//szPathToModule = NT Path to module 



//Pid targets the process we want to map to :d



//MapSelf true = mapfile to self, Pid is assumed to be 0

//and we check what LoadCheckAlignment is,

//if it is FALSE then we default to checking csrss for imagebase.

//if LoadCheckAlignment is true we do the mentioned process below 

//and load the module into memory before via LdrLoadDll and then map it to self.



//MapSelf false = map file to process specified by Pid



//LoadCheckAlignment if true LdrLoadDll is called with StripPath(szPathToModule) and passed

//as a parameter and upon success query the modules memory alignment.



HANDLE Native_MapModuleQueryAlignment(__in wchar_t *szPathToModule,__in_opt ULONG Pid,__in BOOLEAN MapSelf,BOOLEAN LoadCheckAlignment)

{

	HANDLE hSection = 0;

	HANDLE hFile = 0;

	HANDLE TargetProcess = 0;

	ULONG TargetRegion = 0;

	ULONG Index = 0;

	PVOID TargetModule = 0;

	FILE_STANDARD_INFORMATION FileInformation = {0};

	LARGE_INTEGER FileSize = {0};

	OBJECT_ATTRIBUTES oa;

	DEBUG_BUFFER *pDbgbuf = {0};

	IO_STATUS_BLOCK StatusBlock = {0};

	UNICODE_STRING Unicode = {0};

	CLIENT_ID  ClientId = {0};

	char mbPath[255] = {0};

	wchar_t Err[255] = {0};

	SIZE_T ViewSize = 0;

	NTSTATUS Status = 0;

	BOOLEAN Enabled = 0;

	int Pathtest = 1;

	

	__try

	{

		Status = RtlAdjustPrivilege( 20L ,true,false,&Enabled);

		if(!NT_SUCCESS(Status))

		{

			RtlInitUnicodeString(&Unicode,L"RtlAdjustPrivilege Status:";

			__leave;

		}

		if(MapSelf == TRUE)//use csrss 

		{

			Pid = CsrGetProcessIdEx();

			TargetProcess = NtCurrentProcess();

			if(Pid == 0)

			{

				RtlInitUnicodeString(&Unicode,L"CsrGetProcessIdEx returned 0";

				__leave;

			}

		}

		else//open the process

		{

			ClientId.UniqueProcess = (HANDLE)Pid;

			ClientId.UniqueThread = 0;

			Status = NtOpenProcess(&TargetProcess,PROCESS_ALL_ACCESS,0,&ClientId);

			if(!NT_SUCCESS(Status))

			{

				RtlInitUnicodeString(&Unicode,L"NtOpenProcess Status";

				__leave;

			}

			LoadCheckAlignment = TRUE;

		}

		if(LoadCheckAlignment == FALSE)

		{

			RtlInitUnicodeString(&Unicode,szPathToModule);

	 		pDbgbuf = RtlCreateQueryDebugBuffer(0,0);

			Status = RtlQueryProcessDebugInformation(Pid,PDI_MODULES,pDbgbuf);

			if(!NT_SUCCESS(Status))

			{

				RtlInitUnicodeString(&Unicode,L"RtlQueryProcessDebugInformation Status:";

				__leave;

			}

			wcscpy((wchar_t*)&Err,Unicode.Buffer);

			Index = 0;

			do

			{

				Index++;

				Pathtest = wcsncmp(&Err[Index],L"C",1);

			}while(Pathtest != 0);

			wcstombs((char*)&mbPath,(wchar_t*)&Err[Index],wcslen((wchar_t*)&Err[Index]));

			for(Index = 0;Index<=pDbgbuf->ModuleInformation->Count;Index++)

			{			

				Pathtest = strcmp((char*)pDbgbuf->ModuleInformation->DbgModInfo[Index].ImageName,(char*)&mbPath);

				if(Pathtest == 0)

				{

					TargetRegion = pDbgbuf->ModuleInformation->DbgModInfo[Index].Base;

					break;

				}

			}

			Status = RtlDestroyQueryDebugBuffer(pDbgbuf);

			if(!NT_SUCCESS(Status))

			{

				RtlInitUnicodeString(&Unicode,L"RtlDestroyQueryDebugBuffer Status:";

