Ive got some code that compares a file on the hard drive to the loaded memory copy and compares them. If it finds any differences i'm trying to overwrite the "Bad" memory with the original "Good" memory but it's crashing on me.
It works because i can detect changes and it will log that there are changes in the correct place when i manually alter them. However i can't seem to overwrite them!
It Crashes for me on this section:
Here's what i got so far:
if( ReadBuffer )
{
if( ReadFile( hFile, ReadBuffer, ReadSize, &ReadBytes, NULL ) )
{
DWORD Size = CodeSize;
DWORD Data = CodeBase;
DWORD Offset = CodeOffset;
if( OptionalHeader->FileAlignment == 0x200 )
{
Data = DataBase;
Size = CodeSize - DataOffset;
Offset = DataBase - CodeBase + 0x400;
Log( "\tRVAOffset: 0x%X (%d)", Offset, Offset );
}
int d = 0;
for( int i = 0; i < Size; ++i )
{
unsigned char ModuleData = *( unsigned char* )( Data + i );
if( ReadBuffer[ i + Offset ] != NULL && ModuleData != NULL && ReadBuffer[ i + Offset ] != ModuleData )
{
Log( "\t\tMismatch @ 0x%X [%02X != %02X]", Data + i, ReadBuffer[ i + Offset ], ModuleData );
++d;
if( d > 3 )
{
ReturnValue = false;
for( int j = 1; j < d; ++j )
{
unsigned char p = *( unsigned char* )( Data + i - j );
Log( "\t\t0x%08X [0x%02X] -> [0x%02X]", Data + i - j, p, ReadBuffer[ i + Offset - j ] );
DWORD PageFlag;
VirtualProtect( (LPVOID)( Data + i - j ), j, PAGE_EXECUTE_READWRITE, &PageFlag );
*( unsigned char* )( Data + i - j ) = ReadBuffer[ i + Offset - j ];
VirtualProtect( (LPVOID)( Data + i - j ), j, PageFlag, &PageFlag );
}
}
continue;
}
d = 0;
}
}
else
{
Log( "ReadFile Failed %d", GetLastError( ) );
}
free( ReadBuffer );
}