{"id":32140,"date":"2023-01-27T00:17:46","date_gmt":"2023-01-26T18:47:46","guid":{"rendered":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/"},"modified":"2023-01-27T00:17:46","modified_gmt":"2023-01-26T18:47:46","slug":"solved-dllimport-of-the-origin-function-in-the-dll","status":"publish","type":"post","link":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/","title":{"rendered":"[Solved] DLLImport of the origin function in the DLL"},"content":{"rendered":"<p> [ad_1]<br \/>\n<\/p>\n<div id=\"answer-35633059\" class=\"answer js-answer accepted-answer js-accepted-answer\" data-answerid=\"35633059\" data-parentid=\"35624509\" data-score=\"2\" data-position-on-page=\"1\" data-highest-scored=\"1\" data-question-has-accepted-highest-score=\"1\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\">\n<div class=\"post-layout\">\n<div class=\"votecell post-layout--left\"><\/div>\n<div class=\"answercell post-layout--right\">\n<div class=\"s-prose js-post-body\" itemprop=\"text\">\n<p>If only <code>kernel32.dll<\/code> is being changed you could call <code>ntdll.dll!NtReadVirtualMemory<\/code> (<code>ReadProcessMemory<\/code> itself calls this function).<\/p>\n<p>If <code>ntdll.dll<\/code> is also seems to be changed by 3rd party process you could copy <code>ntdll.dll<\/code> to another temporary file (<code>ntdll_copy.dll<\/code>), and use it:<\/p>\n<pre><code>[DllImport(\"ntdll_copy.dll\", EntryPoint = \"NtReadVirtualMemory\")]\nprivate static extern bool NtReadVirtualMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte[] lpBuffer, UIntPtr nSize, IntPtr lpNumberOfBytesRead);\n<\/code><\/pre>\n<\/p><\/div>\n<div class=\"mt24\"><\/div>\n<\/div>\n<p>            <span class=\"d-none\" itemprop=\"commentCount\">5<\/span> <\/p><\/div>\n<\/div>\n<p>[ad_2]<\/p>\n<p>solved DLLImport of the origin function in the DLL <\/p>\n","protected":false},"excerpt":{"rendered":"<p>[ad_1] If only kernel32.dll is being changed you could call ntdll.dll!NtReadVirtualMemory (ReadProcessMemory itself calls this function). If ntdll.dll is also seems to be changed by 3rd party process you could copy ntdll.dll to another temporary file (ntdll_copy.dll), and use it: [DllImport(&#8220;ntdll_copy.dll&#8221;, EntryPoint = &#8220;NtReadVirtualMemory&#8221;)] private static extern bool NtReadVirtualMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte[] lpBuffer, &#8230; <a title=\"[Solved] DLLImport of the origin function in the DLL\" class=\"read-more\" href=\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/\" aria-label=\"More on [Solved] DLLImport of the origin function in the DLL\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[320],"tags":[683,774],"class_list":["post-32140","post","type-post","status-publish","format-standard","hentry","category-solved","tag-winapi","tag-windows"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>[Solved] DLLImport of the origin function in the DLL - JassWeb<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[Solved] DLLImport of the origin function in the DLL - JassWeb\" \/>\n<meta property=\"og:description\" content=\"[ad_1] If only kernel32.dll is being changed you could call ntdll.dll!NtReadVirtualMemory (ReadProcessMemory itself calls this function). If ntdll.dll is also seems to be changed by 3rd party process you could copy ntdll.dll to another temporary file (ntdll_copy.dll), and use it: [DllImport(&quot;ntdll_copy.dll&quot;, EntryPoint = &quot;NtReadVirtualMemory&quot;)] private static extern bool NtReadVirtualMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte[] lpBuffer, ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/\" \/>\n<meta property=\"og:site_name\" content=\"JassWeb\" \/>\n<meta property=\"article:published_time\" content=\"2023-01-26T18:47:46+00:00\" \/>\n<meta name=\"author\" content=\"Kirat\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kirat\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/\"},\"author\":{\"name\":\"Kirat\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31\"},\"headline\":\"[Solved] DLLImport of the origin function in the DLL\",\"datePublished\":\"2023-01-26T18:47:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/\"},\"wordCount\":53,\"publisher\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\"},\"keywords\":[\"winapi\",\"windows\"],\"articleSection\":[\"Solved\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/\",\"url\":\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/\",\"name\":\"[Solved] DLLImport of the origin function in the DLL - JassWeb\",\"isPartOf\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#website\"},\"datePublished\":\"2023-01-26T18:47:46+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jassweb.com\/solved\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[Solved] DLLImport