(hNtdll, 'NtWriteVirtualMemory');
  xNtFlushInstructionCache := GetProcAddress(hNtdll, 'NtFlushInstructionCache');
end.

Only Delphi source code is included in the archive.