Allocating memory in specific Windows DLL module

I want to allocate some memory inside a specific module of a process instead of the process in general. The following Windows C++ code can allocate memory inside a process given its process id:

#include "pch.h"

#include <windows.h>
#include <winternl.h>
#include <processthreadsapi.h>
#include <iostream>
#include <conio.h>

#pragma comment(lib, "ntdll.lib")

typedef NTSTATUS (NTAPI *nt_alloc_virtual_memory_func)(HANDLE process_handle, PVOID* base_address, ULONG_PTR zero_bits,
                                                       PSIZE_T region_size, ULONG allocation_type, ULONG protect);
typedef NTSTATUS (NTAPI *nt_free_virtual_memory_func)(HANDLE process_handle, PVOID* base_address, PSIZE_T region_size,
                                                      ULONG free_type);

void enable_allocating_executable_memory()
{
    PROCESS_MITIGATION_DYNAMIC_CODE_POLICY mp;
    ZeroMemory(&mp, sizeof mp);
    mp.ProhibitDynamicCode = FALSE;
    SetProcessMitigationPolicy(ProcessDynamicCodePolicy, &mp, sizeof mp);
}

long allocate_memory(char** arguments, const HANDLE process_handle, PVOID process_memory, SIZE_T& allocation_size)
{
    const auto memory_size = arguments[3];
    allocation_size = strtoul(memory_size, nullptr, 10);

    const auto nt_allocate_virtual_memory = reinterpret_cast<nt_alloc_virtual_memory_func>(GetProcAddress(
        GetModuleHandle(L"ntdll.dll"), "NtAllocateVirtualMemory"));

    const auto allocation_status = nt_allocate_virtual_memory(process_handle, &process_memory, 0, &allocation_size,
                                                              MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (NT_SUCCESS(allocation_status))
    {
        std::cout << std::hex << process_memory << std::endl;
    }

    return allocation_status;
}

int free_memory(const int argument_count, char** arguments,
                const HANDLE process_handle, SIZE_T& mem_size)
{
    const auto address_string = arguments[3];
    const auto process_address = strtoull(address_string, nullptr, 16);
    auto process_memory_address = reinterpret_cast<PVOID>(process_address);

    if (argument_count < 4)
    {
        return EXIT_FAILURE;
    }

    const auto memory_size = arguments[4];
    mem_size = strtoul(memory_size, nullptr, 10);

    const auto nt_free_virtual_memory = reinterpret_cast<nt_free_virtual_memory_func>(GetProcAddress(
        GetModuleHandle(L"ntdll.dll"), "NtFreeVirtualMemory"));

    const auto status = nt_free_virtual_memory(process_handle, &process_memory_address, &mem_size, MEM_RELEASE);
    return status;
}

int main(const int argument_count, char* arguments[])
{
    if (argument_count < 4)
    {
        return EXIT_FAILURE;
    }

    const auto process_id_string = arguments[1];
    const auto process_id = strtoul(process_id_string, nullptr, 10);

    enable_allocating_executable_memory();

    const auto process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_id);
    if (process_handle == nullptr)
    {
        std::cout << "Cannot open process with process id " << process_id << std::endl;
        exit(EXIT_FAILURE);
    }

    const PVOID process_memory = nullptr;
    SIZE_T mem_size;

    const auto command = arguments[2];
    if (strcmp(command, "--allocate") == 0)
    {
        allocate_memory(arguments, process_handle, process_memory, mem_size);
    }
    else if (strcmp(command, "--free") == 0)
    {
        return free_memory(argument_count, arguments, process_handle, mem_size);
    }

    return EXIT_SUCCESS;
}

NtAllocateVirtualMemory does not seem to accept an argument for a module. What else can be used?

The reasoning behind this is that I don't want to have jmps going from one module to another after I allocated some memory but rather stay as locally as possible. This also makes jmp instructions shorter in terms of their sizes in memory.

Solution

I want to allocate some memory inside a specific module

You cannot do this, when a module is mapped it's memory is allocated. You can't allocate memory inside the module, the module exists inside it's allocated pages and no where else. Any allocated pages will be outside of the module.

Alternatively if you want to use memory which is already allocated but is not used, this called a code cave. It's typically an area of memory inside a module which is filled with zeros. So you can scan for a code cave by finding a certain length of redundant zeros inside the module and then you can write to that memory.

This is done frequently and is especially useful if the page has the execute bit set as you won't have to change any permissions which could be deemed risky.

This is also done frequently in injectors which use "scatter mapping" where it only uses these code caves to inject code.