LRNAB

LRNAB / PEBEditor.cs

Created July 5, 2014 09:56

Edit Image Path, Dll Path and Directory of a Process

	unsafe class PEBEditor
	{
	[DllImport("ntdll.dll")]
	static extern UInt32 NtQueryInformationProcess(IntPtr ProcessHandle, Int32 ProcessInformationClass, out Process_Basic_Information ProcessInformation, UInt32 ProcessInformationLength, out UInt32 ReturnLength);
	[DllImport("kernel32.dll")]
	static extern Boolean VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, UInt32 dwSize, UInt32 flNewProtect, out UInt32 lpflOldProtect);
	[DllImport("kernel32.dll")]
	static extern Boolean WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, UInt32 nSize, out UInt32 lpNumberOfBytesWritten);
	[DllImport("kernel32.dll")]
	static extern Boolean ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, UInt32 nSize, out UInt32 lpNumberOfBytesRead);