Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AssemblyFactory.Execute is terribly slow #17

Open
CapitaineToinon opened this issue Mar 24, 2018 · 0 comments
Open

AssemblyFactory.Execute is terribly slow #17

CapitaineToinon opened this issue Mar 24, 2018 · 0 comments

Comments

@CapitaineToinon
Copy link

I tried using MemorySharp to replace some dirty code I was using to Execute assembly from the memory.

First allocates the memory like this :

// First allocate the memory
RemoteAllocation getflagfunmem = safeHandle.Memory.Allocate(0x8000);

string[] asm =
{
    "mov eax, 0x" + (getflagfunmem.BaseAddress + 0x400).ToString("X"),
    "mov eax, [eax]",
    "push eax",
    "call 0x" + Pointers.GET_EVENT_FLAG.ToString("X"),
    "ret"
};

safeHandle.Assembly.Inject(asm, getflagfunmem.BaseAddress);

And then call it later on like this :

safeHandle.Write(getflagfunmem.BaseAddress + 0x400, eventID, false);
int flags = safeHandle.Assembly.Execute<int>(getflagfunmem.BaseAddress);
return (flags >> 7) == 1;

But I found that the Execute is terribly slow compared to my previous code, showed here :

// Note that the asm code used is a tiny bit different. Since I can't 
// automatically read the result with I can with Execute, the asm code
// writes the result in getflagfunmem.BaseAddress + 0x404 instead
safeHandle.Write(getflagfunmem.BaseAddress + 0x400, eventID, false);

IntPtr newThreadHook = (IntPtr)CreateRemoteThread(safeHandle.Handle, 0, 0, (int)getflagfunmem.BaseAddress, 0, 0, 0);
WaitForSingleObject(newThreadHook, 0xFFFFFFFFU);
CloseHandle(newThreadHook);

int flags = safeHandle.Read<int>(getflagfunmem.BaseAddress + 0x404, false);

And as you can see from the Execution times (in ms), the Execute code :

Flags function called 709 times, average duration : 5.46240267983074
Flags function called 709 times, average duration : 5.70936375176305

Is much slower than my own code, using Kernel calls :

Flags function called 709 times, average duration : 0.186416502115656
Flags function called 709 times, average duration : 0.187183215796897
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant