mireado

starting commit

This diff could not be displayed because it is too large.
1 +# ntdll.pri
2 +# 4/9/2012 jichi
3 +
4 +DEFINES += WITH_LIB_NTDLL
5 +
6 +DEPENDPATH += $$PWD
7 +
8 +HEADERS += $$PWD/ntdll.h
9 +
10 +# EOF
1 +// ntinspect.cc
2 +// 4/20/2014 jichi
3 +#include "ntdll/ntdll.h"
4 +#include "ntinspect/ntinspect.h"
5 +
6 +//#ifdef _MSC_VER
7 +//# pragma warning(disable:4018) // C4018: signed/unsigned mismatch
8 +//#endif // _MSC_VER
9 +
10 +namespace { // unnamed
11 +// Replacement of wcscpy_s which is not available on Windows XP's msvcrt
12 +// http://sakuradite.com/topic/247
13 +errno_t wcscpy_safe(wchar_t *buffer, size_t bufferSize, const wchar_t *source)
14 +{
15 + size_t len = min(bufferSize - 1, wcslen(source));
16 + buffer[len] = 0;
17 + if (len)
18 + memcpy(buffer, source, len * 2);
19 + return 0;
20 +}
21 +} // unnamed namespace
22 +
23 +NTINSPECT_BEGIN_NAMESPACE
24 +
25 +BOOL getCurrentProcessName(LPWSTR buffer, int bufferSize)
26 +{
27 + //assert(name);
28 + PLDR_DATA_TABLE_ENTRY it;
29 + __asm
30 + {
31 + mov eax,fs:[0x30]
32 + mov eax,[eax+0xc]
33 + mov eax,[eax+0xc]
34 + mov it,eax
35 + }
36 + // jichi 6/4/2014: _s functions are not supported on Windows XP's msvcrt.dll
37 + //return 0 == wcscpy_s(buffer, bufferSize, it->BaseDllName.Buffer);
38 + return 0 == wcscpy_safe(buffer, bufferSize, it->BaseDllName.Buffer);
39 +}
40 +
41 +BOOL getModuleMemoryRange(LPCWSTR moduleName, DWORD *lowerBound, DWORD *upperBound)
42 +{
43 + //assert(lower);
44 + //assert(upper);
45 + PLDR_DATA_TABLE_ENTRY it;
46 + LIST_ENTRY *begin;
47 + __asm
48 + {
49 + mov eax,fs:[0x30]
50 + mov eax,[eax+0xc]
51 + mov eax,[eax+0xc]
52 + mov it,eax
53 + mov begin,eax
54 + }
55 +
56 + while (it->SizeOfImage) {
57 + if (_wcsicmp(it->BaseDllName.Buffer, moduleName) == 0) {
58 + DWORD lower = (DWORD)it->DllBase;
59 + if (lowerBound)
60 + *lowerBound = lower;
61 +
62 + if (upperBound) {
63 + DWORD upper = lower;
64 + MEMORY_BASIC_INFORMATION mbi = {};
65 + DWORD size = 0;
66 + do {
67 + DWORD len;
68 + // Nt function is needed instead of VirtualQuery, which only works for the current process
69 + ::NtQueryVirtualMemory(NtCurrentProcess(), (LPVOID)upper, MemoryBasicInformation, &mbi, sizeof(mbi), &len);
70 + if (mbi.Protect & PAGE_NOACCESS) {
71 + it->SizeOfImage = size;
72 + break;
73 + }
74 + size += mbi.RegionSize;
75 + upper += mbi.RegionSize;
76 + } while (size < it->SizeOfImage);
77 +
78 + *upperBound = upper;
79 + }
80 + return TRUE;
81 + }
82 + it = (PLDR_DATA_TABLE_ENTRY)it->InLoadOrderModuleList.Flink;
83 + if (it->InLoadOrderModuleList.Flink == begin)
84 + break;
85 + }
86 + return FALSE;
87 +}
88 +
89 +BOOL getCurrentMemoryRange(DWORD *lowerBound, DWORD *upperBound)
90 +{
91 + WCHAR procName[MAX_PATH]; // cached
92 + *lowerBound = 0;
93 + *upperBound = 0;
94 + return getCurrentProcessName(procName, MAX_PATH)
95 + && getModuleMemoryRange(procName, lowerBound, upperBound);
96 +}
97 +
98 +NTINSPECT_END_NAMESPACE
99 +
100 +// EOF
1 +#pragma once
2 +
3 +// ntinspect.h
4 +// 4/20/2014 jichi
5 +
6 +#include <windows.h>
7 +
8 +#ifndef NTINSPECT_BEGIN_NAMESPACE
9 +# define NTINSPECT_BEGIN_NAMESPACE namespace NtInspect {
10 +#endif
11 +#ifndef NTINSPECT_END_NAMESPACE
12 +# define NTINSPECT_END_NAMESPACE } // NtInspect
13 +#endif
14 +
15 +NTINSPECT_BEGIN_NAMESPACE
