Library updates and compat fixes

[mitchcapper]

Thanks for a great set of libraries!
I was trying to track down various crash/failures with using it and one of the early things I did was update all the deps. I don't know your projects super-well so the conversion is a bit rough and there is an added compat layer I added that may not be wanted (some things I couldn't find newer examples of).

I did find a few bugs in the process, one here related to .net detection also a larger DNNE bug that isn't really related other than from broader user of this library ( AaronRobinsonMSFT/DNNE#178 ).

One thing I failed to do is get the library to work with 64 bit processes when the target address is greater than 4GB. It has been a long time since ive done much assembly so I am sure something is wrong with my attempt (AssemblyLargePtrFix feature bool) but I am guessing one could fix it pretty easily. Once I fixed the 32v64 bit detection I didn't need it (as the proper PEB header ended up having the libraries loaded lower).

[mitchcapper]

One other note, my remote circular buffer compat is very much not a circular buffer. Granted a the true original circular buffer may have run into override issues if not used carefully, instead if you go to the point you would have looped the buffer it now throws an exception.

[Sewer56]

Looks fine to me, except for circle buffer & code style but I can fix that.
I assume PrivateMemoryBufferCompat is for backcompat with older Reloaded.Memory.Buffers API, so that looks okay.

Quick question, in any case:

• How urgently do you need the changes merged?

I don't mind doing a quick update in the interim; but I've had the 2.0.0 branch sitting for a long time, so I should probably get that released. Although I'm working on Rust version of Reloaded-Hooks, but I don't mind pausing on that for a bit.

Would you mind rebasing the changes ontop of 2.0.0?
There's a breaking change here, in any case. Code built against older versions would fail to run due to parameter mismatch if you were to replace the DLL on FileSystem.

Notably, changes currently in 2.0.0 include:

• Can now inject into suspended process.
• Some cleanup

And things I still have to do:

• Hand assemble the Shellcode (removes dependency on Assembler).
  • This is actually pretty easy 😉, since it's just 1/2 functions.
• Replace PeNet with my own lightweight partial PE reader.
  • I actually deliberately kept it out of date in the past to trim on DLL size(s).
• Add full documentation like in Reloaded.Memory.
• Replace AppVeyor with GitHub CI.
• Migrate Project to using Shared Configuration
  • Including Public API Analyzer, etc.

I don't mind doing a release in the interim in any case; but if it's not super urgent, I could probably spend the next 2 weekends to get this polished up for release.

Thanks for a great set of libraries!

Awwww, I'm flattered.

[mitchcapper]

I assume PrivateMemoryBufferCompat is for backcompat with older Reloaded.Memory.Buffers

Mostly I wanted to minimize the re-write requirements for elsewhere in the library while also not just removing some of the potential conversion errors that Add automatically handled for the user (rather than just bytes everywhere). I tried looking at the one other project using a newish version of the Reloaded.Memory for other paths on upgrading but it didn't look like there were great options when dealing with a remote processes memory. Sadly the commit history wasn't super helpful for figuring out the evolution over time given some of the mass cleanup / wipes the project had did so there was a good bit of guess work.

How urgently do you need the changes merged?

No rush at all :) Happily been using this branch version for my own needs for awhile, mainly just contributed these things back in case helpful in updating this library to use your other library updates:)

Would you mind rebasing the changes ontop of 2.0.0?

I am not sure how I missed the 2.0 branch, I don't recall when I first did the work as it sat around waiting for me to clean it up before doing this PR. The 2.0 additions are certainly positive. I can do some further cleanup as well, mostly left a few things for notes incase I wanted to try and return to the >4GB address issue or for further debugging (but it has been rock solid for me paired with the DNNE changes for any process I throw it at).

There's a breaking change here,

Yeah I struggle with this on my own libraries. Using new defaults is cleaner but using function overloads can preserve the API and callback use. Clearly I just need to write a generator to behind the scenes transform your default values to function overloads for the best of both worlds. I have no problem duping up the code if there is some value to maintaining api compatibility, but it can certainly wait for 2.0.

Replace PeNet with my own lightweight partial PE reader.

Yeah when I ran into the issues injecting with .net framework and the problems were non-obvious I started with making sure the newer versions of the libraries were used in case there were any bugs already squashed. PeNet throws (but catches) an exception as it goes but that also initially threw me for concern before I dug further into that code. In the end the DNNE bug was the biggest source of issue.

Add full documentation like in Reloaded.Memory.

Documentation is always great, I think I originally worked off the sample in Reloaded-Project/Reloaded.Hooks#7 based on the name, but that was quite awhile ago.

Awwww, I'm flattered.

They are an unobtrusive way to handle process manipulation that certainly make life easier, quite happy to have found the org.

I forgot to mention this closes #11

[Sewer56]

I'm getting this sorted today.

Due to Reloaded-II suddenly receiving ~4 issue reports per hour when the Windows Defender nation attacked; I even booked off work for the remainder of the week. I'll port these changes to the 2.0.0 branch and release, ASAP. Then use that in R-II.

Edit: Will write this in Rust. I need it in Rust for Reloaded3
Edit 2: I'll write a .NET wrapper around https://github.com/OpenByteDev/dll-syringe, after I make it able to inject into suspended. Seems it's based on this library, and uses very similar code style/ideas.