CreateFileMapping

Shellcode Loader

Allocate memory for executing shellcode later.

Overview

Alokasi melalui memory mapping dengan CreateFileMapping dan beberapa kombinasi MapViewOfFile/MapViewOfFileEx/MapViewOfFile2/MapViewOfFile3.

HANDLE CreateFileMappingA (HANDLE hFile, LPSECURITY_ATTRIBUTES lpFileMappingAttributes, DWORD flProtect, DWORD dwMaximumSizeHigh, DWORD dwMaximumSizeLow, LPCSTR lpName);

HANDLE CreateFileMappingW (HANDLE hFile, LPSECURITY_ATTRIBUTES lpFileMappingAttributes, DWORD flProtect, DWORD dwMaximumSizeHigh, DWORD dwMaximumSizeLow, LPCWSTR lpName);

LPVOID MapViewOfFile (HANDLE hFileMappingObject, DWORD dwDesiredAccess, DWORD dwFileOffsetHigh, DWORD dwFileOffsetLow, SIZE_T dwNumberOfBytesToMap);

LPVOID MapViewOfFileEx (HANDLE hFileMappingObject, DWORD dwDesiredAccess, DWORD dwFileOffsetHigh, DWORD dwFileOffsetLow, SIZE_T dwNumberOfBytesToMap, LPVOID lpBaseAddress);

PVOID MapViewOfFile2 (HANDLE FileMappingHandle, HANDLE ProcessHandle, ULONG64 Offset, PVOID BaseAddress, SIZE_T ViewSize, ULONG AllocationType, ULONG PageProtection);

PVOID MapViewOfFile3 (HANDLE FileMapping, HANDLE Process, PVOID BaseAddress, ULONG64 Offset, SIZE_T ViewSize, ULONG AllocationType, ULONG PageProtection, MEM_EXTENDED_PARAMETER ExtendedParameters, ULONG ParameterCount);

PVOID MapViewOfFileNuma2 (HANDLE FileMappingHandle, HANDLE ProcessHandle, ULONG64 Offset, PVOID BaseAddress, SIZE_T ViewSize, ULONG AllocationType, ULONG PageProtection, ULONG PreferredNode);

BOOL UnmapViewOfFile (LPCVOID lpBaseAddress);

Reference

• MSDN CreateFileMappingA
• MSDN CreateFileMappingW
• MSDN MapViewOfFile
• MSDN MapViewOfFileEx
• MSDN MapViewOfFile2
• MSDN MapViewOfFile3
• MSDN UnmapViewOfFile
• MSDN MapViewOfFileNuma2