Search between a Gas Station

LdrLoadDll Crash I need to load a library via ntdll's LdrLoadDll function, in this case the library I am loading is user32.dll. However, when I try to load user32.dll, an access violation exception is thrown on the call(last line). I am unsure what the cause of this error could be. Am I creating the unicode string incorrectly? LdrLoadDll typedef (__stdcall *LdrLoadDll)( IN PWCHAR PathToFile OPTIONAL, IN ULONG Flags OPTIONAL, IN PUNICODE_STRING ModuleFileName, OUT PHANDLE ModuleHandle); LdrLoadDll LdrLoadDllStruct = (LdrLoadDll)GetProcAddress(ntdllHandle, "LdrLoadDll"); typedef (__stdcall *RtlInitUnicodeString)( PUNICODE_STRING DestinationString, PCWSTR SourceString); RtlInitUnicodeString RtlInitUnicodeStringStruct = (RtlInitUnicodeString)GetProcAddress(ntdllHandle, "RtlInitUnicodeString"); HMODULE hModule = 0; UNICODE_STRING unicodestring; RtlInitUnicodeStringStruct(&unicodestrin...

Memory Mapped Region initial data I want to create memory-mapped region using CreateFileMapping without any specific disk-file bound, but bound (using MapViewOfFileEx ) to a specific memory address. Protection of such region needs to be read-only from beginning. Then, I cannot write data to such a region. If this region would be created for specific disk-file, initial data would come from file content. How I can fill this read-only region with initial data? CreateFileMapping MapViewOfFileEx Example: Most Windows processes have memory regions which are mapped (and not bound to any file path) and read-only since creation, they contain data. How was this achieved? How were these regions filled with data? "bound(using MapViewOfFileEx) to specific process memory address" It's not clear what you mean by that. You can only map shared memory into your own process, not some other process. Sounds like an XY problem. What's your actual goal with all...

How to properly capture user's keystrokes in C#, i.e. respecting SHIFT key etc I have written the following C# program to capture the user's keystrokes. It works perfectly, except that all keys are logged as lower-case without taking the SHIFT key into account (see below). I have read all of the Win32 API's documentation. Still I much be missing something. How can I correct this program to log keystrokes properly? If I enter HelloWorld!!! , the following keys are output in log.txt: HelloWorld!!! h e l l o w o r l d 1 1 1 I.e., it does not consider SHIFT, which is the purpose of GetKeyboardState() ? GetKeyboardState() The program: using System; using System.IO; using System.Diagnostics; using System.Runtime.InteropServices; using System.Windows.Forms; using System.Text; namespace CSharpKeyLogger { public static class Program { [DllImport("user32.dll")] private static extern IntPtr SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hMod, uint...

GetCursorInfo WinForms vs WPF C# I am having trouble of transferring pieces of my code from WinForms to WPF to have better control over the UI. The following piece of code return True in WinForms but False in WPF. I suspect WPF panels have effects on the cursor so I tried start the app minimized but it still failed. Since the GetCursorInfo is PInvoke I think it should work the same within a programming language. Any advices on this? private CURSORINFO ci; [StructLayout(LayoutKind.Sequential)] public struct CURSORINFO { public Int32 cbSize; // Specifies the size, in bytes, of the structure. public Int32 flags; // Specifies the cursor state. public IntPtr hCursor; // Handle to the cursor. Point point; // Should already marshal correctly. } [DllImport("user32.dll")] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool GetCursorInfo(ref CURSORINFO pci); public MainWindow() { ...