Process.NET

Process.NET

Process.NET is a tool for interacting with processes based around a library called "MemorySharp" by Jämes Ménétrey aka ZenLulz under the license on the pages linked below. Below are the mentioned authors original library's and his official website for the library.

https://github.com/ZenLulz/MemorySharp/

http://binarysharp.com/

Process.NET is simply a result of both me learning to program as a newer developer interested in both C# and native code, and the lack of a few features I desired in the library I enjoyed using as a new programmer.

NuGet of latest version: https://www.nuget.org/packages/Process.NET/

Features and notes

The core features of the original MemorySharp all or mostly library still exist. However, they have been implemented as a set of interfaces instead.

This is to allow different implementations of the already great design MemorySharp has, such as support for internal (aka, injected) operations or the need for specific implementation details.

Original features

• Most original features listed here still exist. https://github.com/ZenLulz/MemorySharp.

**General feature, changes, and additions from the original library **

• Interface based design.
• Keyboard and mouse hooks.
• Pattern scanning for both functions and data patterns.
• Reduced dependency on FASM.net and Improved x64 support.
• Patches.

Internal process (aka injected) support

• Detours
• Hooks
• Fast memory reads using pointers/marshaling tricks
• Implementation of existing features to better suite internal-process operations.

The main interface that brings others together

    public interface IProcess : IDisposable
    {
        System.Diagnostics.Process Native { get; }
        SafeMemoryHandle Handle { get; }
        IMemory Memory { get; }
        IThreadFactory ThreadFactory { get; }
        IModuleFactory ModuleFactory { get; }
        IMemoryFactory MemoryFactory { get; }
        IWindowFactory WindowFactory { get; }
        IProcessModule this[string moduleName] { get; }
        IPointer this[IntPtr addr] { get; }
    }

Also, this abstraction is used to provide easier memory read/write implementations.

…

Examples of new (and old) features##

Pattern scanning

The way pattern scanning has been added is through interfaces, and a default implementation for both function and data patterns have been included. In most cases, they will be all you need. Here are the default implementation examples.

Pattern scanning for a function offset:

…

Internal - Implementing the base WndProc hook class to invoke code inside the main thread from your injected C# program

…

And an example of using it:

    public class TestClass
    {
        private WindowHook _window;

        public void Install(IntPtr handle)
        {
            _window = new WindowHook(handle);
            _window.Enable();
            _window.Invoke(UserMessage.SayHi);
        }

        public void Uninstall()
        {
            _window.Invoke(WindowHook.UserMessage.SayBye);
            _window.Disable();
        }
    }

Keyboard / Mouse hooks

A basic keyboard hook use

    public class TestClass
    {
        private KeyboardHook _keyboardHook;

        public void Install(string name)
        {
            _keyboardHook = new KeyboardHook(name);
            _keyboardHook.KeyDownEvent += args =>
            {
                if (args.IsAltPressed && args.Key == Keys.A)
                    Console.WriteLine("The A and alt keys were pressed together.");

            };
        }
    }

And the mouse hook

    public class TestClass
    {
        private MouseHook _mouseHook;

        public void Install()
        {
           _mouseHook = new MouseHook();
            _mouseHook.LeftButtonDown +=
                (sender, args) =>
                    Console.WriteLine($"The mouse was at the position: {args.Position} when left clicked.");
            _mouseHook.Enable();
        }
    }

Remote and unmanaged code execution

Using the Marshal.GetDelegateForFunctionPointer to call user32.dll messagebox

…

Implementing the assembly factory the way MemorySharp does with FASM.Net and using it

…

Samples of the original library functionality included with this library below are included for more exposure of the features. The original documentation of them is better and still apples.

Window operations

…

Memory operations

…

Credits

• Jämes Ménétrey aka ZenLulz for writing the MemorySharp library.
• Apoc for his good post and GreyMagic library from which Detours and Patches are implemented.
• Zat from unknowncheats.me for just good post and decency to new programmers such as myself in general.
• aganonki from unknowncheats.me for his HackTools library and help with writing better more flexible code in general.
• Jadd @ ownedcore.com for his help with everything in general, but most specifically his WndProc hook example which got me started programming more seriously as the newb I was and am.
• miceiken for his icedflake project to reference.
• jeffora for his extmemory project to reference
• aevitas for his BlueRain project and Orion project to reference and is actually where the the base memory abstraction is based from.

Links to check out

• http://binarysharp.com/ (ZenLulz's website )
• https://github.com/aevitas
• https://github.com/aganonki
• https://github.com/BigMo (Zats github)
• https://github.com/jeffora
• https://github.com/miceiken
• https://github.com/Dramacydal/DirtyDeeds/tree/master/DirtyDeeds
• https://github.com/Dramacydal/WowMoPObjMgrTest
• https://github.com/unknowndev/CoolFish
• http://blog.ntoskr.nl (Jadds blog)
• http://www.ownedcore.com/
• http://www.unknowncheats.me/
• http://www.blizzhackers.cc/