				__leave;

			}

			RtlAdjustPrivilege(20L,false,false,&Enabled);

		}

		if(LoadCheckAlignment == TRUE)

		{

			RtlInitUnicodeString(&Unicode,szPathToModule);

			wcscpy((wchar_t*)&Err,Unicode.Buffer);

			do

			{

				if(wcsncmp(&Err[Pathtest],L"C",1) == 0)

				{

					break;

				}

				Pathtest++;

			}while(Pathtest <= Unicode.MaximumLength);

			Pathtest = (int)wcslen((wchar_t*)&Err);

			do

			{

				if(wcsncmp(&Err[Pathtest],L"\\",1) == 0)

				{

					break;

				}

				Pathtest--;

			}while(Pathtest != 0);

			RtlInitUnicodeString(&Unicode,&Err[Pathtest+1]);

			Status = LdrLoadDll(0,0,&Unicode,&TargetModule);

			if(!NT_SUCCESS(Status))

			{

				RtlInitUnicodeString(&Unicode,L"LdrLoadDll Status:";

				__leave;

			}

			TargetRegion = (ULONG)TargetModule;

			LdrUnloadDll((HANDLE)TargetModule);

		}

		RtlInitUnicodeString(&Unicode,szPathToModule);

		InitializeObjectAttributes(&oa,&Unicode,OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,0,0);

		Status = NtCreateFile(&hFile,GENERIC_READ | GENERIC_EXECUTE,&oa,&StatusBlock,0,FILE_ATTRIBUTE_NORMAL,0,FILE_OPEN,0,0,0);

		if(!NT_SUCCESS(Status))

		{

			RtlInitUnicodeString(&Unicode,L"NtCreateFile Status:";

			__leave;

		}

		Status = NtQueryInformationFile(hFile,&StatusBlock,&FileInformation,sizeof(FILE_STANDARD_INFORMATION),FileStandardInformation);

		if(!NT_SUCCESS(Status))

		{

			RtlInitUnicodeString(&Unicode,L"NtQueryInformationFile Status:";

			__leave;

		}

		memcpy(&FileSize,&FileInformation.EndOfFile,sizeof(LARGE_INTEGER));

		Status = NtCreateSection(&hSection,SECTION_ALL_ACCESS,0,&FileSize,PAGE_EXECUTE_READ,SEC_IMAGE,hFile);

		if(!NT_SUCCESS(Status))

		{

			RtlInitUnicodeString(&Unicode,L"NtCreateSection Status:";

			__leave;

		}

		if(TargetRegion == 0)

		{

			RtlInitUnicodeString(&Unicode,L"Could not find Module";

			__leave;

		}

		else

		{

			Status = NtMapViewOfSection(hSection,TargetProcess,(PVOID*)&TargetRegion,0,0,0,&ViewSize,ViewUnmap,0,PAGE_EXECUTE_READWRITE);

			if(!NT_SUCCESS(Status))

			{

				RtlInitUnicodeString(&Unicode,L"NtMapViewOfSection Status:";

				__leave;

			}

		}

		if(TargetProcess != INVALID_HANDLE_VALUE)

		{

			NtClose(TargetProcess);

		}

		NtClose(hFile);

		return hSection;

	}

	__except(1)

	{

		if(TargetProcess != INVALID_HANDLE_VALUE)

			NtClose(TargetProcess);

		if(hSection != INVALID_HANDLE_VALUE)

			NtClose(hSection);

		if(hFile != INVALID_HANDLE_VALUE)

			NtClose(hFile);

		NtDisplayString(&Unicode);

		_ultow(Status,(wchar_t*)&Err,16);

		RtlInitUnicodeString(&Unicode,(wchar_t*)&Err);

		NtDisplayString(&Unicode);

		NtDelayExecutionEx(6);

	}

	return false;

}

		if(!Native_MapModuleQueryAlignment(L"\\??\\C:\\WINDOWS\\system32\\CSRSRV.dll",0,TRUE,FALSE))

		{

			__leave;

                }

		if(!Native_MapModuleQueryAlignment(L"\\??\\C:\\WINDOWS\\system32\\CSRSRV.dll",0,TRUE,TRUE))

		{

			__leave;

		}