Showing
8 changed files
with
241 additions
and
0 deletions
vnr/ntdll/ntdll.h
0 → 100644
This diff could not be displayed because it is too large.
vnr/ntdll/ntdll.pri
0 → 100644
vnr/ntinspect/ntinspect.cc
0 → 100644
1 | +// ntinspect.cc | ||
2 | +// 4/20/2014 jichi | ||
3 | +#include "ntdll/ntdll.h" | ||
4 | +#include "ntinspect/ntinspect.h" | ||
5 | + | ||
6 | +//#ifdef _MSC_VER | ||
7 | +//# pragma warning(disable:4018) // C4018: signed/unsigned mismatch | ||
8 | +//#endif // _MSC_VER | ||
9 | + | ||
10 | +namespace { // unnamed | ||
11 | +// Replacement of wcscpy_s which is not available on Windows XP's msvcrt | ||
12 | +// http://sakuradite.com/topic/247 | ||
13 | +errno_t wcscpy_safe(wchar_t *buffer, size_t bufferSize, const wchar_t *source) | ||
14 | +{ | ||
15 | + size_t len = min(bufferSize - 1, wcslen(source)); | ||
16 | + buffer[len] = 0; | ||
17 | + if (len) | ||
18 | + memcpy(buffer, source, len * 2); | ||
19 | + return 0; | ||
20 | +} | ||
21 | +} // unnamed namespace | ||
22 | + | ||
23 | +NTINSPECT_BEGIN_NAMESPACE | ||
24 | + | ||
25 | +BOOL getCurrentProcessName(LPWSTR buffer, int bufferSize) | ||
26 | +{ | ||
27 | + //assert(name); | ||
28 | + PLDR_DATA_TABLE_ENTRY it; | ||
29 | + __asm | ||
30 | + { | ||
31 | + mov eax,fs:[0x30] | ||
32 | + mov eax,[eax+0xc] | ||
33 | + mov eax,[eax+0xc] | ||
34 | + mov it,eax | ||
35 | + } | ||
36 | + // jichi 6/4/2014: _s functions are not supported on Windows XP's msvcrt.dll | ||
37 | + //return 0 == wcscpy_s(buffer, bufferSize, it->BaseDllName.Buffer); | ||
38 | + return 0 == wcscpy_safe(buffer, bufferSize, it->BaseDllName.Buffer); | ||
39 | +} | ||
40 | + | ||
41 | +BOOL getModuleMemoryRange(LPCWSTR moduleName, DWORD *lowerBound, DWORD *upperBound) | ||
42 | +{ | ||
43 | + //assert(lower); | ||
44 | + //assert(upper); | ||
45 | + PLDR_DATA_TABLE_ENTRY it; | ||
46 | + LIST_ENTRY *begin; | ||
47 | + __asm | ||
48 | + { | ||
49 | + mov eax,fs:[0x30] | ||
50 | + mov eax,[eax+0xc] | ||
51 | + mov eax,[eax+0xc] | ||
52 | + mov it,eax | ||
53 | + mov begin,eax | ||
54 | + } | ||
55 | + | ||
56 | + while (it->SizeOfImage) { | ||
57 | + if (_wcsicmp(it->BaseDllName.Buffer, moduleName) == 0) { | ||
58 | + DWORD lower = (DWORD)it->DllBase; | ||
59 | + if (lowerBound) | ||
60 | + *lowerBound = lower; | ||
61 | + | ||
62 | + if (upperBound) { | ||
63 | + DWORD upper = lower; | ||
64 | + MEMORY_BASIC_INFORMATION mbi = {}; | ||
65 | + DWORD size = 0; | ||
66 | + do { | ||
67 | + DWORD len; | ||
68 | + // Nt function is needed instead of VirtualQuery, which only works for the current process | ||
69 | + ::NtQueryVirtualMemory(NtCurrentProcess(), (LPVOID)upper, MemoryBasicInformation, &mbi, sizeof(mbi), &len); | ||
70 | + if (mbi.Protect & PAGE_NOACCESS) { | ||
71 | + it->SizeOfImage = size; | ||
72 | + break; | ||
73 | + } | ||
74 | + size += mbi.RegionSize; | ||
75 | + upper += mbi.RegionSize; | ||
76 | + } while (size < it->SizeOfImage); | ||
77 | + | ||
78 | + *upperBound = upper; | ||
79 | + } | ||
80 | + return TRUE; | ||
81 | + } | ||
82 | + it = (PLDR_DATA_TABLE_ENTRY)it->InLoadOrderModuleList.Flink; | ||
83 | + if (it->InLoadOrderModuleList.Flink == begin) | ||
84 | + break; | ||
85 | + } | ||
86 | + return FALSE; | ||
87 | +} | ||
88 | + | ||
89 | +BOOL getCurrentMemoryRange(DWORD *lowerBound, DWORD *upperBound) | ||
90 | +{ | ||
91 | + WCHAR procName[MAX_PATH]; // cached | ||
92 | + *lowerBound = 0; | ||
93 | + *upperBound = 0; | ||
94 | + return getCurrentProcessName(procName, MAX_PATH) | ||
95 | + && getModuleMemoryRange(procName, lowerBound, upperBound); | ||
96 | +} | ||
97 | + | ||
98 | +NTINSPECT_END_NAMESPACE | ||
99 | + | ||
100 | +// EOF |
vnr/ntinspect/ntinspect.h
0 → 100644
1 | +#pragma once | ||
2 | + | ||
3 | +// ntinspect.h | ||
4 | +// 4/20/2014 jichi | ||
5 | + | ||
6 | +#include <windows.h> | ||