of the origin function in the DLL\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jassweb.com\/solved\/#website\",\"url\":\"https:\/\/jassweb.com\/solved\/\",\"name\":\"JassWeb\",\"description\":\"Build High-quality Websites\",\"publisher\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jassweb.com\/solved\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\",\"name\":\"Jass Web\",\"url\":\"https:\/\/jassweb.com\/solved\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png\",\"contentUrl\":\"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png\",\"width\":693,\"height\":132,\"caption\":\"Jass Web\"},\"image\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31\",\"name\":\"Kirat\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750\",\"contentUrl\":\"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750\",\"caption\":\"Kirat\"},\"sameAs\":[\"http:\/\/jassweb.com\"],\"url\":\"https:\/\/jassweb.com\/solved\/author\/jaspritsinghghumangmail-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"[Solved] DLLImport of the origin function in the DLL - JassWeb","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/","og_locale":"en_US","og_type":"article","og_title":"[Solved] DLLImport of the origin function in the DLL - JassWeb","og_description":"[ad_1] If only kernel32.dll is being changed you could call ntdll.dll!NtReadVirtualMemory (ReadProcessMemory itself calls this function). If ntdll.dll is also seems to be changed by 3rd party process you could copy ntdll.dll to another temporary file (ntdll_copy.dll), and use it: [DllImport(\"ntdll_copy.dll\", EntryPoint = \"NtReadVirtualMemory\")] private static extern bool NtReadVirtualMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte[] lpBuffer, ... Read more","og_url":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/","og_site_name":"JassWeb","article_published_time":"2023-01-26T18:47:46+00:00","author":"Kirat","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kirat"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/#article","isPartOf":{"@id":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/"},"author":{"name":"Kirat","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31"},"headline":"[Solved] DLLImport of the origin function in the DLL","datePublished":"2023-01-26T18:47:46+00:00","mainEntityOfPage":{"@id":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/"},"wordCount":53,"publisher":{"@id":"https:\/\/jassweb.com\/solved\/#organization"},"keywords":["winapi","windows"],"articleSection":["Solved"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/","url":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/","name":"[Solved] DLLImport of the origin function in the DLL - JassWeb","isPartOf":{"@id":"https:\/\/jassweb.com\/solved\/#website"},"datePublished":"2023-01-26T18:47:46+00:00","breadcrumb":{"@id":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jassweb.com\/solved\/solved-dllimport-of-the-origin-function-in-the-dll\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jassweb.com\/solved\/"},{"@type":"ListItem","position":2,"name":"[Solved] DLLImport of the origin function in the DLL"}]},{"@type":"WebSite","@id":"https:\/\/jassweb.com\/solved\/#website","url":"https:\/\/jassweb.com\/solved\/","name":"JassWeb","description":"Build High-quality Websites","publisher":{"@id":"https:\/\/jassweb.com\/solved\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jassweb.com\/solved\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jassweb.com\/solved\/#organization","name":"Jass Web","url":"https:\/\/jassweb.com\/solved\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/","url":"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png","contentUrl":"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png","width":693,"height":132,"caption":"Jass Web"},"image":{"@id":"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31","name":"Kirat","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/image\/","url":"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750","contentUrl":"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750","caption":"Kirat"},"sameAs":["http:\/\/jassweb.com"],"url":"https:\/\/jassweb.com\/solved\/author\/jaspritsinghghumangmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts\/32140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/comments?post=32140"}],"version-history":[{"count":0,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts\/32140\/revisions"}],"wp:attachment":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/media?parent=32140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/categories?post=32140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/tags?post=32140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}