usr/lib/Get-PsVMInfo.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
Set-Alias -Name vadump -Value Get-PsVMInfo
function Get-PsVMInfo {
  [CmdletBinding()]param($PSBoundParameters)
  DynamicParam {
    New-DynParameter (@{
      Name  = 'Address'
      Type  = [IntPtr]
      Value = [IntPtr]::Zero
    })
  }

  begin {
    New-Enum MEM_PROTECT {
      PAGE_NOACCESS          = 0x00000001
      PAGE_READONLY          = 0x00000002
      PAGE_READWRITE         = 0x00000004
      PAGE_WRITECOPY         = 0x00000008
      PAGE_EXECUTE           = 0x00000010
      PAGE_EXECUTE_READ      = 0x00000020
      PAGE_EXECUTE_READWRITE = 0x00000040
      PAGE_EXECUTE_WRITECOPY = 0x00000080
      PAGE_GUARD             = 0x00000100
      PAGE_NOCACHE           = 0x00000200
      PAGE_WRITECOMBINE      = 0x00000400
    } -Flags

    New-Enum MEM_STATE {
      MEM_COMMIT  = 0x00001000
      MEM_RESERVE = 0x00002000
      MEM_FREE    = 0x00010000
    } -Flags

    New-Enum MEM_TYPE {
      MEM_PRIVATE = 0x00020000
      MEM_MAPPED  = 0x00040000
      MEM_IMAGE   = 0x01000000
    } -Flags

    New-Structure MEMEORY_BASIC_INFORMATION {
      IntPtr  BaseAddress
      IntPtr  AllocationBase
      MEM_PROTECT AllocationProtect
      UIntPtr RegionSize
      MEM_STATE State
      MEM_PROTECT Protect
      MEM_TYPE Type
    }
    $out = [MEMEORY_BASIC_INFORMATION].MakeByRefType()

    New-Delegate ntdll {
      int NtQueryVirtualMemory([ptr, ptr, uint, $out, uint, buf])
    }

    $sz = [IntPtr]::Size
    $fmt, $to_i, $to_u = "{0:X$($sz * 2)}", "ToInt$($sz * 8)", "ToUInt$($sz * 8)"
  }
  process {}
  end {
    New-PsProxy $PSBoundParameters -Callback {
      $out, $sz = [MEMEORY_BASIC_INFORMATION]::new(), [MEMEORY_BASIC_INFORMATION]::GetSize()
      if ($paramAddress.Value -ne 0) {
        if (($nts = $ntdll.NtQueryVirtualMemory.Invoke(
          $_.Handle, $paramAddress.Value, 0, [ref]$out, $sz, $null
        )) -ne 0) { Write-Verbose (ConvertTo-ErrMessage -NtStatus $nts) }
        else {
          [PSCustomObject]@{
            BaseAddress = $fmt -f $out.BaseAddress.$to_i()
            AllocationBase = $fmt -f $out.AllocationBase.$to_i()
            AllocationProtect = $out.AllocationProtect
            RegionSize = $fmt -f $out.RegionSize.$to_u()
            State = $out.State
            Protect = $out.Protect
            Type = $out.Type
          }
        }
      }
      else {
        $ptr = [IntPtr]::Zero
        $(while (1) {
          if (($nts = $ntdll.NtQueryVirtualMemory.Invoke(
            $_.Handle, $ptr, 0, [ref]$out, $sz, $null
          )) -ne 0) {
            Write-Verbose (ConvertTo-ErrMessage -NtStatus $nts)
            break
          }
          [PSCustomObject]@{
            BaseAddress = $fmt -f $out.BaseAddress.$to_i()
            AllocationBase = $fmt -f $out.AllocationBase.$to_i()
            AllocationProtect = $out.AllocationProtect
            RegionSize = $fmt -f $out.RegionSize.$to_u()
            State = $out.State
            Protect = $out.Protect
            Type = $out.Type
          }
          $ptr = [IntPtr]($out.BaseAddress.$to_i() + [Int64]$out.RegionSize.$to_u())
        }) | Format-Table -AutoSize
      }
    }
  }
}

Export-ModuleMember -Alias vadump -Function Get-PsVMInfo