7 | + | ||
8 | +#ifndef NTINSPECT_BEGIN_NAMESPACE | ||
9 | +# define NTINSPECT_BEGIN_NAMESPACE namespace NtInspect { | ||
10 | +#endif | ||
11 | +#ifndef NTINSPECT_END_NAMESPACE | ||
12 | +# define NTINSPECT_END_NAMESPACE } // NtInspect | ||
13 | +#endif | ||
14 | + | ||
15 | +NTINSPECT_BEGIN_NAMESPACE | ||
16 | + | ||
17 | +/// Get current module name in fs:0x30 | ||
18 | +BOOL getCurrentProcessName(_Out_ LPWSTR buffer, _In_ int bufferSize); | ||
19 | + | ||
20 | +/** | ||
21 | + * Get the memory range of the module if succeed | ||
22 | + * See: ITH FillRange | ||
23 | + */ | ||
24 | +BOOL getModuleMemoryRange(_In_ LPCWSTR moduleName, _Out_ DWORD *lowerBound, _Out_ DWORD *upperBound); | ||
25 | + | ||
26 | +/// Get memory of the current process | ||
27 | +BOOL getCurrentMemoryRange(_Out_ DWORD *lowerBound, _Out_ DWORD *upperBound); | ||
28 | + | ||
29 | +NTINSPECT_END_NAMESPACE | ||
30 | + | ||
31 | +// EOF |
vnr/ntinspect/ntinspect.pri
0 → 100644
vnr/winmaker/winmaker.cc
0 → 100644
1 | +// winmaker.cc | ||
2 | +// 2/1/2013 jichi | ||
3 | + | ||
4 | +#include "winmaker/winmaker.h" | ||
5 | +#include <windows.h> | ||
6 | +//#include <commctrl.h> | ||
7 | + | ||
8 | +#ifdef _MSC_VER | ||
9 | +# pragma warning (disable:4800) // C4800: forcing value to bool | ||
10 | +#endif // _MSC_VER | ||
11 | + | ||
12 | +// See: http://www.codeguru.com/cpp/w-p/dll/tips/article.php/c3635/Tip-Detecting-a-HMODULEHINSTANCE-Handle-Within-the-Module-Youre-Running-In.htm | ||
13 | +extern "C" IMAGE_DOS_HEADER __ImageBase; | ||
14 | +namespace { // unnamed | ||
15 | + inline HMODULE _get_module() { return reinterpret_cast<HMODULE>(&__ImageBase); } | ||
16 | +} // unnamed | ||
17 | + | ||
18 | +bool wm_register_hidden_class(LPCWSTR className) | ||
19 | +{ | ||
20 | + WNDCLASSEX wx = {}; | ||
21 | + wx.cbSize = sizeof(wx); | ||
22 | + wx.lpfnWndProc = ::DefWindowProc; | ||
23 | + wx.hInstance = ::GetModuleHandle(nullptr); | ||
24 | + wx.lpszClassName = className; | ||
25 | + return ::RegisterClassEx(&wx); | ||
26 | +} | ||
27 | + | ||
28 | +wm_window_t wm_create_hidden_window(LPCWSTR windowName, LPCWSTR className, wm_module_t dllHandle) | ||
29 | +{ | ||
30 | + //return ::CreateWindowExA(0, className, windowName, 0, 0, 0, 0, 0, HWND_MESSAGE, nullptr, dllHandle, nullptr); | ||
31 | + HINSTANCE module = reinterpret_cast<HINSTANCE>(dllHandle); | ||
32 | + if (!module) | ||
33 | + module = _get_module(); | ||
34 | + return ::CreateWindowEx(0, className, windowName, 0, 0, 0, 0, 0, 0, NULL, module, NULL); | ||
35 | +} | ||
36 | + | ||
37 | +bool wm_destroy_window(wm_window_t hwnd) | ||
38 | +{ return ::DestroyWindow(reinterpret_cast<HWND>(hwnd)); } | ||
39 | + | ||
40 | + | ||
41 | +// EOF | ||
42 | +// | ||
43 | +//void wm_init() { ::InitCommonControls(); } | ||
44 | +//void wm_destroy() {} | ||
45 | +//bool wm_destroy_window() { return ::DestroyWindow(hwnd); } | ||
46 | + |
vnr/winmaker/winmaker.h
0 → 100644
1 | +#pragma once | ||
2 | + | ||
3 | +// winmaker.h | ||
4 | +// 2/1/2013 jichi | ||
5 | + | ||
6 | +#include <windows.h> | ||
7 | +typedef void *wm_window_t; // HWMD | ||
8 | +typedef void *wm_module_t; // HMODULE | ||
9 | + | ||
10 | +bool wm_register_hidden_class(LPCWSTR className = L"hidden_class"); | ||
11 | + | ||
12 | +wm_window_t wm_create_hidden_window( | ||
13 | + LPCWSTR windowName = L"hidden_window", | ||
14 | + LPCWSTR className = L"Button", // bust be one of the common control widgets | ||
15 | + wm_module_t dllHandle = nullptr); | ||
16 | + | ||
17 | +bool wm_destroy_window(wm_window_t hwnd); | ||
18 | + | ||
19 | +// EOF | ||
20 | + | ||
21 | +//#ifdef QT_CORE_LIB | ||
22 | +//#include <QtGui/qwindowdefs.h> | ||
23 | +//WId wm_create_hidden_window(const char *className = "Button", const char *windowName = "hidden_window"); |
-
Please register or login to post a comment