16 +
17 +/// Get current module name in fs:0x30
18 +BOOL getCurrentProcessName(_Out_ LPWSTR buffer, _In_ int bufferSize);
19 +
20 +/**
21 + * Get the memory range of the module if succeed
22 + * See: ITH FillRange
23 + */
24 +BOOL getModuleMemoryRange(_In_ LPCWSTR moduleName, _Out_ DWORD *lowerBound, _Out_ DWORD *upperBound);
25 +
26 +/// Get memory of the current process
27 +BOOL getCurrentMemoryRange(_Out_ DWORD *lowerBound, _Out_ DWORD *upperBound);
28 +
29 +NTINSPECT_END_NAMESPACE
30 +
31 +// EOF
1 +# ntinspect.pri
2 +# 4/20/2014 jichi
3 +win32 {
4 +
5 +DEFINES += WITH_LIB_NTINSPECT
6 +
7 +DEPENDPATH += $$PWD
8 +
9 +HEADERS += $$PWD/ntinspect.h
10 +SOURCES += $$PWD/ntinspect.cc
11 +
12 +LIBS += -L$$WDK7_HOME/lib/wxp/i386 -lntdll
13 +
14 +}
15 +
16 +# EOF
1 +// winmaker.cc
2 +// 2/1/2013 jichi
3 +
4 +#include "winmaker/winmaker.h"
5 +#include <windows.h>
6 +//#include <commctrl.h>
7 +
8 +#ifdef _MSC_VER
9 +# pragma warning (disable:4800) // C4800: forcing value to bool
10 +#endif // _MSC_VER
11 +
12 +// See: http://www.codeguru.com/cpp/w-p/dll/tips/article.php/c3635/Tip-Detecting-a-HMODULEHINSTANCE-Handle-Within-the-Module-Youre-Running-In.htm
13 +extern "C" IMAGE_DOS_HEADER __ImageBase;
14 +namespace { // unnamed
15 + inline HMODULE _get_module() { return reinterpret_cast<HMODULE>(&__ImageBase); }
16 +} // unnamed
17 +
18 +bool wm_register_hidden_class(LPCWSTR className)
19 +{
20 + WNDCLASSEX wx = {};
21 + wx.cbSize = sizeof(wx);
22 + wx.lpfnWndProc = ::DefWindowProc;
23 + wx.hInstance = ::GetModuleHandle(nullptr);
24 + wx.lpszClassName = className;
25 + return ::RegisterClassEx(&wx);
26 +}
27 +
28 +wm_window_t wm_create_hidden_window(LPCWSTR windowName, LPCWSTR className, wm_module_t dllHandle)
29 +{
30 + //return ::CreateWindowExA(0, className, windowName, 0, 0, 0, 0, 0, HWND_MESSAGE, nullptr, dllHandle, nullptr);
31 + HINSTANCE module = reinterpret_cast<HINSTANCE>(dllHandle);
32 + if (!module)
33 + module = _get_module();
34 + return ::CreateWindowEx(0, className, windowName, 0, 0, 0, 0, 0, 0, NULL, module, NULL);
35 +}
36 +
37 +bool wm_destroy_window(wm_window_t hwnd)
38 +{ return ::DestroyWindow(reinterpret_cast<HWND>(hwnd)); }
39 +
40 +
41 +// EOF
42 +//
43 +//void wm_init() { ::InitCommonControls(); }
44 +//void wm_destroy() {}
45 +//bool wm_destroy_window() { return ::DestroyWindow(hwnd); }
46 +
1 +#pragma once
2 +
3 +// winmaker.h
4 +// 2/1/2013 jichi
5 +
6 +#include <windows.h>
7 +typedef void *wm_window_t; // HWMD
8 +typedef void *wm_module_t; // HMODULE
9 +
10 +bool wm_register_hidden_class(LPCWSTR className = L"hidden_class");
11 +
12 +wm_window_t wm_create_hidden_window(
13 + LPCWSTR windowName = L"hidden_window",
14 + LPCWSTR className = L"Button", // bust be one of the common control widgets
15 + wm_module_t dllHandle = nullptr);
16 +
17 +bool wm_destroy_window(wm_window_t hwnd);
18 +
19 +// EOF
20 +
21 +//#ifdef QT_CORE_LIB
22 +//#include <QtGui/qwindowdefs.h>
23 +//WId wm_create_hidden_window(const char *className = "Button", const char *windowName = "hidden_window");
1 +# wintimer.pri
2 +# 7/20/2011 jichi
3 +win32 {
4 +
5 +DEFINES += WITH_LIB_WINMAKER
6 +
7 +#LIBS += -lkernel32 -luser32
8 +
9 +DEPENDPATH += $$PWD
10 +
11 +HEADERS += $$PWD/winmaker.h
12 +SOURCES += $$PWD/winmaker.cc
13 +}
14 +
15 +# EOF