Added CopyOnWrite section protection.

KN4CK3R · KN4CK3R · commit 4f842ddc7bd7 · 2017-09-03T17:40:34.000+02:00
diff --git a/Memory/Section.cs b/Memory/Section.cs
@@ -17,9 +17,10 @@ public enum SectionProtection
 
 		Read = 1,
 		Write = 2,
-		Execute = 4,
+		CopyOnWrite = 4,
+		Execute = 8,
 
-		Guard = 8
+		Guard = 16
 	}
 
 	public enum SectionType
diff --git a/NativeCore/ReClassNET_Plugin.hpp b/NativeCore/ReClassNET_Plugin.hpp
@@ -32,9 +32,10 @@ enum class SectionProtection
 
 	Read = 1,
 	Write = 2,
-	Execute = 4,
+	CopyOnWrite = 4,
+	Execute = 8,
 
-	Guard = 8
+	Guard = 16
 };
 
 inline SectionProtection operator|(SectionProtection lhs, SectionProtection rhs)
diff --git a/NativeCore/Windows/EnumerateRemoteSectionsAndModules.cpp b/NativeCore/Windows/EnumerateRemoteSectionsAndModules.cpp
@@ -25,33 +25,15 @@ void __stdcall EnumerateRemoteSectionsAndModules(RC_Pointer process, EnumerateRe
 			section.BaseAddress = memInfo.BaseAddress;
 			section.Size = memInfo.RegionSize;
 			
-			switch (memInfo.Protect & 0xFF)
-			{
-			case PAGE_EXECUTE:
-				section.Protection = SectionProtection::Execute;
-				break;
-			case PAGE_EXECUTE_READ:
-				section.Protection = SectionProtection::Execute | SectionProtection::Read;
-				break;
-			case PAGE_EXECUTE_READWRITE:
-			case PAGE_EXECUTE_WRITECOPY:
-				section.Protection = SectionProtection::Execute | SectionProtection::Read | SectionProtection::Write;
-				break;
-			case PAGE_NOACCESS:
-				section.Protection = SectionProtection::NoAccess;
-				break;
-			case PAGE_READONLY:
-				section.Protection = SectionProtection::Read;
-				break;
-			case PAGE_READWRITE:
-			case PAGE_WRITECOPY:
-				section.Protection = SectionProtection::Read | SectionProtection::Write;
-				break;
-			}
-			if ((memInfo.Protect & PAGE_GUARD) == PAGE_GUARD)
-			{
-				section.Protection |= SectionProtection::Guard;
-			}
+			section.Protection = SectionProtection::NoAccess;
+			if ((memInfo.Protect & PAGE_EXECUTE) == PAGE_EXECUTE) section.Protection |= SectionProtection::Execute;
+			if ((memInfo.Protect & PAGE_EXECUTE_READ) == PAGE_EXECUTE_READ) section.Protection |= SectionProtection::Execute | SectionProtection::Read;
+			if ((memInfo.Protect & PAGE_EXECUTE_READWRITE) == PAGE_EXECUTE_READWRITE) section.Protection |= SectionProtection::Execute | SectionProtection::Read | SectionProtection::Write;
+			if ((memInfo.Protect & PAGE_EXECUTE_WRITECOPY) == PAGE_EXECUTE_READWRITE) section.Protection |= SectionProtection::Execute | SectionProtection::Read | SectionProtection::CopyOnWrite;
+			if ((memInfo.Protect & PAGE_READONLY) == PAGE_READONLY) section.Protection |= SectionProtection::Read;
+			if ((memInfo.Protect & PAGE_READWRITE) == PAGE_READWRITE) section.Protection |= SectionProtection::Read | SectionProtection::Write;
+			if ((memInfo.Protect & PAGE_WRITECOPY) == PAGE_WRITECOPY) section.Protection |= SectionProtection::Read | SectionProtection::CopyOnWrite;
+			if ((memInfo.Protect & PAGE_GUARD) == PAGE_GUARD) section.Protection |= SectionProtection::Guard;
 			
 			switch (memInfo.Type)
 			{
